The Database Programmer: Advanced Table Design: Secure Password Resets - <AUTHOR> http://database-programmer.blogspot.com/2008/09/advanced-table-design-secure-password.html <comment><USER2> This may be useful in the database domain, but I don't think it applied to most web contexts.

Most web applications don't bother with database security - it muddles the logic and prevents things like pooling, scale, etc

For more traditional web apps - typically you have two sources accessing the database - the Web Application and the Administrators. Both of which have access to nearly everything anyway.

This might stop some malicious code from accessing the database improperly - but the fact is, if someone can manipulate the code you've already lost anyway (they could simply just capture the passwords at entry for example).

</comment><comment><USER3> He's fighting the wrong battle.

He's sending the hash by email! And then working so hard at securing the wrong part of the process - with SSL of course, when email is not encrypted.

</comment><comment><USER4> _The technique presented today makes full use of database server abilities to create a password reset system that is highly resistant to forgery, interception, and_ _evil-admin meddling_ _._

If you for a second honestly believe that this design will stop admins from being able to tamper with the process, you should be fired on sight.

If you are going to design a secure process, I'd say you should focus more on security outside your system, and worry less about keeping admins out. If you're an admin, you have full access, or the ability to give yourself the full access needed to tamper with this system.

<comment><USER5> not so fast. There are companies whose data is very sensitive. Financial, highly sensitive law firm documents, etc. And a large of percentage of data thefts is from inside jobs.

Not everybody is doing only web 2.0, where the data secrecy is not a big deal.</comment></comment>


Show HN: A Random Wiki Page Every Day (via RSS) - <AUTHOR> http://randomfeed.net/

<comment><USER2> Just subscripted to one to a wikipedia feed. Would the feed to have a summary attached to the item, or at least give an option for a full feed?

Great work!

<comment><AUTHOR> Thanks! :-)

Originally, I wanted to extract a summary from each article, but then I ran out of time. I might do this in the future.</comment></comment>


Humanitarian Crowdfunding Thread - <AUTHOR>

Join our Humanitarian Crowdfunding Discussion!
We're new to Hacker News and want to cultivate a discussion about Humanitarian Crowdfunding and the open-source crowdfunding platform we're building.
My colleagues and I are former United Nations staff and veteran humanitarian actors, we're passionate about shortening the turn-around time and effort it takes professional-level humanitarian organizations to develop, launch and sustain operations, and we're building a unique new crowdfunding platform to serve the humanitarian community. You can see our twitter feed at @BeehiveFund and a rough pitch deck at http://vimeo.com/98176476.
What's cool is that we're a totally nonprofit all-volunteer initiative bringing hackers, humanitarian actors and others  together to build a platform that continuously adapts to user input and needs arising from the field. If a humanitarian group requires the ability to crowdfund via SMS or wants to channel cash-aid disbursements directly to refugees – we sort it out and do it, and integrate the capability!
This is the way to build the future of crowdfunding for humanitarian campaigns, through kick-ass open source development and real user engagement right? <comment><USER2> Could you explain what BeehiveFund offers over existing resources, such as Indiegogo?

<comment><AUTHOR> What we're aiming to provide professional-level humanitarian actors is an opportunity to separate their appeals from the mishmash of different 'charitable' campaigns out there and a platform they can own, improve and use as a developmental test-bed.

Crowdfunding is capable of reshaping the fundraising landscape impacting humanitarian operations. But there's no incentive for popular platforms like Indiegogo to stake out and work with humanitarian actors to innovate humanitarian operational financing.

For example the humanitarian development community uses OECD CRS purpose codes to classify giving. It wouldn't take Indiegogo anything to bring standardized reporting in use across the humanitarian community down to the crowdfunding level but there's no incentive to even learn what these codes are or how they're useful.

</comment></comment><comment><USER3> I hope your project goes well.

<comment><AUTHOR> Thanks! We just gave a talk on our project at a Humanitarian Innovation conference at Oxford. Folks are really excited.</comment></comment>


The Philosophy of Punk Rock Mathematics (interview) - <AUTHOR> http://technoccult.net/archives/2010/02/25/the-punk-rock-philosophy-of-mathematics-technoccult-interviews-tom-henderson/ <comment><USER2> Startup hackers should know more game theory. You can explain a lot of human behavior as evolutionary adaptations to compete in partially-cooperative sex- selected games of incomplete information in groups of around 100 players.

For example, why we care about karma on social networking sites, why some employers require you to wear a suit even though everyone concerned thinks suits are stupid, why religions are tenacious, why nobody trusts atheists, why virtually every mid-sized American city has at least one completely uneconomical skyscraper in what passes for "downtown" and why it's always owned by a bank or insurance company... the list goes on and on.

</comment><comment><USER3> Wow, this link was awesome for introducing me to <http://www.mathforprimates.com/> which was a fun set of podcasts! Thanks!

</comment><comment><USER4> I checked another project of that guy mentioned in the interview: <http://www.superstructgame.org/> and I noticed that one of the movies he uses ("Outlaw Planet") has been pulled down by youtube due to copyright complaint from Stanford University. I didn't know universities are so evil that they sabotage projects of their graduates on basis of copyright.

</comment><comment><USER5> 1) People use the average Joe's poor mathematics as a way to control, exploit, and numerically fuck him over.

2) Mathematics is the subject in which, regardless of what the authorities tell you is true, you can verify every last iota of truth, with a minimum of equipment.

Although seldom noticed, mathematics is one of the few, maybe the only, subject not open to interpretation.

<comment><USER6> Ah, don't we wish. There's this thing called an "Axiom" that is, ruefully, generally, arbitrary. Definitions, too.

e.g. Some say the set of natural numbers contain 0, some say it doesn't.

Granted, the kind of math being discussed here isn't open to much interpretation, but I thought I'd note it.

<comment><USER7> Rarely is a person screwed by a controversial axiom.

<comment><USER8> You'd be surprised. The first thing that comes to mind is modern macro- economic forecasting, which is built on a host of controversial axioms. These forecasts are little better than Roman augury, and one could argue they are actually a net negative because they give us the false pretense of knowledge.

Using game theory to make predictions, expected utility theory, etc the list goes on and on (sorry to pick on economics, I'm sure there are plenty of other fields that suffer the same problems).

Just look at some of the assumptions made by the financial engineers who caused the recent financial crisis if want your head to explode: <http://en.wikipedia.org/wiki/Black–Scholes#Model_assumptions>

<comment><USER7> You and I might be using the word "axiom" differently.

<comment><USER8> All right, in the black-scholes example I admit that those are not axioms in the traditional sense. Maybe the expected utility axioms would be a better example: [http://en.wikipedia.org/wiki/Expected_utility_hypothesis#von...](http://en.wikipedia.org/wiki/Expected_utility_hypothesis#von_Neumann- Morgenstern_formulation)</comment></comment></comment></comment></comment></comment>


Ask HN: How to train your brain to recognize opportunities for innovation? - <AUTHOR>

As a technical guy, I'm scared of the idea of being dependent on an idea-guy to come up with real-world problems to solve. I strongly believe that not only should I be able to solve problems through technology (or even simpler means, if you're into the whole lean current), but that I must be able to identify the problems themselves on my own.
The issue is that I have a very consumer-like mind and I feel I'm constantly missing out on opportunities to identify areas of improvement or disruption. As a silly example, I would have never thought of allowing individuals to be able to use credit cards for simple personal transactions (I'm referring to Square), and yet it's such a simple and powerful idea.
How do I train myself to look at the world from the point of view of an innovator? How do I spot opportunities? Any interesting books / internet reads on the subject?
I'm rather good at making things that others tell me to make, but I feel there's nothing as enthralling on working on a problem you yourself "discovered" and believe is really important to solve. <comment><USER3> I find the more I study economics, the more I see examples of problems that could be solved, by technology or otherwise.

Information asymmetry is a big one. FareCaster is a good example of a company that succeeded by reducing information asymmetry.

Arbitrage opportunities are good to look out for too. Same for building markets where no efficient market existed before (eg. AirBnB, Etsy).

</comment><comment><USER4> I'm an idea-guy who's training himself to code because I find hard to trust clueless technical-guys as co-founders. Everytime I'm trying to talk to a tech-guy about ideas and sales and marketing, all I'm getting is that Bambi look, you know, just before it get hit by the car.

Try get some life experience. Problems are only one question away.

<comment><AUTHOR> You raise a couple of very good points that I myself have struggled with.

First of all, as someone who's been coding non-stop since the beginning of college and later on for years for a large corp, I have little to no experience with the "outside world". I have lived in the academia/enterprise- industry programmer bubble my entire life. I can think of ways I would improve bug tracking, programming, source control and other tools that we use day in and day out, but I don't have a clue about how I could help a small business increase their revenues. As you said, total lack of real-world experience.

Second, I often hear the complaint about techies having no clue about marketing and sales. Do you have any suggestions for how we could address that, and perhaps find a common language with the "business guys"?

<comment><USER4> I'd suggest this: the common language has to be English (and/or French in my case). Nothing is easy, but don't think you got burned the death only because one biz guy took advantage of you and treated you like a code-monkey (taken from you, here, yesterday). There's a lot of decent people out there which are not crooks. One thing you have for you is the commodity to supply code, something tangible (if I may say), where salespeople only throw blah blah in. Protect your belongings. You should make sure the code you write is somehow protected, remotely hosted or something. Why would a non-tech guy get to see your code anyway. Then you have the balance of power. That is if you are forming a partnership. Just my 2 cents.

</comment></comment></comment><comment><USER5> This is tactical advice that works for me
 1\. When you get annoyed - <USER2> and ask yourself why you are annoyed and how you can fix it. This could be tying laces that get untied every five minutes, etc. 2\. When you say or think to yourself - I wish I could ... that's an opportunity. I wish I could pay this other guy with my credit card right now so I can track my spending = Square 3\. Repeat 1 and 2 for other people 4\. Watch people - sometimes its easier to find problems when you are watching and other people are doing things differently than you are. 5\. When you see something - a potato peeler, A real estate sign. Guess how much it costs to make, where it came from, what it's purpose is and how well it achieves that purpose. What could make it better? What else could it be used for?

</comment><comment><USER6> I think intuition is something that cannot be taught, & I'm not being facetious. Even Jobs, one of the most intuitive thinkers of his time, said you can only connect dots in your life looking backwards not forward. I am a very intuitive person & I think one has to be very in tune with the world around them in order to connect the dots looking forward. My recommendation to you is that since you're very much in tune with programming and not so much with the outside world, try to find something in your world that you can improve upon. I know nothing about programming so, even though there is a lot of power in naïveté, I don't have enough information about technology to connect dots.

</comment><comment><USER7> Learn -- Learn to know how existing things work.

Think -- Think independently. Think as outsider.

Apply -- Apply what you created by independent thinking to what you learn about existing things in the real world.

Repeat -- Repeat the above the above 3 steps.

</comment><comment><USER8> I wish there was a way to work with other people to think and talk through big ideas. Talking with other people seems to be the best way to actually find big problems to solve as you never know where your conversations might take you.

</comment><comment><USER9> Having someone to bounce ideas off of and just brainstorm with is pretty useful. I like to be like Einstein and have little thought experiments going on in my head about every product or idea I come across.

</comment><comment><USER10> Talk to women and small businesses. Ask them what they feel like they pay way to much for, what their biggest problem this week is. These two markets are so underserved it is ridiculous.</comment>


Ask HN: Can someone explain PCI compliance to me in a nutshell? - <AUTHOR>

What I basically need to do is pass on credit card info (credit card no., cvv, expiry) to a third party that will charge the card. Let's assume I cannot integrate stripe or another such service. I would also want to be able to store the card info for recurring payments. What is the PCI compliant way of doing this? I know that for PCI compliance, I am not allowed to save the cvv or other such data (even if encrypted), but there might be a gap in my understanding. Any PCI compliance experts here who can clarify on this?<p>tl;dr: Need to save credit card info (credit card number, expiry date, cvv) for recurring payments, what is the PCI compliant way to do it? <comment><USER2> I don't know how much value you're going to get from a "in a nutshell" explanation here. PCI compliance regulations are moderately complex and have at least a handful of ambiguities and what-not, like any complex spec. If you want to "roll your own" payment processing and store credit cards, you really need to bite the bullet[1], download and read the spec, and - if you don't feel pretty confident that you understand it - hire a consultant who specializes in this stuff to help out. In either case, you should have a PCI compliance audit done eventually to help ensure that you really are in compliance.

Then, even after that, you have regular reports to do, etc., etc. Being, and staying, PCI compliant can be a huge time sink.

All of that said, would a service like Spreedly[2] work for you? I believe they can handle recurring payments / subscriptions, and they take care of making sure everything is PCI compliant, so you don't have to do all of that work. Unless billing and credit card processing is a core competency for your company, I can't help but think you'd be better off outsourcing that bit.

[1]: [https://www.pcisecuritystandards.org/security_standards/gett...](https://www.pcisecuritystandards.org/security_standards/getting_started.php)

[2]: <http://spreedly.com/>

</comment><comment><USER3> Honestly I am from Spreedly but you should really just use Spreedly. It works with 45+ payment gateways so I would hope there's one that would work for you. You don't want to do this yourself.

</comment><comment><USER4> Your understanding is correct - you cannot store CVV under any circumstances. There's no way around this. When we do recurring payments, we're only able to pass CVV on the first transaction.</comment>


Ask HN: Have you had RSI? - <AUTHOR>

If so, how did you deal with it? What do you do to prevent it from coming back? <comment><USER2> I used to get RSI problems when I was younger. You have to understand that it is directly related to the amount of time you spend doing the repetitive task. In this case I'll assume its typing. (This affects a lot of people such as pianists and guitar players too)

When the pain was worse, I had a velcro wrist brace with a metal support, this helped as it limited movement. Ultimately, the solution to your problem is to simply reduce the amount of repetition if at all possible. Back in my most problematic years, I was a web developer who spent 9-5 coding and would return home every night to clock up 4-5 hours gaming.

Stretching movements do not help either, ie a lot of use from Shift + Control keys is bad - learn how to touch type properly using the action key on the opposite side of the keyboard to perform these operations.

Gaming is very bad. I would love playing FPS games and MMORPG's. FPS games force your finger movements to be very precise which is very straining. MMORPG's are notoriously bad for repetition. Give these up if you are suffering that badly, trust me, its not worth it.

Other things that might help? Well I personally have spent a lot of money finding the most comfortable keyboard + mouse setup. Don't buy based on what looks cool or gets the best reviews, get what is comfortable for you. For me, it is a small bluetooth apple keyboard (low travel laptop keys that have a light touch are MUCH less straining) and a Logitech MX anywhere mouse. Yes its a mobile mouse with no tail, this fits me much better and allows me to use a single battery which also makes it lighter to move about.

Good luck, and take a break!

</comment><comment><USER3> I worked with a developer that had RSI. He used exercise, both grip strength and stretching / yoga to deal with it. He also switched to using a Dvorak keyboard. His situation did get better, but his recovery couldn't be definitively attributed to a specific change he made.

We had an interesting discussion around the theory and the math behind the Dvorak construction of the layout. The gist of it is that there are some natural and unnatural hand movements made while typing. The standard keyboard was constructed to statistically minimize typing letters that would cause the typewriter arms from getting tangled, from overlapping / locking. The Dvorak keyboard was optimized to place the most commonly typed letters in places that your hand could comfortably get to (reducing the frequency of stressful motions on the hand). However, the scientific evidence wasn't conclusive.

Good luck.

</comment><comment><USER4> I haven't had full blown doctor diagnosed RSI, but I have had pain before down my wrist when I moved my thumb.

Static stretching, as well as use reduction worked to get rid of the pain. For me I think it was mostly mouse movements with my wrist and not my arm, so getting a trackball mouse to periodically switch with besides enforcing good habits helped.

Now I take breaks while on the computer or playing video games. Work takes their part and enables this arguably annoying program: <http://www.workpace.com/>

It always pops up at the most inopportune times, but something simple like this should help you reduce use.

</comment><comment><USER5> I have a predisposition to RSI. My carpal tunnel was so bad by my late teens/early 20's that one doctor recommended bilateral surgery. Then I:

* Started taking large doses of B12 and B6 * Switched to Dvorak layouts on all my computer keyboards * Got a good buckling-spring keyboard * Gave up ballpoints, gel pens, etc. in favor of fountain pens * Gave up writing looped cursive (the way almost all American children are taught to write in school), learning to instead use Getty-Dubay Cursive Italic hand

Now I'm 30, and have no problems with carpal tunnel despite never having had surgery.

</comment><comment><USER6> Pushups. Something about the large body movements, maybe the strengthening, kills any RSI issues very quickly. This has made a huge difference for me and I've had others mention the same thing.

You don't need to do a ton, just some regularly. The <http://www.hundredpushups.com> program is actually very good for this, it provides a schedule and ramps up slowly. And hey, you're improving your health in the process.

</comment><comment><USER7> Got a nice digital piano, started playing vigorously on it. All problems went away.</comment>


Blockchain: What the Hell Is a Merkle Tree? (Simple Explanation) - <AUTHOR> https://medium.com/@htkibar/blockchain-what-the-hell-is-a-merkle-tree-65a3071f1ddb <comment><AUTHOR> Hi guys, author here!

I've just written a very short, hopefully good explanation for merkle trees. More of a layman's explanation type of a text but would love to get feedback. If it does not meet the requirements (I read them and didn't see any issues, however to err is human) please let me know and will delete it.

Thanks for your time and have a nice day!</comment>


How Jeffrey Immelt's 'Success Theater' Masked the Rot at GE - <AUTHOR> How Jeffrey Immelt's 'Success Theater' Masked the Rot at GE https://www.wsj.com/articles/how-jeffrey-immelts-success-theater-masked-the-rot-at-ge-1519231067 <comment><USER2> Don't you worry. He walked away with millions for such a enormous failure. The American dream for C-suiters.</comment>


There are copying, and there are shameless rip-offs - <AUTHOR> https://medium.com/@prabhaths/invoicely-a-hiveage-rip-off-b92fa411a2bb#.zbx1096o0 <comment><USER2> I'm an Invoiceable customer who ended up at Invoicely when they forced the migration upon us. Apart from the obvious issue with ripping off Hiveage (which I have commented on elsewhere), the way they handled the move was also horrendous.

There was no communication whatsoever about moving to a new system: I only got to know about the need to adopt this new tool when I tried to log in and was redirected to the new site. The data import process was buggy and I ended up with inaccurate reports.

I stumbled on Hiveage when I was looking for alternatives. What a surprise that was.

</comment><comment><USER3> Wow! The logo of invoicely.com looks similar to that of freelancer.com as well.</comment>


The Ghost in the MP3 (2014) - <AUTHOR> http://theghostinthemp3.com/theghostinthemp3.html <comment><USER2> > primarily designed by and for western-european men, and using the music they > liked

What is the point of this sentence? Any value this may have as a technical or art piece is lost by the random attack on the creators and their race.

I'm not even convinced that it is true. I was under the impression that they chose music specifically that was difficult to compress well.

<comment><USER3> It seemed like they had a larger social justice angle for the piece, then realized it didn't read well or forgot to write it in the first piece.

To be honest, I expected the article to go that route just from that statement, but refreshingly it didn't. While valid, the social justice argument is hard to take seriously - audio engineers are people, too, and you can't expect everyone to be aware of every single one of their biases. Especially not back in the times when MP3 was created.

Still, it would be interesting to read about the technical differences between music in different cultures. As technology spreads in the developing world, accommodating all cultures will grow as an issue.

<comment><USER4> So what wording should people use when they want to suggest that someone's culture constrained their thinking, without triggering the anti-SJW brigade? Some of those people are so easy to accidentally trigger and so sensitive. How could we have a conversation about this without upsetting them and the conversation subsequently degrading?

<comment><USER5> Instead of originating with gender and trying to fit in taste of music etc. into that. Start with what is relevant, the music, maybe that happens to fit nicely into what is considered popular for a specific group of people. Maybe not.

"It seems they targeted this kind of music which would have been quite typical for XXX during that time."

Or mentioning more specifically that they omitted this kind of music which could explain why it perform poorly in that context.

The quote also reads that they it was designed explicitly for western-european men, the gap between that and "they might have biases toward their own taste" is astronomical.

</comment></comment></comment></comment><comment><USER6> Once again a "null test" like this, completely disregards the fact that lossy codecs such as MP3 use a psycho-acoustic model to determine which frequencies can be discarded with minimal impact to what humans actually hear, and is therefore misleading if considered as a means for judging the audio quality of a codec... mildly interesting as an art project though.

<comment><USER7> I think that is literally what the project is about.

<comment><USER6> Just posted for clarity - I remember people getting the wrong end of the stick when it first became popular.

</comment></comment></comment><comment><USER8> Previously at [https://news.ycombinator.com/item?id=7955917](https://news.ycombinator.com/item?id=7955917), [https://news.ycombinator.com/item?id=9049196](https://news.ycombinator.com/item?id=9049196).

</comment><comment><USER9> This project seems to only use the LAME encoder, but it would be interesting to see if other codecs give different creative results. And now that the patents have expired, someone could even write their own codecs from scratch with interesting artifacts in mind.</comment>


Have FTDI kicked-off round 2 of the clone wars? - <AUTHOR> http://www.eevblog.com/forum/microcontrollers/ftdi-gate-2-0/ <comment><USER2> This is (still) a stupidly reckless approach to "addressing" the supply chain counterfeit problem.

One of these days they're going to brick a pacemaker and kill someone. You have to be a special kind of delusional to think that the courts are going to care about your "good intentions" when you knowingly release a driver like this.

And "pacemaker" is really a placeholder for any system that could end up affecting safety of life, regardless of whether it was intentionally designed to. How many of these FTDI chips do you suppose are on a 747? An elevator controller? A fire suppression system? A one-off alarm system at a power plant? A nuclear power plant? How many hoops do you have to jump through before you start to leave your comfort zone? Not many...

A single lawsuit from a bad enough accident could end the company in one fell swoop. This should be a much bigger existential concern for FTDI than _any_ amount of potential IP theft. If I were their general council, I would be looking for the vigilante engineer to sumarily fire, and put in place mechanisms to ensure that this never happens in the future.

<comment><USER3> I think the damage is done and more subtle than a huge public disaster.

When the fake-killer driver burst onto the scene previously, I just switched to microchip MCP2221's. It just wasn't worth the risk that I might accidentally source a counterfeit on a BOM and not find out until later.

If it says FTDI on it, its now a no go. Just no way to be sure anymore.

<comment><USER4> Holy crap, that part's incredible. Let me count the ways...

1\. It's half the price of a FT232R.

2\. It's available in SOIC. Much easier to solder.

3\. It's USB CDC compliant. No drivers required on most OSes.

4\. Along with GPIOs, its spare pins can also be configured for ADC or DAC operation. Also, it's got an I2C master.

It doesn't have a full set of UART signals, unfortunately, but it does have a couple of configurable GPIOs. There's also the MCP2200 which sacrifices I2C for RTS/CTS.

<comment><USER3> What sold it for us was my friend said, "Hey that one comes in DIP so we can breadboard and test..." Never looked back.

<comment><USER5> woah

</comment></comment></comment></comment></comment><comment><USER6> If anyone out there is looking for alternatives, last time this happened I switched to the MCP2221 from microchip. It's been in about 6 hobby projects now and I'm very happy with it. Half the price in small quantities and easier to hand solder (14SO or even DIP vs 28TSSOP)

<comment><USER7> Does it use a class CDC interface? Or does it require special drivers like the FTDI and Prolific chips? Are the drivers available for all OS's?

<comment><USER7> Answering my own question, it looks like it's a plain-Jane CDC device, which seems to me like really great progress - now that we've put Windows XP behind us, these chips really should be using CDC rather than proprietary drivers.

</comment></comment></comment><comment><USER8> It is time we get a meme with Richard Stallman saying "I told you so".

<comment><USER9> > "I told you so".

That breaking a license and using software with hardware it wasn't ever intended to be used with might produce undefined behaviour?

Don't get me wrong: It would be great if we had an open source FTDI driver. But putting the blame on FTDI for all the people effectively pirating their software isn't the way to go.

If you are a stern supporter of Free/open source licenses you also need to accept other peoples' rights to license their work as they think is right. Because without a strong licensing framework GPL & co. don't work either.

<comment><USER10> Here we go again. The issue here is that it's really difficult to buy chips directly from FTDI. So.. you have to buy from a distributor. Those distributors also buy from 3rd parties, trade inventory, issue new old stock, etc...

How can I, as consumer, be absolutely positive that that the "FTDI" chip in my device is genuine? I'll go ahead and answer that. I can't. Anyone who works in the electronics industry knows this. When everything is made in china, it's very hard to be sure that fakes don't end up where they shouldn't belong.

Why do I bring this up? Because, last time they pulled this crap, reputable brand's products were damaged. Somehow some fakes ended up in their supply and those customers got screwed.

OK, so sure, we can fix the supply chain, add expensive testing to the manufacturing process, buy direct from manufacturer, etc... or hey, I got a better idea. Let's just not buy FTDI any longer. That sounds much cheaper and less painful.

<comment><USER11> >So.. you have to buy from a distributor. Those distributors also buy from 3rd parties

In countries that respect IP this isn't a problem. The larger issue is China, Taiwan, etc don't respect IP and hard tactics like the FTDI driver bricking becomes a reality. No one wants to talk about the elephant in the room: Asian manufacturer corruption and lack of accountability with IP issues in those countries.

Lets get one thing straight here. Multiple people/management in the supply chain here know these things are fake. They aren't stupid. They know that a no-name manufacturer who suddenly undercuts everyone else and uses FTDI's driver is a counterfeit. They chose this knowingly to save cost and said 'fuck all' to any issues later down the line.

>Let's just not buy FTDI any longer.

Dell didn't need to buy FTDI to have the nightmarish capacitor plague issue. FTDI didn't make all the toxic dogfood that killed all those US dogs in 2007. FTDI had nothing to do with putting melamine in infant formula. Again, you're ignoring the real issues of how China and Taiwan and other governments do a "wink, wink, nod, nod" when its comes to IP issues and encourage and even protect counterfeiters for the sake of economic output and underselling those who respect IP.

Oh well, here comes the downvotes because on HN you can't criticize China, only Western nations.

edit: to the person who thinks the capacitor issue was just a 'QA issue.' It was corporate espionage against Japan from China to get around IP issues:

[https://en.wikipedia.org/wiki/Capacitor_plague#Industrial_es...](https://en.wikipedia.org/wiki/Capacitor_plague#Industrial_espionage_implicated)

<comment><USER10> > In countries that respect IP this isn't a problem.

I don't disagree with you, but you can't ignore the realities of the world. One of those is that almost all electronics are made in these regions (fake and genuine). This is why supply chain control is very difficult in these places. Additionally, supply chain control is not _my_ problem to solve. It's the vendor's (FTDI).

> Dell didn't need to buy FTDI to have the nightmarish capacitor plague issue.

None of those issues were created intentionally by a reputable company. Dell didn't intentionally start building bad caps. It was due to a QA process gap at a fairly reputable capacitor manufacturer. It was a mistake... In this case, FTDI is doing this on purpose. It's totally reasonable to blame FTDI for a problem they created.

<comment><USER12> I think GP's point was the capacitor issue was still a corporate IP issue. A (tampered) formula for electrolytic capacitor dielectric was stolen and the resulting capacitors were prone to premature failure.

I don't see that as a "QA process gap".

<comment><USER10> Dell didn't intentionally create that issue. They simply should have been performing better HALT to ensure they had coverage for bad caps. That's the qa escape.

In this case, there is no way to test for this as ftdi doesn't provide any way to do so. They simply break stuff after the fact. The only way to prevent this from happening is to not use ftdi branded parts.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> And the calls from my manufacturing clients are already beginning to roll in. Lots of expensive CNC machines are going to be idle this morning while local stores are raided for serial to USB adapters, tested, then returned.

</comment><comment><USER14> There's a term we in random ee blogs call this: being ftdicked

If you run a windows platform and you introduce FTDI chips in your design schematic, you run afoul of using accidentally counterfeit chips. Digikey and Mouser both have had this problem of counterfeits in their supply chain. And we aren't discussing FTDI-compatible chips, that do not counterfeit or claim to be FTDI. But the FTDI kills them all.

The safer alternative is to use a USB-serial chip that's cheaper, and doesn't harass users or nuke their chips: ch340G

Datasheet: [https://www.olimex.com/Products/Breadboarding/BB- CH340T/reso...](https://www.olimex.com/Products/Breadboarding/BB- CH340T/resources/CH340DS1.PDF)

<comment><USER15> And the real solution is to get a grip on your supply chain.

Somehow with FTDI chips it's "normal", "okay" and expected to get counterfeit goods. And heaven forbid the original manufacturer doesn't support you in your innocence.

But if someone ships you a fake ATtiny all hell breaks loose and the Chinese ebay seller must be punished, hours and hours are spent communicating with ebay, with PayPal, with other users' on web forums.

Hobbyist electronics people are strange. Wake up and give Mouser hell if they send you faked goods!

<comment><USER5> Well, that's kind of what FTDI is trying to accomplish. You won't buy from the same supplier again after getting a counterfeit.

<comment><USER10> LOL! Don't buy from farnell, mouser, or digikey? They've all had issues with fakes getting into the supply. Are we supposed to just up and boycott them all? And, once I've exhausted the top 3 distributors, now where do I go? I'm sure I can just call up FTDI and order 10k chips on a weekly basis right?

Actually, that's a pretty good idea. Anyone who works in supply chain, switch to ordering directly from FTDI. They'll soon realize the folly in this decision.

<comment><USER16> It's their responsibility to make sure that they're selling me what they promised me. If they can't do that, then maybe I shouldn't be purchasing from them.

<comment><USER10> Ok fine. Link me the spec that allows me to determine whether an FTDI part is genuine and I'll gladly inform the supply chain, manufacturing and testing teams I work with to reference that spec moving forward. Until then, we have to avoid anything with an FTDI brand as there's no way to be sure. Going with whomever I think is the most reputable supplier and then praying my products aren't bricked at some point in the future isn't the solution.

<comment><USER16> Again, that is all their responsibility.

<comment><USER10> Who is this they you are referring to? If ftdi doesn't provide specs, resellers can't create them out of thin air. My only option is to not buy ftdi.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Why do people need a FTDI driver, it appears that Windows has a USB Serial Class driver? [https://msdn.microsoft.com/en- us/library/windows/hardware/dn...](https://msdn.microsoft.com/en- us/library/windows/hardware/dn707976\(v=vs.85\).aspx)

At least on recent OSX the OS CDC one seems more robust than the FTDI provided one if you pull a cable while it's running. (I assume it's a genuine chip, who knows!)

<comment><USER18> People need a FTDI driver because the UARTs by FTDI aren't "class compliant". Just as most other interface chips aren't "class compliant".

Here are all the drivers for "proprietary" USB UARTs that are currently supported by Linux: [https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/usb/serial)

Here's the class compliant "Abstract Control Model driver for USB modems and ISDN adapters": [https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/usb/class/cdc- acm.c)

<comment><USER19> One gem in the driver heap is Linux' FTDI driver: [https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/usb/serial/ftdi_sio_ids.h#n33)

<comment><USER20> Hah. Wonderful.

      /*
       * Certain versions of the official Windows FTDI driver reprogrammed
       * counterfeit FTDI devices to PID 0. Support these devices anyway.
       */
      #define FTDI_BRICK_PID		0x0000

</comment></comment></comment></comment><comment><USER21> While I don't like that FTDI is pushing their brick-making drivers out over automatic updates, I think the folks calling for everyone to ditch their chips are a little over the top.

Personally, I would love to have a reliable way to detect counterfeit chips. For FTDI I do! Now it is trivial to lot test my chips: Just put one (or a few depending on your level of quality) on a test jig and use the latest driver with it.

Contrast that with one of these other generic pieces of silicon. Is the argument that since the drivers are generic it doesn't matter if counterfeits make it into your products? Of course it still matters! Every single datasheet value that you used in your design is now out the window.

FTDI should absolutely be more forthcoming with their counterfeit detection process. It is going to be a tough call next time I need a USB-Serial chip. FTDI has a great product and documentation, but a future update might break my device if it used counterfeit components that were so far undetected.

<comment><USER22> The correct thing to do would be to throw the user a warning... not cause irrevocable harm. It's not going to stop the counterfeiters, it's just going to hurt legitimate customers.

This would be akin to the government poisoning cocaine shipments with anthrax to try to stop the drugs from flowing in. You won't stop anything, you'll only hurt "innocent" people.

<comment><USER23> No, not cocaine. That implies the end users are actually doing something socially undesirable.

A better analogy would be the government enforcing an import ban by adding sugar to the petrol imported from specific countries.

</comment></comment></comment><comment><USER24> Recently I bought a 3D printer from China, and surprise, can't flash the Arduino chip. This was a bit of a set back but after a little googling, I found a work around and was backup and running.

Here is the patch for anyone who's interested, [http://kiguino.moos.io/2014/12/31/how-to-use-arduino-nano- mi...](http://kiguino.moos.io/2014/12/31/how-to-use-arduino-nano-mini-pro- with-CH340G-on-mac-osx-yosemite.html)

</comment><comment><USER25> Somedays ago discovered that my FT232 which I used to develop a FTDI user- space driver for Android is a counterfeit one. Ironically the feedback I've received about this project is mostly positive.

I now have to test the Flow control and the parity/frame... signals so I hope I wont have to buy one.

Before the 1st FTDIGate, as a guy who has implemented user-space drivers for the most common USB to serial converters my opinions about the FTDI were quite good (from an engineering standpoint I really like the solution they use to send the CTS,Parity status, Break... in a two bytes packet every 40ms which it is a good simulation of a serial port instead of having to poll sending control commands) but now I would recommend to avoid them.

From my humble experience I would recommend CP2102, they work fine (and have a nice documentation for driver developers). The CH340/CH341 is real pain.

</comment><comment><USER26> I can't say I'm feeling sorry for the counterfeiters. Now it sucks if you got suckered into thinking you had bought one thing and ended up with another, back when RAM was both expensive and in short supply(and Intel was still making it) it was not uncommon to have "grey market" RAM with Intel markings but substandard chips.

It is always interesting to see the mechanics at play too, people who get counterfeit chips are more often (but not always) people who have released all "quality" requirements in order to achieve the lowest possible price. As being price preferred they put themselves at risk of getting substandard parts, and then when they get parts that don't work or work anomalously, they frame that problem as someone else's problem rather than their own choice.

In the referenced forum post you have a person using "Chinese clone" Arduino nanos which happen to have chips on them that report as FTDI USB to serial converters but are in fact something else. So drop the vendor or have the vendor write their own USB driver for windows but why hate on FTDI for identifying the bogus chip and refusing to work with it?

<comment><USER27> Because they're breaking the _consumer_ 's experience, not the vendor's. I guess their assumption is that angry consumers will trickle up to the vendor and cause them to go "genuine," but that seems unlikely to me. Why? Because as a consumer, I have no way of knowing whether the FTDI product I'm buying is genuine. It adds risk to buying anything that says "FTDI" on it. I'm not going to vote with my wallet for some nebulous, unverifiable assertion that a chip will be real FTDI before I get it. I'm going to vote for something I know I can plug in and use.

Already a lot of counterfeit users of FTDI (i.e. knockoff Arduinos and cheap "VAG-COM KKL" auto diagnostic cables) are switching to CH340 instead of buying real FTDI.

<comment><USER28> > Already a lot of counterfeit users of FTDI (i.e. knockoff Arduinos and cheap > "VAG-COM KKL" auto diagnostic cables) are switching to CH340 instead of > buying real FTDI.

The driver situation for CH340 seems a bit sketchy. Whenever I've considered buying cheap Arduino Uno R3 clones via aliexpress.com, but then first went searching for CH340 OS X drivers, all I've found have been drivers on random sites whose provenance seems to be "I found this somewhere". Often these are unsigned drivers so I'd have to disable driver signing to use them, although last time I looked there was a set of signed drivers floating around.

For Arduino knockoffs, I prefer something that uses the same hardware that a genuine Arduino would use, or something that works with the CDC driver that comes with the OS. For Uno R3, this is the clone I'm using for development [1]. It uses an ATmega16u2 to handle the USB, which is what a genuine Uno R3 uses.

[1] [http://www.amazon.com/gp/product/B00P2FX9WY?psc=1&redirect=t...](http://www.amazon.com/gp/product/B00P2FX9WY?psc=1&redirect=true&ref_=oh_aui_search_detailpage)

</comment></comment></comment><comment><USER29> Whatever is on the knockoff nanos now seems great. cg340 or something. 5 years ago I had a hell of a time trying to unlearn parallel port crap and figure out all the ftdi hype, aaand now I don't have to worry about it. Stupid move ftdi.

</comment><comment><USER30> It is impossible to detect counterfeit chips electronically. The driver can only check if something produces signals that when interpreted as USB protocol indicate the FTDI PID/VID, but crucially it cannot know if this is the correct interpretation. That depends on the presence or absence of the trademarked USB logo on the device. It's entirely possible that the device has no USB logo, in which case it is not officially USB and the data the driver is interpreting as FTDI PID/VID could mean anything.

<comment><USER31> If the device doesn't have the USB logo, it means they didn't pay the USB implementors forum. There are plenty of devices which implement USB, but don't pay the license fees. It doesn't mean they just output garbage. I've also seen devices with the vaunted logo on them which failed spectacularly when it came to following USB specs.

I'm not sure what point you're making regarding the infeasibility of detecting counterfeit chips. It's not like these chips were bricked by accident. FTDI is specifically going out of its way to exploit bugs in these clones to brick them. So it looks like they have the detection thing pretty well covered.

You'll note that the opensource linux drivers works just as well with the clones. That's because they do not expend extra effort to make them not work.

<comment><USER30> The point is it's possible to build something that does not use USB, but which uses an almost identical protocol differing only in the meanings of the PIDs/VIDs. If it's based off USB 1.0 then any patents have expired, and if you don't call it "USB" or "FTDI" there is no trademark violation. In that case you would be doing absolutely nothing wrong, but the FTDI driver would still falsely detect it as "counterfeit".

<comment><USER30> Not sure why I'm being downvoted here. In the USA, deliberately using counterfeit trademarks is a crime, not just a tort (see [https://en.wikipedia.org/wiki/Trademark_Counterfeiting_Act_o...](https://en.wikipedia.org/wiki/Trademark_Counterfeiting_Act_of_1984) ). The standard for being found guilty of a crime is "beyond reasonable doubt", not just "preponderance of the evidence" as it would be for a tort. There is no way to electronically establish counterfeiting has occurred beyond reasonable doubt, because the completely legal scenario I described is electronically indistinguishable. It's not acceptable to go accusing people of crimes when you know you can't meet that standard of proof.

EDIT: As a practical example, consider the case of I2C. This is a proprietary NXP protocol, and you have to pay to get slave addresses. So instead people use "Two Wire Interface", which is not I2C but is electronically indistinguishable. The only way to detect counterfeit use of I2C is looking at the packaging/documentation.

<comment><USER32> >you have to pay to get slave addresses

You what? But there's only a hundred of them.

<comment><USER30> There's also 10bit addressing mode. I couldn't find a reference to address fees on NXP's current website, but as recently as 2013 they had a FAQ on their website mentioning address allocation fees: [https://web.archive.org/web/20130401000000*/http://www.nxp.c...](https://web.archive.org/web/20130401000000*/http://www.nxp.com/products/interface_control/i2c/faq/)</comment></comment></comment></comment></comment></comment>


In the investor community, cannabis is smoking hot - <AUTHOR> https://www.thememo.com/2017/06/21/investor-community-cannabis-smoking-hot/ <comment><USER2> A couple years ago when Colorado legalized it I made a list of openly traded companies, thinking it'd be a huge investment opportunity.

I was too risk-averse to jump in, but I found my list of potential stocks and their prices about a year later. Of the dozen or so stocks, about half were delisted, one or two were at about 80% of what they'd been then, and the rest were on life support.

Anecdotally, I took it as a good thing I'd stayed out. Really, each of these companies I had very little information about other than that they were "doing that new thing everyone's excited about". So... if you're going to invest, make sure you know the company you invest in and aren't just following the advice of a puff piece courting your cash.

<comment><USER3> Given the US federal regulations against cannabis (and lack of interest from the banking system at large) I'd put forward that the bulk of the interesting deals in the space aren't publicly traded, so there would definitely be a negative bias to the public tickers you mention.

</comment></comment><comment><USER4> I think I've mentioned this a few times now, but more than half the fund I know that beat the market last year did so in no small part due to Marijuana stocks. Infact the space has been hot since about 2015.

Canada in particular has seen the a proliferation in growers listing on the venture exchange and we're in the middle of a round of consolidation in the industry. As a side note, this is one are that Canada leads the US, in small IPO's for junior companies, we've got a better setup for getting small companies listed and available for taking public money.

The Canadian government is gearing up to legalize it next year and there is a huge rush on to become one of the main suppliers, most analysts figure that Canada alone can support 4 -5 major growers.

My current thoughts on pot stocks is that there is lots of money to be made selling gear and being a grower, There probably own't be too many profitable companies started to sell weed to the public, as its up to individual provinces to determine distribution.

</comment><comment><USER5> I went to an industrial grower trade show last year: "Cultivate 2016". Interestingly, there was one Cannabis exhibit, but it's clear more are coming. Once one of the big dutch-owned greenhouse operations starts growing cannabis, it's all over for the little guys :-)

[http://cultivate17.org/](http://cultivate17.org/)

These guys are mentioning Cannabis support:

[http://cultivate17.mapyourshow.com/7_0/exhibitor/exhibitor-d...](http://cultivate17.mapyourshow.com/7_0/exhibitor/exhibitor- details.cfm?ExhID=33469)

[http://cultivate17.mapyourshow.com/7_0/exhibitor/exhibitor-d...](http://cultivate17.mapyourshow.com/7_0/exhibitor/exhibitor- details.cfm?ExhID=124891)

</comment><comment><USER6> Interesting. I would think the only safe investment in this industry are the ones that don't touch cannabis itself since a dispensary can't use traditional banking and is mostly cash business. What I've seen are vertically integrated cannabis business that start as a dispensary, become a producer, and if successful own head shops, edible wholesale, cannabis wholesale, tools of the trade collaboration, etc. The problem is if the federal government wanted to, that whole business can be turned off overnight. So the only safe investment I would imagine are companies that invent technology used in the industry but detached from marijuana itself.

</comment><comment><USER7> Are there publicly-traded companies that are invested in this market, or is this a case of, "you have to be rich to make money"?

<comment><USER8> You could invest in an ETF like this, or pick some companies from its holdings: [http://www.horizonsetfs.com/ETF/HMMJ](http://www.horizonsetfs.com/ETF/HMMJ)

</comment></comment><comment><USER9> One of the underappreciated beneficiaries of cannabis legalization is going to be the food industry. Millions more people are going to be constantly getting the munchies and spending a lot more money on food.</comment>


Ask HN: Ideas for curl.sh website - <AUTHOR>

Hello everyone - I am looking for ideas for an opensource project to do with a newly acquired domain ( curl.sh ).
I was thinking of a warning site like fixubuntu.com, but feel like I could develop something more useful.
Thanks, Kyle <comment><USER2> A reputable host for all those "curl <url> | sh" commands you see these days? Basically, verified to not do something like rm -rf /.

<comment><USER3> How would he establish reputability? I trust rvm.io or brew.sh or whatever else as much (or even more) than I'd trust curl.sh, but there's always the risk that the site has been compromised by a third party, or there's a MITM attack.

</comment></comment><comment><USER4> An interactive javascript shell for demonstrating useful curl commands and allowing users to test their own commands?

<comment><USER5> Similar to hurl.it - seems like if you do something around executing shell scripts via curl... Would be interesting</comment></comment>


Programming Algorithms: A Crash Course in Lisp - <AUTHOR> http://lisp-univ-etc.blogspot.com/2019/07/crash-course-in-lisp.html <comment><USER2> > _It is much easier to explain Lisp if we begin from a blank slate._

More so than any other language I know of, Lisp's reputation precedes it. Everyone seems to know all about Lisp. It's remarkably rare to find people who genuinely want to explore Lisp the way they do other (newer) languages, with no preconceptions and biases.

It also seems people do things less and less out of sheer (scholarly) curiosity these days.

<comment><USER3> You mean the Greedy Ghost [1] has swallowed up everything in it's path? I agree. I've almost got my ass kicked on a few interviews for daring to say I do Lisp in my free time. "Lisp?! What the f __* do you wanna do with thaaat?! " was more or less the answer that I've received. If it doesn't bring any more $$$ in your pockets you're just wasting your time.

[1] [https://www.rt.com/op-ed/465466-europe-tourism-greed- profit/](https://www.rt.com/op-ed/465466-europe-tourism-greed-profit/)

<comment><USER4> I earn money for working in Clojure. And I feel it provide a huge advantage.

I do Haskell in my spare time too. Once you're used to FP, going back to imperative languages feel like a terrible regression.

<comment><USER3> I wanna earn money doing FP work, too!

Of course, Common Lisp spoiled me beyond words. I've tried OCaml the other day. It might be a good language, but I can't seem to make it integrate nicely with the Emacs workflow that I was used to from Common Lisp. You need ;; at the end of your expression when in the REPL, but not when building a standalone app in OCaml. When compiling it's considered bad practice to put ;; But without it, the REPL doesn't know where the expression ends. Or something like that, anyway.

Same story with Prolog. It might be a good language, but there are all sorts of special cases and exceptions when working with it interactively. I've gotten so much used to working interactively, to have a live, one-on-one honest conversation with my language and environment that languages without it seem brain-dead somehow.

I agree with your "terrible regression" comment.

<comment><USER5> Try [https://github.com/triska/ediprolog](https://github.com/triska/ediprolog) for a great interactive Prolog mode for Emacs. Much better that SLIME (as I remember it from briefly playing with it ten years ago): There is no notion of moving code from your edit buffer to a REPL, the code in your edit buffer _is_ your program. Queries are also part of your program (using special comment syntax) rather than entered in a separate REPL and lost when you close that.

I think Tuareg-mode also makes the OCaml part a lot less painful. It's a bit unfair to compare Lisp used with tight Emacs integration to OCaml used seemingly without the corresponding integration.</comment></comment></comment></comment></comment>


New open office UI prototype  - <AUTHOR> http://blogs.sun.com/GullFOSS/entry/prototyping_a_new_ui_july

<comment><USER2> Looks like they ripped off Office 2007. Some people hate the ribbons, which I can understand, but I actually enjoy them. They kind of categorize different functions, so once you learn where something is, you can use that knowledge when you're looking for something LIKE it.

</comment><comment><USER3> I think it's... disappointing... when people say that OpenOffice is a Microsoft Office clone, especially when they append "let's be honest", like it's something every Linux user has to admit and live with, like we have no choice and it's a raw deal.

I disagree with that, or at least I really want to and think that changing that is possible and healthy to the bottom line outcome of what something like OOo can become. But we look at what position open office is placed in <http://www.codinghorror.com/blog/archives/001215.html>, yet OOo has the daunting task of being a true competitor against Microsoft office, an office suite backed by a huge organization, even when compared next to Sun. I guess, from their perspective, they can mimic all MS Office's features within OOo and offer their product for free, and maybe that's enough to compete, but then it doesn't make OOo much better than it's competitor, it really just makes it a free clone, which is disappointing because it can be so much more.

Personally, my experience with the ribbon was negative, I thought it took a lot of screen real estate (especially since I always worked on a laptop) and essentially disrupted my previous toolbar work flow that I had spent time customizing. Whether OOo is making a 1 to 1 copy of the ribbon, I don't know, I haven't used it in such a long time, i forget what it looks like, but the opinion on the matter seems clearly laid out on the topic link.

Now that they are doing a UI redesign, now is a good time to define themselves, a lot like how Blender is and always has defined itself with it's UI <http://www.cgcookie.com/articles/blender-25-overview>. What blender has done was always amazing, and now, with 2.5 they are doing it again! that's crazy! and no one would ever call Blender a maya clone, or a 3dsmax clone. So i think, cloning something isn't really healthy, you don't create an identity, and I fell now OOo has a chance to finally define itself, do a little UX research and really define itself for it's users, create a different and better user experience we look out for and talk about and really compete with MS Office by offering something new.

If they don't do this now, then it's as if (us Linux users) we're never going to amount to anything more than users of a Clone platform in the desktop space, and at that point, we might as well cede: [http://lifehacker.com/5290955/mac4lin-gives-linux- desktops-t...](http://lifehacker.com/5290955/mac4lin-gives-linux-desktops-the- complete-mac-look)

</comment><comment><USER4> The comments on the linked page say it, but it bears repeating: why blatantly rip off the features of your competition that are bad?

<comment><USER5> It's hard to call the office ribbon UI 100% bad. I've used it to some extent and it's actually grown on me. It's certainly weird and different, but they clearly put a lot of thought into it. In particular, the allocation of tasks to the different tabs is usually very good, and the automatic switching between them usually happens at the right time. I very frequently find myself looking for a toolbar button and immediately finding it because it showed up automatically.

What really gets me is, now that everybody has a wide-screen monitor, why do we continue to put administrative debris at the top and bottom of the screen? Most of what we care about (web sites, word processing, email) is tall and narrow anyway, so there's a lot of unused space on the sides.

<comment><USER6> Not enough people in the business world are using widescreen monitors or even "decent" resolutions. Executives and business types actually choose to use 1024x768 or sometimes smaller just so the text is bigger and easier to read. Shell has over 100,000 users worldwide on its intranet and have only just recently upgraded from IE6.

Most corporations have strict operating guidelines.

</comment></comment></comment><comment><USER7> Will I be able to select a chunk of text Or the entire document) and change the font size with some simple keyboard commands ( < and > , perhaps)?

The issues with the OOo UI are more in things being arcane or clunky, not the absence of pretty visual widgets.

</comment><comment><USER8> On Windows that looks fine, but I wonder how that will look on say Linux or Mac OS X. Even MS didn't copy their ribbon style over to Office 2008 (they used something similar though). I hope OOo will do the same.

</comment><comment><USER9> Drop it now.

Copy photoshop toolbars on the sides.

Monitors have more width than height.

<comment><USER9> Idea: Use two sidebars, one fixed to the left for formatting (never change its buttons so users don't get lost), one to the right that changes based on probable actions like working with tables as soon as you enter a table, or image manipulation, etc.

Leave just the menu on top for more vertical space for the document.

I'll use that.

ps. resize toolbars and use small icons when using monitors with resolution less than 1024x768.

<comment><USER10> What I love about your comment is that your idea is already possible with today's Open Office. Just no one takes advantage of it.

<comment><USER9> Then make it the default for next version, just redesign it to be part of the layout with huge buttons instead of just a toolbar dragged to the side.</comment></comment></comment></comment>


'Austerity, That's What I Know': The Making of a Young U.K. Socialist - <AUTHOR> https://www.nytimes.com/2019/02/24/world/europe/britain-austerity-socialism.html <comment><USER2> So the UK is facing a potential economic crisis and an exodus of businesses due to Brexit, and yet they want an expansion of the welfare state?

Where are they going to get the money? The deficit is already 2% of GDP and they're £1.7 trillion in debt.

Source: [https://www.ons.gov.uk/economy/governmentpublicsectorandtaxe...](https://www.ons.gov.uk/economy/governmentpublicsectorandtaxes/publicspending/bulletins/ukgovernmentdebtanddeficitforeurostatmaast/june2018)

<comment><USER3> Corner shop economics is not a model for a nation. I take it you are still working from Reinhart and Rogoff.

> The deficit is already 2% of GDP and they're £1.7 trillion in debt.

This after ten years of austerity. It's not what they promised.

</comment></comment><comment><USER4> The selection of photos (or effects) really seem designed to portray Brighton as some kind of grim slum where the sun never shines. Brighton has high levels of sunshine and a beach. It is also close to the South Downs National Park (with some very nice villages), and close to some stunning cliffs. It's not as grim as the dark moody pictures would make you believe.

<comment><USER5> Brighton's also got one of the highest suicide rates in the country too which was surprising to me as I grew up very close to there and love the place.

[https://www.theargus.co.uk/news/16885281.brighton-has- third-...](https://www.theargus.co.uk/news/16885281.brighton-has-third- highest-suicide-rate-in-the-country/)

<comment><USER6> I also love Brighton, but honestly it doesn't surprise me hugely. There's a lot of common variables that coincide high suicide rates. It has nearly the highest population density in the South East, and a very large student demographic, both which are linked to high suicide rates. You could probably pick out some other variables too, like the fact it's a commuter town, or it has a large demographic of LGBT+ people, or it has a lot of artistic 'creative' types, who also all have high suicide rates compared to the average population.

</comment></comment></comment><comment><USER7> Is this sort of thing news to people in the US? Brighton and Bristol are places people go to drop out (a little), and spend their youth getting involved in fringe politics.

I'm sure there are cities in the US with that sort of scene too.

The irony is that both of these cities have also gentrified, massively, over the last ten or so years. He is now railing at having trouble making ends meet when working a bar kitchen, in about the lowest-end of chain pub we have in the UK, and one of the most expensive towns (outside London). Not that there is anything wrong with Wetherspoons, and everyone should have somewhere decent to live. But...

</comment><comment><USER8> > The panic eased when he found a job as a kitchen assistant at a J.D. > Wetherspoon pub.

This is the same everywhere where people get a degree of a hobby subject. As a renter myself, I have not been allowed to do fixed on the property I rent, so I had to hire semi-professionals (gives you an invoice, but had a weekend course) to fix some piping, painting, electricity issues, etc. I used to be charged between £65-£75 per hour (10x the national minimum wage) and I had to wait for weeks to arrange an appointment. I assume this is the same in every developed country, where people go and get masters in "marketing" or "international communication" but there is a huge demand for people who get things done, even in questionable quality.

</comment><comment><USER9> There is a spectre haunting Europe...

<comment><USER10> Oh you are going down the historically inaccurate "S" in Nazisim?

<comment><USER11> Wrong context - it's a line from the Communist Manifesto.

</comment></comment></comment><comment><USER12> I'm sure it's designed to manipulate, but the photography is beautiful.

The last photo of the bus is absolutely gorgeous, almost looks like an oil painting.

</comment><comment><USER13> The UK tax burden is set to reach a 40 year high by 2025. It's currently at ~37% of GDP, which hasn't been seen in the past 30 years.

<comment><USER14> The problem is that spending is at 38.95%, down from 43.75% in 2010. UK Government spending in real terms is best described at a plateau for the past 10 years rather than slashed. The Government and Opposition were both happy (for different political reasons) to portray what we experienced as mass cuts. They weren't compared to what happened when the IMF imposed greater cuts in a single year back in the 70s.

The credit crunch destroyed government revenues, in response the Government ballooned the deficit rather than impose massive cuts. They've spent the past decade not growing spending so that GDP growth has caught up - in the process massively increasing the national debt.

It's great that young people are getting involved in politics. One can't but help think of the much attributed quote: if a man is not a socialist by the time he is 20, he has no heart. If he is not a conservative by the time he is 40, he has no brain.

</comment></comment><comment><USER15> Does anyone have links to actual numbers on the austerity policy in the UK?

Every time an article like this pops up, I look and stupidly fail to find any numbers specific to what years had what funding reduction in what program and what the total funding of the program was before. So it's "austerity" but I don't know what that means beyond spending cuts and tax increases.

<comment><USER16> [https://en.wikipedia.org/wiki/June_2010_United_Kingdom_budge...](https://en.wikipedia.org/wiki/June_2010_United_Kingdom_budget#Measures_introduced) has some numbers, as does the main article: [https://en.wikipedia.org/wiki/United_Kingdom_government_aust...](https://en.wikipedia.org/wiki/United_Kingdom_government_austerity_programme)

<comment><USER15> Sure although I found these and none of this is digestible in a meaningful way. The best figure on the second link is a graph on disposable income, which says nothing about the claims of spending reduction. Similarly, the first page, which I also found, has "numbers" on it but nothing to give context to relative spending, as in, to prior years.

The closest thing to what I am looking for is apparently here: [https://en.wikipedia.org/wiki/Government_spending_in_the_Uni...](https://en.wikipedia.org/wiki/Government_spending_in_the_United_Kingdom). To find it, you have to search for UK budget without mention of "austerity".

I assume this gets to the heart of why anyone would 'downvote' me here for asking for simple information, there's a strict anti-intellectual force on HN that has a problem with anyone digging in to what "austerity" actually means. When you search for anything specifically related to "austerity" in the UK, unsurprisingly, you're met with articles containing photographs, but no real numbers to give you an idea of what "austerity" means in terms of relative changes to the government's budget.

What would be REALLY nice is a chart like this: [https://en.wikipedia.org/wiki/United_States_federal_budget#/...](https://en.wikipedia.org/wiki/United_States_federal_budget#/media/File:US_Federal_Budget_Comparison_2016_vs._2015.png) (but for the UK, and with more years to compare, or remove the comparison aspect and just give me raw numbers, year by year). Presumably, I could find this on some UK government website in PDF form, but why didn't NYT do this instead of some puff piece about a kewl, hip young socialist.

<comment><USER17> >I assume this gets to the heart of why anyone would 'downvote' me here for asking for simple information, there's a strict anti-intellectual force on HN that has a problem with anyone digging in to what "austerity" actually means.

Yes, I found your downvotes disappointing too! Chin up, the votes often seem to get better over time, as remedial voting is done - i.e. voting up of greyed-out things when you wouldn't bother usually etc. Who cares anyway. You're asking uncommon questions on here perhaps, and surprised they're downvoted? Complaining about voting gets you more downvotes, rightly so.

The only reason I can think of is that you wrote 'stupidly', and read very quickly your comment looks like a complaint about the article. Maybe if you'd put more of this detail in the initial comment.

p.s. Be very careful of nursing political conspiracy theories on here. ("there's a strict anti-intellectual force on HN that ..") People are convinced HN is right wing, left wing, and everything in between, and are totally certain of that. The political topics do tend to be more..careless and loose on here, perhaps unsurprisingly.

</comment></comment></comment></comment><comment><USER18> These people, they love to play communists, they don't have a fucking clue how it actually is to live in a communist country, where there is no freedom of speech, or going on strikes.

</comment><comment><USER19> Apparently, socialism for all is the answer when he...

1\. Chooses to study to be a doctor in one of the most expensive places in the UK rather than staying at home and studying locally or moving up north where rents are significantly cheaper.

2\. Gets a place to stay that is more expensive than he ca n afford in an expensive town. Everything else, of course, will be expensive as a consequence.

3\. Has to work to pay rent, chooses a job with anti-social hours which will, of course, make his ability to concentrate and therefore study a very difficult subject even harder.

4\. Whilst supposedly being in debt, they cover their body in tattoos which are not cheap or necessary to survive.

5\. Drops out, which is a worse decision that borrowing your course fees and putting them all on black in the casino as you've guaranteed lost your money, also months of your life and others around will almost certainly consider it a sign of poor decision making.

Everyone should watch the Yuri Bezmenov video on YouTube to show just how effective the KGB subversion in the west was - these kids will give up capitalism without even realising or believing they've been manipulated.</comment>


Reducing isolation at work is good for business - <AUTHOR> https://hbr.org/cover-story/2017/09/work-and-the-loneliness-epidemic <comment><USER2> I took a 15-20% pay cut to move to a town that had college and high school friends. I missed out on a lot of the real bleeding edge type technical challenges that SV has and I feel like I'm taking crazy pills trying to drive change in our organization. However, I never have a problem unwinding after work and am far from burnout. Having this support structure here is probably worth that 15-20%.

Edit: I should note that I really hate mixing personal & work and that I have very few 'friendships' in the workplace that I take outside of work.

<comment><USER3> I did the same, stayed in Upstate New York after college, my commute is 5 minutes, traffic is low, zero stress, travel the world on company money, tons of good food, and drinks, I go home for lunch. I think about what I "missed" going to the west coast grind, but now that I'm older, I realize I favor low stress / getting plenty of sleep, over working long hours and long commutes to work on bigger tech. Plus this affords me the time to work on all of my side projects, which is what really gives me pleasure. I don't think I'll regret in my final days, that I wasn't able to work more for someone else.

The ONLY caveat I can think of, is if I was offered something very unique. Something progressing humanity. But slaving away for another X for X, isn't going to happen.

<comment><USER4> Totally hear you.

I'm living in a small college-town-adjacent city in rural New England and though I occasionally have pangs of desire for the SV life of some college friends, working for an established company that is not a historic software powerhouse makes stress super manageable, makes me a big fish in a small pond, gives me time to hack on side projects, and opportunity to perfect my hobbies (wood-fired pottery, cooking, and yoga). I took what feels like a big pay cut but cost of living compared to BOS, SV, SEA, or NYC at least zeros that out.

Of course there are problems where adopting technologies/best-practices, hiring a team, or speed of development is like pushing molasses up a sand dune, but leaving that at the door at the end of the day is worth it to me.

Will that balance change? Who knows. The future is hard to predict, but right now it makes a lot of sense to me.

</comment></comment></comment><comment> EZ-E Something I noticed, is that young people commonly suffer from loneliness when making the transition from student life to working life.

Leaving the friends from student life... And not really able to make meaningful friends during working life. I had several people talking to me about this

Now, I have no idea whether it is a recent thing or not.

<comment><USER5> I think that people these days are not as comfortable with being on their own as they were years ago. I grew up in the 1970s and 80s and as we weren't continually interconnected with everyone else we spent a fair amount on time on our own. You became accustomed to planning ahead, travelling on your own to meet your friends with no communication, if they weren't there you either went home again or tried someone else's house.

There were also, I think, more people into hobbies such as stamp collecting and model making. They were fairly solitary for much of the time.

I've nothing scientific behind this but it seems to fit with what I see, we don't feel lonely and lost if we don't have continual stimulation.

<comment><USER6> Very true, as someone who grew up in the 80s and mid-90s, we usually met "friends" for an hour or so in a day and the rest of it was spent with solitary pursuits and perhaps with family. These days we're "connected" 24x7 thanks to the Net and particularly mobile. Almost everything we do is either over these mediums or at least shared on them, commented upon, collaborated and so on.

Individual activities like gardening, woodworking, philately, reading a book, birdwatching, stargazing, painting and so on are either increasingly waning or being substituted by their "online" and "connected" doppelgängers.

<comment><USER7> > Very true, as someone who grew up in the 80s and mid-90s, we usually met > "friends" for an hour or so in a day and the rest of it was spent with > solitary pursuits and perhaps with family. These days we're "connected" 24x7 > thanks to the Net and particularly mobile. Almost everything we do is either > over these mediums or at least shared on them, commented upon, collaborated > and so on.

Yes, and on the other hand it sometimes feels as if this leads to social fatigue. Meeting someone face to face sure felt different and more...worthwhile (for lack of a better term) growing up in the 90s, when it was the only way to keep in touch with friends. Compare this to today where social gatherings are preceded, surrounded and accompanied by constant, always and immediately available, often lesser ways of communicating - whether it's social networks, group chats, messages.

Of course I don't want to paint a pure black picture - I enjoy those options as much as the next guy, but it comes with side effects I guess.

</comment></comment></comment></comment><comment><USER8> If you put people against each other in a mindless internal competition instead of supporting a proper collaboration (and not a fake one that requires some to sacrifice a lot so that others can step over them), what else than a massive isolation could be outcome? Also, not many people mistake colleagues with friends either, so any community within workplace is a non-working fix as people tend to forget each other quickly when they change jobs.

</comment><comment><USER9> Why is this article concentrating so much on forging social connections at work? People's social lives should be built outside work, not the result of corporate workplace sociality-boosting programs.

<comment><USER10> I'm very skeptical of corporate programs that try to meddle in their workers' personal lives, but why should people's social lives be built outside work? A workplace is the social setting in which most of us spend most time, seems like a waste to limit those bonds.

<comment> wu-ikkyu >why should people's social lives be built outside work?

Because it is much more genuine, easier, and less risky.

There are countless laws, regulations, and policies dictating how one is to act in the workplace: you must dress this way, you must use only approved language (no swearing), you must not speak on controversial topics, you must not offend anyone.

A simple joke can get you reported to human resources and potentially fired.

<comment><USER10> _Because it is much more genuine, easier, and less risky._

Right, but they're not mutually exclusive, so how they compare relatively is irrelevant.

 _There are countless laws, regulations, and policies dictating how one is to act in the workplace: you must dress this way, you must use only approved language (no swearing), you must not speak on controversial topics, you must not offend anyone._

Every social situation has its rules with which one must comply. The workplace may be more restricted than one's home or a bar, but hell, even in totalitarian states with political polices people managed to have friends.

If one is in a particularly bad workplace, or have difficulty reading its social context, sure - it's better to keep one's head down and be merely polite. But as a rule, seems quite excessive.

<comment><USER11> certain topics are off-limits for discussion with coworkers even if they occur away from the office.

For example, if I feel strongly about pro-choice but my coworker, she feels very strongly about pro-life, then there may be some extra politics I need to deal with work. While she might not directly shown her distain, instead it'll be a bunch of subtle things she does that negatively affect the relationship. Ideally, political interest would have no effect, but realistic they might. I'd rather not take that chance. That's why I only talk politics with friend outside work.

Secondly, I'd personally rather not talk about my private relationships and family with coworkers. If i was going through a divorce, I would not talk about that even with my closest coworker.Again, I would discuss that with a close friend outside of work. At work, people's status matters more. You always want to portray an image to look strong, positive. At work everybody has a job title, with friends outside of work, there are less stakes on 'status'.

</comment></comment></comment></comment></comment><comment><USER12> If I worked someplace large enough to have peers like me, this article's stance on finding a community within the workplace might seem more palatable.

The only truth I can see from my own perspective on this subject is that one solution won't fit for all.

In my context, the issues being with not having any workable solution.

Maybe that's another feature that guilds, unions, and other professional organizations provide industries that have them.</comment>


Ask HN: Tracking Desktop PC Statistics - <AUTHOR> Hi,
I'm currently using an app called "WhatPulse" to collect a limited set of statistics pertaining to how I use my desktop computer. It's nice, but I'd prefer something more thorough/comprehensive in terms of what gets tracked.
I vaguely recall reading here years ago about something maybe Wolfram was involved in that tracked far more data points than WhatPulse does. But I'm not fimding it in the HN search.
I don't know if there's anything publicly available to do tracking like what I'm after. With my luck, that functionality was some home-grown app I wouldn't be able to get my hands on.
What do you know about this?
Thanks,
-c <comment><USER2> For info about how much you use each application, use [https://www.rescuetime.com](https://www.rescuetime.com)

For info about your programming, use [https://wakatime.com/](https://wakatime.com/)</comment>


Wolfram Alpha added to Bing - <AUTHOR> http://gadgetwise.blogs.nytimes.com/2009/11/11/bing-now-with-more-wolfram/

<comment><USER2> Alpha is really struggling to find a successful use-case for its technology. It has a ridiculously powerful math engine behind a semi-working ontology (not saying that theirs is bad, just that all general ontologies are "semi- working") that's driving a rather poor natural language parser (again, pretty much all NLP's are "poor"). In effect they are trying to use the ontology as a poor AI to "understand" the NL.

People who want to use Alpha have to deal with it through the NLP window. And since it pretty much spends most of its time screwing up their input upon interpretation and not giving them what they want for even fairly simple cases, it tends not to get used except for very few areas of trivial encyclopedic fact comparison (population of Borneo and the population of Hawaii). In effect turning Alpha into a "comparison engine" not a "computation engine" using facts and data anybody could find just as quickly using Google.

For people that have the knowledge to query non-NLP systems, the power of Alpha is locked away behind the sucky NLP interface with no recourse. In effect, it's like putting a Ferrari engine in a combine harvester with a broken steering wheel.

So now, the idea is to stick Bing's query engine on top of Alpha's NLP engine, which is on top of their ontology?

That's like taking our franken harvester and putting a good car audio system in it as well.

</comment><comment><USER3> I wonder who's profiting more from this deal, Wolfram Alpha or Bing?

<comment><USER4> it seems like a good idea for both of them. but in absolute terms, bing probably has more to gain.

<comment><USER5> Wolfram Alpha has a lot more to lose... Microsoft is a gigantic company. This has gotta be Wolfram's #1 revenue source now, and they needed it badly.

<comment><USER6> I assume you mean it's Wolfram _Alpha's_ #1 revenue stream, not Wolfram as a whole.

<comment><USER5> I do.</comment></comment></comment></comment></comment>


Tom Mullaney on Alphabets, Chinese Characters, and Computing - <AUTHOR> http://blog.lareviewofbooks.org/chinablog/time-get-qwerty-qa-tom-mullaney-alphabets-chinese-characters-computing/ <comment><USER2> As a non-native Chinese speaker, I have to agree that using the IME can make conversation very fast. I can reduce many popular sentences down to only a few button presses. However the author has completely ignored Bopomofo and Cangjie, popular in Taiwan and Hong Kong respectively.

But as for it driving innovation? The way our QWERTY Latin input works now it is good enough whereas without an IME Chinese would have to type in Pinyin or use massive keyboard. So the incentive to innovate isn't as great but implying that will slow down Latin based IT doesn't really make sense.

</comment><comment><USER3> According to that thesis Japan should be way ahead of China.

They have the same input difficulties, but way longer to deal with them.

Nothing about the Chinese writing system is a driver for innovation. Chinese innovation comes from the economic boom and a big drive to advance.</comment>


A 30 year-old one line BASIC program is the subject of a new book - <AUTHOR> http://www.itworld.com/it-management/324600/code-cultural-artifact <comment><USER2> This is a great piece of history. A free digital copy is available <http://trope-tank.mit.edu/10_PRINT_121114.pdf>

</comment><comment><USER3> Misleading title. A small BASIC program serves as an introduction to one topic in the book. This is like arguing that "It was a dark and stormy night" is the subject of a mystery novel.

</comment><comment><USER4> An alien race will find this, convince themselves it's some kind of divine code and drive themselves insane trying to figure it out.</comment>


Show HN: UI Playbook – A documented collection of UI components - <AUTHOR> https://uiplaybook.dev <comment><USER2> I feel like many commenters didn't bother to give 2 minutes to check out the site to get the gist of it. Sure, on first glance it does look like Yet Another design system or an alternative to Storybook, but in fact it's something else. This is sort of a wiki for common UI components, i.e., there's information on when to use them, how to implement them, common gotchas, and so on. Since using a 3rd party design system is not feasible for many businesses, I think this has the potential to be a great resource.

<comment><USER3> I think author wouldn't have this problem if they wrote "Best practices for common UI components" instead of "The documented collection of UI components" as the header.

<comment><USER2> Fair point

</comment></comment></comment><comment><AUTHOR> Hey!

After my first experience with design systems, I decided to kickstart a project called UI Playbook which is my attempt to document common UI components, their functionality, best practices, accessibility requirements, and examples.

If at least one person finds this useful — it's a win!

<comment><USER4> What's your general thought on adapting one of the bigger design systems with thousands of hours of improvement & polishing vs building one from scratch?

I do think there is need for a common vernacular in these components, however I think that too often teams start from scratch when they could pull something off the shelf, and swap out some colors.

List of corporate sponsored design systems: [https://designsystemsrepo.com/design- systems/](https://designsystemsrepo.com/design-systems/)

<comment><USER5> At some point you're fighting against the design system more than you're using it. It's The same reason that I wouldn't build a web app on WordPress. WP is great if what you want is a WordPress site. Otherwise, you're just trying to shoe horn _your app_ into WordPress. Most of these things aren't difficult to build and can be picked up a la carte and customized to whatever extent.

<comment><USER4> The depth & flexibility in many of these libraries is quite extraordinary.

Totally agree with the Wordpress example, however, I'd argue that more products & applications should attempt to be build upon known primitives to reduce cognitive overload for both the building team and the end users.

</comment></comment></comment></comment><comment><USER6> I would recommend a couple of things:

Sidebar with links to headers similar to other documentation sites.

And if you are going to provide insights on accessibility, which is great, make sure your site is also accessible.

<comment><AUTHOR> Care to elaborate which parts weren't accessible for ya? Thanks.

<comment><USER6> Install an accessibility tool such as the Wave browser extension and you can see some of the issues... eg. missing form label and contrast.

</comment></comment></comment><comment><USER7> Very cool resource! Thanks for creating it.

Accessibility is a whole beast in itself. It'd be cool to give quick suggestions on how to make the components accessible. The W3 docs are good if you want to dive deep and understand the nuances, but a quick handy reference of good accessibility patterns for common components would go a long way. For example on buttons you could add something similar to this: [https://a11y-101.com/development/aria- disabled](https://a11y-101.com/development/aria-disabled).

Overall, looks awesome!

</comment><comment><USER8> Not as i expected but, great work, continue, maybe in the future it doesn't just a display of only 5 different things that i already know, and one of them isn't clickable.

</comment><comment> jagged-chisel > yes, there's a search for 5 components

I mean, the 5th one isn't even available yet, just a teaser. :)

</comment><comment><USER9> I don't get it, why isn't the "select" box opening, i.e. showing a dropdown?

<comment><USER10> The select at the top isn't actually a select input, if you scroll down to examples it has an actual select box.

<comment><USER9> You're right. Hmmm, I don't think it's very good UI design to show a UI element that turns out to be just an image or a button.

</comment></comment></comment><comment><USER11> nice, will bookmark it for later use when there will be more content :) thanks for the effort!

</comment><comment><USER12> What are the main differences between this and storybook?

<comment><USER13> This is a website detailing various UI components whereas storybook is a development tool where you can manipulate and view components you are building locally (although some people end up hosting a static version of their storybook somewhere).

</comment></comment><comment><USER14> What UI components did you use to build the site.

</comment><comment><USER5> Nice! This is awesome!

</comment><comment><USER15> Why no spinbox?

<comment><USER16> Had to look it up. I think these are more-commonly called "Number Input Box" ?

</comment></comment><comment><USER17> Was wondering why OP only seems to recommend reach-io as examples, turns out they are a contributor. It's all open source so like, you're not doing anything malicious for profit here, but it would come across as disingenuous if you didn't mention being a contributor to the most prominently linked example system if this is supposed to be system agnostic documentation

<comment><USER18> > but it would come across as disingenuous if you didn't mention being a > contributor to the most prominently linked example

No it wouldn't. That's a lot of disclaimer burden to put on someone.

<comment><USER17> > That's a lot of disclaimer burden

No it is not, a disclaimer is very low effort. Here is an example disclaimer: "Just a heads up, I am a Reach-UI contributor!"

That is in no way a large burden, still gets the message out about both UI Playbook and Reach-UI, and is just the more respectable thing to do here. I really don't think OP did anything WRONG, there is clearly no malice here, it's just an observation I had to better communicate in the future for the people like me who care about these details, I know I am not alone here.</comment></comment></comment>


Ask HN: Age preferences for grad school? - <AUTHOR>

I have been offered a sweet deal at a great grad school but I am nearly 30 and feel like I'm a bit old for it. Any pros and cons from your experiences as to good ages and limits for grad school? <comment><USER2> If you can afford it, why not? You'll learn a bunch of cool stuff, have time to think about what you want to build, and meet interesting people. Grad school for me, was the first time where age didn't seem important. We just worked on fun stuff and socialized as little or as much as we wanted.

The only real con is that your earnings will take a hit during, and maybe, after depending on what you're working on. It also depends on the sweetness of the deal.</comment>


Ask HN: Is black-hat hacking harder now than it was 20 years ago? - <AUTHOR>

As a kid I was fascinated with stories of people hacking into high security places like the pentagon. But I recently realized that, while this was surely no walk in the park even 20 years ago, it must have been easier then that it is now. Things like ssh or vpn weren't around back then, and even though I'm sure they had equivalents, they were probably proprietary and thus not as secure as today's time-tested open source solutions. What do you think? <comment><USER2> Interesting question. I'll add one more to it if you don't mind. Even if getting into the pentagon might be harder, do you think there is more data that is a) easy to get via hacking and b) useful? If so, this is an important way in which hacking is easier than it was before.

I might think there is more data like this since more people put more data on computers with less knowledge about how to protect it.

</comment><comment><USER3> I'd say no it isn't in the aggregate harder. There are a few of forces at play that I think lead to this.

First of all you can now buy pretty good hacking tools in a can (CANVAS, Core Impact) that come complete with non public exploits. If you don't have the money, metasploit is pretty good as well. This drastically reduces the need to know the details of a particular exploit, and reduces the amount of toolsmithing required to pull off a penetration. Also, the reality is that exploits are now a business - they're for sale, for better or for worse, on the open market. If there's one thing our PWN2OWN competition at cansecwest proved, it's that for a sufficient amount of money someone will find you a hole in anything. If you have money, even if you're not that knowledgeable, being a blackhat isn't that hard.

Second, there is more stuff to exploit now than there has ever been before, both on and off the net (I'm looking at you SCADA). At least some of that stuff will be low hanging fruit built by programmers who either did not understand how to build secure systems, or didn't expect that those systems would be reachable in the way they are now. As the internet expands, and stuff keeps getting more smarts added to it, I think there is probably a trend in which new insecure stuff is being built faster than the old stuff is being secured (not that I can prove that). Things that previously weren't considered to be security critical, now are (XSS is still barely considered a "real" exploit).

Third, information about exploits, how to write exploits, and how to find vulnerabilities is now massively more available, both because of the change in philosophy around full disclosure, and because we now have more than a decade (two maybe?) of open research into the field. Bugtraq can be argued to have revolutionized security research because it opened up what was previously secret to the eyes of interested amateurs and academics. Today there is a community of security researchers who openly publish information that previously was only the domain of governments and the occasional large defence contractor. I think probably the public community is better at it too.

Balanced against this is all the research and technology on the defensive side (also helped by full disclosure), the forced public shaming to fix-their- broken-shit of various vendors (full disclosure again), and generally better knowledge of security best practices (anyone want to guess what I attribute this to?). All of which is to say that the things that worked 20 years ago are harder today than they were 20 years ago (social engineering sadly seems to be just as easy, and if anything more prevalent now) but it hardly seems to matter since lots more is easy now.

</comment><comment><USER4> I have been fascinated with stories of really clever hacks into systems. I've also been told to setup a scheduled database backup and when I opened the first backup to check it was going to work, found unencrypted credit card and billing details (only a year or two ago). Only a few weeks ago I found a small company system which ships with a default admin password (a dictionary word, no less) which the end user cannot change. Weird.

Putting two and two together, I suspect that some extremely clever hacks happened (and still happen, I guess), but many many more were probably fortuitous stumbling on horrible or utterly absent security in some overlooked corner; as per dnsworks comment, except - is logging into a password-less account really 'hacking'?

</comment><comment><USER5> Absolutely. 20 years ago telcos didn't bother adding password protection to digital "switches" because they didn't even consider war dialers or the proliferation of internal documentation through bulletin boards. Unix vendors like Microsoft (Xenix), SCO, and Sun left password-less accounts (like Root, Operator, Sync) on workstations which were then immediately plugged into a shared-bus network. Not to mention the wide-open nature of the various X.25 networks like Sprintnet which were used for inter-bank communications.

<comment><USER6> OTOH, learning about that stuff was much harder in those days; it was much more underground and word-of-mouth.

<comment><USER5> I don't know about that. Within a month or two of buying my first modem in 1992 I was on bulletin boards that had FIDOnet subscriptions, which quickly gave me enough information to be dangerous.</comment></comment></comment>