Apples and oranges - <AUTHOR> http://blogs.technet.com/b/microsoft_blog/archive/2013/10/23/apples-and-oranges.aspx

<comment><USER2> That's fine and dandy, but the license restrictions on the 'Home and Student' versions supplied with the Surface RTs mean you, legally, can't write/create anything for profit. And the Surface Pro doesn't come with Office, it comes with a 30day free trial of Office 365

>Word, Excel, PowerPoint and OneNote ("Office apps") are Windows apps included with Windows RT. Office apps are governed by some additional terms and are part of Microsoft Office Home and Student 2013 RT or Microsoft Office 2013 RT. Office apps are licensed to you for your personal, non-commercial use, and you may not use them for any non-profit, commercial, or other revenue generating activity.

       Since we launched the Surface line of tablets last year, one of the themes we've consistently used to talk about them is that they are a terrific blend of productivity and entertainment in one lightweight, affordable package. In fact, we're confident that they offer the best combination of those capabilities available on the market today.

At least someone is because last I checked, in the whole scheme of tablet sales, you basically sold zero Surfaces.

>The good news is that Microsoft understands how people work better than anyone else on the planet.

Yes, that's why you gave us the shitshow that is the ribbon interface, poorly scaled on a touchscreen

> 2\. Faster and more precise input methods like keyboard/trackpad.

Only if you but the $120+ covers...which you could do with an iPad too.

</comment><comment><USER3> My favourite part, "… come with full versions of Office 2013, including Outlook, not a non-standard, non-cross-patform, imitation apps that can't share docs with the rest of the world" He shouldn't have included "including Outlook". Outlook is the worst email program to conform to standards. ;)

</comment><comment><USER4> I love that Microsoft built an interesting device that nobody bought, and is defending it like it's a bestseller.

</comment><comment><USER5> Surface -- For whenever you want a tablet so you can type word documents

</comment><comment><USER6> I just sold my IPad on Ebay, it was performing very badly after the IOS upgrade. I am seriously thinking of getting Surface 2. Bottom line, all apps I use are on surface + the office suite. Hopefully Flipboard will be in soon. I know there are too many Apple/Android fans out there actively trolling all over the internet - I think MS deserves a fair chance.

</comment><comment><USER7> If Microsoft had gotten Office on the iPad[1] then it wouldn't matter what Apple does with iWorks. Now, Apple is very close to good enough that Office might never be able to get a foothold.

1) and gotten experience they could bring to their own offerings, oh, like the did with Excel back in the day - that seemed to work out fine

</comment><comment><USER8> I wonder if this gentlemen believes in his heart that Microsoft has built and released a better tablet for people than Apple.

<comment><USER9> I'm sure he does believe that it is a better tablet for some people's needs, that's pretty incontrovertible. Any argument that one is simply "better" than the other in general is pretty silly.

</comment></comment><comment><USER10> Reminds me of the way Ballmer dissed the iPhone.

EDIT: And to be fair, the way Jobs dissed netbooks.

</comment><comment><USER11> I like how he makes reference to the "Reality Distortion Field" and then goes on to immediately state a half truth; that the Surface comes with Office. It comes with hobbled versions.

The fact that Microsoft felt the need to respond to the announcement in this way tells you that they are concerned about it.

<comment><USER12> What is hobbled about them, exactly?</comment></comment>


Thinkery now has Bulk-Edit - <AUTHOR> http://blog.thinkery.me/post/4066296149/new-bulk-edit

<comment><USER2> steady progress...

<comment><USER3> indeed, a couple of other features were released as well.</comment></comment>


Custom cancer vaccines safely fight and kill tumors in early human trials - <AUTHOR> https://arstechnica.com/science/2017/07/custom-cancer-vaccines-safely-fight-and-kill-tumors-in-early-human-trials/ <comment><USER2> That almost sounds too good to be true.

Reminds me that 'scientist rapes reporter' cartoon. They claim 'potential benefits' while curing many people who were essentially walking dead.</comment>


The client is never wrong (You are) - <AUTHOR> http://blog.samuellevy.com/post/32-the-client-is-never-wrong-you-are.html

<comment><USER2> > If you don't tell them what you're building, then they won't know until > you've built it.

In my experience, they'll usually not listen until it's built. They'll not even test it until they need for real work. At that point, they'll get stuck and their customers will get angry. And then, should _I_ feel guilty?

<comment><AUTHOR> In my opinion? Yes.

If you're getting paid a rate similar any other IT professional, then you're getting paid to provide more service than just typing code into a text editor. Seriously, the rate for a decent programmer is insane, yet many of them seem to think that anything other than writing code is outside of their job description.

If a client doesn't appear to be paying attention, then you either have to be more persistent, or re-think how you're communicating with them. Are your questions too technical? Too vague? Full of words that they don't understand? If so then they're not going to give you good responses. If they still don't answer them, then at least you have a record of the questions that you asked.</comment></comment>


Why are humans scared of robots? - <AUTHOR> http://news.bbc.co.uk/2/hi/programmes/fast_track/9636763.stm <comment><USER2> I, for one, welcome our new robot overlords :-)</comment>


Ask HN: Interested in coworking in Thailand? - <AUTHOR>

I'm planning to rent a cheap bungalow in Thailand for two months or so and work on my stuff from there for a change. I went there a while ago to check it out, and found at least one place which I recall cost about $10-20/night and came with wifi. It felt nice to swing there in a hammock and code away on my laptop. Actually more than just "nice", it seemed like the perfect environment.
The benefit from joining forces would be the usual coworking benefits, combined with the comfort of not having to travel alone. For me it's important though that it remain as cheap as possible. This means off-season and staying away from expensive resort-style places. I work on my own small Facebook / MySpace / iPhone projects.
My e-mail is in my profile. <comment><USER3> Those into this idea should read this great (encouraging) article:

[http://www.expatsoftware.com/articles/2008/05/laid-off- one-t...](http://www.expatsoftware.com/articles/2008/05/laid-off-one-thing- you-absolutely-need.html)

It inspired the hell out of me.

It's more about NOT coding, and taking time to see the world cheaply, but looks like the author (Jason Kester) was so font of living this way that he started a company called Expat Software to code full-time from cheap exotic places.

Expat Software's site says, "Where exactly are we located? That is difficult to answer, as it changes on a regular basis. A good place to look would be a nice beach with cheap bungalows to rent and a fast internet connection."

:-)

<comment><USER4> Great article. Read it some time ago too and decided to do just that - <USER2> right now I'm at Bangkok :). Thanks for reminding me on that link.

</comment></comment><comment><USER5> I'm Thai and have been back there a few times the past few years.

One time, I stayed at a resort on Koh Chang (Elephant Island, a few hours east of Bangkok). It was pretty nice, and relatively cheap. And it had wifi. Make sure the room you stay in (or wherever your hammock is going to be) gets good signal. I couldn't get good stable signal in my room. I had to sit out in the porch if I wanted to go online. (Bring bug spray!)

You can stay/vacation in Thailand for relatively cheap. I would recommend you stay on a beach if you can. They have one of the best beaches in the world (not mainland beaches, but island beaches). And definitely take a few days to go sight seeing. Worth it =)

I'm interested in how this turns out for you. Good luck.

ps If you don't get paid locally for your "work", I don't think you need a work visa. And I use TripAdvisor.com for hotel reviews.

<comment><USER6> Last spring I was working on my laptop on travels through Thailand. Loved it.

I also stayed on Koh Chang, at a couple different resorts that had wifi. One was on Lonely Beach (Can't remember the name), one was at Bang Bao (Cliff's Cottages). I never paid more than $10/day for lodging.

I am thinking of doing something similar next year again soon -- I find traveling to be one of the most intellectually and emotionally stimulating things I can do, period. But I'm thinking of Argentina this time, I've wanted to go there for years and brush up on Spanish.

</comment></comment><comment><USER4> I'm already in Thailand since a month and am planning to do what you describe. Sill at the moment I am more into travelling around - Next month I'm going for Laos and Kambodschia. You definitly don't need a working visa if you work on your own startup code. Best to get a 2 or 3 month tourist visa which you can even renew two times by making a visa run to the border. If you come without a visa you'll get sort of a visa on arrival which used to last one month but seems to be now only 2 weeks! Best go to an cheap island resort with wifi or a nearby restaurant with wifi (where you can stay all day and use the net while ordering a coke every 2 hours). $10-20 seems pretty high to my standards. I've seen rooms for $5. I would say you get an okay room for $8-14 but you might have higher standards. My current room is $25 and I have wifi by the hotel but I could easily go with less luxery and have wifi from somewhere over the street (often times you get an open wifi signal from next door). If you have any questions, mail me.

</comment><comment><USER7> Random concern: I think spending too much time in a hammock is a bad thing because it hyperextends your knees.

<comment><USER8> Just put a pillow (or two) under your knees when on a hammock.

</comment></comment><comment><USER9> i recently had that plan with a friend too, unfortunately she had an accident. i have a little project to finish und would join in. planed to leave alone for thailand in the beginning of january. i'll send you an email

why the hell would yo need a workvisa?

</comment><comment><USER10> This is something I'm actually interested in doing as well. I have a friend who lives in Bangkok - so I'd probably be crashing with him and his wife for a bit.

I'm also going to Hawaii for the month of February - lodging is free though since I have family friends who own there.

Working away from home can give you a bunch of new ideas. I'm currently in Jamaica for xmas and have had at least 2 dozen new ideas for current and new projects. A change of scenery is always a good thing.

Please let us know what you're doing - maybe start a blog. I'd be really interested in your planning/trip.

</comment><comment><USER11> Sounds nifty. I actually own a place on the beach in Thailand (technically, I'm a dual citizen of the U.S. and Thailand!); maybe I should stay there for two months and build new business ideas. Maybe I will see you!

</comment><comment><AUTHOR> I fixed my profile now, anyway my e-mail is email@example.com. Hoping someone will join me, and if several people want to join then perhaps we can consider renting some larger place.

</comment><comment><USER12> Not really prepared to do that right now, but I'm curious about the logistics - work visas, tax concerns, etc.

<comment><USER13> Definitely curious about this. What country are you moving from?

</comment></comment><comment><USER14> Sounds like a great idea, I couldn't find your email address in your profile could you post it here?

</comment><comment><USER15> I have been to Koh Samui, Lamai beach, many times. There is good "campus-like" wi-fi you can subscribe to easily. You should be able to rent a house south or north of the main beach area for a good price these days.

</comment><comment><USER16> Man, I'd be right with you a few years ago, all tied down now. After you come back, post a review on here, would love to read it.

PS: Watch out for the girls, very distracting.

</comment><comment><USER17> My co-founder and I just did a similar thing, except we rented a cabin in the mountains for a year. We're working on www.trailbehind.com

</comment><comment><USER18> Sounds cool. I'm not seeing any info in your profile. Is it just me?

</comment><comment><USER19> reminds me of the lifestyle described in 4 Hour work week</comment>


Scientists reveal the relationship between sugar and cancer - <AUTHOR> http://www.vib.be/en/news/Pages/Scientists-reveal-the-relationship-between-sugar-and-cancer.aspx <comment><AUTHOR> And the actual study for those interested

[https://www.nature.com/articles/s41467-017-01019-z](https://www.nature.com/articles/s41467-017-01019-z)</comment>


Natural protein vs. designed (nano)machines - <AUTHOR> http://crnano.typepad.com/crnblog/2009/05/natural-protein-vs-designed-machines.html

<comment><USER2> _biology sets lower bounds for what is possible_

I was surprised when I evaluated this to be a true statement. As a biologist I'm used to marveling at how optimal everything seems in the natural world, and at how evolutionarily distant organisms converge on the same form given similarity between ecological niches. But take flight as an example: we can fly orders of magnitude faster than the fastest flying organism. The upper end of the biological case _is_ the lower bound of what is possible. The early use of the biological example was to inform us that flight was possible at all.

More directly related to the topic of the article, this New Yorker piece, on a new class of therapeutic compounds for correcting protein folding errors:

[http://www.newyorker.com/reporting/2009/05/04/090504fa_fact_...](http://www.newyorker.com/reporting/2009/05/04/090504fa_fact_groopman)

<comment><USER3> "The early use of the biological example was to inform us that flight was possible at all."

If there had never been any birds, would(n't) we have invented planes eventually anyway?

<comment><USER2> I bet we wouldn't have started thinking about it in the 9th century...

<http://en.wikipedia.org/wiki/Abbas_Ibn_Firnas>

</comment></comment></comment><comment><USER4> "I have an additional speculation: that a protein that was too stable would be hard to break down and re-use for spare parts, once it gets damaged by cellular metabolic products (or any of a number of other mechanisms). \--- Drexler suggests that people designing protein machines should not be afraid to try to do things differently, and better, than biology. I agree."

There's a hidden with this line of reasoning - by the first line of reason, it quite likely that a highly stable nano-machines would be toxic because it could not be broken down in the manner of a protein and would thus accumulate in the body if it operated similarly to a protein. It is just about guaranteed that any form of nanomachine you create would wide-up spread about the environment. Could be a problem.</comment>


Ask HN: Should I start blogging when my startup is still early? - <AUTHOR> <comment><USER2> Everything is ROI.

My company has heavily invested in blogging [1] which has helped us become influential in the product space (enterprise ETL around Apache Airflow). As an engineer, every time I write a post I try to balance time vs ROI. I think it's more valuable to pump out a good post that takes 5-10 hours of effort (not counting writing the code etc) vs tons of very low effort posts when you're first getting started. Occasionally, you can find time for a high investment post like 20+ hours but this is pretty difficult and probably not worth your time at the early stages.

If 10 hours invested into writing a good post turns into thousands of page views turns into a small number of conversions, this can be very beneficial in growth.

One trick you can do is recycle ideas across blog posts, meetup talks, and conference talks.

Another thing to think about is that not every engineer enjoys investing in writing. If it's not something you enjoy, I wouldn't force yourself to do it. Some people are much better at formats like podcasts or videos (personally I'm the opposite though).

Happy to answer more specific questions if interested (email in profile). Feel free to reach out.

[1]: [https://www.astronomer.io/blog](https://www.astronomer.io/blog)

<comment><USER3> Given that the enterprise ETL space is crowded, how do you pick and choose topics that are relevant while still unique to your company?

<comment><USER2> It definitely is crowded. I'd say that the strategy varies by department (in engineering, we have a lot of freedom with technical posts) so we tend to write about using flagship frameworks and platform design decisions.

At the end of the day, the goal of my technical content is just to write interesting things that draw other engineers and technical people like data scientists to our blog and site. It also helps establish credibility in a crowded space. (I'd also start to like doing tutorial posts in the near future.)

I think if you have the opportunity to speak with leaders in your industry and work collaboratively on blog posts / podcasts / etc that speaks volume as well. We've done some of this already and it draws a lot of highly engaged traffic.

<comment><USER3> Thanks for the tip.

</comment></comment></comment></comment><comment><USER4> You need to weigh up your perceived benefits of blogging against lost progress of other aspects of your business.

In the early stage, focus should be on generating money so you become self sustainable. If blogging is part of that strategy, so be it. But blogging for bloggings sake isn't probably a good spend of your time.

However, the relationship between doing something here = an equal loss somewhere else is rarely true - so if it's something you enjoy doing as something different to your normal routine then why not.

We've written a fair few blog posts in the past and always focused on keeping them high quality and is has paid off in some ways - I would say though that writing a good quality blog post easily can take 1 full days work. If you're looking to outsource it, you're doing it wrong.

</comment><comment><USER5> I started blogging recently to document my experience starting a startup. In my posts I just make sure to mention where I'm at so people know that I don't necessarily know what I'm talking about yet :)

<comment><USER6> sounds like an awesome attitude to have when blogging. good job!

</comment></comment><comment><USER7> Yes. In fact, you should generally start marketing anything while it's still fairly early in development. Build up a fanbase and supporters before your product or service is released so it gets a lot of users on day 1.

This will also get you more press coverage too, which is much easier to come by when journalists know they've got a guaranteed audience for stories about your startup than if it's a completely untested idea with no existing audience.

</comment><comment><USER8> Do you have spare time to blog? If yes, blog. If no, what will you avoid doing in order to blog and will that other thing have a higher immediate ROI than blogging?

When your startup is young, your job is to keep it alive (which usually means to get it growing). Blogging can help, but don't blog if there are other higher value things that you can do.

</comment><comment><USER9> Yes, to start introducing your business. It will help determine your market range. Just be consistent with your brand and content.

</comment><comment><USER10> Yes, it also attracts talent to your startup, especially at a time you can't afford to pay more. Assuming you write intelligently.

</comment><comment><USER11> Yes. Audience to your blog will build over time.</comment>


Ask HN: CTO equity for a company in its seed round - <AUTHOR> I have been offered to come on as CTO & Cofounder at a startup, here are the facts:
- The CEO and his business partner both own half of the company
- The CEO's business partner is his father
- We would be three "cofounders": The CEO, The Chief Scientist and me
- We have a great working relationship, I am currently working for them as a contractor.
- The AR app is part of a portfolio we are building to test the traction of our product
- All three founders are instrumental for the startup to work, we all complete each other extremely well
- The chief scientist was one of the first employees at a company which recently acquired by a large multinational for around $100M. The company is in the same field as our startup.
- The company being turned into a startup has existed for 3 years and has sold websites + hosting. Hosting generates approximately $20k/yr in revenue. The company is only being renamed as it pivots and "becomes a startup" (This is purely for cash flow).
- I recently declined an offer for $97k + $15k in equity at a very well known publicly traded tech company. I am in demand.
- We are located in the province of Quebec in Canada
They offered me to buy a 10% share in the company (for a total of ~$15k) to come in as CTO & cofounder. The value is based on the current net worth of the company. we would all be paid minimum wage. Both the CEO and the Chief Scientist are pouring $50k in the company to infuse cash flow for the first year, as part of our agreement I would not have to follow suit on any capital investment for the first year.
After a lot of research I can't help but feel like I am being taken advantage of. The way I see it the startup should be incorporated as a new entity and the equity should be split more equally. Any cash infusion by us should be rewarded in the form of convertible notes which should cover the capital risk we take when a Series A comes around.
Am I wrong? Am I about to make a huge mistake? <comment><USER2> There are a few concerns, but I am not sure I'd say you are being taken advantage of (yet).

Concerns I'd have:

1\. By not incorporating a new company, any past liabilities that the old company may have could haunt the new venture. This typically comes true when suddenly it goes from a small business with small revenues to a business worth suing because there is real money at stake. Of course, being in Canada might help as it isn't as litigious as the US from what I understand, but I could be wrong.

2\. They are family, the one key thing to be aware of when working with families (yours or not) is it can be a nightmare. I spent the vast majority of my childhood and early adulthood working in family businesses (tech and otherwise), my family worked really hard to not do what most do in the business but it was a daily effort to be aware of it. Family fights different, family will stick together over almost all else (yes there are exceptions) and you being the outsider might be used as a weapon on either side which puts you in the middle. e.g. Son wants to go one way, Dad wants another, You may agree more with Son so then he'll use you against the Dad to get (or try to) his way. Not saying it is always like this, but I also consulted for years and dealt with family businesses and always saw patterns of strange behavior you wouldn't see otherwise.

3\. The equity just doesn't make sense, unless they are giving you a different share class which could be really bad. This is again where it isn't clean so I'd be cautious and get more details first.

In the end, these maybe great people and you may all work super well together and this will all be fine. It will boil down to your level of comfort and trust with them. My 2 cents, if you trust them, just get them to put everything in writing and have an outside legal advisor go over it for you. You don't have to get a lawyer to negotiate it or be confrontational, just get some advice and make sure it makes sense and you are covered. If you don't trust them or your gut says they are trying to pull something on you, run and run fast.

<comment><AUTHOR> Thanks for your answer

I'm not too scared about the family part, I came in acutely aware that it could be an issue but after working with them it seems to be a non problem.

The part I'm most confused about is the equity, it doesn't seem to be a standard way of doing things in the startup world.

<comment><USER2> The equity isn't standard and it is odd. Only you can make this call. But if nothing else it seems odd.

One point, 98% of all business are not managed or dealt with as a startup like SV would. I have been apart of a lot of businesses outside of SV and so many were not structured as you'd expect based on reading tech blogs etc, but a few were super lucrative for me. SV is an echo chamber, don't use it as your only source of reality as it is really an isolated odd case of reality.

</comment></comment></comment><comment><USER3> Depends on how far along the company is in. If it was no code and just 3 people agreeing - you should have gotten 33% and whatever salary you're okay with. If it's pretty far along that's a bad deal.

<comment><AUTHOR> So either way I'm not getting a good deal ?</comment></comment>


Ask HN: How do you deal with uncertainty? - <AUTHOR> We live in dynamic world. How do you deal in uncertainty which is everywhere. In business, work, health, financial planning?<p>Is it only state of mind, or can we really deal with? Do you use risk management approach? <comment><USER2> My personal example. I'm betting four years of medical school loans that I can successfully complete med school, residency, and find a job. There is a lot of uncertainty in pursuing a medical degree. What if I didn't make it into med school? I have a four year biochem degree.. a field I don't want to work in. I was almost faced with that after two years of applying and finally making it in. Okay.. now what? Four years of medical school, hundred exams that I can possibly fail, license exams I can fail, bad evals I can receive. Even after that, it is more uncertain.

The only way I can "deal" with this is thinking of it in terms of a risk/reward analysis. I'll start with some variables.

Variables:

\- The graduation rate / residency placement rate is around 90%+. What happens with 10%?

\- Salary in a mid competitive field is $300K+ USD in areas that aren't expensive (Nevada?). What if I did computer science instead? 130K in Seattle? What if I didn't land a job?

\- Loans are around 350K at 6.5%. What if I fail and can't pay them off?

\- Employment rates of doctors vs CS? Job security?

\- Ability to leave medicine and go into computer science?

\- Etc.

My risk is I fail and it takes me 25 years to get out of debt... by then I'm an old man. That is a pretty big risk. My reward is job security for the rest of my life. Gamble? ~10% odds I end up failing. Pretty low risk, but everything in the med field is filled with uncertainty. A few years from now I might be the guy making 40K with an MD next to my name, I might not.

The question to ask yourself, is the uncertainty worth the reward? Be reasonable and analyze the risk involved.

</comment><comment><USER3> Read "The Lean Startup" by Eric Reis. It's entire premise is dealing with uncertainty.</comment>


Security reporter tells about hacked 911 call that sent SWAT team to his house - <AUTHOR> http://arstechnica.com/security/2013/03/security-reporter-tells-ars-about-hacked-911-call-that-sent-swat-team-to-his-house/

<comment><USER3> I think this is an all-new low for the word "hacked". You can call any 911-response center and provide a phone/address for them. No need to even change your caller ID, just hide it. No need to dial 911, just find the local 10-digit number for your PSAP. You can probably even just call the police line, and say that 911 isn't working because you're on a VoIP line.

Edit: I had a similar experience, when one of my license plates fell off. I filled out an online form on the police site, never got a response. One day, cop pulls me over, then draws on me and gets 4 other cops as backup. I was under the impression you don't point guns at someone unless you're ready to fire, so I'd assume that if I had made any sudden movements it could have been fatal.

The thing is, I could have filled out that form with anyone's information. There's not even a callback/confirmation. So if you fill out a form for someone who has a concealed carry permit or something, you could probably cause a severe incident.

<comment><USER4> _I was under the impression you don't point guns at someone unless you're ready to fire, so I'd assume that if I had made any sudden movements it could have been fatal._

Was this hyperbole or honesty? Drawing a firearm is a deterrent and is employed in order to prevent things to escalating to a point where an officer has to fire.

<comment><USER3> Sorry, I should have made it clear, he drew, then pointed directly at my head - I was looking right at the end of it. Wikipedia says the rule is "Never let the muzzle cover anything you are not willing to destroy".

So, going from what seemed like an ordinary traffic stop to looking down a gun, I figured he was prepared to kill me if he found it necessary. As I could not figure out any reason for him to want to stop me like that in the first place, it seemed logical there was some massive escalation I was unaware of.

<comment><USER4> Yes, that is a basic tenet of firearm safety. However if an officer delays drawing his weapon until he is ready to fire it can be too late. You cannot fire a holstered weapon.

I am not certain about the exact distance but I think a hostile person brandishing a knife within 20 or 25 feet is considered to have an advantage / pose serious risk of death (able to inflict serious trauma) over an officer with a holstered weapon. (In NYS)

</comment></comment></comment></comment><comment><USER5> One need not be a hacker to get a SWAT team to storm the house of a citizen in the U.S. [http://www.ctpost.com/local/article/Towns-to-pay-3-5M-in- dea...](http://www.ctpost.com/local/article/Towns-to-pay-3-5M-in-deadly-cop- raid-4290145.php)

</comment><comment><USER6> I have an easy fix: don't have soldiers doing police work.

<comment><USER7> I'm no advocate of paramilitary policing, but if the police get a call from your house saying there's a criminal with a gun shooting people, what alternative is there to them showing up with guns drawn?

Even in the UK, where most of the police don't have guns, they still send armed response teams to deal with armed criminals.

<comment><USER6> There is a difference between showing up with bullet-proof vests and handguns, and showing up with full body armor, assault rifles, and grenades. It is a matter of mitigating the risk of innocent people being killed by the police.

<comment><USER8> Good luck getting police to show up to anything involving armed criminals without all that kit after the L.A. North Hollywood shootout of 1997 [1]. Not to mention the Dorner police slayings or the _two_ homicidal maniacs in upstate New York in just the past few months.

If you want to respond with anything less than the best possible tools available to ensure you survive the event then you can certainly make that choice. But I couldn't in good faith tell someone else to make that choice. If you're a bystander near a heavily armed criminal the only safe place to be is far away.

[1] <http://en.wikipedia.org/wiki/North_Hollywood_shootout>

<comment><USER9> When I was an MP (military police), they taught us a bit about _escalation_ , wherein you only use what is necessary for the task at hand and reevaluate as the situation changes.

Cops certainly do not need to be using 'weapons that belong on the battlefield' as their go-to weapon for any raid _unless_ it is suspected that there may be body armored opposition (an absurdly rare occurrence - <USER2> treating as an outlier). It would not be unreasonable to have one or two rifles on standby, in case a situation escalates beyond what was expected.

I do not like this trend of increasing para militarization of the US police forces. You are supposed to trust a police officer. It is hard to trust someone wearing BDUs and carrying assault weapons - you are more likely to respond fearfully, which can often make things worse.

<comment><USER10> > unless it is suspected that there may be body armored opposition

You mean like in the case where someone deceives them into thinking someone well-equipped and violent is in a certain location?

Swatting is a hard problem. We can't really put strong authentication in place because of the asymmetry of needing anyone to be able to report a violent crime in progress at any time at any location. And the anonymous report is, indeed, cause for suspicion that a crime is being committed, and if that anonymous report further claims that the bad guys are heavily armed and/or wearing body armor, that is cause for suspicion that they may indeed be telling the truth and the bad guys are ready to rock and roll at the drop of a hat.

It's a sticky situation.

<comment><USER11> You know, this actually, _just this once_ , sounds like a sensible use-case for civil deployment of surveillance drones! Not pre-emptively, mind you--but when someone reports something like this, it'd be great to be able to send a robot ahead of the police to see what they're up against.

<comment><USER12> Robots are actually frequently used to make contact with armed suspects holed up in buildings.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Hasn't swatting been around forever? Or at least for the time when phone number spoofing became easy. Even the Wikipedia entry is referencing an FBI page from 2008. [1]

[1] <http://en.wikipedia.org/wiki/Swatting>

<comment><USER14> Script kiddies have been doing it since at least the 90's.

</comment></comment><comment><USER15> Major props to the reporter for not losing it. The self control necessary to get through this incident quickly and without things taking serious turns for the worse is something I can hope I have. (I probably don't.)

</comment><comment><USER16> Did they search his home with permission, or does a spoofed phone call alone give the police the right to perform a search?

<comment><USER17> If the police know it spoofed, of course not, but if they have probable cause to believe a person is in danger they can do a search for that person without consent or a warrant.

<comment><USER18> How would they " _know it spoofed_ " without checking? I mean there is no reason to believe someone they just arrested...

<comment><USER19> In this case, Krebs recognized that dilemma and just consented to the search. If someone were to SWAT someone that they knew had unrelated contraband, this becomes an interesting question. That's not far off of what AT&T did to Weev initially, but I think his drug charges were thrown out.

</comment></comment></comment></comment><comment><USER20> The #1 issue is the completely insecure, trust nature of the phone system. It should be _trivial_ for a local police department to verify, with a very high degree of trust, that the number calling them is legitimate. That this doesn't exist is absurd, and is twenty years behind where it should be.

<comment><USER3> It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic. The "caller ID" number is totally unrelated to any incoming line. The number could also be from another country, or corrupted.

The Internet seems to work fine with IP, despite it being trivially spoofable. I think your expectations are incorrect.

Edit to add: It's not even desirable, what you're asking. Imagine, for instance, Twilio. If each call had to be immediately traceable, what would that mean? Would Twilio need to require proof of identification before allowing any outbound calls? I think what your suggesting would be extremely detrimental.

<comment><USER20> _It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic._

While this seems to get stated a lot, it isn't actually true at all: spoofed IP packets get no response (I should also add that most providers flag and drop packets that have no business originating from where they did, so spoofing IP is usually a completely non-starter to begin with), or rather the response goes to _an entirely different place_ (as if you spoofed someone's number to call 9/11 but only the original number can actually hear what the operator is saying). There are a couple of examples of very large providers misusing BGP (usually accidentally), but it is immediately identifiable, completely tracked, and _rejectable_.

 _It's not even desirable, what you're asking._

What am I "asking", given that you've gone to such lengths to declare it? If someone has a phone on AT&T or Verizon or _even Skype_ the provider should be able to essentially sign the call initiation. Much like TCP, the world phone system has a routable infrastructure (otherwise it would be impossible to call a number because where does it go?), and such a mechanism is hardly far flung when we're talking about emergency services.

Yeah, there are some services that can't abide by that, and they should properly be flagged as "completely anonymous, untraceable call" and get the credibility such deserves.

<comment><USER3> Spoofed telephone calls can't be called back either, exactly like IP.

You are asking that the originator of a call be identifiable somehow. That's not possible, given the number of resellers and levels. That would require even more trust, getting every provider to have a transitive trust relationship and show ID. A single call might go through 3, 4, even more resellers before ending up at the destination.

<comment><USER20> _Spoofed telephone calls can't be called back either, exactly like IP._

These emergency phone calls are two-way communications, exactly _unlike_ the IP spoofing situation (seriously you really want to stick with the wrong IP example?)

 _You are asking that the originator of a call be identifiable somehow_

Wonder of wonders, yes I am. The world phone system is a completely routable system -- providers effective own prefixes or even individual numbers, which is exactly how one can call someone. The notion that if a call comes in that says "Hi I'm 555-5555 from Verizon @ 555 Blaxberry Lane" and it can actually be verified if not authenticated by Verizon is hardly some big technical marvel. It's actually _TRIVIAL_ , and it's exactly how the world pay-phone system works (note that these people aren't spoofing numbers to call pay sex lines because the telcos actually care about that). This whole ball of nonsense is because telcos have zero obligation to give a crap, so they don't.

<comment><USER3> SMTP might be a better analogy, but I'll concede as it's irrelevant.

You're wrong about the compensation bit. It's entirely possible to send fake traffic and get compensation. Cutting that off is an entirely manual process; with someone noticing the fraud and reporting it. It's not some magic authentication that happens.

The reason things like sex lines (either premium rate numbers or just really high-rate areas) often do not work is because the costs are passed on through the various companies (so they'll clip anything over a few cents) or because they simply will not accept calls if they are not within the trusted system. If you have a VoIP line and try dialing a 1900 number, it won't work unless that VoIP provider has made a specific deal. It's not like they look at the calling number, then mail out bills to whoever they think the owner is.

Guess what: Folks don't accept limitations on dialing 911 (or the PSAP admin line, which is just a normal number). They're going to demand 911 be answered regardless of billing relationships.

At both 911 companies I've owned, the routing system depended on being able to "spoof" caller ID. We would have to accept whatever caller ID we were given, because there's it's essentially intractable to know who has the actual relationship with the end user. It's also not knowable if the connection handing me off this call is authorized to use that number. There's simply zero concept of that. Additionally, there's no such thing as a real master database correlating number-address. (That'd make things easy easier!)

Even if there was, it'd still be trivial to swat. Buy a number online, say your address is <target address>. Place a legitimate call that "authenticates". Change address, repeat. Worst case scenario (if you can't make an anonymous payment), hack someone else's VoIP account and change their address and place call.

You are right that this _is_ a large problem. Some PSAPs have come under DoS attacks, getting a flood of fake calls. 9-1-1 is a critical piece of safety, and it's fairly unprotected. Funding is limited. Some of the vendors involved are laughably bad. And, at least a few years ago, there was a massive disconnect between technology/Internet and the emergency response side.</comment></comment></comment></comment></comment></comment>


Forever 21, Which Helped Popularize Fast Fashion, to File for Bankruptcy - <AUTHOR> https://www.nytimes.com/2019/09/29/business/forever-21-bankruptcy.html <comment><USER4> Back in '08-'09 Forever 21 was my favorite clothing store. They had styles there that fit well, looked good, used comfortable fabric, and was relatively cheap. Given how the economy was doing at the time, it gave Forever 21 an advantage: clothes 2-3x cheaper and clothes quite a bit more enjoyable to wear.

But the fabric they used disintegrated on me, as woman's clothes tend to. (Men get thicker fabric, but at the expense of being less stretchy. Women like to show off their curves.) The problem with this being that no one else made the styles I enjoyed. It was a fad that came and went. It doesn't exist in thrift stores. I don't even know what to call it, so I can't find pictures in an image.google search. Forever 21 made products I liked, but then they switched and I (and my friends) couldn't find anything that came close since. The last time I bought clothes at Forever 21 was in 2010.

Since then H&M has caught on like wildfire taking over the market Forever 21 once had. They do a lot of the same, but their clothes are even cheaper (why?) and in my current wardrobe my favorite clothes have come from H&M. I'm afraid the same fate will come to H&M that has come to Forever 21. Or maybe H&M will learn from F21's mistakes. Only time will tell.

<comment><USER5> My girlfriend worked as a weaving technician and she said the H&M stuff got much worse over the past decade and subjectively it is true. The stuff literally disintegrates if you have it in the drier to often. Sadly enough this is also true for the men's wear.

I certainly try to spend a little more and get quality stuff. Second hand stores can also be great because you can find great quality stuff that feels better after the 20th wash than the H&M stuff feels fresh out of the store.

<comment><USER6> I have similar experiences with H&M, and a lot of other cheap basically colored shirts. It'll feel great at first. Then I'll leave it in the dryer for a few minutes too long, and the fit completely changes while the material looks degraded.

I'm more than happy to spend $30+ on a simple shirt that won't change its fit after a few cleanings, but struggle to find a consistent brand.

If anyone has recommendations, please let me know.

<comment><USER7> > I have similar experiences with H&M, and a lot of other cheap basically > colored shirts. It'll feel great at first. Then I'll leave it in the dryer > for a few minutes too long, and the fit completely changes while the > material looks degraded.

Hang dry and use a lower spin speed in the wash. It takes a little more planning and time, but I hang dry almost all my clothes and I have t-shirts from H&M type store that are 8 years old and still holding up. Some higher quality clothes brands are even older and look pretty much brand new.

I can get clothing to last until the fabric actually wears out - elbows in dress shirts, knees in pants etc and even after that you can sometimes convert them to shorts with a little sewing.

</comment></comment></comment></comment><comment><USER8> > Mr. Chang, the company's chief executive, said in a 2012 interview that the > chain was named Forever 21 because it targeted 20-somethings and because > "old people wanted to be 21 again, and young people wanted to be 21 > forever."

I like how he felt like he needed to explain that one.

<comment><USER9> The funny thing is that the statement is not true, the first store was called "Fashion 21" and they renamed themselves when they started opening other stores.

<comment><USER10> That doesn't necessarily invalidate the statement, they presumably put a great deal of thought into their new name.

If their first store was called "Fashion 75", do you think they would have chosen "Forever 75" as their new name?

</comment></comment></comment><comment><USER11> Here's some info on potential reasons why they are going bankrupt.

-they are mall centric store and mall traffic has been declining. Other chains have been "right sizing"

-big discount stores (target, Walmart, TJ Maxx, etc) have upped their (discounted) fashion game

-forever 21 was slow to adjust to these broader trends vs competitors

I also agree with proverbialbunny. My girlfriend used to go there regularly but we haven't been to one for ages. Could just be us getting older though :)

[https://www.google.com/amp/s/finance.yahoo.com/amphtml/news/...](https://www.google.com/amp/s/finance.yahoo.com/amphtml/news/why- forever-21-will-probably-go-bankrupt-and-disappear-165236255.html)

<comment><USER12> Overall mall traffic might be declining but I've been to malls here in my city where the higher end malls are thriving and more popular than in previous decades.

The Forever 21's in my area are located in malls that are dated, and ripe for a major renovation.

<comment><USER4> That's a really good point. I can understand why other stories have been dying to wanting quality merchandise. Victoria Secret is going out of business, but True (an online only company as far as I know) is amazing. I'm in love with their products. Victoria Secret I never cared for.

</comment></comment></comment><comment><USER13> I've seen a lot of people going on about fast fashion recently. I'm aware of lots of shops that are considered fast fashion, but which ones _aren't_? Where should I be going to buy more durable clothes that are made of nicer materials? I'm genuinely curious. I'd like to change my buying patterns (I'm really not that fashion conscious, so long as I can have some nice button ups and trousers I'll be happy).

<comment><USER14> Here's a couple I like that aren't over-the-top expensive or bespoke:

      - LL Bean
      - <USER2>
      - <USER3>
      - Lands End

My general rule of thumb: Try to stick to natural fabrics (cotton, wool, linen) for most things. Synthetics can be good but most are _really_ cheap.

If you're willing to pay a little more, there are some small shops still making stuff in America that you can feel good buying and will last a lot longer than your typical fast-fashion goods.

<comment><USER15> I was looking for an excellent fleece to fit my needs, but I didn't want to spend big $$. I wasn't having any luck, so on a whim I splurged (a bit) and bought a fleece from one of the names listed above.

\- I bought it from an outlet store so despite its high price it was still discounted

\- It's incredibly well-made

\- The "cut" of it is great, as in it fits my form really well

\- Its pockets are deep

\- It's warm

Zero regrets. It's absolutely one of my favorite clothing items and hopefully something I'll maintain for a long time.

<comment><USER16> > \- The "cut" of it is great, as in it fits my form really well

I find it odd how much better off-the-rack fit tends to be on more expensive clothes (for men, anyway). You'd think that'd be one thing the cheaper brands could easily duplicate, and that the main differences would be fabric quality & construction, but no.

<comment><USER17> > I find it odd how much better off-the-rack fit tends to be on more expensive > clothes (for men, anyway). You'd think that'd be one thing the cheaper > brands could easily duplicate

Cheaper bands target a wider range of body types per SKU, which naturally produces worse fit on average.

</comment></comment></comment></comment></comment><comment><USER18> The only other substantial discussions on HN:

[https://news.ycombinator.com/item?id=7861442](https://news.ycombinator.com/item?id=7861442)

[https://news.ycombinator.com/item?id=8971215](https://news.ycombinator.com/item?id=8971215)

I guess "fast fashion" means cheap sweatshop clothes. The bankruptcy is probably caused as much by rising standards of living in other countries as it is by the general shift to online ordering.

<comment><USER19> If that was the issue, it would be affecting Zara, H&M, Uniqlo etc as well. Zara is seeing record profits, H&Ms revenues are up but profits are down as they spent their money investing in online sales, Uniqlo profits are also up

<comment><USER20> This is addressed in the article:

 _Mark A. Cohen, the director of retail studies at Columbia Business School, said that he believed fast fashion was as popular as ever, pointing to the success of Zara, but that Forever 21 had expanded far too quickly "without regard to a reasonable outlook. It's a self-inflicted catastrophe"_

<comment><USER21> I would _hope_ that the reason for failure was more about this:

> Forever 21's struggles have provoked questions around the appeal of fast > fashion more broadly. The industry has faced backlash surrounding the > environmental impact of quickly disposable clothes and concerns about worker > safety

...

> Younger shoppers have increasingly turned to consigned goods and brands that > claim sustainability as a value...

But I wouldn't bet big money on it.

<comment><USER22> > goods and brands that claim sustainability as a value... Claiming > sustainability and being sustainable are two different things. For instance > "C&A" is making a lot of things from "Bio Cotton", but you if search for Bio > Cotton on their website > [https://www.c-and-a.com/uk/en/corporate/company/sustainabili...](https://www.c-and-a.com/uk/en/corporate/company/sustainability/bio- > cotton/) you find this:

"BIO COTTON is all of that. It guarantees you that no genetically modified seeds are used, it supports farmers, saves the environment and feels good for you and your loved ones."

Maybe I am biased (I am not opposed to GMO), but I have doubts that this is the best way to be environment friendly.

<comment><USER23> All cotton is bio cotton, isn't it? It's not the sustainability or GMO status of cotton that concerns me about fast fashion but the plastic fibres flaking away into the general environment.

I think that we have no choice but to seek sustainability from farming, as plastic is not sustainable from any angle. The alternatives to petroleum plastics are organic, so farming again.

</comment></comment></comment></comment></comment></comment><comment><USER24> how much do cheap plastic clothes (polyester, spandex, elastic) contribute to the micro-plastics epidemic I saw on HN recently?

I've been trying to get 100% natural materials (cotton, wool, leather) and they seem more comfortable, less stuffy (especially for sleeping) but that might be a placebo.

<comment><USER25> > _I 've been trying to get 100% natural materials (cotton, wool, leather) and > they seem more comfortable, less stuffy (especially for sleeping) but that > might be a placebo._

Natural materials are obviously more comfortable, more breathable, hypoallergenic, etc. These fabrics are literally the product of millions of years of evolution for putting on top of an animal's skin, and work well with its physiology.

<comment><USER26> Lots of people are allergic to wool. Perhaps as much as a quarter to a half of the population will have a mild allergic reaction if they have ordinary coarse wool rubbing against their skin for a long time, like wearing a woollen collar or scarf while trudging through the snow all day. Some people can recognise whether fabric contains wool just by touching it with their fingertips: an immediate itching sensation. So perhaps it evolved for use by sheep, not humans?

<comment><USER27> What about merino wool? It is said to be much less of an issue with allergies, and we see it everywhere these days.

<comment><USER28> Wool makes me itchy (I still wear it just not against my skin) but cashmere and merino don't have the same effect.

</comment></comment></comment></comment></comment><comment><USER29> [http://archive.is/gcj3w](http://archive.is/gcj3w)

</comment><comment><USER30> While fashionnova is booming.

To give you an idea how fast FN is, they'll sell then make a product (in that order) so fast that when the customer gets it in the mail, the paint hasn't dried yet.

Quality is not their forte.

<comment><USER31> That doesn't make sense to me and I work in the fashion industry. Unless you want to pay tens of thousands to air freight goods, min time is at least two weeks.

</comment></comment><comment><USER32> Good. The only fast fashion brand I truly like is uniqlo, but forever 21 was always at the bottom of my list. All of their clothing had prints that looked like it came out of a machine learning algo that wasn't trained properly. I dont understand how they afforded to open these giant stores in the hottest malls. A fun game that I played with friends is to go into f21, try on clothes and see who can assemble the most absurd outfit.

<comment><USER33> Uniqlo is not fast fashion, apart from T-shirt prints they have same styles every year.

<comment><USER34> My wife calls Uniqlo a functional fashion store, nice things but built to be used and possibly last longer- if not because of quality then because of the lack of here and now feeling.

</comment></comment></comment><comment><USER35> Fast fashion is a huge burden on the environment and should not be supported. So good riddance.

</comment><comment><USER36> My ex took me there in Tokyo when I visited Japan. Shiny shops and good background music but crap for men's clothes. 3 floors of women's clothes and a tiny corner for men's. Not great.

<comment><USER37> One thing they DID have is a great selection for larger women. While most stores cater to the skinny+young (see brandy melville's "one-size-fits-all" policy), many forever 21 locations had a large plus size section that I know was appreciated by many women.

</comment></comment><comment><USER38> Fast fashion doesn't need to be bad quality fashion.

<comment><USER39> I think the quality is a side effect of the real problem with fast fashion: Implied disposability.

<comment><USER40> The entire fashion industry is about disposability. Forever 21 simply fulfills it at a low price.

If everyone tried to keep up with the latest trends we'd be throwing out nearly our entire wardrobe every year.

</comment></comment></comment><comment><USER41> I'm a little surprised by this. Forever 21, I thought was the fashionable dollar store equivalent for clothing. It should've done much better than other higher end brands, considering how millenials are spending less and less on clothing.

Also, how are people wearing out their clothes so quickly. I bought a super cheap shirt from forever 21 once and it lasted for years with no sign of wear.

</comment><comment><USER42> Forever 21's app is really bad, it just couldn't compete with other brands like zara and uniqlo.

<comment><USER43> App, really? I really don't think a mobile app is at play here at all.

</comment></comment><comment><USER44> Why does this deserve front page? I read the article expecting customers got woke and are demanding ecofriendly and labourer-friendly clothing. Seems all about bad business decisions, and other fast fashion companies will soon fill that vacuum.</comment>


Show HN: Add forms to your static site – no iFrames required - <AUTHOR> http://www.formspree.com/ <comment><USER2> Is this what I think it is? A resurrection of those free hosted formmail scripts we used when I started writing web pages in the late 20th century?

Edit: [http://www.formmail.com/](http://www.formmail.com/) still seems to be going, in fact.

<comment><AUTHOR> I could be wrong, but it looks like it requires CGI

<comment><USER2> You either download the CGI script and host it yourself or you pay the formmail.com people to host it. In the olde days there were free ones where you specified the destination in the form, but spam put paid to that.

<comment><USER3> It's free, unless you exceed 1000 submissions/month:

 _> How much does it cost?

> Formspree is free for 1000 submissions per email each month. If you need > more, please reach out._

</comment></comment></comment></comment><comment><USER4> This is even more 90es:

<form action="mailto:firstname.lastname@example.com" method=post enctype="text/plain"> ... </form>

<comment><USER5> I'm probably missing something obvious but I don't understand how this is different apart from costing money

<comment><USER6> When you submit a form with a "mailto:" action, the browser opens the mailto protocol handler, which is the user's email client. So you hit submit on the form and then see a draft email filled out with your form responses.

<comment><USER7> To expand on that:

If the user doesn't have an client-side email client setup (eg, they use Gmail/Hotmail via the browser) a box will pop up prompting them to setup an email account.

Even if they do have one setup up, most users will immediately dismiss the email, so you'll never get it.

This is different to serverside email, where the client submits a form to the server, and the server sends you an email.

Unlike the "mailto:" method, the second method will actually get you some responses.

</comment></comment></comment></comment><comment><USER8> Another option is to host your static site on BitBalloon ([https://www.bitballoon.com](https://www.bitballoon.com)) - we make the forms on the site work without any backend programming.

This doesn't leave your email in the HTML and we also do spam filtering on the form submissions (get a bit of traffic and your contact form will get lot of spam).

<comment><USER9> Seems like an enourmously awesome solution, but, again, I ask: who are the users of these kind of services (BitBaloon, Formspree etc.)?

(or, better asked: what is the problem these solutions solve?)

<comment><USER8> People are looking to static sites more and more for a couple of reasons:

1\. speed - you can't beat an optimized static sites hosted on a CDN. In part I suppose the increased focus on speed i driven by mobile traffic. 2\. Github - front-end developers have now gotten really used to having everything under version control. Dumping the most important content into an unversioned database just doesn't feel as good as having everything as Markdown in Github 3\. Jekyll - or rather build tools and static site generators in general. The combination of GitHub and Jekyll and flag ship projects such as the Obama Campaign platform [1] definitively played an essential role in the growth of static site generators we're seeing now.

Our clients range from beginners launching their very first HTML site, over agencies with really cool flows built around Middlemand/GitHub/Draft/Similar services, to companies that are integrating site publishing into their products in various forms.

One of the cool examples is a startup doing a site builder for progressive candidates running for national campaigns. They use our API to handle the publishing, and use our form feature for gathering volunteer submissions and contact mails.

In general I think publishing a website with a form on it, is one of the most basic features of the web. Making it faster, easier and better is a pretty obvious plus for a lot of people.

[1] [http://kylerush.net/blog/meet-the-obama- campaigns-250-millio...](http://kylerush.net/blog/meet-the-obama- campaigns-250-million-fundraising-platform/)

<comment><USER9> Thanks. I'm answered.

</comment></comment></comment></comment><comment><USER10> We did something similar a year ago but it didn't get any traction. [http://instant.jotform.com](http://instant.jotform.com)

</comment><comment><USER11> Great idea. I'm not sure about the pricing though. I'd expect anyone who reaches 1000 submissions per month to probably make the effort to get their own form handler. I'd make it 100/month or maybe 1000 submissions total until you have to pay. Then make it an annual fee so that customers think "OK, I'll pay $X not to have to deal with this for another year."

<comment><USER12> I'd advise against making it a _total_ submissions limit. I would not bother attempting to use a service that is guaranteed to blow up on me one day even if the site remains low traffic.

</comment></comment><comment><USER13> I've been using SimpleForm([http://getsimpleform.com/](http://getsimpleform.com/)) for my static site forms, It's quite easy to set up and you can add some spam prevention with Akismet.

This project looks interesting because there no need to register unlike SimpleForm.

</comment><comment><USER14> You can make a custom form submit to a Google Forms endpoint, and it will go straight into a Google spreadsheet.

<comment><USER15> It seems to me that would be so much more useful than a bunch of emails.

Or expose an API for a CSV download, or a data feed, or something.

</comment></comment><comment><USER16> Anything to stop someone sending 1000 submissions to someone else's form as a trolling Denial of Service (DoS) attack?

<comment><USER17> Rate limiting per IP would be pretty easy to implement.

<comment><USER18> Doesn't help much when there is a botnet spamming you with one mail per minute from 10000 ip-numbers.

</comment></comment></comment><comment><USER19> Cool idea -- what kind of spam protection can it offer though?

I'm not worried about the email address being in the open, but my original contact page form was getting hundreds (thousands?) of spam submissions a day until I implemented some simple javascript 'traps' to filter out the bots.

I've still not worked out why a bot wants to fill in a contact form with spam anyway, seems like a real waste of time.

<comment><USER20> Best and simplest trick I've found for this is having a CSS hidden honeytrap field, something like <input name="message_body" type="text" class="hideme" />

Bots will put something in the field but humans should never see it, so if the server sees anything in there it can safely toss the whole thing.

<comment><USER12> Two pitfalls: 1) You should add some text to indicate to people using screen readers that this field should remain blank. 2) You should make sure to name the field something unlikely to be autofilled. There are browser toolbars out there that will happily autofill even hidden fields and trigger your spam filter.

But other than that, I agree that this is extremely effective against the common sort of drive-by spam bot. (And, obviously, completely useless against any sort of advanced or targeted attack.)

<comment><USER19> Good point. My javascript solution uses two hidden fields with very similar names. One that the script fills in and one that it doesn't.

Bots will either hit both or neither and get rejected. Screen readers/toolbars may be an issue, though the names would be hard to think what to autofill with. It has never come up in practice -- the reject message tells people to email us directly

If you have javascript turned off, you'll need to email directly too -- and the site won't work so there probably isn't much lost!

</comment></comment></comment></comment><comment><USER21> The example says _...action= "//..._ shouldn't this be _...action= "[http://](http://) ..._ ?

This is so seemingly simple but so useful, thanks a lot!

EDIT thanks for explaining, all! :)

<comment><USER22> Ah, I had the opposite remark:

On [http://www.formspree.com/](http://www.formspree.com/) at section 1, they say to use "[http://firstname.lastname@example.com"](http://firstname.lastname@example.com") while it should be "//email@example.com".

I just set up a Jekyll site with links to youtube and disqus. Quite important or it won't work.

<comment><USER21> That's what confused me, too, the inconsistency between the two.

</comment></comment></comment><comment><USER23> Regarding the issue of having your email address in the open. This could easily be solved by requiring registration and generating an encrypted URL for each email address that a user associated with their account. I know this highers the barrier for entry, but putting an email address in the open is foolish and making it _too_ easy for the dumbest of email harvesters.

<comment><USER24> These are for static websites. The idea of an "account" doesn't make sense.

Edit: Ah, you mean that formspree should allow site owners to create accounts. Carry on.

<comment><USER25> I'm thinking he means registering an account on the formspree site. So your form's `action` attribute doesn't require the inclusion of a plain e-mail address. Instead it gets some encrypted string, which is uniquely tied to your formspree account.

<comment><USER23> Exactly. And you could generate as many tokens as needed

</comment></comment></comment></comment><comment><USER26> In the privacy FAQ you might want to link to Mailgun's privacy policy, or at least their website.

</comment><comment><USER27> There's another one (getsimpleform.com) that handles uploads and spam prevention via Akismet. It does not expose your email.

</comment><comment><USER28> There's a problem here. browsers do not send Referrer when on an https site. And they refuse to work without the header

 __For geeks: could not find "Referrer" header.

<comment><USER29> Oops, good catch, thanks! Hadn't thought of this.

Apparently the problem is just sending a request https->http. https->https should work fine. Adding SSL asap.

EDIT: now you can also use [https://email@example.com](https://firstname.lastname@example.com)

<comment><USER28> The rules are more complex. I'd say just do away with the refer(r)er. [http://webmasters.stackexchange.com/questions/47405/how- can-...](http://webmasters.stackexchange.com/questions/47405/how-can-i-pass- referrer-header-from-my-https-domain-to-http-domains)

Maybe later when you have a real problem, fix it then. Let's cross bridges when we come to the river, that way we'll all have much simpler code!

</comment></comment></comment><comment><USER30> I simply prefer to show my email address. People know what to do with an email address.

<comment><USER31> Originally, I did just that with my service. The problem is when you need simple information like "What browser and version are you using" when someone says something "isn't working". Capturing User Agent during form submission takes an otherwise painful step out: asking a non-technical person to find out what version of Internet Explorer they are running. There are still people who think "The Internet" is "the Blue E on my computer". Similarly adding required fields like "What's your site's address" when you run a multi-site service. All valuable things to have specified so that you can answer any questions with the first response rather than having to ask a pile of followup questions when customers don't provide enough info.

With a general purpose email, you don't get that.

<comment><USER30> If you give instructions along with the email, serious people are apt to play along.

</comment></comment></comment><comment><USER32> Nicely done. This kind of stupid simple service makes the web an easier place to work.

</comment><comment><USER33> Does this not invite spam by leaving email addresses in HTML source code?

<comment><USER20> No more so than a company's email being in a Contact Us page.

<comment><USER34> So... yes.

<comment><USER20> In other words, this method is on parity with conventional contact methods and the spam harvesting point is moot.

<comment><USER35> I think that contention is flawed in that it assumes the two methods are, must be, and should be equal in terms of email address exposure.

</comment></comment></comment></comment></comment><comment><USER36> Undocumented feature: If you put _subject into the name property of an input, it will be used as the subject of the email.

</comment><comment><USER37> I was recently looking for a nice simple implementation of this for a client. Didn't really find any that I liked so we decided to build this ourselves. Now we have the flexibility of either emailing them the results or storing in our local database for later processing. This looks really nice though.

</comment><comment><USER38> YES YES YES.

That is all. Thank you.

</comment><comment><USER17> Kind of easy to crawl and harvest verified emails on web sites that implement that API.

<comment><USER39> This kind of service will stay low on the radar compared to how many people write their email in plain text on web pages. It's quite unlikely that someone is going to crawl the web and harvest formspree "ACTION" fields when they can simply harvest regular email and get a million more.

</comment></comment><comment><USER40> This is cool, no JavaScript either.

Also, the contact form at the bottom of the page uses the API :)

</comment><comment><USER41> Would be especially cool if it supported input type=file as well :)

</comment><comment><USER9> I don't know who would want this. Is it really a demand from people? It is programmers who love static sites who use this? Or the non-coders everywhere?

</comment><comment><USER42> Is there a way to denote certain fields as required (on the back-end -- not talking about "required" attribute or js on the front-end)?

</comment><comment><USER43> Is it 1995 again? Where's my formmail.pl ?

<comment><USER34> [http://www.scriptarchive.com/download.cgi?s=formmail&c=txt&f...](http://www.scriptarchive.com/download.cgi?s=formmail&c=txt&f=FormMail.pl)

</comment></comment><comment><USER44> Is there a way to send the form submission to multiple emails using this service?

<comment><USER21> I guess you could use a new email address that automatically forwards what it receives to multiple emails.

</comment></comment><comment><USER45> I was looking for exactly this about two weeks ago. Awesome!

</comment><comment><USER46> Anyone can send mail using "Referer" header?

</comment><comment><USER47> I would love a self hosted version of this

<comment><USER48> Oh man, there are HUNDREDS of "scripts" that do this! Here's the PHP one I used to use back in 2004.

[http://regretless.com/scripts/scripts.php#dodosmail](http://regretless.com/scripts/scripts.php#dodosmail)

I'm surprised this is being touted as such a new idea, but I guess with static sites making a comeback, it was inevitable.

<comment><USER47> cool, thanks for the pointer.

this seems like a good introductory project to any web framework

when I really sit down to learn node, I think I'll try to make something like this starting out.

</comment></comment></comment><comment><USER49> OMG blast form the past. Well done guys.

</comment><comment><USER50> getsimpleform.com as others have mentioned can do all of this plus file uploads and spam prevention.

</comment><comment><USER51> except it doesnt add a form to your site.

</comment><comment><USER52> I love it!</comment>


NASA lunar map shows Moon in new light - <AUTHOR> http://news.techworld.com/green-it/3319282/nasa-lunar-map-shows-moon-in-new-light/

<comment><USER2> Interesting to see all that red and pink. For comparison here are some Earth mountain heights.

Everest == 8,850 meters

K2 == 8,611 meters

Chimborazo == 6,310 meters</comment>


Show HN: Happy Clients - <AUTHOR> http://happyclients.michaelheap.com/

<comment><AUTHOR> There's a bit of an introduction at [http://michaelheap.com/introducing-happy- clients/](http://michaelheap.com/introducing-happy-clients/) if you're not sure what it's for. The site's pretty basic at the minute, but I think the idea has potential.</comment>


Sleep Better: Be Uncomfortable. - <AUTHOR> http://www.lifehack.org/articles/lifehack/sleep-hack-a-simple-strategy-for-better-rest-in-less-time.html <comment><USER2> The entire idea behind this "hack" is that if you make your bed super uncomfortable, you will get out of bed in the morning and not be up all night because you slept late.

In other words, you can exchange not liking alarm clocks for being uncomfortable _all night long_ so that when you wake up you'll want to get out of your uncomfortable bed.

A modest proposal for an enhancement: scorpions.

I'm sticking with the alarm clock.

<comment><USER3> I'm wondering if there might be some way to start out being comfortable but setting some process in motion that would cause you to be uncomfortable 8 hours later.

How hard would it be to design a bed that, say, slowly inclines to vertical?

<comment><USER4> Perhaps, instead of an inclining bed, one could posit a light. This light turns on around 5:30AM and slowly gets brighter and brighter until it hits a maximum intensity; then, it slowly dims until it sets... err, "turns off"... at around 7:30pm?

<comment><USER3> Personally, I tend to use a sleepmask. Maybe I could build a sleepmask with a light...

<comment><USER4> Actually, I do the same, so my plan wouldn't work for me, either. Foiled! But I will purchase your sleepmask+light if it is cozy enough.

</comment></comment></comment></comment></comment><comment><USER5> I did this once, to try to control my oversleeping (10+ hours a day). I put my mattress into a closet and slept on the floor for a year.

Eventually I just got used to the floor. It became pretty comfortable. I even returned to sleeping on my side after a few months.

I've since found a found some _far_ better ways to control my sleeping habits:

\- Eat more.

\- Get a job where you must wake up at 5:30, combined with a lifetime habit of not going to bed before 11.

\- Sleep under windows facing the sunrise, and don't close the blinds all the way.

I can't going to generalize these for everyone, but I can say it worked for me. Sleeping uncomfortably just didn't work over the long term.

</comment><comment><USER6> If this guy tries dating a woman he'll probably get new bedding.

</comment><comment><USER7> I have a hard time believing sleeping like this will be the same quality of rest as sleeping comfortably.

<comment><USER8> In my opinion, sleeping uncomfortably is not a good idea. I will take some of his advice and discard my large comforters and soft pillows.

In the morning I usually end up quickly turning my first round of alarms off and then crawling right back in under those warm and secure covers.

On a somewhat related note, I am going to start Uberman this summer. Does anyone have any experience with that?

<comment><USER9> I tried Everyman-3 last summer. It was a very weird experience. Highly unusual.

After a few times of failing to wake up on time, I became a bit alarm- paranoid. I once woke up on my own early, and jumped out of bed thinking two hours had passed (instead of 30 minutes). Turned out only 8 minutes had passed since I looked at my watch before going to sleep.

This reflects one of the cooler aspects of polyphasic sleep - you learn to fall asleep regularly in under 3 minutes. I slept on a bed, on a floor, on a lawn. You just learn how to relax and drift off immediately.

Also, once you've slept for 30 minutes, you don't want to sleep anymore. Your consciousness just regains control of your body and poof - you're awake.

It's not something I would do for years on end, because it can be difficult to accommodate having work and a social life, but it's very fun to do for a few months at a time. You gain a lot of time.

<comment><USER10> > This reflects one of the cooler aspects of polyphasic sleep

That "aspect" is called sleep deprivation.

<comment><USER9> Eh, maybe. I haven't studied polyphasic sleep and I'm not a scientist, so understand that my opinion comes from someone who has slept monophasically, experienced quite a bit of sleep deprivation, and also slept polyphasically.

That said... what I was talking about is not at all like sleep deprivation. Sleep deprivation causes tiredness, lethargy, lack of energy. You wake up feeling tired and maybe your eyes or your head hurts. What I experienced with everyman-3 was _nothing_ like that. It wasn't you falling asleep because you were unusually tired; it was you falling asleep because you willed yourself and your entire body to relax and let go of consciousness, almost like a sort of meditation. You wake up feeling absolutely refreshed and ready to go. In any case, it _feels_ completely different from going to sleep tired or waking up sleep deprived; I don't know about the specific mental mechanism, as I am not a neuroscientist, as cool as I think it would be to be one.

Anyway, I would recommend giving polyphasic sleep a few tries. I only managed it after trying and failing twice (once because I kept oversleeping, once because social things got in the way). Also, I would not recommend doing polyphasic sleep for many months on end. At least, I wouldn't feel comfortable doing it, as who knows why it's possible. Maybe I'm depriving my body of very necessary sleep and preventing long-term learning or something - until it's more well researched, I wouldn't want to sleep polyphasically for more than a month or two.

</comment></comment></comment></comment></comment><comment><USER11> Based on my own experience I would suggest that you can sleep fine in an uncomfortable situation until you're in a light enough sleep that you'll wake up.

The rested feeling is simply not waking up in the middle of a deep sleep cycle when your body is flooded with melatonin. Alarms simply don't way us up optimally. They blare at us with no regard for how deep we're sleeping.

I don't think either extreme, sleeping uncomfortably or fighting with an alarm, is the answer. There's an interesting alarm app on Android phones that will ring quietly x amount of time before the real alarm is set to ring to see if you're more awake then. I'd like to see more attempts at hybridization like that.

<comment><USER12> Two existing alarms that also work on this premise:

\- One has a light that brightens over the course of an hour to simulate the sun rising. Supposedly the natural progression of brightness in your room will help set your internal clock (or something like that) [1]

\- Some sort of monitor that you wear that monitors what phase of sleep you're in. You set the alarm to a certain time, and the alarm picks the right time to wake you up, depending on your sleep cycle. [2]

[1] [http://www.amazon.com/EZ-Wake-Digital-SunRise- Alarm/dp/B0002...](http://www.amazon.com/EZ-Wake-Digital-SunRise- Alarm/dp/B0002VAHXW)

[2] [http://www.amazon.com/aXbo-Sleep-Phase-Alarm- Clock/dp/B0014R...](http://www.amazon.com/aXbo-Sleep-Phase-Alarm- Clock/dp/B0014RDSSY)

</comment></comment><comment><USER13> Three birds with one stone: Build a bed with a shower above it. Hook the shower up to a timer. You'll get woken up in the morning, you'll get clean, and you won't want to get back in your (now soaking wet) bed. :)

</comment><comment><AUTHOR> I think the theory is more, sleep with _as little comfort as possible_. That way you feel rested in the morning, while at the same time you don't want to lay around because it feels so good.

</comment><comment><USER14> from experience: the style mentioned causes a terrible hangover from lack of sleep. I felt sluggish through out the day.

imho, it is far better quality of sleep if you have 4 hours of 'comfortable' sleep vs 10 hours of 'uncomfortable'(as per the author)

</comment><comment><USER15> This does work in that you'll never oversleep, but you also don't feel very awake for the first hour or two in the morning.

<comment><USER16> Speaking from experience here?

I'm not sure I can agree with you - I don't think humans had a selective pressure to get better rest in soft, coccoon-like circumstances.

Why should we be predisposed to do that?

<comment> a-priori Our ancestors also didn't have automobiles and airplanes. That doesn't mean that it's not faster to travel that way than on foot.</comment></comment></comment>


Kindle for the Web - <AUTHOR> http://www.amazon.com/gp/feature.html/?docId=1000579091

<comment><USER2> This was very exciting to me until I realized that you don't actually get to read books this way. It's limited to book samples. Still, it has some usefulness.

<comment><USER3> They make too much money selling kindle, to release a full reader any time soon.

As long as I need to have some special reading device, I won't buy any ebook.

<comment><USER4> Amazon's deployment of "free" Kindle reader software to many platforms differs from your interpretation. In terms of razor economic models, the Kindle hardware may be a deluxe razor handle, but Amazon seems willing to sell blades to users of other hardware.

</comment></comment></comment><comment><USER5> I was disappointed for a second reason: I thought about Web for the Kindle, rather than Kindle for the Web. I really like reading books and research paper pdfs on the Kindle, but delivery of non-Amazon content is a bit of a hassle.

Not very much, but still emailing to the Kindle is some extra effort. It would be great if there was some selection of web content, e.g. Hacker News frontpage articles, or my RSS feeds that would be converted to the native Kindle format and then delivered like a newspaper daily or twice daily. Not being able to follow links would be annoying, but still the idea is nice. Maybe I have to hack something like that together and try it...

<comment><USER6> <http://www.kindlefeeder.com/> allows you to do most of what you are looking for.

Also for mobi files such as the instapaper one it would be nice to be able to make ajax calls to set articles to read when you clicked a link at the end of the article.

<comment><USER7> Have you actually tried to use kindlefeeder? It's a good service when the RSS feed has the full text, otherwise it just doesn't work (it's no good to read hacker news, for instance, as the feed doesn't have the full text)

</comment></comment></comment><comment><USER8> I like the idea of the kindle. I really love the eInk idea, so I don't really get it when people rave about back lit display books. At the end of the day, it's nice to relax reading. Which when your eyes are tired at the end of the day after sitting behind your computer all day, who on earth wants to sit and read something off a pc or someother back lit display, causing further eye stresses.

Really keen to actually see and use an eInk tablet - without internet; else I'll just waste even more time on fb. I should do some more research into what would suit me.

<comment><USER9> If anyone releases a full-sized e-ink monitor, I'll splurge for it. Just a little bit faster and just a few more colors are all I'd need.

<comment><USER10> That'd be awesome. With a little more speed, I could definitely picture that... maybe a multi-monitor setup with your web browser on an LCD, and your terminals and text editors on eInk displays.

</comment></comment></comment><comment><USER11> I love this. The implementation would be so much nicer if they would extend it to full books, but it still works perfectly for previews. The scrub bar, the previous/next arrows, and all the other stuff make it very similar to other common web elements. Very nice.

</comment><comment><USER12> Previews are cool, but it would be great if you could read all the kindle books you purchased in the browser.

</comment><comment><USER13> It is NOT Flash based! Good news, big deal.

</comment><comment><USER14> I brought the Kindle 2 for total of $400, thought it was a ripoff when apple introduced ipad..but it looks they are progressing slowly.</comment>


How your VPS provider can steal your SSH server's private key - <AUTHOR> http://www.reddit.com/r/linux/comments/1fxg9k/do_more_people_download_linux_distros_after/caexn2o

<comment><AUTHOR> Sorry for the self promotion (what's our spam policy on this?), but I felt that this audience would be more interested in the content :)

This post describes why it's a bad idea to assume the security of your machines if you host them on a VPS provider. The only secure server is one that you have exclusive physical access to.

<comment><USER2> The thread posting sounds like a roundabout (but very detailed) way of saying your VPS provider is running your server and anything they can do with the host key, they could just do by installing whatever they want on your actual VPS instance.

It seems kind of moot when you're using a VPS though. Aquiring the host key would open up man in the middle attacks, but the VPS provider is also the "man at the end."

It goes on to say "replacing passwd" and such, but that's not necessary. One could just replace the file with dd or boot via single user. Potentially, one might also be able to hotswap an executable image on a running machine in memory, but I never tried it.

In short, physical access to a machine is game over and everything else is just kind of over verbosity that gets to the same point.

<comment><USER3> If you are using a shitty virt type like OpenVZ, all they need to do is do vzctl enter [your_vps_id] and they are at a root prompt. This is hidden from w/who/last/ps.

Nothing else.</comment></comment></comment>


New P2P botnet infects SSH servers all over the world - <AUTHOR> https://arstechnica.com/information-technology/2020/08/new-p2p-botnet-infects-ssh-servers-all-over-the-world/ <comment><USER2> This looks like a clue as to what some, but probably not all, botnets consist of...

The idea of using SSH servers (from the perspective of whichever group or individual(s) wrote the given botnet that uses them) makes a lot of sense (in an evil way), because there's a lot of SSH servers out there on the Internet.

To dig a little bit deeper (if I were an investigator), I'd investigate all of the historical security issues that SSH has had, in its history...

Were some of those intentionally engineered?

?

If so, then whichever groups or individual(s) were involved -- might be -- or might lead a security researcher a step closer to the actual authors of the botnet...

Also... one needs to ask "who would need the botnet, and why?"

While I'm on the topic, I think it would be a great idea to research the historical security issues that not just SSH, but every piece of server software (Apache, etc.), _in order of the software 's popularity_.

In other words, the more popular a piece of server software is -- the more likely it is a target for intentional botnet "security modifications" (that is, intentional weakening of the server software's security to support future botnet activity...)

Also (and especially) if those server software packages use common shared libraries of code in their codebases, then those common shared libraries are prime targets...

So, here's what I would do for sleuthing this:

1) List/enumerate all known pieces of software that act as servers on the Internet.

2) Order the list created in #1 by popularity.

3) Look for all libraries/code bases -- shared across those.

4) Look at the historical security issues of those codebases.

and, for skilled investigators:

5) Audit these codebases for changes/commits that look similar to other historical changes in other codebases where security was compromised.

Anytime someone sees weird or not-understandable code in a shared codebase -- it should be flagged for peer review. The more eyes, the better.</comment>


Ask HN: Co-founder? Seeking co-founder? - <AUTHOR> Please lead with either CO-FOUNDER or SEEKING CO-FOUNDER, your location, skills and high level pitch. <comment><USER2> I would not imagine people will do that on YC.</comment>


What is the incentive for curl to release the library for free? - <AUTHOR> https://stackoverflow.com/questions/55884514/what-is-the-incentive-for-curl-to-release-the-library-for-free/55885729?stw=2#55885729 <comment><USER2> The StackOverflow question/whatever was taken down.

Read the post on the author's own blog: [https://daniel.haxx.se/blog/2019/04/29/what-is-the- incentive...](https://daniel.haxx.se/blog/2019/04/29/what-is-the-incentive- for-curl-to-release-the-library-for-free/)

</comment><comment><USER3> That's what real heroes look like.</comment>


Compiling Brainfuck to the MMU Turing tarpit via a MOVDBZ machine - <AUTHOR> http://gergo.erdi.hu/blog/2013-10-05-yo_dawg_i_heard_you_like_esoteric_programming_languages.../

<comment><AUTHOR> I.e. Gergo is compiling an eso lang to a single instruction set machine that runs in the MMU "processor" that lives between the cycles on your processor.</comment>


Some Americans plan to work until 80 - <AUTHOR> https://www.wellsfargo.com/press/2011/20111116_80IsTheNew65

<comment><USER2> I plan to work until my death. Will keep writing code rest of my life. Once I'm around 70-80 I think i'm going to focus on writing artificial intelligence with memories of mine programmed into it, so the artificial intelligence actually will think that it's me.</comment>


Ask HN: Is there a Twilio for Fax kind of service? - <AUTHOR>

We are building a service that relies on some fax processing and wanted to know if there is a Twilio for Fax kind of service <comment><USER2> A quick HN search ([http://www.hnsearch.com/search#request/all&q=fax+api](http://www.hnsearch.com/search#request/all&q=fax+api)) also surfaced Phaxio, RingCentral, and PamFax.

My personal recommendation would be to check out PamFax + Tropo (a competitor to Twilio) which have partnered up. More info at <http://www.pamfax.biz/en/partners/tropo/> and <http://blog.tropo.com/2011/02/21/send-a-fax-with-your-voice/>

</comment><comment><USER3> What about hellofax : <http://www.hellofax.com> ? It's a YC company (W11)</comment>