We're pretty happy with SQLite and not urgently interested in a fancier DBMS - <AUTHOR> http://beets.io/blog/sqlite-performance.html <comment><USER2> I never stop being impressed at how often people will jump to odd, unsupportable, conclusions like, "using MySQL will make this thing faster".

I've seen it so many times over the years regarding users and email configurations. I can't count the number of times I've dropped into someone's badly behaving mail configuration and found they had MySQL hosting the users, and explained it was for "performance" reasons. Somehow they didn't grasp that /etc/passwd fits entirely in memory, and the map files Postfix uses for various lookups and stuff are already a database (just one specifically designed for the task at hand) and also fit entirely in memory. Putting that MySQL layer in there is _disastrous_ if performance matters; it is orders of magnitude slower for any case I've seen...still plenty fast for most cases, but it's ridiculous that this idea gets cargo-culted around that if you store your mail users in MySQL your mail server will be faster.

A little knowledge is a dangerous thing, is what I'm trying to say, and people who know MySQL is "fast" may not know enough to know that it's not the right tool for the job in a lot of cases...and is probably _slower_ for many use cases. I'm pretty confident this is one of those cases. SQLite is wicked fast on small data sets, and being smaller means more of it will fit in memory; I can't think of any way MySQL could be a more performant choice for this workload.

Also, I don't even want to try to imagine shipping an installable desktop application for non-technical users that relies on MySQL!

<comment><USER3> So many times I see people handing out a root password to edit /etc/password. Sure, it may be crazy for performance but, even a trivial number of users and aliases are more easily managed with a remote mysql client. Everyone that has used postfix in a production environment knows the pain otherwise, the rest feel free to vote down.

<comment><USER2> There are practically countless ways to delegate management of mailboxes and users without granting root. That's not even a hard problem to solve, and certainly not one that justifies introducing a hugely complex additional variable to the equation.

Anyway, I'm not saying "never use MySQL for mail users" (though, I think the percentage of deployments where it makes sense is closer to none than it is to one), I'm just trying to make the point that MySQL is, in some folks minds, a magical solution to performance problems. Often, it not only introduces needless complexity, it won't even improve performance. It's a classic example of "when all you have is a hammer, everything starts to look like a nail". MySQL is a very fine hammer. It just isn't the right tool for every job.

The article we're talking about is another case where a little knowledge is a dangerous thing. A desktop app serving one user with a _tiny_ data set (as I understand it, we're talking about the metadata for a person's music collection) is exactly the right workload for SQLite. I'd be shocked if a naive port to MySQL were faster (though they acknowledge that there's room for query optimization), and not at all surprised if it were slower. And, I _know_ it'll require more memory and disk space for the same working set.

</comment></comment></comment><comment><USER4> Wow, the article is such a fresh breath of air, primarily because the author demonstrates common sense.

He (they?) picked SQLite for all the correct reasons:

\- best tool for the job for their situation;

\- write-light and read-heavy;

\- zero configuration;

\- easy to embed;

\- understanding that optimizing queries by far gives the best performance in the shortest amount of time.

As an aside, I'm currently using SQLite for Bacula and Postfix, and it's a joy to use; the only drawback I found so far is lack of REGEXP REPLACE in the SQL dialect which the database supports (must be loaded with .load /path/to/lib/libpcre.so, but it is not part of the language). I used the Oracle RDBMS for my PowerDNS deployments, but in retrospect, the way PowerDNS works, SQLite would have been an even better match. All in all, it is great to read that someone picked it for all the correct reasons, rather than some fashion trend, as is often the case in computer industry.

</comment><comment><USER5> Premature optimization is evil, but _preemptive_ optimization is necessary unless you want to paint yourself into a corner. I realized this after implementing a bitcoin full node.

In my bitcoin implementation, as an experiment, I tried storing the blockchain in sqlite, postgres, and leveldb. I gathered up a bunch of data from the first ~200k blocks of the blockchain and benchmarked all three databases. I queried for something like 30,000 utxos out of a set of a couple million. What took 300-400ms in leveldb took 1.6 seconds in postgres (on the repl. in my actual node it would have taken longer due to deserialization of the utxos). What took 1.6 seconds in postgres took over _30 seconds_ in SQlite.

Now, you can tell me I did the benchmarks wrong, and "oh, if you just did this it would be faster!", but 30+ seconds is slower to an absolutely insane level. Needless to say, I went the key-value store route, but I was still astounded at how slow sqlite was once it got a few million records in the database.

I actually like sqlite, but when you know you're going to be dealing with 70gb of data and over 10 million records, preemptive optimization is the key. If I were the author, I would consider switching to postgres if there are over 500k-1m records to be expected. That being said, if they're partial to sqlite, SQLightning ([https://github.com/LMDB/sqlightning](https://github.com/LMDB/sqlightning)) looks pretty interesting (SQLite with an LMDB backend).

edit: To clarify, these weren't particularly scientific benchmarks. This was me timing a very specific query to get an idea of the level of data management I was up against. Don't take my word for it.

<comment><USER6> I've found sqlite's performance on bulk insertions to be massively (100x) improved by wrapping the bulk insertion in a transaction.

fsync()ing a couple hundred thousand individual INSERTs isn't fast.

<comment><USER7> Those optimizations also apply to PostgreSQL.

<comment><USER8> It would still allow you to use a simpler solution and not paint yourself in a corner if you optimized on sqlite; no preemptive optimization necessary wrt choice of dbms if you can perform the work on the simpler solution.

<comment><USER7> Optimizing in SQLite is just as much of a sunk cost as optimizing in PostgreSQL if you switch away to another database.

</comment></comment></comment></comment></comment><comment><USER9> While we're speaking of SQLite; one thing that has little exposure that could probably use more is that it now ships with Windows as a system DLL:

[https://engineering.microsoft.com/2015/10/29/sqlite-in- windo...](https://engineering.microsoft.com/2015/10/29/sqlite-in-windows-10/)

Between that, and packages readily available on most Linux and BSD distros out there (and, in most cases, installed by default), it's well on its way to become a de facto standard system API for relational storage.

<comment><USER10> It's amusing how Microsoft's different departments keep trying to kill off each other. They spent so much time trying to shove SQL Server Express down everyone's throat, and now everyone gets SQLite included instead.

<comment><USER9> SQLite is not a competitor to SQL Express, because the latter is still an out- of-proc server. It is a competitor to SQL CE (which shipped its last release to date in 2011, so...).

The nice thing about SQLite is how little it assumes about the world outside. That made it easy to run in WinRT application sandbox with minimal changes; and for quite a while, it was the only local DB readily available to WinRT code written in C# or C++ (JS got IndexedDB).

</comment></comment></comment><comment> c-smile If to speak about desktop applications then any embedded DB will be unbeatable.

So I am speaking about embeddable DBs here.

Konstantin Knizhnik have implemented impressive set of various embedded DBs: [http://garret.ru/databases.html](http://garret.ru/databases.html)

Like his POST++ has direct mapping to C++ classes so if you use C++ then you don't need any ORM.

In my Sciter[1] Engine I am using his DyBase library [3] as a bult-in persistence for Sciter's script [2] (JavaScript++).

With the DyBase in script you have features similar to MongoDB (noSQL free- form DB) but without any need for ORM and DAL - you can declare some root object as be persistable and access those data trees as if they are JavaScript objects. The engine pumps objects from DB into memory when they are needed:

      var storage = Storage.open(...);
      var dataRoot = storage.root; // all things inside are persitable
      dataRoot.topics = []; // flat persistable list
      dataRoot.topics.push({ foo:1, bar:2 }); // storing object
      /* create indexed collection with string keys, keys can be unique or not */
      dataRoot.titles = storage.createIndex(#string);

DyBase has Python bindings too.

[1] [http://sciter.com](http://sciter.com) \- multiplatform HTML/CSS UI Engine for Desktop and Mobile Application

[2] TIScript - [http://www.codeproject.com/Articles/33662/TIScript- Language-...](http://www.codeproject.com/Articles/33662/TIScript-Language-A- Gentle-Extension-of-JavaScript)

[3] DyBase - [http://www.garret.ru/dybase.html](http://www.garret.ru/dybase.html)

</comment><comment><USER11> I was unfamiliar with this project and assumed it was a hosted service at first. Not so, this is a local application, so an embedded database makes sense.

It took until the very last paragraph for the blog post to make that point.

<comment><USER12> FWIW, I've run SQLite in a few production sites (low 6 figure pageviews per month) and it has worked fantastically. If you understand and work with the limitations, it really is amazing how much you can get out of it.

I'm actually surprised WordPress hasn't ever moved over to it for ease of installation/deployment - WordPress and PHP seem more likely to trip over in most deployments I've seen before SQLite would.

<comment><USER13> What _are_ the limitations? I love SQLite, and have vaguely heard that it has issues with concurrency, but _what_ , exactly? I use it on production for www.tithess.gr and it seems to be working beautifully, no concurrency problems whatsoever there.

What problems should I be expecting in a multi-access scenario? I've never had that question answered adequately.

<comment><USER14> You cannot have multiple writers to a SQLite database. Only a single file descriptor may be open with 'write' access. As long as you can get the performance you need out of a single writer, then you're good!

<comment><USER15> Clarification: You can have multiple connections (aka file descriptors) open on the same database file for writing at the same time. But only one can be actively writing at a time. SQLite uses file locking to serialize writes. Multiple writers can exist concurrently, they merely have to take turns writing.

</comment></comment></comment></comment></comment><comment><USER16> SQLite also does remarkably well with recovering from all manner of power loss / crashes / worst case scenarios. We created a "power loss" rig just to test this facility for one particular system. Really SQLite's biggest weakness is concurrency, and if your app needs that in any serious amount you probably ought to look elsewhere. If you're just dealing with occasional concurrency though SQLite shouldn't be dismissed out-of-hand.

<comment><USER17> The breadth and depth to which SQLite is tested[0] is both admirable and inspiring.

It's not just "internal" tests, like unit tests or things that can be run from client C programs, but tests of all kinds of hard-to-simulate external situations like out-of-memory and power failure situations.

[0]: [https://www.sqlite.org/testing.html](https://www.sqlite.org/testing.html)

<comment><USER18> That is simply amazing write-up. I'd still not call it a high-assurance system given some things missing. Yet, the amount of rigor in the testing phase could easily be the baseline for that niche in that it exceeds about anything I've seen. There's basically so little I could suggest on code or testing side that I'm not going to even bother here given how marginal it would be due to effort already put in. Just too well-done for mere speculations.

I also noted that the assert section essentially does Design-by-Contract. This is a subset of formal specification that's prime value is in preventing interface errors (vast majority in big apps) and supporting formal verification. Done in design/spec phase in high-assurance since both Edsger Dijkstra and Margaret Hamilton independently discovered technique's value. Done at language-level since Eiffel due to Bertrand Meyer. Good to see that, even if not all techniques, they're doing the 80/20 rule to get most benefit out of what formal specs they're using. Also allow you to easily enable run- time checks if you can accept performance hit. Nice.

</comment></comment></comment><comment><USER19> Classic HN bait.

You don't even need to read the comments to know what people will say:

"SQLite is a great fit for this type of application. It's a replacement for fopen people. fopen."

"What about ALTER TABLE?"

"It's just a toy database, it doesn't even support concurrent writers"

\----- "WAL mode"

"Hey, golang, rqlite"

\----- "Whoa I wrote something similar for a ..."

\----- "Why would you use this? Just use postgres"

"SQLite is the best database ever"

"SQLite is the worst database ever"

</comment><comment><USER20> For any database that isn't huge, a library embedded into your application is going to be faster than anything that has to communicate with a server over a socket connection. Though both execute SQL queries, SQLite is completely different than relational database servers and appropriate many places where running a full RDBMS is not. For example, you can't run MySQL or Postgres on the iPhone, but you can use SQLite.

<comment><USER21> I've found SQLite absolutely amazing for getting the power of SQL for R data frames.

<comment><USER9> Could you expand on some of your use cases? An R data frame, by definition, has to fit into memory, so it would seem that any sort of map/filter/group/fold operation would be fastest if performed in-memory, as well. And I assumed that e.g. joining data frames (where you would run out of memory really quickly if your datasets are large to begin with) would be uncommon... am I wrong?

<comment><USER22> Depends on what you mean by uncommon.

I for example often need to score/model data which doesn't fit in RAM (on my PC) so I use libraries like bigGLM which can use out-of-memory data to build the models. One of the options is SQLite, but you can use an ODBC connection.

Additionally, I can explore slices of the data, which resides only on disk. I don't even need to import it. I can use dplyr (very famous package for aggregations and slicing) which will map the R syntax to SQL which is executed by SQLite.

</comment></comment></comment></comment><comment><USER23> > we're read-heavy and write-light

> we have almost no indices, no principled denormalization

Sounds like an easy win. People are probably suggesting a database switch because they're finding issues with the current speed, but they're not using their current database to its full potential yet.

<comment><USER10> Is the bottleneck even the database in the first place? From the article, that doesn't seem to be the case:

> The main case when beets writes to its database is on import, and import > performance is dominated by I/O to the network and to music files.

Small file I/O is universally slow, even on SSDs, and if you're hitting rate- limited MusicBrainz servers for each file, database performance is almost irrelevant.

<comment><USER24> lots of people use beets to query their music to build playlists. those cases don't require network access.

</comment></comment></comment><comment><USER25> Sqlite is fine for small scale systems. It is not a "web scale" database, but not every web site is "web scale." SQLite does have performance limits, and will break at certain load, but until that, it's okay. For single user databases, like desktop applications, SQLite is awesome! What the others bring to the table is concurrent sever performanc, user management, and such. There's nothing surprising about this, right?

</comment><comment><USER26> I'm a long time user and lover of SQLite, since way back when. Use it in a lot of our projects (web and Win32) that require local databases for logging etc.

Sure for larger or concurrent user access to a db, we use other databases, but nothing beats the 'zero footprint' install of SQLite. I even enjoyed the fact that earlier versions of SQLite forced me to think optimise my queries due to the lack of nested SELECTs.

SQLite still kind of reminds me of my early days in MySQL. I was recently trying to downgrade MySQL 5.7 to 5.6 after a slew of issues, which forced me to reminisce about how simple things used to be when MySQL was a lot like SQLite still is now...

<comment><USER27> I find that Firebird has been pretty nice as well, with the option to move from embedded to server.

<comment><USER28> And much overlooked. It doesn't get half the love it deserves. While it could do with some work around making the sysadmin experience a bit better and have a way of aliasing short 'public' database names to the file-system level database, it's quite a good RDBMS.

<comment><USER27> About a decade ago, I wrote a system of intermittently connected systems that would run independently and sync up to a central db, all using firebird (uuid custom type) and a few utilities that ran via C# (mono under suse). It worked surprisingly well for the purpose it was designed.

Firebird was definitely nice in terms of being able to utilize the same db from the local systems (embedded) to the centralized server (service mode). As you say, it could use some love, but some of that could be done via symlink and/or consistent structure (/var/firebird/db/*). I haven't even looked at it in a while, wonder how hard it would be to use with electron/node, may have to look.

</comment></comment></comment></comment><comment><USER29> Beet is an awesome program, you should really check it out if you still are among the minority of people who actually have a music collection and don't rent access from spotify/itunes/etc.

I'm glad to see this post; one of the reasons that I like beet so much is that everything is self-contained.

</comment><comment><USER30> You're doing it right for your application! MySQL or PostgreSQL would most probably be slower and introduce a lot more overhead as they are client/server oriented systems. Don't listen to those armchair architects!

</comment><comment><USER31> I don't get the point of this article. SQLite is fine, especially in an embedded database, but once you have concurrent access, it starts to suffer because it has very coarse grained locks, so a "real" database is better for a distributed single-DB design. It's more about using the right tool for the job, and the author seems to be talking himself out of some kind of guilt for SQLite being the right tool for him.

<comment><USER32> I think you're misreading the post. They're just trying to explain why sqlite _is_ the right tool for their particular job, so they don't have to keep explaining it to other people who keep trying to shoehorn in the wrong tool. Lack of concurrency in their app is specifically mentioned as a reason sqlite is appropriate. There's no guilt there.

<comment><AUTHOR> Yep! This suggestion comes up shockingly often, and I got tired of re- explaining my reasoning every time.

</comment></comment></comment><comment><USER33> I can't blame them. I've been a huge fan of SQLite for years. Anytime I need storage it's my default choice unless there is a specific reason to use something else.

Another nice advantage of it is if you are distributing something that requires a small dataset[0][1]. If I give you both the code and the data already imported into a sqlite database, then you can use the code right away, or you can dump the data to a different database very easily.

[0] [https://github.com/jedberg/wordgen](https://github.com/jedberg/wordgen)

[1] [https://github.com/jedberg/Postcodes](https://github.com/jedberg/Postcodes)

</comment><comment><USER34> What people actually seriously suggest that a desktop application needs more than sqlite offers in the way of databases?

Desktop apps are like the sweet spot for sqlite. It's practically made for them.

</comment><comment><USER35> Suggesting you add a server dependancy to your desktop app as a solution to a problem that isn't there is pretty braindead.

</comment><comment><USER36> I have used SQLite for similar use cases, but occasionally it's led to a corrupted db. I had a cron task writing to it once a day, but an issue with the scheduler led to 2 tasks one day with the latter one finishing before the former.

Of course I can add locking or something in my code, but I'd prefer to handle at a lower level — for example, have SQLite take the latest write without corrupting. I'm hoping someone has solved this problem with SQLite elegantly.

<comment><USER37> SQLite is supposed to handle multiple concurrent writes by returning SQLITE_BUSY. I'm imagining hypothetical other causes for your corruption problem, like power loss at a bad moment.

<comment><USER38> SQLite is designed to handle power loss at bad moments (indeed, anything that calls itself a "database" ought to be resilient against power failure).

Relevant: [https://www.sqlite.org/howtocorrupt.html](https://www.sqlite.org/howtocorrupt.html)

<comment><USER37> The article you linked has an interesting line: "Unfortunately, most consumer- grade mass storage devices lie about syncing." That's the kind of problem I was talking about.

</comment></comment></comment></comment><comment><USER39> I didn't know beet, but it looks exactly like what I've been wanting for years.

</comment><comment><USER40> Even a file can be convenient. It's all about how you integrate it into the system.

</comment><comment><USER41> Some people are unfamiliar with the phrase "right tool for the job".

As the developers behind the project, I'd have to think the authors are in the best position to make the determination about which tool is appropriate.

<comment><USER42> "right tool for the job" ends up being almost meaningless unless the players involved have enough experience with multiple tools to make a useful judgement. Too often "right tool" is "whatever I've already used before". :/

<comment><USER41> That is true. I failed to adjust my perspective for the fact that not everyone has nearly thirty years of programming experience given I still consider myself an amateur.

Still we should recall the utility gained in using the right tool is finite and variable. In some cases can be like night and day while in other cases a moderate or negligble improvement might be all you see. Under some circumstances familiarity with a given tool may outweigh the advantages of using a better suited tool - especially if a team lacks well-rounded expertise.

Reinforcing the other side of the argument is the fact that programmers are often subject to constraints placed on them from on high that restrict the choices they might make in such.

Given the specific situation, the author seems to build a pretty good case for SQLite at least by my own limited understanding of the facts.

<comment><USER42> The "constraints" part is def something to remember. I've done a lot of short term consulting or training over the years, and I'll come in to a new team and see what they're doing. The "right tool" line is often used to justify something, and it's often either because it's the only thing person X knew, but often the 'right tool' might take an extra several weeks to get the team up to speed on. It's definitely the 'right' tool, but they're denied that decision.

My reaction to "right tool" was less about this particular article (and I agree with you) as it was to the phrase in general. I've seen it used to justify just about any tech decision ever made.

The other reality is... if you're a C# shop, with a team of 15 C#/.NET devs, the 'right tools', if there's any deadline at all, will probably involve Windows, C# and .NET tools, even if they are demonstrably inferior to, say, a Linux-based stack. Deadlines, existing code and budgets _do_ play a role in decision making, further confounding the usefulness of the "right tool" rule.

</comment></comment></comment></comment><comment><USER43> For everyone loving SQLite, you should consider donating to them. I remember a post this last year about the maintainers working on it full time, but making much less than most of us probably do.

</comment><comment><USER44> I wish HTML5 storage standardized on Sqlite. The inconsistent story on HTML5 storage across browsers is kind of sad.

<comment> c-smile I participated in HTML5 specification work group at W3C as Invited Expert. We had such a proposal to add SQL storage to HTML5. But it was pretty much unanimous opinion that adding specification of any SQL flavor to the _HTML_ spec would be too much.

<comment><USER11> Yeah, basically it would've had to specify all of SQL, or to say "do what SQLite does", and neither option was very palatable to all the parties. Some browsers [1] did implement WebSQL before it was formally abandoned, though.

[1] [http://caniuse.com/#feat=sql-storage](http://caniuse.com/#feat=sql- storage)

<comment> c-smile Some browsers _can_ use Open Source libraries, some simply cannot , for whatever reasons. Yet formally we need at least two independent implementations of the same thing in order the spec to get Recommendation status.

So each UA (a.k.a. browser) has to implement any SQL spec from scratch adding its own SQL flavor.

In fact I am pretty sure that it is possible to add some basic SQL features by JS on top of IndexedDB. It should be such things already I think.

</comment></comment></comment></comment><comment><USER45> SQLite is Ok, but write access must be synchronized. I used it for my Flask (Python) application and was forced to switch to PostgreSQL because of synchronization problems. I would prefer sticking with SQLite which was simpler to manage.

The author doesn't say a word about synchronization when writing to SQLite.

<comment><USER28> It's intended for desktop, single-user use from the command line. In such cases, you're not going to have much of an issue with write contention.

<comment><USER45> Then SQLite is obviously a better solution than MySQL and PostgreSQL.

</comment></comment></comment><comment><USER46> The bigger news here is they arent using an ORM to make moving between databases trivial.

</comment><comment><USER47> Firefox uses SQLite

</comment><comment><USER19> I have written several "Use Sqlite!" posts that have made the rounds on hackernews... reading this watered down post, which is devoid of any new, surprising or usable info, it strikes me that repping SQLite has achieved meme status.

If you want tangible info you can actually use, read sqlites documentation. There's a wealth of information there.

Here are some of posts, for the Python crowd:

[http://charlesleifer.com/blog/five-reasons-you-should-use- sq...](http://charlesleifer.com/blog/five-reasons-you-should-use-sqlite- in-2016/)

[http://charlesleifer.com/blog/using-the-sqlite-json1-and- fts...](http://charlesleifer.com/blog/using-the-sqlite-json1-and- fts5-extensions-with-python/)

[http://charlesleifer.com/blog/my-list-of-python-and- sqlite-r...](http://charlesleifer.com/blog/my-list-of-python-and-sqlite- resources/)</comment>


Creating a ZigBee Chain Reaction - <AUTHOR> https://eprint.iacr.org/2016/1047 <comment><USER3> Security is expensive for vendors to implement, so they externalize the risks to their customers and society in general. To reverse this dynamic, "insecure by default" needs to be more expensive than "secure by default".

It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech, and rather simply make the vendors legally liable for damages and let the market evolve effective standards and practices.

However, constructing effective legislation/regulation for doing so is a non- trivial legal challenge. Simply proving when the vendor is liable vs a user could get tricky, as well as estimating damages and divying them up among multiple vendors if damages involved products from multiple vendors. Among other things.

Anyone, especially lawyers, have insight on best way to fix this problem?

<comment><USER4> > It seems simplest for the Govt to avoid trying to mandate detailed security > standards for continuously changing tech

Govs can do a lot of broad legislation rules that is non-specific.

The software industry requires a legislative bitch slap like the auto industry received. These rules would wreak havoc on the industry but if you ask me for the better.

\- Are you running unpatched software exposed to the internet for which CVE patches exist? Pay a fine every day until you do so.

\- Ban IoT devices that do not have automatic signed software updates over encrypted channels (which would probably ban all current IoT devices).

\- Ban all IoT devices without crypto capabilities. Must have a hardware RNG and a set of standard crypto algorithms.

\- Does an IoT maker have a CVE and has not patched all their devices in X amount of time? Daily fine.

\- Are you a vendor who has not patched a CVE for your software after X amount of time? Pay a fine every day until you do so.

<comment><USER5> Cars kill people. At worst current IoT let a pirate control your light bulbs, see your heart beat or record your sleep patterns, waste your food and listen to your music.

This won't interest anyone.

For this to start seriously motivating people, you'll need:

\- even more numerous DDOS, with more expensive consequences. Companies are affected so they act.

\- scandals with naked people, preferably famous ones or underage, or both. People that gets the medias talking.

\- money stolen. A lot, to bother insurances.

\- people dying. Scaring the public always work. E.G: fire started by pirated IoT device.

Otherwise nobody is gona bat an eye.

We don't live in a world were most companies do the right thing because it's the right right. Remember that tobacco companies use to run ads to show you how cool your life is with cigarettes while lobbying the congress to state how non dangerous for health it was. Remember that people are putting their entire life on systems with text analysis, geolocation and face recognition and they don't see the big deal out of it. Remember that the government spies on every citizen, considers it perfectly acceptable, and that the citizen let it to.

So really, the fact that your connected fridge has an open telnet port is not going to move anyone.

You need damage done to get a reaction. Not potential damage.

<comment><USER6> > Cars kill people. At worst current IoT let a pirate control your light > bulbs, see your heart beat or record your sleep patterns, waste your food > and listen to your music.

Once you're home network is compromised it's much easier to infect other computers on it, a lot of IT people don't even run firewalls on PC's anymore. We largely rely on a single line of defense for home cyber security.

A compromised device becomes a launch pad for a bunch of other attacks, like data collection and credit card theft. Imagine how many pedophile rings would love to remotely watch kids using a built in webcam? All without the family ever knowing.

Or you could simply use them to stream illegal torrents.

<comment><USER5> I said "Cars kill people", not "cars could kill people".

You are talking about potential. People don't care about that.

Potential that I mentioned by the way, with "scandals with naked people, preferably famous ones or underage, or both."

They will care only once pedophiles will have watched THEIR kids using their web cam. Repeatedly. With media coverage.

Not before.

<comment><USER4> > You are talking about potential. People don't care about that.

What people care about is irrelevant. What should be legislated for the better of all is another matter. Car safety laws were unpopular with a lot of regular people as well.

<comment><USER5> That's fair but it was because dead people cost money.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Security should be embedded in the IoT frameworks and should be easy for it to become the standard practice.

But most IoT stuff are hacked on, rarely using anything standard, and even when there is a framework involved, it seldom has security as a main feature.

Even when it does, it's still a lot of work. Take crossbar.io, which is my go to tool to communicate within a IoT context (or anything soft real time really). To secure it you need to:

\- setup the TLS certificate. Default communication transport is over unencrypted websocket.

\- configure the provided authentication service (and write a backend for your system).

\- declare several realms to isolate the clients, and configure the permissions accordingly (default permissions are YOLO, to ease the "hello world", which I understand). Make sure you don't expose important RPC to the wrong clients or allow anybody to declare callbacks.

\- manually code the procedure to use their hot reload system to swap code updates. It's made for local updates, not remote ones.

\- be very careful when updating your clients. Crossbar routed RPC is transparent and it's tempting to replace a call from JS to Python to a call from JS to Postgres to remove a layer of indirection. But do you make proper permissions checks in your SQL ? Are you sure you don't expose too much ?

So basically, you can make it secure. But only if you know what you're doing and don't have a deadline tomorrow.

<comment><USER7> > Security should be embedded in the IoT frameworks and should be easy for it > to become the standard practice.

To be fair, almost all of the security libraries suck. The only thing which is _SMALL_ and solid is DJB's TweetNaCl ([http://tweetnacl.cr.yp.to/](http://tweetnacl.cr.yp.to/))

If I'm running on a Nordic nRF51 series, for example, things like SSL/TLS are a _HUGE_ chunk of my RAM, ROM, battery, and time budgets. This exploit is a good example. Even if you wanted to use something like a public/private key system, it's not clear that the the Atmel SoC could handle it.

In addition, there are still gaps in security libraries that we need. We don't have a good PAKE (password authenticated key exchange) library, for example. HomeKit standardized on SRP with a 3072-bit key, and then discovered that it was too heavyweight and slow for devices working with a lithium coin cell battery. Even Microsoft with AllJoyn had to deprecate SRP and switch to a non- standardized elliptic curve key exchange to better match tiny hardware.

The crypto folks are falling down on the job here. These things aren't standardized, and they don't seem to have been beaten on very hard. And they certainly haven't been tested on small hardware very much.

Everybody can bitch about security, but until someone figures out the tools required for these small systems, it's going to remain the wild west.

<comment><USER5> Well you said it.

There is a reason IoT is not secured. It's hard to make thousands of connected devices with little system resource but connected on foreign networks in heterogeneous context secure.

<comment><USER8> Then simply do not connect thousands of such devices if you can't handle it…

<comment><USER5> Yeah. And to avoid theft, simply don't acquire things that are not yours.

<comment><USER9> A better comparison would be: to avoid theft, don't build your house out of toothpicks that can't support a deadbolt door.

<comment><USER7> And yet we built houses out of such materials for thousands of years.

Security has 2 problems--technical and social.

The technical problem will eventually get solved as transistors are almost free. We are integrating hardware accelerators into almost everything since transistors are so cheap.

The social problem isn't so easy. Companies don't give a crap about security. Only when companies start losing 25% of their stock price after a breach will they care.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> While reading this, I went looking for the ZLL master key. What surprises me is that it got DMCA'd everywhere, including Hacker News:

[https://news.ycombinator.com/item?id=9249841](https://news.ycombinator.com/item?id=9249841)

And there was really no outrage about it. Very strange.

<comment><USER11> It's amazing how 16 bytes of data can be under copyright.

Not arguing, just pointing out how there can be a DMCA request for something so small, citing copyright laws.

Reminds me of the AACS controversy when people starting printing keys of t-shirts, and illegal numbers were born.

<comment><USER12> John Cage's 4'33" is silence that is under copyright, and has been the subject of legal controversy.

[http://edition.cnn.com/2002/SHOWBIZ/Music/09/23/uk.silence/](http://edition.cnn.com/2002/SHOWBIZ/Music/09/23/uk.silence/)

<comment><USER13> Differnt issue.

4'33 is a recording of the audience, not silence. I studied it in a music class in school.

Cage's estate's infringement claim on "silence" was not upheld by a court.

The defendant on that suit put Cage's name on the album as a songwriter, of his own accord.

</comment></comment></comment></comment><comment><USER14> I don't work in the IoT department but they use our chips and I can guarantee you that if you make security a legal requirement my company will not hire more engineers, they will hire more lawyers.

<comment><USER15> OK, but then lawyers will say to hire more engineers.

<comment><USER14> I genuinely can't tell if you're joking.

In case you're serious:

No, they will work on some legal dodge to avoid the liability. The company does not see it as a technical problem.

<comment><USER15> OK, I was joking, a little.

If the regulations are crafted properly, legal dodges won't make the nut. Firms that go that route will fail.

</comment></comment></comment></comment><comment><USER16> previous discussion was here: [https://news.ycombinator.com/item?id=12893793](https://news.ycombinator.com/item?id=12893793)

Though the report does say it was recently updated, unsure what the diff was.

<comment><USER17> Yea.. Is there a good way to find the diff? Only if research papers were published on git :P

</comment></comment><comment><USER18> ZigBee / Z-Wave are just getting started in their WEP everything stage. Most of the installed base is unencrypted. It will take many more years until they are at WPA2 levels of robustness.

</comment><comment><USER15> Wow. That's awesome. The first WiFi worm, I think.

Think of the art that's possible with this. You could create city-scale images. Maybe larger, in high-density areas.

</comment><comment><USER19> IoT is a bad vision for the future. 20 years from now I don't want a million devices in my home running software. Either they'll all constantly be pestering me with updates that break functionality I rely on, or they'll be out of date with bugs and security holes that last forever.

My vision of a good future is one where I have exactly one smart device: a robot butler which will operate all my other devices. I don't need a smart lock if the butler unlocks the door for me. I don't need a security webcam if the butler monitors the house while I'm away. I don't need a smart thermostat if the butler sets it for me. Etc.

<comment><USER20> Meh, I'm much more interested in a future where all my devices aren't "smart" but they all include an API contract regulated by an org akin to UL or FCC backed by legislation providing legal remedies to security and usability deficiencies. It's not about _if_ legal regulation will come to software but _when_, and the further in front of it hackers are, the better the future can be.

</comment></comment><comment><USER21> I don't know why, but I kind of want to see a truly gargantuan IoT debacle unfold at this point.

Something beyond stupid, and completely preventable, and all the more horrendous, because at this point, it can only be funny.

I want to see something like a TV commercial accidentally trigger a home automation system, which corrupts the operation of a class of light switches, which cascades onto smart microwave ovens, which transmit kill signals to self-driving cars which synchronize with flying cars at which point they all swarm the nearest hospitals and explode, demolishing trillions of dollars of health care, and imploding society because of failed credit default swaps on all of the health care insurance (even obamacare), which then causes automated trading platforms to sell, killing off everyone's 401K's, destroying the retirement plans of all survivors, such that the living envy the dead.

Can we make that happen?

IoT is retarded.

<comment><USER22> Hyperbole, or just wanting to watch the world burn, aside, why is IoT, as an idea, retarded? It seems to me that having the underlying platform for secured communication to semi-smart technology is good. If my house could intelligently govern itself within a set of parameters I define that fit my life, I bet I could save a few bucks a month on power, not have as much food, and help the environment in my own little way.

I do see the idea of IoT with no security and no long term commitment to the products as actually, technically retarding (we'd be worse than we are no for the reason you enumerated). Could you make an argument for your last statement as to why a good implementation of IoT is bad?

<comment><USER23> > why is IoT, as an idea, retarded?

The usual complaints about IoT as an excuse for surveillance capitalism aside, the key problem with IoT in _most_ products is the (currently obscured) costs do not outweigh the (often novelty) benefits. By benefits I mean actual, significant time or effort savings that need to outweigh the large risks inherent to anything IoT.

> underlying platform for secured communication

That illustrates a big part of the problem. There is no such think as a "secure platform", because "Security is a process, not a product."[1]

The internet is and will always be an incredibly hostile place. If you plan on internetworking on the shared global network _or_ anything that connects to it in any way, you need to plan on a way to maintain vigilance over the devices you created or are responsible for. This means continuous work into the future[2].

> I bet I could [...beneficial outcomes...]

You're only listing the positive side. To judge IoT properly also need to enumerate the _known problems_ and _possible risks_. A few examples of the risk that most IoT devices bring are:

* The other end of the supposed "secure communication" being compromised by governments, criminals, disgruntled workers, etc.

* Bugs (everything has bugs) allowing assholes of the "swatting" persuasion messing with your power, food, _etc_ "for the LULZ".

* All that data being logged - even when stored locally - becoming the target for discovery in a trial (maybe involving you, maybe not).

* The manufacturer of your IoT device selling data to your insurance company, or you insurance company requiring that data from you directly (e.g. fitbit data for "cheaper" insurance that now has more ways to deny you coverage).

That's just some obvious examples. The real problem is that after data is collected it tends to be permanent. Nobody has thought of the _big_ risks of plugging your devices into a hostile network. You see the _potential_ benefits of IoT devices, but you also need to consider what some black hat (or script kiddie) will do with all of those devices - and the data they collect - in 10+ years with a clever new exploit.

[1] [https://www.schneier.com/essays/archives/2000/04/the_process...](https://www.schneier.com/essays/archives/2000/04/the_process_of_secur.html)

[2] It might be possible to limit this with products that have a limited lifespan and are guaranteed leave the network.

<comment><USER22> All the things you listed are things to be planned for. None of them are extremely terrible in and off themselves with the proper vigilance. Even the data logging should be solvable with reasonable laws.

Apply the general argument to personal computers. Anyone can attack your PC. Once pawned, they can get valuable information. Your IP could be wrongfully associated to a crime, which brings Jonny Law to your door. Given all of this, I still assume you see the idea of being connected via a PC as a good thing since you wrote a response via a browser.

My question was essentially, why dismiss something whole cloth? You raise valid things to consider, but I don't think that anyone of them is a death stroke to IoT. They are, at least in my opinion, design considerations for products that make sense.

<comment><USER23> > proper vigilance

You seriously expect the average person to have anything close to "proper vigilance" with a collection of IoT devices?

> reasonable laws

I'd absolutely _love_ to see strong data protection laws passed, but that isn't likely in the near-ish future. Also, laws don't protect against bugs.

> All the things you listed are things to be planned for.

The worst problem in a new, _unexplored_ area are the unknown/unexpected problems. You believe these data risks are minor - I strongly disagree - <USER2> how can you even begin to make that kind of judgment? Data persists and CVEs increase with time; how can you be certain that your data (which includes access credentials, e.g. ssl keys/certs, passwords) won't be stolen off some server (or your home devices) 20 years from now?

These are huge, unknown, open-ended risks that could suddenly become a problem at any point in the future.

> personal computers

The PC isn't tied to sensors around the house, with the ability to control various important hardware. The thermostat (nest) is an obvious example: it _should_ be a trivial device, because simplicity is one of the better ways to guarantee reliability. Adding massive complexity and network access left a lot of people with a freezing house[1]. My PC isn't tied to important thing like the thermostat, because adding risk for effectively a nerd toy, social status symbol, and (allegedly) minor heating-bill benefits isn't a good trade-off, and it's terrible security.

The PC _is_ a risk, but it can also serve as a place to _contain_ the risk of being connected to a hostile network.

> why dismiss something whole cloth

I'm not: "...the key problem with IoT in _most_ products is the ... costs do not outweigh the ... benefits."

Internet connectivity can work if the benefits sufficiently outweigh the cost of having to actually secure the device _and_ remain vigilant and responsive to new security issues for the lifetime of the device. This is expensive, and approximately nobody is doing that right now. I also find it hard to believe that anything remotely similar to the current IoT _toys_ on the market can ever be profitable enough to pay for their own security. There may be exceptions, of course, but they will be expensive (in some way) and rare.

[1] [https://www.nytimes.com/2016/01/14/fashion/nest- thermostat-g...](https://www.nytimes.com/2016/01/14/fashion/nest-thermostat- glitch-battery-dies-software-freeze.html)

</comment></comment></comment></comment></comment><comment><USER24> A lot of people are calling for government action against IoT. Think twice, people. You are undermining your own profession (and I don't just mean IoT, I mean software engineering in general). The laws the state will come up with will not be great, they never are, and they will stifle innovation. The internet is pretty darn stable, I don't think we need good old state to tell us how to write software, we will fix our problems ourselves as we have in the past.

<comment><USER25> What do you think about IoT devices with powerful motors that are able to kill people?

Or conversely, what do you think about current regulations regarding cars and aircraft?</comment></comment>


Ira Glass on Storytelling (applicable to anyone who "makes stuff") - <AUTHOR> http://www.vimeo.com/24715531

<comment><USER2> This 2 minute chat just rocked my world :)</comment>


Ask HN: Pimp my startup idea - <AUTHOR>

I'm really interested in the CGM (consumer generated media) space, and I'd love to get some feedback on what the market's like.
My idea is to take something like WordPress, modify it with CGM features (voting, user submitted pictures, videos, comments embedded in media, user profiles, karma system, etc) and market it as a SaaS to mid to large sized businesses. Sort of like how Yammer works, but for businesses that want to implement interactive features features in the most efficient manner.
I could also implement a simple shopping cart system and payment gateways for PayPal, Authorize.net, etc as well. A lot of my inspiration comes from Danny Choo and his Mirai Gaia product in Japan. But that's licensed software. <comment><USER2> What the fuck does all this marketing speak mean?

EDIT: And why would businesses want it?

<comment><AUTHOR> I didn't think it was that bad. :(

Social network in a box. Ning would be a competitor.

<comment><USER2> It was pretty awful.

You want to build a Ning for businesses? Since you don't sound like an engineer, here's what I would suggest you do.

Pay a designer 500$ for mockups, then go sell it to 10 businesses at $10k a pop, and if you can get contracts signed, build the product with that cash.

Your description above sounds out of focus, start with one thing, do one thing and do it really well.

If you are an engineer, build a prototype - what are you waiting for?

</comment></comment></comment><comment><USER3> A little off topic, but in the 7 days since you created this account, you've asked three questions on this topic. You've commented on them, and that's your entire history here.

I'm all for Ask HN, but please just hang out here a bit. Contribute with some comments. Provide unique insight. Don't just tap into the great resources here - become a part of them.</comment>


Corona SDK in now free - <AUTHOR> http://coronalabs.com/products/corona-sdk/

<comment><USER2> has anyone tried corona? looking for some first hand feedback..

<comment><USER3> I have used it for a few years for hobbyist game development on Android and iOS. It's easy to use, especially if you like lua, quick to develop in (auto- refreshing), and runs fast enough. If your game/app is 2D and is mostly placing sprites on the screen that react to touches, then it's great. It's not good for 3D (obviously) or complex apps that need access to low-level graphics.</comment></comment>


Ask HN: Given that SOPA or a similar legislation passes, would you leave the US? - <AUTHOR>

I live in Europe and when I was in school we learned about the "American job mobility" as a driving factor for the economical success of the US.
I understand this applies to mobility within the US but it does indicate a certain mindset.
Given the scenario that

  - a bill like SOPA passes

  - it is being enforced, creates a controlled internet and thus substantially threatens your business model as well as free speech.

  - the current status quo (or "better") of the internet is being maintained in most of the world.
 Would you leave the US?

  - If not, how would you adapt?

  - If yes, where would you go and why?
 <comment><USER4> I was already planning on leaving the US for similar reasons, and SOPA isn't doing the US's case any favors. The fact of the matter is that the US can no longer claim it holds a monopoly on a first-world quality of life the way it could in the past. The US hasn't taken itself seriously as a country for a while, and I don't see any reason to stick around and subject my family to whatever comes down the pipeline.

I'm planning to head to Australia for a number of reasons, some personal, some political. I've decided to effectively vote with my feet. I'm an intelligent, successful person and I see no reason to put up with a government that seems to take me for granted while it can't even do its most basic job. The world is getting smaller every day, and things like Skype mean that a move like this doesn't entail cutting all ties with family in the way it used to. Why put up with a country that acts like it doesn't want you?

<comment><USER5> Is there a specific timeframe where you think the US had that monopoly?

<comment><USER4> Post-WW2 comes to mind immediately, largely because the rest of the world was either in the grips of colonialism or trying to rebuild after the war.

</comment></comment></comment><comment><USER6> Interesting question.

As I've been reading the developments of the SOPA legislation, the very thought occurred to me of what would happen if it passes, and whether I would consider leaving in the near or long term.

The problem is that once it gets to the point where it makes sense for intelligent people to think about leaving, it will become very difficult to do so. The trick is to leave before it gets really bad-- but how to know when that is.

And then there is the question of where can we go?

Canada is the first thought, but it's not easy to emigrate there from what I understand. And Europe? Without an EU passport forget, about it unless you have very exceptional skills.

I lived in Japan for some years and would also consider there or another East Asian country, but even for those who know Japanese, for example, it is not easy to secure employment except in very specific industries.

I'm curious to hear what others have to say about this question.

<comment><USER7> It made sense for intelligent people to leave the U.S. since 2003 (when I moved my family of 5 to Vienna Austria), so it's already too late (not so easy to renounce US Citizenship now, new draconian financial reporting laws for expats and new laws which prevent taking assets out of the country kick in 2013).

In 2013 I will renounce my US Citizenship to gain Austrian Citizenship. I have thought long and hard about this. I am proud of the principles the US was founded on, which are trampled on each and every day in Congress, by the President, and in the Supreme Court. I am proud of those who sacrificed for the good of our country, who sacrificed to preserve those rights and to bestow them on me upon my birth. Those sacrifices are dishonored and spit upon daily by our politicians, and their kleptocrat corporate owners.

I will always love the United States, and the majority of it's honorable, kind, and caring people. However I have no love of this totalitarian nightmare which is our government.

Our government is illegitimate, despicable, and dishonorable.

"But when a long train of abuses and usurpations, pursuing invariably the same object, evinces a design to reduce them under absolute despotism, it is their right, it is their duty to throw off such government and provide new guards for their future security."

People don't talk that way anymore.

Beautiful, huh?

\- No idea what you said. - It means, if there's something wrong, those who have the ability to take action have the responsibility to take action. "

National Treasure - <USER2>

"Because you are the president of USA, sir. Whether it is to your character ... Of the oath that you have taken To the Constitution to protect. Of the weight of history That rests on your shoulders. I believe you Are an honorable man, sir.

Gates, that sort of thing People do not believe anymore.

They want to believe in it."

National Treasure Book of Secrets - <USER3>

Getting a VISA in Austria is straightforward, and Vienna is the best city in the world for quality of life (Mercer 2010, 2011).

[http://www.migration.gv.at/en/types-of- immigration/permanent...](http://www.migration.gv.at/en/types-of- immigration/permanent-immigration-red-white-red-card.html)

</comment></comment><comment><USER8> If I had the resources, yes.(I'd either go to Norway or Australia, I'm not sure which) Unfortunately, I can't afford to leave the city I live in now, let alone the entire country.</comment>


Tell HN: Early-bird registration closes for the MathsJam - <AUTHOR>

A few people have been kind enough to ask, so I thought I'd post this.  The MathsJam event I'm running in November (6 weeks to go!) has now closed early-bird registration.  We have 54 full delegates, 4 day delegates, and 5 non-delegates.  We have reached roughly half capacity already.<p>It looks like it will be easier to run the event than to give the money back ... <comment><AUTHOR> Ferengi rule of acquisition number 1: Once you have their money ... never give it back.

Clickable: <http://www.mathsjam.com></comment>


Handling Unused CSS in SASS to Improve Performance – Smashing Magazine - <AUTHOR> https://www.smashingmagazine.com/2019/08/handling-unused-css-sass-performance/ <comment><USER2> BEM and other OOCSS metodologies are a waster of resources and time to load, render and paint a website. No matter how good you are on Sass or how many Gulp tasks you add to your workflow: over the time, you will get 99% unused styles for most of the important pages in your website, depending how big your project goes.

The solution to this dilema (unused styles) is to adopt Functional CSS. I talk in deep here [http://minid.net/2019/08/12/in-defense-of-functional- css/](http://minid.net/2019/08/12/in-defense-of-functional-css/)</comment>


Wall Street and hedge fund analyst: "Financial markets are rigged" - <AUTHOR> http://www.reddit.com/r/occupywallstreet/comments/muqzv/wall_of_text_i_work_in_wall_street_and_work_in/ <comment><USER2> Better title:

"Anonymous Internet commentator: Here's a bunch of common knowledge you can glean from any basic investment book. I'll omit the half that makes my argument look bad. Also, I can pretend to be someone who wouldn't naturally agree with you."

I don't know why the Internet eats this stuff up. It might be fun to go to conservative-monoculture forums and start posting: "I am an OWS organizer. I'm only here to appear more virtuous than my friends, and also to sleep with girls who have weird piercings and tattoos."

Politics articles in general are an utter black hole for intelligent discussion, but this one is also a portal into a completely new dimension of pointlessness.

<comment><USER3> And all the things that come from reddit are just as over-dramatic:

"The finance industry is a complete scam"

"you have absolutely no chance"

"you're paying ridiculous spreads"

"you are paying exorbitant fees."

"you are utterly screwed"

"You have no idea"

</comment></comment><comment><USER4> unpersuasive. You go to the casino and sit down at the poker table, some of them are going to be pros or very skilled people who will try to manipulate you. Is the game rigged against you? As much as they can within the rules of the game.

Second, on average, HFs recently have little performance edge. They had an edge during the dot-com burst and earlier, when they were smaller. Lackluster returns and frequent blowups belie the notion they have the inside track.

A few of the hedge fund guys are legitimately brilliant, with a consistent edge.

A few are bad eggs and push the envelope, e.g. Galleon.

A few have an inside track, e.g. HFT guys who are collocated and see everything a split second before everyone else.

Most HFs have little or no sustainable edge, and just take big fees from gullible people until they blow up.

If you don't think you can play against these guys, just invest in bond and stock index funds and ETFs. You won't do much worse, and you won't be risking blowups.

There's been a lot of looting the last few years, blatant stealing of customer funds at MF Global, bailouts, insider trading by Congressmen, CEO pay, private equity extraction, would focus on those guys. Mostly hedge funds are a convenient target. If you want to target something, target specific practices that are a problem, not specific actors.

(the only real scandal is the ultralow tax rate paid by HF managers on giant earnings - thank fully-paid-for Paul Ryan and Eric Cantor)

</comment><comment><USER5> I started reading this, then skimming, then came to "You have better odds going to a casino and playing slots, the worst-paying game in the house, but still better than the stock market" and decided that this piece is a rant by an ideologue.

That statement is just flat out wrong, and ridiculously so.

</comment><comment><USER6> 401(k) accounts amount to an enormous subsidy for the financial industry. The whole system is structured to discourage competition and funnel money to the largest financial services companies, because employers require you to use a specific company with a limited choice of investment options. Health insurance being tied to employment causes similar problems there. OWS should be rallying against stuff like this instead of police brutality, which seems like the current focus.

<comment><USER7> This. This is the real rigging: your company doesn't care what fees your 401(k) charges you. They'll give you an S&P500 index fund with a 1.2% expense ratio. Given that you can get that for 0.06% elsewhere, you can _bet_ that a good chunk of the rest is yacht money.

Fortunately, you can roll over your 401(k) to an IRA when you change jobs. Vanguards' ain't too shabby. Or pick a brokerage and get your own stocks. You don't need to care about a high-frequency traders' 30-second impact on the market if you're not selling your portfolio for 30 years.

</comment></comment><comment><USER8> He has two points with which I agree:

(a) many investing strategies which rely on frequent trading or high leverage are not available to retail investors because of commissions, spreads, or taxes;

(b) (i) mutual funds etc. are poor investments because of the fees they charge; and (ii) because 401(k)s often force you into mutual funds, 401(k)s are often poor investments.

Of those, I'm only angry about (b)(ii), because the government forces me (with tax incentives) to put money in my suboptimal 401(k).

The rest is just a question of understanding what game you're playing and acting accordingly. I don't see why I should be offended that somebody else gets better access to the markets than I do, any more than I'm offended that my friend who works at the donut shop gets free donuts.

<comment><USER9> don't most 401ks offer index funds?

<comment><USER10> They also have the all cash option, which by itself offers a very good return if you factor in matching and tax benefits. And if you switch jobs somewhat frequently you can roll it over into a no fee IRA you manage without necessarily worrying about the state of the market when you do the rollover.

</comment></comment></comment><comment><USER10> "You have better odds going to a casino and playing slots, the worst-paying game in the house, but still better than the stock market."

I can calculate what the odds are for slots, but I would love for someone to post some real numbers for what the stock market odds are.

<comment><USER9> It's not the same kind of mechanism, so you can't really provide odds.

I guess you could look at the S&P as an average measure of return.

<comment><USER10> Kinda my point. The comparison is meaningless. I also think he's wrong, but don't know how to even begin demonstrating that.

</comment></comment></comment><comment><USER9> There's a lot there that's emotionally stated and designed to draw ire without actually being correct, alas.

</comment><comment><USER11> _Some of these services, especially pension funds, will invest into hedge funds, who take an additional 2 and 20 (meaning 2% of assets plus 20% of capital gains). What this means is that if you go any of the traditional retail routes, you are utterly screwed facing off against the hedge funds._

Two of the most completely unreasonable sentences joined together. Hedge funds' ruinous fee structures give hedge fund investors an advantage...?

Uh, no.

</comment><comment><USER12> Why is this biased anonymous junk on HN frontpage?

<comment><USER13> I'm guessing people wanted to talk about it or use the audience here to verify the quality of it.

</comment></comment><comment><USER14> Some actual numbers to provide some context. Out of 2128 HFs I can see on the Bloomberg...

Total 5 year return: 650 > 3%, 399 > 25%, 56 > 100%, max 322.84%.

Total 1 year return drops to: 498 > 3%, 51 > 25%, 2 > 100%, max 278.64%.

273 of them appear to have been around for >= 10 years. Out of those 273 the total 10 year return: 244 > 25%, 135 > 100%, 51 > 200%, 14 > 500%, 4 > 1000%, max = 1907.18%.

edit: clarity

</comment><comment><USER15> Possibly the best rant in support of the book "Intelligent Asset Allocation" by Bernstein.

</comment><comment><USER16> Much of this is not true. This is in an occupy subreddit so be careful what you see in comments and what gets upvoted...

One thing that he doesn't make clear: hedge fund fees are 2% annual management fee PLUS 20% of any upside (very similar to VC's)

After fees, index funds often perform better than hedge funds: [http://www.nytimes.com/2007/03/04/business/yourmoney/04stra....](http://www.nytimes.com/2007/03/04/business/yourmoney/04stra.html)

Also - relevant is this long bet: <http://longbets.org/362/>

"Over a ten-year period commencing on January 1, 2008, and ending on December 31, 2017, the S & P 500 will outperform a portfolio of funds of hedge funds, when performance is measured on a basis net of fees, costs and expenses." PREDICTOR Warren Buffett

<comment><USER17> That NYT article is from 2007.</comment></comment>


Linux vs. BSD on EC2 - <AUTHOR>

After reading the prior thread about whether or not startups should use EC2 for hosting, I was left wondering what the leanest possible approach would be to hosting an OS image... and do we have a truly optimal image for this purpose yet?
From a strictly computational perspective, which OS platform is better suited for this? My guess is that this contest would be between Linux and BSD (Solaris has too fat an ass?). From what I understand, the BSDs are tightly engineered with the goals of performance and efficiency in mind (still has the best networking stack, or so I hear), whereas Linux may tend to be more hackish (I am not an authority here!). However, Linux's advantage could be its modularity, making it easier to shape it to specialized puposes (like cloud computing).
I've heard a lot of geeks say that although Linux makes for a better free desktop, a BSD would be their first choice as a server.
So, in the cloud computing landscape, who will perform better? A tight BSD image, or a tight Linux image? Which will be more efficient in terms of computational resources used?
BONUS QUESTION: Do you think virtualization services like EC2 will drive the creation of new *nix variants that are optimized for max price/performance on cloud services? If you know of any that exist now, please post links! <comment><USER2> FreeBSD doesn't run on EC2 yet. I'm working on it. :-)

Leaving that minor detail aside, I (unsurprisingly) think FreeBSD is much better than any variety of linux for this purpose. The first rule of running servers is "apply security patches", while the second rule is "don't break things" (some people reverse these two...). FreeBSD works with a concept of "stable branches", and as a general rule, FreeBSD does not break APIs or ABIs except across major version upgrades. In contrast, security patches to linux have been known to change kernel/userland interfaces, as well as kernel APIs -- either of which can result in system administrators needing to run around fixing things after applying a security update.

This is even more relevant in the context of cloud computing, where the patching (or not patching) of the operating system is performed by someone (e.g., Amazon) other than the people actually using the virtual machine instances. I don't think Amazon has really figured out what to do with linux here; but for FreeBSD the right answer is simple: Update images as soon as security updates are released, secure in the knowledge that doing so won't break anything.

<comment><AUTHOR> Nice. Do you plan on sharing with the rest of the class? Do you have a site for this project?

<comment><USER2> Yes, I will be sharing -- once there's something to share. Before getting to that point, there's work which needs to be done on Xen, packaging up FreeBSD in such a way that EC2 can handle it, and getting FreeBSD and EC2 to handle each other's quirks sanely... so there's nothing to share so far, and no need for an empty website yet.

</comment></comment></comment><comment><USER3> FreeBSD would be worthwhile in any virtual environment because it works well in low memory environments. I've got a FreeBSD server with 64MB of RAM. It has been running for years. It has been patched but it hasn't required a hardware upgrade.

</comment><comment><USER4> plan 9 from bell labs, maybe <http://plan9.bell-labs.com/sys/doc/9.html></comment>


Ask HN: How do developers learn new skills quickly? - <AUTHOR> My favorite method of learning a new programming language, framework, tool, etc. in depth is by reading books and working through exercises. However reading books is extremely time consuming and maybe not the most efficient way to learn. Sometimes books are so long I never even end up finishing them, and thus not learning much. Reading documentation, tutorials, and watching YouTube videos on the subject ramps you up quickly on the basics, but these things are usually shallow in content and explanation. Is there a more optimal way to learn new technical topics in a way that is fast AND gives you a reasonable amount of deep knowledge? How do other developers learn when they need to learn quickly and get things done? <comment><USER2> Quickest way is to build something with what you are learning. It's frustrating at first when you don't know much, but once you get a little success you can quickly build on it.

Books usually start from very basic and it takes long time to start writing something useful and fulfilling.

</comment><comment><USER3> Necessity is the mother of invention.

When you're stuck on a tough problem with a tight deadline you can learn pretty quickly. Though it's a tightwalk, especially if you don't have a lot of help from others, since you might really get stuck or so out of your depth that you miss obvious solutions sitting right in front of you.

Still there's nothing quite like a good project to focus the mind and the lessons you learn that way tend to stick. I find this is especially true when working with source code. You will accidentally learn a codebase from constantly having to refer back to it.

I also find trying to teach things to others is a good way to learn. If you like to write, try putting together a few paragraphs or some slides to explain a concept. It will stick with you a lot better after going through the effort. (and it's real effort... it takes hours to produce a seemingly miniscule amount of content when building tutorials)

This assumes of course that the chief problem is not so much content as it is holding onto it for more than a day and achieving real depth with it.

Videos aren't ideal in this respect. They can introduce a concept and point you in the right direction, but you really need to get your hands dirty to understand it.

Maybe try your hand at fixing a bug in an open source codebase you want to learn. (or even just reviewing a pull request and trying to understand it)

</comment><comment><USER4> Tangential.

From what I have seen happen around me, the "new skill" isn't really as new as it seems; it is just tweaking and reapplying the already present skill.

To use human languages as an example, a monolingual English speaker learning Italian, or even the seemingly esoteric Urdu, is not as hard as it seems for all these are of the same (broader) family sharing many similar features, and the skill is transferable easily. However, learning something like Chinese or Arabic and being good at it is hard and only people who have no other choice engage in the activity, and may be stand to benefit more in terms of ROI.

In that sense, I would be interested to know how a C++ guy learnt and became skillful in Haskell or Erlang, more than learning Java or Python and churning out code with them.

Or to use a non CS example, its more interesting to know how a medical student learnt fluid mechanics in order to understand the human body better than to know how a mechanical engineer became a theoretical physicist.

</comment><comment><USER5> Everyone learns differently so it's hard to generalise. It seems for you it could be more efficient to "learn by doing". For example start some simple project and then gradually add more advanced topics (there are many websites with ideas for such beginner projects).

If stuck try to find answer by yourself googling, read documentation/books or seek for help from community. I think it's more efficient and entertaining than reading whole books chapter by chapter before starting using knowledge.

If you must learn something quickly I would probably search advice from a person who already knows what is important to learn first or search if someone resolved similar problem.

That way you will learn just needed subset for a beginning to resolve a problem and then you can learn more.

</comment><comment><USER6> Internet is a huge resource. Even finding the most relevant thing is an art. You keep on getting better. Videos and tutorials might be shallow but your aim is to get the job done by learning a new skill. You only get closer to being an expert by meeting your objectives (programming and making human effort less than ever) and NOT by reading in depth nor by finding short cuts to expertise.

</comment><comment><USER7> I think developers evolved on associative thinking in order to learn new skills faster, you can see that when you migrate to a new syntax language.

</comment><comment><USER8> if you want to learn new language/tool, try direct building something for which language is popular. if you want to grasp existing code base fast, try copying it line by line. You don't have to finish all code. Once you cover to 30-40 % of code base, you become comfortable with it.

</comment><comment><USER9> Someone here pointed to me about this guy[0] who was using Anki to optimize his study. And now, I was using Anki for a month and I found out that I can be more productive with it. You might want to try it by yourself too.

[0] - [http://augmentingcognition.com/ltm.html](http://augmentingcognition.com/ltm.html)

<comment><USER10> I've been using Anki for a number of years now, and I think it's a fantastic tool for retention. However, I have never had any success with learning concepts that were new or foreign to me. I use it for testing powers of 2, port numbers, and cli flags, niche python syntax. For learning "new" skills, I would say reading books and watching lectures is the best way for me.</comment></comment>


Ask HN: What tools do you use for note-taking, progress tracking and TODO lists? - <AUTHOR> I usually work on multiple projects at once, using several computers and phones and need to get better at tracking progress I made (for my personal purposes), managing TODO lists and taking personal notes.
I'm quite unorganised in this regard and I'm looking to change this so that I can finally stop worrying that I forgot about implementing a feature or that I forgot how I solved a particular problem a few months ago.
I need to obtain inner peace to be able to focus more on solving actual problems rather than living in fear over note-keeping.
My "system" so far is like this: I keep one Markdown file per computer I work on. Each file contains:

  - TODO lists for multiple projects

  - personal, general TODO lists (not related to particular projects)

  - my insights (regarding e.g. newly read papers or notes when learning new algorithms)

  - links to materials I find interesting and want to read later (papers, tutorials, links to HN :), etc.)

 All of these MD files are unorganised (TODO lists for a single project can be found at multiple places in the file, interleaved between links and unrelated notes). I tried synchronising the MD files using Git, but that seemed like an overhead for me. I think I need something that does automatically save history and it would be nice to show the date and times when a note was taken (so that a graphs of my activity could be made over time - but this is not required).
I guess I would like to have a solution that not only synchronises across all platforms (Linux, macOS, Windows, iOS), but most importantly is secure as my notes can contain sensitive information. If there is an open-source solution for this problem, I have no problem with self-hosting such system.
How do you keep your notes/TODOs/track progress? <comment><USER2> Org-mode. Once you get hooked and comfortable there is hardly going back.

Org-mode support todo lists, agendas, scheduling, recording time per task, latex export, references (with org-tef) and executing code in the document (with babel) and more.

To give you an idea of what the workflow is while I am working on my PhD thesis. I write text with references in sections with todo tags, add my python code, execute it and export to latex. Now I can track how much work I did today in what section and I can also see other files in a common agenda. All of this is in plain text files so git work as well and if you decide to migrate a python script can parse it.

All of this in a free and open source solution if you are happy to work with Emacs. In my opinion it is worth it even if you keep a running Emacs version only for this.

<comment><USER3> +1 for org-mode.

Org-mode files are tree-structured, so anything you can structure as a tree should work well with org-mode. The navigation controls work nicely: expanding/collapsing, reordering, searching within subtrees.

<comment><USER4> Perhaps you know this, but other curious readers may not: it's worth noting (perhaps in an org-file) that properties such as tags, priorities and timestamps allow you to catalogue and access information without using the tree structure, so it can work for non-tree like structures too.

To any interested readers, I'd watch Carsten Dominik's (the original Org-Mode auhtor) Google Tech Talk on the topic. It's good to see it explained from the creator's perspective, imo.

</comment></comment></comment><comment><USER5> I have two primary programs to handle this on a generic level across devices. It was important for me to be able to easily access everything from my phone or PC.

\- Notion [1]

I use Notion to create notes, share thoughts, save links and resources, and write blog drafts. The focus here is to easily share them with my partners or publicly, if needed. Notion is extremely versatile and if I had to recommend an application, it would be this.

\- Standard Notes [2]

I wanted a tool like Bear (for Mac) and this is the closest I could find. This is for personal use so I wanted something that would securely store my data. I use this for journaling and maintaining To-Do's.

To manage projects and keep track of how I've been progressing, I use Trello[3], cause it's one of the best kanban boards out there.

[1] notion.so/ [2] standardnotes.org/ [3] trello.com/

<comment><USER6> Why use both Notion and Standard Notes? I use Bear, but have been vaguely thinking of moving to Notion.

</comment></comment><comment><USER7> In collaboration with others, I often use Trello, Asana, Notion, Google Drive.

\---

That said, if you have the time and inclination, you can always roll your own custom, personalized solution by combining tools at hand: editor/stack of choice, Git, rsync, grep, etc.

My own "system" has evolved over the years. These days I use (and continue to develop) a React app that serves a personal dashboard and watches a folder of Markdown files for live/hot reload. It has various features that I've added as needed, like calendar, events, to-do list, different "views" that organize and list the notes, extracting Markdown "front matter" for metadata like tags.. I also use it as a scratchpad for code.

The biggest advantage to this approach is the infinite extensibility. If I want, I can integrate my book collection and keep virtual shelves for "reading now" and "to read"; use Git for tracking tasks/time/progress; push the system to a remote server and put my dashboard behind a login, for different devices to access the central repo; share and up/download static files; dynamic spreadsheet-like functionality (calculate tax, currency conversions); add a text-based chat over WebSockets for collaboration..

But this is kind of how I've always used personal computers, by building my own systems. I get great enjoyment out of it, and the tools fit my needs perfectly (well, limited by my technical ability and there's always room for improvement).

</comment><comment><USER8> Since you use MD files for "organising" you may have a look at Notable [1] which is Open Source and uses MD files under the hood. And you can tag your posts to organise your projects

Personally I use a combination of Bear App [2] for Mac to organize my Notes. Bear has a built in tag function which is really easy to use. Also I'm a huge fan of it's minimalistic design. For ToDos I use Things 3 [3] which let's you categorize your ToDos in different projects.

But both are Mac only currently which is a pain point at work where I use Windows.

[1] [https://github.com/notable/notable](https://github.com/notable/notable)

[2] [https://bear.app/](https://bear.app/)

[3] [https://culturedcode.com/things/](https://culturedcode.com/things/)

</comment><comment><USER9> Over the years, I've tried all sorts of different approaches and tools for this, and some have worked better than others.

At this moment, I use four tools. On the desktop, I use a basic text editor for all of those. When I'm not at my desktop, I use an Android app called LectureNotes.

I use git to archive my notes, etc.

I also run my own Wiki, where I consolidate the current notes for every project I do (mostly to make it easy for future me to refresh myself when I need to change something on a project I did 10 years ago, and to make it easy to share the notes with others in a comprehensive way).

</comment><comment><USER10> I use a dot grid bullet journal with multiple colored fountain pens. I find it addresses most of your concerns whilst being flexible enough to accommodate any deviation you can dream of, without any dependencies on technological solutions. It's dated, organized, consolidated, efficient, flexible, portable, with room for artistic expression, and it gets you away from your monitor and keyboard and phone.

</comment><comment><USER11> For daily TODO lists pen and pencil is the best, you will feel this funny dopamine hits when you cross out finished a task.

<comment><USER12> Personally, I also have the feeling that I remember points better, if I write them down instead of digital notes. Nothing beats Pen&Paper.

</comment></comment><comment><USER13> I use Trello for TODOs and Bookmark OS for notes/bookmarks. I like the overall UI of Bookmark OS and it's use of tags.

[https://trello.com/](https://trello.com/)

[https://bookmarkos.com/](https://bookmarkos.com/)

</comment><comment><USER14> After trying several tools, I just got to feel a plain text is all I need for my todo list as I don't want to start decorating the list when I have that list to consume first.

For Mac, Unclutter is really useful (which also acts as a clipboard manager) as it gives you instant access to the note with a scroll down from the top of the screen. And I just have the list written in the order of priority under several categories, which are just bracketed text headers and it serves me well.

[https://unclutterapp.com](https://unclutterapp.com)

For Notes, I ended up using Apple's note as it did things fairly and you can attach files and also encrypt individual entries which I find useful to keep sensitive information.

</comment><comment><USER15> Like some others here, I've been a diligent and an extremely happy Org mode user. I use it extensively for work and personal projects, to generate reports, documents, summaries, and task tracking of all kinds.

And since about a few months, even for mobile, I switched (from "Keep") to the "Orgzly" app, that supports the Org mode format. In addition to other goodies like (manual) sync, export, etc.

Org mode is a delight (an understatement).

And oh, I also use the old-fashioned notebook and pen to take notes while reading books. Something about the rotary motion of pen on paper brings me joy, and seems to help me better crystallize what I'm trying to learn. (And if I may say so myself, my handwriting is not terrible.)

</comment><comment><USER16> I used to use Wunderlist because it had a GREAT widget on Android. Then I switched to Evernote when I got an iPhone. Now I'm in a hybrid of real pen and paper and Evernote. Eventually I feel I will go 100% pen and paper. I use Pocket for saving things on the web that I want to come back to.

I've found that because I work with computer SO much that I need something analog to bypass that resistance to using a screen after a long day on computers. I have two notebooks. One strictly for work that I treat like an Engineers Notebook, 1-page a day, date at the top, sign off when the page is done, etc. The other I use for personal stuff and usually is just a to-do list.

<comment> m-p-3 "Eventually I feel I will go 100% pen and paper."

I'm still looking for THE epaper notepad that works well for note-taking, but also reading emails, managing a calendar, etc and that is also running Android.

<comment><USER16> One day brother, one day.

</comment></comment></comment><comment><USER17> On Windows, I just use the Microsoft Sticky Notes app. I'd used text files for a long time, and tried various local and web-based apps, but the key feature for me is that the note has to be visible or I'll eventually forget about it. I've got a whiteboard beside my desk and that's good for some things, but having the notes on my desktop is easier to edit. My second monitor on each work computer is a mess of notes, but I never forget about them.

[https://en.wikipedia.org/wiki/Sticky_Notes](https://en.wikipedia.org/wiki/Sticky_Notes)

</comment><comment><USER18> Emacs and Org-mode for almost everything. The eventual rewards significantly out weight the steep learning curve. IMHO Beyond a point - the ability to create custom workflows becomes critical to progress.

</comment><comment><USER19> Personally for ToDo Lists and Tasks I use Taskade [1] which let's you organize structured docs into different project workspaces and makes it easy to track. For more visual tasks and organization, I've been playing around with Mural [2] and it gets the job done but can get chaotic.

Both are cross platform which makes it easy to collaborate on.

[1] [https://taskade.com](https://taskade.com)

[2] [https://mural.com](https://mural.com)

</comment><comment><USER3> > I guess I would like to have a solution that not only synchronises across > all platforms (Linux, macOS, Windows, iOS), but most importantly is secure > as my notes can contain sensitive information. If there is an open-source > solution for this problem, I have no problem with self-hosting such system.

If access across machines and operating systems is a priority for you, you may want to set up a private wiki and ticket tracker, either on your own machine or with a cloud provider.

</comment><comment><USER20> I'm looking for something like this but a bit more complex.

I'd like to have an ENCRYPTED database with my TODO lists, ideas or whatever comes to my mind, maybe contacts, calendar, alerts and very important, a sort of wiki where I can store news, images, articles or anything I find interesting.

A very important feature is encryption. As it's something very personal I wouldn't like people to be able to read it.

</comment><comment><USER21> Taskwarrior, where have you been all my life? [https://blog.djy.io/taskwarrior-where-have-you-been-all- my-l...](https://blog.djy.io/taskwarrior-where-have-you-been-all-my-life/) [https://news.ycombinator.com/item?id=17029560](https://news.ycombinator.com/item?id=17029560)

</comment><comment><USER22> I use MS OneNote because it's available for free for all my devices, syncs, and has a decent UI. It does not support MarkDown at this time.

</comment><comment><USER23> Nobody seems to do my technic, I used to do org-mode but then the TODO became too big and I could not remember exactly what happened. So instead, I use... one github private repository.

I rely on (sometime big) issues and projects. I store documents and papers in the git repository.

It also gives me more room to procrastinate, like add emojis, tags etc... on something that will be useful.

</comment><comment><USER24> I use vimwiki. Simple, light-weight, and does exactly what I need. I also use org mode in spacemacs with evil, but so far I haven't come across any functionality in org mode that I needed that vimwiki didn't also provide.

[https://github.com/vimwiki/vimwiki](https://github.com/vimwiki/vimwiki)

</comment><comment><USER25> Bear.app is incredible! It's been my daily driver for todos, notes, thoughts, planning, etc for a while.

</comment><comment><USER26> Simple Draft Emails (in Gmail for me) is the easiest IMO.

I also use keep.google.com for personal purposes. Both work great.

</comment><comment><USER27> I use Zim, writing notes in Markdown and push the changes in a private Bitbucket private repository.

</comment><comment><USER28> I use Standard Notes([https://standardnotes.org/](https://standardnotes.org/)). It support extensions which allows you to use markdown, publish to blog, etc etc..

Main feature is that it supports End-to-end Encryption.

</comment><comment><USER29> Reminders on my phone for important personal tasks, Slackbot for reminders at work, and then Simplenote for general notes/things I want to come back to or remember. I find that anything more is superfluous and difficult to keep up with.

</comment><comment><USER30> I use Joplin. It can sync across Windows, OS X and iOS (didn't try it on Android), notes are in Markdown. The note editor is not awesome, compared to smth like Typora, but it's ok if you just want to type in Markdown.

</comment><comment><USER31> You can take a look at [https://colab.research.google.com/](https://colab.research.google.com/) (hosted jupyter notebook from google) to keep your notes organised.

</comment><comment><USER32> Used to use trello until atlassian bought them. Now I use [https://www.phacility.com/phabricator/](https://www.phacility.com/phabricator/)

</comment><comment><USER33> Trello is amazing. For a more versatile tool I'd say Asana. You can also move downstream to expert project management tools, but these to are my go-tos for a simple workflow.

</comment><comment><USER34> Notepad is best to write down day to day todo. It is very easy to use and easily available in any device. Now it has more features and you can quickly perform your operations.

</comment><comment><USER35> The archive for plaintext notes [https://zettelkasten.de/the- archive/](https://zettelkasten.de/the-archive/)

</comment><comment><USER36> 1\. iOS reminders app for to-dos 2\. google calendar for day to day tasks and meetings 3\. Evernote for weekly, monthly and yearly progress(I should get a better tool for this)

</comment><comment><USER37> I have Evernote subscription and I use that. But lately, I find myself using more and more Apple Notes and it seems to meet my needs as I have an iPhone and MacBook.

</comment><comment><USER6> I use Bear. It's basically like Apple Notes, but more fully-featured. In particular, it uses markdown (more or less), and has checkboxes you can use for todos.

<comment><USER14> While I liked it feature wise, I don't think I want to pay a monthly fee just to take notes.

<comment><USER38> I thought the same, but it's €15.99 a year. I usually buy a couple of Leuchtturm notebooks a year, which cost that each. Looking at it that way, it's well made and I want it to stick around.

<comment><USER39> > ...it's well made and I want it to stick around.

Fully agree. And for me personally I think €15.99 is cheap - I use it way more than any of the video games I keep buying.

</comment></comment></comment></comment><comment><USER40> Dynalist - it specializes in hierarchical lists like Workflowy, but with a lot of rich functionality layered on top. I've been using it daily for over a year.

</comment><comment><USER41> I use the Things 3 app on Iphone. It was built to work in GTD style with things broken out into spaces and projects in those spaces.

The mail to cloud feature is very handy.

</comment><comment><USER42> i have pretty severe adhd which causes a somewhat difficult situation where i need to keep todo lists to remain on track for even basic stuff, and the system needs to be pretty foolproof because, you know, the adhd

i dream of doing something really fancy, but i always come back to the same trio of tools:

-every morning i grab a few sheets of paper and keep them folded up in my pocket, to jot things down when needed. this covers my irl day-to-day pretty well

-for the virtual stuff i use simplenote because it's got apps on every platform i use, and failing that there's a webclient which is nice in the event i am on a computer that isn't mine.

-i really, really wanted to get a nice taskwarrior setup going, but i found that getting the server up for sync purposes to be overly complex. after alot of searching and trying-outs and whatnot the setup that remains due to its ease and portability is a little thing called dstask, which uses a private github repo as its base. setup is as simple as a 'git clone .my/repo' and a 'npm i dstask', and running the sync command updates the repo in a way that i -wish- hub's 'hub sync' command would operate.

with the speed of computing these days, i reformat and reinstall my os maybe once a week or so because it's literally faster than trying to un-break something when i manage to mangle something up. so this is a super easy thing to have to constantly re-deploy because git and npm are, naturally, some of the first things that get installed on a fresh setup

so that's how i manage to be somewhat functional and independent in my short- term type stuff. for longer projects and just to keep up the habit, i keep a pretty large amount of notebooks around, because i am prone to forgetting to grab one so my solution was to have so many that there is now one or two at just about any place i am at routinely. i have a sort of system to keep track of what i guess i would call this 'distributed notebook' but it would probably drive you insane in a sort of lovecraftian way if you tried to make sense of the clusterfuck method - like if i refer to something in another notebook i draw an arrow and depending on the orientation i know what other notebook i am referring to, because the arrow points to its physical direction relative to wherever it is i am writing.

obviously the big problem here is encryption but the first rule of encryption club is,...

</comment><comment><USER43> Dropbox Paper. Excels at combining notes and todo lists with assignment and due dates. Easy markdown editing, code blocks, embedded content

<comment><USER44> I love Paper except for the fact that I can't get it to show the folder view as default. It's just one click, but it drives me crazy that it won't remember that I want to see the folder view.

</comment></comment><comment><USER45> GNU's nano. Seriously :)

And nfs-equivalent between machines to "sync" (if nfs is out of the question, rsync works good enough)

<comment><USER9> I've never managed to get along well with Nano, personally, but I'm with you on using a fairly minimalist text editor.

</comment></comment><comment><USER46> I use Etherpad on a regular basis.

[https://etherpad.org/](https://etherpad.org/)

</comment><comment><USER47> I've tried a lot of things over the years and I keep coming back to this:

vim ~/notes.txt

I sync with Google Drive to edit on mobile

</comment><comment><USER48> Team tasks require communication. For these, basecamp or if no budget, trello.

Personal tasks: things, in gtd system.

</comment><comment><USER49> Emacs org-mode.

For everything.

</comment><comment><USER50> Google Keep. Free. Desktop + mobile. But they'll probably discontinue it one day.

<comment><USER51> And they are probably mining it for data. I use Keep as a synchronised shopping list with my wife, among other things. I'd really like a self- hostable replacement.

</comment></comment><comment><USER52> Been using todoist lately and like it pretty well

</comment><comment><USER53> Self hosted nextcloud with notes and tasks</comment>