Show HN: Schesign alpha - <AUTHOR> https://www.schesign.com/ <comment><AUTHOR> Hi Everyone,

I am looking for feedback on a side project some friends and I have been working on.

First, do you see any value in being able to create, collaborate with access control, version, and diff data designs, and then output them to different formats? I have done some work in healthcare, energy, manufacturing, and e-commerce and in every one have seen json/xml schemas (or free text data specs) being passed around through emails, word docs, excel spreadsheets, hosted s3 files, power points, custom built websites, etc. I've also seen bugs when versions get confused between data partners or comments/changes get lost in email threads. It's also not fun to read and maintain a 300-3,000 line data schema file.

Second, do you seen any value in being able to compose data designs? I personally think the idea of reusing data structures and composing data designs with a few clicks is interesting, but I'm curious to the practicality of it?

Also the json-ld graph output feels like it could be wrong? I am trying to avoid constraining properties using rdfs:domain as is common in RDF (since properties can be shared between designs and it creates a coupled export), however lib:children seems a little off?

<comment><USER2> On your second point, I would find that super helpful.

Mainly due to data structures that may share > 10% of the data design but is very different and me not wanting to retype.

</comment></comment><comment><USER3> This looks like a really useful tool, do you plan on adding any discovery features to it so that I could find an existing schema to inherit from?

<comment><AUTHOR> Yes, we will be adding a discovery tool and an import/ export tool :)</comment></comment>


Only 22% of searches on Amazon include a brand name - <AUTHOR> https://www.marketplacepulse.com/articles/only-22-of-searches-on-amazon-include-a-brand-name <comment><USER2> One aspect I didn't see mentioned in the article was whether brand name is reflected in final purchase v.s. initial search.

As a consumer, I often am open to one of several common brands but will search generically in order to see all available options. However, I'm unlikely to buy from an extremely generic brand in most cases.

Not sure if this behavior is common, but I expect it is not uncommon.</comment>


Ask HN: Is python still worth spending time learning and teaching? - <AUTHOR>

Python was my first language, and I am a major, major fan of it. I love it. I even taught a class on it last year.
But I'm starting to question why I was teaching it, aside from it being a great first language to learn with.
Compared to PHP, Rails, and Java, the web jobs for Python are somewhat thin. You have to know Django, and even then there's far fewer jobs available than for the other stacks. Nor have I had much luck seeing jobs for python outside of web development.
I work as a JS engineer professionally, and jobs for that are abundant. I'm considering teaching JS instead because if someone's going to only have time to learn one thing (as is the case for many working individuals), it may as well be something they can keep working at and find work with, is my line of thinking.
I'm looking for other opinions. Is python growing or declining? Are there many professional opportunities for it? Would you recommend beginners bother learning it, as opposed to a more employable language like C++, Java, JavaScript, PHP, or C#? <comment><USER2> Python is used very extensively in scientific computing, it's used a bunch in data science, it's often used for build or shell scripts by sysadmins or SREs, and it's used extensively by entrepreneurs for prototyping software systems.

Web development is an interesting and very visible profession because the people who do it talk a lot about it on the web (naturally enough), and it's true that JS and Rails are somewhat more popular for it. But in terms of the breadth of what you can do with Python, it's _a lot_ more.

<comment><USER3> I agree re data science. If you're doing statistics or machine learning (one huge industry there is finance), Python is unrivaled. I do mostly Rails, and I'm very happy there, but I've thought about learning more Django just so it's easier to incorporate Python ML code, and also because a lot of the companies with interesting ML work are using Python for everything else too.

</comment></comment><comment><USER4> Python, by all means, is a MODERN OO programming language.

I'd rather teach Ruby or Python to beginners than JS. I don't like comparing languages and frameworks but we all know that JS was designed and shipped _really fast_ and this proved awful in many ways. Don't get me wrong, it's a half-miracle designing a language that fast, but still can not be directly compared to Ruby or Python.

How are you going to explain the difference between a class and a function using JS to a beginner which should wrap his mind around these new concepts?

As for the _getting a job_ part, I reckon that JS is ubiquitous, but it's not _that hard_. You could add some JS on top of Python, once some very basic things about programming in general are clear.

</comment><comment><USER5> Python is as relevant as any of the other languages you mentioned. It is actually superior IMO for some tasks so it is a good tool to have in your tool bag. I personally, wouldn't write an entire system in it, but many very successful companies have, so I think this is more a personal preference than a language capability issue.

As for teaching it. Frankly I think the entire college education around computer science at most schools is lacking. I see so often that they start people in the higher level languages that abstract students from the underpinnings of what they are doing. I seriously think students should still have to start with a low level language and go through the learning of building solid data structures, algorithms, etc. Of course, not all schools are bad about this, but I see most colleges in the US starting with Java or .NET and not really focusing on teaching fundamentals or how choices affect how the software runs on hardware. Not saying everyone has to be an expert embedded programmer, but knowing how the hardware processes what they are asking it to do would be really helpful. And damn it, they should be able to write basic data structures without using a 3rd party (or standard) library. Not because they will have to do it often, but it teaches them when to use what and why.

I would agree with you that students don't have as many employment options in Python as they will .NET, Javascript, PHP etc, but then again, hopefully they are learning more than just one language and having Python be one of those would still be a benefit IMO.

</comment><comment><USER6> Python seems to hold steady, it's neither the most popular language in the world or the least popular. It just _is_.

Actually take a look in the "Who's Hiring" thread running right now: [https://news.ycombinator.com/item?id=9303396](https://news.ycombinator.com/item?id=9303396)

I periodically glance through this as a way to gauge what skills I should be sharpening up on for the next few years.. Turns out a quick word search for "Javascript" had 67 results, "Ruby" had 36, and "Python" had 81 results. Looks on the surface that in the HN community at least Python is really surging in popularity right now

</comment><comment><USER7> Solely addressing the jobs question, there are more of those for Rails than Django overall, but based on general listings, the market in my city, and announcements at a (well-attended) local users group, if one had Django on his/her resume, one would be courted by a number of willing suitors.

Django/Python also seems to be disproportionately represented (relative to the general market) in HN job listings, so there is plenty of interest and opportunity here, too.

<comment><USER8> It's not all Django, though. There are many web frameworks -- Flask and Pyramid, for example -- so I would count those jobs , too. Many Python jobs are in the Bay area, so you might not have many where you are from.

<comment><USER7> Definitely, and I've noticed that the Python community was much more receptive to the idea of using a micro-framework for APIs, while RubyLand has mostly been content to stay on the Rails (versus Sinatra, most notably).

</comment></comment></comment><comment> dev-ious Python is extensively used in DevOps/ system-administration ... usually its the go to language but rarely mentioned because you're supposed the know it by default to perform those jobs.

</comment><comment><USER9> Who are your students?

What is their motivation in taking the course?

What are their short term goals?

What are their long term goals?

Why do you teach the course?

</comment><comment><USER10> "Rails" is not a programming language. You just can't compare it to PHP, Java, or Python. "Ruby" is a programming language. Rails is a web framework, in the same way Django is a web framework.</comment>


Tell HN: Nuuton crawler is active.  - <AUTHOR>

The second generation of the Nuuton crawling system (codename: Gravity) is in the wild. I will be testing a lot of different parameters. The speed of the crawl is not quite ideal, and I will be adjusting it to respect your bandwith. If you experience a sudden jolt of bandwith consumption, let me know. It is not on purpose, because this thing is a prototype. It should not happen, because I have included safety mechanism, but its not 100% perfect. At the moment, I'm only using the test server, so the probability is not very high. Still, let me know if anything. I dont want to damage your things.
Also, if you want Nuuton to return to your site (you have a blog), then include the following line on your robots.txt file:
nuuton: return(n)
where n is the amount of time between crawls in the unix timestamp format (epoch).
I make this post to alert the community of possible issues. I will be posting on twitter/orangethirty any issues that may arise.
Please report any issues to email@example.com
:) <comment><USER2> It would probably be a good idea to tell us what this all means. <http://nuuton.com/>

</comment><comment><USER3> What is Nuuton? Why invent a proprietary robots.txt feature instead of the (common but non-standard) "Crawl-delay:"?

<comment><AUTHOR> 1\. Nuuton is a search engine.

2\. Because this feature ties in with others that I cannot talk about. Its optional, and meant for optimizing for Nuuton.</comment></comment>


Stephen Hawking: "Will Extraterrestrial Life Be Carbon Based?" - <AUTHOR> http://www.dailygalaxy.com/my_weblog/2009/07/stephen-hawking-asks-will-alien-life-be-carbon-based.html <comment><USER2> I actually think that alien life won't be very alien at all.

Given that the laws of physics are constant throughout the universe/s in question, I think they're probably very similar. Why? Well, DNA and RNA are self replicators that, to the best of our knowledge, arose independently. Given that the emergence of self-replicators is improbable to begin with, it's even more improbable that two different types of self-replicators arose that are so similar to each . This probably means that there is some about the way natural laws are shaped that means that certain types of self-replicators are more probable than others; and those that use heterocyclic aromatic organic compounds as code fall under this category.

What about other aspects of life? All large forms of life are modular; that is, composed of many smaller but similar types. It's likely that alien life will follow this basic structure as well, because it's much easier to evolve that way. Evolving a larger body without modularity requires fundamental changes in structural composition which may be difficult to achieve with incremental changes.

The temptation with exploratory thinking is to deliberately think as much outside the box as you can. Doing so is good, but it's not always correct.

<comment><USER3>
      Given that the laws of physics are constant throughout the universe/s in question

That actually turns out to be a pretty big given, and there's some evidence that the "laws" as we know them are contingent and could be subject to variation across different regions of the universe. Of course, those regions are in principle unobservable by us, but if it can vary on a large scale it'd be rash to rule out variation on a smaller scale.

<comment><USER4> Not really. What you are describing might happen on a bad episode of Star Trek TNG (Q changes the gravitational constant, for example), but in reality stuff that happens on a planet orbiting a distant star are not going to be all that different than what happens here on Earth. Chemical bonds work the same way in Sunnyvale as they do in the Oort Cloud or in a galaxy billions of light years away. We know this by studying the spectra of the light coming from these places.

At the chemical level, I do not anticipate that extraterrestrial life would be very different than that found here. Water is a terrific solvent and is liquid at a wide range of temperature. Unlike methane and ammonia, its molecules are dipoles (one end is more positive and the other more negative), which makes it easy for it to form hydrogen bonds and a strong surface tension at the surface.

Carbon and Oxygen are both fairly abundant. They are formed during the carbon- cycle of aging stars (3 He -> C, 4 He -> O). I have read SF stories that tell of creatures that breathe Florine or are Silicon-based, but these are pretty far-fetched. Florine is a lot rarer than Oxygen, and though it is more electro-negative than O, because of this it is likely to stay locked up in rocks than remain in the atmosphere. Silicon has the same number of valence electrons as Carbon does, but the bonds that it forms are at a higher energy state (n=3, vs. n=2 for C). This means that it is hard for Si to form double or triple covalent bonds; this is something C can do very easily. For a more detailed discussion on this subject, see: [http://en.wikipedia.org/wiki/Hypothetical_types_of_biochemis...](http://en.wikipedia.org/wiki/Hypothetical_types_of_biochemistry#Silicon_biochemistry)

</comment></comment></comment><comment><USER5> _Sulfur is capably [sic] of forming long-chain molecules like carbon. Some terrestrial bacteria have already been discovered to survive on sulfur rather than oxygen, by reducing sulfur to hydrogen sulfide._

Terrestrial bacteria use H2S an an _energy_ source, not as the basis of life. Extraterrestrial life will almost certainly be carbon-based---or rather, its ancestors will be. ET, if we find it, will almost surely be a machine intelligence.

<comment><USER6> Machines have a lot of disadvantages that aren't readily apparent. Machines have to build collection systems or mine energy sources to thrive. We live on stuff that grows out of dirt-- that's pretty handy.

Of course, machines could become more and more advanced if they didn't go extinct in those first pivotal years, but I think it'd be to the end of looking organic. And if you're going to life out of something, make sure it's low on the periodic table. We're carbon-based because that's what works.

<comment><USER7> Well, _we_ have to build collection systems for those things growing out of the dirt!

</comment></comment></comment><comment><USER8> down for me. Cache: [http://google.com/search?q=cache%3Ahttp%3A%2F%2Fwww.dailygal...](http://google.com/search?q=cache%3Ahttp%3A%2F%2Fwww.dailygalaxy.com%2Fmy_weblog%2F2009%2F07%2Fstephen- hawking-asks-will-alien-life-be-carbon-based.html)

<comment><USER9> Not down -- the author has renamed the article (presumably for SEO)

[http://www.dailygalaxy.com/my_weblog/2009/07/stephen- hawking...](http://www.dailygalaxy.com/my_weblog/2009/07/stephen-hawking-on- the-possibility-of-noncarbonbased-extraterrestrial-life.html)

</comment></comment><comment><USER10> Who's to say that aliens will even be matter-based?

It doesn't seem to imporbable to me that life forms, for example, on the surface of stars, where energy is abundant. Self contained, self replicating energy patterns are just as much "life" as bacteria, and I don't see why they can't evolve intelligence either.

</comment><comment><USER11> _Somehow, Hawking observes, "some of these atoms came to be arranged in the form of molecules of DNA. One possibility is that the formation of something like DNA, which could reproduce itself, is extremely unlikely._

Or it could be quite likely. There are theories that amino acids can form without life. Just get something resembling our planet's crust and they'll form and then they can form peptide chains and and so on. This means that any planet similar to earth could end up not just with carbon based life but with DNA based life.

</comment><comment><USER12> Carbon don't enter into it. Just because something has a lot of carbon in it doesn't mean it acts like we do. There are plenty of other things to do with carbon than the ways organisms on Earth use it. DNA? Forget it, that was evolved. Alien biology will be completely alien.

<comment><USER13> "Completely alien" is a misnomer—it's like saying alien computers won't be Turing machines, just because they're "so alien." DNA is simply a way of sticking polymers together to form a storage device and self-stable electrochemical API for accessing it. Organisms that want to reproduce, especially sexually, _need_ storage devices. Likewise, oxygen is the simplest and most robust carrier of electrochemical capacitance. Aliens _will_ have these things—not because they evolved in the same way we did, but because those are the most fit mutations in the early chemical soup. Sure, given an incredibly constrained soup containing lots of sulphur and no oxygen, sulphur- dependent life might evolve, but by the time it has evolved enough that it meets up with us after some good ol' intergalactic travel, it will probably realize that oxygen is a lot easier to manage and rewrite its genetics to use it instead. Or, to take that concept further, it'll be a post-Singularity machine intelligence, as mhartl said.

<comment><USER12> Well, you're probably right about the oxygen thing. I just meant that the chemical mechanisms behind their functioning will be completely different than ours. I mean, some Earth organisms have completely different RNA from ours. I do not expect aliens to have guanine, adenine, etc. as their storage device, but that's not to say they won't have one.</comment></comment></comment>


How can you tell if a person is a programmer? - Stack Overflow - <AUTHOR> http://stackoverflow.com/q/895296/287893

<comment><USER2> They closed it back in April, it's just another junky riff on "you might be a redneck..."</comment>


Apple Store MacBook "We've got something special in store" - <AUTHOR> http://www.apple.com/us/shop/goto/macbook_pro/select <comment><USER2> What makes you think it's the macbook?

[http://store.apple.com/](http://store.apple.com/) gives the same message, heck, even [http://www.apple.com/us/shop/goto/mrmattyboy/select](http://www.apple.com/us/shop/goto/mrmattyboy/select) gives the same message.

</comment><comment><USER3> Don't see anything about the MacBook, just the store is down again. Can you update your title to avoid confusion. Also isn't the new red iPhone launching today? I assume they have to take the store down temporarily for that.

</comment><comment><USER4> Apple's ritual of taking its store down every time they need to add a few SKUs is amazing for a company its size.

<comment><USER5> On the contrary, they realise that doing so will create hype. They know exactly what they're doing.

<comment><USER6> This is just speculation. The marketing team might have just hated the "under maintenance page" and turned a negative into a positive. This is also speculation.

</comment></comment></comment><comment><USER7> "come back at 08:01 PDT"

Oh one? Is that just a little jest or gesturing at something bigger?

</comment><comment><USER8> It's not just MacBook. The whole store is done in prep for the Red iPhone launch.

<comment><USER9> Huh.. wasn't the iPhone RED and the new iPads released a couple of days ago? Why is the store down again?

</comment></comment><comment><USER10> Still points to a MBP.</comment>


Yelp Dataset Challenge - <AUTHOR> http://www.yelp.com/dataset_challenge/ <comment><USER2> The prizes are ridiculously low.

Netflix did it right.

Stop being so greedy, Yelp.

<comment><USER3> There are a lot of Kaggle competitions with similar prizes. Netflix is an outlier.

<comment><USER4> 5k to help yelp? please.

<comment><USER3> Yes it's ridiculous, I'm just saying it's not atypical for these kinds of contests.

</comment></comment></comment></comment><comment><USER5> Is Yelp still penalizing listed businesses that don't pay them?

<comment><USER6> I often forget the exact name of the fallacy this type of question embodies, so for reference:

[https://en.wikipedia.org/wiki/Loaded_question](https://en.wikipedia.org/wiki/Loaded_question)

The common analogue being, "Have you stopped beating your wife?"

<comment><USER4> That's not a loaded question when the person in question has a history of beating their wife.

</comment></comment></comment><comment><USER7> 5000$ is ridiculously low.

</comment><comment><USER8> Wow that's a tiny carrot to dangle, Yelp.</comment>


It Seems Cloudflare Is Merging with Akamai – Techzim - <AUTHOR> https://www.techzim.co.zw/2019/02/exclusive-breaking-news-it-seems-cloudflare-is-merging-with-akamai/ <comment><USER2> If anyone reads this, it should be easy to verify if you are in contact on Linkedin with someone working at Cloudflare London, since the main claim is this:

> one insider who works in the industry with whom we are in contact noticed > that the work addresses of his colleagues who work for both Akamai and > Cloudflare in San Fransisco were now similar. It seems Cloudflare employees > changed their work addresses and are now using Akamai Offices. This past > week Cloudflare employees in London also changed their addresses to match > Akamai's Offices in London.

I didn't know you could see full offices addresses on LinkedIn, but it should be easy to verify.

</comment><comment><USER3> hope this is just a rumour, I love what Cloudflare did and also it releases open source software and build on open source. I like their 220.127.116.11 service.

Akamai is a Giant from last decade, does not engage with small developers, no self service system only sales people

<comment><USER4> Agreed. Just moved one site from Akamai to Cloudflare and plan to move others. Would be disappointed if, on the heels of that, Cloudflare was swallowed up by Akamai. Akamai's service is good, of course, and I have no real ill will towards it.</comment></comment>


"You Don't Know JS" book series kickstarter - <AUTHOR> http://www.kickstarter.com/projects/getify/you-dont-know-js-book-series

<comment><USER2> I'll bite. I dropped $10 on it.

<comment><AUTHOR> thanks so much for the backing. really excited to get this off the ground! please help me keep spreading the word.</comment></comment>


David Plouffe: Obama campaign was a startup - <AUTHOR> http://www.portfolio.com/views/columns/the-world-according-to/2008/12/11/David-Plouffe-Interview

<comment><USER2> Just like in any industry, a good product + favorable market conditions + publicity = success. Obama had more of the above, and in a single mandate election, that's all that matters.

<comment><USER3> The funny thing is that if we look at 2007, there is no fundamental difference between Obama and Clinton, other than initial support for the war. John Edwards disagreed with the war from the beginning as well, and was more polished. Many progressive leaders preferred his message.

Obama had a better product than McCain, but so did Clinton, so did Edwards. Obama's only real differentiation was his intangibles. (Not a Clinton, black, that preacher vibe he gives off) However, he had a few major negatives as well, namely being so new on the national scene.

It was the machine that he and Axelrod and Plouffe built that pushed him past Clinton and Edwards.

<comment><AUTHOR> _It was the machine that he and Axelrod and Plouffe built_

Translation into startup rules: execution is more important than idea?

</comment></comment></comment><comment><USER4> What political campaign isn't a startup?

<comment><USER5> Incumbent campaigns

</comment></comment><comment><USER6> one of those logos had what seemed the default so background in the '0' that was scary to me till I read that the image would cHange depending on his message, seemed kinda cool - but a brand need to be consistent...</comment>


Larry Page: Here's What's Wrong With My Voice - <AUTHOR> http://au.businessinsider.com/larry-page-my-vocal-cord-2013-5

<comment><USER2> Why not link directly to the post?

[https://plus.google.com/106189723444098348646/posts/aqy6DvvL...](https://plus.google.com/106189723444098348646/posts/aqy6DvvLJY1)</comment>


Mail a Letter Online - <AUTHOR> http://www.mailaletter.com/ <comment><USER2> I used a service similar to this in 2011 after I moved back from Australia to UK. Australian banks charge a monthly fee if you don't deposit your salary into the account so after a few months I realized my now-defunct Australian current account was very close to $0 (I had left a few dollars in there when I left). I emailed them and asked them to close the account to which they replied I needed to send a snail-mail letter - I used a service like this (with scanned signature no-less) to do so because it was easier than sending my own international letter to them. I got an email back saying they needed me to send a real letter with a real signature. I replied saying they could keep my account open but I wouldn't be paying for any fees, the reply was swift "Your account is now closed".

<comment><USER3> In Poland the law theoretically mandates that a digital signature is just as good as a pen-and-paper one. But, when dealing with banks, one quickly finds that the law is one thing and the stone wall of your bank is another.

Here's how a typical discussion unrolls:

Bank: "To do X or Y, we require you to visit us in person or provide a written statement".

Me: "Here's my statement with a digital signature, attached as a PDF."

Bank (ignoring the PDF): "To do X or Y, we require you to visit us in person or provide a written statement".

Me: "The law says (specific citation goes here) that I have just provided a written and signed statement. Here it is again."

Bank (ignoring the PDF): "To do X or Y, we require you to visit us in person or provide a written statement".

By the way, I had this kind of stupid back-and-forth with mBank, which tries to position itself as a "modern and innovative" bank.

The only next step is to sue, but who would bother.

<comment><USER4> regulatory complaints work wonders too

</comment></comment></comment><comment><USER5> I'm the founder of [http://handwrite.io](http://handwrite.io), which allows you to use your own real handwriting to send out cards in about 30 seconds a card. Our robots use real pen and paper to write in your actual handwriting.

For every card, your handwriting is generated from scratch so it's unique every time and not a font like other services. And if you don't like how your writing looks, you can always use one from our selection.

We've got a Zapier integration which has been a game changer for us and clients as well.

<comment><USER6> This is really cool. Have you thought of doing on-demand pricing? I'd send a few cards, but I don't want to pay $30 a month for a service I might only use intermittently.

<comment><USER7> Seriously, the only reason this is priced per month is to make money off people who don't use the service/forget to use it or forget to cancel it.

Why is this not just

10 cards = $30

20 cards = $50

50 cards = $100 ?

Shady business tactics.

</comment></comment></comment><comment><USER8> The last time this site was submitted to HN was over 10 years ago: [https://news.ycombinator.com/item?id=449964](https://news.ycombinator.com/item?id=449964) \- it doesn't appear to have changed much since then.

<comment><USER9> wow, that has to be some kind of record

</comment></comment><comment><USER10> I created [http://simplepostal.com](http://simplepostal.com) a year and a half ago. Just never knew how to get it on top of hacker news :)

<comment><USER11> You need to get on the HTTPS bandwagon as well [https://doesmysiteneedhttps.com/](https://doesmysiteneedhttps.com/)

<comment><USER12> Brian Lunduke inadvertently found an exception to this. He wanted to make his site accessible by very old browsers... So he stopped using https.

[http://lunduke.com/](http://lunduke.com/)

It's a dumb exception, but you guys might find it mildly amusing.

<comment><USER13> Great, compromise the security for the 100% of users to keep the 0% reading linux news on IE2 able to visit.

</comment></comment></comment></comment><comment><USER14> We've actually been working on something similar. Our goal is to make it as dead simple to send a letter as possible in USA. We'd love any feedback people have!

[https://papermail.in](https://papermail.in)

Feel free to drop us a note at firstname.lastname@example.com if you have thoughts :)

<comment><USER15> If targeting US customers I'd avoid using a foreign TLD. If you're targeting Indian customers wanting to send to US addresses it should be fine.

<comment><USER16> I agree; I wouldn't even think to click that unless I wanted to send a letter in India.

</comment></comment></comment><comment><USER17> Apple used to have an iOS app called Cards where you could snap a photo with your phone and it would arrive as a handsome postcard a few days later. I thought it perfectly fit at the intersection of Apple's obsession over digital experiences and tangible products. Sadly, Apple has since abandoned all of their printing services.

Bill Atkinson, the storied early Apple engineer, has an app for this as well, but I have not used it and can't vouch for it. But it's worth noting that when Bill himself went to have his own photography book printed by a publisher, he made modifications to the printing equipment before he was satisfied with the quality. [http://www.billatkinson.com/aboutPhotoCard.html](http://www.billatkinson.com/aboutPhotoCard.html)

</comment><comment><USER18> I wrote a letter to a friend on the website because I honestly thought it would be amusing. But then at the address page I kinda stopped, because I didn't actually feel very comfortable with writing my friend's address and full name on a random webpage. I wonder if there is anything that can alleviate this paranoia?

<comment><USER19> Depending on where your friend lives, you can address it to a post office. However, your letter would still need your friends full name on it to get it picked up.

</comment></comment><comment><USER20> My first internship in 2009 was for a company with a similar business model in the UK. We developed a Windows application, a web application and an API which allowed letter templates to be uploaded and then sent out to large mailing lists using mail merge.

Most of our big customers were real estate agencies where it felt pretty spammy but the selling point was that people were more likely to open a personalised letter compared to an email. Some of our marketing focused on poking fun at people using franking machines!

I remember a more interesting customer that sent out parking violations to individuals. Along with the basic mail merge, the letters would include images of their vehicles parked where they shouldn't be.

The biggest problem we had was with consistent print quality. We sent batch files to be printed out by different printing companies but there would often be problems with things like alignment and image quality. Even though we had test letters sent to our office every day we'd always be stressed out when a new customer was coming on board and testing the service - they'd often receive a couple of dodgy letters!

In the end the company was absorbed by a larger IT business - I think they just wanted the developers. They wanted me to come work full time for them but I went back to University to finish off my degree and did some part-time remote work for them. Can't find any trace of the company online now.

</comment><comment><USER21> In Germany - where the bureaucracy is massive and mostly paper based - Deutsche Post the national postal company runs a similar service ([https://epost.de](https://epost.de)). Works both ways, you can send and receive paper-and-envelope letters in digital form. The user interface is surprisingly modern and they do use https;) It even includes a DropBox-like storage space for your documents.

</comment><comment><USER22> This makes it look like there are some unresolved challenges with fulfillment: [https://www.bbb.org/us/wa/seattle/profile/international- mail...](https://www.bbb.org/us/wa/seattle/profile/international-mailing- services/mail-a-letter-1296-22825175/complaints)

<comment><USER23> I've been using it for many years with no problems with fulfillment. I like that there is a record the letter was sent.

The biggest annoyance is the horrible UX for entering recipient's address. I'd like to type the two lines on the envelope. Instead, I need to go through this form adding them as a contact, with fields for e.g. city and state. Most of my letters are one-offs, and it's a bunch of cut-and-paste work. Still beats doing my own mailing, though.

</comment></comment><comment><USER24> I've been looking the something that's kind of the opposite of this. I'd like to be able to use an address in my city for all my mail - when a letter arrives I'd like to get a scan as an email attachment.

I usually get parcels delivered to amazon lockers or my office since I'm out all day.

<comment><USER25> There's plenty of those services.

This one is recommended usually. [https://travelingmailbox.com/](https://travelingmailbox.com/)

You'd have to live in a decently sized city to get an address in your town though. You can definitely get one in your state. UPS also has mail services. They don't scan, but if you're wanting to protect your address, it's a good option. They run about 200 a year in LA so maybe 130 or so somewhere smaller?

<comment><USER26> I love Traveling Mailbox. Been using it since I moved to Seattle. One overlooked feature is that you can have mail sent to multiple email addresses. So I don't have to worry about a family member opening an important letter and losing it or forgetting to tell me about it.

</comment></comment></comment><comment><USER27> So many companies have come and gone in the "print on demand" space. The barriers to entry are low and the market, while shrinking, is still quite large... If you consider the market those that send stationary (cards, letters, etc.). Having started a company in the space (engreet.com, since renamed [https://www.thegreetingcardshop.com](https://www.thegreetingcardshop.com) by its new owners), the fallacy is that most folks that send offline won't make the jump to digital. It's a different demographic that is slowly dying (sadly). From cardstore.com to Minted, there's still a market out there, but it's a fraction of the offline spend.

</comment><comment><USER28> I was looking online for some resources for sending mail online. I came across this thread and thought I'd add a repo to keep the links together. Thanks to all those who responded! Here's the repo: [https://github.com/caseyw/snail- mail-websites](https://github.com/caseyw/snail-mail-websites)

</comment><comment><USER29> _For the fastest payment service, Mail A Letter provides customers with a MailBank. Add funds to your MailBank with a VISA, MasterCard, American Express or Discover credit card or PayPal. Payment from each order will be deducted from your account automatically and you can avoid entering in your payment information for each order. You can add any amount (minimum $5.00)._

Uh huh, and i bet the money in said "money bank" is not refundable, so really it is $5 minimum

<comment><USER30> Seems reasonable given the payment processing fees.

I'm spitballing here, but ordering a single $1.54 letter would cost $0.30 + $0.03 in fees, $0.55 for the stamp, $0.03 for the envelope and maybe $0.25 for the labor, paper, ink, machine maintenance, overhead, etc. And that's before advertising and other costs.

So it seems pretty reasonable that they want to reduce that $0.30 fee, especially if a large number of people only order one card.

And in all honesty, if you're willing to avoid their service over worries of losing $3.46 in credit, you're probably not their ideal customer.

</comment></comment><comment><USER31> This site looks like it was designed back in the 90s, but the actual service sounds quite useful.

If you mail letters infrequently and/or don't own a printer, you're saving yourself the trouble of buying envelopes, buying postage, printing at Staples, etc.

But I bet the site could greatly improve its marketability by investing in a refresh of the site design.

<comment><USER32> I wonder if they've done some testing to compare designs.

A site that looks like it's designed in the 90s is probably highly attractive for many users. This "Mail A Letter Online" site, if compared to a 2019-looking snazzy SPA "smail.io" Bootstrap site and mobile app, probably wouldn't do as well for some audiences. But if their target demographic likes this style better, then this site is what they should be using.

Also, nothing prevents them from also starting up Photoshop and designing a snazzier sister site that's fulfilled through the same physical service.

<comment><USER33> Judging from the fact that the "How did you find us?" box on registration offers options like "Yahoo!", "MSN Search", "Ask", I'd say it's actually quite old (not saying that's a bad thing)

</comment></comment></comment><comment><USER34> This is similar. I've never used it but it looks fun: [https://handwriting.io/](https://handwriting.io/)

<comment><USER35> this is pretty cool. I would love to see a service takes writing samples in your own handwriting and produces a letter that looks like you wrote it.

<comment><USER36> > this is pretty cool. I would love to see a service takes writing samples in > your own handwriting and produces a letter that looks like you wrote it.

That would personally be horrifying to me. Imagine, someone can make it look like you said _anything_.

</comment></comment></comment><comment><USER37> My Grandmother loved the physical paper mail I used to send to her back home in the UK from [https://www.pc2paper.co.uk/](https://www.pc2paper.co.uk/)

She commented once that it took almost no time for the letter to get from the US to her. That's because, of course, I just uploaded the PDF for printing in the UK.

</comment><comment><USER38> Cost for taking a physical document and transporting it across the country to any arbitrary home or business in the United States, including Alaska and Hawaii, within about 3 days: $0.55.

Cost to print a text file, attach a stamp, and put it in a box outside to await the first company's arrival: starting at $0.97, and $0.47 for each additional page.

</comment><comment><USER39> This website isn't new, as most comments say. However, I've been using in the past a lot of times and works very very well. In fact, I used a lot the option to add a return stamp so if the other person wants to reply (mostly offices), they don't need to pay anything.

</comment><comment><USER40> I've created one similar service some time ago for Brazilian market called www.cartacarteiro.com.br however, after running it during some months with Google ads, the only visitors were my sister and some few friends. P.s. none of them paid a penny for the service at all.

</comment><comment><USER41> [https://hello.pixinote.com/](https://hello.pixinote.com/) is a properly beautiful product in this vein, though input is restricted to a square-cropped photo and a few lines of text

</comment><comment><USER42> I've been using [https://www.mailform.io/](https://www.mailform.io/). I see a lot more options on here. Which one is the best and why? To be honest, I just want the cheapest.

<comment><USER43> <shameless plug>

Thanks! Mailaletter.com is great, and we (Mailform) are a competitor. There's a few others you could check out:

click2mail.com

[http://simplepostal.com](http://simplepostal.com)

neopost.com

clicksend.com

papermail.in

letterstream.com

pingen.com

elipso.eu

postalmethods.com

sendovernightmail.com (also owned by us btw)

They're all pretty different along cost, features, delivery speed, etc. Cheapest probably depends how you define it (mailaletter is one of the cheapest if you're sending a single letter, click2mail is probably the cheapest if you're sending multiple, etc)

here to help, firstname.lastname@example.com :)

</comment></comment><comment><USER44> This post makes me think of the Railway in US. So late compared to Europe haha.

</comment><comment><USER45> [https://www.laposte.fr/lettre-en-ligne/telecharger- document](https://www.laposte.fr/lettre-en-ligne/telecharger-document)

</comment><comment><USER46> There is also [https://letterbug.co.uk/](https://letterbug.co.uk/) in the UK.

</comment><comment><USER47> I remember using this service to send mail to an incarcerated family member about 7 years ago. Works great with ASCII art too!

</comment><comment><USER48> Is there another service, where I get a PO box, and they automatically scan my mail and send me PDFs via email?

</comment><comment><USER49> Too bad there's not a postcard option...

<comment><USER50> [https://lob.com](https://lob.com) probably has what you're looking for. I've used their service for awhile and it's amazing.

<comment><USER51> Yeah I use Lob for a lot of my "write up a letter, print, and mail it with a written record of what I sent and when" correspondence. They make it super easy to send letters about as easily as an e-mail.

I am very clearly not the intended customer and appreciate that they're willing to take my business anyway.

I also used them for holiday cards two years back, which was

* Fantastic -- super straightforward to write up a small script to call their API and send 1 card to each person on our holiday-card list

* A little weird -- sending 70 holiday cards involved instructing their API to download an identical .pdf holiday card template from a remote server where I hosted that one file 70 times

* Cheap -- they printed and mailed glossy postcards at a very affordable price

* Ever so slightly disappointing -- we got to see maybe 10 of the actual mailed postcards from this run (on family's fridges, in the test copy we sent ourselves, and in the 3 or 4 postcards that we thought were addressed correctly but which were returned to us with an invalid address) and every single one of them had the same printing defect, what looked like a big scuff across a photo. Not sure what the deal was or why it was so consistent on every image. We didn't write in to support because I am pretty sure we are not the target audience.

Great service, A+, huge time saver vs. manually writing so many addresses, still a big fan.

<comment><USER52> Glad you like our service! In the future don't hesitate to reach out to us through support (I work at Lob)!

The scuff marks that you saw in your mail are most likely due to belt rollers in the USPS sorting facilities. We've tried a lot of different combinations of paper, ink and protective coatings to minimize the chance of mail pieces being damaged but we haven't found a combination that 100% removes the chance of damage during the USPS sorting process.

Throughout the mailing lifecycle a piece of mail will go through several sorting facilities. Each facility has similar sorting machines but they might be in different conditions. There's a chance that a certain sorting facility has machines with more worn out rollers that cause higher damage rates than others. This would manifest in mail pieces going to a certain zip code experiencing higher damage rates. For mail that is returned to the sender it has to go through even more sorting facilities (both when being delivered and back) that causes an even higher damage rate.

Here's a video showing you the type of sorting machines each mail piece goes through: [https://www.youtube.com/watch?v=gB7QOK1bd3U](https://www.youtube.com/watch?v=gB7QOK1bd3U)

</comment></comment></comment></comment><comment><USER53> I tried to do this about 12 years or so ago... domain was quickymail.com.... I probably gave up too soon.

</comment><comment><USER54> It uses http, not https for this -_-

</comment><comment><USER55> I like the idea!

</comment><comment><USER56> No https?

That's a major concern. It's 2019, (almost) everything needs to be https.

<comment><USER57> Why?

Also there is https on the more sensitive parts of the site (login etc).

<comment><USER58> Doesn't matter, it needs HTTPS on the whole site. [https://doesmysiteneedhttps.com](https://doesmysiteneedhttps.com)</comment></comment></comment>


Dart can now produce self-contained, native executables for macOS, Win and Linux - <AUTHOR> https://medium.com/dartlang/dart2native-a76c815e6baf <comment><USER2> Title should specify _command-line_ apps. I thought it could produce desktop GUI apps.

<comment><USER3> Though not the point of the article, it can indeed. I have created desktop GUI apps for Mac, Linux, and Windows in Dart using Flutter. It is still experimental and under development, but here's how: [https://github.com/flutter/flutter/wiki/Desktop- shells](https://github.com/flutter/flutter/wiki/Desktop-shells)

<comment><AUTHOR> I'm practicing with Dart for the past year and have just started trying to do some desktop programming, that's how I stumbled upon the link above. Desktop is still immature with Flutter, but is being worked on and I hope it will get a faster track from the team than web support.

</comment></comment></comment><comment><USER4> Can we design languages that target DartVM ?

I haven't seen much documentation around DartVM.

<comment><AUTHOR> In theory, you can write another language frontend for the Dart VM, but it isn't being utilized a lot as I can tell.

Here's a year and a half old page describing the Dart VM's internals: [https://mrale.ph/dartvm/](https://mrale.ph/dartvm/)

Also, here are two examples of different frontend add-ons for the Dart VM, although outdated: [https://github.com/thosakwe/bullseye](https://github.com/thosakwe/bullseye) and [https://github.com/jvasileff/ceylon- dart](https://github.com/jvasileff/ceylon-dart)

<comment><USER5> If you check out the dev branch of bullseye, I'm currently working on a rewrite, but it's on pause for a few months while I work on an internship.

<comment><AUTHOR> Kudos for the work!

Out of curiosity: what is the inspiration for this and what's the goal?

<comment><USER5> The inspiration is OCaml. I've used it a lot, and some of its best features, like sum types, are missing from Dart (and many mainstream languages).

As for the goal, I just want to finish it for now. I don't intend to publish packages in Bullseye, rather just to use it in projects to consume existing Dart libraries.

<comment><AUTHOR> Have heard praises about OCaml, but never tried myself.

Good luck!</comment></comment></comment></comment></comment></comment>


Is my developer's home-brew password security right or wrong, and why? - <AUTHOR> http://security.stackexchange.com/questions/25585/is-my-developers-home-brew-password-security-right-or-wrong-and-why

<comment><USER2> I expected daily-WTF like idiocy, but Dave's code isn't insane. It's a pretty standard combination of a (sufficiently random) salt and a SHA1 based hash. SHA1 was until recently regarded "strong enough". Dave's code is unnecessarily obfuscated, but whatever. I don't see how this can be considered "homebrew password security" given that all the heavy lifting is done by SHA1. Anyway, Dave's solution is as good as a SHA1 based solution gets. That's already better than 95% of the websites out there (citation needed), but of course worse than the bcrypt approach suggested by the OP.

The OP pretends to innocently ask "Is my developer's home-brew password security right or wrong, and why?". I'm going to call BS on this. To me it's pretty clear the OP is trying to passive-aggressively bully/ridicule/shame Dave in order to get his way. And sure enough, the top ranked StackOverflow has somebody going through the code line-by-line going WTF at every opportunity. The OP isn't trying to figure out whether he or Dave is right, he's clearly already convinced he's right and wants the StackOverflow community to collectively pat him on the back. Kind of childish.

<comment><USER3> _To me it's pretty clear the OP is trying to passive-aggressively bully/ridicule/shame Dave..._

I had a different interpretation; OP _is_ "Dave." It's sort of a time-honored tradition, on-line and off, to seek advice "for my friend."

<comment><USER2> Nearly impossible. Every single sentence in the post provides evidence against that theory. (Dave " _Insists_ on using a home-brew script" / use of "Homebrew" vs "Standard solution" / Dave's "primary hang-up" became clear after he "immediately balked" / Ridicule of Dave's code is "sincerely appreciated", etc). It's so over the top that the entire post may just be an elaborate troll.

<comment><USER3> _Nearly impossible. Every single sentence in the post provides evidence against that theory._

On the internet, nobody knows you're a Dave.

</comment></comment></comment></comment><comment><USER4>
         $time = date('mdYHis'); // Probably in the database somewhere too
         $rand = mt_rand().'\n'; // Said to be a 31 bit number
         $crypt = crypt($user.$time.$rand); // DES crypt is 64-bits output

Since "$crypt" is time-varying, he's got to be storing $crypt in the database as the seed along with the password hash. This system is no better than a weakly-generated random 64-bit seed.

It's reasonable to assume the attacker knows the username. If the attacker knows the time the user was created, he can easily brute force the 31 bits of $rand. PHP mt_rand is not seeded with more than 32 bits of entropy, so with knowlege of just two (username, time, seed) entries the attacker learns the values of all other mt_rand numbers (past and future) generated by this PHP process. This may have significant implications for the security of other parts of the system.

        function hash_it($string1, $string2) {
            // Equivalent complexity to:
            return sha1($crypt, md5($password)).
        }

        $hash = hash_it($password, $crypt);

So the resulting hash is 160 bits long, by interposing MD5 it is guaranteed to not contain more than 128 bits of entropy. If nothing else, this is a waste of space.

In my estimation, this scheme is about 0.5 bits stronger than plain SHA-1 like Linkedin was using. 90% the Linkedin passwords have been cracked. [http://arstechnica.com/security/2012/12/25-gpu-cluster- crack...](http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every- standard-windows-password-in-6-hours/)

<comment><USER5> This is as strong as SHA-1 plus a salt, which is much stronger than SHA-1 without a salt(but still not a good way to store passwords). The salt does not need to be random, merely unique. Since salts are stored in plaintext in the database next to the hashed password, the assumption is that an attacker has those as well.

<comment><USER4> > This is as strong as SHA-1 plus a salt, which is much stronger than SHA-1 > without a salt

No, not really. Salts are used for two main reasons:

1\. So if two users have the same password, it's not obvious in the password file.

2\. To thwart precomputation attacks, e.g., "rainbow tables".

Modern password cracking has all-but obsoleted both of these reasons. For (1), if two users can "choose" the same password, then it's almost certainly a weak password that the attacker can guess as well. For (2), GPUs have gotten so fast now that password crackers don't even bother much with precomputed rainbow tables.

I'm not arguing against salting, it's still good practice. I'm saying it doesn't, in reality, add much time at all to the time needed to crack a database of passwords. It's just that at the end of the day, it _all_ comes down to the entropy content of the user's password as experinced by the attacker.

<comment><USER5> I have a database of 1 million users. Regardless of what hashing algorithm I am using, if there is no salt I just need to hash the entire password space once, where the password space could be a dictionary attack or a brute force of passwords up to length 10 of letters, digits, and symbols. If there is a salt, it means that after hashing the entire key space I only have the password for 1 user rather than all of them. It means attackers must use targeted attacks and slows them down by a factor of # of users. Rather than having all my passwords in a day, an attacker gets access to one user's password per day (over the course of a million days). (Still not a good thing to happen)

<comment><USER4> > I have a database of 1 million users.

Similar to Linkedin with 6.5m, we have a real-world case study.

> Regardless of what hashing algorithm I am using, if there is no salt I just > need to hash the entire password space once, where the password space could > be a dictionary attack or a brute force of passwords up to length 10 of > letters, digits, and symbols.

When you say "entire password space" you're implying that there's a hard upper limit on the complexity of a user's password. Many sites do indeed restrict passwords to 8 or 10 characters, but that's horrifically broken.

Any not-completely-broken system has an password space so much larger than an attacker could search that it's effectively infinite. Note that even the silly system proposed here uses MD5 which accepts password longer than would even fit into available memory.

> If there is a salt, it means that after hashing the entire key space I only > have the password for 1 user rather than all of them.

As described, the "key space" is effectively infinite, but luckily for the attacker some parts of it are far more richer to mine than others. This is where the easy-to-guess passwords lie.

So the attacker won't do anything as dumb as "hashing the entire key space". The attacker will search the most rewarding parts of the keyspace first.

> It means attackers must use targeted attacks and slows them down by a factor > of # of users. Rather than having all my passwords in a day, an attacker > gets access to one user's password per day (over the course of a million > days). (Still not a good thing to happen)

For example, recent data breaches suggest that 50% of users will choose one of the 10,000 most-common passwords. So the attacker tries this set on all 1M of your users. That's 10,000,000,000 hash operations. A typcial rate for SHA-1 is 3.8 _billion_ per second, per GPU. <http://hashcat.net/oclhashcat-lite/>

So our expectation is that the easiest 500,000 of your 1M accounts will be cracked in the first 5.2 seconds by a single GPU attacker. And this is approximately what happened with Linkedin, ISTR 60% of the passwords were reported cracked that first day.

But the rate of success slows down for the attacker and the remaining passwords begin to take exponentially longer. As of today, 90% of the Linkedin database is reported to have been cracked: [http://arstechnica.com/security/2012/12/25-gpu-cluster- crack...](http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every- standard-windows-password-in-6-hours/) So there are really only 65,000 hashes posing any difficulty at this point.

When a fast hash function is mis-used for password hashing, salt or no salt, there's not a case where "an attacker gets access to one user's password per day". The attacker cracks the majority of passwords in the first few seconds yet a small minority will never be cracked.

Salting doesn't save the database as a whole. Salting doesn't help the users with weak passwords. Salting doesn't even help the few users with very strong passwords, they wouldn't need salt in the first place. But for the users in the 60 - 90 percentile, it might buy them a few hours or days.

<comment><USER5> > Similar to Linkedin with 6.5m, we have a real-world case study.

Except that Linkedin's passwords weren't salted.

> When you say "entire password space" you're implying that there's a hard > upper limit on the complexity of a user's password

That's why I said "where the password space could be a dictionary attack or a brute force of passwords up to length 10 of letters, digits, and symbols". I don't actually mean the whole key space, just whatever the attacker chooses to target.

> So our expectation is that the easiest 500,000 accounts will be cracked in > the first 5.2 seconds by an attacker with a single GPU

OK, I concede that point that in this case the salt is not helping so much, at least for users using the 10000 most common passwords. For the few hundred thousand users users whose password lies in a larger key space (but still in the range of bruteforce), the salt still protects them.

Getting back to your original point

> Modern password cracking has all-but obsoleted both of these reasons [for > having a salt]

Let's look at a better hash function - bcrypt. In this case hashing passwords is still slow enough (by design - you can slow it down to whatever you want) that rainbow tables would again be useful - to compute the hash of 10000 passwords with a difficulty such that each hash takes 1 cpu-second to compute will take almost 3 hours. Adding salts makes this a per user operation instead of a global one.

<comment><USER4> > Except that Linkedin's passwords weren't salted.

My point is that salting a fast hash function is like issuing lifevests to the passengers of the Titanic. It sounds better than nothing, but in practice it only just keeps a handful of them from drowning so they can die of hypothermia a few minutes later.

> That's why I said "where the password space could be a dictionary attack or > a brute force of passwords up to length 10 of letters, digits, and symbols". > I don't actually mean the whole key space, just whatever the attacker > chooses to target.

Sounds like you think you get to decide what the attacker will target first and when he will give up.

> Let's look at a better hash function - bcrypt.

Agreed, bcrypt is categorically better. But note that bcrypt includes salting as an intrinsic part of its implementation. So it's not something any web programmer could say "I will/will not salt my Bcrypt thusly".

As tptacek says, "if you're typing the letters A E S or 'salting your hashes', you're doing it wrong."

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> A meme post, by a StackExchange mod, got upvotes?

(<http://security.stackexchange.com/a/25637/3773>)

<comment> lost-theory Yes, and by the same mod: "Deleted long discussion on preimage attacks, collisions, hashing strength etc – Rory Alsop ♦ 8 hours ago"

<comment><USER7> Aye - we delete ALL long winded discussion in comments, as Stack Exchange isn't a discussion forum.

<comment> lost-theory That may be the rule, but it seems perverse to delete useful comments, which add to the conversation, while adding meme pics, which add absolutely nothing useful to the conversation.

P.S.: Meme pictures originated on discussion forums.

</comment></comment></comment></comment><comment><USER8> Bcrypt _is_ published. That's its strength, not its weakness. That's how cryptography is. The more people try to break it the better it gets.

Dave's primary problem is that his scheme is based on MD5 which is still well known, but can be brute forced quickly. His additional lightweight obfuscation will provide nearly zero extra protection.

Use Bcrypt with salt. End of story.

<comment><USER9> 'xactly.

Published crypto is stronger because it's had many eyes on it, not weaker. This is pre-101 level crypto knowledge, it's like the first line in the idiot's guide. Or it should be!

</comment></comment><comment><USER10> I write GPU-based password bruteforcers. The main flaw of this algorithm is that it is not iterated: it makes a single call to the MD5 then SHA1 compression function. As a result, I estimate it can be bruteforced way too fast, around 1 to 1.5 billion password/second on a AMD Radeon HD 7970 ($400).

(On this GPU, MD5 alone can be bruteforced at 8 billion pw/sec, and SHA1 alone at 2 billion pw/sec.)

This one flaw, by itself, makes the algorithm very bad. The developer should have used bcrypt, or scrypt, or SHA2-based Linux crypt. These are iterated by making multiple calls to a compression function to significantly slow down bruteforcing, from billions/sec down to thousands/sec.

</comment><comment><USER11> The main problem here IMO is that this thing will be used to store passwords for a longer period of time than anyone will spend bothering to break it now. So you store your entire password database this way, then two years from now you get breached, and both your database and your code gets exposed.

Then, you _might_ benefit from nobody wanting to bother to spend the energy to reverse-engineer your one-off GoofHash(). But, then again, maybe not. Maybe the fact that all of the passwords have been effectively hashed using single iterations of fast trivial algorithms like SHA1 and MD5 will mean that a ton of your users' passwords could be calculated in a short period of time.

In that scenario, you're gambling instead of relying on battle-tested approaches. Maybe the gamble will pay off, probably it won't, but when the battle-tested approaches have been examined by a lot of really smart people and found to be solid, why not use them instead?

Or, put another way: you're going to have to play a game of dice against Death. You have a choice between playing with a set of dice that thousands of people have rolled over and over again and found to be fair so far, or a set of dice that some dude just rolled for the first time a minute ago and declared to be fair. Which do you choose?

edit: I am an idiot. If someone gets the code and DB, they won't have to reverse-engineer anything; this is just a fast MD5/SHA1 combo, a bunch of passwords could be brute-forced in a short period of time.

</comment><comment><USER12> Does anyone know of a decent introductory, authoritative text on cryptography? I haven't needed to know this stuff before beyond "use bcrypt because it's good, MD5 is rubbish", but have recently been given the task of generating license keys for our product. I would like to be able to test that what I've created isn't trivially crackable.

<comment><USER13> You're going to have to define "trivially crackable". Sure if you use a public key they can't create a keygenerator. After that, crypto has little use to you.

A user can just open your binary and flip the jump that checks if the license is good or not. Do you really want to start wasting time making your software vastly more complicated, in order to try to lock out crackers? If the software is remotely desirable or common, it'll get cracked.

<comment><USER12> For me, trivially crackable here refers to having someone who has read a basic text picking the license key out of the registry and going "hmm, that looks like a such-and-such key, I wonder what happens when I run it through this program here. Oh look it works, I think I'll just extend the date of the license to forever and tell all my friends."

If someone wants to go and disassemble the app and read all that machine code to find the bit to flip then there's not much I can do about that I think.

<comment><USER13> "Read all that machine code" - I think you highly overestimate the difficulty of that.

Take a simple checking function. Check the code, if it is wrong, show a message box saying "wrong code". Well, in that case, all you gotta do is set a breakpoint and go back. Programs like OllyDbg or IDA Pro make this kind of reverse engineering absolutely trivial, and something you can accomplish after "reading a basic text".

Most likely if someone's going to "run a program", they can run a crack, too. If you can get away with a license file, then you can do RSA properly. Otherwise, end up with short RSA and hope no one really looks.

It's almost certainly the case that you're far better off improving some other aspect of your application than investing any time trying to defend against pirates.

<comment><USER12> Thanks for the pointers to OllyDbg and IDA Pro - I'd never heard of them. Embarassingly, it's been quite a few years since I tried _actually_ hacking a program; especially since I'm posting on " _Hacker_ News".

<comment><USER13> Here's a tutorial I wrote in 2004 which is still a decent start these days. If anything, it's easier these days, because IDA Pro has HexRays which can decompile code into C and makes it very easy to navigate a compiled module.

[http://www.atrevido.net/blog/PermaLink.aspx?guid=ec99e239-89...](http://www.atrevido.net/blog/PermaLink.aspx?guid=ec99e239-8917-48e3-bd4f-af866b730150)

</comment></comment></comment></comment></comment></comment><comment><USER14> <https://www.coursera.org/course/crypto> is excellent

<comment><USER9> I did this as well, awesome course. The drop-out rate was astounding from the feb-may run though, from 70K signups there were only 1-2K that completed IIRC.

<comment><USER4> Wow. I'm even happier to have completed it then!

Agreed, it was a great course. Looking forward to the sequel in early April. <https://www.coursera.org/course/crypto2>

<comment><USER9> Thanks fr the reminder, must get involved in that, it's fascinating stuff.

</comment></comment></comment></comment><comment><USER15> When your machine is breached and the list of hashed passwords is stolen along with the code the attackers will be able to brute force at very high speed all of your customers' passwords, then use these to get into the customers' gmail/yahoo/hotmail/paypal accounts (because they used the same or similar password) and from there do real financial damage to your customers. And it will all be your fault.

The point of bcrypt is to make it so they can't brute force at high speed. (If you choose your number well enough.)

</comment><comment><USER16> The published algorithms are prune to dictionary attacks. If you can have even a not too good cryto-algorithms, whose logic is kept really secret you are much secure.

Let's say a hacker, some how got into some non-secure services with good amount of user. And found out the username/password are not encrypted or hashed at all. He can use that list a dictionary. He can also have MD5, SHA1 hashed calculated. The same hacker got it into your secured service, who already have a dictionary to try on. He can get password from MD5 or SHA1 or any known hash, in O(1) using hash-table lookup. Normally, hackers now-a-days have the dictionary to try on, it is just the SALT and hash-algorithm is unknown to them. So, the security measures can be:

1\. Protect password Hashes from theft. 2\. Protect salt from theft. 3\. Protect hash function from theft.

Try to protect them all. All of them can stolen, but probability of 3 theft is less than 2 theft. I agree with Dave, only if he has plan to keep hash function secret. I should not shipped inside java script, so hacker don't need to do any effort.

<comment><USER17> This is more-or-less totally incorrect. The only thing you got right was 'use salt to help against precomputed tables'.

Cooking up goofy hashes doesn't give you any extra security in the worst case scenario (the hacker gets access to your web server and has the source code for your goofy hash). A goofy sha1/md5 based algorithm with salt can still have millions upon millions of attacks generated per second by anyone with a half-decent GPU. Your only hope once you're in this scenario is to use a big slow hash that the attacker can't run very fast -- y'know, something like bcrypt.

And if you're right that they're more likely to get the db without the source (very dubious -- web servers are a big attack surface)? Then the attacker is still completely screwed trying to break your too slow to attack bcrypt+salt passwords. You've got much better safety in _every_ scenario, not just the "well they didn't manage to see how my goofy hash worked" scenario.

(And that's assuming you, as a non cryptographer, didn't so thoroughly screw up your implementation of goofy hash that it ended up with less entropy than even md5. But how would you know when you've kept it super-secret for l33t security?)

</comment></comment><comment><USER18> For a short password, does it help to first calculate a hash using MD5 or SHA1 and then run it through Bcrypt? As far as I have understood it's better that the password to encrypt is long enough which the first simple hashing takes care of, or am I wrong?

<comment><USER19> My gut tells me no. If your password process is to take a string, get the MD5, then call bctypt on the MD5, then you are essentially doing the same as calling bcrypt on the string.

If the USER takes a short string, and MD5's it then sets the MD5 as their password then it is more secure, but that is only because it is a longer password to begin with.

If I'm wrong I'd be interested in knowing why.

</comment></comment><comment><USER20> Re-implementing crypto functions is generally a terrible idea, unless you really know what you are doing (and most likely you don't). There are so many different relevant factors to consider, that single individuals or organizations are really unlikely to be able to cover reasonably close to completely. That's why standards and "well known" algorithms are a good choice.

Also, "security through obscurity" is well known as a worst practice for crypto (probability that the algorithm will be reverse engineered or disclosed is all but negligible), so definitely not a good reason to implement any new algorithm.

</comment><comment><USER21> This is actually quite tame - I've encountered developers who justified writing their own web server (in VB6!) because it would be more secure than "standard" web servers - this was for quite sensitive commercial data...

</comment><comment><USER22> The md5 and shuffling of the md5 hash before doing a sha1 is entirely pointless.

The salt generation looks acceptable though.

The op stated that he already created a system using bcrypt. The fact that op doesn't know what is wrong with Dave's code, and needs others to explain why Dave's code is bad, makes me lean towards op stfu and allow Dave to continue.

Op is unlikely to be any more competent compared to the somewhat incompetent Dave.

I agree that it is likely that op and Dave are one and the same, and think this mess of code is some sort of genius.

</comment><comment><USER23> The only instance in which homebrew password security isn't wrong is if you are actively involved in research and experimentation, destined for publishing and peer review, into better security methods.

We don't publish security-related algorithms to make them stronger. We do it to weed out the weak, and it is remarkably effective at doing that. If you're not confident that your algorithm could survive in the open, then chances are it can't.

</comment><comment><USER24> Dave's mentality about having hashing that is unpublished is also known as "security through obscurity". Relying on the fact that nobody can see your source code. That's generally known to be a poor strategy.

Ironically, if he would just substitute bcrypt for sha1 in his function, it would be a great crypt function!

</comment><comment><USER25> This is silly, true, but "you are not a cryptographer, use bcrypt" is not helpful. You could design an equally silly password hashing scheme using pbkdf2 and bcrypt, the recommended alternatives:

        sillysalt(user):=user+date+mersenne_twister()
        sillykdf(user,password):=pbkdf2(sillysalt($user)+
               shuffle(bcrypt($password)))

        persist( sillysalt($user)+":"+$outer_pbkdf2_salt+":"+
            $inner_bcrypt_salt+":"+sillykdf($user,$password))

A scheme like this is designed to thwart offline attacks on the password verifier (for example, an attacker acquires a dump of your database).

His user+date+mersenne salt accomplishes the goal of (mildly) increasing the cost of precomputed attacks. He should use a CSRNG instead.

He uses existing cryptographic hash algorithms, SHA1 and MD5.

His shuffling does not add or detract from the security of the scheme.

He does not perform any significant key strengthening. Weak (most) passwords will be very cheap to brute force.

<comment><USER4> > His user+date+mersenne salt accomplishes the goal of (mildly) increasing the > cost of precomputed attacks.

Most password crackers these days are using GPUs and don't even bother with precomputed rainbow tables. So the salt is not increasing their cost at all.

<comment><USER25> You didn't actually disagree with what I wrote. What you wrote is also true.

</comment></comment></comment><comment><AUTHOR> tl;dr - don't break the first rule of cryptography (<http://meta.security.stackexchange.com/a/915/12776>)

> "Anyone can invent an encryption algorithm they themselves can't break; it's > much harder to invent one that no one else can break" - Bruce Schneier

</comment><comment><USER26> A primary tenet of cryptography is to assume that the mechanism of an encryption is known. This is a case of someone, honestly, not being educated about the topic and therefore I would definitely not want someone like that making security decisions.</comment>


What Fred Wilson and the VCs don't get about advertising - <AUTHOR> http://pandodaily.com/2012/12/12/what-fred-wilson-and-the-vcs-dont-get-about-advertising/

<comment><USER2> Okay, I'll risk being "that guy" who starts about adblock, but I seriously tend to forget that there even is advertising on the web, let alone that it is still a source of revenue for anyone else but Google.

I've always considered it one of those walking dead business-models, like printed newspapers, and it regularly surprises me the practice is still alive and well. I would be terrified to let my business depend on it.

<comment><USER3> > a source of revenue for anyone else but Google

My theory is that internet advertising is a zero-sum game (out of the left- hand pocket into the right-hand pocket sort of thing), but there hasn't been any serious, credible research to prove or disprove my intuitions.

And no, "serious" and "credible" do not apply to companies that sell internet advertising and point to their own (air quotes) reasearch as proof that internet advertising works.

AdBlock Plus and Ghostery for the win, by the way.

<comment><USER4> let me get this straight.. you think companies are spending billions every year on advertising without any proof, ROI figures, just solely from the seat of their pants without any research, studies, etc? I assume because a company like Walmart, for example, with a profit margin of 3%, is so flush with cash they just throw around $600 million+ every year without any thought. Amazing.

I own an ecommerce store, 10 years. I can tell you that internet advertising does more than pay for itself if you control the costs, track the sales that result from it, etc (which is standard practice in internet advertising).

That's why when GM said they spent 10m+ on facebook with a very poor ROI, it was big news. Advertisers will test new platforms like facebook, and when they fail to perform, they will abandon them very quickly.

Google has lasted this long not because advertisers are stupid, but because Google's Adwords has a positive ROI.

<comment><USER3> Still waiting for those links to serious, credible research.

Yeah. I didn't think so.

<comment><USER4> Look, I'm not going to go Google articles for you. You're perfectly capable of doing that yourself. We're talking about an industry with 140+ billion annually in revenue in the US alone (w/ about 35b spent on the internet). If you think there isn't research on it, you're kidding yourself.

</comment></comment></comment></comment></comment><comment><USER5> What the ad-supported business has going for (and against it) is that the results are roughly linear with investment -- it's a plausible business plan for an individual to make $1000 a month in ad revenue in their space time. The business plan isn't too different if you've got a company with more staff that takes $100,000 a month to support except it's harder to cherry-pick a niche that's more profitable than average.

A company like AirBNB has to make a nonlinear change in people's behavior to succeed, it has to cross some threshold, which produces a certain kind of risk and poses a certain kind of reward. Advertising, in itself, doesn't need to be disruptive to succeed.

For big brands you're facing the need for big investments to keep up your brand. For instance, ESPN spends a lot on IP rights, photographers and other things, and that is what makes ESPN a premium site. Again, you don't have this tiny investment that explodes, but a slow and steady crawl that, in their case, is surely subsidized by the huge multichannel TV business.

</comment><comment><USER6> Thanks - good post. That said, I don't think Fred Wilson was being unreasonable.

I'm far from an expert but I'd agree that the ad business is a tough one in which to succeed, maybe not when contrasted w/ mobile apps or gaming, but certainly when compared to other web businesses with more distinct revenue streams like enterprise solutions, etc.

Perhaps the founder of a successful advertising-based business such Bleacher Report would disagree, but he has good reason to do so!

</comment><comment><USER7> The author ignores that there are a limited number of big ad budgets that will spend big $$ on shitty placements like ESPN, etc.

I speak from experience. Anyone spending more than $1m a year on Internet advertising is investing in "branding" more than they are investing in "conversions". If you want to take the risk that this scales, go for it.

<comment><USER7> And perhaps I should add a "why" - the universe of web properties that can convert is limited. They typically have a small audience, so the real spend for any specific brand that will really convert into actual $$ sales is limited. I'm guessing that its around the $1m mark. I could be wrong by an order of magnitude, and probably not much more.

</comment></comment><comment><USER8> Advertising based businesses are 100% about scale because making money with ads is about math. Take a CPM of $10. To make $10,000,000 you need 1,000,000,000 page views. Figuring each user views 10 pages (which is probably high), you are now down to something like 100,000,000 user sessions. Now, figure each user visits your site 10 times a month (which would be a pretty site), you're now down to needing 10,000,000 users a month to make $10 million a month. That is a per user value of $1 per month or $12 a year.

Now, compare that to a SAAS that charged $25/month/user. You're now talking per user revenue of $300 per year. It's a lot easier to build a company at $300/user/year than $12/user/year.

To make $10 million a month at $25/user a month you need 400,000 users. That's still a big number, but it's probably easier to reach 400,000 customers than it is 10,000,000 users.</comment>


Your product sucks... and why that's OK - <AUTHOR> http://www.tnl.net/blog/2012/03/11/your-product-sucks/

<comment><USER2> There are some great points in there, particularly the quote from Ira Glass.

It's frustrating to have the taste to recognize what great looks like but not the talent to produce that result yourself. But that demarcation line, not giving up, saying to yourself, "Ok, that didn't work as well as I wanted, it's not great but it wants to be, what's the next thing to change that could make it better?" That seems to make a big difference.

<comment><AUTHOR> You should click on the link to the youtube video. The whole thing is worth it.

</comment></comment><comment><USER3> I was quickly skimming the article but then I stumbled upon my project management mantra:

"A lot of people think that the first outing with a product is the product but the truth is more complicated. Whether you are going out with a minimum viable product or something more complex, there comes a point where one has to make the call as to a product being "good enough" for the marketplace. And "good enough" for anyone who has poured sweat and tears into a product is seldom what comes out of that first product."

and I had to read it, top to bottom. Best ten minutes of today's internet.

<comment><AUTHOR> Thanks _blush_ :)

</comment></comment><comment><USER4> This is the problem with being arrogant: apart from being unkind, you often miss really good things. Arrogant means never needing to listen. Never needing to listen means not being awesome :-)

<comment><AUTHOR> Yup. It was a hard lesson to learn. Don't ever let the success go to your head. Time, fortunately, has allowed me to get better at this :)</comment></comment>


Norman Borlaug: How to Continue the Fight Against Hunger - <AUTHOR> http://online.wsj.com/article/SB121271006714350451.html <comment><USER2> Not saying the starving masses don't need to be fed, but is enhanced food production really a long-term solution? Seems to me no matter how much food production is raised, population growth will eventually catch up.

That's assuming that there is a natural limit to the amount of food that can be produced on the planet. Also, do we really want to reach that limit, or maybe we all live more comfortable if we can stop population growth before that?

<comment><USER3> _Seems to me no matter how much food production is raised, population growth will eventually catch up._

How do you reconcile this assertion with the negligible population growth in many of the developed countries?

<comment><USER2> Well if you assume that population stops growing, there is no need to raise the food production. Of course in theory population growth can be stopped. I just meant that ever growing food production can not be the solution. Instead, it would probably make more sense to focus on stopping population growth.

<comment><USER3> It works the other way, though. People in less developed countries have kids because they need them to produce food. When they know that they won't starve without having many offspring, they have fewer.

Another way to look at it is that having a child in a less developed country is closer to a net gain in terms of payback to the parent over the life of the child. In developed countries, children are a big investment on which no one expects to come close to breaking even.</comment></comment></comment></comment>


Java Build Systems - a sad state of affairs - <AUTHOR> http://grok-code.com/538/java-build-systems-a-sad-state-of-affairs/ <comment><USER2> So, the Java build systems suck? You should see the .NET ones - those make me cry.

I mean that the glass is half full. I wouldn't call a full dependency resolution system like maven's "a sad state of affairs."

<comment><USER3> Amen sir. I made a switch to .NET and boy suddenly the Java ecosystem (library, builds, IDE) looks a lot better!

</comment></comment><comment><USER4> There is buildr as well

<http://buildr.apache.org/>

It is built on ruby and follows the Convention over Configuration route. Which keeps the build file quite small.

It has hooks into maven and can be run on jruby or ruby

<comment><USER5> buildr is actually an extension of rake. It essentially adds tasks for building Java projects (classpaths, libraries, etc) and for packing standard formats (jar, war, ear, etc). I've been using it for a while now and it's great.

</comment></comment><comment><USER6> The article makes no mention of the solutions implemented in the newer languages on the JVM:

\- Groovy has Gant (<http://gant.codehaus.org/>)

\- Clojure has Lancet (<http://github.com/stuarthalloway/lancet>)

Both of these avoid the "XML tag soup" problem.

<comment><USER7> I believe on the Clojure side, leiningen is the preferred tool of choice:

<http://github.com/technomancy/leiningen>

<comment><USER8> Leiningen leverages the maven repository underneath, but has a much simpler, less scary API so it was adopted pretty quickly by clojure programmers.

</comment></comment></comment><comment><USER9> What's mentioned as drawbacks are powerful features Maven provides to handle the project/plugin dependencies better. It takes a bit of understanding and experience to appreciate these features and to use them effectively. I've used Maven the right way in one of the biggest enterprise environments as well as a couple of startups and the results have been nothing short of phenomenal. Am still baffled by how most of the expert Java/JEE programmers have very little knowledge about how Maven works.

<comment><USER10> _It takes a bit of understanding and experience to appreciate these features and to use them effectively._

That would be the reason why most expert JEE folks aren't getting Maven. It's not a short or easy learning curve. even on a good day with good folks to help you wade through it.

That said, Maven's dependency management engine alone is worth the price of admission. Bye-bye JAR hell. But the integrated build/release/tag/version features are the real treat once you get that far...

<comment><USER9> Yes. Thats why companies that can afford have separate build engineers. Maybe one shouldn't be called an expert if they have a poor understanding of how their build system works? My first couple of interview questions for Senior JEE engineers always revolves around their understanding of build and I've found it to be a useful parameter to validate their claims of being an expert.

</comment></comment></comment><comment> brown9-2 Is there any build system that doesn't have it's problems?

edit: The discussion on Reddit points out many details about Maven that the author has gotten wrong: [http://www.reddit.com/r/programming/comments/dmu26/java_buil...](http://www.reddit.com/r/programming/comments/dmu26/java_build_systems_a_sad_state_of_affairs/)

<comment><USER11> Exactly. I'm mostly a C++ programmer and I have yet to find a build system that I'd like enough to actually use even in my small hobby projects.

<comment><USER12> If I might make a (self promoting) suggestion, I wrote one specifically for small C/C++/ObjC projects. You can find the most recent release here[1]. Only a few people have used it, but so far the response has been positive.

[1]:<http://github.com/sahchandler/bit/tree/CaressofSteel>

</comment></comment></comment><comment><USER13> I also have my own build system, fbuild:

<http://felix-lang.org/tags/fbuild>

That has some basic support for Java. I'm using Python3 for my dsl. Here's a dummy example of how to use it (from <http://github.com/erickt/fbuild/tree/master/examples/java>):

        import fbuild.builders.java

        def build(ctx):
            java = fbuild.builders.java.Builder(ctx)

            lib = java.build_lib('lib.jar', ['World.java'])
            exe = java.build_lib('exe.jar', ['HelloWorld.java'], classpaths=[lib])

            ctx.logger.log(' * running %s:' % exe)
            java.run_class('HelloWorld', classpaths=[lib, exe])

I haven't had much demand for Java support, but it probably wouldn't be that difficult to extend it to download from a maven repository.

</comment><comment><USER14> "But Maven uses XML too" - since Maven 3 you can use Groovy, JRuby & Scala too.

<comment><USER15> I admit I'm entertained by your use of the word "since." Maven 3 is still beta. When it gets released and adopted I fully believe it will be great. I won't be depending on it until it is ready for prime time.

I do wonder if Maven 3's flexibility will hurt it or help it in the long run. Yes pom.xml is XML, but at least there is only one dialect. If team A likes XML and team B likes Groovy, development manager C will have a fun time getting them to work together on project D.

</comment></comment><comment><USER16> _Or maybe you want to loop through a set of files and perform a set of operations on them._

If you did start putting clever code into Ant files, they'd get so huge they'd be unmanageable. It's really really easy to just write your own Ant plugins in Java.

Then your build files are very straightforward and readable, and just look like a set of simple file operations and method calls.

Then Ant becomes really powerful - you can even write some plugins that take a web server out of service using telnet to Cisco LocalDirector, SCP a deployment build across and all sorts of other clever stuff.

Plugin example:

      public class MyTask extends Task {

        private String param1;
        private String param2;

        public void execute() throws BuildException {
          // do something
        }
      }

Then in the XML:

      <myTask param1="..." param2="..." />

<comment><USER17> If you have to drop into raw Java to accomplish anything exceptional, it largely defeats the purpose of build scripting.

</comment></comment><comment><USER18> Sometimes I suspect that the amount of time spent on build issues, IDE configuration, continuous integration, version control, and dependency management approaches half the total time spent on the project.

<comment><USER19> I think that one of big reasons people jump to new languages like Ruby is that there isn't all this cruft. It may not be related to the build system but just look at logging in java versus logging in Ruby. I know everybody likes to talk about the advanced features of the Ruby language but I can't help but think that much of the productivity boost comes from getting rid of this stuff.

<comment><USER20> _It may not be related to the build system but just look at logging in java versus logging in Ruby._

I was in a meeting once where I was the lone "cowboy" Perl programmer amongst amongst a group of Java dudes. One Java dude told another off for doing logging wrong. He said "I have a book on this logging package if you want to borrow it."

None of them knew why I laughed, but to me, logging was just a fancy print statement. And somebody wrote a book about it.

<comment><USER3> The thing about Java developers is that some of them are probably seasoned developers. They've been through many projects with scars everywhere. From each project, they learned something new (not necessarily the best way, but albeit something new). Combine that with the fact that there are people out there who have been through these situations and wrote "best practices".

When they build the next system, they will try to use these best practices to avoid their problems they've been through in the past. When this happened, they are already experiencing the second-system syndrome (but they don't realized it).

Of course each project differs right?

<comment><USER21> yes nothing beats inexperience

</comment></comment></comment></comment></comment><comment><USER22> Actually I have my own contribution to this space:

<http://ebuild.origo.ethz.ch/wiki/ebuild>

Although unfortunately the documentation is not ready yet, it is quite capable and is designed to solve what I perceive to be critical short comings of maven.

<comment><USER22> I've added some documentation. Far from complete, but it should shed some light on the situation for the curious.

</comment></comment><comment><USER23> I still use Makefiles, and I like it!

<comment><USER24> There's something to be said for relatively simple tool like make. It can be a lot easier to understand what's going on with Make because it eliminates the layers of stuff between the build script and the actual commands that are run. That's not to say that it's possible to write inscrutable Makefiles.

<comment><USER25> Java presents a lot of problems for make (multiple classes from a single java file, JNI produced files, circular class references, package to package dependencies).

</comment></comment></comment><comment><USER26> The writer of this article either a troll or untalented hack.

Lets talk about the article : a) the so called XML tax : Agreed XML is not the best representation of information but it does seem to be particularly suited for build tasks. Ant's plug in tasks give you a lot of leeway -- a prudent programmer would know how not to hang herself or himself. I hope for the writer's sake that the example he chose is not from his actual project. If it is, then the writer should probably find a different line of work.

b) Netbeans now supports Maven 'natively'. And before that, I have been faithfully and successfully upgrading my Netbeans version while working on enterprise scale applications. The problems that the writer mentions are either exaggerations or a reflection of his ineptitude.

c) Maven : it took me a while to wrap my head around it and I hated learning how to write plugins -- in xml. But it was worth the effort. I implemented a Continuous Integration build system for my project that builds an EAR with over 1.2 million line of code.

Maven just works -- once you have put in the effort to learn the platform. The writer has not put in any effort towards that. In fact the maven problem he talks about is actually a quote from a third party. This guy really does not know what he is talking about.

Don't get me wrong -- ant and maven are far from perfect ; but this article only betrays the writer's ignorance and lack of skill.

And then he goes on to recommend Rake . Would you take recommendation from a guy who whines about stuff he knows nothing about ?

</comment><comment><USER27> It's true. They're all pretty sad. That said, the problems he lays out with Maven are mitigated fairly well by using a local Maven proxy. I like to keep all of my dependent bits in there, and I'm no longer at the mercy of changes or differences in repos.

</comment><comment><USER28> I loved the comment about the upgrade treadmill. Some build systems have unintended consequences.</comment>


TestFlight Desktop App (private beta) - <AUTHOR> https://testflightapp.com/desktop

<comment><USER2> Interesting. I'm currently using TestFlight for my first iOS project. This app doesn't really change the current workflow of registering new tester devices, does it?

Btw. one thing that annoyed me about your service, is the lack of transparent documentation about that workflow. Judging from the website I thought that the UUID registering process is part of the service. It was only until I found a thread on StackOverflow that it became clear how TestFlight is supposed to be used when inviting new testers. It's still a good service but please make this more transparent.

</comment><comment><USER3> TestFlight was a great service for a long time. We ended having to roll our own distribution system recently though, as their servers have been very unreliable. Clients don't like to hear "you'll have your beta once TestFlight's server start working again"</comment>


Ask HN: Are you a morning person or a night owl? - <AUTHOR>

I'm a morning person, what are you? <comment><USER2> Morning person by choice, though I quickly default to night owl if I let myself.

I get a decent boost of clarity and creativity late at night, but the tradeoff is feeling like garbage with a long ramp-up period whenever I have to wake up the next day. Now I make a point to get to bed between 10 and 11pm so I can be up by 730 (I have Rheumatoid Arthritis that slaughters my sleep quality, so I need 8hrs in bed minimum to feel reasonably rested). I rarely get into quite the same cognitive zone during the day as a do at night, but I feel much better overall.</comment>