PostgreSQL 10 Beta 1 Released - <AUTHOR> https://www.postgresql.org/about/news/1749/ <comment><USER2> While everybody is going to be rightfully excited about the logical replication, for me personally, CREATE STATISTICS and the new ROW syntax for UPDATE amount to the additions that have the probably biggest effect on me ever since I moved to postgres exclusively when 7.1 was released.

Especially CREATE STATISTICS (wonderful explanation here [https://www.postgresql.org/docs/10.0/static/multivariate- sta...](https://www.postgresql.org/docs/10.0/static/multivariate-statistics- examples.html)) is the one single knob I wanted to be able to turn so many times in the past now (especially the n-distinct counts).

Most of the time, the planner does an ok job, but sometimes you have tables in a peculiar shape and if you're unlucky, the planner will opt into horribly bad plans. Whenever this happened for me, it was due to one of the two things CREATE STATISTICS allows me to tune in the future.

Thank you, thank you, thank you to whoever gave us this wonderful feature

<comment><USER3> What's the significance of the `update .. set (..) = row (..) ..` syntax?

      update comment set modified = now(), body = 'edited comment' where id = 123;

vs

      update comment set (modified, body) = row (now(), 'edited comment') where id = 123;

It doesn't seem to provide any new functionality, just a minor difference in syntax.

<comment><USER4> EDIT: Turns out the below is not true, though you can achieve the same effect with the sub-select syntax.

The row value can be a single value from some other query. (Rather than having to pick apart each column from the row value.) That said I think the feature has been there for a while, and now simply the "ROW" keyword is optionally allowed.

<comment><USER3> Thanks for the explanation!

      update comment set (modified, body) = (select now(), 'edited comment') where id = 123;

You're right, it works the same without the `row` keyword in 9.6.

<comment><USER4> Actually now that I re-read the grammar, sub-selects are yet another accepted syntax. Looks like the ROW syntax doesn't support row expressions like I thought. Not really sure the benefit beside making it easier to programmatically construct UPDATEs.

<comment><USER5> It's for when you want to update more than one column with values from the same record in another table, eg:

      UPDATE books
        SET (title, isbn) = (
        SELECT title, isbn FROM other_books
      WHERE other_books.foo = books.bar);

You can also do it with UPDATE ... FROM (which may be more efficient), but that's a PostgreSQL extension, while the added-in-9.5 syntax is SQL standard.

      UPDATE books
        SET title = other_books.title, isbn=other_books.isbn
        FROM other_books
        WHERE other_books.foo = books.bar;

<comment><USER4> That's not the row syntax though, that's the sub-select syntax (my initial confusion). i.e., there are three options according to the grammar:

      SET { column_name = { expression | DEFAULT } |
            ( column_name [, ...] ) = [ ROW ] ( { expression | DEFAULT } [, ...] ) |
            ( column_name [, ...] ) = ( sub-SELECT ) }

The second option, "row" syntax (to which the optional "ROW" keyword was recently added), doesn't allow for a row expression, only column expressions. The sub-select syntax suffices for row expressions (as your example demonstrates).

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Congratulations to the team. The replication/partition improvements are significant and much appreciated.

My favorite improvements are full text search of JSON & JSONB; this makes pg a full replacement for Mongo for my use cases.

<comment><USER7> I feel like this feature replaces almost all of Mongo's use cases!

<comment><USER8> I'm interested. When you say almost, can you elaborate on any remaining use cases when you'd use Mongo?

<comment><USER9> At my previous company we made heavy use of its lossy compression feature.

<comment><USER10> You would get compression with Postgres running on ZFS.

<comment><USER11> Database plus Copy-On-Write file systems sound like a bad idea. I am imagining a modest 100gb database being re-written for every change.

I am sure there is some way to work around this, but wouldn't this be the default behavior with a typical database and typical COW file system?

<comment><USER10> You might be interested in reading this paper: [https://people.freebsd.org/~seanc/postgresql/scale15x-2017-p...](https://people.freebsd.org/~seanc/postgresql/scale15x-2017-postgresql_zfs_best_practices.pdf)

<comment><USER11> I am interested and I appreciate the thought and link, however these appear to be the slides to a talk without the actual talk. If so they are of limited use because the slides never have all the information the presenter has, and that information is often just a summary.

Is this the correct talk: [https://youtu.be/dwMQXLOXUco?t=5380](https://youtu.be/dwMQXLOXUco?t=5380) ?

<comment><USER10> Yes, sorry about that, that is the corresponding talk to the slides. Thanks for pointing that out.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Important features:

Native Table Partitioning - [https://www.keithf4.com/postgresql-10-built-in- partitioning/](https://www.keithf4.com/postgresql-10-built-in-partitioning/) Logical Replication - [https://blog.2ndquadrant.com/logical-replication- postgresql-...](https://blog.2ndquadrant.com/logical-replication- postgresql-10/)

or what is new in PG 10 [https://wiki.postgresql.org/wiki/New_in_postgres_10](https://wiki.postgresql.org/wiki/New_in_postgres_10)

Postgresql really awesome!

</comment><comment><USER13> PostgreSQL is an amazing project. A no-nonsense database that delivers what it promises. I'm amazed at what a talented group of people can accomplish when they are driven and put their mind to it. Thanks for a wonderful product.

<comment><USER14> Plus their documentation is top notch. After using Oracle for 15 years, I nearly cried when I moved to Postgres recently and saw how wonderful their documentation is.

<comment><USER15> Completely agree!

I've often said that I didn't learn English grammar until I studied German, I didn't understand Linux until I read the Arch documentation, and I didn't comprehend relational data until I read the Postgres documentation.

</comment></comment></comment><comment><USER16> The biggest news for me is ICU support for collations (text sorting).

Previous versions of PostgreSQL relied only on strcoll, which is horribly broken on BSD and macOS. On platforms where it wasn't completely broken, it had the potential for subtle data corruption bugs (eg. an update to glibc might change sort order, causing indexes to become corrupt).

Now, you can optionally use ICU for collations, which gives you reliable, versioned collations. This is a big step forward!

ICU collations are not the default, you need to add them with CREATE COLLATION. You have a lot more collations available to choose from, but I think it's not yet possible to change any of the advanced settings that ICU provides.

(Also, when I tried it, it seems that the ICU collations are case insensitive -- but I think case insensitive collations aren't fully supported yet.)

<comment><USER17> ICU collations are prepopulated; see <[https://www.postgresql.org/docs/devel/static/collation.html#...](https://www.postgresql.org/docs/devel/static/collation.html#collation- managing>).

Also, ICU collations are case sensitive, just like libc locales.

<comment><USER18> s/insensitive/sensitive/?

<comment><USER17> fixed, thanks

</comment></comment></comment></comment><comment><USER16> If you're looking for a quick way to try PostgreSQL 10 on a Macbook, we made a special build of Postgres.app that includes PostgreSQL 10beta1.

You can download it from Github: [https://github.com/PostgresApp/PostgresApp/releases](https://github.com/PostgresApp/PostgresApp/releases)

<comment><USER17> Or if you use Homebrew you might like: brew install --devel petere/postgresql/postgresql@10

</comment></comment><comment><USER19> The native table partitioning makes me so happy. I'd been doing this for years with really hacky external modules and tons of triggers. Sadly, even then there were always weird edge cases.

Postgres really has become the most versatile database out there. I cringe whenever I have to work with MySQL again...

<comment><USER20> Every time I see a job post mentioning mysql I realize they just haven't discovered postgres, or they have some really gross problem. :/

<comment><USER21> Or they want to allow for case-insensitivity of some data, like for example email addresses on login forms.

As much as postgres is overall better than MySQL in so many ways, it's still ridiculously difficult to set things up such that

        SELECT id FROM users WHERE email@example.com'

returns the same result as

        SELECT id FROM users WHERE firstname.lastname@example.com'

<comment><USER22> not sure why you got downvoted so much.

Everyone's answer is "just lowercase everything".

I'll respond just a bit:

1\. You don't always have control over all the queries that have been written against your database.

2\. You would probably lose the ability to use ORMs without a moderate amount of customization.

3\. If you're migrating from a different database, you may have checksums on your data that would all need to be recalculated if you change case on everything stored.

4\. Doing runtime lowercase() on everything adds a bit of overhead, doesn't it?

citext on postgresql seems a decent option - the citext docs even mention drawbacks of some of the other recommended options.

<comment><USER23> Is there a single ORM out there that doesn't support the lower() function? I googled "case insensitive search" \+ a couple ORMs and each of them could implement it as a one-liner.

And doing the runtime lower() on everything will generally not be slower than citext. If you look at the source for the citext comparison ([https://github.com/postgres/postgres/blob/aa9eac45ea868e6dda...](https://github.com/postgres/postgres/blob/aa9eac45ea868e6ddabc4eb076d18be10ce84c6a/contrib/citext/citext.c#L113)) you'll see it is internally converting the values to lowercase and comparing them. All it saves you is the overhead of a sql function invocation, and you'd have to do a lot of comparisons to make that difference measurable. But if you're doing a lot of those comparisons, unless you're just running the calculation on the same couple values over and over, the memory and disk latency will dominate performance, not the minimal overhead of the sql function invocation.

I agree you should probably use citext if you need case-insensitive unique or primary key values, but be aware of the drawbacks. [https://www.postgresql.org/docs/current/static/citext.html](https://www.postgresql.org/docs/current/static/citext.html)

</comment></comment></comment></comment></comment><comment><USER24> I wished they would implement more from SQL:2011. I have a lot of applications that would benefit from system versioned tables.

This is a good sum up of useful modern SQL features: [https://www.slideshare.net/MarkusWinand/modern- sql](https://www.slideshare.net/MarkusWinand/modern-sql)

<comment><USER25> I was expecting that presentation to be stuff you were missing, but the presentation is saying that essentially every feature they describe is implemented in PostgreSQL. Of the SQL:2011 ones, only one wasn't (temporal tables), and even the SQL:2016 features had partial support (with the summary slide at the end of other features they didn't do in detail having stuff that looks familiar in a PostgreSQL context). Do you have a reference of features not in PostgreSQL you are hoping to use?

<comment><USER24> I really would like to use Temporal Tables (slides 137 and following) to say like 'give me the record of last week'.

I can of course do that already manually, but it is tedious and I hope it will be faster if implemented directly.

<comment><USER26> [https://github.com/arkhipov/temporal_tables](https://github.com/arkhipov/temporal_tables) seems like a good option?

<comment><USER27> Thanks for the link!

<comment><USER26> Here's two more--

[http://clarkdave.net/2015/02/historical-records-with- postgre...](http://clarkdave.net/2015/02/historical-records-with-postgresql- and-temporal-tables-and-sql-2011/)

[https://pgxn.org/dist/temporal_tables/](https://pgxn.org/dist/temporal_tables/)

</comment></comment></comment></comment></comment></comment><comment><USER28> Will having logical replication make doing a DB version upgrade in production easier? We're using Postgres 9.4 on RDS right now, and there doesn't seem to be an upgrade path that doesn't involve some downtime.

<comment><USER29> > E.1.2. Migration to Version 10

> A dump/restore using pg_dumpall, or use of pg_upgrade, is. > required for > those wishing to migrate data from any previous > release. > ([https://www.postgresql.org/docs/devel/static/release-10.html](https://www.postgresql.org/docs/devel/static/release-10.html)) > This means no, I guess. This is what I don't get. How can anyone with a > sizeable db in production do that?

<comment><USER30> That is only if you want to upgrade in-place. Upgrading using logical replication is different: it requires running another instance and switching over to it when all the data has been replicated.

</comment></comment></comment><comment><USER31> The new features related to clustering looks exciting. Also SCRAM support and Full text search for JSON and JSONB . Postgres is cementing itself as not only the safe choice for Databases but also the Swiss Army knife .

</comment><comment><USER32> As someone with little to no Postgres experience, it seems like they are heading in the direction of providing the type of massively parallel, scale out features that Citus provides.

Would love to hear thoughts from someone with real expertise.

<comment><USER33> Citus is building functionality on PostgreSQL to provide sharding for data sets too large for a single machine. There aren't really any PG 10 features that duplicate that. Some of the new PG features such as increased query parallelism allow for better utilization of single-machine resources. Other features such as logical replication may allow for some horizontal scaling by splitting read workloads across replicas, but none of them provide any sharding capabilities.

<comment><USER34> Aggregate push down to foreign servers seems to overlap with Citus. It's not as transparent, but you could have a dataset sharded across several PG instances, mount them all into a master with foreign data wrappers, and UNION them (for some queries) to aggregate across the set.

<comment><USER35> BTW, you can also create partitions as foreign tables: [https://www.postgresql.org/docs/10.0/static/sql- createforeig...](https://www.postgresql.org/docs/10.0/static/sql- createforeigntable.html)

</comment></comment></comment></comment><comment><USER36> So glad that GiST indexes now support UUID and ENUM data types. That was a big wart for me due to needing exclusion constraints.

<comment><USER37> I always just cast to text in this scenario.

<comment><USER36> The issue with that is performance and index size. At first that was my solution, but as more data got into the tables that just wasn't working. For UUID's I had to move to casting to bytea using the uuid_send(uuid) function.

For enums, I had to create a function to cast an enum to a unique integer, and used that in my exclusion constraints. It's hacky as hell and not something I like, but it's worked for the past 3 years.

I'll be really really happy to get rid of those hacks come PG 10 though.

</comment></comment></comment><comment><USER38> I know this sounds icky to some, but what I _really_ want from Postgres is a proper equivalent to MSSQL's FILESTREAM.

I know, I know, "databases are bad for files" \- but let's take something like an ECM suite where images and documents are literally part of a transaction, having to synchronize those between filesystem and database breaks the Atomic constraint in so many ways. PostgreSQL has LOB support, but oid's being 32-bits severely limits the usefulness of the feature without using convoluted workarounds (multiple databases).

<comment><USER18> Postgres dev here.

> but what I really want from Postgres is a proper equivalent to MSSQL's > FILESTREAM.

What sizes of files and such are you interested in? What kind of read/write patterns?

I do think we need some improvements in the area. Not enough that I'll drop the other stuff I'm working on, which I think is higher priority, but enough to discuss approaches and review patches.

It'd be cool if you could comment on the pgsql-hackers list.

<comment><USER38> Small files, 25-50K on average (images of patient charts), and they're all they're all write-once read-many.

<comment><USER18> Hm, in that case, what stops you from just using a bytea column?

<comment><USER38> My major issue with bytea is two fold, the same oid issue that you have with LOB's (we have 10's of billions of pages) so you're forced to less than optimal solutions like table inheritance for large numbers of records, plus it severely bloats the size of the heap file making a VACCUM FULL take a century if needed.

<comment><USER39> > so you're forced to less than optimal solutions like table inheritance for > large numbers of records

Would the "native table partitioning" feature introduced in this release be a solution (or, at least, more optimal) for this?

Alternately, if you want to go off-heap, what about using Foreign Data Wrappers ([https://wiki.postgresql.org/wiki/Foreign_data_wrappers#File_...](https://wiki.postgresql.org/wiki/Foreign_data_wrappers#File_Wrappers))? These two both sound like they might solve your problem:

• [https://github.com/ZhengYang/dc_fdw/wiki](https://github.com/ZhengYang/dc_fdw/wiki)

• [http://multicorn.org/](http://multicorn.org/)

<comment><USER38> The native table partitioning removes one of the headaches of inheritance, but it mostly only relieves some of the administrative headaches - the foreign key issues remain.

fdw's are great, but they don't participate in replication - which is a pretty big issue. Unfortunately, the "proper" way to do this would be with a custom type, but I can't find any way you could write one with the extension API that wouldn't be stored in the database heap (you could create some native functions similar to the existing LOB functions, but then you run into atomicity issues again).

Honestly, this would be easy to write if the extension API supported off-heap storage of custom types - though I understand there's a ton of technical complexity in implementing such a feature.

<comment><USER39> To be clear—you want Postgres to manage the data (so that it gets replicated through Postgres replication), but you also want the data to exist in somewhere other than the DB heap?

As far as I can tell, these two conditions together form a bit of a bind: for Postgres to manage the data in a way that would enable replication under MVCC, it has to have said data mmap(3)ed and indexed and have it participate in the WAL log and so forth. Just the space overhead of this management metadata will then be prohibitively costly in memory, if you have "tens of billions of files" to keep under management.

Personally, I think the pragmatic solution would be to replicate the files themselves outside of Postgres, and have Postgres just hold opaque references to their paths, which you would join through an FDW to fill a column with their contents.

As you say, the files are Write-Once-Read-Many—so you (presumably) aren't worried about how Isolated or Consistent writes to the file data would be without Postgres. Plain filesystems provide Atomicity and Durability guarantees all by themselves. It's less _convenient_ to do things this way—you have to manage e.g. "WAL-E + a separate rsync" rather than just WAL-E—but it's not particularly _bad_ in terms of the engineering trade-offs.

<comment><USER18> > To be clear—you want Postgres to manage the data (so that it gets replicated > through Postgres replication), but you also want the data to exist in > somewhere other than the DB heap?

> As far as I can tell, these two conditions together form a bit of a bind: > for Postgres to manage the data in a way that would enable replication under > MVCC, it has to have said data mmap(3)ed and indexed and have it participate > in the WAL log and so forth. Just the space overhead of this management > metadata will then be prohibitively costly in memory, if you have "tens of > billions of files" to keep under management.

There's really not too much of a technical problem here. What the sub-op is complaining about mainly just some work that needs to be put into parts of postgres that have been designed long ago. Not entirely trivial due to compatibility concerns, but also not super hard. The first thing would be to have a separate type of toast table with 64bit ids (can't drop support for 32 bit ids without making in-place upgrades impossible), and to have per table toast id. Then use same infrastructure for the LOB piece.

Btw, postgres doesn't mmap() data. On some systems it uses mmap(MAP_ANONYMOUS) to allocate its buffer cache, but that's just a configurable size.

<comment><USER39> Right, I didn't mean to suggest that Postgres currently mmap(3)s all data; rather, I meant to get across that—in the scenario where you really want to keep all this data laying around _as files_ rather than as LOBs—Postgres would need to have some way to guarantee that the data that's sitting around in those files is always in the state Postgres _thinks_ it's in, if the corresponding file-streams are going to join in the same MVCC transactions as everything else. From what I can tell, that would require Postgres to do whatever it does for each table backing-file it keeps, to _each_ of those files: both on the OS level (at least fopen(3) + flock(3)), and in terms of book-keeping in the system catalog.

Let me put it this way: how much overhead do you think there would be if you split your Postgres data across "ten billion" _tablespaces_? Because that's essentially what's being talked about here—little tablespaces containing one {oid, LOB} table, with one row, with a "storage engine" that represents that tablespace as a file.

...of course, if you _do_ just (fix and then) use LOBs rather than insist on externally-visible files, none of that matters. :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER40> unrelated to this particular release, but since we're talking about postgres... how do people find the ability to write stored procedures and functions in languages other than just SQL? I'm coming from a MSSQL shop and curious how writing a query in python for example has benefited anyone if at all -- did you / can you use modules like numpy or pandas in a postgres python procedure?

<comment><USER41> Python under PG can do anything python can do.. but that said, just because you _CAN_ import numpy/pandas and go to town, doesn't mean you _SHOULD_. In fact you probably really shouldn't :)

That said, we use python inside of PG, and it's awesome. It's not really any more powerful than PG/SQL(their built-in language) i.e. in terms of what you can do in the DB itself.

Our main app is also python, so we have a continuity of language from front- end to back-end. We do have some DB functions that take advantage of python's flexibilities, but like I said, we try to keep external modules and craziness out of the PG backend if possible. Sometimes there is no help for it, and you do what you must, and it's very handy that you can just go do it.

<comment><USER40> Sometimes I'd rather do python magic than self join correlated sub-queries or write window functions and have it all become a convoluted mess. But I see your point.

edit: i'm still trying to train myself to think in a relational way.

<comment><USER41> relations are awesome, but it def. takes training! I'd suggest avoiding window functions for pagination.. see [http://use-the-index-luke.com/no- offset](http://use-the-index-luke.com/no-offset) as one method.

</comment></comment></comment></comment><comment><USER42> So it looks like PostgreSQL will finally be web scale ;)

(ducks and runs)

<comment><USER43> That, i suppose, was meant to be a joke. see [https://www.youtube.com/watch?v=b2F-DItXtZs](https://www.youtube.com/watch?v=b2F-DItXtZs) and just replace mysql with pg.

<comment><USER42> Yes, it was a reference to that. My comment is currently sitting at -2. I'm still getting the hang of Hacker News' sense of humor. On Slashdot, I would be at +5. Ho hum.

Anyway, just to make my intentions clear, I love Postgres, have used it for over a decade, and have yet to use MongoDB or any other NoSQL database.

<comment><USER44> In general, strive for substantive and constructive comments on HN. If you've got that, a little humor added in can be appreciated. Comments that are submitted only for humor value (which you knew yours was, given your parenthetical addendum) are likely to be less appreciated on HN than on other sites.

Here's a recent thread where this has been discussed:

[https://news.ycombinator.com/item?id=13760333](https://news.ycombinator.com/item?id=13760333)

There are likely others that describe it better, but I don't have them at hand.

Edit to add: Of course there are. Here's some comments by 'dang on the topic:

[https://hn.algolia.com/?query=author:dang%20humor&sort=byPop...](https://hn.algolia.com/?query=author:dang%20humor&sort=byPopularity&prefix&page=0&dateRange=all&type=comment)

<comment><USER42> So what I want to know is how the members of Hacker News act as one. Presumably these are the same people who appreciate humor on other sites, upvote it, and participate in it. But on Hacker News they somehow all know to downvote it. It's eerie.

<comment><USER44> I'm not sure I follow. People often behave differently depending on the context (e.g., work, home, school, out with friends), so acting differently on different sites doesn't seem very surprising. Also, different sites have different, though perhaps overlapping, populations, so the "average" behavior or culture is going to be different.

One example (mentioned in the HN guidelines) is Reddit. There are people who frequent both HN and Reddit, yet it's clear that members on HN—even those who use Reddit as well—don't want HN and Reddit to be the same. As such, they behave differently on each site. That's not to say one is better than any other: they're just different.

And HN members don't act as one—just as they don't act as one on any other site. If they did, your comment would have been downvoted to the point that it was flagged dead (given it's likely been seen by hundreds, if not thousands) or not flagged at all. Given it's current shade of gray, I suspect you've received only a few downvotes. (Edit to add: I see you did say it is at -2.)

Does that make sense? Or am I misreading you?

Anyway, this is quite off-topic now. I posted these in the hopes of providing a bit more insight into the HN community. I hope they've been more helpful than frustrating.

<comment><USER42> Thank you. No, you're not misreading me. I guess like you say, it could be worse than -2. (Although now it's at -3!)

I don't frequent Reddit. It sounds like it's so jocular that people come here to get away from it all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER45> What is a good resource for learning databases in general (besides just queries) and then focus on PostgreSql?

<comment><USER46> So you want something that covers all types of database systems? I don't think any such book exists, but maybe look at the database-oriented courses at CMU, Berkeley, Stanford, MIT ... Those are typically comprehensive and include links to source books/papers.

In particular, look at Joseph M. Hellerstein at CMU: db.cs.berkeley.edu/jmh/ (doesn't load for me at the moment, not sure what's wrong).

Also, the Redbook (prepared by Hellerstein, Bailis and Stonebraker) is great: [http://www.redbook.io/](http://www.redbook.io/) but it's more an update on various topics than introduction.

</comment></comment><comment><USER47> Wasn't primary-primary replication from 2ndQuadrant BDR tool supposed to make GA with PostgreSQL 10?

<comment><USER17> The new logical replication feature is based on the experiences from BDR and pglogical, but it isn't multimaster yet.

</comment></comment><comment><USER48> Postgres is awesome and thankfully is much easier to get set up with high availability and replication baked-in (remember pgpool anyone?). AWS Cloud Formation Docker Swarm stack + postgres primary/replica compose file + datadog and you're good to go.</comment>


Man Overboard: GNOME Cofounder Joins the Mac Side - <AUTHOR> http://www.linuxinsider.com/story/Man-Overboard-GNOME-Cofounder-Joins-the-Mac-Side-77492.html

<comment><USER2> Gnome-3 had Mac envy from the start, so something like this isn't surprising.</comment>


Important Facts You Didn't Know About the Music Streaming Industry - <AUTHOR> https://news.alphastreet.com/loss-making-spotify-looks-for-a-turnaround-through-ipo/ <comment><USER2> Spotify is currently the leader, but I doubt it will dominate anymore in the likes of Apple Music and Google Play. It needs to come up with a new strategy, maybe an alternative to Netflix.</comment>


Android shuffling letters in input - <AUTHOR>

When I've typed more than a few lines in any text box, Android starts shuffling letters around. I'm on an S4. I've googled for this problem and found some indications that others might experience it too, but no bug report of any sort. So my question is if anyone else here has this problem?
I'll keep on typing to demonstrate the problem, it is bound to happen once this text grows large enough.
After a while spontanious scroll events start happening and the cursor starts bouncing around. Before you know it Android has made some inexplicable shuffling of your text and you go mad.
It is also posspossiblet the problem has somesomethingdo with the total amount of back-navigation which is perfperformed the total number of line breaks in the text.
Going back to edit old text seems to trigger the problem as well. I went back to edit the last paragraph and it happened! Reproduction sucess! <comment><USER2> My phone does this for me as well, including when I am using a pull out keyboard which lessens but not eliminates the chance of a dirty touchpad.

</comment><comment><USER3> Does it shuffle/move stuff around, or does the cursor just jump around as you type?

If the latter, sounds like a faulty touch screen.

<comment><AUTHOR> Don't think that its dirt or faulty screen since it sometimes garbles text in ways that couldn't be explained merely by my keystrokes. Text is duplicated, concatenated and moved around in various ways.

</comment></comment><comment><USER4> I've experienced this also. You'll be mid sentence, but it will start putting new letters at the beginning of the textbox.

<comment><AUTHOR> Cool. Are you also seeing the seemingly random duplication as in the word "somesomethingdo"? That used to read "something to do"

</comment></comment><comment><USER5> Make sure your screen is clean. If there is dirt that triggers a touch, that happens to be in the text, the cursor will jump there.</comment>


Tutorial: Stress Detection with Wearable Devices and Machine Learning - <AUTHOR> http://dataespresso.com/en/2019/01/30/Stress-detection-with-wearable-devices-and-Machine-Learning/ <comment><USER2> Thank you sir, for the great summarisation of the heart and heart rate variability.

<comment><AUTHOR> I'm glad you enjoyed reading it! I for sure enjoyed writing it :)</comment></comment>


Elementary OS to Build the Next-Generation Linux App Store - <AUTHOR> https://news.softpedia.com/news/elementary-os-to-build-the-next-generation-linux-app-store-529141.shtml <comment><USER2> I really liked my time using Elementary OS. It had a good and consistent design scheme, and shipped with a good default tool set (I would be willing to put my parents on it). I've yet to have a "great" Linux App Store experience, but out of all of them I think elementary's was the best. I really hope the OS draws more people to the Linux ecosystem.</comment>


Ask HN: What is your favorite company swag? - <AUTHOR> Fidget cubes? Pajama pants? You name it! <comment><USER2> Notebooks and notbook covers / holders. If it looks nice (aka not cheap) I will use it a lot. If it is refillable and looks good I will use it forever ... or until I get a nicer one.

I also enjoy Pens which provide entertainment. I have a Pen from CDW which as you turn it, part of the logo goes the way you are turning the pen,m and some of it goes the opposite direction. When in a boring meeting I liek to play with it. Because of this valuable BONUS function I take it with me often.

If you have real money to spend, I would spend it on CONTIGO coffee and water bottles. In particular the ones that only take a finger to operate. Everyone will use it and brag about it.

If your customers are beer drinkers. I know a cool bottle opener which will impress also.

</comment><comment><USER3> I like backpacks, don't have to worry about sizing, and they actually get used.

</comment><comment><USER4> Bloomberg magnets to form nerdy/funny sentences with on the fridge :)

</comment><comment><USER5> socks

</comment><comment><USER6> Beer. (PortEngine Porter)

My company gives out a delicious bottle of beer, and people LOVE it. We're memorable, and I guarantee, people remember the experience. Best part, we get follow up conversations, which is the whole point.</comment>


How to get rich in America - <AUTHOR> http://www.economist.com/blogs/economist-explains/2017/02/economist-explains-0 <comment><USER2> Radiolab recently featured ([http://www.radiolab.org/story/radiolab-presents- media-busted...](http://www.radiolab.org/story/radiolab-presents-media-busted- americas-poverty-myths/)) some content from another podcast series called "Busted: America's Poverty Myths", that examines various myths about the poor - and by extension, the rich - in the US. It was fascinating. One thing that was discussed is the degree of upward economic mobility in the USA. IIRC, they measure this by the likelihood that someone who is born into a family that is in the bottom 20% of earners enters the top 20% of earners in their lifetime.

In other words, what is the statistical basis for the belief that in America, anyone can go from "rags to riches"?

It turns out that in the US, the percentage of people who achieve this feat is, on average, about 7%. In Canada, it's about 13.5%. Another myth busted.

Conclusion: if you want to get rich in the Americas - or at least, well-off in the Americas - come immigrate to Canada. Especially if you're reading this comment, since you likely have the kind of education and experience that makes immigrating here a breeze. Sure, it's cold here in the winter, but you'll make enough cash that you can spend a chunk of the winter in Mexico!

<comment><USER3> I'm biased here. I grew up well within the bottom 20% if not the bottom 10% of family incomes. I'm now personally in the top 5%. At no point in my life did it feel like there was anything holding me back. In fact if anything it was frustrating to watch as other people in my situation got handouts while I had to work my way up. I think America is just fine (with maybe a little too much affirmative action).

<comment><USER4> Well, it depends on your environment. What where your parents doing and what was your personal "big break"?

<comment><USER5> >>what was your personal "big break"?

This.

Many times.

Often people luck-out and think that the same would happen to everyone sooner or later. Or worse they think it was their work all along and nothing else.

You can very easily deceive yourself into believing a certain set of things when the times are going good. Unfortunately you might have to fail for reasons beyond your control(for a lot of time, on a lot of things) to convince you otherwise.

<comment><USER6> None of the successful people I know had a single "big break". It took a handful, but more importantly it took the willingness to take risk or do without.

1\. Did you study in high school while everyone else was having fun? 2\. Break - get into good school 3\. Did you graduate with a difficult degree? This is pure tenacity. 4\. Did you do interesting projects on the side in college? Tenacity. 5\. Said degree + projects lead to job. Sort of break. 6\. Moving across the country for a better job - tenacity. 7\. Switching jobs many times to move up - tenacity 8\. Promotion to management/lead/whatever. Tenacity + break because you have a boss that likes you 9\. Large jump in salary by jumping to a company on the way up - break. 10\. Several years with low medical bills, no divorce, whatever so you can save $50k+ per year. Break with slight tenacity for not splurging on stuff

</comment></comment></comment></comment></comment><comment><USER7> It's probably no surprise that the same people that think hard work is what leads to success are the same people that don't understand what the wealth distribution actually looks like in america.

[https://en.wikipedia.org/wiki/File:Wealth_Inequality_in_Amer...](https://en.wikipedia.org/wiki/File:Wealth_Inequality_in_America_by_politizane.webm)

<comment><USER8> Well, the ideal would be very strange though. Top 20% owns only twice as much as bottom 20%? That would mean that the upper class - doctors, lawyers would earn only twice more than garbage men. That probably wasn't true even in Soviet Union

EDIT: played with it a bit and produced this chart - Y axis has the base of the exponential (top 20% earns n-times more than bottom 20%). It seems that what US has is not exponential though - I can't get the bottom 40% to be as small without the top 20% becoming too big. I think that means that it's subexponential

[http://i.imgur.com/gHxBXwa.png](http://i.imgur.com/gHxBXwa.png)

EDIT 2: This is actually about wealth inequality rather than income inequality. So it makes sense for that to be much larger. Here is the paper it's based on

[http://www.nber.org/papers/w18559.pdf](http://www.nber.org/papers/w18559.pdf)

<comment><USER9> And why the hell should I be making more than twice what a fulltime garbage man does? He's objectively providing a more important service and delivering more real physical value than I do.

<comment><USER10> Well said, I completely agree. Also his job is arguably "harder": has to get up super early, physically exhausting, smells bad all the time, etc.

</comment></comment></comment></comment><comment><USER11> >>"Between 1999 and 2004, just 2% of Princetonians came from the families in the lowest 20% of earnings, while 3.2% came from families in the top 0.1%"

These kinds of statistics are appalling to me. I wonder if they continue along the income percentiles (e.g. top 5% has a greater chance than lower 30%, or so). My parents are as middle-class as it comes, one is a nurse and the other is a probation officer. Their combined income is about $150,000. The top 0.1% make > $1.5 _million_ per year. How can your parent's income have such a dramatic effect on your access to college? Is it not enough applicants? Is it lower performance on AP exams? Is it the inability to pay tuition?

I may be a bit bitter as I'm set to graduate med school with $250,000 in debt. It's hard for me to fathom having parents who could pay my tuition four times over every year.

<comment><USER12> If your family income is $150,000 that puts you well above the average - you're probably in the top, what, 5%?

</comment></comment><comment><USER13> Basically having Rich parents makes it easier to become rich. This is even true in the Netherlands. I see children buying houses with parents money and subrenting it to make a profit. I just cant do this, i don't have the capital

<comment><USER14> I second this. Not having parents who spend their life accumulating wealth (read: bought a house which increased an order of magnitude in value over the last 20 years) makes it very hard to even afford a house for your own use, let alone buying one to rent out. With the wealth gap growing ever larger, it becomes increasingly hard to 'break out' of the (lower) middle class.

<comment><USER15> With asses price inflation, depressed wages, insane taxes and and overaged population it is very hard in the EU. Only few make it. By plain luck or maybe by ability.

But you can leave. Best decision I ever made.

<comment><USER16> Where did you go?

<comment><USER15> I was born in the EU, got my PhD in the US and finally hard to start as an illegal immigrant in China and worked my way up. This being said, there are opportunities everywhere.

China. Angola. Colombia. Even Ethiopia. There are opportunities out there for the people who are willing to try or who are forced to try. Places, where there is still some growth, some opportunity and the government does not strangle you.

The best incentive may be if there is something that you like. Be it the weather, culture, language, women. Something that touches you. I saw too many people fail in China. This were the people who wanted to eat every day McDonnalds or Subway instead of Chinese food and called the Chinese "savages". Immerse yourself in that culture. Become that culture. Or how the Chinese say: What you can't avoid, welcome!

</comment></comment></comment></comment></comment><comment><USER17> One thing often omitted, or taken for granted, in the "rich parents" discussion is the curious question of "How did the parents get rich?" Did they have rich parents too? Or did they actually started from very low and got clever/lucky/hardworking. If you think of it this way, having rich parents may not be a magic privilege, a "silver spoon", but a consequence of their effort and sacrifice. Their children do not have to bear the same sacrifice. But you, whose parents weren't that clever/lucky/hardworking, you need to bear the sacrifice - maybe even not to get rich, but give enough of a good start for your children to get rich, and you grandchildren to be called privileged.

<comment><USER18> Sacrifice implies you lose something with nothing gained. These people generated wealth and got posterity and legacy. They bought that with their work, volitionally, and bore the responsibility of the dedication required to keep it.

You aren't sacrificing your money to buy yourself lunch, providing for your kids isn't a sacrifice, and you aren't sacrificing by working more hours to afford that big house and nice car you have.

It's just hard sometimes, but it's all part of the bargain.

<comment><USER19> _" Sacrifice implies you lose something with nothing gained."_

Not true. That is just pure loss. According to its definition¹, "sacrifice" means either "to surrender or give up, or permit injury or disadvantage to, for the sake of something else" or "to dispose of (goods, property, etc.) regardless of profit". Parents working hard in order to provide for their kids may involve something from both of the meanings.

 _" you aren't sacrificing by working more hours to afford that big house and nice car you have"_

It depends on how you look at it, and working more hours for a nice house and car can be both a transaction and a sacrifice. If you consider the leisure time you have to give up (assuming that you don't particularly enjoy your work) then it's a sacrifice. If you consider the time and energy involved in the paid work then it's just a transaction.

¹ [http://www.dictionary.com/browse/sacrifice](http://www.dictionary.com/browse/sacrifice)

</comment></comment></comment><comment><USER20> > That suggests that the simplest way to become extremely rich is by being > born to the right parents. The second-easiest way is to find a rich spouse.

Articles showing just how unattainable wealth is in the USA always remind me of this quote which seems to be the most concise summary of why many poor and middle class people vote against their own economic interests:

> Socialism never took root in America because the poor see themselves not as > an exploited proletariat but as temporarily embarrassed millionaires.

<comment><USER21> It's an old article but at the time 39% of Americans thought they either were or one day will be among the top 1% [1].

1: [http://www.nytimes.com/2003/01/12/opinion/the-triumph-of- hop...](http://www.nytimes.com/2003/01/12/opinion/the-triumph-of-hope-over- self-interest.html)

</comment></comment><comment><USER22> Once was speaker before a few hundred recent grads and asked if they wanted to be a billionaire. Only a few raised there hands.

My theory is most people want more stuff, few really want to be billionaires, or even just part of the 1%.

<comment><USER23> Being a billionaire usually means that you will fear kidnappings and other crime against your family for the rest of your rich life. Earning more than 200k per year will not make you any happier (see [http://www.cnbc.com/2015/12/14/money-can-buy-happiness- but-o...](http://www.cnbc.com/2015/12/14/money-can-buy-happiness-but-only-to- a-point.html) ).

<comment><USER24> I'm curious. Is kidnapping a real fear for rich people in the West?

</comment></comment></comment><comment><USER25> By America they mean the country "USA". Not Brazil or Mexico or any other part of America. Given the salary inequality between the USA and most of the other countries in America it is easy to automatically imply that you only need to be in the USA to get rich in America.

<comment><USER26> I know America is a continent and all that, but more often than not people refer America to USA.

<comment><USER27> Only in the U.S./English.

If you refer to "America" in Spanish it's assumed you're referring to the continent, the state is commonly referred to as the United States or the United States of America.

We actually call ourselves Americans here in Uruguay.

[https://es.wikipedia.org/wiki/Uso_de_la_palabra_americano](https://es.wikipedia.org/wiki/Uso_de_la_palabra_americano)

 _" En el uso tradicional a los naturales de América como continente.

En un segundo término, a los ciudadanos de Estados Unidos de América, uso derivado de la influencia lingüística inglesa."_

<comment><USER28> And if you refer to "Spain" in Spanish, people will be similarly confused. But we're not speaking Spanish.

</comment></comment></comment></comment><comment><USER29> This article is about employers hiring Ivy League graduates. Why is this news? The phenomenon is just as acute in SV as it is on Wall Street.

The Tier 1 schools in the US are the Ivy League, MIT, and Stanford.

Getting into these great schools starts by being incredibly precious in elementary school and middle school, and really accelerating the positive energy and focus in high school.

</comment><comment><USER30> But this just assumes that everyone is striving to get into 0.1% equally, where it might make more sense assuming that someone who goes to Wall Street wants to get rich more than a nurse.

It's like saying it's a lot "easier" being in top physical shape if you exercise at top sport facilities in the country, and/or already come from a family of athletes.

Both of which are already signals you might be trying very hard in the first place.

Coming from rich families might also mean being rich and making money is more socially valued. And rich families don't posses only money and connections which makes it easier, they probably also have good knowledge of how to make money and where money can be made compared to working class families.

So before jumping to any conclusions on how easy it is and why it is easier exactly, stuff like that needs to be thought through a bit.

</comment><comment><USER31> TL;DR - have a rich family or marry a rich person. if neither work - go to harvard and hope

</comment><comment><USER5> Came to work in the US. Have moved back to my home country. But would love to come to US again(A great country, no doubt). A few things that I have noticed.

1\. It can be really quite hard to get rich(like crazy rich) as a programmer unless you have a very generous stock grant package. When I mean generous, I mean like really in the upper order of 6 figures. Given tax is going to eat a good bunch of it.

2\. Taxes will eat a lot of your salary and bonus. So any dream of making it big out of saving up monthly salary is absurd to a large extent.

3\. What makes 2. even more so true is at some point in time you have to buy a home, and take some responsibilities with regards to kids and family. Your savings cache will only decrease.

If you are in the Bay area, rents will eat your ice cream. Buying a home is in the order of >=$1 million. Kids can be expensive if you want them to have a good future. If you want to buy a home, you will lose half your life to monthly payments. Plus comes the regular fear of defaulting on payments in phases of financial crises and job losses. And also be prepared for routine house maintenance expenses and property taxes.

Overall life is hard for immigrants.

But I can imagine it would be the same for US citizens who come from poverty. Education would come at a thick debt on top of which you have to build the above points I mentioned.

Life if pretty much paycheck to the next. Paying monthly installment for car, bills, mortgage etc.

Somethings that I like about the US:- Social security, infrastructure, uniform quality of education, merit and overall values on which the country is built. Overall there is better appreciation for merit and quality than most countries.

If you are in the US you have already made it big by many a definition. You just have to go farther.

<comment><USER32> > Somethings that I like about the US:- Social security,

?!? That's literally against _everything_ I ever read about USA (living in EU, never been to USA).

<comment><USER5> Depends on where you come from. I come from India, here we have 0 social security.

Any upgrade from 0 is good.

<comment><USER32> Ah, that makes a lot of sense.

The world is so large, it's so easy to forget this when living inside one bubble or another. Thanks for pointing that out for me :)

</comment></comment></comment></comment><comment><USER22> Here's a quick lookup for US annual household income ranks/percentile based on US Census Bureau data:

[http://money.cnn.com/calculator/pf/income- rank/](http://money.cnn.com/calculator/pf/income-rank/)

As of 2014, to be in the top 1% of income earners by household, you needed to make roughly $420,000 a year.

</comment><comment><USER33> It should have been "how to get rich". However, at least in America nepotism plays a lower role in many professions compared to many other countries because competition is much rougher.

</comment><comment><USER34> So what do we do if we don't go to Princeton? Or even UIUC?

</comment><comment><USER35> Is entrepreneurism dead, or something? On HN of all places it isn't even mentioned in the comments?

I think so many of the entrepreneurial doers left HN or stopped participating in discussions long ago.

<comment><USER34> Getting "rich" from entrepreneurship isn't very practical in most cases IMO.

From Dan Luu - [http://danluu.com/startup- tradeoffs/](http://danluu.com/startup-tradeoffs/)

<comment><USER35> ... that is a link about equity tradeoffs _as an employee_. You've demonstrated not even knowing the definition of the word!

Incredible really.

<comment><USER34> In terms of risk founders take on more than startup employees take on more than bigcorp employees too. The tradeoffs for the founders are even worse.

[http://startupclass.samaltman.com/courses/lec01/#annotations...](http://startupclass.samaltman.com/courses/lec01/#annotations:4119881)

<comment><USER35> Entrepreneurism is still very much alive. Down but not out. However for this board, talk of it is decimated. To the point where the only mention of it is in this thread, where I am speaking to one person, who needed to be reminded what it even means.

</comment></comment></comment></comment></comment><comment><USER36> Blah blah college. Degree has nothing to do with getting rich

<comment><USER37> From the article: _Few engineers, nurses or pharmacists make it to the top 1%, which is dominated by bankers and other financiers._

Do you think the statement in the article is wrong? Based on what?

Do you think a college degree is irrelevant to become a banker or other financier?

<comment><USER36> Get rich != become a banker. The article would be accurate if it said "how to become a banker"

<comment><USER37> > Get rich != become a banker.

The article doesn't say that. The passage I quoted doesn't say that either.

</comment></comment></comment></comment><comment><USER38> As though a huge number of poor immigrants haven't come to the US and succeeded massively, after coming from nothing?

Is this person serious?

<comment><USER39> A huge number certainly haven't succeeded massively. A few have. Also a lot of legal migrants already come from (relatively) rich families since US migration can be expensive and favours the educated.</comment></comment>


Ask HN: Anybody know somebody working on Google App Engine? - <AUTHOR> I have an app I haven't deployed for a few years. It's been chugging away providing a bit of pocket money for years. I pay google a few hundred a month in hosting.
Today I installed the gcloud tools on my new PC and attempted to deploy to my sandbox in preparation for fixing a few bugs. I've found that my Model classes now just throw "Missing or insufficient permissions" exceptions when attempting to fetch data from the data-store.
I don't really know how to go abut debugging it. I've read through the docs and as far as I can tell it should all just work.
Any suggestions? <comment><USER2> Since you didn't get any answer here, perhaps consider submitting your question to Server Fault and r/AppEngine (on Reddit). Best of luck!</comment>


Employees inside WeWork talk about the non-stop party to attain a $100B dream - <AUTHOR> https://www.businessinsider.com/employees-inside-adam-neumanns-wework-reveal-a-wild-culture-2019-9 <comment><USER2> (Paywall)

<comment><USER3> The paywall on this site is easy to get around: use a browser add-on like uMatrix to disable 3rd-party domains. (On other paywalled sites, you can read the articles if you disable JavaScript and/or cookies.)</comment></comment>


Bitwarden: Free, open-source password manager - <AUTHOR> https://bitwarden.com/ <comment><USER2> There's compatible Bitwarden server written in Rust called bitwarden_rs[0] for those who don't want to run the official Docker image with the requirement of Microsoft SQL Server and the demand for 2GiB of RAM.

[0] [https://github.com/dani-garcia/bitwarden_rs](https://github.com/dani- garcia/bitwarden_rs)

<comment><USER3> Does that give you access to all the features, or do you still need to pay?

<comment><USER4> Haven't used the official server, but I've been using the official clients with bitwarden_rs without issues for the past week. So I'd guess its a complete reimplementation.

<comment><USER3> I'm not talking about API compatibility so much, but I think I read somewhere that you need to get a license even if you use a custom server. So all the custom server gives you is it decouples you from the main service.

Do you get TOTP support and Organizations on your custom server for free?

EDIT: I just tried it, and yes, you do get (at least) TOTP support for free. Haven't tried orgs, but I'm going to convert it for Dokku now and host it somewhere as a backup plan.

<comment><USER5> > I read somewhere that you need to get a license even if you use a custom > server

I don't think this is the case. There's really no way to use the license with a custom server anyway.

</comment></comment></comment></comment></comment><comment><USER6> Previous discussions:

2019 [https://news.ycombinator.com/item?id=18433144](https://news.ycombinator.com/item?id=18433144)

2018 [https://news.ycombinator.com/item?id=17503917](https://news.ycombinator.com/item?id=17503917)

2017 [https://news.ycombinator.com/item?id=15733540](https://news.ycombinator.com/item?id=15733540)

[https://news.ycombinator.com/item?id=14865932](https://news.ycombinator.com/item?id=14865932)

[https://news.ycombinator.com/item?id=14264117](https://news.ycombinator.com/item?id=14264117)

2016 [https://news.ycombinator.com/item?id=12676979](https://news.ycombinator.com/item?id=12676979)

</comment><comment><USER5> I just set up my own Bitwarden server the other day using bitwarden_rs, a third-party implementation written in Rust.

It basically gives you all of the premium features for free, as opposed to the official server which requires a license.

I really wanted to run the official server, but they offered no option of a lifetime license (only a yearly license). For what it's worth, I would have been willing to pay a lot more for a license that never expired.

The whole reason I'm hosting the server myself in the first place is because I want _full_ control, so a subscription based license doesn't really fit well there.

Given that the project is licensed under the GPL, the license is effectively a donation anyway, so I hope they consider offering a lifetime license for those who want to self-host.

<comment> m-p-3 Does the bitwarden-rs server works with the browser addons and the desktop/mobile apps?

<comment><USER5> Yeah, it works with the official Bitwarden clients. I'm using it with the iOS client personally.

</comment></comment></comment><comment><USER7> We've been using Bitwarden at work, the Teams plant, paying $15 per month, or $180 per year for 10 users. The only reason for why I picked it is its open source nature, otherwise I would have gone for 1Password Teams.

The pricing is odd. For example you can't self host it yourself without paying for a license. The code is AFAIK open source, so you could maintain your own fork with the required code branches removed, if you wanted to. I do hope the author doesn't pull a bait and switch, after enough users go down this route. Don't get me wrong, I'm actually not looking into hosting it myself, I'm glad to pay for a hosted service, but with open source I want that possibility to be there and I don't want licensing per user for self-hosting either.

And currently I like what the author has been doing. Adding some code in there that makes it require a license, but that you can remove, is totally fine. But I'm seeing more and more open source apps turning proprietary nowadays and I don't look kindly to such bait and switches, because I end up using those apps because they are open source. Like it is the case for Bitwarden, otherwise there are often better proprietary options available.

From a usability standpoint, Bitwarden is unfortunately inferior to 1Password in every way. But it works fine for our purposes, for now. And Bitwarden is better than LastPass in case you're wondering, even if it has some missing features.

The official servers are slow. I just had multiple login failures. I'm assuming that it's experiencing issues due to being featured on HN right now, but this isn't the first time that it's happening.

But as long as it is _open source_ and as long as it does a reasonable job, then I'll keep supporting it. Because I'd rather pay for open source solutions.

<comment><USER8> Doesn't it bother you that even though it is open source, it is essentially maintained by one person [1]?

What happens to the SaaS offering if he gets run over by a car?

[1] [https://github.com/bitwarden/server/graphs/contributors](https://github.com/bitwarden/server/graphs/contributors)

<comment><USER7> Open Source means that it can be forked.

If that guy gets hit by a bus and if the app is useful enough (and it is), then a fork will happen. And I can always do some contributions myself. And if I'm wrong and that fork doesn't happen, then nobody (with resources) wants it, in which case might as well let it die.

The bus factor for open source stuff is great, even with zero contributors at any point in time.

In contrast when a proprietary app gets killed (either due to acquisition or b/c it's not profitable) then it's gone for good. If a proprietary app changes, to include ads or anything that you don't like, there's absolutely nothing you can do but switch to something else or bend over.

</comment></comment></comment><comment><USER9> I've switched from KeePassXC, stored on my Google Drive with an offline key file, to BitWarden last month. I previously was a customer of LastPass and switched to KeePassXC after being tired of LastPass' UI mess.

Anyways, BitWarden works absolutely flawlessly. There are a few things here and there that I'd wish it had, like the ability to create templates for custom categories, but apart from that, it does an amazing job. The websites autocomplete works really well, and I was pleased to see that I can unlock my vault on my phone with my fingerprint reader.

Migrating data from KeePassXC to BitWarden went smoothly. I took a moment to clean my database and reorganize a few stuff. The database takes a bit of time to load, but nothing that's a real bother.

The only thing I don't store in BitWarden is the 2FA TOTP I use (mainly Google Authenticator) as I feel it breaks the entire concept for 2FA. I've seen people on HN do it, but to me it just feels wrong.

<comment><USER10> I currently use KeePassXC and think it's great. What made you switch? BitWarden seems interesting but it's not completely free and you'll need their servers (or you can set one up yourself). Granted I also use Google Drive to sync my KeePass db so I'm also using someone else's servers but I've been considering changing that to syncthing to cut out the server.

<comment><USER11> I'm also curious about the same thing. Ever since I started using KeePassXC's autotype feature, I haven't been able to go to any other password manager. Even with the degraded mobile options and having to build my own syncing with things like rclone.

Does Bitwarden have that autotype option? If not, I'm wondering how difficult it would be to build it myself, if only for the desktop clients.

</comment></comment></comment><comment><USER12> I reviewed Bitwarden for use in my company a few months ago. I discovered that there was no way for an admin to allow the recovery of an account (i.e. allowing a master password reset). This is a non-starter in my organization since some small percentage of the users _will_ forget their master password.

Has anyone else been successfully using Bitwarden in a team setting? If so, how do you work around the limitation I mentioned and other such things?

<comment><USER13> I suppose it's for the same reason as why you cannot reset your forgotten private SSH key.

Secrets are only stored encrypted, and the key is derived from the master password, not known to any admins. Cracking the admin account or the entire server gives the intruder very little.

So, it's a feature. You may not want this feature, though.

<comment><USER14> > you cannot reset your forgotten private SSH key.

You can though. If you lose your private SSH key, you regenerate it, and the server admin resets your public key. Zero data loss.

I think the better analogy would have have been a disk encryption key. But note that consumer facing encryption tech (Mac, Windows) generally doesn't stick to "user forgot key = user lost data".

> So, it's a feature. You may not want this feature, though.

Yeah, I must agree I do not want this.

I understand it is more secure but it is also more user hostile.

I'll take the risk of a compromised admin (assuming strong password and TFA of course) over "sorry you lost all your data."

Data integrity is just as much a part of security as data privacy.

<comment><USER15> > If you lose your private SSH key, you regenerate it, and the server admin > resets your public key. Zero data loss.

This is exactly the same data loss as when you lose your master password.

Just like you store multiple passwords in your password vault, your SSH key can give you access to multiple servers.

If you lose it, you have to "reset" your public key on _every_ server, just like you have to reset _every_ password that you stored in your password vault.

<comment><USER14> That's true.

Though of the purposes of having password manager is managing with large numbers of disparate systems.

Whereas an SSH is simply the authentication mechanism, and may or may not be shared across large numbers of systems.

</comment></comment></comment></comment></comment><comment><USER16> I'd still much rather stick with [https://www.passwordstore.org/](https://www.passwordstore.org/). It's encrypted with your keys (which I didn't see on Bitwarden's site) and has plugins for Chrome/Firefox (you can setup keyboard shortcuts to fill in your info automatically as well) and works with Git.

Although it is a bit of a hassle to setup on mobile devices (I use Pass for iOS), the security and functionality it provides is worth it.

<comment><USER17> I would argue that pass isn't that secure other than when your computer is off.

Namely that it requires copy and pasting. Any program on your computer can read your clipboard.

And for a normal user who are more vulnerable to phishing, there isn't automatic domain checking. It would be their normal work flow to copy a password into a malicious site.

<comment><USER16> If you install Browserpass for Chrome (there's an alternate for Firefox as well) all you need to do is type in your keyboard command and it'll automatically fill out your info for you on the website.

Meaning: Suppose you go to gooogle.com instead of google.com, the extension won't fill out info because it doesn't recognize you having an user/pass for gooogle.com

<comment><USER18> This is a basic feature of every password manager I've ever used.

<comment><USER19> Yes, he's just making the point to the GP, that actually copy and paste is not a requirement to use pass.

</comment></comment></comment></comment></comment><comment><USER20> I'm a little put off by the login and service. It's just one more thing that can be shut down. Especially since iOS and android allow syncing on remote services such as dropbox and iCloud (how it works in 1Password ver 6 and below). There's really no necessary need for a centralize service.

Create the encrypted vault in your preferred cloud storage service and locally and sync across all devices.

<comment><USER21> You are right. Yet hosting an encrypted 10kb for each user means that even if Bitwarden had a million free users it'd need no more than 10GB of cloud space to store all data. Consider syncing at startup or on adding new entries and the number of requests is also negligible. Not really a service that the company would ever had to cut to save money.

What makes you so sure that dropbox and icloud will never be shut down?

<comment><USER22> > What makes you so sure that dropbox and icloud will never be shut down?

They might, but then they're trivial to replace and you have a backup.

</comment></comment></comment><comment><USER23> Given the requirements of self hosting, ill just stick with keepass. The desktop and mobile clients are great and I can host them on my nextcloud and grab them over WebDAV.

<comment><USER24> You can self host Bitwarden or use the cloud version

<comment><USER23> I should've been more clear. I don't host the clients; rather, I host the databases. That's why I prefer keepass - it's just an encrypted db which is lightweight and the clients tend to be lightweight as well.

</comment></comment></comment><comment><USER25> I'm using Bitwarden and 1Password at the same time (private and company use).

1Password pros:

* very polished UI, pleasure to use

* good UX in general

1Password cons:

* I have constant issues with it loosing connection with browser. Extension just randomly stops working for few days. Tried to fix it multiple times, never succeeded

* Price (too expensive for my private use)

Bitwarden pros:

* Free

* Very simple app, easy to use

* More reliable than 1Password for me

* Fills login pages quicker than 1Password

* Feels quicker and more snappy than 1Password

Bitwarden cons:

* Lacks 1Password polish, generally UX and UI needs some work

* Can't login using fingerprint on Mac

* Crashes on my iPad when trying to save new credentials (need to report it as a bug, but I didn't go around to it yet)

* Slow on Android

All in all, I'm very satisfied with Bitwarden and use it daily.

<comment><USER26> I have the same situation, Bitwarden for personal use and 1pass at my job.

1pass does a few things better (2FA, background agent so I don't have to log into the browser and desktop app separately, general level of polish), but apart from that they're largely interchangeable for me.

<comment><USER27> If everyone took your advice and used 1pass, then I doubt 1pass would be able to defend itself against the coming hack attacks. I do say this in a bit of ignorance, but they don't imho possess the resources to defend against the complete list of cybercriminals out there.

<comment><USER28> Who do you suggest does have the resources?

Bitwarden is essentially the work of one person[0].

Are you suggesting that we only rely on Apple Keychain and Chrome password sync due to their MegaCorp backing?

0: [https://github.com/bitwarden/server/graphs/contributors](https://github.com/bitwarden/server/graphs/contributors)

</comment></comment></comment></comment><comment><USER21> Very interesting. Has anyone been using it as a daily driver and could comment of safety, reliability and browser integration? How well do they behave compared to e.g. 1Password?

<comment><USER29> I'm a very happy user (Firefox and iOS). Switched from LastPass about a year ago (found it on hacker news back then) and never looked back. I can't compare it to 1Password, since I never used it.

<comment><USER30> I switched from LastPass today, and already liking it a bit more. Not as slow and doesn't slow down on forms, for one!

</comment></comment></comment><comment><USER31> Bitwarden has changed my life: it's the first password manager I can get my family to use. The commercial ones all had ads or upsells that interfered with the experience, while Bitwarden just worked. Props to this creation.

</comment><comment><USER32> I find it ironic that they claim "[s]ource code transparency is an absolute requirement for software solutions like Bitwarden" on their website yet they require SQL Server 2017, a completely proprietary RDMBS.

<comment><USER5> I don't think it's that ironic.

All of the software written by "Bitwarden" is open source. The fact that it uses some pre-existing propriety software doesn't change that. If it did, then that logic could really be extended to any piece of software written for Windows.

<comment><USER32> It's ironic b/c they claim source code transparency is an absolute requirement yet they rely on something that is not source code transparent to store the data.

You can write open source code for Windows all day long and it doesn't change the fact the your code is open source.

However, to claim that you need transparency for your security product and then build it on top of a proprietary storage engine is incongruent.

<comment><USER33> Security requirements all apply to the client side. The storage on the server doesn't matter. You could upload directly to the NSA and it will still be fine.

Also, there are many server implementations other than the official one.

</comment></comment></comment></comment><comment><USER34> For people who don't want to go through the trouble of self-hosting and also don't want to pay for a subscription I have had pretty good luck with Enpass.

* It stores an encrypted file on a cloud storage platform of your choice (gdrive/dropbox etc) and syncs across devices. * No subscription fees

<comment><USER35> > Stores up to 20 items

How is this possibly a replacement for Bitwarden considering they don't have any limits on the number of passwords for the free accounts?

<comment><USER34> You pay once for cloud based sync instead of annually

</comment></comment></comment><comment><USER36> I found the pricing to be a bit confusing. I'm self-hosting it now and been happy with it, but when installing for the first time I couldn't find how to share some of the passwords with another user. Well it turned out that in self-hosted instance you don't have that possibility to share to another user without a paid license. Ok, fine by me so I bought the one year premium for the self-hosted instance as from one of the tables in their website it said that would be needed. So now I had the one year premium with all the nice features but still I couldn't share passwords. Importing the license key to create an organization (for sharing) failed every time. I contacted their support and found out I had just misunderstood the pricing. To create an organization you need an organization license, which was another roughly ten euros a year. After bying that I had it working as I wanted. Their support also gave the possibility to get money back from the unneeded personal premium license as it wasn't needed for my usecase, but I kept it as I found the price to be quite ok.

So that might have sounded like a rant, but my only issue was that I didn't understand the pricing for self-hosted. My one year is up soon and I will be renewing my license as we've (as in me and my wife) been happy with Bitwarden.

<comment><USER37> In 1Password, you cannot share passwords at all …

(Sharing is useful if you set up new accounts for other users.)

<comment><USER38> Yes, you can. [https://support.1password.com/create-share-vaults- teams/](https://support.1password.com/create-share-vaults-teams/)

<comment><USER37> That's vault sharing, not password sharing.

</comment></comment></comment></comment><comment><USER39> Its good for personal use, but enterprise features are weak/missing and the layout isnt very enterprise ready. I tried their "Organizations" feature out to see if I could deploy it at work instead of teampass, and it wasn't comparable. They are still fixing and developing, so it might be enterprise ready someday. It really is a nice with all the addons.

I use the bitwardern docker version for people to use, I have it installed, but for my own use, sticking with keepass.

</comment><comment><USER40> As someone who has used 1Password for many years, how does Bitwarden compare?

<comment><USER35> I have been using Bitwarden because its free for about 1.5 years. The UX experience is so bad on both mobile and extensions. If the extensions closes, like when you copy the password and paste it into the box, it looses its location, so you have to re-find the account, click on it, and then copy the username. You get what you pay for.

<comment><USER41> > If the extensions closes, like when you copy the password and paste it into > the box, it looses its location, so you have to re-find the account

That's not my experience. The account details stay open for me.

For me the UX is not amazing, but ok. A bit better than LastPass, a bit worse than 1password.

<comment><USER35> This happens to me on Firefox.

[https://recordit.co/QdK2FrRoYX](https://recordit.co/QdK2FrRoYX) I copy the password, go to paste it in and it loses the selected account:

[https://recordit.co/jrvUFWCPkS](https://recordit.co/jrvUFWCPkS) Here, I go to add an account. I generate a new password and then I try to paste it into the text box to verify it meets the website's password rules. I then go back to hit save, confirming that it worked and it loses the entry.

Sooo frustrating.

<comment><USER42> You can just right click on the text box and use the context menu to make this task much easier.

<comment><USER35> oo that is a cool trick! but it doesn't work if you're looking for an account that doesn't match the current URL (like if you created the account on the mobile app)

<comment><USER43> In that case it's simpler to find the right password entry, click edit on it and add the current domain to the list of domains it keeps for the entry. That way you won't need to mess with the copy/paste button.

I use Bitwarden myself and I only need the copy/paste button for stuff like email and WiFi passwords. If you're manually copying and pasting data, you're probably overlooking one of the many (sometimes not clearly indicated) features Bitwarden has.

Hope this helps!

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> I changed from LastPass to Bitwarden. Have been quite satisfied with it so far. The save suggestion was annoying sometimes but overall everything works pretty fine.

Would recommend it to everyone in need of a password manager now.

</comment><comment><USER45> I wish the Bitwarden mobile app would support multiple accounts so I could use a server at work and another server for my personal stuff.

<comment><USER46> I just sign in as another (email) user.

<comment><USER47> That would require logging out and back into the mobile client every time they leave and start work... that's pretty tedious.

<comment><USER46> Not at all..a few clicks. Safer, as well...I use email addresses no one else knows.

</comment></comment></comment></comment><comment><USER48> Is it possible to migrate (export then import) data from bitwarden? I'd like to sign up for a free account, and I'm wondering if I'd be able to move my data to a private (bitwarden_rs) instance later.

</comment><comment><USER49> Big fan of Bitwarden! I have tried almost all the password managers over the last few years, and this is the one I finally settled on. Every previous one had some element that bothered me or was principally wrong.

</comment><comment><USER50> For business users, can a single password be stored in multiple "shared folders" or groups?

For example, can I share a password with both "marketing" and "customer support"

The lack of this is one of the biggest pains I have with LastPass

<comment><USER51> Yes, that feature is called "Collections". An item (login, card, secure note, etc.) can be shared into multiple collections (only within one organization). For each collection per user permissions (none, read, write) can be set.

</comment></comment><comment><USER52> my only gripe with Bitwarden is that it only allows one login per website that I've seen. At work we use DashLane cause you can have multiple saved logins per website, which is a God send when dealing with multiple clients.

Bitwarden is great for personal use, but I can't use it at work cause of this one missing feature. If anyone knows of a way to make it have multiple logins per site, I'm all ears as I would love to get rid of DashLane and it's horrible Chrome Extension.

<comment><USER8> Are you saying that I can only have one saved account for say twitter.com? That's definitely a killer for me.

<comment><USER47> I'm not sure what OP is on about, but I've got plenty of sites with multiple logins just fine...

I'm using Bitwarden_rs as a server, but the official Apps all support it great, so it would strike me as a surprise if the official server didn't have this ability too.

</comment></comment></comment><comment><USER53> There are no screenshots of the UI on the homepage. Adding them would be helpful.

</comment><comment><USER54> You know,

I just had a thought. What I would like is password protected, "password notepad". When activated, it remembers the text of passwords, shows it to you in text when you go to a website and then you type it into the site. (people looking over your shoulder is a way overestimated danger, the password-hiding thing dates to shared terminals).

The thing I hate about password managers is I am afraid I would stop knowing my passwords. This would allow me to remember my passwords since I would type them each time.

I've only seen Firefox and Chrome's built-in password managers so maybe this exists already. But it seems a decent way to do it.

<comment><USER55> > The thing I hate about password managers is I am afraid I would stop knowing > my passwords.

That is a feature. The handful of passwords I know are mostly long passphrases. The rest are long random strings, generally up in the 30-something character range.

In fact, I don't even know some of my logins anymore: I will use or at least append random characters to most accounts that don't have any 'social' functions (that I care about). I also use a unique email per site.

If an account is compromised, it's got a very low chance it'll even connect to another account I own (at least not without human interpretation), and zero chance of helping with cracking any of my other passwords (other than hinting you can skip guessing anything <30 characters).

I have backups of my password file, I have email recovery (to a domain I own) - knowing individual accounts is just unnecessary.

<comment><USER56> How do you have unique emails per site?

<comment><USER57> Not OP, but just a guess: you can use tags in your email (add `normal- email@example.com`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don't know—then you can easily create as many emails as you want and forward them to other accounts.

<comment><USER58> Some overly strict checks on some websites don't allow tags, but if you host yourself there's also the possibility to use `normal- email@example.com`. Pretty convenient for filtering.</comment></comment></comment></comment></comment>