PostgreSQL 9.5: UPSERT, Row Level Security, and Big Data - <AUTHOR> http://www.postgresql.org/about/news/1636/ <comment><USER2> Whenever there is a version update, I can't help but be grateful for the documentation ethic of Postgres. For the vast majority of my projects I have to wade through unaffiliated and incomplete blog tutorials that may or may not be relevant to the version I'm trying to use. With anything related to Postgres, I may read about something on a blog post, but I _always_ know that I can count on the Postgres documentation if I need supplemental information, or sometimes I'll skip the post and go straight to the official docs. The PostgreSQL project, in my mind, sets the standard globally for software documentation.

I should add that Postgres was the first database I ever used, and I literally learned pretty much everything I know about Postgres, SQL, as well as Relational and Set Logic from the official docs. And that was with no background in software development and an undergraduate business degree with Excel being my most technologically advanced toolset. _That_ is a documentation success story.

<comment><USER3> Remarkable similar to my own history with Postgresql, which I started using in ~1998 at the time of their first public release. Postgresql documentation has indeed been the exemplar for all software, open source or not. It's been the SQL textbook I've relied on.

With the steady addition of features, it's gotten much more complex, and there will come a time when using just the documentation won't be enough to learn how to use Postgresql to full advantage. With release of 9.5 we might be there now.

Perhaps the logical extension of the documentation is some form of coursework to enable users to learn the DB systematically. I haven't looked into it, this might already be offered.

<comment><USER4> (self plug) for coursework on the read-only SQL side, you might want to give [http://pgexercises.com](http://pgexercises.com) a try. I have ambitions to expand it to include arrays and json, but alas haven't found the time so far...

<comment><USER5> This is awesome, thanks for making it!

<comment><USER4> Cheers, hope it's useful :-)

</comment></comment></comment></comment></comment><comment><USER6> With a REST layer like [https://github.com/begriffs/postgrest](https://github.com/begriffs/postgrest) you don't need any extra application server layer to serve your data, securely (RLS). Bye bye Java EE ?

<comment><USER7> You just got an accidental downvote as I came back after bookmarking your link. Sorry.

Dang/mods: Can we please please get something to avoid accidentally downvoting good stuff on mobile phones?

<comment><USER8> Happens all the time and has been the most requested feature of all time. I like to take the charitable view and say the current design is there to let your ego explain away down votes - i.e. I am only being down voted by accident, not my post is terrible.

</comment></comment></comment><comment><USER9> Really nice to see the direction things are moving in... I do feel that the replication/failover story needs a lot of work, but there's been some progress towards getting it in the box. Even digging into any kind of HA strategy is cumbersome to say the least (short of a 5-6 figure support contract). It's one of the things that generally stops me from considering PostgreSQL for a lot of projects. As a side note, I really like how RethinkDB's administrative interface is and their failover usage. It would be great to see something similar reach an integration point for PostgreSQL.

I also think that PLv8 should probably make it in the box in the next release or two. With the addition of JSON and Binary JSON data options, having a procedural interface that leverages JS in the box would be a huge win IMHO. Though I know some would be adamantly opposed to this idea.

<comment><USER10> _> I do feel that the replication/failover story needs a lot of work, but there's been some progress towards getting it in the box. Even digging into any kind of HA strategy is cumbersome to say the least (short of a 5-6 figure support contract)_

Eeeh...a simple HA solution can be developed in about a week (I was able to do so on 9.3, and so far, it held it's ground). Also, now with 9.5's pg_rewind you can easily switch back and forth between nodes ([http://www.postgresql.org/docs/9.5/static/app- pgrewind.html](http://www.postgresql.org/docs/9.5/static/app-pgrewind.html)), simplifying things a great deal. Can't imagine that's 5-6 figures.

I agree that you don't get a Plug&Play-Solution out of the box, but from anecdotal evidence they often don't quite work as advertised anyway (remember 1995? And I'm sure your friendly DBA has some stories to share as well).

</comment></comment><comment><USER11> There are plenty of nice minor improvements in the release notes. One of my favorites is "Allow array_agg() and ARRAY() to take arrays as inputs (Ali Akbar, Tom Lane)", it will come in handy when writing ad hoc queries to understand stored data. Right now I have to build a string which I use as input to array_agg().

<comment><USER12> I'm so pleased to see that I was not the only freak out here doing that!

</comment></comment><comment><USER13> I'm very excited about CUBE and ROLLUP -- I am just about to start a project that barely requires an OLAP shim. Now it looks like I can just do it all with just database features. Yay for fewer dependencies!

<comment><USER14> I'm not familiar with those statements, can you provide an example?

<comment><USER15> They're useful for providing summaries like row totals and column totals. Rather than just get an aggregated count for the total GROUP, you can also get aggregated counts for each unique combination of columns within the GROUP.

      col1 col2 count
      ---- ---- -----
      a    b    10
      a    null 5
      null b    5

There's more to it than that obviously, but you can read about them here: [http://www.postgresql.org/docs/devel/static/queries-table- ex...](http://www.postgresql.org/docs/devel/static/queries-table- expressions.html) (7.2.4. GROUPING SETS, CUBE, and ROLLUP)

</comment></comment></comment><comment><USER16> I might get some hate, but I also think upsert was one of the best features that MongoDB offered that PG didn't, so this is a big win from that perspective too.

<comment><USER17> Which makes sense, because the atomicity of the upsert is really the tricky part.

</comment></comment><comment><USER18> Great that Heroku sponsored upsert and have support for 9.5 right now (in beta): [https://blog.heroku.com/archives/2016/1/7/postgres-95-now- av...](https://blog.heroku.com/archives/2016/1/7/postgres-95-now-available-on- heroku)?

</comment><comment><USER19> Regarding Row Security, yes you can use it with a web application and still use connection pooling.

From web server, connect to db as one user then SET ROLE to the database user. This gives you Column Security and easier auditing as well. See [http://stackoverflow.com/questions/2998597/switch-role- after...](http://stackoverflow.com/questions/2998597/switch-role-after- connecting-to-database)

<comment><USER20> The thing is that each application user now needs a corresponding DB user to use RLS. While this isn't a huge problem, it's different than how most (if not 99%?) of applications work.

<comment><USER21> No, RLS does _not_ necessarily require separate database users. Using database users is one relatively obvious way to use the feature, but you can very well do something like 'SELECT myapp_set_current_user(...)' or something, and use a variable securely set therein for the row restrictions.

<comment><USER20> Interesting. I didn't think about doing that. 9.2 makes that much easier to do [http://dba.stackexchange.com/questions/97095/set-session- cus...](http://dba.stackexchange.com/questions/97095/set-session-custom- variable-to-store-user-id)

</comment></comment></comment></comment><comment><USER22> Interesting, I wasn't aware PostgreSQL didn't have UPSERT until now. MySQL has INSERT on DUPLICATE functionality that is similar.

<comment><USER23> Yep. Been a long requested feature. One of the reasons why the post states: "This feature also removes the last significant barrier to migrating legacy MySQL applications to PostgreSQL."

<comment><USER24> What do they mean by "legacy" in this context? INSERT ... ODKU is not a legacy feature of MySQL, it's a currently supported first-class feature of the database, nor is MySQL itself a "legacy" database.

<comment><USER25> I think they're referring to mysql. The sentence would have worked just as well without the word "legacy". I say this as someone who prefers PostgreSQL.

<comment> X-Istence No, they are referring to an application that is being moved from MySQL to PostgreSQL. The application is "legacy" in that it is an older version and the new version is "current".

Due to the English language however there can be some debate as to what they meant. In this case "legacy" is most likely meant to describe the "MySQL application" not "MySQL" itself.

<comment><USER25> You're wrong about which meaning is more likely.

A meaning that adds something to a sentence is a more likely meaning than one that adds nothing to a sentence. If you take "legacy" to mean "being migrated from" then the sentence becomes

This feature also removes the last significant barrier to migrating _being- migrated-from_ MySQL applications to PostgreSQL.

It's more likely that if "being migrated from" was the intended meaning, they would have simply left the word out.

<comment><USER26> Your comment assumes the author of the release notes has perfect command of the English language and they thought through in detail what the word "legacy" would mean in this context.

<comment><USER25> Not at all.

First, my comment says "more likely" so it isn't assuming anything.

Second, if we change "more likely" to "definitely", the assumption is merely that the sentence in question is written with the same command of the English language as the rest of the announcement, i.e. no egregiously redundant words.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Can anyone suggest a good "getting started" tutorial for PostgreSQL/debian/php? I've been using Mysql for years and would like to give Postgres a try.

<comment><USER28> Install it, and then build something.

A few things you will want to look at that are different:

1\. data types are much richer and more useful than in mysql

2\. transactional DDL means migrations are atomic.

3\. schemas are what mysql refers to as databases. Remember to set `search_path`.

4\. roles and grants are somewhat more expressive and work differently than in mysql, but not that differently for the simpler use cases

5\. database functions ( aka stored procedures ) are awesome as are extension languages.

<comment><USER9> On point 5... love PLv8, which imho makes working with the newer JSON data types really nice.

</comment></comment></comment><comment><USER29> Yay! I like the changes.

But they are doing absolutely nothing about my biggest beef with PostgreSQL. Which is that there is absolutely no way to lock in good query plans. It always reserves the right to switch plans on you, and sometimes gives much, much, much worse ones. No other database does this to me. Even MySQL's stupid optimizer can be reliably channeled into specific query plans with the right use of temporary tables and indexes.

This is a problem because improvements don't matter if the query plan is "good enough". But they will care if you screw up. PostgreSQL usually does well, but sometimes screws up spectacularly.

The example that I have been struggling the most often with in the last few months is a logging table that I create summaries from. Normally I only query minutes to hours, but I set it up as a series of SQL statements so I first put the range in a table, and then have _happened BETWEEN range_start AND range_end_. PostgreSQL really, Really, REALLY wants to decide that the index on the timestamp is a bad idea, and wants to instead do a full table scan. Every time it does, summarization goes from under a second to taking hours.

Hopefully the new BRIN indexes will be understood by the optimizer in a way that makes it happier to use the index. But I'm not optimistic. And if I lean on it harder, I'm sure from past experience that I'll find something else that breaks.

<comment><USER30> There is some discussion on why the Postgres team dislikes query hints here: [https://wiki.postgresql.org/wiki/OptimizerHintsDiscussion](https://wiki.postgresql.org/wiki/OptimizerHintsDiscussion)

But perhaps I also have some practical advice to try.

I had a similar issue: I have a few tables with sensor data, 300-500 million rows, indexed among other things by event type. Some counting queries kept defaulting to full table scans. It turned out that this was because of limited statistics on the distribution of counts by event type.

The default_statistics_target config parameter sets how many entries Postgres keeps in the histogram of possible values per column, the default is 100 I think. Because my event types were not evenly distributed, the less frequent ones were missing from the statistics histogram altogether, and somehow this resulted in bad query plans.

As a fix, I upped the default_statistics_target to 1000, and to set it to 5000 for the biggest tables. Then after a vacuum analyze, the query planner started making sensible choices.

Another thing to try is perhaps reducing the random_page_cost config parameter from it's default of 4.0. On SSDs, random page costs are much closer to 1 than they are 4 (compared to long sequential reads).

<comment><USER29> This is all good optimization advice, but I don't think it is applicable to my specific case.

My problem is not that PostgreSQL does not understand the distribution of my data. It does. The problem is that it comes up with a query plan without realizing that I'm only querying for a very small range of timestamps.

If this happens again, I'll have to try rewriting code to send it queries with hard-coded timestamps, cross fingers and pray. I find prayer quite essential with PostgreSQL sometimes because as ineffective as it is, at times I've got nothing else.

<comment><USER21> > My problem is not that PostgreSQL does not understand the distribution of my > data. It does. The problem is that it comes up with a query plan without > realizing that I'm only querying for a very small range of timestamps.

Which version did you reproduce that on? While the problem has not been generally addressed, the specifically bad case of looking up values at the "growing" end of a monotonically increasing data range has been improved a bit over the years (9.0 and then some incremental improvement in 9.0.4).

<comment><USER29> PostgreSQL 9.4.4 on x86_64-unknown-linux-gnu, compiled by gcc (GCC) 4.8.2 20140120 (Red Hat 4.8.2-16), 64-bit

If it matters, it is an Amazon RDS instance.

</comment></comment></comment></comment></comment><comment><USER31> Congrats to everyone involved, indeed an amazing opensource project that displays true integrity and discipline.

<comment><USER32> Thanks

</comment></comment><comment><USER33> I am looking forward for Row Level Security, Though cell level security will be even more awesome to have.. Difficult to achieve in SQL. Only Apache Accumulo in NoSQL space has it.. But once we have it make sure no one has access to SSN column and we will be protected to one degree in data breaches.

<comment><USER34> Any practical use cases of Row level security ?

<comment><USER35> Imagine you're working in a place with a rather large sales/marketing department. Now, sales is a pretty cutthroat job, and some people will do any cheat possible to get ahead of their co-workers. In a typical sales database, someone who manages to borrow a bit of sql from a techie friend could potentially go in and get sales leads from co-workers, poaching their deals. With row level security, the sleezier co-worker isn't allowed to look at those rows to be able to poach.

<comment><USER36> Do you mean as another security layer? I guess the sales people don't normally have direct access to the databases and the softwares already restricts which data they can see.

Maybe you mean just in case they manage to bypass the software restrictions.

<comment><USER9> In some cases, people will defer to database level security restrictions. It really depends on how much application logic is in the database. Some applications are designed with as much logic as possible in the DB, including each user being a db user with credentialed access. Others will treat the DB as dumb storage with all access through a programatic API... with thin API shims over DBMS, the db security is paramount.

</comment></comment></comment></comment></comment><comment><USER37> [http://www.postgresql.org/docs/9.5/static/brin- intro.html](http://www.postgresql.org/docs/9.5/static/brin-intro.html) If like me you were looking for what BRIN index is all about.

<comment><USER38> Out of curiosity, has anyone managed to find something more detailed about the guts?

It sounds like it's basically a BTree that stops branching at a certain threshold, but I'm almost certainly wrong.

<comment><USER21> No, that's not really it, although you could see it as a very degenerate form of a btree. Basically it's using clustering inherent to the data - say a mostly increasing timestamp, autoincrement id, model number ... - to build a coarse map of the contents. E.g. saying "pages from 0 to 16 have the date range 2011-11 to 2011-12" and "pages from 16 to 48 have the date range 2012-01-01 to 2012-01-13". With such range maps (where obviously several overlapping ranges can exist) you can build a small index over large amounts of data.

Obviously single row accesses in a fully cached workload are going to be faster if done via a btree rather than such range maps, even if there's perfect clustering. But the price for having such an index is much lower, allowing you to have many more indexes. Additionally it can even be more efficient to access via BRIN if you access more than one row, due to fewer pages needing to be touched.

</comment></comment></comment><comment><USER39> anybody know how quickly does RDS upgrade to newer versions of Postgres.

I'm really, really keen to use 9.5 jsonb with its insert/update changes.

<comment><USER40> While you wait, check out [http://stackoverflow.com/a/23500670/229006](http://stackoverflow.com/a/23500670/229006)

My plan is to rely on these functions for now, and switch to the native implementations once 9.5 is production ready on RDS.

<comment><USER39> this is so cool... thanks!!

</comment></comment></comment><comment><USER41> I swear... I will redesign and develop Postgre's site for free.

<comment><USER42> I'm curious, what do you think needs to be redesigned?

<comment><USER41> I wish I could say it's circa Web 2.0 but it's still stuck even farther back than that. I mean it works which is great but I loathe spending time on it because it's such a poor experience.

</comment></comment></comment><comment><USER43> how does postgresql upsert compare to ms sql's merge statement

i want to look deeper into this, but didnt have the time but from the little i read, seems ms sql merge is more powerful

<comment><USER11> The new PostgreSQL syntax is more convenient to use in the UPSERT use case while the MERGE syntax is more convenient to use when doing complicated operations on many rows of data (for example when merging one table into another, with a non-tricial merge logic).

The reason PostgreSQL went with this syntax is that the goal was to create a good UPSERT and getting the concurrency considerations right with MERGE is hard (I am not sure of the current status, but when MERGE was new in MS SQL it was unusable for UPSERT) and even when you have done that it would still be cumbersome to use for UPSERT.

EDIT: The huge difference is that PostgreSQL's UPSERT always requires a unique constraint (or PK) to work, while MERGE does not. PostgreSQL relies on the unique constraint to implement the UPSERT logic.

<comment><USER44> _I am not sure of the current status, but when MERGE was new in MS SQL it was unusable for UPSERT_

I've used MERGE as an UPSERT using MATCHED/NOT MATCHED and SERIALIZABLE/HOLDLOCK since it was introduced in mssql 2008. It was one of the first features I upgraded my code to use, and it worked out of the box with no issues.

<comment><USER11> See this blog post for what I am talking about: [https://www.mssqltips.com/sqlservertip/3074/use-caution- with...](https://www.mssqltips.com/sqlservertip/3074/use-caution-with-sql- servers-merge-statement/)

If PostgreSQL had gone the same route as MS SQL I would have expected a similar set of bugs. I suspect all of this have been fixed by now, but I do not follow MS SQL.

</comment></comment></comment></comment><comment><USER45> I wonder how much time it will take to appear in the Ubuntu apt repo? Should it be already there (I don't see it yet)?

Edit: I meant apt.postgresql.org of course, not the official Ubuntu repo..

<comment><USER11> No idea, but the PostgreSQL community distributes official Debian and Ubuntu packages at apt.postgresql.org. They should already have 9.5, or if not have it very soon.

</comment></comment><comment><USER46> Every time there's a minor version update I have to remind myself the sequence of upgrade incantations. It's pretty simple, but here's a gist that might help anyone upgrading from 9.4 to 9.5 with Homebrew:

[https://gist.github.com/chbrown/647a54dc3e1c2e8c7395](https://gist.github.com/chbrown/647a54dc3e1c2e8c7395)

</comment><comment><USER47> pglogical ([http://2ndquadrant.com/en- us/resources/pglogical/](http://2ndquadrant.com/en-us/resources/pglogical/)) claims to allow cross version upgrades from 9.4 to 9.5 with minimal downtime, but the documentation seems fairly light-on.

Has anyone come across a guide to using it for upgrades?

</comment><comment><USER48> Upsert is something I expect so commonly in modern databases nowadays. Happy to see it here with Postgres.

</comment><comment><USER49> search in 5% the time it would take to search a btree? anyone can see that with actual data?

<comment><USER49> [http://pythonsweetness.tumblr.com/post/119568339102/block- ra...](http://pythonsweetness.tumblr.com/post/119568339102/block-range-brin- indexes-in-postgresql-95)

the very first example points to BRIN indexes resulting in smaller index than btree but with much longer search time... so i guess the 5% time figure was very use-case specific?

</comment></comment><comment><USER50> this is excellent news. I really enjoy using postgresql in one of my current projects. I look forward to using upsert and the new indexes

</comment><comment><USER51> What an absolutely fantastic project. The recent releases have all been very exciting.

</comment><comment><USER52> Bye bye mongodb.

</comment><comment><USER53> Unless I'm mistaken MySQL has had this for almost a decade with "ON DUPLICATE KEY UPDATE". I'm seeing a lot more about PSQL here and in the news. I've always found it to be unfriendly and slow. Why the new attention? Is there really something about PSQL that makes it better than MySQL these days? It used to be transactions, but InnoDB made that moot years ago.

We do over 20,000 queries per second on one of our production mysql DB's and I'm not sure I'd trust anything else with that: [http://i.imgur.com/sLZzXhS.png](http://i.imgur.com/sLZzXhS.png)

Just curious if I'm missing out on some new awesomeness that PostgreSQL has or if it's just marketing.

<comment><USER54> > Is there really something about PSQL that makes it better than MySQL these > days?

In a word: correctness.

Yes, MySQL has an UPSERT implementation. Like so many things MySQL rushed out the door, it's also buggy and unpredictable. Did you know UPSERTing into a MySQL table with multiple unique indexes can result in duplicate records? Did you know MySQL's ON CONFLICT IGNORE will insert records that violate other not-NULL constraints? [1]

I've used both MySQL and PostgreSQL for over a decade, and working around the many MANY misbehaviors and surprises in MySQL requires continuous dev effort. PostgreSQL on the other hand is correct, unsurprising, and just as performant these days.

MySQL is what happens when you build a database out of pure WAT [2].

[1] [https://wiki.postgresql.org/wiki/UPSERT#MySQL.27s_INSERT_......](https://wiki.postgresql.org/wiki/UPSERT#MySQL.27s_INSERT_..._ON_DUPLICATE_KEY_UPDATE)

[2] [https://www.destroyallsoftware.com/talks/wat](https://www.destroyallsoftware.com/talks/wat)

<comment><USER53> Nah. MySQL rocks. I've been using it since 1998 at Credit Suisse, 2000 at eToys.com where we used it to run the entire company from warehouse to web. I used it at the BBC in 2003 for a high traffic Radio 1 application and I've used it since then on my own companies with serious volume including a job search engine featured in NYTimes and Time Mag in 2005 and feedjit.com doing real-time traffic on over 700,000 sites. We use it for Wordfence now which is where the image link comes from I posted earlier with 20K TPS. All very high traffic with consequences if it screws up. I've never run into any of the issues you mention.

You say "upserting into a mysql table". Which storage engine? MyISAM? InnoDB? I find MySQL to be both reliable and incredible durable i.e. it handles yanking the power cord quite well. The performance also scales up linearly for InnoDB even for very high traffic and concurrency applications.

We use redis, memcached and other storage engines - by no means are we tied to mysql. But for what it does, it does it incredibly well.

I'm also completely open to using PostgreSQL and I was hoping someone could give me a compelling reason to switch to it or to use it.

<comment><USER55> I've worked at a company that was doing > 20,000 TPS (transactions/sec) on a single PG instance with no problem. That is baby-tier usage for a DB.

As far as why you should give up MySQL like I did four years ago: [http://grimoire.ca/mysql/choose-something- else](http://grimoire.ca/mysql/choose-something-else)</comment></comment></comment></comment>


Apparent Amazon breach yields 80,000 Kindle logins - <AUTHOR> http://www.dailydot.com/debug/amazon-hack-80000-passwords-usernames/ <comment><AUTHOR> If legit, a lot of those Kindle credentials are likely tied to identical info on AWS accounts. Update your passwords.</comment>


Ask HN: Grade my Landing Page  - <AUTHOR>

http://www.crunchfit.com/lsw-rewards/<p>Tell me what you think. Advice?<p>(Created at Lean Startup Machine) <comment><USER2> Next impression: The value proposition is murky. As a visitor to this page, I'm not immediately sure what I'm expecting to get in return for giving you my email address.

What am I getting sold here? How is this going to change my life?

Coupons and discounts... why do I want these? Are they for products and services that I actually use? Or am I supposed to pay you for the privilege of receiving other people's junky promotional spam?

75% discount... meaningless if there's no price attached. 75% off of a $2,000 fitness course? 75% discount off of a $2.99/mo webapp?

The bullets are hard to read (see earlier comment about color scheme), and this is the only point at which you start promising things that start to get concrete. You do, however, identify and address some common fitness concerns here, which is good ("it takes too long", "the same workout gets boring over time", "do I have to join a gym?", etc.).

"Get fit" is a weak promise, though. It's not concrete. How would someone know if they are fit? Is it being able to run a mile without collapsing from exhaustion? Running a marathon? Bench pressing 300lbs? What?

Also, how do I know this is for me? Is this a product for men? For women? For young people? Old people? Busy people? Office workers? Housewives?

The fitness market is huge and your competition is numerous and highly sophisticated. You will be far, far more successful as an upstart if you can laser-target your offering. It doesn't matter if it would work for everyone; "everyone" is a market that is much, much too expensive for you to reach. Once you are successful with your initial target market, you can leverage that experience to expand into others.

Having testimonials is very, very good... but are they real? The first one has a woman's picture, but is improbably captioned "Aaron K." Clean that up for sure! Don't use fake testimonials. You'll probably get away with it, but it's dishonest, and who wants to risk getting sued by the FTC?

The testimonials will also be much more powerful if you can get some concrete (i.e. objectively measurable) results into them. Before-and-after pictures are widely used in the fitness industry for a reason!

To sell your product: 1) start with a laser-targeted market... get as specific as you possibly can; 2) find out these people's biggest pain points around fitness; 3) promise them an amazing (but realistic) concrete result that they will achieve by using your service; and 4) back it up with proof in the form of testimonials and samples.

But on this particular landing page, it looks like you're just trying to capture leads in exchange for a bribe. The basic strategy is very good; if you can build a good relationship with your prospect list, you can sell them just about anything.

But you will have ridiculously better results by instead giving people something they can use _right now_. Give them a free workout plan by email (or a week's worth of plans, dripped out over several days), just for signing up. With a little programming work, you could even give them a customized workout... take them to a web form where they enter some basic parameters like age, weight, fitness level, and then have a script that uses those selections to choose from several possible plans.

If you send them something they can actually use immediately, that's much more valuable than vague offers of discounts, etc. It's actually compelling, especially if you do a good job of selling them on the benefits that your free workout plan is going to deliver to them (more energy, more mental clarity, higher self-confidence, more attention from the opposite sex... speak to whatever you know are the hot-button concerns of your market). This has more benefits for you than just getting the prospect onto your email list: they've now had an opportunity to sample your offering and receive real benefit from it, so they know you're for real, and hopefully, you've whet their appetite for more.

(That rambled on longer than I expected; hope it's not too overwhelming. Send me an email if you want to go into depth on any of that.)

</comment><comment><USER3> Bam! - took a second to realize its not some 90s throwback site - maybe tone down the colors?

quick no reading look-through see some jumping stick figure a text box, bullet points and some talking head reviews. Is this a get rich quick? The text kinda reads like that lots of promises little detail...

Grade C-

Suggestions:

Tone down colors - loose the highlighter line at the bottom. The logo guy is kinda OK but the font is not energetic enough.

How about having the testimonials pics with the people Exercising or in gym gear near exercise equipment? Would add a more active dynamic to it.

"get a 75% discount by signing up now..." sounds expensive. Should elude to the rates like "for less than a gym membership," (or whatever the comparison) "you will/can..." (bullet points) As a customer I would be comforted in knowing what will I be putting into it and what value will i get out of it...

You have one serif line and then everything else is sans serif... doesn't seem to balance well. you reiterate the same thing twice at the top two lines. maybe if the second line has silhouettes or stick figures doing the steps.

Just noticed it's a mobile application - put handheld devices in stick figure's hand.... Maybe in testimonial pics too.

</comment><comment><USER4> There are way too many colors (seven, not counting black and white), none of which really work well together.

I personally don't like how the content is all one width the entire length of the page. I think it would look better to have some variation.

There is an asterisk next to "Email," but there's no explanation why it's there.

The star bullet points look like they were drawn in MS Paint.

"take the workout with you on the road" seems misleading. Can you do this workout in your car while driving? Maybe pick a different location...

"It's your turn! This special promotional rate ends soon. Start living the dream today!" - I feel like this should be higher up the page. What's the point of having it at the very bottom?

</comment><comment><USER5> I'm a professional designer but I'll tell you what I think doesn't matter. At the end of the day this is direct marketing and the best thing to do is to test your concept by placing an ad with AdWords. In fact I think the only thing you are really doing wrong is just having one page -- you should really test several pages that offer different copy and layouts. I would also suggest getting a professional copywriter who knows what they are doing...

<comment><AUTHOR> Awesome. Thank You!

Working on separate pages now.

</comment></comment><comment><USER2> First impression: Are you red-green colorblind by any chance? I ask because your landing page looks _much_ better with a protanopia simulation filter applied.

If you aren't colorblind, then, well, let's just say I suggest that you start with color schemes that have been well-tested in other successful direct marketing pieces.

If I'd hit this page from an ad link, I'd have bounced immediately before your sales copy even registered.

</comment><comment><AUTHOR> LINK: <http://www.crunchfit.com/lsw-rewards/></comment>


The price of "Free" - <AUTHOR> http://richardmuscat.wordpress.com/2011/06/20/the-price-of-free/ <comment><USER2> Thanks for the up vote ;-)</comment>


Internet Users by Country – Iceland 100% Smartphones at Birth? - <AUTHOR> http://www.internetlivestats.com/internet-users-by-country/ <comment><USER2> Worked for a company there a couple of years ago. Know this is close to accurate. In my notes I have 2014 numbers by Statistics Iceland stating individuals with internet access at 98.2%.

</comment><comment><USER3> I would assume the data was collected only for adults. The "internet Users" figure seems to be roughly 50% of the total population for the country.</comment>


A few thoughts on SSL Search - <AUTHOR> http://www.mattcutts.com/blog/google-secure-search/ <comment><USER2> In the post, the author mentions he doesn't want hotels or cafes snooping on his search. However, I fail to see why search is any more important than the results a user visits (which most likely will not be ssl).

If someone truly wants privacy, they should use something like tor.</comment>


Ask HN: What are ways to make serious money playing computer games? - <AUTHOR> <comment><USER2> I don't know about "serious" money but I was good enough at Xevious in college that people would give me quarters to play so they would watch.

I switched to pinball and learned how to find machines that were hard to tilt and would put up the kind of high scores that people would think were impossible. I found that if you played like that at a state school they would threaten to kick you out of the gameroom, but if you did that at an Ivy League school (grad school) nobody would confront you about it.

</comment><comment><USER3> It's a combination of luck and a bit of skill (which can be acquired over time if you have the former). You need to get in early, pick a game that will attract a large audience, have the right looks & personality to entertain that audience, etc.

</comment><comment><USER4> Be good enough to become pro? Streaming?</comment>


Where the heck is NerdTV season 2? - <AUTHOR> http://startupcrunch.org/where_the_heck_is_nerdtv_season_2

<comment><USER2> Not going to get too many votes when choice one is blank and choice two is blank :<)

<comment><AUTHOR> many thanks

</comment></comment><comment><AUTHOR> oh can you send me a screen shot colourbleu at free dot fr

many thanks

btw what browser are you using?</comment>


Step inside your photos with Cardboard Camera - <AUTHOR> https://googleblog.blogspot.com/2015/12/step-inside-your-photos-with-cardboard.html <comment><USER2> According to a friend's analysis, this appears to be using a rather ingenious dual slit-scan technique where it's gathering the leftmost and rightmost columns of pixels from the CMOS as the phone is turned, and then using the offsets between these columns against the two scans to re-create parallax. Fascinating stuff.

</comment><comment><USER3> This looks like a great inside-out 3D scanner.

Meanwhile, MS is working on a mobile-phone outside-in scanner :)

[http://www.theverge.com/2015/8/24/9199469/microsoft-turns- ip...](http://www.theverge.com/2015/8/24/9199469/microsoft-turns-iphone- into-3d-scanner)

</comment><comment><USER4> I've taken "non-3d" panoramas and viewed them in Cardboard, and that was cool enough. It is certainly the best way that currently exists to share the experience of being somewhere with someone else. I can't wait to try this out; I expect the addition of depth will make it that much more amazing.

</comment><comment><USER5> I played with the new app yesterday. It works fairly well, generating 3D from camera motion (you slowly pan the camera).

The resolution did not seem very good, but the effect is nice. Someone had a good idea.

</comment><comment><USER6> I'm a little confused. Do you need some kind of smart phone holder that has a slot for your phone and lenses in front of each eye? If so, where do you get that?

<comment><USER7> "Google Cardboard."

Verizon is handing them out free right now, as a promo with Star Wars.

The New York Times sent them free to every Sunday subscriber, a few weeks ago.

Amazon has them, too. Also, here:

[https://www.google.com/get/cardboard/get- cardboard/](https://www.google.com/get/cardboard/get-cardboard/)

<comment><USER6> Thanks!

</comment></comment></comment><comment><USER8> It works surprisingly well, but it has a very limited vertical extent (based on how wide your phone camera is) and that limits the scenes it is suited for.

</comment><comment><USER9> Is there an iOS equivalent to this yet?

<comment><USER10> Check out [http://optonaut.co](http://optonaut.co)

</comment></comment><comment><USER11> Gonna have to check this out later and see how the viewing part works on the Rift. I'm guessing it'll come down to viewing the images with the proper alignment on the desktop/browser-based photo viewing app. If you can pull them up fullscreen with a side-by-side layout it ought to work fine.

<comment><USER7> They don't make it easy to do what you're asking.

Mostly because it's a panorama. Also because it's a single jpg, but it only shows the left eye. The right eye data is embedded as a BASE64 encoded JPEG that is stored in the XMP data of the image. Yup.

<comment><USER11> Yeah, I figured that out the un-fun way. Hopefully someone makes a wrapper or something the way they have for other panoramic images or street view. You can fullscreen a side-by-side 3d image and view on the Rift but you'd need something to translate it to that format and map positional tracking.

</comment></comment></comment><comment><USER12> Gah, not available in your country. Lame, why do they do that...

</comment><comment><USER13> Cool, but why does it need permission to access my microphone?

<comment><AUTHOR> Because it optionally records ambient audio to play while looking at your panorama.</comment></comment>


Merkel compared NSA to Stasi in heated encounter with Obama - <AUTHOR> http://www.theguardian.com/world/2013/dec/17/merkel-compares-nsa-stasi-obama

<comment><USER2> "The German chancellor also told the US president that America's National Security Agency cannot be trusted because of the volume of material it had allowed to leak to the whistleblower Edward Snowden, according to the New York Times."

</comment><comment><USER3> That's outrageous. Merkel should have known better.

The Stasi only _dreamed_ of being as pervasive and efficient as the NSA is today, when it comes to domestic surveillance.

</comment><comment><USER4> > The Germans have received assurances that the chancellor's phone was not > being monitored and that the US spy agency is not conducting industrial > espionage.

Seriously? After admitting they spied on Petrobas and EU telecoms, "for their own safety"? They still can't get their story straight.

Also, the extent of Stasi spying vs NSA spying:

[http://falkvinge.net/2013/07/05/stasi-vs-the-u-s-nsa-back- to...](http://falkvinge.net/2013/07/05/stasi-vs-the-u-s-nsa-back-to-back-whos- worse-and-by-how-much/)</comment>


Do you think this form of interactive timeline could prove useful? - <AUTHOR> http://www.tiki-toki.com/timeline/entry/6306/Category-Band-Timeline/

<comment><AUTHOR> Hello. Single founder here. Developing web-based interactive timeline software. We've just launched a major new way of viewing timelines, and would love some feedback. We've also redesigned our home page: <http://www.tiki- toki.com> (it was previously just a full-page timeline).

</comment><comment><USER2> Useful yes (I work with a lot of temporal visualizations) and I would use it but...

Free Version is limited to 1 timeline. You're not going to generate enough engagement/ commitment off of your freemium model especially since it's just a point solution (only one novel type of visual narrative). No one will feel like they need it or are comfortable with it enough to purchase.

My suggestion. Increase freemium to three timelines. 1.Give people a chance to do cool things with it and experiment.. 2\. Because the temporal aspect is only a part of a story, I would suggest working on product integration (Powerpoint or one of its alternatives, Prezi etc.) 3\. Or an alternative strategy would be to get a few types of clean slick visualations. I could see people paying for a package.

<comment><AUTHOR> Thanks for the useful feedback. Just to clarify. The banded timeline is a new way of showing timelines with our software. We also have a standard way ofshowing timelines, an example being: [http://www.tiki- toki.com/timeline/entry/43/Beautiful-web-bas...](http://www.tiki- toki.com/timeline/entry/43/Beautiful-web-based-timeline-software/)

And we're also working on a Gantt chart style visualisation, which might fit in with your suggestion 3.

Not sure about integration with PowerPoint and Prezi. Don't get me wrong. It is a great idea. But our timeliness are in HTML/CSS and JS, so am not sure how easy (or even possible) it would be to integrate with them.

Maybe I am being a bit mean with the number of timelines in the free account but I worry that if I give the free accounts too much, no-one will upgrade.

Anyway, you have given me food for thought. Thanks!

<comment><USER2> [http://www.guardian.co.uk/news/datablog/interactive/2011/jul...](http://www.guardian.co.uk/news/datablog/interactive/2011/jul/21/phone- hacking-what-happened-when) you should remodel that in your software. The gaurdian's version is very clunky.

</comment></comment></comment><comment><USER3> I think it's very nice. I would like to see the ability to integrate it into other projects, to buy it as plugin instead of a monthly subscription service.

I also think you should give more details on how to create and embed a timeline, a video of the proccess would be excelent.

nice job!

<comment><AUTHOR> A video tutorial would be great. And is definitely something on our todo list. Along with a FAQs and other useful stuff.</comment></comment>


US Declaration of Independence first and final drafts as GitHub diffs - <AUTHOR> https://github.com/usgov/forget-the-king/pull/1 <comment><USER3> Hmm, so this is a case where a Git repository, with all its commit history, is the final product. Would it be feasible to develop this product within a different Git repository? How would one best do that? Is such a repository also available on GitHub?

<comment><USER4> You can track a git repo inside another, as long as the "inner repo" is bare (otherwise git will add it as a submodule instead).

<comment><USER3> OK. How do you edit the inner repository, if it's bare? Do you have to clone it to a different directory, make changes, and then push it back to the original place?

<comment><USER4> Yeah, I think so.

</comment></comment></comment></comment><comment><USER5> There are a lot of commits in the history of this repo that seem like actual typos on the behalf of the creator of the repo. For example, the line "that among these are life, liberty, and the pursuit of happiness" was accidentally removed here[1], and re-added in the next commit here[2]. It seems silly to have a project purporting to be various drafts of the Declaration to contain diffs which are entirely anachronistic/accidental/have nothing to do with the actual drafting process.

It turns out[3] that Jefferson wrote a first draft (of which only a fragment survives), then wrote the "original Rough draft" which is very similar to the document we know. 47 alterations were made before the vote for Independence, and 39 more between then and the official adoption of the document on July 4th.

I'd really like to see a version of this git repository accurately reflecting the fragment, original draft, all 86 revisions (in approximate order and attributed as well we can), and final version published as the Dunlap Broadside, instead of this anachronistic heap.

[1] [https://github.com/usgov/forget-the- king/pull/1/commits/f9ff...](https://github.com/usgov/forget-the- king/pull/1/commits/f9ff3ee2d0e53633e7cb5a374d3cd875894315cc)

[2] [https://github.com/usgov/forget-the- king/pull/1/commits/d041...](https://github.com/usgov/forget-the- king/pull/1/commits/d041db6716fc0789cd83cbf7234337de8304375d)

[3] [https://www.loc.gov/exhibits/declara/declara3.html](https://www.loc.gov/exhibits/declara/declara3.html)

<comment><AUTHOR> Hello, original repo contributor here!

> I'd really like to see a version of this git repository accurately > reflecting the fragment, original draft, all 86 revisions (in approximate > order and attributed as well we can), and final version published as the > Dunlap Broadside...

Me too!

I was unaware that we had the information you mentioned. I helped put this together after talking with my teammate about how it would be interesting to show a famous document being revised like we view code revisions.

Looks like some rationale behind the 82 changes is here: [http://alexpeak.com/twr/doi/draft/](http://alexpeak.com/twr/doi/draft/)

> It seems silly to have a project purporting to be various drafts of the > Declaration to contain diffs which are entirely > anachronistic/accidental/have nothing to do with the actual drafting > process.

This is primarily for entertainment value. The commit messages are certainly not learned insights into what the founders were thinking. Perhaps I should have made a note somewhere, like at the bottom of the PR description - <USER2> silly aspect is there, and a bit intentional, since I am in no way a scholar on this.

Maybe consider this a prototype demonstrating the potential value - if any - of seeing revisions to famous important documents. The exercise of looking at putting together the diffs was certainly educational! I hope seeing the diffs can be a little insightful to someone else.

> the line "that among these are life, liberty, and the pursuit of happiness" > was accidentally removed here[1], and re-added in the next commit here[2].

Intentional - and intentionally silly. I thought it would be interesting to imagine one of the most well-known phrases in US historical writing could be accidentally gobbled up by a stray press of the delete key, just like an important line of code may get wiped out unintentionally.

If anyone with more knowledge of the 82 changes creates a very serious capture of each change, let me know and I will promote it in this repo!

</comment></comment><comment><USER6> USA: Far from perfect, but we're trying.

Happy [early] Independence Day fellow Americans.

</comment><comment><USER7> Is there a way to change the dates on the comments to the date they were recorded? It would be fun to see these as "comment made 240 years ago"

<comment><AUTHOR> I was hoping so! I figured maybe that would break the date system, too.

Anyone know how?

<comment><USER8> Yes, like this. [https://github.com/gelstudios/gitfiti](https://github.com/gelstudios/gitfiti)

Setting the GIT_AUTHOR_DATE and GIT_COMMITTER_DATE environment variables.

<comment><USER9> That'll let you change the commit dates, but not dates for the GitHub comments.

</comment></comment></comment></comment><comment><USER10> You can never view a historical document with modern eyes the same way someone at the time it was written did. I bet we couldn't write/agree on such a document today at all either.

</comment><comment><USER11> The comment from bertilda-lovejoy just summarizes the first-world problems very well.

<comment><USER12> That account (bertilda-lovejoy) was made 10 minutes ago, so don't get too bent out of shape over it. Its likely a mens-rights red-pill-er intentionally misrepresenting feminist values by taking them to a tone-deaf extreme in a repo thats obviously not meant to be taken seriously.

<comment><USER13> Bertilda Lovejoy made a name for himself by writing outrageous YouTube comments. I don't know if this is the same person, but it's not coincidental that they chose that name here.

<comment><USER14> She has always been a manufactured character, including those YouTube comments.</comment></comment></comment></comment>


Show HN: Password-Protect My File - <AUTHOR> https://www.passwordprotectmyfile.com/

<comment><USER2> If a user doesn't trust Dropbox, why would they trust passwordprotectmyfile.com?

I know it claims the file doesn't leave your computer, and that might be true right now, but in five minutes if I visit the page the code could have changed. And it would hardly be user-friendly to ask users to check the minified javascript before using it.

<comment><AUTHOR> It's a little clunky, but I do have a process in place for checking that the website matches the code: [https://github.com/louissobel/ppmf/blob/master/bin/check_pro...](https://github.com/louissobel/ppmf/blob/master/bin/check_production_sha)

<comment><USER3> If you have to run a local program to verify the code on your web page, why don't you just put the code you are verifying in the local program?

</comment></comment></comment><comment><USER4> Should really highlight the fact that it could be self-hosted [0]. Typing a password and uploading a sensitive file is never a good idea.

[0] [https://github.com/louissobel/ppmf](https://github.com/louissobel/ppmf)

<comment><USER5> At first sight it seems the encryption is done by client-side javascript, so you don't gain much by hosting it yourself.

<comment><USER6> If the javascript comes from your computer (because it's embedded in the page you self-host), how could it get compromised?

</comment></comment></comment><comment><USER7> As soon as my file is readable by javascript it _could_ be sent anywhere by your code. I'm not saying you _do_ , but it _could_. Therefore this adds an unnecessary risk. I would have to disconnect my machine from the network and clear all the browser storage before reconnecting to even begin to think this was safe.

Just to be clear: I'm not saying it's useless, just that if the file I was encrypting was so important that I needed to encrypt it, doing it in a sandbox that is directly connected to an untrusted third-party wouldn't be a very bright move.

<comment><AUTHOR> It's all in one html file, so it will work disconnected from the internet. Download or save the page, turn off your internet, open it in a browser, and encrypt with peace of mind (although the javascript could still use off-line storage and then next time you're online on the page access it, I guess).

</comment></comment><comment><USER6> I really like this. Especially the self-contained html file you send around afterwards.

You should recommend people to download the html and then save it instead of using the page itself. Maybe make a big download button. Also, remove google analytics from the self-contained version, that way the page should never download/upload anything from the network.

</comment><comment><USER8> It's the same as using openssl aes-256-cbc -in plaintext -out ciphertext That's as easy and convenient as it can get for me. But it might be helpful if I have to send an encrypted file to someone not able to use openssl or gpg. It's pretty cool to combine an encrypted file with the tools needed to decrypt it :)

</comment><comment><USER9> How is this better than symmetric encryption with GnuPG?

<comment><AUTHOR> The encrypted result of this tool contains all the code necessary to decrypt itself (in a web browser).

I'm not too familiar with GnuPG, so I don't know if that's different.

<comment><USER10> Any browser?

<comment><AUTHOR> Tested and working with recent Chrome, Firefox, Opera, Safari 6.1+, IE 10+. [https://www.passwordprotectmyfile.com/faq](https://www.passwordprotectmyfile.com/faq).

It uses, among others, the Blob API so will not work on older browsers.</comment></comment></comment></comment>


Want to help those living with PTSD? - <AUTHOR> https://medium.com/aware-study/introducing-aware-d817e5c101a6 <comment><USER2> A legitimate psychology app should not be tracking people's location all the time, let alone fine location. (Refer to Permissions in Google Play entry).

<comment><AUTHOR> Hi Dr.Scump we are actually not tracking location all the time. Just significant location change every 10 minutes or so.

Users don't need to select this permission if they don't want to.

Hope this helps.

<comment><USER2> But _why_ track location at _all_?

<comment><AUTHOR> In the study of many mental health conditions, tracking changes in location are markers for depression. By understanding mobility patterns, we can learn more about how to better deliver care just-in-time.

Companies like ginger.io have been doing this with success for many years.

Some scientific papers on the matter: \- [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5571235/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5571235/) \- [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4526997/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4526997/)</comment></comment></comment></comment>


Building Database Driven RESTFUL API Applications with Flask and Angularjs - <AUTHOR> http://techarena51.com/index.php/how-to-build-database-driven-crud-applications-with-flask-api-and-angularjs-ng-resource/ <comment><USER2> Thanks exactly what I was looking for :)

</comment><comment><USER3> I like flask very easy to customise</comment>