Microsoft says no known ransomware runs on Windows 10 S, so we tried to hack it - <AUTHOR> http://www.zdnet.com/article/microsoft-no-known-ransomware-windows-we-tried-to-hack-it/ <comment><USER2> _" Word was opened with administrative privileges through Windows' Task Manager"_

So the whole point of Windows 10 S is that it's so locked down it will only run applications from Microsoft's App Store. (That alone make it useless beyond elementary school level.) Yet it will run Microsoft Word _with administrative privileges?_ Why would you ever want to run Microsoft Word with administrative privileges?

<comment><USER3> I think it means if you launch Word normally it is not running with administrative privileges.

you have to launch from Task Manager to run Word with administrative privileges. (which researcher claims can also be automated)

<comment><USER4> Yes, but for a locked down OS version it should be possible to have administrator privileges denied to an application. So the Store could have a flag of which apps might need admin, and only those apps can be run as admin. This would prevent Word from being run as admin, since it certainly shouldn't have that flag.

<comment><USER5> The point of Task Manager here was that Word was being launched "directly"—the process was being spawned, outside of the framework that cares about concepts like "apps" or their security manifests.

No matter how sandboxed you make your high-level abstraction layer, you can always just remove the sandbox by removing the abstraction layer. Docker (for example) won't protect you if you cd inside your Docker image and run a binary from it directly on the host.

The only way to really "leak-proof" the abstraction here would be to build "apps" as a concept into the OS kernel itself, such that the exec/spawn syscall itself is responsible for doing the sandboxing and the OS's executable-binary format itself is responsible for containing the privilege manifest. So far, I haven't seen any OS interested in taking steps in that direction, though (which is odd, given that a similar conceit—code-signature verification—was embedded into said syscall in every OS quite recently.)

</comment></comment></comment></comment><comment><USER6> I wish:

(1) Microsoft would actually document clearly how its security works.

(2) Solve these security problems.

E.g., decades ago we had time sharing systems where rarely or never did the work of one user cause security problems for another user.

One partial approach is to run a program _in_ a particular file system directory and arrange that the program the program has very limited access to anything outside that directory and possibly limited access to what is in that directory.

Then ransom ware? Okay, such a program might make a mess but only within some one directory. In that case, junk the program and delete the directory.

Or a program gets its own access control list with its own capabilities for whatever _resources_ are or might be on the computer.

A clear goal is for Windows to be able to run any software, including malicious software, safely. Why not?

<comment><USER7> >decades ago we had time sharing systems where rarely or never did the work of one user cause security problems for another user.

How much of that was due to people not trying to cause those problems, though?

<comment><USER6> Well, they wrote and ran a lot of software with outrageous bugs, especially writing out of array bounds.

But likely a biggie difference is that the _attack surface_ was smaller.

Also it may be that some of what Microsoft is still struggling with is being able still to have Windows run old software that thinks it's just fine to read files from nearly anywhere, write lots of files it should have no business writing, run other programs, etc.

E.g., on Windows, I can download and install software, e.g., a new version of Firefox. That writes to my boot drive. What the heck security door did that software pass through?

I'd like to know the details of Windows security, but so far I've never seen any good descriptions or documentation.

I'm interested in Windows security because Windows is the source of the computing for my startup.

Otherwise, and in general, I hope that Microsoft gets the security problems fixed.

</comment></comment></comment><comment><USER8> So, they didn't install and attempt to run any ransomware. I suspect they could have, but if the claim is that it "won't run," it seems you need to actually go ahead and try to run it.

<comment><USER9> Not really. Most Proof of Concepts for Windows exploits merely launch something like calculator.exe as a placeholder, just to prove that malicious code _could have run here_. I think it's sufficient that if they could prove they achieved privileged code execution, it is safe to assume that ransomware could have run at that point unabated.

<comment><USER10> Running calculator.exe isn't sufficient enough for the claims that are made in this article, since it's already in the 'trusted' domain of the OS.

If they could get 'myPersonallyDevelopedExecutable.exe' to run, then the article would have a point, but the researcher stopped short of trying, so this article ends up being shitty journalism.

[disclaimer, MS employee].

<comment><USER11> Why? They are already running their own unsigned DLL injected code that can do anything they want. Even if the OS wouldn't allow it to launch an unsigned .exe, any malware can just be shipped in that DLL as easily.

<comment><USER10> This is an argument against running word as an admin and then explicitly allowing macros to execute, it has little to do with breaking the app- containment, which is the claim made in the article.

</comment></comment></comment></comment></comment><comment><USER12> Seems Word macros will also run, with the expected results.

[https://arstechnica.com/information- technology/2017/06/micro...](https://arstechnica.com/information- technology/2017/06/microsoft-should-shore-up-windows-10-ss-security-then- offer-it-to-everyone/)

</comment><comment><USER13> imo this isn't so much an Office problem as a general Centennial problem. As long as Centennial apps run with full user privileges, some of them are going to have some mechanism allowing someone to run untrusted code, and I doubt it's feasible to fix this if you also have a goal of allowing a large portion of the legacy apps people want to run, without requiring onerous modifications

</comment><comment><USER14> > can only run apps from the app store

So basically this is nothing but a control ploy by M$? Even Apple doesn't restrict things like that (on macOS)

<comment><USER15> They tried: [http://www.osnews.com/story/25619/Mac_OS_X_10_8_restricted_t...](http://www.osnews.com/story/25619/Mac_OS_X_10_8_restricted_to_App_Store_signed_apps_by_default)

</comment></comment><comment><USER16> Didn't get past the autoplay video with sound on your page. Pah

</comment><comment><USER17> Oh hey let me be a dumb ass and run untrusted code with Admin and blame it on Microsoft. - "Security researcher"

<comment><USER18> The whole freaking point of Windows S is that it's not supposed to be possible to do that.

<comment><USER19> I think it's fair to say there's an implicit assumption that a user, given the right knowledge and intent, could circumvent this protection at which point they're on their own.</comment></comment></comment>


Nextspace – NeXTSTEP-like desktop environment for Linux - <AUTHOR> https://github.com/trunkmaster/nextspace <comment><USER2> I imagine a world in which the F/OSS community chose to implement and innovate on GNUStep or some other OpenSTEP/NeXT/Cocoa compatible implementation. This project is exciting by way of providing a more complete nucleus of what that desktop might look like.

The KDE/Gnome schism really divided the mindshare of the open *nix desktop. If we'd gone this route, I like to imagine the differences between Mac and Linux or BSD would be small enough that

\- Mac apps would be a recompile away from running on Linux

And

\- Linux would be a viable developer environment to target macOS

Apple's commitment to the desktop has waned and caused some longtime users like me to go back to Linux/BSD. Meanwhile, desktop facilities on Linux/BSD have lacked coherence and singularity of vision. A viable, modern post- OpenSTEP Linux and BSD desktop would have the capacity to keep Apple honest, while giving the Free community a benchmark for consistency.

I'd love to see something like this project blossom into a 3rd way GUI layer for Linux and BSD.

<comment><USER3> Actually Gnome when it started was really good. I remember around 2000 same time as Redhat Linux 6, Gnome worked perfectly. But for some reason Gnome community wasnt satisfied so they started modifying it so much that it worked more like Windows, when they were still not satisfied they wanted to become more like Mac with fancy animations and a Dock. Which is why very few use gnome these days. Gnome people have lost their way. Now its just a community of confused people, same applies to KDE. A more well disciplined community is i3, mint and elementary.

<comment><USER4> >Which is why very few use gnome these days

Where did you get that info from? GNOME is the default on Debian, Ubuntu (probably the most popular distro) and Fedora

<comment><USER5> Maybe OP was thinking of people that chose the DE and are not using the default because they don't know there is an alternative.

Unfortunately in Linux community telemetry is controversial so we do not have accurate data on what people chose when they have a choice, surveys on reddit or other web pages are not reliable

</comment></comment></comment></comment><comment><USER6> > I intentionally left aside modern UI design trends (fancy animations, > shadows, gray blurry lines, flat controls, acid colours, transparency). I > like this accurate, clear, grayish, boring UI that just not hinder to get my > job done...

Amen! The UI in the screenshots looks very tasteful to me, and it's nice to see somebody not conflating "no-nonsense" with "ugly programmer art".

Looking forward to giving this a try.

<comment><USER7> When I read your comment I thought is going to look clean and nice... Looks like win 98... Not at all tasteful to me

<comment><USER8> Compare the nextspace screenshot to the nextstep screenshot, and one can see they are appreciably different.

nextspace: [https://raw.githubusercontent.com/trunkmaster/nextspace/mast...](https://raw.githubusercontent.com/trunkmaster/nextspace/master/Documentation/NEXTSPACE_Screenshot.png)

nextstep: [https://upload.wikimedia.org/wikipedia/en/1/1d/NeXTSTEP_desk...](https://upload.wikimedia.org/wikipedia/en/1/1d/NeXTSTEP_desktop.png)

<comment><USER9> I don't see anything really standing out between these two.

<comment><USER8> Sorry for the late response. The biggest difference to my eyes is the color choices. Although this was many years ago, I recall that the nextstep color scheme was very muted, tending to scale of grays rather than contrasting colors. The wikipedia screenshot seems to confirm my memory.

The nextspace screenshot shows apps and icons with very bright colors. Nowadays icons and apps tend to be colorful, and since they follow different color schemes, a collection of them has a high probability of clashing (e.g. the gray Gimp next to the orange Firefox.)

Nextstep could maintain a consistent aesthetic, I think, because: 1) there were not many apps available on it as there are now on nextspace, and 2) a single company, which had a notoriously style conscious CEO, produced these apps. Nowadays, apps are produced by different groups, with different tastes (let alone skills) in designs.

Nextspace faces the problem of maintaining the muted and clean style of nextstep, in a more diversified world. That's what I was reacting to.

</comment></comment></comment></comment></comment><comment><USER10> I really like WindowMaker and similar clones, but _(warning: ranting)_ I partially abandoned it because of how absurd it is to try to run a Linux system without DBUS-native tooling, which mostly only exists in GUIs for specific window managers/docks. Unless you're using one of a few popular desktop environments, Linux is a shitshow of bad user interface (and even some of them like Ubuntu seem to lack functionality that used to exist). I'm probably moving to Windows soon just so I don't have to spend _days_ to get an affordable machine from 2 years ago to achieve basic hardware functionality like "graphics" and "wifi".

<comment><USER11> Interesting. And I've recently moved to FreeBSD and let it imitate a Mac with Xfce, and I have graphics, Wi-Fi, black jack and hookers [1]. I never thought this level of imitation would be possible in the free world.

[1] [http://trafyx.com/?p=2551](http://trafyx.com/?p=2551)

<comment><USER12> > [1] [http://trafyx.com/?p=2551](http://trafyx.com/?p=2551)

Very nice. To me, the biggest things I have grown to love since moving to a mac are:

\- Spotlight (& I use it far less than most). You mention Desktop Search as the replacement. Have you wired it up to cmd+space?

\- Time Machine (the way it handles going back in time for your current Finder window is awesome). For me, an rsync solution is a poor cousin to Time Machine, purely because of the graphic aspect. It would be awesome to know of a FOSS equivalent to it (but would need to work with your current file manager: thunar).

<comment><USER11> Thanks. I don't use the Desktop Search that often but I think one can bind a shortcut to it. On the rsync, I can mount the remote file system and browse through the backups in the Double Commander or Thunar, so the graphical aspect is fully there. Plus, I have reports in the Terminal when the last successful backup was done. I don't really think I miss anything.

Edit: the rsync setup to do incremental backups and naming backup folders after the day of the week is mentioned on the rsync's home: [https://rsync.samba.org/examples.html](https://rsync.samba.org/examples.html) It's interesting how much more creative backups can be when you have full control over rsync on which, if I am not wrong, the Time Machine itself is built.

</comment></comment></comment></comment><comment><USER13> To save interested hackers the time: not a single configure script, makefile or specfile is in working condition.

<comment><USER14> Did you try to follow this [https://github.com/trunkmaster/nextspace/wiki/Build-and- inst...](https://github.com/trunkmaster/nextspace/wiki/Build-and-install)?

</comment></comment><comment><USER15> When I switched from Amiga to Linux in 1995 I thought that I will have a perfect NeXTSTEP clone within a few months. I saw pictures of GNUStep and it looked nearly ready to go.

Ha!

</comment><comment><USER16> On the bottom they mentioned [1] Etoile.

[1] [http://etoileos.com](http://etoileos.com)

<comment><USER17> Thanks, I was trying to recall this one. Looks like it didn't gained traction tho.

</comment></comment><comment><USER18> I haven't dug into the code, but how does this differ from GWorkspace and other GNUstep components (Prefs, Terminal, Login, et .)?

<comment><USER2> I've not dug deeper than reading the page and looking at the screenshots, but it looks like he's making some sane default choices such as to use WindowMaker for the dock rather than GWorkspace's dock. And it appears he's working to put more and more into the Prefs app (rather than, for example, configuring WindowMaker through WindowMaker's preference manager app).

GNUStep already has quite a lot there for making a desktop. What it's lacking is the implementation of the desktop. This, on the surface, appears to be an attempt to round that out.

<comment><USER19> I'm not sure using WindowMaker is sane at all.

WindowMaker is a completely isolated C implementation with its own GUI toolkit. It's not integrated at all with the rest of GNUStep. It only _appears_ NeXT-like, it's a facade.

GNUStep should ulimately replace it, if this is to be some kind of NeXTSTEP replica beyond skin-deep appearances.

<comment><USER14> Workspace is a new application that contains WindowMaker. And it _is_ fully integrated with GNUstep applications. This is not a facade, this is how OPENSTEP feels. Just give it a try.

</comment></comment></comment></comment><comment><USER20> So this is basically OSX but take away 30 years of human-computer interaction learnings and UI improvements.

<comment><USER21> Considering I spend 99% of my time either in a terminal or a web browser, I don't think it will have too much of an affect, unless the UX of either of those two are diminished. For years I used a very barebones Linux desktop (a minimalist tiled VM) and was very happy and productive with it. The former is largely why.

But I don't think the point was a 'better' desktop but an interesting or experimental one. Or simply just for fun.

We can often relearn valuable things from the past by recreating them. It's usually not enough to just look at pictures of it or hear stories. Plus many "new" UX and software problems were dealt with in the past and reappear later with new platforms, hardware, and UI concepts which start over from scratch.

<comment><USER22> > Considering I spend 99% of my time either in a terminal or a web browser, I > don't think it will have too much of an affect

Sure, for you, because apparently you just need a web kiosk and an ssh server. Some of us actually do want a personal desktop computer.

<comment><USER21> Yes, obviously it's just for a certain niche. Did you think the "Nextspace" linux desktop environment was for mainstream consumption?

</comment></comment></comment></comment><comment><USER23> WindowMaker was a perfectly functional touch interface circa 2008 using VNC/SSH on a Nokia N810 tethered to a N95 with a slow 3G connection.

It just worked.

I miss that separation between the phone and the mobile platform.

</comment><comment><USER24> Is there instructions on how a newbie can install this?

<comment><USER24> I found it...

[https://github.com/trunkmaster/nextspace/wiki/Build-and- inst...](https://github.com/trunkmaster/nextspace/wiki/Build-and-install)

</comment></comment><comment><USER25> Being a happy Window Maker user, I like that I will have more choices in the future. Etoile seems dead.

</comment><comment><USER26> Huh, this is pretty cool, if anything as something to install in a VM and get a blast from the past

</comment><comment><USER27> This is great. Nice work.

</comment><comment><USER28> Thanks for the naming explanation linked in the readme. That almost seems like a case study to warn of the dangers of using case sensitivity to reference different things.

</comment><comment><USER29> What about WindowMaker?

</comment><comment><USER30> Fantastic. If I ever run a DE again, I'm running this.

</comment><comment><USER31> Oh how I'd love to have Quartz/Aqua/Finder on top of Linux.

</comment><comment><USER32> I loved NextSTEP so I bought a Mac, which IS NextSTEP, only better.

<comment><USER33> I miss the NeXTSTEP menus, that Mac toolbar is horrid on large monitors. Also, the Finder is a poor second compared to Workspace Manager. The lack of EOF and the Digital Librarian is painful.

<comment><USER34> The Mac toolbar is thin and neat - not sure how that qualifies as "horrid"? I am using a 27" monitor.

<comment><USER33> I have a 34" monitor, so scrolling up to the upper left every time I need to select a menu item is horrid. Plus, they got rid of the amazingly useful tear off menu customization. The Mac toolbar is a big step backwards.

<comment><USER34> Then just use CTRL-F2, it's a shortcut to select the menu item. Although with such a big monitor, I'd say the biggest challenge is to move your eyes all the way up to where the menu bar might be. Unless of course you're sitting 10 feet away.

<comment><USER33> Ok, but missing the point if I have to use a keyboard to make it work better. The menu bar on the NeXT was a joy, obvious, and right next to where I was working.

</comment></comment></comment></comment></comment></comment><comment><USER35> beautiful. in a weird way it almost looks modern.

</comment><comment><USER36> This reminds me of Afterstep.

</comment><comment><USER37> CDE!

<comment><USER38> Hear hear, been my daily user environment since they open-sourced it what, 5 years ago?</comment></comment>


Oscar.go.com can't handle traffic after nominations announced - <AUTHOR> https://imgur.com/a/gIEwP <comment><AUTHOR> Linked to screenshot instead of the page so as not to exacerbate their problems. Here is the page:

[http://oscar.go.com/news/nominations/oscar- nominations-2017-...](http://oscar.go.com/news/nominations/oscar- nominations-2017-view-the-complete-list-of-nominees)</comment>


Rappers, sorted by the size of their vocabulary (Updated January 16, 2019) - <AUTHOR> https://pudding.cool/projects/vocabulary/ <comment><AUTHOR> This has been posted several times, but it was updated with fresh and interesting data today--for the first time in several years. Is it possible to get that [dupe] flag removed?

<comment><USER2> author here, that'd be great!

<comment><USER3> Does using a large vocabulary correlate with positive critical reception? Does using a smaller vocabulary correlate with increased record sales?

It would be interesting to see another dimension to the data such as critical reception or record sales.

Another idea is to break down an artist's discography, and show these stats across different albums (would probably only work for artists with a large discography)

</comment></comment></comment><comment><USER4> I wish he would add mc chris[0] to this. I have no idea where mc chris would fall, but I suspect it would be to the right, simply because of his use of unique sci fi words.

[0] [https://en.wikipedia.org/wiki/MC_Chris](https://en.wikipedia.org/wiki/MC_Chris)

<comment><USER5> Also a shame that Project Pat[0] is not included

[0] [https://en.wikipedia.org/wiki/Project_Pat](https://en.wikipedia.org/wiki/Project_Pat)

<comment><USER6> He is likely a part of Three Six Mafia's entry in the list.

It is a pleasure, however, to see Canibus ranked among the top. That man is a true legend IMO.

</comment></comment></comment><comment><USER7> Taken aback that there's an artist that passed MC Solaar - although in this source, they report him using 7691 words out of the first 30,000.

[http://www.slate.fr/story/93477/rap-francais-infographie- mc-...](http://www.slate.fr/story/93477/rap-francais-infographie-mc-solaar- vocabulaire-orelsan-disiz)

</comment><comment><USER8> The most surprising one for me is DMX. There is a lot of repetition in his songs, though I remember thinking that he was a solid lyricist spitting bars much more complex than his beats, which are certainly a bit more mundane.

<comment><USER9> Literally came here to say this!! I think more of his sound comes from his fast delivery, his different voices, and of course, his ridiculously unique beats. The Damien songs come to mind.

I think X achieves his lyricism through the combination of small and simple words into unique phrases. "Yall been eating long enough now, stop being greedy" is a unique phrase that no other rapper would ever utter, but it isn't made from complex words like Aesop Rock or Eminem would use.

</comment></comment><comment><USER10> As the author points out, song structure biases the results, so that artists with structured and repeated lyrics end up with a lower "vocabulary". Wouldn't it make sense to simply combine repeated lines before counting? So you'd be measuring vocabulary in first 35,000 non-structurally-repeating lyrics.

</comment><comment><USER11> Has someone tried quantifying those who create something maximally spectacular from the smallest number of words possible? This seems to be the theme in math: gargantuan universes out of minimal number of axioms.

<comment><USER12> Energy equals mass times the square of the speed of light.

</comment></comment><comment><USER13> I like the "Just W" filter. Also Action Bronson surprised me.

</comment><comment><USER14> I would love to see Dessa and Kate Tempest on there.</comment>


ATM Skimmers - <AUTHOR> http://krebsonsecurity.com/2010/01/would-you-have-spotted-the-fraud/ <comment><USER3> A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdrawals for pocket cash. (I use Simple, btw, which is quite nice.)

An unintentional side effect of this system is that it also minimizes the risk posed by ATM skimmers, since I don't keep much in the ATM account.

<comment><USER4> Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

<comment><USER5> "my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours [...] He lost all of his money."

That's horrible. Not to try to minimize, but something doesn't sound right, though (in the US). Risk of loss on debit cards should be up to $50, if you notify your bank within the first 48 hours, under the Federal Electronic Fund Transfer Act.[1]

[1] <https://en.wikipedia.org/wiki/Debit_card#United_States>

<comment><USER6> It's not a debit card transaction, it's an ATM withdrawal.

</comment></comment></comment></comment><comment><USER7> And that's why we use chips instead of magnetic strips nowadays.

For a longer list, see: <https://krebsonsecurity.com/all-about-skimmers/>

The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn't mean they don't have 'em.

Crypto is cool, until you mention physical security. Obligatory: <http://xkcd.com/538/>

<comment><USER8> How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

<comment><USER9> I've seen two different kinds of reports:

* Some banks cards were vulnerable due to faulty crypto. The banks phased those cards out.

* Attacks based on a malicious PIN pad logging the PIN code, then feigning a chip error and telling the user to fall back to the magstrip, thus turning to traditional skimming.

I haven't read anything that attacks the chip itself on current cards. Do you have any links?

edit; Just found <http://en.wikipedia.org/wiki/EMV#Vulnerabilities>

edit2: Wikipedia TL;DR: There are two currently-relevant attacks:

* One lets attackers trick a terminal into initiating a PINless transaction in order to use a stolen card. This information is sent to the issues as part of the authentication, so a bank could deny all PINless chip charges if they wished (I'm not sure what cases this legitimately used in?), plus there's a clear trail that the cardholder isn't liable.

* The latest attack tricks the card into downgrading to an older, plaintext method of transferring the PIN from the terminal to the card, allowing the PIN to be skimmed. I'm not sure how this is useful in recreating the card to steal money.

<comment><USER10> There's some evidence that the first attack was used in the wild, but the banks deleted the logs showing whether a PINless transaction took place so the customers were found liable for the charges.

</comment></comment></comment></comment><comment><USER11> There also is the technique of completely replacing an ATM in say a mall. Read about that one a couple times. Some ATMs in convenience stores and even retail chains like Walgreens and CVS already look sketchy enough.

<comment><USER12> A couple years ago someone brought a fake ATM into Defcon.

<comment><USER13> I'd also like to point out that it was placed there by local criminals, not the conference attendees. It was however discovered by the attendees and the hotel was notified and the offending ATM was turned over to police.

<comment><USER14> Were these the most idiotic criminals of all time?

"Hey, Bob! Let's place our ATM skimmer right in the middle of a bunch of FBI goons and security experts!"

</comment></comment></comment></comment><comment><USER15> This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern.

They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas stations frown upon...

<comment><USER16> there certainly has to be a method that could be devised to prevent this type of fraud. Visually a lot could be done that should foil someone looking to attach a skimmer.

From continuous images, seamless faces to make it obvious something is added on, to screen based keyboards. I am sure a lot of thought is put into it. I would hazard that the losses are not sufficient to fix it.

<comment><USER17> Yeah my first thought on reading the article is that if enough actors cared about this they would redesign the standard for card readers so that the card goes flush into the reader without any protrusions (some are already like this) and then market this fact so that machines that aren't flat are viewed with suspicion, but I'm sure the costs to replace all the machines out there and do the marketing would be enormous at this point, and you would need buy- in from a ridiculous amount of companies so it is unlikely to happen.

<comment><USER18> It could happen if pushed by the companies that make the ATMs, rather than the banks.

</comment></comment></comment></comment><comment><USER19> Just today I was in the test lab for the ticketing machines at the transport company I work for. Our machines being unattended and often in public spaces, skimming is a real concern (and it has happened to me personally).

The solution? Adding a plate with random bumps to each machine, and also adding a contraption infront of the card slot into which you place your card and then slide it in (see [http://blog.webwereld.nl/wp- content/uploads/2009/08/nspas.jp...](http://blog.webwereld.nl/wp- content/uploads/2009/08/nspas.jpg) ). This last solution seems to be patented BTW.

</comment><comment><USER20> I seem to recall that some banks (in Estonia??) will mail you a piece of paper with a list of single-use PIN numbers. Use one, mark through it. When you get close to running out, they mail you a new list.

<comment><USER21> Some banks do RSA ids, and you have to punch the right number in at the time of withdrawal.

<comment><USER22> A search on Google didn't pull much up for me on which banks offer this. Do you know which banks off hand?

<comment><USER23> Charles Schwab will issue a two factor device for online banking, but it is not required for withdrawals AFAIK.

</comment></comment></comment></comment><comment><USER9> I always tug at the card reader on the ATM to make sure it doesn't come loose.

What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

<comment><USER24> > _Why don't ATMs in Europe use chip and pin yet?_

Many of them do - one security feature is to have the ATM pull the card very, very slowly into the slot whilst oscillating them to prevent skimmers reading the mag strip, as it's no longer required (unlike the US, nearly all ATMs here in the UK feed the card in automatically, rather than manually dipping it). If you're not used to this you might think the machine was on the way out.

Even with ATMs that support EMV (chip and PIN) you still run into the problem that a) ATM design inherently involves pushing the card into something, which could allow the mag stripe to be raed, and b) as long as there are ATMs and places that _don't_ use EMV then there's always going to be a way to get money out / buy product with cloned cards.

<comment><USER25> I had an ATM card eaten in London on vacation because I couldn't recall the PIN.

That was a weird moment.

</comment></comment></comment><comment><USER26> This is pretty scary stuff, I mean fuck, every time I see a story like that I can't help but be amazed at how incredibly insecure the services of credit card companies are, and how hypocritically they behave at every single step about security.

<comment><USER27> It's an arms race, never throw in the big guns if you want to stay ahead. I'm no expert, but this is ain't rocket science. Suppose the insurance company covers $256K worth of damages, it's useless to add more security when the damages total $192K. The insurance company would periodically (or rather sporadically) evaluate their claim requirements (ATM must have grade X lock, must weigh at least Y tonnes, etc.) and adjust for common risks (according to past cases). Between upgrading the contract to cover more risk and implementing security measures, the latter will probably have a better cost- benefit. The costs saved not doing anything beyond the minimum helps their bottom line and potentially you as well (albeit indirectly), by offering you a better deal (i.e. slightly lower interest rates) than their competitors.

This may not be exactly how the system is set up, but I think I'm not too far off.

</comment></comment><comment><USER28> Article dates from 2010. Title should be revised to note this.

</comment><comment><USER29> I want to thank HN for possibly saving my arse. During my lunch break, I put some gas in my car. During the fill-up, I noticed the anti-tamper stickers on the pump were all broken. I paid it no mind, finished the fueling, bought some lotto tix with cash, then left.

Came back to my desk, fired up HN, and read the article upon which we are commenting. Simmered in paranoia for a little while, then called up my bank and told them my card might have been compromised. New card with new number on the way.

Now just have to remind myself to check my transactions until the new card arrives.

</comment><comment><USER30> I'm surprised this is new to HN. The article is from 2010 and ATM skimmers have been around for 15+ years. They've become significantly more sophisticated over time. Back when I was involved with this stuff 9 years ago most people were making skimmers you had to hook up with a USB cable to get the data. Now people are using cell phone hardware to transmit the data automatically.

</comment><comment><USER31> See previous discussion on "How is an ATM Secure"

Original article:

[http://security.stackexchange.com/questions/32917/how-is- an-...](http://security.stackexchange.com/questions/32917/how-is-an-atm- secure)

Comments:

<https://news.ycombinator.com/item?id=5421864>

</comment><comment><USER32> You should ALWAYS put the hand over the other one while you type the PIN number. At least your PIN typing is not going to be recorded. It's something.

<comment><USER33> The standard skimmer "online kit" options include also replacement keypads - <USER2> thin (1mm) overlay over the real keys that record your physical keypresses.

</comment></comment><comment><USER34> 2011 story. Can somebody downvote this? Gah.</comment>


Gonorrhea Evades Antibiotics, Leaving Only One Drug To Treat Disease - <AUTHOR> http://npr.org/blogs/health/2012/08/10/158464908/gonorrhea-evades-antibiotics-leaving-only-one-drug-to-treat-disease

<comment><USER2> The eventual resistance of bacteria to antibiotics could be a major problem for the human race. Hopefully other technologies like Bacteriophages will be able to help. (<http://en.wikipedia.org/wiki/Bacteriophage>)</comment>


Millennials flocking to 10 US cities to get a job, buy a home, and start a life - <AUTHOR> http://www.businessinsider.com/best-housing-markets-2018-millennial-home-buying-2017-12 <comment><USER2> As a Californian millennial articles like these make me frustrated. my one bedroom apartment is ~2200 a month and came without a refrigerator. home prices start at a million dollars, traffic is horrid and the city i live in is currently on fire.

That having been said, im not sure id trade California for Ohio or other so called "flyover" states. The only time they end up on the nightly news is when they violate marriage laws (Kentucky) for gay couples, stage a massive white supremacy rally (Virginia) or pass some arcane law that either wipes out womens healthcare or edifies teaching autonomous ignorance in place of biology in school.

Is there an independent perspective on these cities? Something that cuts to the point of what living in Tennessee is actually like? can I still get bulgogi and ramen? how does healthcare work? I know these states would get quite a few more transplants if they or someone just explained what it was to be a part of them.

<comment><USER3> It's not so much of a "flyover" state dynamic -- it's more rural vs urban.

States like OH and KY have more rural space, which tends to lean conservative, which increases the chances of hearing about extreme-right nonsense.

I would imagine the opposite is true in states with more urban space and the nonsense of the extreme left.

Urban areas in OH and KY are similar in terms of cultural offerings and advanced technology of most cities. Or at least they are in Columbus....

<comment><USER4> Yep. Did school in Boston for several years, almost exactly the same as my life in Cincinnati and Columbus except more expensive. There are definitely pros and cons to any decision about where to live, but your life in most places is always going to be "work, go home, pay for stuff, spend time doing fun stuff with friends when possible." The only valid exception is if you're working in a field and position where you truly need to be exposed to the absolute highest levels of industry, e.g. NYC for finance, D.C. for law and politics, SV for tech. But the people who are truly operating at the level where that matters are a fraction of a fraction of a fraction of a %, and if Warren Buffet can work from Nebraska I assume that's true even for many people who are at that level.

</comment></comment></comment><comment><USER5> The cities in this list in no way represent the top 10 cities that millennials are "flocking" to.

Headline:

> millennials are flocking to 10 US cities to get a job, buy a home, and start > a life

Data:

> 10 US housing markets Trulia expects will grow next year while remaining > affordable and attracting young buyers.

</comment><comment><USER6> I could not have been more wrong in my predictions of this trend. At Y2K I looked at a future where better technology would allow people to spread out around the country and still tap into meaningful cultural and job opportunities. Lower cost of living and higher quality of life. Instead, it's like the opposite has happened, and we're increasingly roped together by a noose that tightens more every year.

<comment><USER7> It's not really technology pushing people into cities is it ?

I assumed its really due to a lack of well paying jobs, combined with an increased debt burden from college.

I guess one could argue technology has lead to increased automation and reduction of jobs typically found outside of cities.

<comment><USER8> I suspect this is almost more of a "marketing" (for lack of a better word) problem than anything else. It's this negative feedback loop where no one thinks non-costal cities are cool, so they don't move there, so they don't become cool, etc, etc.

<comment><USER9> I grew up on the East Coast so that may also bias me a bit, but I'm planning on being in NYC for at least the next 10 years seeing how the "second coming" of tech plays out. I feel a lot better about job prospects in NYC in an economic downturn vs basically anywhere else. Sure, rent is high in the abstract but roommates bring it way down.

</comment></comment></comment></comment><comment><USER10> Columbus, Ohio (#8 on the list) native here working in User Experience Design making an average tech salary. At the end of every month I'm always amazed at how much I can put in savings and travel because of the low cost of living. I live downtown and my rent is only $750. There also seems to be high demand for jobs, but not enough talent to fill those jobs.

<comment><USER11> sounds pretty cool, but then I'd have to live in Ohio.... more of Michigan person myself

<comment><USER12> What's the difference? (honest question)

<comment><USER13> I can't speak to the parent's reasons, but I do know that Ohio and Michigan are rivals for a variety of reasons, one from the early indoctrination of their public universities (Ohio State Buckeyes and Michigan Wolverines) into the general populace, even those that never attend either. Those two states have an allegiance/pride instilled into their citizens early that most places don't (apart from maybe Texas and NYC). Some of my friends that I went to college with that grew up in Michigan actually rooted for the Wolverines to beat us haha.

<comment><USER14> [https://en.wikipedia.org/wiki/Toledo_War](https://en.wikipedia.org/wiki/Toledo_War)

</comment></comment></comment></comment></comment><comment><USER15> Having recently escaped Columbus, Ohio after an extended accidental stop there, it would take a lot more than just the ability to buy a shitty house to get me to go back. The job market is deceptively weak, going _anywhere_ requires getting in a car, and worst of all you share the state with Cincinatti, which is like Columbus, but somehow worse in every way.

Seriously though, of course houses are cheap in Ohio. The 3 major Ohio cities are all giant sprawling semi-urban areas, with _very_ limited public transit, while the rest of the state is in varying states of rust belt recovery (or collapse). The few walkable, connected neighborhoods in Columbus (Upper Arlington, the nice part of Grandview, etc) command prices that would be tough to afford on a west coast salary, let alone the 60k-90k you'd make in Ohio.

<comment><USER3> I would take exception to a lot of this, but you're right about needing a car. Columbus is extremely lacking in public transportation. Traffic is not too bad overall, but if growth continues eventually the increasing number of cars will create even more problems.

<comment><USER16> I know I was living in a bit of a special enclave of Columbus (Clintonville), but I I'm finding a car to be _much_ more mandatory in the South Bay. In Columbus I would only drive about once a week when I needed to go out to the suburbs.

EDIT: However I do agree that public transportation sucks there. BUT it can be far, far more pedestrian-friendly than my current environs.

</comment></comment></comment><comment><USER17> Raleigh is a hidden treasure. Educated populace with good schools, pretty decent jobs, yet peaceful and green.

Their only drawback is isolation from west coast hubs.

<comment><USER18> I grew up in Charlotte and a lot of my engineer friends have settled and started families in Raleigh. It's made me consider moving there when I finally burn out on the Bay Area scene.

<comment><USER19> I can personally attest that every place on that list is pretty damn nice except for Grand Rapids which is to damn cold! They all have low cost of living and a solid tech scene as well.

<comment><USER20> Don't forget cloudy too. You can go for close to a month without any sunshine around February in Grand Rapids.

</comment></comment></comment></comment><comment><USER21> Added bonus of a cheaper state income tax at any of these places vs CA or NY (expect WA which wins out for the time being, though they seem to be facing pressure to change)

</comment><comment><USER22> For those also using an ad blocker like myself:

10 cincinnati, 9 madison, 8 columbus, 7 austin, 6 fort worth, 5 san antonio, 4 el paso, 3 raleigh, 2 nashville, 1 grand rapids

<comment><USER23> I briefly debated turning off my ad-blocker to see this list. Decided instead to check HN in a couple of hours, so thank you!

</comment></comment><comment><USER24> With how much talent the coasts seem to suck in, there needs to be a better conversation about how the rest of the country attracts talent. It's becoming more and more obvious that economic growth is predicated on solid jobs requiring a college education.

<comment><USER25> The north central schools (think Big 10 land-grant colleges), Georgia Tech, and Texas schools produce perfectly fine engineering and science grads. They mostly don't leave the locales they are in, because they all do this analysis:

"California: great weather all year, earn much less adjusted for CoL" "(e.g.) Minnesota: great weather for 8 months of the year (11 months if you ski or play ice hockey), earn much more adjusted for CoL"

So maybe you just haven't seen the talent in the rest of the country and assume it isn't there?

<comment><USER26> I've heard great things about Minneapolis, always with the caveat 'except for winter' but it seems you can still do winter stuff like people do in the rest of the world. Is the winter particularly bad or does it just seem that way if you're coming from a typically sunnier climate?

</comment></comment></comment><comment><USER27> It's strange to see Austin on this list. It says it takes nearly 50% of your income to buy a home. While all the other cities are nearly half that. Most of the other cities are also Midwest/North and have seasons / snow except for all the other Texas cities.

I'm in Austin, I like it, I don't see myself ever buying a home, but I'm happy renting. I've owned homes in the past and I honestly didn't like it.

<comment><USER28> My honeymoon with Austin ended a few years ago. In 2011 I absolutely loved it. Pubtrans and traffic has become so miserable (oh boy, express lanes) that I have almost completely quit leaving my 3 mile bubble. I ride my bike sometimes but that's always nerve wracking. Everyone from LA will hop on here and say it's not bad, the problem is it's not getting better. The improvement projects are bad. The metro rail by me runs ONCE an hour.

Also people are being priced out of homes. You know why there are hardly any townhouses here that were built after the 70s? COA banned building single family homes on lots smaller than 5750 sq feet. That regulation was removed LAST year. Your options for buying property here for anywhere near our median house value was basically buying a condo in a midrise or buying a 70s house up north (which is what I had to do). If you go to Dallas or Houston you can find really nice 2-10 year old townhouses in the middle of cool areas for $200-300k. Appraisals skyrocketing 30-50k/yr for the last 2 years has caused my property tax to rise $200/mo .. twice. And that's with homestead exemption. $800/mo in property taxes alone for my 70s regular-old-house. I'm sure it'll go up another $200 next year.

Median household value is $400k now. [http://kxan.com/2017/06/14/report-shows- austins-average-home...](http://kxan.com/2017/06/14/report-shows-austins- average-home-price-hits-record-400k/)

Been considering Olympia lately. Visited a few months ago and it was a really cool place. Felt like Austin probably 30 years ago. People still owned houses "downtown." Super walk/bikeable and a lot going on. I was shocked when I realized it only has 50k people.

Also you're so damned central in TX that I can't go camping anywhere fun without a minimum 8 hour drive.

<comment><USER27> The property taxes here to me are my main concern. Even if paying for a downtown condo in cash I still have a substantial monthly constantly growing property tax. It seems pointless to me.

It is very bike (although all my friends disagree) and walk friendly. I got rid of my car and have been biking and walking every where (my apartment is downtown). Minus insurance, car payment and parking fee my rent is about what it was in Oklahoma, but in a much better location and quality of life.

I came from Oklahoma a few years ago, where I owned a house in Tulsa and then Stillwater. Home prices are very similar to what you describe. For $200,000 to $300,000 you get a mansion, brand new even, in a very nicely kept up community with little to no H.O.A. fee (for keeping it up and access to the community amenities like club house and pool and trash).

Edit: Do you mean Olympia, WA?

<comment><USER28> Yeah, Olympia WA. I know nothing about it beyond spending two days there while I was hiking around Olympic National Park, but I really liked it. I'm sick of having to drive and find parking etc everywhere.

My mortgage is 1400, my property tax is around 750 for reference. I previously had a fancy unnecessary downtown apt (studio) for about $1700, now I'm around 2500/mo after insurance, etc. I put very little down, my bank only required 3.5% down but I put around 10% down. The house I bought has gone up $100k in the last 2 years so I figured if I didn't buy now I'd never be able to buy.

If only salaries went up 10-20%/yr like my property taxes do.

<comment><USER27> My apartment is somewhere around 1,800-1,900 per month and that includes all fees and what not. It's also a studio, but it's condo grade (3 feet of sound proofing on all walls and ceilings), concierge, built in Sonos and speakers, ethernet, and option of having Google Fiber. Not sure I ever want to move. I'm kind of content actually.

It's tempting to consider buying a condo downtown over at 360 or even Seaholm for the reasons you list. I would put down 20-30% though. I do not want to live outside the city. I like being in the middle of everything. I've toyed the idea of moving back home to Minneapolis or trying out Portland. I don't want to deal wit cold weather. My parents are retiring and just bought a home in Sarasota. They have invited me down with them. Which is tempting.

<comment><USER28> I have family in Sarasota. If you at all like the fact that you can do things after 8pm in Austin do not move to Sarasota. Go visit your parents so you can go to the beach (Siesta Key) and go home.. lol. I lived with my mom in Sarasota for year after college and not only did I have to drive an hour to Tampa for work but the place was one of the most boring places I'd ever lived.

I'm 2 miles from the domain which is one reason my property taxes are so high, $380k 3/2 house. So, while I'm not "in the city" it's a $6 Lyft to go to rock rose, train downtown is 5 minutes away (but stops going north at 7pm).

I lived in midrises forever. I got absolutely sick of dealing with parking garages every time I wanted to go drive somewhere. Beware as well, some of the downtown highrises require you to use and pay for valet services. The Austonian didn't require me to use it but there are a couple that do.

I just wanted a damned nice townhouse like I had in Houston. They started building them in 78704 but they're $800k (because 78704). These sorts of things; [https://i.pinimg.com/originals/16/f0/4c/16f04c1392ade123104c...](https://i.pinimg.com/originals/16/f0/4c/16f04c1392ade123104c9b46d00f0e2b.jpg)

They're perfect for me, I'm single and just have dogs. Right now I have a front and back yard that nobody ever uses.

<comment><USER27> Thanks much for the information. I currently live in 78704 (The Catherine). Those types of places are perfect for me as well. I'd love something like those townhouses (also single, would love a dog as a companion). I was looking and tempting like I mentioned a 1 bedroom at the 360 or Sealholm or 800 Brazos, but those start around $400,000. Location is very important to me. I'm not going to live outside the city.

Thanks for the heads up about Sarasota. The reason I left my cushy lifetime job in Oklahoma was because of the lifestyle. I was bored out of my mine. Nearly felt like I needed prozac and psychotherapist just to make it through the days (I didn't, but it sure felt like it). Coming to Austin, with in a day or few I was cured. My parents would have moved to Austin, as they love it, but dad was dead set on a boat and water and ocean front (they bought a house on the ocean and are shopping boats now).

You lived in the Austrian? I don't have that kind of spare cash, at least from the prices I have seen advertised.

If you are downtown and bored and want to meet up or something, my email is in my profile. You should hit me up. Love to chat more if you are interested.

<comment><USER28> Stayed with a buddy who owns some units there, definitely out of my range and even if it were for that price I'd be on the lake or something.

Not downtown much but I'll drop you a line when I am. I stay in my little 3 mile bubble around the domain mostly these days. Pretty boring and quiet but everything I need out here.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> Without even clicking I guessed Grand Rapids would be close to the top of this list.

The job market here has been fantastic, there is a great metro life to be had, housing is decent, plus the country and small towns around it are easy to commute from. 20-25 minutes to a Great Lake, fantastic beaches, even better beer. Grand Rapids is a fantastic place to call home.

<comment><USER30> True. Except! The bone chilling winters and lake effect snow that accumulates into multiple feet. I remember one winter years ago where, when visiting my girlfriend, the wind-chill temp was 45 below zero and our cars were encased in ice an inch thick.

That being said, I'm from Detroit but if I had to live in Michigan again I'd be in GR.</comment></comment>


Ask HN: How to learn to stop worrying and love pair programming? - <AUTHOR> At my work we have to do pair programming for some time. For me it seems even worse than being interviewed. To make myself concentrate is very hard. And it seems that this pair programming is exactly the opposite of what programming is all about, i.e. to become temporarily unobservant, forget about everything else but the problem to solve and the code. So I wonder, are there people who can truly enjoy pair programming? <comment><USER2> Pair programming is great to get junior people or people just coming in up to speed.

If you put me and another senior next to each other to use just one computer and make us do that consistently, we would both quit the job by friday. Pair programming is a great way to cut your productivity in half (2 people doing the job of one). We trust each other anyway, there's no point in watching each other like hawks. We can just do our own thing and then CR the other guy.

Pair programming is another one of those schemes employed to make people feel pressured into not slacking under the pretense of it being new and edgy and kinda cool. Its great, nobody ever slacks. You just burn out within months.

If you don't think pair programming is retarded, please ask a welder how he would feel about pair-welding. Complete and utter bullshit.

^ I'm talking about professionals. Not brogrammers. Not node.js clowns. Those people could all use some supervision. But sticking two great engineers with lots of experience together like that will jsut reduce productivity and will to live.

<comment><USER3> Nose.js clowns?

<comment><USER2> node.js

<comment><USER3> Sorry phone typo. Question is why you associate node.js with being a clown?

<comment><USER2> I'll let the paradigm and the code speak for themselves.

Other than that, I did not say that all node.js engineers are clowns. I said that clowns tend to use crap like node.js over better alternatives.

Don't ask me for better alternatives without saying what you want out of your tool, though. Node.js does a little of everything but is pretty weak at all of them. Now, if your main requirement for a programming language is that it better be as crappy as your frontend technology, then node.js is the only choice you've got :D

<comment><USER3> Don't worry I'm well versed in the better alternatives was just interested in the correlation. And sometimes at a job you have to use tooling you wouldn't necessarily choose yourself.

I like your welder analogy it priceless! Pair piloting works well I heard.

</comment></comment></comment></comment></comment></comment><comment><USER4> I've done pair programming. With the right partner it is productive and produces better code. The person at the keyboard is at a disadvantage because the partner has more "think time". Anyway, I found it pleasant.

The KEY problem is management. My partner always wanted to type so we ended up with me doing the thinking/review while he worked out the syntax. When we got our performance reviews my partner got a raise and I got a bad review. My manager believed that he did all the work and I just sat around talking.

Beware the 'review' trap...

<comment><AUTHOR> So you could concentrate and think despite that there is another person sitting next to you and waiting when you say something?

This part remains me too much of an interview: somebody sitting next to you and waits in the real time when you say something. It is too much pressure for me, somehow.

<comment><USER4> We both knew the task, having designed it before we started. It involved networking so there were standards we had to follow. He wasn't 'waiting', just writing code. However, writing code takes up a lot of head-space. My portion involved things like real-time code review, discussing design decisions such as where to check for edge cases, etc.

There isn't much benefit to pair programming. It does catch errors sooner. It does help structure code better. It does eliminate typos the compiler can't catch. So it does have benefit. But I think the cost of two programmers does not justify the benefit.

The real problem is 'shared credit'. Remember those school projects where 2 or 3 people worked together? I had one in grad school where I ended up writing almost the whole project myself but we all got an 'A' grade. Management has no way to figure out how to allocate credit. This is a problem in shops where they put people on a scale of 1-5 or some such nonsense. If your shop does this, do NOT pair program.

</comment></comment></comment><comment><USER5> I agree with another comment here, you are not supposed to love pair programming. It's an attempt to put pressure on you. Just never do it, talk to your manager. If they are not happy with your decision, leave, as you are the one to suffer the consequences, not them.

<comment><AUTHOR> I also see it as an attempt to put pressure on me, but I know, that there are people who truly like it. So would be interesting to understand their point of view.</comment></comment>


Ask HN: Here is my idea...help & feedback needed. - <AUTHOR>

Ok..I am going to come straight with you guys. I am feeling vulnerable right now, and had to reach out to the community for a little support.
I have been consulting for the last few months. That one client was my largest client and they are going away very shortly. I could either continue trying to do the freelance/consulting thing, or get a 'regular job' except I am in Jamaica and the startup scene, that I would want to work in, is not available locally. Going through the visa process is such a turn off, for another job in the US.
On that note, I would rather work on my app and am going to put my idea out there and see what happens.
I have been working with designers and developers for the better part of the last 3 - 4 years, in a project management type capacity and have discovered a huge pain point that I am determined to fix.
When a designer does a comp for me, they email it to me (or post it to basecamp, or upload to an ftp). I then look at it, reply to the email with comments, or post a comment to basecamp or send notes in a word/txt file. They then revise it, and on and on and on. This process gets very messy, especially when I have to then pass the comp along to other stakeholders (e.g. people on the executive team, other designers, developers, etc.). So I am building a web app to do that. It's called either 'Comp Version' or 'Comp Versions'. I own both domains.
I have started working on the interface, mainly jQuery, HTML, CSS. I am no designer, but I know how it should look and function and have decided to just build it myself. The truth is, that had things continued on (i.e. still had my major client) I was planning on taking the long slog of a journey and building it on my own, while learning everything. I am learning jQuery as I go along, and it is an uphill climb.
So, right now, in my moment of vulnerability. What I am looking for are a number of things. 1) Do you guys think this idea is good, and would any of you want to pay for this monthly? 2) Would you be willing to sign up for an alpha? 3) Are you a strong rails developer, that are interested in working with me on the back-end for equity or delayed compensation (that might be much higher than getting paid upfront)? 4) Any encouragement that can help me get over this little slump of vulnerability I am feeling right now.
I know that if I am able to power through, and get this app off the ground (without running out of cash), I will be much better off...both financially and psychologically (I can't explain how long I have been wanting to do this). I am just going through a slightly rough time at the moment.
Thanks guys.
P.S. I would apply to Y-Combinator...but it's too late and am running out of cash :| <comment><USER2> I think the idea is great. I have seen people struggling with Basecamp for this in the past and I've been on both ends.

The only downside that I see is that the number of designers out there doing freelance projects is relatively small, so your eventual 'market' is kinda tiny.

Anyway I wouldn't let that stop you. If you feel the pain I'm sure at least 50 others do, and that, to me, is enough to do it :)

One thing I'd add though - partner with another designer. Designers care greatly about the visual aesthetic of the tools they work with. As this is mostly targetted at designers, make sure that you get one that believes in it (offer lifetime free service) to help you out :)

<comment><AUTHOR> This is an awesome suggestion. I think I will edit my post to include a reach out to designers. I meant to do so, but it slipped my mind.

Also...re: the market size...that's what you think at first glance. However, if you look at the number of interactive agencies around the world, I would say there are at least a few tens of thousands - if not hundreds of thousands or a million.

Remember this is not just for web designers. Anyone that does any graphics work, that needs to collect revision notes from their customers. Illustrators, animators, sketchboard artists, print designers, web designers, marketers that do print design, etc. I am fairly confident that the market is big enough for me to make enough to work on this full-time, and have enough to support at least one or two others doing the same. As for bigger than that, we will just have to see.

<comment><USER2> Perhaps you could build something that plugged into Scribd then? They are gearing up to be the defacto HTML5 'embed anything' vendor for the web.

Building a comment and revision tracking system on top of it that is very easy to use could be a great way to 'start' your startup before moving to a standalone system? :)

<comment><AUTHOR> Interesting.

Never thought about that.

Not sure if that will be a good place to start, but I will definitely look into it.

My main issue now though is to get some sort of cash flow going as soon as I can.

So we will see.

Thnx though.

</comment></comment></comment></comment><comment><AUTHOR> Since I can't edit the post, I am also looking for a nice designer to work with this on polishing the UI for me. Either lifetime free service, delayed compensation, or some other creative compensation that doesn't include cash.

</comment><comment><USER3> We built a similar app for internal use, with the addition of real-time collaboration (flash-based audio/video chat + NetMeeting-style abilities to draw, type, etc. on the reviewed document). While this requires a central server to stream a/v and good connection, it's quite popular around here now.

</comment><comment><USER4> It sounds like you're trying to build <http://www.notableapp.com/>

With no partner, still learning, no designer and running out of cash, you'd be better suited doing something else.

<comment><AUTHOR> Not exactly like Notable.

I know the odds sound ridiculous, but we'll see how it turns out.

</comment></comment><comment><USER5> I built a similar app for a different audience long ago. I would like to work with you on this. Tried to email you. But didn't find an email on your profile.

You can mine on my profile.

<comment><AUTHOR> Funnily enough. Yours isn't there either.

Can you email me at: marcamillion {at} gmail.com please.

Thanks.

<comment><USER5> ah! I added the email address in the email field on my profile. But isn't that field visible? Or maybe that field is not shown to others. Thanks tho, I've added it to the About field.

P.S: Sent you a mail too

</comment></comment></comment><comment><USER6> Why would this be better than Dropbox and emails for commenting? Dropbox does automatic versioning of files, doesn't it?

<comment><AUTHOR> Why would you use getsignoff.com as opposed to using Dropbox?

Dropbox is good for managing files and versioning of files. But it isn't good for easily working with different versions of a graphics file.

</comment></comment><comment><USER7> Isn't this similar to getsignoff.com?

<comment><AUTHOR> You are right. It does sound very similar. I think they are the closest product I have seen that comes close to what I want.

However, they didn't do it the way I would have done it. So, I guess there is space for at least two apps :)

<comment><USER8> Even better way to frame it: Finding a competitor is one of the best ways to validate your idea!

<comment><AUTHOR> I thought that, but never said it :)

</comment></comment></comment></comment><comment><USER6> What's a comp?

<comment><AUTHOR> I believe it stands for 'Graphic Composition'. One version of a design of anything.

I wonder if this is a red flag...the name that is.

<comment><USER6> > I wonder if this is a red flag...the name that is.

It is for me. I speak with graphic designers and have had designs done and didn't know the term. I am in the UK if that makes any difference.</comment></comment></comment>


The Lesser Known Contributors Who Are Trying To Make PHP Good Again - <AUTHOR> http://www.danielnill.com/blog/the-lesser-known-contributors-who-are-trying-to-ma/ <comment><USER2> Article title seems to imply there will be some info about the people who programmed these new features... instead there's a rehash of the new features and mention of a library or 2 that we could read about elsewhere.

Author says, "the developers of these new tools deserve some serious recognition for the work they are doing" and then totally fails to mention them!

So now we've again been suckered into the 'PHP good' vs 'PHP bad' non-debate.

</comment><comment><USER3> While I've bashed PHP as much next guy, these are the facts:

-Take away PHP and the internet would break. The vast majority of websites are either written in PHP or have a PHP back end.

-The LAMP/LNMP stack is by far one of the most deployed web server configuration.

-PHP is extremely well documented and it's been around so long that it's easy to find solutions on the web.

PHP is the Model T of web languages: people love to laugh at it because it's old and ugly but it nearly single-handedly revolutionized the landscape. I for one applaud any efforts to revive and improve this language.

<comment><USER4> _PHP is extremely well documented and it's been around so long that it's easy to find solutions on the web._

I can agree that PHP is documented. That it is _well_ documented however is something I'm very much willing to argue against.

PHP has string-operations documented to be "binary-safe" without ever saying what that is supposed to mean, if it's good (it's not), if it's bad (yes, yes, yes it is) and why you should have an opinion on that at all. Nothing about that. "Binary-safe" is not defined anywhere. It just "notes" that all these operations which should operate on text is "binary-safe". And "safe" makes it sound like a good feature, right?

Documentation like this is probably written by people who have no idea what a character encoding is and thinks that being able to strpos() on raw byte-data is a "cool feature", without understanding that text and it's encoded representation are two very different things.

Basically, the documentation is written by people lacking any deep understanding of the subject they are covering, and they pass their confusion on to whoever may be unfortunate enough to stumble upon it.

So... Is bad documentation better than no documentation? I don't know. Maybe? Still: PHP documentation, good or bad, represents the blind leading the blind.

If you want "extremely well documented", head over to MSDN and check the .net docs. It's systematic, it's consistent and it's thorough. It's written by people who understand the difference between Unicode, UTF8, text and bytes. Or whatever else the subject you are reading about covers.

But people peddling in PHP wouldn't know that, because they wouldn't want to go too far outside their comfort-zones, and hey, they _definitely_ wouldn't want to look at anything done by Microsoft.

<comment><USER5> @josteink, you don't really understand what good documentation is do you. A large amount of PHP documentation provides context in which you may effectively implement a piece of code by providing "sufficient" examples. A grenade I can almost guarantee you probably comes with documentation, but probably a warning which states when you pull the pin, it will blow up. PHP will not blow up the world, or blow your hands off. The documentation does not have to be "perfect". PHP has changed web development in many positive ways, by increasing what could be done via simplicity using what you might call poor documentation. It has sufficed enough that good developers found it sufficient to build large complex code-bases which they could both build on and make money from. Much of MSDN library is created from internal comment-style documentation automation(JavaDoc,PHPDoc, XML Comments). MSDN will often times lack easily readable code-samples, and provide enough context in which you may actually use a library. Just because you define a prototype with long naming conventions doesn't mean Joe schmuck has a clue. PHP examples are generally not obtuse, or obfuscated to newbies. It's the "I'm going to show you how to hunt fish" and nobody said it had to be pretty. MSDN has gotten better over the years, but there are still many areas in the many libraries hosted on there which don't have "even good enough" documentation to help you to the most basic things.

</comment></comment></comment><comment><USER6> Time to beat this dead horse again!

PHP as a language isn't great, since it has been around the block in a volatile environment (the web) and shows lack of foresight in language design.

However, PHP is experiencing a renascence with modular components, frameworks and tools utilizing established design patterns, and an overall boost in contribution and collaboration in the open-source community, in large part thanks to Github.

PHP is not dead, and vibrant communities around Symfony and Doctrine are pushing it forward considerably.

In my opinion, large applications can and have been built primarily on PHP while leveraging other languages and tools for their strengths.

<comment><USER7> A lot of good people are working on a lot of PHP that isn't going away, and obviously they are going to improve tooling and the language itself. There is a renaissance in terms of making PHP development sane and thus not something good people run away screaming from - a bit like Java.

But the benefits of starting a new project in PHP are few: All of the original benefits (mainly low barrier to entry) are eradicated, and that leaves PHP to compete directly, as a full development environment, not as the only easy way to get code on the web, with a myriad of other languages that can, almost objectively, be thought of as better. Again, a bit like Java.

</comment></comment><comment><USER7> PHP was never good, but it abstracted away some basic web specifics -- as opposed to CGI/Perl that required you to care about protocol details such as starting output with two newlines -- and hit a sweet spot infrastructurewise -- dead easy to get started with, dead easy to get hosted for next to nothing -- that gave it enough traction to grow very quickly.

<comment><USER8> I'm not sure that was so much the attraction when PHP first started gaining traction given the existence of CGI.pm

From my experience in the 90s, most of the early adopters of PHP were more smitten with included PHP code in otherwise static HTML files. It was SSI++

</comment></comment><comment><USER9> Those are all nice, but as a long-time PHP dev, the only way to make PHP truly better is to do a Python-style hard version bump. Rip off the band-aid, so to speak. Create an entirely new, consistent, object- or namespace-oriented standard library to replace the mess that exists now. The majority could just be wrappers for existing code, which is fine but just inconsistently named and parameterized. Then fix the terrible namespacing implementation, consolidate the jumble of operators (::, ->, ., +, etc.), add some syntactic sugar to objects (getters and setters?), add native Unicode support, and call it all PHP X or something.

There's much to be said for backwards compatibility, and PHP does that really well; but there's also much to be said for a new generation built with the mistakes of the past in mind.

I actually really like PHP despite its flaws. It gives the programmer easy, deep control over HTTP output, it's easy to install on new servers, it's easy to deploy (no compilation, just rsync everything!), it has decent built-in templating (if you can learn the quirks), it's OSS, it has rich libraries, rich documentation, and a rich community. But it's also deeply flawed and it deserves a break from the past.

My ideal sort of web language would be something with C# syntax and libraries but with PHP-style OSS-ness, simplicity in output and compilation, and expressiveness in HTML. That would be nice!

</comment><comment><USER10> Everyone probably knows this, but PHP's Smarty template engine (<http://www.smarty.net>) is really awesome.

I've yet to see a better one in any language - it has things like Unix-like pipe chaining of filters, user defined functions, and intelligent caching built in.

I reduced the number of lines in one codebase I worked on by 70% through use of Smarty.

<comment><USER11> PHP is itself a template engine.

Bolting a template engine on top of that makes no sense whatsoever.

<comment><USER12> I hate PHP and don't even want to talk about it but I did skim through the docs for Smarty. The rationale is that PHP sucks as a template engine, so why not create a new one and use PHP for the model-controller/whatever.

Maybe that seems perverse, but you have stuff like Node.js in existence that oddly enough solves some problems quite nicely, so maybe it works for PHP guys. I'll never see the appeal compared to other languages though.

edit: That being said, the final result looks kind of horrible to me.

<comment><USER4> Completely unrelated: I'm not easily offended. Right now I'm not offended at all, in case anyone would interpet this post to mean so. I'm all OK. Really.

But that said: I'm severely puzzled about your choice of HN username.

<comment><USER13> Breivik is a fairly common last name. There are actually 8 men in Norway who have Anders as their first name, and Breivik as their last name.[1]

[1] [http://www.ssb.no/navn/sok.cgi?lang=n&fornavn=anders&...](http://www.ssb.no/navn/sok.cgi?lang=n&fornavn=anders&etternavn=breivik)

</comment></comment></comment></comment></comment><comment><USER14> So does PHP not let you mock things by actually writing classes in the test file, like:

       class FakeFooBar(FooBar):
           def my_method(self, *args):
               self.last_my_method_args = args
               return self.result

       class TestFooBar(TestCase):
           def test_my_method(self):
               foobar = FakeFooBar()
               foobar.result = 42
               self.assertEquals(
                   foobar.use_my_method('hello world'), 'forty two')
               self.assertEquals(
                   foobar.last_my_method_args, ['hello world'])

This is more verbose than mocking things out, but the control flow is more obvious and you don't have to rewrite the entire test case every time you change one tiny implementation detail (which is what I've had to do with every mox test I've ever written).

Actually, it's not even that verbose compared to mox :)

<comment><USER15> It does; it's just not very common.

Defining mocks manually is my preferred method. I find things like Phake and Mockery to be a little too opaque and hard to debug when you get subtle problems. I think they also add to the learning curve when getting new devs up to speed.

IMO one reason a lot of PHP devs avoid the manual method of defining mocks is just laziness.

</comment></comment><comment><USER16> When was PHP good in the past? (Honest question; I don't use PHP.)

<comment><AUTHOR> Quite possibly never, but it was arguably the best web language in the early 2000s.

<comment><USER17> Perl fans would probably object strongly to that, but it is true that when PHP first caught on there really weren't any great choices.

<comment><USER18> The strong selling point of PHP for a long time was cheap hosting. Combine that with a fast learning curve and you're set.

Nowadays, it's not so clear cut price wise, but PHP took a strong advance in term of user base - look at the number of libraries, projects, and jobs (!) available in PHP, vs python or ruby.

<comment><USER19> good selling points, but those things never made it a good language, it was just convenient.

<comment><USER18> PHP followed a very uncommon path. Features were added as needed, in an incremental fashion. Nice syntax is never a huge problem, though that's probably most people complaint. That said, it isn't worse than its "contenders" in terms of feature set. You get a decent object system, lambdas (note that they'd been there for a long time, but it's more convenient now), a wide range of bindings. It's not pretty, but it does the job in many cases.

But, anyway, if you're really looking for a good language (something efficient, where you don't have to spend hours to spot a stupid bug), skip the dynamic ones altogether, and go for as much static analysis you can get.

</comment></comment></comment></comment></comment></comment><comment><USER20> Those examples aren't good differentiators between PHPUnit and Phake. And unfortunately, despite how goot Composer it, it just adds another package management system into the mix. GitHub has ended up being the best package manager PHP could really ask for.

I kind of view the native PHP development server as getting featural parity with Rails and Django. But it seems like that's a major gripe for developers who are averse to working with Apache or Nginx for being too complex.

I'm very excited for traits as a feature. This is when we get into real language features other, more prestigious or "hot" web development languages actually have that PHP lacks. These result in true architectural deficiencies requiring annoying hacks to accommodate.

In the end, PHP itself benefits most from expanding its capacities as a logical formalism. Tools are great, but they're also a lot less easier to get right.

</comment><comment><USER21> You shouldn't forget about PSR-0 / <http://www.php-fig.org/>

<comment><USER22> PSR-0 would be great, except for the use of mixed case filenames. The number of packages that have obviously only been tested on HFS+/other case- insensitive filesystems is staggering (or maybe I just have bad luck picking ones). The only logical reason I can see they didn't normalize and lowercase filenames is that the big boys had too much legacy cruft already broken.

</comment></comment><comment><USER23> To all the language bashers, can we all agree that a good developer beats a bad developer in any language?

I wrote a post on this: <http://news.ycombinator.com/item?id=4606961>

</comment><comment><USER24> composer is great, I'd just like to add that the docs make the distinction that it's a dependency manager rather than a package manager.

</comment><comment><USER25> Serious question: Do you know of successful/large web startups in the last two years that used PHP as their main language?

<comment><USER26> I would be interested in the answer to this also, but I am coming from the side of expecting lots probably are.

</comment></comment><comment><USER19> Again?</comment>


Foundbite: Launching and Scaling with Cloudant and Windows Azure - <AUTHOR> https://cloudant.com/blog/foundbite-windows-phone-app-launch-on-cloudant-and-windows-azure/

<comment><USER2> If you need a side by side comparison for MongoDb and Cloudant, you can find it here:

[http://vschart.com/compare/cloudant/vs/mongodb](http://vschart.com/compare/cloudant/vs/mongodb)

</comment><comment><USER3> Here to answer any questions if anyone has any. James

<comment><USER4> You say you evaluated Cloudant and MongoDB, among others. Why did you decide on Cloudant?

<comment><USER3> -Recommendation by the Windows Azure team. -Scalability. -After I got my head around CouchDB in a weekend it was so easy I didn't need to look any further.

</comment></comment></comment><comment><USER5> How does Cloudant compares to Azure Table Storage ?

<comment><USER3> Azure tables is good for storing data much in the same way as a spreadsheet, however when you want to do anything even slightly complicated to index the data it soon becomes hard with table storage and you have to start repeating data. Not ideal. Cloudant makes it very easy to store the data and index it in a myriad of ways without repeating any data.

<comment><USER6> While I agree on limitation of indexes - you get 3 - table name, partition key and row key, you can 'nicely repeat data' by embedding it via serialization.

I ported my db from mongo over to storage tables. I was embedding data, so I didn't have to do two lookups, and when I moved over to storage tables, I wanted the same thing, so simply serialized via protobuf - works a treat.

<comment><USER3> Interesting, certainly clever than the way we were trying it.</comment></comment></comment></comment>