Ask HN: Did you use Dokku or Flynn in 2014? Was it worth it? - <AUTHOR> <comment><USER2> So, I wrote Dokku, helped design Docker, was co-architect of Flynn, and am now in R&D partnership with Deis. I also made Localtunnel, RequestBin, Hacker Dojo, etc etc if anybody is keeping track. I guess I'm not who this question was intended for, but I figured I'd share some context.

I can't speak as much to Flynn right now, but here is a fairly recent blog post about the current status of Dokku: [http://progrium.com/blog/2014/10/28/deis-breathes-new- life-i...](http://progrium.com/blog/2014/10/28/deis-breathes-new-life-into- dokku/)

tl;dr, after a long lull between 2013 and 2014, its activity has picked up and is slowly working towards a 1.0 including a major refactoring to address a lot of issues and bring it up to modern standards. In fact, here is our refactoring doc in progress: [https://github.com/progrium/dokku/wiki/Refactoring](https://github.com/progrium/dokku/wiki/Refactoring)

I feel the flaws of these projects quite deeply, especially Dokku. But I'm surprised to still run into so many people (just not as many here) that really love Dokku. Without them I would not be motivated to come back to it and make it what it should be.

Keep in mind Dokku was the first killer app for Docker and a lot of my design influence on Docker was to be able to easily make something like Dokku and eventually systems like Flynn, Deis, etc. But also so many other things...

</comment><comment><USER3> I used Dokku on DigitalOcean. Was it worth it? Honestly? No.

Would it have been worth it if there was any sort of clear roadmap for the future of Dokku, or anything coming out of Flynn other than "a first beta" (which I think I've seen at the top of flynn.io for literally months now)? Perhaps.

I eventually got fed up with the lack of direction, ditched Dokku, and went with a pure Docker-solution (which I documented here: [https://medium.com/@robringham/how-interviewpad-uses- docker-...](https://medium.com/@robringham/how-interviewpad-uses-docker-for- easy-deployments-on-digitalocean-f85e52f3c9da)), and I don't feel like I lost much, and I don't regret moving away from Dokku. I feel like I have much more control now (at the cost of the Docker learning curve, which honestly wasn't that bad).

From my post on Medium:

"It [Dokku] worked great for a basic setup, but ultimately was simply not mature enough — minor customizations were straightforward, but anything past that (particularly around security) involved rolling up your sleeves and being willing to wade through Dokku's source code (and that of Dokku's plugins). Lack of direction in the project was another concern — Dokku is on hiatus, with Flynn, Dokku's spiritual successor, in apparent eternal beta/preview mode."

To make up for losing Dokku's nice Heroku-like Git deployment, I rolled my own script-based Docker image swapping system for deployments, which has worked great.

<comment><AUTHOR> several other comments mentioned [https://github.com/dokku-alt/dokku- alt](https://github.com/dokku-alt/dokku-alt)

did you check it out? do you think it could fill in the gaps you mentioned?

<comment><USER3> Interesting. I haven't heard of it, but it certainly looks interesting.

Having ditched Dokku and gone my own way, the one concern I'd have in going back to something like Dokku is that it always felt like there was too much "magic" going on beneath the hood, which made me nervous - particularly with respect to security.

RE: security - one thing I had a hard time of figuring out with Dokku was how the underlying Docker system played with firewalls (something I still struggle with, but at least I don't have a layer of scripty Dokku magic between me and Docker now).

<comment><USER4> Dokku didn't - and still does not - do anything re: firewalls. Thats up to the server administrator to handle. For instance, you might choose to have this on a VPC in AWS, in which case you wouldn't need much of a firewall. Or if you're using this on Digital Ocean where there aren't Security Groups, it would be up to you to setup ipfw or iptables.

As far as magic, I'm not sure what you are getting at. The entire source is there for you to look at, and is actually quite readable. I don't write bash all day, but it was quite easy for me to jump in as a maintainer of dokku.

</comment></comment></comment></comment><comment><AUTHOR> Background information for readers:

Dokku and Flynn are

Flynn:

"...something like Heroku that we could host ourselves..."

~ [https://flynn.io/about](https://flynn.io/about)

Dokku:

"Docker powered mini-Heroku."

~ [https://github.com/progrium/dokku](https://github.com/progrium/dokku)

\</comment><comment></comment><comment>

where heroku is a platform-as-a-service for hosting your rails/node/whatever websites/webapps

<comment><USER5> Flynn has a much, much larger scope than Dokku or arguably even Heroku. To complete your quote:

"We knew we wanted something like Heroku that we could host ourselves, but we also knew that a Heroku clone wasn't enough. We needed something suited to today's needs. It wasn't just about deploying stateless web apps, it was scaling them, provisioning and managing databases, and ideally the ability to run anything that could run on Linux all inside a single platform."

Another product mentioned in this thread is Deis, "a lightweight PaaS with a Heroku-inspired workflow".

~ [http://deis.io/overview/](http://deis.io/overview/)

</comment></comment><comment><USER6> We started using dokku just before 0.2.0 released for hosting our apps. One place it initially lacked was process management. If you wanted anything outside of your 'web' process in your Procfile, you were out of luck. I wrote a couple plugins[1][2] to handle that.

It worked alright for single sever deployments. When attempting to scale to a multi-server setup, dokku wasn't the right choice. I went down the rabbit hole of docker orchestration on top of CoreOS, but eventually backed out to go with Cloud66[3].

[1]: [https://github.com/statianzo/dokku- shoreman](https://github.com/statianzo/dokku-shoreman) [2]: [https://github.com/statianzo/dokku- supervisord](https://github.com/statianzo/dokku-supervisord) [3]: [https://www.cloud66.com/](https://www.cloud66.com/)

</comment><comment><USER7> I've just started using Deis at work recently. Dokku looks like it was a small project sponsored by the company behind Deis. I haven't looked much at dokku- alt.

The thing that I really like about Deis is it supports deployments off of docker images in a private repo on top of git push deploys.

One of the things we do is host a REST service backed by data we generate. We can have jenkins automatically build and publish a docker container to our internal repo, then it's two REST calls to Deis to update the docker container that is running. We generate the data in Hadoop through a longish oozie workflow weekly and we can make two REST calls to repoint the REST service to some new database tables.

I also like that each layer or part of Deis can be swapped out. Want to run haproxy for the load balancing layer instead of nginx? Someone probably has a container that can be dropped in instead. Want swap a more advanced scheduler for etcd, you can swap in Mesos, YARN, or even Flynn's scheduler.

</comment><comment><USER8> I volunteer as the backend rails dev at [http://balloonchallenge.org/](http://balloonchallenge.org/) and ended up doing our ops, using Dokku to handle our main site's pushes. I'm terrible at devops and Dokku has been bulletproof so far. It's been flexible enough that when I needed to do things like edit some nginx config, it wasn't an issue.

I've hit some issues with docker and server restarts, but that's mostly due to my own incompetence with docker.

Overall it's a great tool that I recommend to a lot of friends. Paying the ridiculous Heroku prices just to be able to do a code push via git is silly, and Dokku largely solves that need among others.

</comment><comment><USER9> Using dokku for a few BigCo projects since late 2012.

I want to do what another commenter (renegar) mentions, and simply use Docker/machine/compose, now that that is a viable option. For my next green- field project, I probably will.

Dokku doesn't try to realize _all_ of the benefits of containerization by a long shot, but it's the most frictionless way to get started with containerization for small projects. The stack is a pretty common one (ubuntu, nginx, git push to deploy) and everything residing either in bash script or a docker image means it's almost as easy to extend as an ordinary, non- containerized server would be.

</comment><comment><USER10> Heavy Docker user. Played with but have not used them, because Docker+machine+fig (now compose) already gives me everything I need (isolation, repeatable build, atomic deploy) without another infra layer to worry about.

Then again, I'm a one-man 360 shop and a control freak, and I'm not afraid to slap together a webhook-eating build+deploy process on a whim. So, my use case is probably not representative of Docker users in general.

<comment><USER11> Do you deploy in clusters? That's my main gap with Docker, and I haven't decided how to cover it. Deis[1] is the frontrunner at the moment, but a DIY solution is more appealing to me. I like to understand all the parts of my stack that I can.

1\. [http://deis.io](http://deis.io)

<comment><USER12> I do deploy in clusters, and Mesos is pretty much the default for me. It's much, much smarter in terms of work allocation than Deis or the like, it's not tied strictly to Docker, and, having been in its codebase, I trust its engineering much more than the alternatives. It's cautiously-designed software, and it is the better for it.

I would emphatically advise against rolling your own unless it's for projects you don't otherwise care about. Security and scalability are not trifles, and everybody else has already stepped on the rakes.

</comment></comment></comment><comment><USER13> We are using dokku for our internal applications and it works really great. The development stagnated a bit for the last months, but since the deis guys picked up the project it seams that they are starting to work on new features.

I also made a zero config dokku-cli[1] to get it more herokuish.

[1]: [https://github.com/SebastianSzturo/dokku- cli](https://github.com/SebastianSzturo/dokku-cli)

</comment><comment><USER14> Yes.

Flynn wasn't complete enough to use.

Dokku was too much of a moving target.

Deis requires substantially more resource than I'm willing to stand up for a minimal project.

My ideal solution would be a Dokku-like on a hardened CoreOS. I'm hoping some of these projects turn an eye to security in 2015 -- hardened toolchains, kernels, etc.

</comment><comment><USER15> The ideas behind 12 factor principles are pretty solid, however Im no longer sold on them as being the one and only way, in other words, sometimes your company setup might be better supported with alternative opinions (e.g. context rich logging, smart frontend routing - e.g. exploiting haproxy/nginx directives rather than dumb proxy forwarding). I guess this was contributing reason I didnt take openruko forward (although some others did). It is great there are supported/maintained heroku like implementations such as dokku/flynn but it might not be ideal or compatible with your style of devops. I guess my advice would be to take inspirations from these systems but ultimately you have weigh up if its a good fit.

</comment><comment><USER16> I build a bunch of small web apps with a pretty diverse range of stacks. I like Dokku because it lets me deploy the apps in a uniform way regardless of what I use to build each one.

It's convenient, but Docker is likely overkill for the kinds of apps that I'm building. I don't have a compelling need to isolate them, I'm mainly taking advantage of the fact that Dokku automates the process of putting together the runtime environment and fetching the dependencies.

Dokku is reliable enough for what I'm doing, but I would frankly be reluctant to use it in production for anything that I really cared about.

</comment><comment><USER17> Have been using dokku on DigitalOcean since the 0.2.0, for personal projects. After bumping up against the poor quality of database plugins, I found "dokku- alt", which comes with pre-packaged well-functioning plugins for common use- cases, and seems to be good enough for my needs.

When evaluating the ecosystem, I got the impression Flynn has stalled out, and Deis looks to be too large for my modest requirements.

What I'd really like is ElasticBeanstalk or Heroku, but the per-app pricing quickly breaks the bank. My kingdom for a graceful way to host many tiny, low- traffic apps for cheap!

</comment><comment><USER18> I used Dokku, and tried real hard to get it to work, but it just didn't work out. Getting started was easy, but once you start configuring things, and keep adding plugins for everything that you are doing, it keeps getting crazier.

In my case, I gave up when I couldn't get dokku to start a (critical) container on its own after a reboot. Ultimately, I think dokku is a good thing (in general) but to get it to succeed, it needs to get decoupled with docker a bit, so that people like me can use it easily without having to deal with docker.

</comment><comment><USER19> Dokku-alt has been tremendously useful for testing and small projects.

[https://github.com/dokku-alt/dokku-alt](https://github.com/dokku-alt/dokku- alt)

Dokku-alt is a fork of dokku.

<comment><USER20> So looking through the link, the value add appears to be in the plugins. For your use case what is the main benefit of using dokku-alt?

<comment><USER21> Dokku-alt lets me use a Dockerfile to build applications.

<comment><USER4> Dokku also has this feature as of the 0.3.15 release[1].

[1] [https://github.com/progrium/dokku/releases/tag/v0.3.15](https://github.com/progrium/dokku/releases/tag/v0.3.15)

</comment></comment></comment></comment><comment><USER22> Yep. We (Loomio) have been using Dokku as an alternative to Heroku hosting - our main site is still on heroku, but we know that many people are using Dokku for Loomio hosting.

I spent about a week writing up the documentation: [http://github.com/loomio/loomio/wiki](http://github.com/loomio/loomio/wiki)

Since doing that we've seen a big increase in the number of poeple contributing code and helping out on Github. It's certainly been worth it from that point of view.

</comment><comment><USER23> We gave both Dokku and Flynn a try earlier in 2014. Dokku ended up just being too simple for our needs—we're deploying to a cluster, not a single machine. Flynn still felt too immature and definitely isn't optimized for microservice architectures.

Instead, we hired progrium (the creator of Dokku) to help us build out a Fleet & CoreOS based deployment infrastructure. With a couple custom bash scripts, all run through CircleCI, it's worked pretty well so far.

</comment><comment><USER24> I used Dokku (and Dokku-alt) on Digital Ocean with the goal of making deploying easier. I ended up getting rid of it (and Docker) because for a small scale system, Docker wasn't worth the overhead (vs capistrano and ruby, or heroku's git push). On the other hand, at my last job -- where scale was much larger, we implemented a Docker orchestration system to handle our SOA using Consul as a registration system.

</comment><comment><USER25> I played around with it quite a bit in early 2014 and even wrote a plugin for it. It gave me a better understanding of Docker and abstracting things into containers. The internals are all bash scripts so it's pretty easy to follow how it works and modify it.

[1]: [https://github.com/sehrope/dokku-logging- supervisord](https://github.com/sehrope/dokku-logging-supervisord)

</comment><comment><USER21> I use Dokku-alt but have previously done most of the groundwork for implementing my own such system: [https://christine.website/projects/flitter](https://christine.website/projects/flitter)

It's been mostly untouched since December, but it is 100% Go and runs on top of CoreOS.

</comment><comment><USER26> I started out with Dokku and ran into a number of issues. After moving to dokku-alt I've found it to be very useful for running small services.

</comment><comment><USER27> Excellent tools for setting up new services without mch effort; I found it ideal for microservices and even hackfests.

</comment><comment><USER28> I've tried to use Dokku in the past but opted for flynn and deis.io

</comment><comment><USER29> you may want to expand on this question. what is the background of this?

Are you looking for experience in a professional or personal setting? Large or small scale deployments?

</comment><comment><USER30> No, and no.

Both are pretty lackluster and honestly not worth the effort.

</comment><comment><USER31> And what about Tsuru? ([https://tsuru.io](https://tsuru.io))

</comment><comment><USER32> I have no idea what either of those things are

<comment><USER33> [https://google.com](https://google.com) will help you

</comment></comment><comment><USER34> I've never heard of either of these projects. Context? What are they?

<comment><USER11> If you haven't heard of them, you haven't used them, so why comment? If you want to know what they are, you could just as easily Google them as post.</comment></comment>


Teen hacks Pentagon websites, gets thanked for finding 'bugs' - <AUTHOR> http://www.reuters.com/article/us-usa-pentagon-cyber-idUSKCN0Z32IU <comment><USER2> Click-baity title. The teen participated in a bug bounty and found some (know) vulnerabilities.

</comment><comment><USER3> A whole thank you?

<comment><USER4> Well I did get to meet with the Secretary of Defense and get his personal challenge coin! And they did pay out bounties, I just wasn't the first to report the ones I sent in (despite sending most of them in on the first day).</comment></comment>


Nine New Findings About Inequality in the United States - <AUTHOR> http://www.nytimes.com/interactive/2016/12/16/business/economy/nine-new-findings-about-income-inequality-piketty.html <comment><USER2> What's the conclusion? Pretax incomes have stopped growing for anyone except the top 1–10%. (It's been forty years of income stagnation for the bottom 50% and twenty years for the next 40%.)

It's actually not so bad when you add back the huge increase in entitlement programs like Social Security and Medicare.

Maybe we should start getting used to the idea of a welfare state supporting the vast majority of its citizens.

</comment><comment><USER3> It would be interesting to look at global charts.</comment>


How and why web developers should file bug reports and test browser nightlies - <AUTHOR> http://ejohn.org/blog/a-web-developers-responsibility/

<comment><USER2> Browser developers should make it easier for us to send bug reports :-)

It would be nice to have a button on my toolbar which just bundles up everything I'm looking at, attaches it to a bug report with all of the browser details filled in, and lets me type a little text. If you want my bug reports, you need to make it easier to give it to you than to swear about it.

<comment><USER3> IE8 has exactly that:

[http://www.microsoft.com/downloads/details.aspx?familyid=A95...](http://www.microsoft.com/downloads/details.aspx?familyid=A950A427-D16C-4379-B641-2F319A69F70D&displaylang=en)

<comment><USER2> Cool. Now integrate it into the developer toolbar that I am more likely to have installed.

</comment></comment></comment><comment><USER4> You should check out <http://web.mac.com/reinholdpenner/Software/Home.html> if you are on OSX. Reinhold made three great apps which download the lastest version of Firefox, Webkit and Camino for you automagically. They are Firefix, Nightshift and CaminoKnight respectively.

An absolute must to follow John's advice.</comment>


How #badBIOS may have persisted (and spread undetected) - <AUTHOR> http://spritesmods.com/?art=hddhack&foo

<comment><AUTHOR> Well, so much for "how did this went undetected" and "where is the storage". Everyone just has looked on the motherboard components IIRC, but there's a lot more of equipment in a computer than just a mobo and a CPU.

Caused quite a stir (460-something points) three months ago, but now with the badBIOS stuff popping up everywhere, I've seen no one who mentions this here...</comment>


5 years in prison for Egyptians who publish square massacre sign on social media - <AUTHOR> http://arabcrunch.com/2013/12/5-years-in-prison-for-egyptians-who-publish-cairo-square-massacre-sign-rabea-on-social-media.html <comment><USER2> As I see it, America has always had a big issue with cults of personality since WWII and will do close to anything to get rid of them, including the 'democratically' elected, whatever that actually means.

While the public foreign policy statement is something like 'oh, if your people elect you, you're a-ok' it's much more like 'if you're a friend of the U.S. and don't do anything we find objectionable, you're a-ok'. Objectionable being, basically murdering your own people enmasse and or giving signs that you're not going to be a benevolent dictator, or trying to get more than conventional weapons.

<comment><USER3> >As I see it, America has always had a big issue with cults of personality since WWII

Where exactly have you seen this?

>While the public foreign policy statement is something like 'oh, if your people elect you, you're a-ok' it's much more like 'if you're a friend of the U.S. and don't do anything we find objectionable, you're a-ok'. Objectionable being, basically murdering your own people enmasse and or giving signs that you're not going to be a benevolent dictator, or trying to get more than conventional weapons.

How exactly did Mossadegh, Allende, or Arbenz fall under this rule of thumb? The US has a history of overthrowing democratically elected leaders and installing mass murdering despots who were friendly to gigantic US businesses.

Has the US _ever_ overthrown a dictator in favor of democratic elections?

</comment></comment><comment> at-fates-hands >>> When the Egyptian army which is baked by the US government launched a coupe against a democratically elected president.

Is it just me or has the US foreign policy been upside down the last 5-8 years??

<comment><USER4> Geopolitics is complicated, now as much as any time in history.

The US has been doing "OK" with regard to Egypt lately but there's really no good way to handle what's going on there. On the face of it Morsi was democratically elected but he also gave himself unlimited powers and was on his way to becoming just as much a tyrant as Mubarak ever was. He was deposed by a military coup which has its own problems and now Egypt is devolving into what seems to be an inevitable sectarian war (just as is happening in Syria, Lebanon, Iraq, and Pakistan/Afghanistan).

Calling the Egyptian army "backed by the US government" is a bit of a stretch. Prior to the coup the US shipped 12 F-16 fighters and millions in aid to Egypt under Morsi, since the coup the US has delayed further scheduled deliveries of F-16s and aid, largely as a protest for the harsh actions of the government against dissident groups. Nevertheless, there isn't exactly a good side to back in Egypt at present. It's not as though there's a nice, peaceful secular organization dedicated to democracy and individual liberty just quietly growing in the shadows. Instead there are a bunch of folks who want to seize power to further their own interests.

Removing Qaddafi in Libya was almost certainly a good move though the followup there has been lacking. And the failure to engage in a meaningful way in the middle east in general has been frustrating. It's a hard problem, but sitting back and fucking around when there's serious shit going down isn't really the best alternative. The middle east is going to be hugely different over the next decade, but how much influence the US will have over that shape (to guide it away from islamic fundamentalism and totalitarianism specifically) is very much in doubt at present.

<comment><USER3> >Calling the Egyptian army "backed by the US government" is a bit of a stretch

No, it's literally true. Although I've heard that an end to US military aid to Egypt would simply mean an end to US influence in Egypt, as they could easily secure support elsewhere without the restrictions that the US imposes on who they can deal with.

>It's not as though there's a nice, peaceful secular organization dedicated to democracy and individual liberty just quietly growing in the shadows.

This is the result of US support to the Egyptian government. As elsewhere in the Middle East, the US propped up a dictator and assisted him in exterminating all secular opposition. There's no way to do that to the religious opposition, so when the dictator leaves, all you have to fill the vacuum are fundamentalists.

<comment><USER4> The idea that the current Egyptian regime is "US backed" or that it is significantly more "US backed" than Morsi's regime, is frankly not supported by reality.

US support for Mubarak's regime was always problematic but it was theoretically in service to the greater good of maintaining peace between Egypt and Israel (which lasted for decades). When Mubarak started murdering protesters the support of the US government for him evaporated rather quickly.

</comment></comment></comment></comment><comment> guard-of-terra I don't like islamists but that's exactly what makes them feel righteous and multiplies their numbers.

</comment><comment><USER5> I can't read the article. Site seem to be or overloaded. (or DDOS:ed?)

<comment><USER6> Mirror [http://archive.is/ESfqw](http://archive.is/ESfqw)

Here is the link labelled "Including this geek" [http://archive.is/UEEoy](http://archive.is/UEEoy)

Here is the banned sign: [http://i.imgur.com/mzhp9V8.jpg](http://i.imgur.com/mzhp9V8.jpg)</comment></comment>


MetaMask replaces MIT License, claims ownership of all forks - <AUTHOR> https://github.com/MetaMask/metamask-extension/commit/044bc016e37d45720b13e0a73fd9107fe290f0f1#diff-9879d6db96fd29134fc802214163b95a <comment><USER2> Note that MetaMask, by operating a public repository on GitHub, has agreed to grant all GitHub users worldwide the right to fork their public repository on GitHub, regardless of the terms otherwise stated in their new license.

> _If you set your pages and repositories to be viewed publicly, you grant > each User of GitHub a nonexclusive, worldwide license to use, display, and > perform Your Content through the GitHub Service and to reproduce Your > Content solely on GitHub as permitted through GitHub 's functionality (for > example, through forking)._

(Disclaimer, I am not your lawyer.)

</comment><comment><USER3> Anyone could just fork from the commit before this and then their fork can legally stay MIT right? This license change only applies to future updates?

<comment><USER4> That's correct. They can't remove the MIT from forks—that would be illegal.

</comment></comment><comment><USER5> Wow, knowing the Ethereum community, this is a very quick way to start developing bad blood between the very open-source liberal community and this pretty important piece of Web3 infrastructure...

</comment><comment><USER6> This isn't legal right? What does this mean and are there other examples?

Is it similar to this? [https://www.cnet.com/news/pulling-back-from-open- source-hard...](https://www.cnet.com/news/pulling-back-from-open-source- hardware-makerbot-angers-some-adherents/)

<comment><USER7> I am not a lawyer.

There's _generally_ nothing stopping a copyright holder from ceasing their distribution under an old license, and starting distribution with a new one. However, detaro linked [https://github.com/MetaMask/metamask- extension/issues/9285](https://github.com/MetaMask/metamask- extension/issues/9285) which brings up that this new license probably violates the license terms of it's GPLv3 dependencies.

Additionally, if they've accepted any pull requests without requiring a contributor agreement assigning copyright to them, they might be trying to relicense code they don't have exclusive copyright over - which AFAIK would make removing the MIT license a violation of said MIT license in that context. (They don't need a license to grant themselves the right to do what they want with their own code, but doing what they want with other people's code is another story.)

Additionally, it's not automatically retroactive - if you've got a copy of the old software (trivial via git) you can presumably still hard fork under the original MIT license terms - it contains no privisos for force-updating the license for anyone who has a copy.

<comment><USER8> Also technically I guess (IANAL) you might have to prove that you obtained the source code prior to the license change. We like to say code itself is licensed such and such, but in reality code is licensed _to_ somebody. If you just place the code somewhere for a month with a license next to it and take it down again, and somebody later comes and wants to get those terms, it's probably too late.

OTOH please correct me if I'm wrong. Law contains many unintuitive things like contracts by handshake and so on :-)

<comment><USER9> Whatever hypothetical you're posing now is too far removed from this situation and too obscure to spend energy working it out here. It's best to take a page from the Supreme Court and consider what's relevant to the facts as they actually exist for this situation and avoid unnecessarily burdening ourselves with imagining counterfactuals.

The code was published under a public license, it has been available long enough to garner thousands of commits from over 192 "contributors" (albeit some of whom work for MetaMask), and it has over 1.5k forks. Also, there is no contract.

</comment></comment></comment></comment><comment><USER10> > To ensure the longevity of the services we have been providing to the world, > we feel that it is time that we establish some defensibility for our work > from large commercial forks.

If you read that as "for our _future_ work" it's just an ordinary license change. I suggest they add that clarification.

</comment><comment><USER11> also: [https://github.com/MetaMask/metamask- extension/issues/9285](https://github.com/MetaMask/metamask- extension/issues/9285)

</comment><comment><USER12> There is some interesting discussion in an open PR reverting this "[https://github.com/MetaMask/metamask- extension/pull/9286"](https://github.com/MetaMask/metamask- extension/pull/9286"). It sounds like they may have broken the copyright on code by outside contributors.

<comment><USER2> FYI, wrapping URLs in anything other than whitespace can break HN hyperlinking. The corrected link is [https://github.com/MetaMask/metamask- extension/pull/9286](https://github.com/MetaMask/metamask-extension/pull/9286) for anyone who got 404s at above.

</comment></comment><comment><USER13> Good luck with that.

</comment><comment><USER14> There's still issues preventing this re-licensing from being valid. [https://github.com/MetaMask/metamask- extension/issues/9292](https://github.com/MetaMask/metamask- extension/issues/9292)

</comment><comment><USER15> Stallman goes brrrrrrr.....</comment>


Obama Recruits Goldman, Google to Help Refugees Fleeing Wars - <AUTHOR> http://www.bloomberg.com/politics/articles/2016-06-30/obama-recruits-goldman-google-to-help-refugees-fleeing-wars <comment><USER2> How many missiles, bullets and guns has the US sent to Syria?

Thanks Obama!</comment>


Spammers expose their entire operation through bad backups - <AUTHOR> http://www.csoonline.com/article/3176433/security/spammers-expose-their-entire-operation-through-bad-backups.html <comment><USER2> It puzzles me that all these spam/fishing operations are being uncovered by an accident and there's no proactive private or nonprofit organizations pursuing these criminals.

Overall our current state of (an average user) security can be described as Swiss cheese where anyone with malicious intent can poke a hole and use it without any repercussions.

<comment><USER3> There are people who do this. ShadowServer comes to mind. A number of large companies (Google, Microsoft, ISPs, etc.) run anti-spam operations.

It's harder than you might expect to do effectively.

<comment><USER4> But is there an international interpol-style/black helicopters operation against such types. If there's one class of people I'd be glad to see have their human rights trampled, it would be spammers.

<comment><USER5> Or you know, we could uphold the rule of law and punish rule breakers within the framework we already have.

</comment></comment></comment></comment><comment><USER6> This talks about misconfigured rsync being the vector.

However, the researcher that found it says:

 _" The search engine at Shodan.io had indexed their IPs as running publicly accessible MongoDB instances"_[1]

The screenshot looks like some kind of mongo explorer type UI: [http://imgur.com/DzNthuy](http://imgur.com/DzNthuy) Probably MongoVue: [https://mongopi.files.wordpress.com/2012/11/mongovue.png](https://mongopi.files.wordpress.com/2012/11/mongovue.png)

So it appears to be the "mongo installed with no password, and open to the internet" thing again.

[1][https://www.reddit.com/r/apple/comments/3wq9fc/massive_data_...](https://www.reddit.com/r/apple/comments/3wq9fc/massive_data_breach/)

<comment><USER7> That post is a year old... I don't think it's talking about the same breach.

<comment><USER6> Ah, wow. My mistake then. Interesting that MacKeeper is related to both.

</comment></comment></comment><comment><USER8> The number of emails in the database isn't even the interesting part. What's more noteworthy is the fact that the spammers have figured out how to evade Google and Yahoo SMTP servers' rate-limiting techniques, and the sheer amount of volume they have at their disposal relative to the compute resources they have.

<comment><USER9> I hope Google does something about this. The problem with spam is that once you're on the spammers' lists, it's virtually impossible to get off it.

<comment><USER10> That's interesting, I never get spam in my inbox in Gmail, but my "spam folder" is constantly full. I wonder if gmail makes these spam emails appear as if they're "inboxing" to the spammers.

<comment><USER11> At the SMTP level, you can't tell the difference (spam or not). A bounce return message will tell you it fails, but the absence of a bounce message doesn't mean it was received, let alone got into an inbox.

The only way a sender can tell for sure their e-mail was delivered is to have tracking links: images and/or clickable links that include something to uniquely identify which address received the mail.

Most if not all e-mail clients block images, and many even disable links for unknown senders and/or messages that even remotely look like spam (eg: a non- zero spam score that is below the threshold to automatically reject or filter to a junk folder).

If you get tracked by one of these images or links, presumably you move from the "maybe working" e-mail address list to the "reads our messages" or "clicks our links" list, and at the very least means you contribute to making more money for the spammer when they sell that (higher-value) list.

<comment><USER12> > Most if not all e-mail clients block images

Gmail auto preloads (via their servers) all images in emails. You can turn it off though.

(lots of sources on internet about this, [http://www.guidingtech.com/13461/gmail-always-display- images...](http://www.guidingtech.com/13461/gmail-always-display-images- email/) for example)

<comment><USER11> I stand corrected. Must be a setting I changed at some point then, as I have it set to always ask.

It's a terrible setting, it should just be 'always ask'. Is there a legitimate use I'm missing? The only thing I can think of is for spammers to track if their spam went through, marketers of 'legit' mail to track the same thing, or a backdoor way to implement the atrocious 'read receipt' feature. None of those is at all beneficial to the user receiving the message.

<comment><USER10> I was delighted when they changed it from "always ask" to "show by default." Like I said, Gmail never puts spam through to me, so it saves me clicks.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> [https://news.ycombinator.com/item?id=13802559](https://news.ycombinator.com/item?id=13802559) is a better article, now marked as a dupe.

<comment><USER14> OK, we've changed the URL above to that from [https://mackeeper.com/blog/post/339-spammergate-the-fall- of-...](https://mackeeper.com/blog/post/339-spammergate-the-fall-of-an- empire).

</comment></comment><comment><USER15> So now MacKeeper will use those 1.4B accounts to lure people into installing their own software, and giving them more information?

</comment><comment><USER16> I didn't realize MacKeeper investigates other spammers, maybe helpful in develoiping their own best practices.

</comment><comment><USER17> I'd rather see Troy Hunt handling this... hoping they add the database to HIBP

<comment><USER18> Is it a "pawn" though? Your email address in their database does not necessarily mean your security has been compromised - just that your on a spam list somewhere?

<comment><USER19> They have added the "GeekedIn" leak from mid last year in the database even though technically none of the information was private (IIRC it was all scraped from GitHub's public API).

Sometimes getting on these lists is fairly harmless by itself, but they can end up leaking a large amount of data about some people.

Just knowing that an email address is used and active is a start, but combine that with other information that could be grabbed like rough location data, IP address information, knowledge that the email was associated with that service, active usage dates, and more can end up being much worse.

</comment></comment></comment><comment><USER20> For years I've contemplated with the idea of building a botnet that aggressively attacks companies that advertise through spam by consuming their bandwidth or DDoS the hell out of them. Every time I read an article like this I feel like I have to implement that thing sooner than later.

<comment><USER21> Yes, because it's a great idea to combat one illegal thing with one that is much more illegal and victimizes yet another large number of people.

Better let that one sit in the contemplation folder, as soon as you move to action you'll simply be just another criminal.

<comment><USER22> There's no such thing as "more illegal"; interpretation of the law may be subjective, however, once a determination of legality has been made, it is or isn't legal.

Actually, it'd make him/her a vigilante, that while still criminal, aims to serve the public good, whether rightfully so or not. I won't suggest whether that is ethically acceptable, but it'd me more of a conversation than legality.

<comment><USER23> Well, there are degrees of criminality, which is why penalties for certain similar acts vary depending on the exact circumstances, methods, and intentions; e.g., manslaughter vs. 2nd degree murder vs. 1st degree murder.

I think this was the point. DDoS attacks potentially affect innocent people who just want to (say for instance) buy some cheap Viagra and who have nothing to do with the spammer who caused the initial irritation by sending yet another useless email.

</comment></comment></comment></comment><comment><USER24> Who doesn't already have our email addresses? I get spam email all the time...

</comment><comment><USER25> Reminds me a bit of this story from a few years back: [https://www.wired.com/2010/04/cloud- warrant/](https://www.wired.com/2010/04/cloud-warrant/)

</comment><comment><USER26> Can someone please explain the difference between email marketing and spam?

<comment><USER27> I assume you're being facetious, but there is a literal definition of SPAM in the United States (or, at least, a definition whereby it's OK to send 'commercial email', the inverse of which could be considered SPAM). (From Wikipedia for the CAN-SPAM act - [https://en.m.wikipedia.org/wiki/CAN- SPAM_Act_of_2003#Applica...](https://en.m.wikipedia.org/wiki/CAN- SPAM_Act_of_2003#Applicability))

A commercial email is legal if it complies with the following:

 _Unsubscribe compliance_

* A visible and operable unsubscribe mechanism is present in all emails.

* Consumer opt-out requests are honored within 10 business days.

* Opt-out lists also known as Suppression lists are only used for compliance purposes.

 _Content compliance_

* Accurate "From" lines (including "friendly froms")

* Relevant subject lines (relative to offer in body content and not deceptive)

* A legitimate physical address of the publisher and/or advertiser is present. PO Box addresses are acceptable in compliance with 16 C.F.R. 316.2(p) and if the email is sent by a third party, the legitimate physical address of the entity, whose products or services are promoted through the email should be visible.

* A label is present if the content is adult.

 _Sending behavior compliance_

* A message cannot be sent through an open relay.

* A message cannot be sent without an unsubscribe option.

* A message cannot be sent to a harvested email address.

* A message cannot contain a false header.

* A message should contain at least one sentence.

* A message cannot be null.

* Unsubscribe option should be below the message.

<comment><USER26> Was being genuine - thank you for the detailed response.

</comment></comment></comment><comment><USER28> Hey, it can't be worse than what the airbnb founder did

<comment><USER29> Story?

<comment><USER6> I suspect they are referencing this:

[http://www.businessinsider.com/airbnb-harvested- craigslist-t...](http://www.businessinsider.com/airbnb-harvested-craigslist- to-grow-its-listings-says-competitor-2011-5)

Harvesting emails from Craigslist and spamming people that listed properties.

</comment></comment></comment><comment><USER30> MacKeeper? The company that aggressively advertises something that looks like scareware? Surprised that they are now supposedly the good guys.

The Wikipedia intro reads "The software is heavily promoted and has been the subject of a class-action lawsuit for false advertising.".

They are now writing about a data leak of some spammers because these accidently left their repo open while MacKeeper had their own nice similar leak: "In December 2015 security researcher Chris Vickery discovered a publicly accessible database of 21GB of MacKeeper user data on the internet, exposing the usernames, passwords and other information of over 13 million MacKeeper users. According to Kromtech this was the result of a "server misconfiguration""

<comment><USER9> MacKeeper has 13 million users?? Who would install MacKeeper willingly?

<comment><USER31> My 12 year old son has installed it multiple times without notification.

This is what happens to people on a Mac who download minecraft modpacks off of random places on the internet...

<comment><USER32> My 10 year-old is an ace at spotting fake download buttons and "your PC is at risk!" banners thanks to downloading Minecraft mods. In an odd way, these spammy download sites have been a surprisingly good educational tool--to date she hasn't messed up her machine once.

</comment></comment></comment></comment><comment><USER33> These Mackeeper guys had some high pressure dude on a live chat get my mother to pay and install their software. Worse - she was having trouble installing it and the guy suggested a remote session. Luckily she got wise at that point.

I wouldn't even visit their site to be quite frank.

<comment><USER34> Out of curiosity - what do you think a guy that is hired to make that software to work on your mom computer would do more than help her install said software, even if through a remote session?

<comment><USER35> > Out of curiosity - what do you think a guy that is hired to make that > software to work on your mom computer would do more than help her install > said software, even if through a remote session?

Because that is literally part of the modus operandi of the Windows tech support scammers?

</comment></comment></comment><comment><USER36> Were they held for River City Ransom?

(I'm sorry, couldn't resist)

<comment><USER37> Crap now the menu tune is playing non-stop in my head</comment></comment>


Who Is A Programmer? - <AUTHOR> http://r0ml.net/blog/2005/05/03/who-is-a-programmer

<comment><USER2> Postscript is a surprisingly useful print file format although it's use does require taking time to learn (what is effectively) a stack based programming language.

If you are wondering just what the key advantages are - well you end up with a compact, re-usable file structure that is searchable and (broadly) human sensible. An excellent format for archiving documents once they have been generated.</comment>


Drawing Lines is Hard - <AUTHOR> http://mattdesl.svbtle.com/drawing-lines-is-hard

<comment><USER2> This looks good and fell through the cracks. Can you please email us at email@example.com so we can give you some advice about reposting it?</comment>


Ask HN: You're a recent grad that's working full time on your startup. How? - <AUTHOR>

I'm curious as to how the recent grad crowd works full-time on their startup. I've read multiple comments over the last few weeks from people that do this, so I have to be nosy and ask the obvious question - how do you do this? Personally, after graduation I will need to get a "real" job to pay for expenses, housing, food, etc. Ideally, of course your startup makes money, but it's obvious that comes with no guarantee or time frame. Are the bulk of these fresh grad full-timers somehow independently wealthy, do they just get by with part-time jobs, or am I missing something entirely?<p>Let me know, thanks. <comment><USER2> Everyone's how is going to be different and probably not applicable to your situation but here is what you can do...just make it fucking happen. This small piece of advice may not seem that helpful but what I'm trying to say is you're nuking it. You're over thinking. Jump in head first and see what happens.

On that note, I don't recommend any plan that involves your parents, but that's just my undying need for self-reliance.

If you really want to know what I do to survive, nothing special really. I cut back my costs but don't eat only ramen and live in a box. I pick up some consulting and freelance jobs and help out people with other stuff when I'm in need (menial labor can be a good thing). The key is flexibility. I think about my company 24/7, but there is no way I can work on it that much. There is more than enough time in the day to make a living wage and work on your startup full-time, just make it happen.

<comment><USER3> Although I am new to HN I have tried to contribute in a positive way and have not, until now, left a negative comment.

Being a founder is about getting things done, busting walls down and doing, often, the unthinkable in terms of effort and brainpower to prove your thesis correct.

Based on your question, you probably aren't ready.

</comment></comment><comment><USER4> In my case it's a combination of (a) graduating with money in the bank due to generous scholarships, and (b) having low expenses due to living in my parents' basement.

YCers, of course, are given a theoretical 3 months of living expenses and then usually get other investment at the end of the YC program -- so there's no mystery there (at least for those people for whom $5k == 3 months of living expenses).

<comment><USER5> Bingo! I too live in my parents' basement - it has it's perks and a few downfalls as well. Aside from saving money, I've found it easier to code at all hours of the night and day while in the basement. There's also an added sense of privacy which seems to give me some mental comfort as well. On the downside, I've now become part of the super-nerd stereotype: jobless and living in my parents' basement. =)

On a side note, I've also found it increasingly difficult to keep in touch with old friends post-grad. The majority of my time is now devoted to my projects rather than hanging out or attempting to reconnect.

<comment><USER6> _On the downside, I've now become part of the super-nerd stereotype: jobless and living in my parents' basement. =)_

You're probably just being facetious, but you're not jobless; you just don't have a job that involves working under contract for someone else. ;-)

<comment><USER7> My friends referred to it as "unemployed but busy", at one point. Many of them were "unemployed and bored" at the time, since it was right around the time when all my friends were thinking of dropping out of grad school.

<comment><USER8> When I was working on my product full-time, I always said I was "self- unemployed."

</comment></comment></comment></comment></comment><comment><USER7> The easiest way is just to move back in with parents. Most middle-class families can afford to do this; I think the stats from my graduating class (05, top private college) were that 50% of students were moving back home.

I took a slightly different path: I moved back in with the 'rents, but I also took a job for a couple years and saved up money. _Then_ I went full-time on my startup, funding it mostly out of savings (I was paying rent to my parents). It's funny - now that I've moved out, my expenses are only about $200/month more than they were when I was living at home, but the difference is that now I'm paying a complete stranger's mortgage instead of my parents.

<comment><USER9> Is this in the U.S.? If I were a school administrator and half my graduating students were moving back in with their parents after graduation, I would consider my school to be failing terribly. I would expect even a community college to be better than that.

Alternatively, by "top private" do you mean very expensive, so most of the students were independently wealthy and were getting degrees in things not intended/needed to provide jobs after graduation? I just can't fathom going to / sending my child to a school where that was normal.

<comment><USER7> Yes, this is in the U.S.

"Top private" as in #1 in the U.S. News & World Report rankings. It's academically selective (slightly under 20% acceptance rate), and yes, very pricey for those not on financial aid. The demographics did skew toward children of upper-middle-class parents who wanted degrees in useless subjects. Liberal arts, after all.

BTW, this is not saying that 50% of graduates could not find jobs. There were a couple in that situation (mostly English, history, and language majors), but most people living back with their parents had jobs - in some cases, very good ones. I worked at a financial software startup. I had a classmate at the State Dept. Another friend was doing strategic analysis at MITRE (MIT Research and Engineering). All of us chose to live with our parents, even though we were making more than the median _household_ incomes for our respective areas. Then there are more conventional live-with-parents stories, like the schoolteachers and librarians and baristas and unemployed.

It's more that if a large enough critical mass (say, all the English majors) chooses to live with their parents, it then becomes socially acceptable. And then their friends do it (while banking the rest of their salary), partially so as not to feel "different" from their less-successful classmates and partially just because they can.

</comment></comment></comment><comment><USER10> I see a common theme here in the first few submitted replies. What does an ambitious young person do if the parents are

a) dead and gone,

b) sick and dying,

c) impoverished,

or

d) stingy?

(I ask as a parent of would-be start-up founders, trying my best not to fit into those categories, but never knowing for sure when I might fit into category a).

<comment><USER11> I think it's ideal to have some sort of part time job. In my case, I have a full time job and can't leave it for two reasons:

1) I am on H1b-Visa [More Important than #2, so didn't even think about applying for YC this summer, though I would love to]

2) I need $$$ :-)

I typically try to wake up early(6am), hit the gym, put in my 8/9 hrs at work so I am free by 5-6 pm. Now I have potentially 6 more hours till 12:00 am during which I try to get some work done on my personal projects OR go to silicon valley meetups etc Or just laze/party out completely some days. [Potentially 30 hrs in 5 days]

So, time is not really a problem, it's more of a Time management and Motivation that will carry you forward. I am still tweaking both :-)

PS: On another note, I will be up in the SF city for StartupWeekend. Still looking for people to partner up ? Anyone Interested ??

<comment><USER12> you know that you can always switch to a part-time H1b to make more time, right? Also, apply to YC if you are interested and ready to commit, the visa thing is hard but not insurmountable (especially if you raise money). IIRC, The buxfers did it!

It's very easy to go down the road of, oh no there are so many obstacles, but if you're relentlessly resourceful, you can make it work :)

<comment><USER11> I am a believer in "if you're relentlessly resourceful, you can make it work :)". I honestly never considered/thought moving to a part time H1 especially in this economy. It was always evenings/weekends in my mind. But now that you mention about Part time, it seems a pretty descent option :)

BTW what/who are the "IIRC , The buxfers" ?

<comment><USER13> IIRC = If I Recall/Remember Correctly

Buxfers = <http://www.buxfer.com/about.php> (I think)

</comment></comment></comment></comment></comment><comment><USER14> I've had two phases of my life where I went without income. The first was getting established as an open source developer, the second was starting a startup (both, interestingly, feel like they have a lot in common).

After college I worked full time for one year. I kept living with college roomies and saved up about $10,000. I used that to work full time on open source for 10 months, and move to Europe (where I stayed).

When I started Directed Edge 6 years later, I did something similar, but had more saved. I got my living costs back down to college student levels to ensure that we had a long runway.

It's easy to stretch money out if you get used to it and easy to save enough money to live on for a year if you've got an IT job. The freedom of knowing that you can survive for a year on $10k while living well, mind you, is pretty awesome and it certainly gives you the flexibility to do something you think is worthwhile.

<comment><USER15> I'd love to hear more about your move to Europe. Did you move for a job and have an employer help out with the red tape, or did you work out another path? Having spent about a year in Europe backpacking during my college days (on $10k, no less), finding a means to make it a full-time experience would be great.

EDIT: I assumed you are/were a citizen of the US and shouldn't have.

<comment><USER14> Yes, I am a US citizen. In a nutshell, I took all of my overtime and vacation in that year of working full-time and went to Guatemala to study Spanish and met a German girl ... that was September of 2001, so a pretty nutty time in the US, and it seemed like a good excuse to try something different.

I had a job with a startup lined up, which fell through, and then ended up getting hired by the SAP LinuxLab who sponsored my visa (roughly equivalent to a H1-B), so I went back to the US for a couple weeks, packed up my stuff, shipped it over and well, stayed. 6 years (and one job) later I got permanent residence, which meant I was no longer bound to having a company sponsor my visa, and a couple months later quit my job to found Directed Edge.

The convenient upshot of that is that now, at 28, I'm permitted to live and work anywhere in the US or EU.

<comment><USER15> Thanks!

</comment></comment></comment></comment><comment><USER16> YC isn't the only program that allows Bright Young People(TM) to get off the ground. For example, I'm on the EPIS programme in Scotland (<http://www.epis.org.uk> \- shameless plug) which is effectively a year-long YC, giving you a £10k loan to get started, free office space and a ton of mentoring. (The reason I'm interested in YC is because Scottish mentors and investors, for the most part, don't 'get' emerging technologies.)

There's also the Royal Society Enterprise Fellowships, also in Scotland, which is an even cushier deal - you graduate straight from PhD to startup with a year's salary from the university and some small seed investment.

For the most part universities want to commercialise your work, so if you're a graduate with no money but a ton of great work you want to turn into a business, there is support there - you just have to know where to look.

This applies more to postgraduate students, mind; some of the things that supported me fresh out of my BA and looking to start some projects included a part time job that paid well enough to cover my basic expenses, leaving me free to tinker in the rest of the time, and doing a lot of freelance work which pretty much came to the same end. Having money saved up from internships and graduate stipends also helped, but I believe the system is a little different in the US ;)

</comment><comment><USER17> I graduate in May and plan to move to full-time. I'll be able to work on my startup because my parents have [thankfully] agreed to help me out while I try to bring it into the black. Since I've been working on it a lot during college, I hope to start making a profit not too long after graduation. I'm currently living with some college friends in a house and intend to live there for now, unless (A) money runs out and I need to move home, or (B) I decide it'd be better to move to the valley.

I'm in Iowa right now; it's a dead zone, but I have resources available to me here (family, time, friends) that I wouldn't have if I just upped and moved to SF right now. Not that the prospect isn't intriguing of course.

</comment><comment><USER18> WebNotes' first founder worked part-time on WebNotes for about a year after graduating before raising enough investor money to go full time. After going full-time, he gave everyone else an ultimatum to jump ship as well, and now, we're a five person team.

So, in short, I'm lucky. The startup has been able to fund me from the start.

<comment><USER6> How concerned was the first founder that while he was getting money together, another startup would develop a competing product and spend the year working full-time while he was working part-time on his own? If such a competitor appeared in the year's time, what would the first founder have done?

I ask because there seems to be some division amongst the comments and essays I've read about how severe of a risk this is, and whether it is a greater risk than jumping in without building up a sufficiently comfortable cushion beforehand. The other half of this, that either hasn't be discussed as much, or maybe I just haven't noticed discussions of, is what happens when a risk of competition appears while the people involved are working at mitigating the risk of inadequate savings/funding.

It seems that some would argue that going the route of the part-time job to fund the project is reasonable path to follow and that things will work out; others that would claim that it puts the startup at an acute risk of failing or just never getting off the ground, and that never having enough money goes with the territory.

As concrete examples of both viewpoints, the 37Signals guys would argue that splitting one's time at first is fine, and is in a lot of ways more desirable than diving straight in. On the other hand, pg has argued in his essays that moonlighting is incredibly risky to a startup's success, due to both the time commitment required by other obligation(s) and the placating effect of an near-assured soft landing should things go bad.

It seems like this situation is precisely where discussions of risk trade-offs come in. Hearing the thoughts behind how these trade-offs are balanced is interesting and useful, both for the sake of curiosity and helping me and others develop an intuition for where our own balance should lie.

<comment><USER19> The risk of going part-time isn't that a competitor will beat you, it's that you won't make a good enough product. Don't worry about competitors, worry about the product.

<comment><USER6> This strikes me as being worried about the same thing, especially in a market ripe enough for you to have real competition. Presumably, in trying to best your competition, you and/or they -- hopefully both if both are paying some attention to the other -- will ultimately approach a product the customer wants. Otherwise, you're both dead anyway. Past that, it's up to whoever has the better product.

The only other thresholds to overcome is that you or your competition solve enough of the customer's problem for them to be interested at all, and that the price is something the customer would be willing to pay. Odds are, if you are tooth-and-nail with one or more competitors, you'll pass both those thresholds just trying to keep ahead of them.

There might be very niche markets were you won't have the threat of competition to keep you honest about product quality, but I can't imagine of any. I'd worry about any market where no one cares enough to make a competing product.

</comment></comment></comment></comment><comment><USER20> I started my first company by getting supported by my partner, working all day & night :). I had a deadline of 6 months to release which I met. We lived like students (still in a student flat), and by no means had any disposable income. It was exciting and daring, and paid off.

My advice, find a brainy girl/boy who believes in you (and can add value in their own way) and talk it over :)

<comment><USER16> That's pretty impressive. The pressures of working 24/7 on a startup don't always mesh with the ideal of a happy balanced relationship, especially if the startup founder is relying entirely on the other to be the breadwinner. I've not really been in that position myself, but I've heard a lot of stories about how relationships nearly died because of someone getting obsessed with a startup and neglecting their spouse. Any thoughts?

<comment><USER20> She's a special girl what can I say :) We have both been working on a mutual startup products for a few years now. It has worked for us, probably because we are both different (optimist/dreamer vs pessimist/realist) yet the same (passionate, understand the same domain specific areas, work insane hours and love it).

<comment><USER16> Well, kudos to both of you then! :)

</comment></comment></comment></comment><comment><USER21> I live in India, Pune. So the expense are really low as compared to US or Europe. Plus, I really cut down on expenses and still manage to have decent lifestyle. I have a cook coming in to cook food and a maid to clean the house.

I worked for a year and saved enough ($3000). This amount of money will go long way (8 to 10 months) if I spend frugally. I am already 4 months into developing the startup.

Another thing is, develop a knack for getting things cheaply. If you search around, you can get same things far cheaper, than say from a Mall or Big shop.

</comment><comment><USER22> I just graduated and got a full time job. I leave work around 5ish, I hit up a cafe and usually work until 8-10. I get home relax a bit, I go to the gym around 11 and then bedtime for me. Lather, rinse, repeat...

I've learned what I need to do to not burn myself. I've fine tuned it to the point where it's become sustainable, at least for a while. I try to exercise four times a week, eat healthy, get at least 7+ hours of sleep and to, once in a while, change things up dramatically to break routine, such as going to a different city to work.

My job pays the bills, I don't have very many responsibilities and my goal is to start a company which will provide a steady source of income and open up other doors of opportunity.

Bottom line: You can have a full-time job and start a company.

</comment><comment><USER23> We are two cofounders. We both had full time jobs. We worked nights and weekends for a year and got something out the door. Now that it is going well, I made a deal with my employer to switch to part-time. I consolidated my fixed costs (aka sold the car, got rid of cable) to be able to live on a part-time salary. The other cofounder is on an H1-B, so he doesn't have the same options.

We live in Cambridge, MA, so you can get by without a car. Food is cheap, and rent is in the range of $700 a month with roommates. So one should be able to live in Cambridge comfortable on about $1600 a month.

Once we get funding, we will both do it full-time.

</comment><comment><USER24> Talk to your parents.

It's amazing what the response to

"I just recently graduated. Instead of going to Europe to get drunk for a year, I'd like to go home for a year and write software for my startup."

can be.

</comment><comment><USER25> Am I the only person who would ask my parents to pay for my living and allow me to startup?

I am planning to live on the provision from my parents to startup after June. That is when my current job finishes. :-)

Well, of course, I have got my ideas and plans ready before starting. :-)

</comment><comment><USER26> I'd have to agree that in my case, I'm pursuing a full-time start up after having worked for a few years, saving up a bit of cash that will hold me over for the next few years. Along the way, gaining some experience from the corporate sector to bring to the start-up.

</comment><comment><USER27> Uh, I moved to the 3rd World. Forex swaps help for bread and butter income!

</comment><comment><USER28> My mommy loves me and is letting me bum it?</comment>


40 Days With the Playstation 4 - <AUTHOR> http://exitevent.com/40-days-with-playstation-4-131227.asp

<comment><USER2> I agree with most of the review, except the controller.

The battery life on the dual-shock 4 is really poorly designed. Playing games for more than a few hours at a time almost always requires plugging it in to keep using it.

Note: The Dual-shock 3 was also USB charged.

<comment><AUTHOR> I'm kind of conflicted. I've heard so many different reports regarding DS4 battery life, i'm generally getting 6-8 hours of life with constant use out of mine.

What are you clocking in at?</comment></comment>


A thermostat company shut down every thermostat in the middle of a cold night - <AUTHOR> https://twitter.com/jeremyphoward/status/1094681327297736705 <comment><USER2> I own an Ecobee. The internet connection is only used for remote adjustment and monitoring.

When the internet connection is down, the thermostat maintains the current program. I'm not quite sure what the outrage is here. If the OP was home, he could walk over and change the temperature. If OP was away, one would hope the base program was set to something that didn't freeze the pipes.

The owner finally mentions that the thermostat is in a location that's not accessible 24/7\. While that's a great use case for a net connected device, it's puzzling why you would sleep in a place where you have no control over your HVAC.

<comment><USER3> Not as puzzling as to why would one want to let "the internet" control their HVAC in the first place.

<comment><USER4> I understand this a popular opinion for IOT naysayers, but HVAC is one of the few features where IOT seems to make sense. It can cause a noticeable change in the cost of your utilities and general comfort.

<comment><USER3> But you do see that there is a downside - right?

Speaking of making sense, why does your thermostat needs to make a connection to a computer that is not under your control?

<comment><USER5> I'm with mvid. The benefits to the average user far outweigh the negatives.

It's unfortunate that for me using something like an ecobee requires a sandboxed network connection to protect my other devices from the ecobee and vis-a-vis, but that's how it goes in 2019. We are not as security conscientious as we need to be yet. Or we can all live in caves in isolation. That's okay too I guess.

</comment></comment></comment></comment></comment><comment><USER6> I think this is germaine to the comments

[https://www.nytimes.com/2016/01/14/fashion/nest- thermostat-g...](https://www.nytimes.com/2016/01/14/fashion/nest-thermostat- glitch-battery-dies-software-freeze.html)

when convieniences are affected thats one thing but when it goes into potentially life threatening or extremely destructive, like the IoT refrigerators [~7000] found to have a default password, prone to mal usage such as remotely putteing them all into THAW mode, thats a black eye. Please lets find some way of purging the default password, and developing a non damaging default mode that persists during power or command & control outages.

Unfortunately landlords want to skrimp on utilities so, they lock thermostats and hot water tank shunts away in a service chase or closet. Ive lived in a place like this as a kid and it was always freezing in winter and luke warm showers had to be supplemented with stove top hot water.

</comment><comment><USER7> As mentioned, your internet connected thermostat works based on settings that are stored locally. It's not making a http request every second asking "should i change the temperature?" The original poster clearly woke up angry and wanted someone to blame but is misrepresenting the situation and that's why the tweet was removed. Let's let logic prevail here instead of getting up in arms over penny press headlines.

</comment><comment><AUTHOR> sorry, the tweet has since been deleted

</comment><comment><USER8> This guy complains, but he is the one who bought a Internet connecting thermostat. Darwin effect at work here.

<comment><USER9> Letting the public know about your experience is what helps others not make the same mistake.</comment></comment>


Show HN: Cloak – Encode your binary files to base64 text and decode them back - <AUTHOR> http://cloak.websrvr.in/ <comment><USER2> The stated motivation is email not handling binary files - what email client doesn't already handle binary files in a similar manner?

<comment><AUTHOR> Its not that email doesn't have the ability to handle binary files. It is because 'enterprise policy' doesn't allow sending/receiving binaries by email.</comment></comment>


Policies that Shaped India: 1947 to 2017, Independence to $2.5 Trillion - <AUTHOR> https://www.orfonline.org/research/70-policies-that-shaped-india-1947-to-2017-independence-to-2-5-trillion/ <comment><AUTHOR> Direct link to PDF copy - [https://www.orfonline.org/wp- content/uploads/2018/07/70_Poli...](https://www.orfonline.org/wp- content/uploads/2018/07/70_Policies.pdf)</comment>


Python packaging and deployment made simple - <AUTHOR> http://www.continuum.io/anaconda-server?utm_source=hn&utm_medium=sm&utm_campaign=as_013014

<comment><USER2> > Protect your organization from undesired Open Source licenses. With Anaconda > Server, you can filter packages with licenses that don't work for your > organization

This alone makes the product compelling. I try to be rigorous in making sure everything we use is copy middle, but the chance that the GPL will get added as a dependency of a dependency later and I'll miss it makes me very uncomfortable</comment>


Ask HN: Is there any interest of Octopus Deploy alternative? - <AUTHOR> A while ago I learned that Octopus Deploy is no longer available for free and, given the fact that open source community contributed significantly (community step templates, various OSS libraries etc), I felt the need to do something about it. So, I set off on a task to create a much simpler alternative, vowing to, if it ever hits the market, always provide a free community edition. By simple, I really mean simple: targeting Windows servers only.
I call it fDeploy (I even bought the .com domain), and I built the tool originally only for my own use (there is some fancy tech like protobuf, nuget API wrapper etc.).
Current unstable version screenshot: https://i.imgur.com/Ju74ThX.png
My question to you: would you use such a tool if it was made available for free? <comment><USER2> We would. And lots of other companies would.

<comment><AUTHOR> Thank you. I missed your comment, but seeing that there is at least one person interested, inspires me to keep working on it. Thanks again!</comment></comment>


Ask HN: store password - no hash, but aes - <AUTHOR>

It's just an idea....what's your opinion?
Instead of using md5 and similar (too fast to calculate, and rainbow tables attack too - if not salted) my idea is:
-create a cleartext (even public); -use the password you want to store to encrypt this text, using aes256 for example; -save the encrypted text;
verify your password (on user input) encrypting the clear text and checking if it matches with stored encrypted password.
Pros: -it's more slow to calculate (and so less easy to brute force) -being the cleartext different on each "server" there's now way to have a rainbow table!
opinions? cheers, aw4y <comment><USER2> So basicly using AES instead of md5 is what your saying.

Though what your doing with the plaintext that is encrypted is iin effect adding a salt that actualy allows easier brute forcing as it does not compliment the the encryption but offers a fixed point ability to verifiy that you have broken the password.

Also AES256 isn't imune from being brute forced, not nth bit encryption is imune.

But remember that any password used on the web is only as good as the transport layer used to convey it and in that you could have the best encryption in the world, but when it is entered via a http connection in plaintext it becomes moot and when it is via https, then it is down to the encryption used for that connection.

Security is often the longest path to the weakest link and that sadly is still a weak link - some call them users, some call them bad passwords and some just call them and ask them for there passwords!

Summary: you have taken the salt aspect and made it a public cleartext password whilst at the sametime removing the extra entropy it affords. You could probably get a job at Linkedin though as you have done better than they did.

<comment><AUTHOR> but the salt is not known?

<https://www.owasp.org/index.php/Hashing_Java>

"A salt is a random number of a fixed length. This salt must be different for each stored entry. It must be stored as clear text next to the hashed password."

the only difference I see it that the salt is different for each password, instead my "solution" uses a cleartext for all password...am I wrong?

</comment></comment><comment><USER3> A rainbow table would still work if you're using one clear text per server, I just have to build the table per server. The reason salts remove rainbow tables as a way of attack is that they're different per password, so I'd have to build an entire table just to crack one password. If I'm doing it per password there's no point in saving the table, I can stop once I've found the matching password. If I have a whole set of hashes which share the same salt though I can build a table and crack more of them at once.

</comment><comment><USER4> I was just about to point out the known-plaintext scenario of this setup when the server is compromised, but apparently AES is immune to this attack. [1]

[1]: [http://en.wikipedia.org/wiki/Known- plaintext_attack#Present_...](http://en.wikipedia.org/wiki/Known- plaintext_attack#Present_day)

<comment><USER2> I don't believe it. If you have a text of say "WIBBLE" and thats encrypted and thats all you have, then you can run thru every permutation(brute force) and compare until your decrypted text matchs the known text. No shortcuts to this, but still brute/rainbow realms.

<comment><AUTHOR> brute works (but slowly?)...rainbow should be created on cleartext basis...change the cleartext and trash the rainbow!

</comment></comment></comment><comment><USER5> AES is not significantly slower than a salted hash and so this does not overcome the problem of JtR style attacks. See for example: <http://www.cryptopp.com/benchmarks.html></comment>


List your accomplishments - <AUTHOR> http://blog.timrpeterson.com/2016/01/23/list-your-accomplishments.html <comment><USER2> I was right with the author on this until they referenced Donald Trump as some sort of role model. Ugh. The final paragraph of TFA is quite relevant advice for Trump: Don't Brag. And advice for everyone else: Don't Be Like Trump.

That said, I think self-reflection is fantastic. Maybe you feel like you're always running in place? Write down what you've been doing for the past few weeks/months/years, figure out what you think has been valuable or not as valuable, and adjust going forward.

This practice has been super-helpful for me also as a morale boost going into negotiations about compensation. It gives me both moral courage that I have been valuable as well as specific details that I can bring up to demonstrate how I've provided value to the company.

In all of this, though, beware that we tend to undervalue the contributions of others just as much as others undervalue our own contributions. Even for the smartest/most productive of us, our own accomplishments still stand on the shoulders of others'.

<comment><USER3> Author here. Using Donald trump wasn't as a role model but because you know who he is and that he makes lists.

<comment><USER4> Your target audience is still going to read his name, have an intuitive negative feeling, and associate that negative feeling with your article.

<comment><USER5> In other words, the audience is completely emotional and is unable to see the good traits of someone because they don't like their politics.

HN everyone

<comment><USER4> > completely emotional

Nope, just emotional to varying degrees. If you think that people don't ever have emotional responses to things or are always able to separate those emotional responses from their interpretations of things, I am really curious what life experiences led you to that conclusion. It differs drastically from my interactions with people.

I actually suspect we're misinterpreting each other.

<comment><USER6> Welcome to the world of disclaimers, trigger warnings, and safe spaces.

<comment><USER4> What do any of those things have to do with the advice that someone's essay would be more rhetorically effective if they chose a different person?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I need to do this for job hunting purposes. What's my greatest accomplishment, they will ask. I'm not sure how to answer that. I don't have much stand out stuff, at least not career wise. Should I mention a cool coding project I worked on for a job? That seems somewhat underwhelming as a "greatest" accomplishment.

Any advice on this front?

<comment><USER8> Yes, mention the cool coding project! We're mostly average[1], most companies/jobs are average, and most employers should and do value our average accomplishments[2]! If you enthusiastically and knowledgeably describe a cool coding project you'll be winning vs most people I've interviewed.

If you're going for CTO of SpaceX, yes, you'll need some overwhelming accomplishments. If you're going for developer role 437 at SpaceX, less so :)

[1] when compared to peers, e.g the people going for the same jobs as you

[2] and will definitely prefer a nice 'average' person, to an obnoxious 'genius'

</comment></comment><comment><USER4> This is also a good habit for folks who occasionally have a problem with their brain telling them that they are worthless and can't do anything useful.

</comment><comment><USER9> > Einstein had numerous colleagues essential to his success, but historians > only list the accomplishments as they were Einstein's alone. You don't know > any of Einstein's colleagues names so writing down your place in the world > matters.

What historical account of Einstein have you been reading?

</comment><comment><USER10> I came across this concept called "The jar of awesome" which on first glance seems really naive but I really took a liking to it. It's basically just writing down your victories when they happen and storing them somewhere in a tangible way. A collection of notes, post its, anything, but it has to be physical and it has to be stored. That way it feels "real", and its a great reminder of the small victories we tend to forget

<comment><USER11> I tried a similar thing at work several years ago, before "scrum" took hold everywhere. I kept my to-do list as a stack of post-it notes, and when they were done, I'd ball them up and throw them into a decorative glass mug someone left in my office.

"Update ownership on parser tests." "Get M3 feature list from Dan." "Finish code coverage slide deck." "Call dentist." "Buy quicklime and duct tape." "Investigate ia64 hang." "Finish mid-year discussions."</comment></comment>


The lives of social media influencers - <AUTHOR> http://find.xyz/map/the-lives-of-social-media-influencers <comment><USER2> This is pretty neat! Super interesting package of information.</comment>


Render Markdown to the Browser Console - <AUTHOR> https://github.com/adamisntdead/console.md <comment><USER2> This is cool! Maybe not super useful (perhaps could be used as a changelog or something?), but definitely cool-lookin'. Interesting that while images don't load on Firefox, they do seem to actually take up space. I get a big gap in the console on the image render line.</comment>


Are you what you earn? - <AUTHOR> http://www.benhuh.com/2010/02/02/are-you-what-you-earn-compensation-and-wages-advice-from-a-ceo/

<comment><USER2> Simply terrible advice. How many scammy pointy-haired-boss types haven't tried to use "we'll take care of you in the future" or "but the job is so exciting, you should be happy to work for half what you're worth" to justify low wages.

Top developers know they can get a job doing something they enjoy or care about that comes with a good salary and benefits, why should they even consider such a job as Ben is offering?

Even if a developer doesn't care about money, the compensation is a big indicator of how the company/boss views your value. If they are paying you $10/hr, do you really expect to be treated as if you are an important, valuable part of a team?</comment>


Ask YC: Need a loaner IPOD touch. - <AUTHOR>

Hi,
Our app works on the Iphone but not on the Ipod touch.
 Would it be possible for someone to loan us their IPOD touch for an hour or so. We would really really appreciate it. My email address is manojb at blogbard dot com.
We are located in South bay(Sunnyvale/Mountain View/Sunnyvale/Santa Clara).
Thanks a lot for reading this
-Manoj. <comment><USER2> I hate to nitpick, but... it's _iPod_ , not IPOD, Ipod, or any variant.

I don't have an iPod touch, and if I did I probably wouldn't loan one to someone on a web forum, especially not someone who registered just to ask that... but I'm curious, is it a web app or hacked SDK app?

</comment><comment><USER3> ipods have pretty good resale value. If you only need to work with one for a short time, buy one on craigslist (or even your local apple store) and sell it a few days later. At worst you'll be out 50 bucks.</comment>


Module Oriented Programming - <AUTHOR> http://www.floopsy.com/post/32582236678/module-oriented-programming

<comment><USER2> Interesting idea. How would you implement this in a real world setting?</comment>


GitHub and Export Controls - <AUTHOR> https://help.github.com/en/articles/github-and-export-controls <comment><USER2> FWIW, it was first created in 2017 and last updated in March[0].

[0][https://github.com/github/site- policy/commits/master/Policie...](https://github.com/github/site- policy/commits/master/Policies/github-and-export-controls.md)</comment>


US attempts to block Edward Snowden are 'bolstering' case for asylum - <AUTHOR> http://www.guardian.co.uk/world/2013/jul/07/us-attempts-block-snowden-bolster-case-asylum

<comment><USER2> This is crazy talk. No countries are waiting until they see a _prima facie_ case of harassment and then saying, "We've seen the facts and we're giving asylum!" Every country that could conceivably do that has weighed the damage to their relationship to the US and stayed well away.

I don't even think that the collection of Latin America would-be asylum-givers are very serious. In the most likely case, they are just grandstanding for their own reasons.</comment>


European Papers Find Creative Ways to Thrive  - <AUTHOR> http://www.nytimes.com/2009/03/30/business/media/30paper.html <comment><USER2> 'In much of the world, American newspapers are seen as journalism's gold standard.' Oops, I think there's a bit of confirmation bias showing there...

</comment><comment><USER3> ironic that the story is published by the nytimes</comment>


GitHub XP – GitHub Windows XP Theme - <AUTHOR> https://github.com/martenbjork/github-xp <comment><USER2> I had hoped for something more like this [https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large](https://pbs.twimg.com/media/De17PIKXUAE27W6.jpg:large)

<comment><USER3> You know I really miss the classic Windows UI. It was easy to work out what to click and what doesn't do anything.

<comment><USER4> Yes, you would expect the armies of UX experts to be able to figure out basic consistency and discovery of components. Seems all the good UI research (using actual user experience testing) in the late 20th century has been largely forgotten.

<comment><USER5> [http://prior.sigchi.org/chi96/proceedings/desbrief/Sullivan/...](http://prior.sigchi.org/chi96/proceedings/desbrief/Sullivan/kds_txt.htm) is a fun read. At the time, the very concept of a UI on a computer was itself alien to many of Microsoft's target users - they did a lot of user testing to come up with what ended up in Windows 95.

</comment></comment></comment></comment><comment><USER6> The only thing missing is the warning at the top that says not all features will work with your old version of Chrome.

How do I know? Because I'm still one of the last people on Win XP at work. FML.

<comment><USER7> We have to use it sometimes because nobody can figure out how to get our Delphi 7 environment running on Windows 7.

I feel your pain.

<comment><USER8> I've installed Delphi 7 on my Windows 7 at the time, ran really good and kept developing code as normal.

Then eventually that same laptop got upgraded to Windows 10 and this same Delphi kept working as expected (compile, edit, ..).

Maybe your colleagues can try to install it with the UAC disabled?

<comment><USER7> I think it has something to do with the 3rd party libs we're using.

</comment></comment></comment></comment><comment><USER9> This is the best take on the GitHub / Microsoft hysteria that I have seen. Thank you.

</comment><comment><USER10> Fun idea. I hated that color scheme back in the day. Fischer-Price computing anyone?

<comment><USER11> At the time it seemed like a really poor and ugly attempt to rip-off Apple's OS X Aqua design. IIRC the betas had a really nice theme called "Watercolor" that I still miss.

Although looking back at both designs now in 2018, those OS X pinstripes and heavy drop shadows feel way more dated than Luna's Fisher-Priceness.

</comment></comment><comment><USER12> Off-topic question about VSCode - it is Electron based, which was released in 2013. Now, Microsoft had/has team in Zurich, Switzerland - they've specially opened the office to hire Erich Gamma (of Eclipse and DP fame). The team led by Gamma was working on VSCode predecessor (I think), in 2011... So what happened there? Did they abandon most of the stuff and switched over Electron later?

<comment><USER13> The project was called Monaco.

It was a massive success, and has since been open sourced here: [https://github.com/Microsoft/monaco- editor](https://github.com/Microsoft/monaco-editor)

Visual Studio Code joins the Monaco editor with an Electron-based environment to provide desktop text editing. That's about as opposite as abandoned as you can get.

<comment><USER14> Plus, Monaco powers more than just Visual Studio Code. Visual Studio Team Services and the Azure portal uses Monaco as editor of choice in a large number of places. Monaco powers online REPL/sandboxes such as Typescript's playground [1]. IE10+ and Edge Dev Tools are powered by Monaco (and the minimized gunk of the average random webpage sources was an early impetus for Monaco to have much of the performance we see in VS Code today).

[1] [https://www.typescriptlang.org/play/index.html](https://www.typescriptlang.org/play/index.html)

<comment><USER15> I think godbolt.org uses it as well.

</comment></comment></comment></comment><comment><USER16> The spacing is all off. I get it's in jest, but it's really just not quite there. Especially the search.

</comment><comment><USER17> Looks great! Love the idea.

I'll buy the extension off you for $5/install count? I promise to wait at least a day before bundling malware, since you hit front page of HN there should be some great targets.

/Sarcasm obviously.

But there's just no way i'm installing something that can "read and change my data on github.com". Chrome extension permission granularity is just not sufficient. Especially since data exfiltration is possible using CSS only (e.g. [https://blog.acolyer.org/2018/05/28/large-scale-analysis- of-...](https://blog.acolyer.org/2018/05/28/large-scale-analysis-of-style- injection-by-relative-path-overwrite/) )

<comment><USER18> >permission granularity is just not sufficient

This is a careful balance between extensions being almost completely useless and extensions being able to take over the whole browser...

Just read the source code if you don't trust it.

Edit: it seems this extension has no javascript code, just stylesheets that get applied by manifest.json. Seems this actually could be a good spot for more granular permissions. "change style information on *.github.com"

<comment><USER17> _> Just read the source code if you don't trust it._

No, that doesn't really work for Chrome extensions - they can silently auto- update, and will no longer match the published source.

It's just barely possible to run the extension directly from the source code - you either need to put up with popup warnings every single time you open the browser, or, need to install an entirely separate developer version of Chrome.

Certainly most people here aren't doing that.

 _> change style information on .github.com_

It would be an improvement, but it turns out stylesheets can be used for malicious data exfiltration anyway (see parent).

<comment><USER18> >No, that doesn't really work for Chrome extensions - they can silently auto- update, and will no longer match the published source.

As much as I hate Google, this is exactly how most people use free software linux distributions. The only difference is the barrier of entry for new/updated software.

>need to install an entirely separate developer version of Chrome

Heh, I'd probably expect anyone who audits all of the software they use to already be using chromium.

<comment><USER17> The salient difference is that bribing Google or Red Hat is practically impossible (a hypothetical billion-dollar exercise reserved for state actors); whereas bribing Chrome extension developers is definitely not hypothetical, maybe even commonplace (e.g. some friends were hit by [https://www.ghacks.net/2013/12/26/hoverzooms-malware- controv...](https://www.ghacks.net/2013/12/26/hoverzooms-malware-controversy- imagus-alternative/) ).

For high-value targets, like full access to a software developer's private github repos, there's definitely an economic incentive to do this.</comment></comment></comment></comment></comment>


Ask HN: What year did algorithm-focussed interviewing begin? - <AUTHOR> I've been in the software business for 40+ years. There was definitely a time before the current emphasis on CS algorithms in interviews for software-engineering positions. We used to do things differently. But when did the transition take place? Possibly sometime in the range 2000-2005?<p>I've speculated that the transition is due to Google having been founded by a couple of grad students. When I was a graduate student in Physics, a dreaded rite of passage was the so-called "Comprehensive Oral Exam," at which you were expected to be able to know and derive on the spot anything taught in the entire undergraduate-level canon. Perhaps the founding grad students did not have any other model for an effective interview process, and simply adopted the only thing they were familiar with. Google became successful, everyone else copied them, and here we are... <comment><USER2> I think you've answered your own question. :)

My memory is that it was rare pre 1998 in Silicon Valley but ubiquitous post 2005 or so - Silicon Valley and Seattle. It's unclear whether Seattle's development was independent of the Valley's, stemming from Microsoft's well known emphasis on algorithms and the same stupid logic puzzles that Google became infamous for.

</comment><comment><USER3> Pre-2000, I remember most questions revolved around data structures. Linked lists, hash tables and various trees & such. For my line of work, it's critical to know.

The "you're one inch tall and stuck in a blender..." Yeah. Google / Amazon were my first experiences with those kinds of questions.</comment>


RIAA to help enforcing the GPL? - <AUTHOR> http://blog.milkingthegnu.org/2008/04/riaa-argument-t.html

<comment><USER2> The person that wrote this may or may not know what they are talking about. But the FSF (creator's of the GPL) are assisting defendants against the RIAA.

<https://www.fsf.org/associate/riaa> for info on that.

and the slashdot posting on it a while back

<http://yro.slashdot.org/article.pl?sid=07/11/19/1948244></comment>