'Fleeceware' apps overcharge users for basic app functionality - <AUTHOR> https://news.sophos.com/en-us/2019/09/25/fleeceware-apps-overcharge-users-for-basic-app-functionality/ <comment><USER2> Similar abuse occurs in Apple's ecosystem as well. It was really easy to subtly sign someone up for a $99/week subscription, but I'm not sure if this is still the case. A lot of these scam apps appeared regularly in the App Store's "Top Grossing" charts — easily millions of dollars every month were/are going to these kinds of apps.

This is an interesting example of incentive alignment — in some sense, it's in Apple's best interest to let this abuse slide since they're also profiting off of it (though obviously that's not a long-term, deliberate strategy).

This article covers it well: _How to Make $80,000 Per Month on the Apple App Store_ ([https://medium.com/@johnnylin/how-to-make-80-000-per- month-o...](https://medium.com/@johnnylin/how-to-make-80-000-per-month-on-the- apple-app-store-bdb943862e88))

<comment><USER3> How are these apps getting past app store review?

<comment><USER4> I wonder if the prices can be adjusted after the app is published. So the scammer publishes the app with a reasonable price, gets past review, then ups the price and profits.

<comment><USER5> Yes, you can apparently do this via App Store Connect.

</comment></comment></comment></comment><comment><USER6> This is blogspam of [https://news.sophos.com/en-us/2019/09/25/fleeceware-apps- ove...](https://news.sophos.com/en-us/2019/09/25/fleeceware-apps-overcharge- users-for-basic-app-functionality/)

The only thing this user does is submit articles from secalerts.co, and almost all of them are blogspam.

<comment><USER7> Thanks, we've changed the URL to that from [https://secalerts.co/article/android-apps-sold-for- hundreds-...](https://secalerts.co/article/android-apps-sold-for-hundreds-of- dollars-on-google-play-store/8690bdea).

</comment></comment><comment><USER8> We can whack this mole, but really we just need a credit law (or convention from VISA/Mastercard) applied in as many countries as possible that says all charges on a credit card need to be pre-approved.

So if you want to take $99/month from my CC I have to approve it, using a PIN, and say how many months I am happy for this to go on for. Basically what Paypal offers to terminate subscriptions should be at the card level for all transactions.

This will stop the whole class of "forget to unsubscribe" type scams.

In the meantime hopefully everyone hit will do a chargeback which would force Google to do something.

<comment><USER9> > We can whack this mole, but really we just need a credit law (or convention > from VISA/Mastercard) applied in as many countries as possible that says all > charges on a credit card need to be pre-approved.

That would help, but it wouldn't completely stop the abuse. I recently decided to try out the VPS offerings at [a major cloud provider]. I paid for one month of a VPS with Paypal, quit using it before the end of the month, and didn't pay for another month. Unlike every respectable cloud provider I've ever used, they apparently wanted me to navigate their interface to figure out how to cancel the VPS and do that. Instead they kept it running for another two months (they say), and after one attempt to contact me by email (which I missed), turned my entire account over to collections, with all the mess that entails for me.

So even preventing recurring charges won't necessarily help if the companies move to _claiming_ that you never canceled your subscription and then trying to bill you for it later, or sending your account to collections.

<comment><USER10> Awful. I had the same experience with Online.net. A prepaid service that was paid, and then I cancelled through the bank, forbidding them from charging me, YET the kept the service running for a month, but I couldn't cancel as they blocked my account for non-payment (impayé). In the end I left the account in this state and stopped caring.

As far as I had understood it, if I don't pay, it SHOULD be suspended and deleted immidiately, NOT kept running and then the provider claiming I owe them for that service.

<comment><USER9> Yep! Very similar situation in my case. Since Hetzner requires you to give them a name, phone number, address, etc. it's very easy for them to track you down later when they want to pull this scam.

> As far as I had understood it, if I don't pay, it SHOULD be suspended and > deleted immidiately, NOT kept running and then the provider claiming I owe > them for that service.

With every VPS I've ever used, this is the case. The nice ones will send you a warning before shutting it down a few days later. I'll steer clear of online.net because of your warning.

</comment></comment></comment></comment><comment><USER11> The deal is that trial apps ate allowed to charge $ after the trial ends.

To avoid it users have to uninstall and tell the developer. Since nobody reads and understand these fine prints, charging after the trial is ok, as it complies with Google rules.

No laundry here...

<comment><USER12> The fix could be pretty simple: Have the trial API built so that it locks out the app at the end of the trial and presents a pay-to-continue or uninstall option dialog the next time the user tries to use it.

</comment></comment><comment><USER13> My daughter often wants to download iphone games.

A lot of these games will charge $4.99 per WEEK for access to keep playing without ads, etc.

A lot of pc games cost much much less than that.

And while I am talking about the cost of games [https://itch.io/](https://itch.io/) is a fantastic place for free and cheap and pay what you want games.

<comment><USER14> Yes, this weekly subscription model for games even to just remove ads has become annoying. Thankfully you can just subscribe to AdGuard Pro for $3/year (yes, it's that cheap) and set it to use AdGuard DNS - this blocks ads in mobile games nicely.

</comment></comment><comment><USER15> I've always thought this would be a money laundering opportunity. Sell an app for an outrageously high price, buy App Store gift cards with dirty cash, and then buy your app from yourself. You could almost certainly get an army of cheap labor to buy your app on their phones if you gave them a gift card worth say 110% of the app's cost. You'd lose a pretty big chunk to App Store fees and taxes but it'd be clean.

<comment><USER16> It's probably still easier (and with less loss) to sell $500 gift cards for $450 on eBay

<comment><USER17> Seems like that'd be a tricky proposition. There are a lot of people who would be happy to buy your $500 gift cards at $450.

</comment></comment></comment><comment><USER18> Reminds me of the I Am Rich app on iOS: [https://en.m.wikipedia.org/wiki/I_Am_Rich](https://en.m.wikipedia.org/wiki/I_Am_Rich)

<comment><USER19> There's a massive difference to the app you link to.

The I Am Rich App was totally upfront about what you get. Namely: You pay 999$ for a red gem (as I recall) on your phone's display. There was nothing sneaky or underhanded about it.

Essentially it was an app for people who wanted to prove that they have money to blow, but coughed from smoking cigars, lighted with 100$ bills.

The idiocy of it was part of the concept, but the app was very upfront about what it does and what it costs.

This is different in that you get a crappy, redundant app, which is "free", but sneaks a very expensive subscription model of which you are not aware, which is not really mentioned (or if, then in very dark patterns) and of which it's very hard to get out.

The first is, arguably, an expensive piece of conceptual art (not on the phone, but on a meta level) the second model is outright fraud.

What's discussed here is very different.

</comment></comment><comment><USER20> > they overcharge users for functionality that's widely available in free or > low-cost apps.

The first thing I thought of here was YouTube charging me to play music with my phone locked in my pocket.

<comment><USER20> Another example that comes to mind.. headphone companies purposefully/artificially downgrading their sound quality on lower end models with cheap foam or something, while still using the same exact hardware as the higher end model.

<comment><USER21> Which headphone company does this? Genuinely interested, as I am very into portable audio, and haven't heard anything about it.

</comment></comment></comment><comment><USER22> In a way, good that they charge stupidly high amounts (the article has screenshots with claims of >100gbp/usd). That high, most people would make some noise to get it back. If it had been 10$ or similar, more people would either not notice it, or they would just jot it under the "well, shit, lesson learned" account.

</comment><comment><USER23> And Google is allowing this.

<comment><USER24> I fail to see the problem here. There are dozens of these apps offered for free, some the developer decides to charge per month. User just has to find the free ones.

Should Google now tell app developers what to charge? That's ridiculous.

<comment><USER25> No.

But Google and Apple ought to require clear disclosure of price and conditions. Also, free trials shouldn't transition to paid usage without explicit authorization.

<comment><USER24> Ok and your first point, but your second point...That's exactly what a free trial is by definition. It's free for a period of days until you are a paying member.

<comment><USER25> Not really. Payment should require authorization _at the time of payment_. I mean, what's the point of a free trial if you must commit to paying in order to start the trial?

I do understand that this is a common dark pattern. But common or not, it ought to be illegal. And these bullshit apps are _perfect_ examples of why. So is the New York Times, but that's a different fight.

</comment></comment></comment></comment></comment><comment><USER26> There is a legitimate reason for that. If you unpublish an app, existing users can't download it. The workaround is to put a high price so nobody will buy new copies.

<comment><USER27> Is that still true, though?

I think I've seen cases of apps being unpublished for new purchases (even free ones) but still available for downloads of existing users in both Google's and Apple's stores.

<comment><USER26> I had recently unpublished an app of mine expecting it would still be available for purchasers, didn't work. Had to resort to the outrageous price trick.

<comment><USER28> That's strange–I wonder why unpublishing didn't work for you. I have seen several apps be taken off the store by various companies but remain on my list of Purchased apps on the App Store. I can still download the apps but not see the entry on the App Store when I tap on the app's name for details.</comment></comment></comment></comment>


Color Theory For Designers - <AUTHOR> http://www.smashingmagazine.com/2010/01/28/color-theory-for-designers-part-1-the-meaning-of-color/ <comment><USER2> Color me unimpressed, but this is just another surface level analysis of very rudimentary ideas. I think it was in preschool where I learned ideas like "green is the color of leafs and grass", and "yellow is the color of the sun".

To say that a site looks professional because it employs a deep blue is fundamentally misleading, because all the examples they give are sites that would look just as professional with a red layout. Don't believe me? Try changing the hue of one of those screenshots. The composition of a design as a whole creates our impression of it, and I feel giving out reductionist and simplistic advice like SmashingMagazine so often does just makes things worse for people who were lost to begin with.</comment>


Amazon Web Services Certification Program - <AUTHOR> http://aws.amazon.com/certification/

<comment><AUTHOR> Nothing grabs the attention of the average corporate IT worker like a certification program - be interesting to see if they can replicate the traction of the certification tracks offered by nearly every established enterprise IT company.</comment>


NASA plans to open the International Space Station to commercial business - <AUTHOR> https://www.nytimes.com/2019/06/07/science/space-station-nasa.html <comment><USER2> [https://news.ycombinator.com/item?id=20125081](https://news.ycombinator.com/item?id=20125081)

</comment><comment><USER3> Assuming this works in attracting some big names to visit, I think this is a good move. It will shine a light on the program and in this day and age you need that to survive, get funding, and attract more investment.

</comment><comment><USER4> Huh, I thought they were planning to deorbit it soon. Is this a major change?

</comment><comment><USER5> Gross. Keep the Ferengi off humanity's ship.</comment>


Open letter to a depressed VC (state of funding) - <AUTHOR> http://techmeetup.co.uk/blog/2010/05/a-letter-to-a-depressed-vc/

<comment><USER2> I've heard this same story everywhere outside Silicon Valley; Not enough big exits, means not enough angels, means not enough seed capital, means too many service companies and almost no product companies.

pg's talked a lot about being ramen profitable and as a decent engineer you should be able to put away $15k and take 3 months off to go build a startup.

Except capital is only one piece of the puzzle. Building a real product company takes a lot more than just capital. I don't know what a good solution is, but atleast NYC seems to be solving it with pumping more early stage money into the system and slightly easier access to mentors. But even here we don't have a lot of people with the time, inclination and big exits behind them the mentor and nurture younger entrepreneurs...

<comment><USER3> You don't need mentors to have your company take off. You need a good idea, the ability (which includes runway, meaning cash) to execute, and the wisdom to learn from your mistakes. If you're a decent engineer with a little saved up, all you have to do is come up with (1) and recognize if you're capable of (3).

<comment><USER4> You might not _need_ mentors but I'll bet good ones help.

There's a lot to learn in so many domains and good mentoring can speed up that learning substantially.

</comment></comment></comment><comment><AUTHOR> At the techrunch+engage event yesteday held in edinburgh, one of the investors bemoaned a lack of innovation in scottish startups.

We have an excellent grassroots community growing and an abundance of engineering talent but still a relatively minor successes.

The letter is from a local startup founder (who also started techmeetup) to the vc about the lack of bottom tier funding.

<comment><USER5> I wonder if it's a similar problem that is seen in Australia. Plenty of talented folks, but a real lack of innovation/big thinking. There are two main problems in Australia.

1\. Lack of capital. Larger Australian companies and investors don't "get" the value and potential of startups, and there isn't a strong network of angels. I'm also shocked at some of the valuations I've seen in Australia for companies that end of raising a lot more overseas. A company that may be valued at 100k in Australia would be valued at 3 million in Silicon Valley.

2\. Lack of gumption. There is this very odd cultural thing called "Tall Poppy Syndrome" in Australia, which is essentially that everyone should know there place - if you rise too high you'll get cut down. People aren't encouraged to think big.

<comment><USER6> Tall Poppy Syndrome is not a cultural oddity. It's prevalent (but named differently) in Japan, Scandinavian countries, UK, Ireland, Germany, Canada, New Zealand, the Netherlands, economically depressed areas of the USA, most of the Midwest, and so on and so forth. I would wager that at least half of the world's cultures have the tendency to try to cut down the tall poppies...

<comment><USER7> Its a line from Livy's history of Rome. <http://www.hup.harvard.edu/catalog.php?recid=24381>

An early King of Rome sent his son out as a spy pretending to have run away from the tyranny of his father.

Rome's enemies promoted him to a senior position. When their spys told him that his father was cutting down the tall poppies, this was the signal that he should mount a coup against the leadership of the enemy towns - which he did and they all fell under Rome's control.</comment></comment></comment></comment>


We should all follow Linus's example - <AUTHOR> http://blog.erratasec.com/2015/11/we-should-all-follow-linuss-example.html <comment><USER2> _" His rant is designed to inform. The Linux kernel is a work of art based on certain consistent principles, such as not needlessly obfuscating implementation details. He takes the time to yet again lay out his philosophy that guides the kernel. Yes, his language is strong, but I'm not sure how else he'd communicate the unreasonableness of the code in question."_

Here's a re-write of Linus' critique - in more polite language, but just as informative:

[http://catcode.com/comments/2015/cf20151101.html](http://catcode.com/comments/2015/cf20151101.html)

If you had submitted that patch, which version would you have rather received, Linus' or this one? I'd much prefer this one, and when I review other peoples' code, that's the style in which I write.</comment>


Word Mover's Embedding: Cheap WMD For Documents - <AUTHOR> https://vaclavkosar.com/ml/Word-Movers-Embedding-Cheap-WMD-For-Documents <comment><USER2> Thanks for introducing a new (to me) idea. I didn't watch the video but I felt the write-up could have been more cohesive. Perhaps just a conclusion to tie all the ideas together. I'm also left wondering why we would use this WME approach over other document embedding techniques (averaging word vectors, paragraph vectors, smooth inverse frequency weighting, etc). Is it faster, gives better similarity estimates, etc.?

</comment><comment><USER3> Interesting idea!

Perhaps the 'random' docs could instead be generated (or even trained) for even-greater significance of the new embeddings.

For example: after doing LDA, generate a 'paragon' doc of each topic. Or coalescing all docs of a known label together, then reducing them to D summary pseudo-words – the D 'words' with minimum total WMD to all docs of the same label. Or adding further R docs into regions of maximum confusion.</comment>


House Overwhelmingly Passes USA Freedom Act Without Amendments - <AUTHOR> https://www.eff.org/deeplinks/2015/05/landslide-vote-house-overwhelmingly-passes-usa-freedom-act-without-amendments

<comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=9542185](https://news.ycombinator.com/item?id=9542185).</comment>


Ask HN: Should a login be a Username or an Email? - <AUTHOR> I've always wondered which one of the two is more user friendly - a username or an email?
An email is usually longer and involves special characters. A username on the other hand is usually easily forgettable.
So what is the best practice when it comes to picking up a user login attribute? <comment><USER2> In my services I usually use concept of identity associated with user account. Each account is allowed to have multiple identities, which can be used for credentials reset, login etc. The business data is always linked to an account, not to identity. Identities can be email, phone, username/password pair and 3rd party service account. This approach allows to fine-tune your security by customizing authentication/reset policy for each identity type and giving user enough flexibility.

<comment><USER3> How do you architect that, regarding DB, code and endpoints?

<comment><USER4> I usually model it so you have an Account model, which in itself is nothing more than a table with UUID and metadata like creation timestamps. Then you can have EmailIdentity, PhoneIdentity, FacebookAuthIdentity, etc. that are linked to the Account.

In a simple service you can start with just a foreign key from EmailIdentity to the Account. This allows multiple email addresses to be tied to a same account and the same account to have multiple authentication methods or identities (Facebook, email). This way you can implement e.g. changing email address by actually adding an email address and verifying it first, before deactivating the old one.

When you start to need e.g. organization accounts (think about services that have both personal and organizational aspects: Facebook with business pages and ad management, StackOverflow with companies), you can either tie the identities or personal Accounts to the organizational accounts, depending on the model you need.

It can be often useful to add Person model to the mix, which models a real person behind multiple identities / accounts, but this depends on your service.

</comment></comment></comment><comment><USER5> Thank you for thinking about the user experience. Recently, I had to forcibly change an email address that I had in my possession for over ten years. The service was shutting down.

It was incredibly annoying to change this value for some of the sites I had accounts with. Some of them assumed I had access to my old email!

Suggestion:

So, I would prefer you build into your design the concept of an "identity". The identity is me! I can _paste_ (I use keepass) in an email _or_ my username. Your software can figure out which one I'm using. Also, please allow me to use long passwords, and don't disable paste with JavaScript! Also, allow the email to mostly be a hidden key. I only want to use it to interact with you, not something revealed to the public at large.

<comment><USER6> Did those sites not have customer service reps you could contact to change your email address

<comment><USER7> iTunes lets you change the e-mail address associated with your account, but not your account name.

If you use an e-mail address as the account name and then that e-mail address goes away, you may be in for some serious hurt when you try to change the associated account.

Been there, done that.

<comment><USER8> You most definitely can change the email address that represents your Apple ID account.

</comment></comment></comment></comment><comment><USER9> I would steer away from using a username as a login. A person's default username may be taken on your site, in cases like these people usually use a variation by appending some numbers/characters. Now, when they try to login they'll use the default username first because they don't remember. Using email removes all these barriers.

Why even add a username? I usually don't add them unless they are necessary (in cases where a user's profile, other information needs a pretty url)

<comment><USER10> So much this.

Particularly, services which insist on you logging in with a username, but can send you your username by email if/when you forget it, should suffer horrid flaming death.

<comment><USER11> My god yes. I get caught up in this with Steam maybe once a year — frequently enough that I grimace in irritation at every Steam login prompt. Repeated logins using my email address and password, increasingly obscenely expressed frustration, follow the password reset process — emailing me a reset password link, at which point I usually remember why this keeps happening and go back to login with my username.

I mean, I understand that one could make a case for such a high-value target as Steam to not allow email/password pairs considering the high rate of password reuse. But I have 2FA enabled as well for heaven's sake. And I cannot believe that simply insisting on username/password pairs instead is better enough to justify it, compared to real best practice password policies. I mean jeez, how many username are just the pre-@ portion of the email address anyway??

<comment><USER12> On my desktop, Steam remembers the username, and just asks for the password. Do you do anything particular that causes the username to vanish? (I could only think of switching to a different account.)

<comment><USER11> Signing in from a different machine.

</comment></comment></comment></comment></comment><comment><USER13> I think the people in this thread saying things like "getting an email account is easy" need to spend more time observing some non-tech folks using a computer. Because actually that is a substantial barrier for ordinary people.

My service accepts both an email address and a membership number, and this helps enormously with account recovery in the astonishingly frequent case that someone changes job or ISP and loses access to their original mailbox. And it's amazing the number of people who mistype their email address.

For sign-in, we accept either and simply detect which one was used.

This also helps us to support multiple profiles per email address, which is a common case for families using our service.

<comment><USER14> Is getting an email address for tech folks even "easy" these days? Most services now seem to require a mobile phone number (virtual numbers like Skype numbers seem to be excluded). There are also various mobile operators whose numbers don't work, for whatever reason.

I've personally found getting a new address from gmail etc often problematic.

<comment><USER15> Gmail maybe, making an account at mail.com was dead easy. On the flip side, you have to keep pointing out "mail, without a g at the beginning," so who knows if that's worth it.

<comment><USER16> Gmail actually banks on the idea that most people just fill out whatever fields they are presented. The phone number is not actually required to register an account.

<comment><USER17> If you keep using the account at one point you'll be required to add your phone number or you won't be able to login.

</comment></comment></comment></comment></comment><comment><USER18> The beauty of just collecting an email is that you can use that for everything, including a lost password. Since most of my web apps are more private and account-based without communication among users, I tend to just create the account with an email and password.

I am working on a web app though that is more social, and I'm implementing something similar to Hacker News. Create a username and password and you are in.. with the option to set an email for password recovery and display purposes later on.

</comment><comment><USER19> Depends. I worked on a software for school which will be used by young children to learn spanish. It was a strict requirement to have usernames because these children don't even have an email yet.

Another advantage of usernames is to mask the email address specially if you run public forums etc. Also, this allows changing email address without losing identity on front end as you obviously dont want to display the database table id.

<comment><USER12> > you obviously dont want to display the database table id

Why not? A lot of services assign a user ID (literally a number) or contract ID, which I can read to the customer service rep on the phone so they can quickly find my account without having to go through the trouble of mistyping my given name (see username) at least once.

</comment></comment><comment><USER20> Facebook does it well, you can use your email, username and phone number to login.

If you don't NEED a username, refrain from using any, it's just annoying. Worse yet don't require one.

</comment><comment><USER21> It depends.

I used to require a username on my site but I chose to take it away because it meant nothing since I was collecting emails anyway.

My heuristic is if they interact with other users: Username.

If not, email.

</comment><comment><USER22> How about giving people the choice to choose whether they want their login to be an email or a username. It's daunting task for developers, but at the end of the day, we write code to make people's lives easier, correct?

</comment><comment><USER23> "I've always wondered which one of the two is more user friendly".

Well, I'd say neither one. I personally prefer OAuth and a sign in with X (github, google, facebook, etc).

This gives the user the most flexibility and quickest/easiest sign-in/register experience. They also get to pick and choose what you get access to and depending on what you need the user might not have to even give away his email.

<comment><USER24> Problem with this is that you assume your users will either have a github, google, facebook login.

While that may cover most people, there are increasing numbers of online users choosing to delete their facebook or google accounts.

If you want to use a third party login, remember to also provide a more traditional login option as well (email/username).

<comment><USER25> Also people who do use one or more of those services, but don't like the idea of linking each and every account to them.

<comment><USER26> This. Linking is one thing, but the other are permissions: sites asking for access to my contacts are disqualified straight away.

</comment></comment></comment></comment><comment><USER27> I would prefer email, but its not too big a deal.

What I hate is some stupidly strict password (numbers letter and special chars) for logging into something which I don't care much about - like some companies corporate jobsite. Whats the worst that can happen? Someone finds information about me that is already publicly available on LinkedIn.

</comment><comment><USER28> As a user, unless I'm logging into and using your product everyday, I'll definitely forget my login id in a few days and then go through the headache of trying to find my login id etc leading to a poor experience.

So unless you have a very good reason to do something different, stick to login ids as email ids

</comment><comment><USER29> An email address is not an immutable property of a user so I find a username is a better way to identify a user.

<comment><USER30> That's what database-level user IDs are for.

Don't push your technical requirements onto the user when it's not needed.

<comment><USER31> If someone uses their work email as a username, they loose their ID if they leave the job. Even worse, the employer may give the same email address to someone else.

<comment><USER30> If you're allowing emails as a credential reset mechanism, you've already got that problem.

</comment></comment></comment></comment><comment><USER32> I think a username works better here. Gives users more of an ability to customise their profile than an email would, might be a tiny bit more secure than with an email address (since someone with a hacked list of emails and passwords can't just test them out on the login form) and generally I feel it looks better to have a human readable username than a generic email address to log in with.

More importantly however is giving the user a way to choose what name is displayed in their profile/next to their content, and not doing stupid things like forcing a name based on the email address or trying to take the first and last names from a connected social media account.

</comment><comment><USER33> Funny that you should ask, yesterday I wanted a fast and simple way to do logins for a side project I'm working on and ended up writing a quick Django library that does passwordless authentication over email:

[https://github.com/skorokithakis/django- tokenauth](https://github.com/skorokithakis/django-tokenauth)

I would say email is significantly better than a username, as long as the user can change their address. An email is just much easier to remember. Of course, if your identifiers are ever going to be public, you need a username.

</comment><comment><USER34> We have already had a hard time selecting a email username (the part which comes before @). Now if you ask me to choose another username, I am going to be wanting the same email username because I do not want to remember another name. Its more difficult than remembering passwords. If your service becomes extremely popular then I will not get a proper username available (if I am one of the late to party guys).

So avoid usernames at all cost. Email is longer, but more often, who needs to enter it again and again, we anyways store it in stored passwords on chrome etc.

</comment><comment><USER35> > I've always wondered which one of the two is more user friendly - a username > or an email?

An email as either a login or the sole recovery mechanism means your user's accounts can be permanently lost (or impossible to create) depending on some other service providers actions. It's pretty much the same problem as OAuth only (relying on external providers), without the convenience benefit of single sign-on.

OTOH, if you are willing to use email-only recovery (and most services are), there is no additional harm in email-only logon.

</comment><comment><USER36> Just curious for people who are advocating for email how they deal with the following situations:

1\. The user gets a new email address. Instead of updating the email address on their existing account, they create a new account. Then they are confused when none of their data from their old account shows up when they login to the new one.

2\. The user gets a new email address and no longer has access to the old one. Then they forget their password and are unable to reset it because the reset email is going to a dead email address.

<comment><AUTHOR> 1\. This looks like a normal use case. It depends on your business, if you end up collecting more than just an email (e.g. SSN, phone #, etc.), then you can add a logic to prevent the creation of a new account from the same user. Otherwise, it looks just like the creation of a new account and shouldn't be handled has an exception by your app.

2\. On the user side you only present an email as a login. Though, on the implementation side you still need a user_id as your primary key. You can update the email attribute at anytime for an existing user_id. That involves an extra step to setup some sort of security questions so that a user can update the email address without having to access the account.

</comment></comment><comment><USER37> Same question has been asked over so couple of times, such as -

[https://stackoverflow.com/questions/1303575/what-are-the- pro...](https://stackoverflow.com/questions/1303575/what-are-the-pros-and- cons-of-using-an-email-as-a-username)

</comment><comment><USER38> It might be harder to do but it should be both since I use throwaway emails for new sites I discover but don't trust and remember the usernames. And register with email so I could do password recovery in cases I trust. I'm sure a lot of people do this.

</comment><comment><USER39> it was always a big question in front of any product person. It was primarily relized by user's own behaviour, people started using so many sites, it became almost impossible to keep a seperate user name for so many logins. In case they tried having a usique namer over a new property, sometimes it was avilable sometimes it wasn't.

Hence, email based login became omnipresent

Social logins / Open authentication were also tried. They are at many places, but they also pose some challenges.

There isn't a simple answer yet, but may be in the future, a device based finger printing, eye scanning or something else may be the answer

For now, or some years back actually, I gave up and chose Email based authentication.

</comment><comment><USER40> If you use an email address, be sure you don't use it as your internal key/identifier for the corresponding accounts.

Says someone who's "eternal" email address from a robust institution still very much a going concern, just went away.

<comment><USER41> Would you clarify why it's worse to use an email address than a username as an internal key/identifier? It seems to me in either case you suffer the problem of, if the email or username changes, needing to update all the "foreign key" references to the identifier throughout your database.

<comment><USER42> That would be my assumption, and feels like a good idea to me.

Use the e-mail as the login locator, but not as the primary key.

</comment></comment></comment><comment><USER43> no one is talking about the audience you are interacting with. Not everyone has an email and that does not mean they have to remain excluded.

Mobile phones are becoming a universal device, be it a rich or a poor, each one is going to have one. Hence the easiest and unique identifier is their phone number.

Now phone number is personal and could be easily tracked but the kind of audience that engages with phone number as a username is not much privy about their information when it comes to solving their problem or making their lives easier. The onus is on the system to make it entirely secure. With every data point, comes more responsibility.

<comment><USER44> OTOH it is pretty easy to get a free email address if you don't have one already.

However getting a phone number can be more work and isn't usually free.

Remember also that people may want multiple accounts on your service, ie for work and personal. Or for special purposes. (eg I have a couple of twitter bots but I'm only allowed to attach my phone number to one account).

</comment></comment><comment><USER45> I worked for a big company that spent considerable effort to migrate to an email-as-username solution. Not sure about the background but likely well researched. For big companies, these are definitely not arbitrary choices.

</comment><comment><USER46> As long as I can change the email address I don't care. I've had many email addresses over the years to which I can't log in anymore.

</comment><comment><USER47> I would say email. Actually, it's easier to remember and it may be longer, but the users can use the browser to autofill it.

</comment><comment><USER48> A username is an additional (if somewhat trivial) authentication factor.... I like to see them anyway.

</comment><comment><USER49> Email. No can can remember a username, especially not on your site.

</comment><comment><USER50> just use email so that user doesnt have to yet again think of another customized username for your service.

</comment><comment><USER50> email of course, not only is it uniquely identifiable but you have a way to verify and contact the user

</comment><comment><USER51> Trick question. None.</comment>


Truth, Disrupted |False news spreads online but it can be contained. Here's how - <AUTHOR> https://hbr.org/cover-story/2018/07/truth-disrupted <comment><AUTHOR> This is the best piece I have read on the topic.</comment>


The distributed language Hello v1.0.3 - <AUTHOR> http://www.amsdec.com/download.html

<comment><USER2> Here is the license for this ... thing.

[http://www.amsdec.com/license.html](http://www.amsdec.com/license.html)

Summary: it's an EULA. 'Hello' is licensed, not sold. The cost for a license is $0. It's copyrighted by AMSDEC. You may redistribute the Hello binaries and such so long as you include the EULA.

My opinion: the authors have never heard of the GPL but they might like it if they were to learn about it somehow.

<comment><USER3> There's something really weird about that website... The language does sound interesting -- though.</comment></comment>


CMC Cartonwrap box packing machine [video] - <AUTHOR> https://www.youtube.com/watch?v=9rP1wjEsbak <comment><USER2> This appears not to be a machine made by Amazon, but rather a commercially available machine called CartonWrap 1000 made by an Italian firm named CMC Srl. According to news reports I found online, Amazon is piloting the machines in its warehouses, however. (Edit: I wrote this in reply to the original article title which described the machine as Amazon's.)

News report: [https://www.reuters.com/article/us-amazon-com-automation- exc...](https://www.reuters.com/article/us-amazon-com-automation- exclusive/exclusive-amazon-rolls-out-machines-that-pack-orders-and-replace- jobs-idUSKCN1SJ0X1)

Product website: [https://www.cmcmachinery.com/portfolio- item/ecommerce1-cmc-c...](https://www.cmcmachinery.com/portfolio- item/ecommerce1-cmc-cartonwrap/)

The effect on waste should be interesting. I assume that everyone who has ordered a product online has had the experience of receiving that product in a box that was quite a bit larger; that happens because standard shipping processes use a limited and pre-determined set of cardboard box sizes. If you look on the box somewhere, you should see a label like "1A5" which is the box size. With past technology, you had to round up to the next largest box that fits the product, which sometimes leaves quite a bit of waste, both in cardboard and the packing material (plastic pillows) used to fill up large voids in the box. It looks like this machine can cut boxes exactly to the product dimensions, which will presumably save both on box and filler material to lower costs, and generate less waste.

<comment><USER3> I once received 5 toothbrush heads from Amazon, package size where ~4 MBP's would fit (~2" by 15").

The problem was huge underlying package.

<comment><USER4> But they can never beat HP, which will send you a single ps2 mouse strapped to a pallet or a stack of software licence documents, each of which individually packed in a box. [https://www.theregister.co.uk/2008/07/23/enormouse/](https://www.theregister.co.uk/2008/07/23/enormouse/)

</comment></comment></comment><comment><USER5> So to the manufacturing engineers around here, is this actually impressive? Because it's definitely impressive on the "this is a really cool machine" level but I was left with a nagging feeling that it wouldn't actually be all that useful.

The input seems to be single items that are regtangular-ish within a certain size and don't need any wrapping, padding, or air bags. This probably describes a lot of Amazon's products but for this use-case wouldn't a machine that wraps the item between two sheets of plastic on rolls be easier/cheaper?

Is this a stepping stone to the machine that can handle multiple/delicate/irregular items?

<comment><USER6> I would assume that air-bags and other padding isn't needed when the box fits this well on the products.

I'm not a manufacturing engineer, but I have watched a lot of How It's Made, the machine doesn't seem more impressive than any of the other plethora of automated manufacturing machines that were available then.

That's not to say it isn't a handy thing to have running, it looks like a crew of 4-6 persons with the right setup for folding and packing boxes could probably keep up with the machine as it is running in the video, so as all things in business it's gonna be a cost-benefit calculation that makes the decision.

</comment></comment><comment><USER7> How do us meatbags compete with this?

<comment><USER8> There's always going to be a human component to logistics. I wouldn't worry</comment></comment>


Google Wave Available for Everyone - <AUTHOR> http://googlewave.blogspot.com/2010/05/google-wave-available-for-everyone.html

<comment><USER2> And they just announced at Google I/O that they are open-sourcing their in- browser editor, and (finally) specifying and publishing the client-server protocol.

</comment><comment><USER3> Are any HN'ers already using Wave to collaborate within their team? If so, for what purposes, and would you mind to describe your workflow?

<comment><USER4> We usually break up a project into large tasks and make a wave for each task. Various assets for the task are stuffed into the wave and everybody comments or provides info directly into the wave. Usually each task/wave has a few people working on that part of the task, and the rest just go in if they need to.

There's also usually a "Master" wave for meta-discussions and overall project coordination as well as final assembly.

Waves are generally setup with a header "wavelet" we use for channel meta- data/notifications/schedules and such, so they don't get buried down in the wave someplace. Everybody edits those, but in general the agreement is to pretty much just leave the waves you put in as-is and don't mess with anybody else's.

As often as not, if there are just documents, we just make it in google docs and link to the doc in the appropriate wave. We've found that's the best way to handle collaborative document editing. We haven't had a chance to take advantage of the new docs features yet, it probably would have saved us even more time since we had to export out the final document into MS-Word for final editing and insertion of various diagrams and such.

One thing that would be nice, now that we've done a few projects like this, is the ability to hierarchically organize groups of waves. Right now we have to be careful to name the waves well...like "Project 4459:Phase A" or some such and search for them.

It's completely replaced using groups for us and various other collaboration sources, the asset management is just much better since it ties the discussion and assets together. However, it would be nice to just have a list of attached files to scroll through sometimes. On our last project, which lasted about 14 weeks, we got everything done on-time with this, but with far less frustration, less problems with organization of _stuff_ , only a small handful of emails (it would have easily been thousands of emails bouncing back and forth) and really very few face-to-face meetings considering.

By way of comparison, a similar project I worked on resulted in thousands of emails, twice weekly multi-hour in-person meetings, constant phone calls, and when summing up the work a mad dash to find lost project assets.

I felt like I could have done 3 or 4 projects simultaneously like this with all of the saved time instead of just one.

We also set up lots of one-to-one or one-to-few sidebar waves for private discussions.

Basically it's a meta-discussion organizer for artifact production for our projects.

<comment><USER5> >> hierarchically organize groups of waves.

This is how <http://BraintrustHQ.com> works. It also has a simpler user experience focused on making conversations productive and organized.

<comment><USER4> Thanks for the link! I'll be sure to check it out.

</comment></comment></comment></comment><comment><USER6> Finally! I've had a sandbox account for the longest time, but for some reason they wouldn't give me an invite to my main account.

Edit: contact import from mail still seems a bit ropey...)

there's a HN wave if you search for 'news.Ycombinator, which has about 21 people on it. It's been moribund since October but I guess we can start adding to it again...

</comment><comment><USER7> ..now when nobody cares anymore...

</comment><comment><USER8> While it is too early to comment about wave specifically, I wonder how a big company would handle a flop of such a product. A flop being lack of expected level of usage.

<comment><USER9> Like they did with <http://www.lively.com> maybe?

</comment></comment><comment><USER10> Wave is still alive?

</comment><comment><USER11> When they released buzz I was thinking than that was wave for everyone.

I wonder if they will still try to push wave as an independent product or it will just die slowly in the background without anyone noticing.

<comment><USER6> I think it could be a fine independent product, but they'll need to be be bit more hands-on and responsive than usual to make it effective.

Biggest problem I see right now: every time you leave a wave and return, the state of the wave is not saved. so if you have selected 'hide inline replies' in order to have a high level view of a wave with multiple sub-threads, the next time you access it all the subthreads are expanded again, and it's not immediately obvious which changes have taken place.

This may be OK for small teams of friends or single-topic discussions, but is severely limiting for hub & spoke discussion models, an area in which it otherwise has great potential.

Also, I'm not too sure about the 'email@example.com'. It seems a little perverse to create a parallel namespace, although perhaps the purpose of this is to avoid a repeat of the buzz launch where people found themselves signed up to something without even knowing what it was.

</comment></comment><comment><USER12> It's still slow as hell, lagging behind as I'm typing.

<comment><USER13> To expand on your post a bit:

Used it for some courses during my masters. It was a painful experience. When you get to ~100 entries (simple text), it starts lagging so much, I could type a couple of lines of text, that would slowly get updated for the next minute. You cannot easily save images (preview, right click, save as... works). There's no serious way to print. When you work with others you either start mixing answers and questions with someone editing just below you, or start a new section for everything and allow the wave to explode to >500 entries of silly stuff. "Stuck" statuses still occur (waves that are always read, or always new). And there are loads of other small problems I'll skip here... I really waited for the Wave, but now that it's as reliable as it was in the sandbox, I don't see how it can be useful for me.

<comment><USER14> Were either of you using Webkit browsers?

<comment><USER12> It's a lot better on Chrome, but it's still choppy. I'm on a fast Macbook Pro.

</comment></comment></comment></comment><comment><USER15> I was reading Paul Graham's essay on "essay writing" today, and he mentioned how he lets thoughts flow freely onto the page but occasionally needs to back- track several paragraphs if some thread of the discussion led to a 'dead end.'

It would be a cool experiment for a talented blogger/essayist to compose something in Google Wave and then make the Wave public. We (the readers) could use the playback feature to examine what stuff was cut, what the editing/refinement process was.

Of course the whole point of cutting material is that you _don't_ want the world to see your unfinished work... but on the other hand as a one-off it might garner some more attention/publicity than usual.

Sigh. If only I was a talented blogger...

<comment><USER16> > Of course the whole point of cutting material is that you don't want the > world to see your unfinished work...

Not always. You might just want to cut something out to enhance the flow of your argument. In movies they often cut scenes out, but put them on the DVD as bonus material.

</comment></comment><comment><USER17> I am not sure about Wave. I was a beta user, then got accounts for family and friends, but the uptake seems really slow. My enthusiasm level is good, but:

As a practical matter, the only money I have made on Wave was writing one how- to article on Wave Robot development. None of my consulting customers have expressed any interest in custom Wave development.

</comment><comment><USER18> I can't seem to find anyway to enable it in Free Google Apps, anyone got a link?

<comment><USER19> Looks like it isn't available for the free version:

[http://googleenterprise.blogspot.com/2010/05/google-wave- lab...](http://googleenterprise.blogspot.com/2010/05/google-wave-labs- available-today-to.html)

<http://www.google.com/apps/intl/en/business/wave.html>

I may be wrong though

<comment><USER20> I tried browsing to <https://www.google.com/a/mydomain.com/> on my domain that has Apps Standard. I get:

>> Service not available

>> This service is not enabled for mydomain.com. If you believe this is an error, please contact your domain administrator or try again with the following link.

>> <http://wave.google.com/a/mydomain.com>

I don't see anywhere in the Dashboard to enable it, either. Bummed.

<comment><USER21> Try going to the "Add more services" link.

It's on the main Google Apps domain management page, right next to the "Service Settings" header (the header of the sections which has things like mail, calendar, etc.).

Worked for me, and I'm on the Standard Edition.</comment></comment></comment></comment>


Udash – Scala and Scala.js Reactive Web Framework - <AUTHOR> https://udash.io/ <comment><USER2> I did a couple of blog posts about UDash recently, one of which was to view this very site using functional programming library Fetch (similar to Facebook's HAXL)

[http://justinhj.github.io/2017/10/11/hacker-news- api-3.html](http://justinhj.github.io/2017/10/11/hacker-news-api-3.html)

The other was a simple roman numeral converter

[http://justinhj.github.io/2017/08/27/roman-numeral-tool- with...](http://justinhj.github.io/2017/08/27/roman-numeral-tool-with- udash.html)

For me the advantage of UDash is for people that want a type safe Scala "all the way down" web application. One of the downsides is that is difficult to avoid runtime errors, at least to the extent that Elm does (by design).

Another drawback is not being able to simple share a template with designers; they would have to be proficient in Scala at least to the extent they can fix compile errors in the page code.

Some plus sides are that it plays well with Twitter Bootstrap and type safe CSS.

<comment><USER3> Can you expand on why it is difficult to avoid runtime errors when everything is typesafe?

<comment><USER2> This was from personal experience where code that would compile correctly would give a runtime error in the browser. Could be that I didn't know enough about UDash to fix it, but the error was unhelpful so I worked around it.

</comment></comment></comment><comment><USER4> If people don't want the entire UDash experience there are smaller libraries:

Binding.Scala [https://github.com/ThoughtWorksInc/Binding.scala](https://github.com/ThoughtWorksInc/Binding.scala)

React [https://github.com/japgolly/scalajs- react](https://github.com/japgolly/scalajs-react)

RPC [https://github.com/shogowada/scala-json- rpc](https://github.com/shogowada/scala-json-rpc)

<comment><USER5> Shameless plug: I found the complex type/macro/implicits mixture in scalajs- react hard to work with and made a wrapper that's simpler to use:

[https://github.com/Ahnfelt/react4s](https://github.com/Ahnfelt/react4s)

<comment><USER6> This looks fantastic, nice work! Does it work with React Native?

<comment><USER5> Thank you :) I have not tried to use it with React Native. There's no fundamental reason why it wouldn't work, but it hasn't been tested. If you try it out, I'll do my best to help you make it work.

</comment></comment></comment></comment><comment><USER7> This is awesome. Clojure has had similar frameworks for a while, but Clojure has a fairly steep learning curve. Really excited to try this in Scala. Wonder if this will be a new trend away from the totally separate webapp + rest API model...

<comment><USER8> I use Scala daily and have never used Clojure - what creates the steep learning curve? Scala also has a lot of features between "Beginner" and "Advanced" which can really add to the learning curve (Implicits being a good example).

<comment><USER9> Oh man I had the misfortune of starting scala with a framework( akka http) that used magnet pattern. Turned me off from scala forever till I rediscovered it again.

<comment><USER4> I am very much in the minority but I can't stand most of Akka.

It's overly engineered with too much clever magic and hence is very reminiscent of frameworks like J2EE Spring which is why people left Java to begin with.

</comment></comment></comment></comment><comment><USER10> It looks really verbose only to render simple html.

I had one really bad experience with Scala.js. When I used it, I noticed Scala was just not designed for the web (front end) and it just didn't work well for things really simple in JS.

<comment><USER11> Could you cite an example of how Scala is unsuitable for the web? Between Scala and JavaScript, I would pick Scala in a heartbeat for one reason alone - it's strongly typed. Both of them offer OO & FP.

<comment><USER10> Strongly typed was one of the problem I found. TypeScript offers a better alternative to typing on the web because it keeps the compatibility with javascript and also have a real any type when it's really necessary. Typescript now can import raw js without types definitions unlike Scala.

<comment><USER12> I believe Scala can use javascript libraries either dynamically or with type definitions in exactly the same way as TypeScript?

I tried to use TypeScript but the type system just wasn't good enough; when you've been working in a strongly-typed language like Scala for a while, a language without nominal types or HKT just isn't going to cut it.

</comment></comment></comment></comment><comment><USER13> This actually looks really cool. I really like the idea of RPC over websockets built into the framework, I don't do much webdev anymore but I dont think I've seen that before. Looks like a really solid project

<comment><USER14> RPC over websockets is basically how Meteor worked. Although it seems that's sort of being deprecated in favor of GraphQL.

<comment><USER13> Good to know!

</comment></comment></comment><comment><USER15> The problem with these things is that I can't give my web developer a bunch of Scala files to edit instead of HTML. Does it support binding in HTML templates too?

</comment><comment><USER16> Is there a runtime lib? That includes e.g. Scala collections for the browser for example? How many kilobytes?

<comment><USER17> > Is there a runtime lib? That includes e.g. Scala collections for the browser > for example?

Pretty much all Scala code compiles with Scala.js, that includes the Scala standard library, as well as part of the Java standard library that has been reimplemented in Scala.

> How many kilobytes?

Scala.js does whole program optimization and dead code elimination, so there's not a single number that can be given here, you pay for what you use.

<comment><USER18> > so there's not a single number that can be given here, you pay for what you > use.

While true, in practice as soon as you use, for example, `List`, `Map`, and `Option`, along with various basic collection operations (`flatMap`, `map`, `zip`, ...) you've pulled in basically the entire standard lib*

Wind up paying about a 160KB baseline "tax" to use Scala in the browser, which is well worth it considering that you can ditch jQuery and related plugins (DataTables, Validation, etc.), shedding far more weight than Scala.js in the process. I find it to be a huge win, wish I could use it in current bloated Angular 5 + TypeScript project :\

* This is due in part to existing collections library that is not so amenable to dead code elimination (or at least google closure compiler can't track the full reach of _CanBuildFrom_ 's tentacles :)) Maybe this will change in Scala 2.13 collections overhaul, have my doubts, doesn't sound like the new design is radically different than the current one.

</comment></comment></comment><comment><USER11> This is just great. This is the web framework I have been hoping someone would make!</comment>


'Oh, My God, Where Is This Going?' When Computer-Science Majors Take Improv - <AUTHOR> https://www.wsj.com/articles/oh-my-god-where-is-this-going-when-computer-science-majors-take-improv-11557846729 <comment><USER2> It's kinda odd to see these sorts of "gen-ed" requirements from the UK. US college degrees seem to be lengthened a year and required to be partially filled with what appears to be a bunch of irrelevant classes. I'd be pretty annoyed given the cost of tuition if, as an adult, I was expected to do a bunch of drama, or humanities, or languages classes prior to graduation... for a CS degree.

To me, and I suspect most people in Europe, the primary purpose of going to university is to specialise in one particular course area and gain a higher qualification. Of course, there is space to ensure students practice e.g. public speaking, working within a team, project management and technical writing within these constraints. But generally, all of the classes will be relevant to the subject area you are studying unless you _wish_ to take a module from a different degree course as an option. The idea of depriving an adult from being able to make that decision for themselves is disheartening.

Most students would surely have already worked through and experienced a great deal of other classes in high school in order to receive a well-rounded education _prior_ to attending university.

So sure, if you want to get outside of your comfort zone, take an optional class or sign up for a society. But this whole concept of forcing it into an unrelated degree is odd.

<comment><USER3> Indeed. If they wanted CS grads to come out of their shells, then a mandatory communications course might be more in order. That would cover all multitudes of communication: face-to-face, telephone, written, email, etc.

Not "Communication for Dummies" but "Communication for the Workplace", and maybe a few boundaries could be pushed within that class, but not to the point of irrelevance.

</comment></comment><comment><USER4> Not a bad idea I think. I had a voluntary communications class that I signed up for over 2 years in school. It helped a lot in preparing for interactions and presentations in the business world, but also life in general.

It was also very uncomfortable for me.

</comment><comment><USER5> This feels like it's leaning pretty hard on a stereotype.

</comment><comment><USER6> Theatre can help you get over stage-fright, there's some real value there. I took 3 semesters of theatre in high school and that was the biggest gain for me.

</comment><comment><USER7> Paywalled.

Would be nice to have a tag or something to show that

<comment><USER8> Agreed.</comment></comment>


Seniors at Risk: Using Spatial Analysis to Identify Pharmacy Deserts - <AUTHOR> https://makepath.com/open-source-gis-spatial-analysis-pharmacy-deserts/ <comment><USER2> Awesome. Here is the beauty of a well-thought data analysis workflow, by picking up quality data and using powerful tools: in a few steps `xarray- spatial` and the *pandas ecosystem hit the confidence level for the human intervention (calls) to reveal a very important (easy to overlook) reality.

</comment><comment><USER3> This is fantastic analysis, this tech could be used to analyze lots of geographic problems where there are multiple overlays of geographic data.

</comment><comment><USER4> Insightful article leveraging insightful analysis.</comment>


Public Universities Send More to Silicon Valley Giants Than Ivy League Schools - <AUTHOR> http://www.businessinsider.com/silicon-valley-hires-uc-berkeley-grads-2017-5 <comment><USER2> This isn't too surprising, because most of the schools listed are _far_ larger than the relatively small IL schools (ASU is, if not the biggest university by student population in the country, then very close to it). I'm surprised the University of Washington isn't listed.</comment>


How are you preparing for a future of work requiring constant reinvention? - <AUTHOR> <comment><AUTHOR> Many scholars and futurists are envisioning a world where one's ability to work will require constant transformation, retraining, and reinvention. How are you preparing yourself? How are you retraining, reinventing, and working to remain flexible as things move ever faster?

<comment><USER2> By reading Hacker News, of course!</comment></comment>


Some Easy Hacks to Simplify Your Life - <AUTHOR> http://zenhabits.net/21-easy-hacks-to-simplify-your-life/

<comment><USER2> "Trash, Donate, Maybe" - This is great because the Maybe pile can be used for all the hard choices and allows you to take action when the choice is easy.

You can sort your mail this way into Toss, File, Recycle, Read Later. Make all the easy choices when you get your mail and most of the choices are handled right away.

Instead of one big pile of Undone, you have a small pile of Undone with very little work.

Or maybe you just kept going and got it all done because you got momentum and that pile of actual work got small enough.

<comment><USER2> Tax software could actually use this idea too. They could advertise "Start with all the easy choices first".

Then, once you get through that 1/3 of the work, tell you that you got all the easy stuff done, so how about one more, not so easy one?</comment></comment>