Richard Stallman on proprietary software, SaaS and open source - <AUTHOR> http://gigaom.com/2013/08/06/hactivist-richard-stallman-takes-on-proprietary-software-saas-and-open-source/ <comment><USER2> "Richard Stallman, revered by some as a genius (after all, he won a McArthur "genius" grant in 1990) and by others as a crackpot"

When I first heard him speak many years ago, I thought he was a real crank. My negative thoughts centered around:

1 - How can we build the next Microsoft without true ownership?

2 - Does his model of thinking demand that 100% of the population be technical enough to troubleshoot their computers?

3 - I can see people writing software for love, but who writes all the documentation?

As the years go by, he's one of the few people who sounds less like a crackpot, even though he hasn't softened his extremism. With the current state of patent trolling, it's getting harder to create the next Microsoft. Improvements in GUIs is taking some of the issue away for #2. But I still haven't figured out #3.

Edited for formatting

<comment><USER3> > I can see people writing software for love, but who writes all the > documentation?

1\. People like me? :) I genuinely love writing documentation. Though I should mention it's easier to write books/tutorials than to write detailed documentation of the software you are yourself not writing, which brings me to point 2.

2\. Writing documentation is very much a part of software-writing. It's usually best to do write documentation as you're writing the software... I haven't met anyone yet who really hated the process, so I wouldn't consider this to be a big problem at all.

<comment><USER4> I too write documentation. Not exclusively, but in my day job I often write manuals and other documents for our software, and I've done documentation work as a volunteer for Project GNU.

It's no more strange that someone would enjoy writing documentation that it is that someone would enjoy writing software, though just as non-developers don't understand the joy of programming, I imagine that non-writers don't understand the joy of documenting.

<comment><USER2> Fair enough. I think my bias showed. :-)

So a question in return... Do you share my belief that documentation tends to lag in most projects? And if so, is the bottleneck not enough documentation writers, or not enough engineering time and attention? I've assumed it's the latter, though it could be the former. Or is it something else?

<comment><USER4> _Do you share my belief that documentation tends to lag in most projects?_

Absolutely.

I suspect that the number of people interested in writing software documentation is fairly small: they have to have enough knowledge of software engineering to be able to understand what they are writing about, and they have to be good writers. Anyone could learn software development, but not everyone does. And anyone could learn how to write well, but not everyone does. So the set of people who learn both is even smaller.

On commercial software engineering projects, my experience is that documentation of any sort is made as much of an afterthought as possible, if even that. Unless there's some business case (i.e., obvious money) that comes from spending time on documentation, then it doesn't make it very high on the priority list. Which is unfortunate, because as a software developer, I've wasted a lot of time figuring things out that should have been documented. So money can be saved later on, even if no money is "earned" up front.

For free / open source projects, the story may be different. There's not necessarily paid engineering staff involved, so if documentation doesn't get written, I can only presume that the developers either didn't want to, didn't know they should, or felt incapable of writing it. I find it hard to imagine taking a principled stand against having good documentation.

BUT... in my anecdotal experience, I've encountered volunteer open source software developers who in fact did seem resistant to accepting offers of volunteer help with documentation. So I'm not really sure what's up with that.

</comment></comment></comment></comment></comment><comment><USER5> I didn't think this article was very good at all, I've read all this before.

These are just Stallman's exact ideas rehashed under hotwords like Snowden & SaaS...

I'd usually try not to whine but I'm not even sure if the quotes they use are from the talk or from years ago.

<comment><USER6> Probably both. Like a lot of other speakers, Stallman has a few canned speeches. He asks the organizers which one they want, and he gives it. It probably evolves over time, but the differences are minor.

The issues Stallman talks about have not changed much over the last 20 years, so his speeches haven't either.

</comment></comment><comment><USER7> I have to admit before the whole PRISM story I didn't think much about Richard Stallman and thought he's too extreme or delusional. After PRISM however I realised he was right all this time and I was just too stupid and blind to see it. I'm going to read more of his notes. Very few people have what it takes and are willing to pay the huge and continuous cost of rejecting proprietary software/technology. But he has been standing by his principals for a lifetime and I respect him for that.

<comment><USER8> Read this and talk about ominous: [http://www.gnu.org/philosophy/right-to- read.html](http://www.gnu.org/philosophy/right-to-read.html) I think rms has other interesting articles on the same subject but I fail to find them right now, I now I read a few back in the days when I was diving into FLOSS.

</comment></comment><comment><USER9> I attended a talk by Richard Stallman about two years ago, and it revolved around the same ideas. While some of his ideas are a bit too extreme for my taste, e.g., when a guy asked how to make money by building Open Source software he replied something like "get another job", I think that many of them are inspiring. Such as the ones about proprietary formats and owning your own data.

<comment><AUTHOR> I attended the talk covered in this article, and someone actually asked him a similar question there.

His reply this time is that, personally, he had never made more money in his life than when companies paid him to fix or improve open source software. And I can see his point!

It may not be common, but there certainly plenty of organizations that either have business interests aligned with open source technology (e.g. 10gen, MySQL AB), have open source ingrained into their culture (e.g. Wikimedia Foundation, Mozilla), provide consulting/training services around open source (e.g. DataStax, Elastic Search, LucidWorks), or simply use open source so heavily that they need to pay people to improve it (e.g. Intel, Google).

And then, there are plenty of companies (like mine, [http://parse.ly](http://parse.ly)) that take the business perspective that anything that isn't core to our business / competitive advantage not only can, but _should_ , be open source, eventually.

Getting a job working on open source isn't some fringe thing anymore. If it feels that way because _your_ employer doesn't allow open source work, you may want to get the heck out :)

<comment><USER10> And Mozille gets its money wrom where? Google paying for being the default search engine? Is Google search open source?

</comment></comment></comment><comment><USER11> This was a terrible piece. Why/who think Stallman is a crackpot? And what is up with this snide editorializing?:

'"Almost everyone in the world using proprietary software is also using propriety malware," said Stallman, who looks every inch the part of a hactivist with his long mane of graying hair.'

I actually bust out laughing when I read that. Journalistic standards, please.

</comment><comment><USER12> who is a "Hactivist"?

why is rms one?

the article only says: "Stallman, who looks every inch the part of a hactivist with his long mane of graying hair."

does that mean i can Hac if I look like Gandalf?

the fact this is not a typo and the explanation given practically discredit anything written in the article</comment>


Use App Engine and Go to Host a Static Website with Same Domain Redirects - <AUTHOR> https://thornelabs.net/2017/03/08/use-google-app-engine-and-golang-to-host-a-static-website-with-same-domain-redirects.html <comment><USER2> This is well done.

If you want it 'done for you' or have a site that doesn't fit in the free tier on GAE but don't want to spend money - take a look at Netlify.

Free tier is generous, has CDN, free auto-provisioned SSL, builds automatically from a git repo (GitHUb/GitLab etc) and you can simply upload a _redirects file to handle redirects[0].

It'll even build a 'preview' of a branch, so just create a branch, make your changes and merge request, then Netlify will build a temporary site to view the changes - useful if you need to show someone what the changes to the site will look like.

I just switched from GitLab pages, and even changed domain from the apex to www (to get full DDoS/CDN benefit out of Netlify this is needed) - which is handled automatically.

If you want to have a poke around/speedtest of a site using it I'll link below[1].

[0] [https://www.netlify.com/docs/redirects/](https://www.netlify.com/docs/redirects/)

[1] [https://www.josharcher.uk](https://www.josharcher.uk)

</comment><comment><USER3> I host my static website using Firebase and Google Domains. Google has easy integration between the two and seems to include all the listed benefits out- of-box.

</comment><comment><USER4> Thrifty way to do this. Seems the golang code, though, isn't setting any expires or cache-control headers (for the static content it's serving), so your browser ends up re-downloading a lot of assets that it doesn't need to.

Might be nice to add that bit in. Better performance for visitors, and would keep you in the free tier longer if traffic grows.

<comment><AUTHOR> You are correct, and great points. This is my first Golang app, so doing what you suggested is my next step. Thanks!

</comment></comment><comment><USER5> The app.yaml routing allows "fall-through" routing, where your application's handler is only invoked if no static files match:

      - url: /static
        static_dir: static/
      - url: /.*
        script: _go_app

The redirect 'map' smells bad- better to simply serve the file if path exists, redirect if it doesn't.

</comment><comment><USER6> Or just use Netlify: [https://www.netlify.com/](https://www.netlify.com/)

<comment><USER7> Seconded, lately I've been using Lektor+netlify for all my sites. Deploying is just a git push, and it's zero-headache. Greatly recommended.

</comment></comment><comment><USER8> Heads up Google Cloud just release a new feature today which allows you to redirect traffic to different storage buckets and even VM instances using simple rules which are themselves stored in a storage bucket.

[https://cloud.google.com/compute/docs/load- balancing/http/us...](https://cloud.google.com/compute/docs/load- balancing/http/using-http-lb-with-cloud-storage?utm_source=release- notes&utm_medium=email&utm_campaign=2017-March-release-notes-1-en)

</comment><comment><USER9> My recommendation to a friend for static hosting would be to use shared hosting for $5/mo.

Pick one that does automatic SSL with LetsEncrypt. I'm partial to Dreamhost because I've been on them for many years, but there are lots of good ones out there.

<comment><USER10> I know $5/month isn't all that much, but I still like to suggest Nearly Free Speech. Most static sites can be hosted for pennies per month.

</comment></comment><comment><USER11> Or even simpler you can use S3 redirects to send all of your old URLs to their new location on the same host. I'm currently doing this from both an old domain to a new domain and within the same domain and "It Just Works" (tm)

<comment><USER12> app engine static files are dispatched by google cdn network for free. CloudFront is not free.

<comment><USER4> I think the OP is subverting the CDN functionality since the static assets are flowing through the golang code.

<comment><USER12> not flowing through, it is redirecting. The static files are really served by google cdn.

<comment><USER4> I don't think so. See his code:

        http.ServeFile(w, r, "static/"+r.URL.Path)

<comment><USER12> ok, he could use google cdn in fact.

</comment></comment></comment></comment></comment></comment><comment><USER13> I prefer Heroku over google cloud, better documentation and deploying is really easy.

<comment><USER2> Any time I hear 'Heroku' it's mentally followed by that 'it's going to be expensive' intake of air sound.

Is that prejudgement borne out in reality?

<comment><USER4> $7 a month for the hobby plan doesn't seem that terrible.

But, serving static assets from Ruby seems heavy handed. You also end up writing code for things other environments would handle with configuration...like redirects, cache headers, and so forth.

Also, while $7 isn't a lot, it is a little more than other solutions in this hobby level space.

The suggestions for Netlify and Firebase seem better ideas for static content, and both allow for changing configuration instead of coding to satisfy the normal things you do for static assets. Both appear to be free at this hobby level as well.

<comment><USER14> You can use Go with Heroku, with a buildpack [1]. There's a free plan, but it doesn't include SSL.

[1] [https://github.com/heroku/heroku-buildpack- go](https://github.com/heroku/heroku-buildpack-go)

<comment><USER4> The free plan also "sleeps" after inactivity, right? I assume that means a really long page load for the visitor that follows the inactivity? And, you're still left implementing caching, redirects, etc, in a language (Go or Ruby) vs configuration directives.

Just seems a poor option compared to other choices, at least for static content.

</comment></comment></comment></comment></comment><comment><USER15> Often when I recommend GAE to someone the answer is: "but it's Google they are known to abandon their services". That and also the fear of being locked into Googles Cloud ecosystem pushes many potential customers away.

<comment><USER16> GAE gives at least a year after deprecation before turning off a feature. [https://cloud.google.com/appengine/docs/deprecations/](https://cloud.google.com/appengine/docs/deprecations/)

(I work on Google Cloud and on Datastore, which is built into App Engine. We bend over backwards to support existing code.)

<comment><USER17> My seven year old website work without single line of code since, so I know this is true.</comment></comment></comment>


Amazon pushes back against record labels on Cloud Player license issue - <AUTHOR> http://www.techdirt.com/articles/20110412/12450913873/amazon-insists-no-licenses-needed-cloud-player-google-thinking-skipping-licenses-as-well.shtml

<comment><USER2> " Cloud Player is a media management and play-back application not unlike Windows Media Player and any number of other media management applications that let customers manage and play their music. It requires a license from content owners no more than those applications do."

Very much unlike Windows Media Player, as Windows Media Player doesn't play music stored in SkyDrive. Look, I'm on your side Amazon, but this _is_ different. In a good way for consumers, and in a crappy way for record labels.

<comment><USER3> It might not play from SkyDrive(that's a failing with SkyDrive), but it will play from a shared folder I have on my fileserver here at home. So if I can store and access my files legally from one network attached drive, why not from another? Does it really matter who owns the drive or where it's located?</comment></comment>


Ask YC: best development/project process? - <AUTHOR>

Yes, I know there is no "best" process.
I'm in the position of needing to define the project life-cycle and development process for a new development practice being built within a medium-sized consulting company that has until recently focused on branding/marketing.  I've made pages and pages of notes, and have looked a number of development methodologies, but I was hoping to tap into the experience and intelligence here.
Here are the relevant guidelines:
The clients are all external companies, mostly large, paying for expensive projects (therefore scope, meeting dates, quality, etc...) are all critical.
Most of the projects will be ground-up implementations of large, complex, Java-based web applications.
The project teams are distributed across multiple states, and may include off-shore resources at times.
The project teams will typically have a mix of experienced architect/tech-lead individuals and inexperienced people fresh out of training.
My current thoughts: Due to the external clients, it's important to document and lock down the scope, budget, timeframe, etc... as much as possible.  So start out with a waterfall-ish process, with a series of steps, with hard gates, sign-offs, etc...
Break down the development into small feature based iterations.  Have the architect design the approach for the first iteration (class skeletons, some commented psuedo-code, arch approach docs).
Do iteration based, scrum-style development, with daily time-boxed con-calls, using GreenHopper+Jira for task management, scrum cards, etc...
Formal test plans and test phases.
Anyhow, I'd LOVE to hear your thoughts, experiences, etc... about project process, development cycle process, tools to support it, etc....   Thanks! <comment><USER2> one of the worst things about large projects is the number of developers/teams. if you have too many people, things go wrong and if you don't have enough, projects fall behind. so there is a art to this to create that balance.

Also as a developer, I would apply some programming principles to project management. for example design-by-contract where you create interfaces that define interaction with a group of classes, etc. So you divide groups/people by function, ie UI, back-end, integration, etc. then each group would define what they need from the other groups and what they would be able to produce. you can then develop some process based on those requirements. I think the person doing integration with have the most input into this. he/she has to deal with static pages and at the same time with server side code. so its really an interface himself

Another thing I don't like about large groups is QA. I would not have them at all. perhaps one person that would give demo of the on going project to the clients. if he can give the demo without running to problem and the clients are happy with what they see then you have a QA.

one other note, create a sub group of a select few that really understand and have a good vision of the results. they should meet and review/audit everything and catch design errors before it becomes too late.

and finally don't manage things employees in a company. think in terms of a research project in a univercity. with lead developers as staff and everyone else as students. you can use you imagination as to how this would effect every aspect of your project.

PS: I've also worked on ATG in the past but now I'm working on tomcat and other open source.

<comment><AUTHOR> Thanks for your insight. We'd probably have one team per project, with hopefully the right number of people on each team, staffed based on the LOEs we build during the architecture design phase. Dev team size would probably be 3-6, plus creative, mgmt, qa, etc...

I like the idea of the research project paradigm, as long as we remember the stricter timelines and higher consequences of failure:)

I have to disagree with the QA thing though. It's important to test every flow, in every major browser, on every major OS. It's also important to see what happens when you leave this field blank and submit the form, or put in bad data here, or use the back button and try to do something again. When you're delivering a multi-million dollar project, it can't go out the door and break on IE6 or Firefox, or break whenever someone enters a zip code that doesn't exist.

PS: there are TONS of really really high buck ATG contracts available all over the US right now. If you're interested I know a ton of companies who are dying to find an experienced ATG dev (back end or front end), so feel free to email me.

<comment><USER2> Thanks but I quit my last job few months ago so that I could work full time on my own project.

on the QA I guess what I was trying to get to was to not let your developers rely too much on QA team to catch the errors.

</comment></comment></comment><comment><USER3> "it's important to document and lock down the scope, budget, timeframe"

In order to do any of these, you must first lock down the "big fat what". Analysis. Functional specification. Specs. Whatever you want to call it. Putting any kind of rigorous or formal framework on a project with "fuzzy specs" is a disaster waiting to happen.

Get really, really good at defining EXACTLY WHAT the end product will be. Don't fall into the trap of saying, "That's close enough, after the next prototype we'll know more." That kind of thinking works well in a product business, but not in a service business.

"Give me six hours to chop down a tree and I will spend the first four sharpening the axe." - Abraham Lincoln

<comment><AUTHOR> I totally agree! Defining what the client wants and exactly how it will be delivered is crucial.</comment></comment>


My granny is a programmer - bra-ket http://blog.progopedia.com/2012/jun/06/my-granny-programmer/

<comment><AUTHOR> This doesn't surprise me. In Europe it's not uncommon to find women in computer science or engineering. In the US it's not unheard of. In Australia it's extremely rare and most of those that you do find were born overseas.

<comment><USER2> In India, you will find an equal number of women and men in computer science engineering. There is no stigma associated with being a programmer either (It was never extremely uncool).

In practice, I have found that there are women who are as good as men when it comes to programming. I strongly believe that women don't have any inherent disadvantage. It is just social conditioning.

<comment><USER3> Please tell me more.

<comment><USER2> Will be happy to answer any specific questions :)

</comment></comment></comment></comment><comment><USER4> Afaik, gender equality was much better in the USSR than it is today in the US.

<comment><USER5> To be fair you might expect that, if you have a command economy you can say "how can we get more women in IT?" and answer with "Take women out of nursing and put them in IT".

<comment><USER6> You can't do this and expect them to be competent IT workers.

You couldn't do this 50 years ago and you can't today.

<comment><USER5> This is the USSR , you don't care about that. If they don't work fast enough you can "incentivise" them.

</comment></comment></comment></comment><comment><USER7> She also looks like a total badass.</comment>


Ask HN: Why are private/hidden methods so popular in OOP APIs? - <AUTHOR> As a Python programmer, I heartily subscribe to the philosophy of "we're all consenting adults here" [0]. Nothing should really be private or hidden, because nothing is really stopping a canny user from cracking open your code and accessing that stuff anyway.
However, it seems like the opposite philosophy is the prevalent one, so I must ask why? Why do people inside on concealing and privatizing so much of their code, especially in open source projects where I can clearly see what they're doing?
Thanks.
[0]: https://mail.python.org/pipermail/tutor/2003-October/025932.html <comment><USER2> I think you need to clarify what you mean by "private". Are you referring to making methods private?

When you make a method public, you are making a promise to users that you won't make any breaking changes to that API without a major version upgrade. Once something is out there, you can't take it back. So if you have some functionality that isn't meant to be used by the outside world but is used to serve your API, then you wouldn't want to expose that and tie your hands in the future.

<comment><USER3> Another way of phrasing it is that a public interface is a kind of tight coupling. Also, private methods are typically contain highly factored code which may have little utility outside of the interface but which is factored for reasons of modularity.

</comment></comment><comment><USER4> I know the answer, thanks to watching a recent video by Richard Feldman on why functional programming isn't popular yet. I recommend watching it for some interesting talk about programming languages in general, it's on YouTube at [https://m.youtube.com/watch?v=QyJZzq0v7Z4](https://m.youtube.com/watch?v=QyJZzq0v7Z4)

Anyway what privates give you is what everyone wants from a programming language: modularity.

We want to be able to expose an api to some code and for it to have some inner workings that we don't see because:

1\. If we know they can't be touched we have some implicit guarantees about our program. E.g. the mouse pointer cannot go off screen even if we try to make a call to do that.

2\. It is simpler for a programmer to understand the api which might be 1% of the size of the module itself with all private's.

3\. I can change my private's without breaking your calls. Essentially a minor version change in Semvar parlance instead of a major breaking change.

4\. Make impossible state impossible! By guarding the state.

All these things require modularity, and OO uses classes and private members to provide that modularity.

Elm uses modules and the exposing keyword (or lack of!) as a contrast.

JS modules are similar with a lack of an export allowing you to hide something. That something you did export can use for state or functionality. There is an old IIFE trick that works this way also.

Making everything public is a bad idea, as you miss out on modularity advantages. Not sure how Ruby hides things as I haven't used it for a while but I'm sure there is a way.

And finally reflection in OO to access private's is almost always a sin, unless you are make a debugging tool or similar. Canny? No way!

<comment><USER5> To address your first point, plenty of functional langs have access control - as an example F# has complete public/protected/private for all levels of function/class.

</comment></comment><comment><USER5> The primary reason is of course encapsulation. Many things you don't want to leave publically accessible. For instance if you're creating a thread safe api, you need to be mindful of references/mutexes/locks which can easily be enforced with wrappers. If you expose the underlying objects directly you could easily dead lock, corrupt memory, create race conditions, etc. It also greatly simplifies testing and guarantees/provability since you can guard against access patterns or certain inputs or states.

Personally, I have run into enough horror caused by mutating a global state that I write code which is quite strict about what it exposes. If you're a python dev, I'd suggest reading this (posted on hn recently but I can't find the hn link currently): [https://instagram-engineering.com/python-at-scale- strict-mod...](https://instagram-engineering.com/python-at-scale-strict- modules-c0bb9245c834)

</comment><comment><USER6> I get your sentiment of the overused "hidden"/"private" stuff that seems like people following some sort of decades-old ritual and then adding getter/setter, where it should have been all transparent, knowingly that the module/package will eventually be running in a single process.

"private"/"hidden" attrs/methods help limiting the knowledge needed by new developers jumping into and building on top of existing code base.

Concealing complexity is necessary, but can be done with other methods such as HOF, selective exports, etc.

This is called interface-first design paradigm where your module is "serving" other module by doing its job without exposing its complexity.

Disclaimer: I'm mostly use TypeScript in a functional/data oriented design manner. Not a big fan of OOP.

</comment><comment><USER7> This is all about the Unix philosophy of 'do one thing, and do it well'. I used to be a python programmer before I moved to java and a significantly larger stack. The public interfaces of different classes made writing new code so so much easier. In fact, I think python should use this paradigm if only for the purpose of productivity.

</comment><comment><USER8> The issue is not consent or privacy, it's promises.

An API is an "application programmatic interface" and the idea of an interface is that it's making a promise or some kind of contract.

Every precocious teenager thinks they're a consenting adult, but they don't _really_ understand how fucking works until they've actually made a baby.

So you publish some code that does a thing, and however many consumers are exploring every sweaty nook and cranny of your interfaces, and not only do you not remember because cocaine is a hell of a drug, but now you've got a small legion of dependents you aren't even aware of.

Even if you're using a language like Java that lets you impose the bureaucracy of encapsulation, there are always various unintended consequences to the use of your API.

(Besides making assumptions about state, while the API might have all sorts of encapsulation, it still throws exceptions. And those exceptions might wrap internal exceptions, so a consumer trying to respond to an error condition might slide the condom off and investigate those internal exceptions to identify their specific error.)

There are two major reasons to claim a thing is private:

1\. If your code breaks when I make a change, you can yell at me, but I can point at the fine print and tell my boss, "nah, it's swidi's fault".

2\. It might even get you to nag me, "I need feature X to do a thing" and then I'm aware you're using feature X.

I'm working on a language to make APIs work better[1] and you should tell me if I'm fucking crazy or not.

Don't take any of this seriously, I'm quite inebriated at the moment.

[1]: [https://tenet-lang.org/](https://tenet-lang.org/)

</comment><comment><USER9> To quote something from Pragmatic Programmer (1999):

"Functions should act like a contract. Functions should do no more and no less than what they're expected to. If they fail to meet the contract, they should report it."

</comment><comment><USER10> You can reason about your code more effectively when you can see more precisely what function calls are made on an object or class of objects, and from where. Making a method private limits that surface area.

</comment><comment><USER11> The more public interfaces you have, the harder it is to improve things.

</comment><comment><USER12> "Implementation Detail" is a fundamental concept in software engineering.

If we don't formalise something as fundamental as that in tooling, we're pretty much giving up on tooling.</comment>


Have You Ever Wondered How Jet Engines Work? - <AUTHOR> http://animagraffs.com/inside-a-jet-engine/

<comment><USER2> I'm sure anyone who clicked this link is still wondering if they didn't already know. A list of parts isn't an explanation of how something works.</comment>


Storage IO Benchmark Results from 20 IaaS Providers - <AUTHOR> http://blog.cloudharmony.com/2010/06/disk-io-benchmarking-in-cloud.html

<comment><USER2> For what it is worth, I found the Rackspace Windows Cloudservers (Beta - various sizes) to have amazingly fast IO (500+mbs). They were 4-7x as fast as the EC2 instances I tried. (70-120mbs)

I was just using ATTO. Is this a valid test? It was at least twice as fast as my RAID10 dedicated server (240+mbs).

</comment><comment><AUTHOR> EC2's IO performance depends on type of instance storage (ephemeral or EBS) used and instance size. The m2.* instance sizes with EBS actually outperformed rackspace in our tests, whereas m1.small performed about 2/3 slower than Rackspace.</comment>


Bed-In-a-Box Startups Challenge Traditional Mattress Makers - <AUTHOR> http://www.wsj.com/articles/bed-in-a-box-startups-challenge-traditional-mattress-makers-1457380362 <comment><USER2> My brother found a basically-new memory foam mattress on Craigslist years ago - it was someone's guest bed. He had just started medical school, and quite proud of his find.

This mattress has migrated to his guest bedroom - he'd replaced it with a larger spring mattress. I've slept on the foam mattress a few times. After I sink in, it's like I'm frozen in place. While not the worst mattress I've ever slept on, I wake up 'stiff'.

When I was mattress shopping last fall, I got an old-fashioned spring mattress and a cheap ikea bed frame [1]. The frame was instead of a box spring, so I could store stuff underneath. (The one with drawers would have been cool... But my father pointed out that I was about to move, and it'd just be more work.)

[1] [http://www.ikea.com/us/en/catalog/products/S49007528/](http://www.ikea.com/us/en/catalog/products/S49007528/)</comment>


Microsoft-groove-app-download-free - <AUTHOR> http://www.app-droid.com/2017/10/microsoft-groove-app-download-free.html <comment><USER2> I half-jokingly clicked through. What I found was a reason to install:

> you can Add all your MP3s files to OneDrive and play them wherever you go

I currently don't have an easy way of doing this given my music lib is larger than phone storage.</comment>


Show HN: Tabchat – A browser extension that lets you comment on any webpage - <AUTHOR> https://github.com/mshindal/tabchat <comment><AUTHOR> This is my first real open source project so I'm open to any criticism or advice!

</comment><comment><USER2> I think its a pretty cool extension, how do you identify the user on each web page?

<comment><AUTHOR> Thanks. It generates a random key client side the first time you leave a comment that's used to identify the user.</comment></comment>


Merchant account for 3rd party processing apps? - <AUTHOR>

I'm currently trying to get a merchant account for my business that's essentially a 3rd party processing app for a large niche market here in the UK, however when I explain the nature of the business, the banks simply turn us down flat.
Even Paypal turned us down for our WPP application, though they were more vague with their reasoning.
Obviously things are stalled until we can get this issue sorted :) <comment><USER2> Without knowing the actual nature of your business, it's hard to say. It's difficult for me to comprehend everyone turning you down. In my experience, banks are relatively forgiving and willing to work with you to get your merchant account up and running.</comment>


Elementary OS - a blatant copy of OS X - <AUTHOR> https://www.youtube.com/watch?v=0-_hZ542qsM

<comment><USER2> The only real similarity is the superficial UI styling, the underlying OS is actually Ubuntu Linux where as OSX in based on BSD Unix.</comment>


Building an Open, Drop-in Replacement for UITableView - <AUTHOR> https://techblog.livingsocial.com/blog/2013/12/02/lsctableview-building-an-open/

<comment><USER2> Overall this is a great article. It does a good job outlining what UITableView does and why it's built the way it is. If you're new to iOS and wondering why UITableView's delegate and dataSource protocols are structured the way they are, it's a good idea to take a deep dive and understand them better. As others have mentioned, data sources and delegates aren't unusual in Objective-C. They're everywhere, and they enforce a separation of view logic and data that is at the heart of MVC.

This is a great exercise, but please, please don't use your hand-rolled UITableView in your apps.

If UITableView doesn't do what you need, create a UICollectionView. If you find the data source protocol frustrating to use, create a provider object that maps your (array/dictionary/weird-ass data structure) onto the dataSource protocol. (In desktop Mac programming, NSArrayControllers serve this purpose.) Don't re-implement UITableView. The things you could potentially screw up are many, and when some other developer inherits your code and tries to add editing, multiple selection, re-ordering, etc..., they're going to be pissed.

</comment><comment><USER3> Is it just me, or does it seem like UITableView is a combination of controller and view? The delegate has both controller functionality (selection) and view functionality (cell height). I keep trying to use it as one or the other and you just can't do it.

Although, my view of MVC is that the model is just the data (pretty lightweight), the view just draws the things, and the controller handles user actions. So you could remove the view and do testing on the controller. This doesn't seem to be Apple's perspective, so maybe I just haven't figured out their perspective yet.

<comment><USER4> In iOS, sometimes the line between view and controller gets blurred.

UIViewController is part of UIKit. UIKit is a framework developed specifically for iOS as a high-level wrapper over OpenGL, for performance reasons as well as making touch screen based interfaces easier to implement.

This is why UIViewController has many view-related hooks in it. For example, the native view lifecycle flow includes a call to the method `viewDidLoad` on UIViewController - a controller method dedicated to view functionality and customization.

That said, the UITableViewDelegate seems to have the standard amount of view and controller commingling that's found throughout the common iOS frameworks, IMO.

</comment></comment><comment><USER5> Nice job creating your own implementation of UITableView. Although, if you find delegates and datasources unusual then its best for you to spend more time getting familiar with them rather than trying to work around them.

<comment><USER4> Hi! Post author here.

Totally agree with that last statement.

That said, I tried to write the post to be geared towards the beginner audience. And I remember when I first started iOS development, UITableView seemed weird.

It comes with two delegate objects with separate responsibilities (delegate and dataSource) and is pretty ubiquitous, so you may interact with it right away when first starting iOS development, before interacting with the many other classes that use delegates (and the, what, 3 others that use dataSources).

To a beginner, that tends to make UITableView stand out as an unusual thing.

I'm hoping pulling UITableView apart, and explaining the machinery can help make those design decisions more clear.

<comment><USER6> I am an iOS beginner.

I have not read your post in-depth, I will, but I think it's probably wise to stick to learning UITableView well -- and understanding why I would want to implement something custom -- before avoiding the classes Apple provides.

That being said, I understood delegates, categories, and other Objective-C features much better after coding several applications first, reading a ton of open source code, and then reading relevant parts of Programming in Objective-C (Kochan). I first purchased his book before attempting to code for iOS, and found the pace too slow or concepts too unfamiliar, but after some practice and finding what I did not understand, it is much easier to look to documentation and textbooks for appropriate reference.

<comment><USER7> The OP didn't reimplement it to use it, it was done to explain. that's what I got out of it anyway.

</comment></comment></comment></comment><comment><USER8> "It relies on a relatively unusual API design – delegates..."

Nothing unusual about delegates, the entire iOS codebase is littered with them.

But kudos on doing what we all eventually think about doing, the longer we work with UITableView

<comment><USER9> Correct - UICollectionView also uses delegates, dataSources, and reusable cells.

</comment></comment><comment><USER10> Funny, this was actually really helpful for me as I'm building a dynamic list (or "table" in iOS parlance) for HTML5 in Ionic Framework. Gave me a few ideas on how we could structure the API to handle tons of items efficiently. Great write up!

<comment><USER4> Thanks! Very glad to hear that!

I suspected most of the concepts could be pretty easily applied to other languages, so I'm especially glad to hear this feedback.

</comment></comment><comment><USER11> Mike Ash did something similar on his Friday Q&A posts: [http://www.mikeash.com/pyblog/friday-qa-2013-02-22-lets- buil...](http://www.mikeash.com/pyblog/friday-qa-2013-02-22-lets-build- uitableview.html)

<comment><USER12> Yeah, I was thinking the same thing. Loved that blog post, and certainly enjoyed looking at R. Nystrom's implementation too: [https://github.com/rnystrom/RNTableView](https://github.com/rnystrom/RNTableView).

UITableView is one of those components that we all spend so much time with that everyone has little tweaks they want to make. Implementations like these at least give us options to extend/tweak low level behavior should we need to. I also love it when they write thorough blog posts like these explaining explicitly their rationale and structure of the component.</comment></comment>


Sun's answer to Ajax, Microsoft Silverlight - <AUTHOR> http://www.techcrunch.com/2007/05/08/sun-responds-to-ajax-silverlight-with-javafx/ <comment><USER2> Oh man, Sun. Anyone have high (or even mediocre) hopes for this?

<comment><USER3> The phrase "too little, too late" springs to mind. Also the phrases "crippling hubris", "halfhearted sop", "internecine bloodletting" ( <http://www.infoworld.com/article/07/04/26/HNflair_1.html> ) and "hat-trick" ( <http://www.blinkenlights.com/classiccmp/javaorigin.html> , <http://www.noodlesoft.com/blog/2007/01/23/the-sun-also-sets/> ). Now it's quite likely those horrible inklings are wrong. Maybe JavaFX is a clever spoiler move to take significant momentum out of Silverlight and Flex at minimal expense to Sun; maybe it's a stalling manoeuvre while Project Flair condenses. But then again ... oh man, yeah, Sun.</comment></comment>


Ask HN: How does deforestation affect climate change? - <AUTHOR>

I know the impact must be frightening because trees are such a vital part of healthy ecosystems and most people have never planted a tree in their lives.
I Googled it. This is what I found...
"One day of deforestation = carbon footprint of 8 million people flying to New York."
How accurate is that? Does anyone know? <comment><USER2> The impact on short-term climate change is negligible. If the timeframe you're looking at is the next 50 years, it makes almost no difference to climate change because climate change is affected so greatly by natural cyclic factors such as solar flare activity.

However, it will most likely have a devastating effect on long-term climate change, because any damage to the ecology is cumulative and symbiotic. We do depend on plants to turn the carbon dioxide we exhale into the oxygen we need to respirate, after all.

</comment><comment><USER3> The Economist ran a special report on Forrest recently. That might be a good starting point.</comment>


French Covid-19 infections were not caused by patients from China or Italy [pdf] - <AUTHOR> https://www.biorxiv.org/content/10.1101/2020.04.24.059576v1.full.pdf <comment><USER2> This is a ridiculous paper and a ridiculous headline.

Firstly, the paper directly states the opposite of the title of this post:

"The first European cases sampled on January 24, 2020 (IDF0372 and IDF0373 from Île-de-France, described in (Lescure, Bouadma et al. 2020) were direct imports from Hubei, China, and the genomes fall accordingly near the base of the tree, within clade V, according to GISAID nomenclature (Figure 2, Figure 3A)"

The rest of the paper is supposition that COVID strains evolved simultaneously (not sequentially from the first infections imported from Wuhan) based on genetic sequencing, implying that COVID had already been in the French population before that first diagnosed case from Wuhan.

Since the Chinese government has yet be transparent about when the virus started spreading in China, and destroyed all early samples of the virus, we have no real clue as to what the evolutionary history of this virus is.

<comment><AUTHOR> A few lines afterward: "Subsequent early cases in the West or East of France (B2334/B2340, clade V and GE1583, clade S), all with recent history of travel to Italy, add to the genomic diversity of viruses from Northern Italy, but also do not appear to have seeded local transmission with the current sampling "

And in the abstract (and from the French press like "Les Echos"[0]) _" In parallel, our genomic data reveals the later predominant circulation of a major clade in many French regions, and implies local circulation of the virus in undocumented infections prior to the wave of COVID-19 cases. "_

[0] [https://www.lesechos.fr/economie- france/social/coronavirus-e...](https://www.lesechos.fr/economie- france/social/coronavirus-en-france-lepidemie-ne-serait-pas-venue-directement- de-chine-ou-ditalie-1199167)</comment></comment>


Stevie Wonder's "classic period" - <AUTHOR> https://redux.slate.com/cover_story/2016/12/the-greatest-creative-run-in-the-history-of-pop-music.html <comment><USER2> I remember "discovering" a second hand copy of Innervisions whilst at university in the early 90s.

Up to that point I knew Stevie Wonder as the guy who recorded "I Just Called to Say I Love You", a song I hated as a kid. Well that opinion changed pretty sharpish I can tell you.

I've bought so many albums and singles since that I really, really like but I don't think Innervisions has ever been bettered. Just my humble opinion of course.

<comment><USER3> My first rule of music is that any artist that became popular before the '80s, was terrible in the '80s. Look at Aretha Franklin. Who's Zoomin' who? What? Aretha darling, what were you thinking? There are a few exceptions to the rule, like Michael Jackson.

<comment><USER2> Oh that works really well, I'm going to add that to my own first rule of music: Any "band" completely made up of singers is _probably_ rubbish[1][2].

[1] there may be a few exceptions but they're Higgs-Boson rare.

[2] feel free to take it with a pinch of salt if you actually like that kind of "music". :P

</comment></comment></comment><comment><USER4> That five year stretch is indeed stunning. So many songs that are harmonically sophisticated and yet singable/relatable to non-musicians. Without any doubt one of the best song writers of all time.

<comment><USER5> This +100. I don't think there has been anyone in recent years who has combined those qualities as well, consistently.

Earth, Wind & Fire is in the same category for me but yeah going back decades

<comment><USER6> Similarly I was very very surprised by Phil Collins - Hello I must be going. The overall big band funk groove in a pop album (and a successful one at that). And then his drumming. It's a bit like The Police, you don't hear the sophistication at first; but it's there.

</comment></comment></comment><comment><USER7> Stevie is amazing, but for "greatest creative run in popular music history," I feel like we still have to give that to The Beatles, no? In 5 years they released Help, Rubber Soul, Revolver, Magical Mystery Tour, Sgt. Pepper's, The White Album, Abbey Road and Let it Be.

<comment><USER8> Beatles had Lennon, McCartney writing, and George Martin composing, also the engineering of EMI.

Stevie did everything himself, writing & playing ALL instruments. Beatles had several session players.

</comment></comment><comment><USER9> I love the linked article on Stevie's drumming prowess: he is indeed a fantastic drummer, one of the best.

Stevie also had the great bassist James Jamerson on many of these tunes: check out Jamerson's amazing lines on "For once in my life"!

<comment><USER10> Absolutely!

There's a great visualisation of his line here: [https://www.youtube.com/watch?v=At3OP5CvIRY](https://www.youtube.com/watch?v=At3OP5CvIRY)

<comment><USER9> I forgot about this! So cool! also forgot that Joe Dart from Vulfpeck put this together. very, very cool.

<comment><USER10> I think it's Jack playing on this one. He's still pretty handy, even if he isn't Joe Dart :)

</comment></comment></comment></comment><comment><USER11> On Talking Book's album opener (and #1 hit), You Are the Sunshine of my Life, Stevie let background vocalists sing the opening lines. That always seemed incredibly cool and selfless to me.

<comment><USER12> To amazing effect too. The two singers style take you off your guard (this... isn't... Stevie?) and then he comes in, singing slightly louder, and stressing the start of each word - the song changes from something super cool and easy, to something a lot more funky.

By the end of the verse, you realize how great Stevie's singing is, even though he's holding so much back.

</comment></comment><comment><USER10> > Wonder negotiated a new contract with Motown that would grant him full > artistic control over his music, his own publishing company, and an > unprecedented royalty rate

I wonder if this could ever happen again, given the state of the music industry now.

</comment><comment><USER13> Did you know that Stevie got a street named after him in Detroit today? Just off Woodward near the Motown museum.

[http://www.wxyz.com/news/region/detroit/city-of-detroit- to-u...](http://www.wxyz.com/news/region/detroit/city-of-detroit-to-unveil- stevie-wonder-avenue-today)

</comment><comment><USER14> TFA appears to be following the conventional wisdom when it describes "Higher Ground" as a "reincarnation meditation". But while it seems Stevie Wonder did himself connect the song with ideas about reincarnation, at least tentatively [https://en.wikipedia.org/w/index.php?title=Higher_Ground_(St...](https://en.wikipedia.org/w/index.php?title=Higher_Ground_\(Stevie_Wonder_song\)&oldid=754320225#Subject) , the one thing which the lyrics really plainly make reference to is Apocalypse 22:10-12 [https://www.biblegateway.com/passage/?search=Revelation+22%3...](https://www.biblegateway.com/passage/?search=Revelation+22%3A10-12) :

> And he saith unto me, Seal not the sayings of the prophecy of this book: for > the time is at hand. He that is unjust, let him be unjust still: and he > which is filthy, let him be filthy still: and he that is righteous, let him > be righteous still: and he that is holy, let him be holy still.

> And, behold, I come quickly; and my reward is with me, to give every man > according as his work shall be.

Which admittedly is an slightly odd fit with the sense of having himself been given a second chance and a change of life which SW expresses in the song (and apparently in the NYT interview), but so it goes apparently.

</comment><comment><USER15> _Synth whizzes Bob Margouleff and Malcolm Cecil co-produced the album with Stevie and would continue to work with him through Fulfillingness' First Finale_

The involvement of Margouleff and Cecil needs to be further highlighted. They were not only talented musicians, they were also engineers, producers, and pioneers in early synthesizer experimentation. They patched together a massive electronic synthesizer dubbed TONTO that consisted of various components including a Moog, which Stevie Wonder heard on their avant-garde 1971 synth album Zero Time. He literally showed up at their studio with the album under his arm and asked how TONTO worked. The story is told here (1):

 _So he takes my elbow and I escort him to the studio. We went down to the studio and I showed him the instrument. I put his hands over it and he realized that it wasn't something that he could easily play. He tried to play it, but he couldn't get it to sound like a normal keyboard, because in those days you could only get one note at a time. He asked me, "What is wrong with this keyboard?" I told him, "That's how it works. It only plays one note at a time." And then he got it. He asked me if we could record. I went upstairs and got my test tape and we put it on the two-inch machine. At this time, the Moog had been moved to Studio B in the basement. We ended up recording the entire weekend. I had to break into the tape store, and I had no authority to do it, but I did it anyway. I told Stevie, "Someone is going to have to pay for this tape at least." He said, "Oh, don't worry. I just got money put into my trust fund from Motown because I just turned twenty-one. I don't have any contracts." He explained the whole thing. He told Bob and me that he wanted us to be musical directors for his company and to help him get his music out there. He liked working with us, and we liked working with him. We got seventeen songs done that first weekend. And that's how it all started._

In films from that era, you can see Wonder performing with TONTO in the background, with Cecil or Margouleff patching together components on the fly.

I saw an interview with one of them (see Soundbreaking, below) who says that they recorded something like 250 songs with Wonder, and they picked the best ones to go on the albums. I would love to hear some of the stuff that didn't make it onto vinyl!

PBS recently released an eight-part series on music production called Soundbreaking that includes clips and interviews with Cecil and Margouleff. It was co-produced by the late George Martin, and includes so many stories about the production of pop music from the 1950s to the present, including early multitrack recording with Les Paul, The Beach Boys and The Beatles, the synth era, disco, sampling, rap, the impact of music videos, EDM, laptop-based production, and more. It's amazing. Some short clips are here (2) but I urge readers to seek out the full program!

1\. [http://www.waxpoetics.com/blog/features/articles/malcolm- cec...](http://www.waxpoetics.com/blog/features/articles/malcolm-cecil-stevie- wonder-classic-innervisions/)

2\. [http://www.pbs.org/show/soundbreaking/](http://www.pbs.org/show/soundbreaking/)

</comment><comment><USER16> I couldn't agree more. Those albums are some of my favourites.

</comment><comment><USER17> I learnt the other day that Stevie Wonder inspired Kurzweil to create one of the first synthesizer .

"In 1982 Stevie Wonder invited Raymond Kurzweil to his new studio in Los Angeles, and asked if "we could use the extraordinarily flexible computer control methods on the beautiful sounds of acoustic instruments?"[2] In response to this query, Raymond Kurzweil founded Kurzweil Music Systems, with Stevie Wonder as musical advisor.[1] A prototype of the Kurzweil K250 was manufactured for Stevie Wonder in 1983." [1]

1\. [https://en.wikipedia.org/wiki/Kurzweil_K250](https://en.wikipedia.org/wiki/Kurzweil_K250)

<comment><USER18> That is not even close to being 'one of the first synthesizers'. It's probably the first digital piano anyone took seriously, in addition to introducing sampling keyboards into the world, but synths had been around for more-or-less thirty years by 1983.

<comment><USER19> I first thought of the Abbey Road usage of the Moog (in 1969), and that certainly couldn't have been the first synth use (although probably one of the more popularizations of it). (maybe my def of 'synth' is a bit loose though)

<comment><USER20> Wendy Carlos "Switched On Bach" released in 1968 probably launched synthesizers into the mainstream consciousness.

[https://youtu.be/o95yZCnGVAw?list=PLD3973AC7BFE489A4](https://youtu.be/o95yZCnGVAw?list=PLD3973AC7BFE489A4)

[https://en.m.wikipedia.org/wiki/Switched- On_Bach](https://en.m.wikipedia.org/wiki/Switched-On_Bach)

</comment></comment></comment></comment><comment><USER21> I've always loved Stevie Wonder. It's a show of how far we can go when we apply ourselves.

</comment><comment><USER22> I don't think many people actually listen to his music since it's never on the radio.

<comment><USER23> It is sampled so much, that people do hear his music even if they don't know it is from him. [0]

[0] [http://www.whosampled.com/Stevie- Wonder/](http://www.whosampled.com/Stevie-Wonder/)

</comment></comment><comment><USER24> This pales in comparison to Prince's outpourings.

<comment><USER25> I love Prince. Prince was maddeningly talented, shockingly prolific, and produced an amazing and wildly underrated (still!) opus over his career. Prince will be remembered as one of the most important pop musicians in history.

Yet there is no 5 year stretch in Prince's career that compares to what Stevie Wonder did from 1972-1976.

<comment><USER26> I know I will get down-voted for this, but I just never really got the Prince vibe. I can appreciate his work, and the love a lot of people have for him. But I can't name one song that struck a chord with me. Sorry

<comment><USER5> Prince wasn't super high on my list until I saw him live twice 7-8 years ago. Blew my mind. Almost entirely different repertoire both times. Completely in a league of his own. Amazing energy, musicianship, really incredible player, and he wasn't young anymore either but just kept hitting it hard. Played a show like that every day in London for weeks. Plus afterparties a couple of times a week where he would play for hours sometimes. It was probably the best live show I have ever been to.

Stevie has a special place for me as a songwriter but as a performer Prince was next level. Different artists, love both

<comment><USER6> Prince, even today, is still underrated. He carried mountains of music on his shoulders, while being an overwhelming rock star persona, and a live genius, and quite an ok human being (goofy and a bit precious at times but well).

After his passing I saw videos of rehearsal, where he would drive sound stage check calmly with people, dropping jazz classics from his pocket and being cool with the crew.

A lot of what he did was so brilliant, for so many years, in so many genre.

ps: he also managed to make rock guitarists drop their jaw at the george harrison celebration, all done unrehearsed (for better surprise effect).</comment></comment></comment></comment></comment>


First, we kill all the patent lawyers - <AUTHOR> http://www.computerworlduk.com/toolbox/open-source/open-source-business/in-depth/index.cfm?articleid=3299 <comment><USER2> A bit drastic, but it's a start ;)

Seriously, even the author wrote that only as 'bait', but there is a subtle point to it, which is that at a gut level these people must know that they are acting against our common best interest by exploiting legal loopholes. As long as we commend lawyers on exploiting the letter of the law while raping its spirit there will be no end to this.

In the end it boils down to the fact that words are inadequate vehicles to express concepts in, we can do all we want, thoughts and concepts are fluid entities, they can not be expressed in words without losing something. It's like digitization always is a 'lossy' process.

So by using piles of words ('legalese') we can try to limit the number of gaps and the size of the gaps between the intention and the description of the intention, given enough time there will always be new holes found.

It's the basis of biblical interpretation and it is the basis of the enormous increase in legislation and jurisprudence, and why we need things like a supreme court.

The patent system is old by technological standards, it has become a liability and it stifles innovation more than that it promotes it.

If we have to go back to a world without disclosure and of trade secrets then so be it, I predict that that in the longer term will also be found 'wanting' as loopholes in those constructs will be discovered, but in the short to mid term (say another century?) we're better off without them.

<comment><USER3> The title is a Shakespeare quote/paraphrase which, amusingly, many lawyers interpret as being a resounding endorsment of the role of lawyers in society:

<http://www.spectacle.org/797/finkel.html>

</comment></comment><comment><USER4> The supreme court recently had to have emails vs text messages explained to them (and then they still didn't get it).

[http://lawyersusaonline.com/dcdicta/2010/04/19/technical- dif...](http://lawyersusaonline.com/dcdicta/2010/04/19/technical-difficulties- at-the-supreme-court-2/)

When it comes to technology, we're pretty much not going to get an intelligent ruling.

<comment><USER5> Actually I find it beautiful in a philosophical way. That the Supreme Court of Justice tries to find the difference between email and text messages by simple questions is in essence, the direct application of the Socratic method. It seems odd that a 55 year old person does not know what texting is and how it works despite a thousand "My BFF Jill" ads. However, if you think justice should be blind and uninfluenced by external factors, lack of intimate knowledge or rather attachment to particular fields or experiences is a good thing.

<comment><USER2> I don't know about that. If a justice is to make judgements that make sense the participants in a society then it would help if they themselves are aware of the status quo of that society. Otherwise their judgments may be right in some philosophical sense but will alienate people from the law in a way that does tremendous damage.

Judgments should not only be 'right' they should make 'sense', and some of the language in the decisions indicates that not all of them are in touch with the world as we know it to the extent that they should be.

</comment></comment></comment><comment><USER6> The only way to change the state of the patent system is by legislation; the system operates in the only way it can given the current laws. Judges do their best to interpret these law. Lawyers execute the will of their clients. "Inventors" seek to protect their inventions. Patent inspectors attempt the impossible task of evaluating the uniqueness of claims.

It is possible that the Court will change its opinion on the patentability of the ideas that concern us, but it is unlikely that they will not just rock but overturn the software patent boat. Even if we as individuals dislike software patents, wealthy companies clearly see them as an investment worth protecting. If you care, you need to speak out, and in a way that says it is in not your's, but society's best interest for the status quo to change.

</comment><comment><USER7> I don't think that the patent system is bad by itself. There was a time when it did bring value to the innovator. It served as a series of rules to describe a relatively simple system. The negative thing is that it doesn't scale well. It's in need of a serious overhaul or things will only get worse.

<comment><USER8> So it bring values to the innovators, or maybe a _specific group_ of innovators.

Does it bring values to the rest of us? What if the concept is wrong in the first place?

Well, two contarian economists doesn't think the system was that great in the first place:

 _It is common to argue that intellectual property in the form of copyright and patent is necessary for the innovation and creation of ideas and inventions such as machines, drugs, computer software, books, music, literature and movies. In fact intellectual property is a government grant of a costly and dangerous private monopoly over ideas. We show through theory and example that intellectual monopoly is not necessary for innovation and as a practical matter is damaging to growth, prosperity and liberty._ \-- Michelle Boldrin and David K. Levine in Against Intellectual Monopoly [http://levine.sscnet.ucla.edu/general/intellectual/againstfi...](http://levine.sscnet.ucla.edu/general/intellectual/againstfinal.htm)

I think it is a bit presumptious to assume that patents benefit does outweigh the loss at some point in their history. People needs to dig a little deeper than that.</comment></comment>


Don't Learn to Code in 2019, Learn to Solve Problems - <AUTHOR> https://www.youtube.com/watch?v=GI_G3oGYLeo <comment><USER2> Conversely, if you already learned how to solve problems, learn to code.

Especially for women or disabled folk, most likely you've been shoved to learn how to define a problem, how to communicate effectively, how to break a problem down.

If you've done that part already, just learn to code so you can apply your skills to larger problems. Or better, get more of your time back.

</comment><comment><USER3> Don't just think about solving problems. Think about making people's lives better. Problems can be created just for the sake of being solved so that companies can profit.</comment>


Measures of Complexity: A non-exhaustive list (2001) [pdf] - <AUTHOR> http://web.mit.edu/esd.83/www/notebook/Complexity.PDF <comment><USER2> From the same author this MOOC (Introduction to Information Theory):

[https://www.complexityexplorer.org/tutorials/55-introduction...](https://www.complexityexplorer.org/tutorials/55-introduction- to-information-theory)

Recommended for (Introduction to Renormalization):

[https://www.complexityexplorer.org/tutorials/67-introduction...](https://www.complexityexplorer.org/tutorials/67-introduction- to-renormalization)

<comment><USER3> Measuring computational complexity with dollars is a time dependent expression of complexity, since that value will change in the future due to cheaper and better hardware.

An expression line number of operations or expression via Landau symbols is timeless and can be individually mapped to costs.

</comment></comment><comment><USER4> That list is pretty ad-hoc, and doesn't seem to be carefully curated. Fair enough, one has to start somewhere, but ...

There is clearly a great deal of overlap, e.g. Minimum Description Length, algorithmic complexity and information theoretic entropy.

There are also many well-understood relationships between different forms of complexity, e.g. between space and time complexity.

Some appear to be less formal than others, e.g. what is "cost" what is "crypticity"?

Finally, regarding the broad distinctions, in what sense are the "difficulty of description" and the "degree of organization" even different?

<comment><USER5> I think he just didn't define complexity at all, just gave ways of measuring whatever he means.

But of course it's a tough topic. If measuring bit length of the explanation is a valid way of measuring something's complexity, then the measuring method itself is pretty complex

</comment></comment><comment><USER6> I spend nearly all of my effort on "3\. Degree of organization." I figure if I can get this right in first the most homoiconic way possible, and secondly with the shortest code possible then I get the first two points mostly for free.

It is also why I loathe inheritance. When I read unstructured code written for inheritance I don't see the same path and flow control that the computer sees. I just see a bunch of global classes and public/private/static declarations like a million tiny islands or grains of sand. To me this is a mess.

</comment><comment><USER7> [https://en.wikipedia.org/wiki/Lacunarity](https://en.wikipedia.org/wiki/Lacunarity)

One of my favorite measures

</comment><comment><USER8> Cyclomatic complexity might be a go to measure for algorithms.</comment>


Gridgarden: A cool game to learn CSS Grid - <AUTHOR> http://www.cssgridgarden.com <comment><USER2> Outstanding. I learned the Flex layout by playing this simple game: [https://flexboxfroggy.com/](https://flexboxfroggy.com/) (from the same author I believe). I wonder if there are examples of learning through playing a game that are as effective as these two.

<comment><USER3> css diner: [https://flukeout.github.io/](https://flukeout.github.io/)

<comment><USER2> This is awesome! Clearing some of the challenges without having to Google for the right selector feels good =) Congrats to whomever made it.

<comment><USER3> If you don't know how to contact the author, open an issue to say thank you. FOSS developers don't get enough love.

<comment><USER2> I've just done it. You're right.

</comment></comment></comment></comment></comment><comment><USER4> CSS Grid still blows my mind. A syntax that actually makes sense for a visual styling language in CSS?

People like to make fun of Javascript but CSS doesn't get enough heat. It was absolutely awful and still is in many ways.

Even Flexbox is a convoluted mess with a strange naming scheme.

CSS Grids just makes so much more sense intuitively for what it's trying to do.

<comment><USER5> You make it sound like CSS Grids is a replacement for flexbox. They each solve very different problems, and they complement each other.

<comment><USER6> Can you outline what problems each is trying to solve? I end up using each seemingly interchangeably quite often.

<comment><USER7> Flex:

1\. For unknown number of items in one direction. (toolbar of buttons works better in flex)

2\. Row-wrapping items. (ie, the unknown number of items need to flow with the screen, grid _stinks_ horrible at this)

Grid:

1\. Specific forced number of columns but unknown number of rows (the control is the ultimate, flexbox still does some loosey-goosey stuff where grid stays put). Also, when I know exactly what I want and where it will go and there is no ambiguity about it, grid is perfect. Rows are implicit (ie, any number of rows) This makes clean form building a dream...

2\. Specific layout with areas. Think header, columns, footer all part of a unified design. Way, easier in grid than in flexbox.

Grid has grid-gap, which is vital for making some layouts easy. Flex only has grid-gap in Firefox, so you are stuck with flippin margins for item spacing in flexbox still, yuck.

<comment><USER8> To add onto point 2, areas are _really_ powerful, because it makes changing layout based on screen width really easy.

</comment></comment></comment></comment></comment><comment><USER9> I work in government which is pretty modern but there are users who still use Ie 11.

It looks like IE11 doesn't have full support for flex box or css garden..is that correct?

<comment><USER7> Microsoft doesn't consider IE a browser anymore, they call it a "compatibility solution"[0][1]. If a site looks bad in IE, I think that is ok these days. (functional but ugly, is there an industry phrase to encapsulate this idea?) IE 11 was released 5 year ago...

[0] [https://www.zdnet.com/article/microsoft-security-chief-ie- is...](https://www.zdnet.com/article/microsoft-security-chief-ie-is-not-a- browser-so-stop-using-it-as-your-default/)

[1] [https://techcommunity.microsoft.com/t5/Windows-IT-Pro- Blog/T...](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/The- perils-of-using-Internet-Explorer-as-your-default-browser/ba-p/331732)

<comment><USER10> Graceful degradation.

<comment><USER7> Thank you. I guess I always considered that a phrase regarding features where a browser doesn't have a feature yet, but will in the future. But I guess it works well for the other direction as well.

(ie, a browser that will never have any new features)

<comment><USER10> That's progressive enhancement.

Progressive Enhancement: Starting from some baseline, ideally static content, and building in features that newer, usually visual browsers can support

Graceful degradation: What happens if things don't work perfectly, or some browser doesn't support a feature, or network connectivity is shit so your js file doesn't load.

</comment></comment></comment></comment></comment><comment><USER11> I am still amazed CSS Grid named areas are not used more often.

To me the named areas are the first time that CSS layout makes sense and I first did layouts in tables in the late 90s.

<comment><USER12> Yes! Named areas are the best! The thing I can never decide is whether to use descriptive names or stick to single letter (since single letter helps visually clarify the intended layout)

<comment><USER8> Since CSS isn't really space-sensitive, you could just pad unevenly matched names with spaces, and then layout should be reasonably clear in any standard monospaced text editor.

<comment><USER12> I don't know why that didn't occur to me. Thanks.

</comment></comment></comment></comment><comment><USER13> Tried this and their froggy game a few months ago. I thought it was cool, but I felt it didn't translate well into the real-world. I still have significant issues figuring out how to do layouts in CSS and I still hate trying to do so.

<comment><USER2> This is completely normal. Flexible layouts in any UI system are difficult. I was surprised that the authors of all the popular CSS books and courses usually skip or barely cover that part. Apparently they know it's a topic difficult to explain with short snippets of CSS and HTML. Too many moving parts, especially with dynamic content. In the end, you learn by doing it.

</comment></comment><comment><USER14> I did a pretty popular comprehensive video tutorial on CSS grid: [https://www.youtube.com/watch?v=SPFDLHNm5KQ](https://www.youtube.com/watch?v=SPFDLHNm5KQ)

Best 40 minutes you'll spend if you want to learn CSS Grid! :) First 5 mins are a bit of history, with grid starting at the 5 min. mark.

<comment><USER15> Great work with the tutorial. One question though, aren't flexbox and grid supposed to be complementary systems? The history part seems to suggest that css grid is the next step in the evolution, or an improvement over flex.

</comment></comment><comment><USER16> I learned flexbox since I thought... well you were supposed to. Should I have been using grid all along?

</comment><comment><USER17> This is great! I know ZERO about CSS grid, but this taught me something and very straightforwardly.

</comment><comment><USER18> This is great. There is also Flexbox Froggy if anyone is interested: [https://codepip.com/games/flexbox-froggy/](https://codepip.com/games/flexbox- froggy/)

</comment><comment><USER19> Great game, but does grid display use 1-based numbering?

</comment><comment><USER20> I created a CSS Grid course on Udemy at [https://www.udemy.com/css-grid-with- react/](https://www.udemy.com/css-grid-with-react/). My goal was to use it to build an Instagram web app clone. What I learned was that a lot of the features are really cool to play with but many lack practical use cases, its strong suit being its ability to go in both row and column directions. However despite trying I couldn't think of any use-case for configuring rows (going vertically). I found the grid-template-columns to be most useful, but the grid-area feels fairly gimmicky, as if you were building a quilt. Perhaps for a dashboard application. Overall, I just use flexbox now, even though CSS Grid has a cleaner API.</comment>


Wikipedia and the Meaning of Truth - <AUTHOR> http://www.technologyreview.com/web/21558/page1/

<comment><USER2> I don't trust wikipedia on issues in the soft sciences. it's a nice reference for the hard sciences.

</comment><comment><USER3> i absolutely love wikipedia. it's such an organic system that just WORKS so well, it's elegant. if i need something absolutely factual i will of course take it from vetted sources. but when i am just researching day-to-day curiousities, i'll gladly accept the word of "a friend who seems to know what he's talking about"

that's what wikipedia is to me</comment>


Cofounder Wanted: www.timeoffhq.com - <AUTHOR> I have personally developed this web app over the last couple of years. I have a few serious users but it is only by luck that I have any at all. I have done 0 marketing. I am looking for someone with some mad biz-dev skills to partner with me in turing this project into a revenue generating business. I would even consider selling it outright if the situation was good. My email address is on the front page of www.timeoffhq.com <comment><USER2> Visiting <http://www.timeoffhq.com/accounts> \- shows a xml dump of all your accounts and users!!

I can tell from your blog that you are a good coder, but need to be careful with little things like the routes file as this can lead to big problems.

All the best!

</comment><comment><USER3> Hey, good luck.

Just one small suggestion: that video... You scared the hell out of me.

<comment><AUTHOR> LOL. Like i said, I have not idea what I am doing when it comes to marketing. I made this video after 3 days of relentless hacking.

<comment><USER4> You've got a good voice so you can do the narration yourself. And you look decent so you're not going to scare little children away. But you've got the intensity of a hyperactive geek who overdosed on Froot Loops. Don't take this the wrong way. As a proud geek myself I know that this can be intimidating. The other problem with the video is that it looks home made. (Yes, I know that it is home made) This is OK for technical tutorials but not for a sales presentation. Potential customers might think that this is a sign of an unsuccessful company. And they might associate this apparent lack of success with a bad product. Yes, people are shallow. The video contrasts with the professionalism of your website. Your website looks good and professional. Tone your intensity down a bit and remove yourself (and your room) from the video and you'll make your software look a lot more trustworthy.

Another recommendation is to not use your gmail account... sort of. It makes you look like a kid in a basement instead of like the owner of a small software company. But you can use gmail for your domain for free so you can still get the greatness of Gmail with the legitimacy of your own domain.

Good luck.

</comment></comment></comment><comment><USER5> Cute, I like it.

You should consider some simple avenues to get sales before paying the huge equity cost of getting someone else to do it for you.

\- Get all of your friend's employers to use it (even within subsets of their business)

\- Write some blog articles about what you learn and post them on HN

\- Get some blog coverage about your product

\- Even pay for some ads or adwords

You might also find a cofounder as you drive up your traffic.

What (I think) you need to do now is to stop trying to improve the product and concentrate on getting friends and family to use it.

</comment><comment><USER6> Hey Ryan, your product looks quite interesting and I think it is especially good that you have done no marketing yet: It shows that users are intrinsically motivated to use your product and are even willing to pay for it. You should be proud of that! Before you make all your family and friends use the product or pay for ads, you should start off having a conversation with your existing customers. \- Try to get suggestions off them for new features \- Understand what other problems they have (it was already pointed out that HRMS or payroll systems for small businesses do a poor job with automatisation of such simple tasks) --> Your existing customers are the business experts you are looking for and they would be able to tell you whether or not your ideas are what they value \- Understand how much money/time they save by using your product and what they value about it (put it on the front page instead of the features) In the next step you could think about paid ads, but before using them, your frontpage needs a clearer focus on people coming in from ads. This is the case as those people will likely be less educated in terms of their needs and thus your page has to display and tell them what exactly they are looking for! Some things to consider and then measure: \- Your page talks in terms of features and not solutions. You might want to consider to change that. \- it should mirror the feedback from your customers and have a proactive tense e.g. consider your "sign up & pricing" button → you might think about changing it to "Sign Up Now" \- look at the big screenshot → you might want to think about using this prominent space for your video as it tells much more and is much more convincing that the current screenshot. Obviously, those are the little things in the beginning but they might have a significant impact. Other thing to consider are pricing: It is not clear whether or not the prices are total per month or per user per month (as is usually the case with such products). As you can see there is a lot of work in front of you, but you should be proud of yourself, as I have pointed out! In terms of a business cofounder: It is great that you have realized that you need those skills in your team. I have worked in biz dev with quite successful start-ups and can tell you from my experience that HN is probably not the best place to find those people as it has a very technical focus (what I like about it). Best of luck, Alex

</comment><comment><USER7> A system like this is nice, but IMHO it needs to be aimed at larger corporations and/or those that deal with limited skill job sets(many employees). Being an engineer my team has always been small enough that getting time off just takes mentioning it to my boss 20ft away and making sure I email him the dates after. If you can tell me how this will save a company money I would completely agree you can sell the service. This may sound odd but once again IMHO your pricing is too aggressive, seeing the product and putting my take of going after larger corporations on it I would say you would want to have a sales force pushing a specialized version of this to each customer. Essentially you would go to a Hospital for instance, pitch them on how much they could save in time and $ using this, add some zeros to the end of your current rate and do the full install making sure it works with their current system for scheduling, a support contract is in there somewhere as well.(huge run on sentence but that's how my mind works) My biggest question is who is your competition? I could go on, but I would like to hear your take on competition and who you believe your customers are.

<comment><USER7> Sorry just spotted small businesses on your page, so my question then is why small businesses only? Back to your competition with that question I guess.

</comment></comment><comment><USER8> Link: <http://www.timeoffhq.com/>

</comment><comment><USER9> I don't think its a bad idea- but like others mentioned, the video is a turnoff for me. I like your enthusiasm, but I suggest a remake of the video. The video to me seems like it's an unprofessional product made by someone on a whim. It's great if it were a testimonial, but when used to describe your product- It could be less personal.

Keep up the good work and let me know how it turns out.

Cheers

</comment><comment><USER10> Does it integrate with any HRMS or payroll systems? It may be a nice bolt-on to such systems which have rather dated interfaces, and would allow you to target past the small business focus you have at the moment.

<comment><AUTHOR> It does not. Perhaps this is a great first step towards increasing signups.... But I am looking for someone who knows weather or not this would be a good idea.

</comment></comment><comment><USER11> Looks like a great product, I do have to agree the video did freak me out a bit.

I've worked for mid to small businesses in the past and this could integrate great with them, yet the missing part if you want daily users of your system you need to have time tracking functionality, and this plays in perfect with 'timeoff' as an employees time off accumulates based on hours worked at some defined rate.

</comment><comment><USER12> Looking Good It seems most HRMS/Payroll systems do a poor job of this.

Integration with Google Apps is nice / key. ( [https://www.google.com/enterprise/marketplace/viewListing?pr...](https://www.google.com/enterprise/marketplace/viewListing?productListingId=7205+11045242183304151957) )

</comment><comment><USER13> Just curious, what's it coded in?

Edit, actually nvm, I'm guessing rails since your blog is on heroku.

</comment><comment><USER14> Cool idea. Very well narrated and concise. The 1 min next to video convinced me to spend one min on it.

</comment><comment><USER15> Spelling error in the video - "Email notificaiton" (I always make similar typos).

What a good idea!

</comment><comment><USER16> I made something just like this for work (internal). Looks pretty good!

</comment><comment><USER17> where do you live? Kansas City, MO?

<comment><AUTHOR> I used to. Now I am living in San Francisco.

</comment></comment><comment><USER18> yeah that video is creepy</comment>


OpenCrypto: Unchaining the JavaCard Ecosystem - <AUTHOR> https://dan.enigmabridge.com/black-hat-2017-usa-opencrypto-unchaining-the-javacard-ecosystem/ <comment><USER2> It's a pretty cool hack to reuse crypto primitives in order to implement some operations.

If you're not very familiar with JavaCard and why this would be noteworthy, JavaCard is basically a very stripped-down version of Java that only bears some similarity to regular Java SE. Amongst these limitations is a very stripped down standard library (there is no java.lang.String for example), only a few types (byte, short and arrays of bytes, support for int is optional, no support for char, long, double, float, etc.) and no garbage collection (so everything is preallocated at program start, including exceptions).

Given these limitations, implementing newer crypto algorithms is quite a feat.

</comment><comment><USER3> I don't know very much about this field - what are the major uses of JavaCard other than in SIM cards?

Or are SIM cards where this OpenCrypto would be most useful for makers/researchers?

<comment><USER4> Smart Cards used for military/corporate computer authentication and facility access, some transit systems, some purpose-specific stored value cards (like bike locker rental at BART stations), then of course chip credit/debit cards.

Anywhere you want the user's credential to have some intelligence (sign challenges under specific circumstances, credit and debit a balance without any central database in the loop, etc) but be highly resistant to data tampering/exfiltration (like inflating the balance or copying the key) by its bearer.

<comment><USER5> I used to implement smart card as Personal Identity Verification for Federal employees. It was required by a regulation driven by the post 9/11 Bush era called HSPD-12 (Homeland Security Presidential Directive - 12).

It was a real boon to the DC area technology consulting business. Timed well with stimulus in the post crash crisis as well. Lots of investment in this technology (reminiscent of the Secret History of Silicon Valley) and surprised it has taken this long to get to finance and other uses.

I think one problem is smart cards were timed with the take off of mobile. They weren't very mobile friendly and seemed kind of redundant, but I prefer them to a fingerprint scanner on the iphone or galaxy.

Excited to see where this goes.</comment></comment></comment>


Ask HN: What are the colors of "productive" and "leisure"? - <AUTHOR>

Im writing an app that tracks the times when you are productive and when you are lazy. It has 2 states that I want to represent by color: "productive" and "leisure". Which colors would you assign to these two states? <comment><USER4> I conceive of leisure as either sky-blue or blank white.

</comment><comment><USER5> There's some great articles on the psychology of colour which may help you decide. Here's one: <http://www.entrepreneur.com/article/175428>

My suggestion: Productive: Yellow (stimulates energy), Leisure: Turquoise (associated with tropical water, and pairs well with yellow)

</comment><comment><USER6> Green will refresh you and thus you will be productive n creative. Blue will also be productive. light blue and white for relaxed feeling. Purple n rose will destroy men's productivity and any good company will lose all its sheen as it happened for yahoo.

</comment><comment><USER7> Productive: Orange (construction = work) Leisure: Light blue (sky = watching the clouds)

</comment><comment><USER8> Leisure: ocean blue. Productive: muted red.

</comment><comment><USER9> Productive - <USER2>

Leisure - <USER3>

</comment><comment><USER10> For me productive is either green or dark blue. I don't put leisure in Klok so it doesn't have a colour.

<comment><AUTHOR> Yeah, green is what I tend to for productive. As a sign to "go on!". So I will probably make leisure red. Even though it might be a bit strange to have such a strong color for a nice time.

<comment><USER10> Red, for me, has always been school/education ... maybe because I started assigning the colours when I was still in high school.</comment></comment></comment>


Active Machine Learning with PyTorch - <AUTHOR> https://blog.scaleway.com/2020/active-learning-pytorch/ <comment><USER2> Nice tutorials!</comment>


TOTP SSH port fluxing - <AUTHOR> https://blog.benjojo.co.uk/post/ssh-port-fluxing-with-totp <comment><USER2> I change the SSH port to stop the damn logs filling up so fast, for my own logins I have a key. If you're using passworded SSH on the internet you're just asking for trouble.

<comment><USER3> A few years ago I started installing fail2ban on all my server instances, which comes with sane defaults and the SSH filter enabled out of the box (on Debian/Ubuntu, at least).

<comment><USER4> The defaults in debian for fail2ban are too short, in my opinion, it's useful to turn the ssh, postfix and other daemons' fail2ban time up to 3000 seconds.

<comment><USER5> I use recidive[1] jail to ban an IP if it tries again and again.

[1] [https://github.com/fail2ban/fail2ban/blob/master/config/jail...](https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf#L740)

</comment></comment></comment></comment><comment><USER6> They then have 30 seconds to find the port, which is feasible. So... combine TOTP with port knocking and make sshd unnecessarily difficult to find!

<comment><USER7> +1 for port knocking. Should be used more.

<comment><USER8> I don't get the love for port knocking. If you need such a thing, wouldn't a proper VPN implementation be more robust?

Edited to add: I'm asking for a clue. Thanks in advance. :)

<comment><USER9> I trust openssh a hell of a lot more than any vpn software.

<comment><USER10> Sure, but I also trust it a hell of a lot more than any port knocking implementation. If SSH is your point of trust... make it your point of trust. Throwing up an extra layer of obscurity on top doesn't help anything.

<comment><USER11> If the port knocking was obscuring an unauthenticated root shell then you would have a good point, but this is a defence in depth measure that adds to the security. It helps because it's one more hurdle for an attacker to bypass.

<comment><USER10> Layering two actual security measures makes sense. Layering an obscurity measure on a security measure is not really any safer than just having the security measure, just as obscurity alone is not really any safer than nothing.

<comment><USER11> It is a security measure, as it involves authentication through the series of knocks. It's a weak security measure on its own, so you obviously wouldn't want to rely on port knocking by itself, but it does have utility in preventing an attacker from discovering the service through a simple port scan.

I don't quite understand why you're saying it adds nothing at all.

<comment><USER12> In essence, it's the same argument as "everyone should use encryption, even if it's barely non-trivial for state-level actors to break."

You're not defending against the attacker who is targeting _you_ with this. You're defending against the attacker who is targeting "anyone who is trivially accessible."

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Neat project. What we've been doing is using provider (software) firewalls for whitelisting IPs at the bastion level.

In AWS we have a security group just for the Bastion inbound, and adding/removing IPs to that on-demand to allow access. I kind of assumed this was standard practice by now?

<comment><USER14> Filtering by IP addresses and ranges only gets you so far. What if one of the people who needs to log in logs in remotely? Or if a contractor is behind a dynamically changing IP address? Or if you have too many IP addresses and ranges to fit the limit of rules in a security group? So, while IP restriction is a standard practice, it is by no means the end of it all.

I like the project as a cool and creative experiment,though, and that's what it says it is :)

<comment><USER15> filtering IP-adresses is an important security feature, if personnel needs to access it from non-white listed adresses, they first have to tunnel into Corporate Intranet

you shouldn't expose your services for convenience

</comment></comment></comment><comment><USER16> Cool, but not useful at all when using already written scripts (scp, rsync, …)…

A more easy, yet secure, way would be to simply use the google authenticator module, which does the same task but not at the "port/network" level.

</comment><comment><USER17> I know that TFA acknowledges this but, I think it still needs to be stated that scanning all open TCP ports on a single IP generally takes less than a second.

It'll help you with logs but certainly not provide the same peace of mind that key auth or even post login TOTP provides.

Cool project nevertheless.

<comment><USER18> Back in 2007 I came up with something similar. It opened a bunch of decoy ports that changed frequently so that a scanner would quickly get blocked.

[http://shimmer.sourceforge.net](http://shimmer.sourceforge.net)

<comment><USER17> You could presumably still just SYN scan to find the ports and then use proxies to identify the real sshd.

Obviously my approach would be somewhat involved but I'd imagine this would mostly be intended to protect against someone who may already have likely password candidates, rather than just random scanners.

<comment><USER18> The idea was that if you sent a packet to a decoy port then your IP was banned.

<comment><USER17> I don't think shimmer will catch half open connections, and if it did you could somewhat easily get large parts of the internet banned.

<comment><USER18> Maybe not. It's been 8 years since I last looked at that code...

</comment></comment></comment></comment></comment></comment><comment><USER19> Cool idea, and as long as your connection was completed before the port number changes, you'd be good to go.

Except..

* you're sharing a TOTP secret with one (or more) servers (probably all of your servers), or else you'll have to track multiple TOTP codes for each server

* throughly defeats legitimate automated scripts (i.e., backups, fabric, security scans, etc) that need SSH for automation

* hard to fix (increased complexity)

We recommend fail2ban or denyhosts at Userify[1] (plug: ssh key management), which do a pretty reliable job of blocking inbound traffic after a few (configurable) failed key attempts. They watch failed login attempts in the log file and then block the originating IP.

Still, as recommended in the article, consider running your sshd on a high port (standardize across your org), since it will definitely keep your logs cleaner, perhaps the same port throughout your org. It's amazing how many script kiddies this simple trick blocks. This is also handy on a jumpbox[2]. The time cost does represent a real increase in time for scanners (depending on the scanning pattern, possibly thousands of times slower), and so actually ramps up the time cost in attacks. It's kind of like blocking spam... this trick might seem like security through obscurity, but it will dramatically slow down/eliminate automated attacks against random targets of opportunity (which is what most attacks are). Also it truly does almost completely wipe out the random attack spam from your logs, leaving room for the good stuff.

Of course, the author states this TOTP trick was really a joke and a cool experiment. Don't actually do it in production. :)

1\. [https://userify.com](https://userify.com)

2\. [https://userify.com/docs/tips/jumpbox/](https://userify.com/docs/tips/jumpbox/)

<comment><USER20> "Cloud SSH Keys".

Absolutely not.

<comment><USER19> > "Cloud SSH Keys". > > Absolutely not.

... better avoid that whole cloud thing in general then! :)

</comment></comment></comment><comment><USER21> I have been using sslh ([http://www.rutschle.net/tech/sslh.shtml](http://www.rutschle.net/tech/sslh.shtml)) on my servers where it is just myself logging in for a while and it works great for me!

</comment><comment><USER22> The real solution is to move beyond the ridiculous limitation of 65535 ports to choose from.

<comment><USER23> Or just use ipv6, which would be insane to even guess at the IP.

<comment><USER24> Attackers can still scan the IPv6 subnets owned by you if you are being specifically targetted.

<comment><USER25> Depends if you have entropy in your addresses or not.

585 years to scan a single /64 at one billion packets per second.

</comment></comment></comment></comment><comment><USER26> How's a last digit 5 digits?

Takes the last digit, if the result is above 65536, do that again

<comment><USER27> I think they mean "remove the last digit".

</comment></comment><comment><USER28> Nice!

If you want make things harder for attackers, check out IPtables rate limit[1], nicely implemented also in Shorewall[2]

[1] [https://debian- administration.org/article/187/Using_iptables...](https://debian- administration.org/article/187/Using_iptables_to_rate- limit_incoming_connections)

[2] [http://www.shorewall.net/4.6/manpages/shorewall- rules.html](http://www.shorewall.net/4.6/manpages/shorewall-rules.html)

</comment><comment><USER29> What would happen if I, as an unprivileged user on the box running this, did this:

for port in $(seq 1024 65535); do ./my-ssh-sniffer-thing $port &; done

I leave my ssh at port 22 to make sure only root can bind to whatever i send my password/keys to and/or the AllowGroups directive in sshd_config(That way I dont accidentally allow my test:test1234 SSH-access.)

<comment><USER30> Nit: You do not "send your keys" to the SSH server. You only sign a statement using them. The statement contains some session data that is generated by the server and client together while setting up the session; this makes the signature useless for trying to impersonate the client in any future or concurrent connections.

</comment></comment><comment><USER31> I appreciate this is tongue in cheeck but given that it should be possible for me to constantly scan his server and get each port change is there anything I can do with that? i.e. derive his 2FA private key

<comment><USER32> IANA cryptologist, but it should not be possible to derive the shared secret from the token, if I understand correctly this is discussed in the HOTP spec[0]

> Assuming an adversary is able to observe numerous protocol exchanges and > collect sequences of successful authentication values. This adversary, > trying to build a function F to generate HOTP values based on his > observations, will not have a significant advantage over a random guess.

[0] [https://tools.ietf.org/html/rfc4226#section-6](https://tools.ietf.org/html/rfc4226#section-6)

</comment></comment><comment><USER33> Interesting project. Support port range would be more kind since you won't want all the ports to be on firewall whiltelist.</comment>