Nokia N1 Android tablet released - <AUTHOR> http://n1.nokia.com/

<comment><USER2> Seems to be two submission of the same url:

[https://news.ycombinator.com/item?id=8623131](https://news.ycombinator.com/item?id=8623131)

Didn't think that was possible.

<comment><USER3> the current one has a "/" at the end. So they aren't the same url. (I checked using FF inspector, otherwise hard to notice)

</comment></comment><comment><USER4> Maybe people in more fortunate locales are seeing something different, but based on this page I wouldn't say that the table has been "released". This is just a "coming sometime" site, and I can enter my email at the bottom to be the "first" to know about something. (I assume that emails entered here are sold to spammers. If I actually did find out about availability, say 24 hrs in advance, this might be worth it, but is there any indication that will be the case?)

</comment><comment><USER5> And with the USB3 Type C connector. AFAIK it's the first major device maker to make the move.

<comment><USER6> USB 2.0 TypeC

</comment></comment><comment><USER7> It's nice to see tech specs mention the audio chipset and codec package. In this case the Wolfson WM8958E.

I've tended to avoid audio on phones and tablets, preferring dedicated devices with better chipsets. I'd love to see mobile devices start competing on audio quality (as opposed to loudness of crappy speakers).

</comment><comment><USER8> Atom CPU. Is this the first mainstream Android Intel device to ship?

Does anyone know if it comes with the Play store?

<comment><USER9> There are literally millions of Atom Android tablets out there already, including all the last generation of Galaxy Tabs from Samsung.

</comment></comment><comment><USER10> I really appreciate this design's Finnish

</comment><comment><USER11> Nice Drupal site.</comment>


Anyone else having issues with TravisCI? - <AUTHOR> I have found it to be increasingly unstable recently:
* Network timeouts(few instances just this year apparently)
* Jobs failing at random points for no describable reason(the logs just end and the job is marked failed)
* Jobs taking a long time to start even though the status page shows no pending jobs and low capacity usage
* Partial and slow loading logs
* Randomly VERY slow job execution(VM contention?!)
On top of this the evolution of the platform is incredibly slow(no docker-in-docker, no artifacts, no test result viz/tracking, no build chains, etc, etc), so I'm looking at alternatives. CircleCI looks very promising and much more professionally run. Supposedly it has much better performance as well. Although nobody seems to have build chains which is hugely disappointing coming from something like Jenkins, Bamboo, or TeamCity.
I'd love to hear thoughts on the TravisCI situation and alternatives people recommend. <comment><USER2> We use Circle CI and usually happy with them</comment>


LSD 'microdosing' is trending in Silicon Valley - <AUTHOR> https://theconversation.com/lsd-microdosing-is-trending-in-silicon-valley-but-can-it-actually-make-you-more-creative-72747 <comment><USER2> I would strongly encourage anyone looking for new perceptions that aid in concentration and/or creativity to first really try, and properly try, and without giving up too soon, the art of meditation.

It's cheaper, safer, longer-lasting, and most certainly a higher-quality experience once properly learned.

<comment><USER3> What would you recommend, how could one start meditating? Is there a practice, or book or something you would specifically recommend? And what time interval would be not "too soon" in your opinion?

<comment><USER4> I am a huge supporter of Headspace (the app), and 4 other people in my life stuck with it after passing through many other options.

Headspace offers a broad library of targeted programs, and I can pick a topic that causes the most friction right now - be it anxiety, productivity, relationships, health, etc. Each program has a supporting structure and provides continuity for my daily practice. I feel like I'm taking new baby steps every day, and that sense of progress is motivating for me. I decide on my time commitment (for me it's 10 minutes), and just put in headphones and sit down. I have my phone and headphones nearly all the time, so I've done this on the train, in the park during lunch, on a side street bench, in a taxi, etc.

In the year I've been using it, I have never finished a 10-minute session without feeling significantly lighter and more composed when I got up. I _still_ don't do it daily (humans, hey), but for me it was the only thing that stuck. Give it couple weeks.

<comment><USER5> I've done the first free 10 days and was surprised by the results from something so simple.

</comment></comment></comment></comment><comment><USER6> Ah yes... you see it anywhere that people are closely matched and seek perceived "edges". Athletes wear their copper bullshit, Valley types take stimulants and psychedelics. It's a symptom of people not understanding the nature of survivorship bias, hindsight fallacy in general, and an inability to delay gratification for a greater reward.

There's nothing inherently wrong with the drug, but there's something inherently wrong with the behavior around it, by people who are so desperate for edge. Down that road ultimately lies Lance Armstrong, and East German women with beards.

<comment><USER7> The comparison of copper bracelets to LSD is pretty weak in that if you take LSD, something WILL HAPPEN

<comment><USER6> You can take a sugar pill and something will happen... we're talking about a microdose after all, not a full hit.

<comment><USER8> Go take a sugar pill and 50ug of LSD and tell me which one is a placebo.

</comment></comment></comment></comment><comment><USER9> It's hard for me to imagine getting any meaningful programming work done on even a low dose of acid.

One look at my computer and I go "I sure waste a lot of my life on this thing. I'm going to go outside."

<comment><USER7> That's what psilocybin would do, maybe not lsd. Shrooms will send you to the woods though for sure

</comment></comment><comment><USER10> I interpret this as Silicon valley losing its way. I'm not judging LSD use, but if you need it to get through the day then you need to find a different career. If you need your high paying, high stress job to afford your lifestyle, you need to find a more economically friendly environment.

<comment><USER11> You may be right. But I see it from a different angle. I don't see this as using drugs to get through the day. I see it as trying to get something for nothing. It feels like a very Silicon Valley attitude to want to discover a free lunch; some sort of bonus optimization.

I would probably most expect this to come from Silicon Valley, Wall Street, professional sports, etc. Anywhere that fosters an attitude of seeking significant optimization or getting something for nothing.

Though this is all just personal perception. It's certainly filled with bias.

<comment><USER12> It's not trying to get "something for nothing", it's trying to tune your brain/body to the workload you actually perform by altering the way signals propagate.

Tuning low-level settings to optimize the stack for the workload expected is standard engineering practice. Heck, we even do it in hardware: deciding if we want higher single-thread performance or higher throughput for a given heat envelope.

<comment><USER13> It sounds you practice micro dosing? You speak nearly in a vernacular about it

</comment></comment></comment></comment><comment><USER14> Careful not to over-micro-dose, then it's just a really weird day at work. Heard from a friend.

<comment><USER15> Or a really fun day at work!

<comment><USER16> Possibly a really fun _last_ day at work

</comment></comment></comment><comment><USER17> Makes sense in theory and to be honest is intriguing.

Provided the quality and dosage was strictly controlled and adjusted to fit the user. Discipline also needed to avoid too much too often. Doesn't help that it's illegal.

You wouldn't want to be doing it to fix a "normal problem" that could be addressed by eating nutritious food and getting more sleep for example.

Psychedelics aren't suited to capitalist agendas either. The idea is to use psychedelics away from the office for perspective and focus shift. I suppose that's normal dosages though, and the idea here is micro-dosages which would be more like a good strong coffee but a clearer more mental buzz.

An extra hit above the micro-dose might make you shut down your PC and head to the park for the rest of the day. Risk.

Let's face it, we're not all building things that are making the world a better place. Psychedelics tend to expose anything trivial that's masquerading as important. Your ability to discriminate genuine from fake is sharper. At normal dosages at least, you feel attracted to these insights and will follow them out the door if that's where they lead.

</comment><comment><USER18> gwern has a great write-up on this: [https://www.gwern.net/LSD%20microdosing](https://www.gwern.net/LSD%20microdosing)

<comment><USER19> Where he reports a null result. It's wasting your money, take a full dose or not at all.

<comment><USER20> It's a sample size of one, even a well designed test is basically meaningless. Plus, from my research on the subject, a full dose can have positive effects for months after the experience. Taking a full dose around a week before the experiment may have tainted the data.

<comment><USER19> It's a sample size of one, but considering the rigorous methodology used I think it counts for at least as much evidence as the anecdotes of people going "it totally boosts my creativity man" with no control group and subjective measurements of efficacy that are highly vulnerable to a placebo effect.

</comment></comment></comment></comment><comment><USER21> I feel like I have the obligation to say that if you are a generally a happy person and good at what you do I highly doubt taking LSD in any dose is worth the risk of a bad trip. Not sure why HN has an affinity for LSD? It's pretty psychologically dangerous imho.

<comment><USER22> _Not sure why HN has an affinity for LSD?_

Please don't make generalizations about the entirety of HN. You're a member of the HN community as well: do you have an affinity for LSD? If you have some stats backing this up, I think a lot of people would find it interesting: at least I would.

<comment><USER23> I think it's clear that lcw was making an observation about the tone of HN comments on the topic. I found it to be a reasonable one that matches my perception.

Disputing his comment makes sense if you think he's wrong, but it seems unreasonable to require people to back up such commentary with "stats".

<comment><USER22> There's a tendency in discourse to make generalizations across large groups of people, which degrades our ability to see the nuance and diversity of opinion and perspective that clearly exists. This gets particularly pernicious when discussing contentious topics. Given the how damaging this can be (current political discourse in the US or here on HN is a good example), making such generalizations really needs to be justified.

In 'lcw's comment, the generalization doesn't add anything substantive to the comment. Indeed, one could read it as disparaging to the HN community because it's too naïve to understand the risks of LSD, rather than granting the members the benefit of the doubt that they're capable of making reasonable decisions. And that's ultimately the point: by making generalizations like this, it doesn't add anything substantive or constructive to the comment and ignores the wide range of opinions across the HN community.

Edit to add: As an aside, you mention that 'lcw's observation matches your perception. It's well known that our perceptions are often wrong, or at least skewed. That's why backing them up with data is important, to make sure our perceptions are consistent with reality.

<comment><USER23> Healthy discourse can include both qualitative and quantitative commentary. I think HN readers can generally differentiate between the two. We don't need comment police complaining that some qualitative comments are lacking statistical support.

<comment><USER22> Sure, there can be qualitative and quantitative commentary. I don't agree that generalizations of groups of people are worthwhile qualititive commentary. One final question: is 'lcw's initial comment improved by the inclusion of the statement regarding HN?

<comment><USER24> > is 'lcw's initial comment improved by the inclusion of the statement > regarding HN?

Why does it matter? Is lcw's statement regarding HN improved by the initial statement?

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I think microdosing LSD for the purpose of increased work performance is absolutely ridiculous. I have absolutely nothing against performance enhancing drugs in the workplace or other areas so long as the drugs themselves can be taken safely, but I think the use of LSD and psychedelics in general for this purpose is misguided for several reasons.

I think self-reported gains in creativity are meaningless in defending LSD microdosing. Psychedelics are not magic creativity chemicals and their use does not inherently make anyone more creative. How are we defining creative? What does that even mean? Is the code I wrote on LSD really that much better than the code I wrote sober or on a different drug or combination of drugs altogether? What about strategic business decisions, design work, or documentation? How does one accurately measure 'creativity'\- is that even a desired trait while working for most people?

I also don't see why it's necessary to use hallucinogens during the work day. Why can't you just drop acid on the weekend or vacation when you actually have the time to enjoy the experience (as heavily as you'd like) in whatever setting you feel most comfortable in? If you really are invested enough in your career to do psychedelics for the sole purpose of workplace creativity, can't you just do your creative thinking then? I think this approach to applying hallucinogens to your work would be as effective as microdosing, if not more so.

My biggest criticism is this though: isn't the whole point of psychedelics the expansion of consciousness and wisdom beyond its current state? The psychedelic community is generally a fairly anti-authoritarian one and I tend to think that it's not just because the state often treats the use of hallucinogens with the same level of violence as far more socially dangerous behavior. Using psychedelics for as shallow of a reason as coming up with ways to better optimize your stupid advertisement platform to sell foot cream to seniors is a tragedy. Besides, there already exist drugs for this purpose (coffee).

And these points ignore the main risks which are obviously being caught and having an adverse health effect.

I think this is a stupid trend highly indicative of just how boring and uncreative the tech industry is. At the end of the day, some of us use drugs to get through the work day. If you want to use psychedelics to do so, that's your business, I don't know how you function, but I doubt you're drastically outperforming the coffee guy or the straight edge guy at the office.

<comment><USER26> There have been some studies on the effect of psychedelics on creativity. A particularly relevant study by Oscar Janiger has been documented in _LSD, Spirituality, and the Creative Process_.[1] Other studies (including ones on microdosing) are discussed in _The Psychedelic Explorer 's Guide_ by James Fadiman.[2]

That said, this is a wide open field that could greatly benefit from more research. I am hopeful that such research will once again become acceptable to the scientific establishment before too long, as a number of studies on other effects of psychedelics have recently been completed with much success.

[1] - [https://www.amazon.com/LSD-Spirituality-Creative-Process- Gro...](https://www.amazon.com/LSD-Spirituality-Creative-Process- Groundbreaking/dp/0892819731/)

[2] - [https://www.amazon.com/Psychedelic-Explorers-Guide- Therapeut...](https://www.amazon.com/Psychedelic-Explorers-Guide-Therapeutic- Journeys/dp/1594774021/)

</comment></comment><comment><USER26> What I wonder is whether the stuff on the street is really LSD. There's a lot of counterfeit material floating around, and (as far as I know) no testing kits that can detect the real thing. I'd be very wary -- especially at larger doses.

<comment><USER27> LSD is usually LSD because it is way more potent per unit volume than any other recreational drug. It's also cheap per dose. In terms of not knowing what you are getting it's much more common to find stuff like 'mdma' actually containing LSD. It's true it can be hard to know the dose. I'd also be very wary more because LSD can cause harm than it possibly being something else.

As an aside here's a dosage guide: [https://www.reddit.com/r/LSD/comments/2hg6io/different_dosag...](https://www.reddit.com/r/LSD/comments/2hg6io/different_dosage_of_lsd_explained_from_20ug1500ug/)

<comment><USER26> _" LSD is usually LSD because it is way more potent per unit volume than any other recreational drug."_

This used to be true, but is very unfortunately not true any more. Newer synthetic drugs, like bromo-dragonfly, are approaching LSD in potency[1] making them essentially indistinguishable from LSD in practice, and resulting in actual fatalities.[2][3]

[1] - [https://en.wikipedia.org/wiki/Bromo- DragonFLY#Dosage](https://en.wikipedia.org/wiki/Bromo-DragonFLY#Dosage)

[2] - [https://en.wikipedia.org/wiki/Bromo- DragonFLY#Toxicity](https://en.wikipedia.org/wiki/Bromo-DragonFLY#Toxicity)

[3] - [https://erowid.org/chemicals/bromo_dragonfly/bromo_dragonfly...](https://erowid.org/chemicals/bromo_dragonfly/bromo_dragonfly_death.shtml)

</comment></comment></comment><comment><USER28> I don't know about microdosing, but 300ug kept me 40+ hours awake and caused anxiety/insomnia for 6 months afterwards. So be careful.

</comment><comment><USER29> I'll stick to meditation, yoga, and the occasional premium IPA. I do understand the compelling nature of chemical enhancement - especially for creative endevours. David Bowie cranked out amazing albums year-after-year while high on coke. But like usual, it became a problem he had to address.

<comment><USER30> Heavy stimulants are like running your car with NoS all the time. You'll get amazing performance until your engine fires a rod through your hood. Bowie had a near psychotic break.

Much lighter use however may be more sustainable. There is no law that says the human brain can't be tuned a little for different modes, and I have no problem with people doing that. There may still be tradeoffs though, so anyone doing this should try to be self aware and observe the effects carefully.

</comment></comment><comment><USER31> Hmm, i thought your body builds tolerance to LSD very quickly. I've seen people at music festivals take twice as much the next day to get the same effect.

<comment><USER32> It does. You're supposed to microdose every 4 days to avoid tolerance buildup.

</comment></comment><comment><USER33> But why?

</comment><comment><USER34> How about not? Drugs still have incredibly harmful effects. Some people take trips and never come back off these drugs. Imagine going to work in the morning on a supposed "micro"dose just to realize you had an overdose and end up in a psych ward for two weeks. You'll also likely lose your job as most tech companies have no drug in the workplace policies...

This is just another BS article from someone who knows nothing about how drugs can very dramatically Fuck up a person's life.

(How do I know? I've worked with many recovering drug addicts in the past who all wish they had never started in the first place)

<comment><USER35> Imagine not being totally clueless, dosing appropriately, and having a relatively normal (perhaps a bit more open-minded) day at work. Not all drugs are created equal, and almost all of them can be used responsibly.

I find the micro dosing trend distasteful, but I hate anti-drug propaganda even more. This is just another BS comment from someone who has never done drugs and looks to force their misinformed values and opinions onto others.

<comment><USER16> Drug abuse is a real thing and has extremely negative effects for individuals and those in their lives.

That being said, it's a public health issue, not a criminal one. Abuse can also be significantly curbed by open and honest discussion about the benefits and negatives of various drugs. The DARE and scare model is an abject failure.

<comment><USER35> Absolutely. I have no interest in partisan arguments on the issue, that's all.

edit: fwiw imperio59 has a post history repeatedly denigrating LSD, psychology as a valid scientific practice, in addition to advocating for and linking to Drug Free World, a Scientology-backed nonprofit. Not even worth replying to.

<comment><USER22> Your comment regarding another member would have a lot more weight coming from an account with some history. It's bad form regardless to make comments like this, but you're also using their comment history in doing so, yet denying others from knowing your own.</comment></comment></comment></comment></comment>


HoloLens 2 Remote Collaboration is fake? - <AUTHOR> Facebook, Twitter and other media are still rumbling on the news from MWC-19 and Microsoft release of its HoloLens 2 with "Spatial" remote collaboration demo.
The project was presented by Spatial team and CTO of Mattel (iconic toy producer). The crowd is super-excited about the demo, however we'd love to give some thought on what Microsoft's recent release really stands for:
1) Turning 2D images into full 3D avatars in few seconds sounds quite challenging. I mean, there're awesome guys like Wolf3D, but it still doesn't work just like that even for them. Have a look at Jinha Lee (00:21 on the video)  standing with his back turned to the crowd, this is simply impossible to create out of 2D photos – not online or within seconds - ever!
2) Moving on to magical search engine (from 02:10)  with predefined 3D objects: there is a 3D model with animation for every search. Looks more like a fantasy to me.
3) There is plenty of black color in the video, while HoloLens holograms are created by adding light to real life light. This means that white appears bright and black renders transparent. To put it simple you cannot see black color in Hololens.
Bottom line, we believe the whole thing was a replay with pre-recorded user actions(best case scenario) or a video. What really confuses is why the presented case was this basic. At some point the Mattel CTO states that the remote collaboration gives a faster way to the market + reduces time for travel. This is so true, BUT:  in the remote collaboration demo we've spotted just the collaboration part. <comment><USER2> 1, there are demos of avatars created in real time for VR and AR, even back in the days where all we had was Kinect. all in real time. the avatars show in that presentation were pretty crappy compared to the ones demoed in more recent VR devices that track eyes and lips.

2\. its a demo, that was most likely staged so that 3d models would appear, they may be searching inside their own DAM/MAN system that already has the assets.

3\. black colors can be reproduced in transparent screens. magic leap does it why not the hololense?

<comment><AUTHOR> 1\. Not a good example. Kinect has a depth sensor - this guys claim to do it from a 2D photo.

2\. OK, then what the point of showing it if it is prerecorded? that does not show any real value to users. Basically nothing different from a video.

3\. Its impossible to disguise real light the way you say it. This is fundamental technical limit. I am not sure how magic leap is doing it if doing at all.

</comment></comment><comment><AUTHOR> [https://m.youtube.com/watch?v=3UTYxaXtc0s&t=35s](https://m.youtube.com/watch?v=3UTYxaXtc0s&t=35s)</comment>


Alfred Anaya Put Secret Compartments in Cars. So the DEA Put Him in Prison - <AUTHOR> https://www.wired.com/2013/03/alfred-anaya/ <comment><USER2> The title is intentionally misleading.

Alfred Anaya was a willingly complicit part of a drug trafficking operation in return for large financial gain, so he was put in prison.

This is also from 2013.</comment>


CDNs, HTTP/2, TLS, Browser Caching: A Survey of Web Performance Techniques - <AUTHOR> https://medium.com/baqend-blog/hosting-lessons-learned-6010992eb257 <comment><USER2> I've noticed these guys "Baqend" have an impressive content marketing campaign going on right now. It's a pity they are so expensive.</comment>


Common origin of Fermi bubbles and galactic center X-ray outflows shown - <AUTHOR> https://phys.org/news/2020-05-reveal-common-fermi-galactic-center.html <comment><USER2> [http://sci-hub.tw/10.3847/1538-4357/ab8bd0](http://sci- hub.tw/10.3847/1538-4357/ab8bd0)

The "very hot gas" in the introduction means plasma. There is a peculiar guild restriction on use of the word "plasma" in astrophysical publications, particularly in introductions and abstracts (with admirable exceptions for solar physics).

X-rays are always interpreted as blackbody radiation from "very hot gas" (interpreted as being into the millions of degrees) and not from, e.g., sychrotron radiation from electrons accelerated in a plausibly much cooler plasma. While the only things not plasma that astronomers can see are planets, none of it may be interpreted as _doing_ anything, except purely gravitationally.

Much of this must originate from limited education on plasma fluid phenomena among astronomers, but that needs its own explanation. Prominent mention of plasma-fluid dynamic phenomena is a career-limiting move. Magnetic fields and their effects may be mentioned, but only where they can be assigned to a gravitationally condensed body such as a star, neutron star, or black hole accretion disc. Current sheets must be interpreted as "shocks" (which also exist).

I _guess_ that this avoidance arises from the utter mathematical intractability of plasma fluid dynamics (itself routinely confused with the overwhelmingly simpler magnetohydrodynamics), which make it hard to elaborate the consequences of a hypothesis. Perhaps a solar physicist can explain further? I am genuinely curious.</comment>


ESP8266: A $5 microcontroller with wi-fi that runs Python - <AUTHOR> http://makezine.com/2015/04/01/esp8266-5-microcontroller-wi-fi-now-arduino-compatible/ <comment><USER2> A related crowdfunding project to facilitate MicroPython with this chip has already passed funding goals: [https://www.kickstarter.com/projects/214379695/micropython-o...](https://www.kickstarter.com/projects/214379695/micropython- on-the-esp8266-beautifully-easy-iot/posts/1485145)

The new ESP8266 source code will be made available on GitHub right after the crowdfunding campaign closes..

</comment><comment><USER3> The ESP also runs Lua (by way of NodeMCU), JavaScript (Smart.js, Espruino and JerryScript), Lisp ([https://github.com/yesco/esp- lisp](https://github.com/yesco/esp-lisp)) and even a form of BASIC ([http://www.esp8266basic.com/language- reference.html](http://www.esp8266basic.com/language-reference.html)). I'm sure more are out there - seems like something new pops up every few days.

<comment><USER4> Yup, NodeMCU is really easy. I used it to make a Philipps Hue clone. [https://github.com/christophesmet/ledsgetIton](https://github.com/christophesmet/ledsgetIton)

It's surprisingly easy connect to a WiFi and get a TCP server running

<comment><USER5> FWIW - There was a related project front page a few weeks back talking about this: [https://news.ycombinator.com/item?id=10899798](https://news.ycombinator.com/item?id=10899798)

</comment></comment></comment><comment><USER6> By the way, I have to warn people who are thinking about trying this chip (as I have done in other comments):

The bare chip won't be very useful to you, unless you want to design your own PCB. Instead, I would recommend a breakout board. There are two major types:

Something like the WeMos D1 Mini ([http://www.aliexpress.com/item/D1-mini- Mini-NodeMcu-4M-bytes...](http://www.aliexpress.com/item/D1-mini-Mini- NodeMcu-4M-bytes-Lua-WIFI-Internet-of-Things-development-board-based- ESP8266/32529101036.html)) or NodeMCU ([http://www.ebay.com/itm/NodeMCU-LUA- WIFI-Internet-Developmen...](http://www.ebay.com/itm/NodeMCU-LUA-WIFI- Internet-Development-Board-Based-on-ESP8266-/291505733201)), which are very full-featured and include onboard USB programmers and fancy things like that, but are a bit bulky. The NodeMCU I linked is solid, the WeMos is also great as it's much smaller and only includes the useful pins.

The alternative is a bare breakout board, which is the minimum that you need to make the ESP breadboard-friendly and so you don't have to solder a bunch of resistors on the chip. This is best when you want to work at a lower level, and have the minimum hardware required for the ESP to work on the board, with everything else going in your circuit.

There are breakout boards on ebay like this one ([http://www.ebay.com/itm/1Set-ESP8266-WiFi-Module-Breakout- Bo...](http://www.ebay.com/itm/1Set-ESP8266-WiFi-Module-Breakout-Board- Adapter-Plate-for-ESP-07-ESP-08-ESP-12-/181784198861)). STAY AWAY FROM THESE. They don't include all the necessary components, so the ESP won't work reliably without extra pullups, and they take up the entire breadboard space.

Because I was burnt by these, I designed my own and made it open-source:

[https://github.com/skorokithakis/tiny- ESP8266-breakout](https://github.com/skorokithakis/tiny-ESP8266-breakout)

It's easier to work with, leaves room on the breadboard and includes all necessary resistors/caps and an optional voltage regulator. It's also very small. There's a dirtypcbs link on the github repo so you can just order 40 of these for $14 if you like, or you can just download the KiCad schematics (KiCad is awesome and open-source) and get it fabricated at your favorite PCB house.

Back to our regularly scheduled programming. Feel free to copy/paste this comment whenever there's an ESP discussion, I think it's a good primer for people who don't have ESP experience.

<comment><USER7> How can you forget something like the Adafruit Huzzah[1]? It is so nice with the ESP8266. We use it in home-assistant ([http://home- assistant.io](http://home-assistant.io)) for things like this temperature sensor[2].

        [1] https://www.adafruit.com/products/2471
        [2] https://home-assistant.io/blog/2015/10/11/measure-temperature-with-esp8266-and-report-to-mqtt/

<comment><USER6> I forgot it because I don't have one :-P I think the wemos is better, to be honest. About the same size, half price and includes an FTDI chip just in case.

</comment></comment></comment><comment><USER8> I've personally built hardware[1] and software[2] around the ESP8266 and it is a wonderful little chip. The low price point ($2 including shipping from China) and the very active community around it really makes it stand out.

[1] [http://memcpy.io/esp8266-apa102-bulb.html](http://memcpy.io/esp8266-apa102-bulb.html)

[2] [http://memcpy.io/user-friendly-setup-of- esp8266-gadgets.html](http://memcpy.io/user-friendly-setup-of- esp8266-gadgets.html)

</comment><comment><USER9> I have actually done a fair bit of dev work on this chip (a custom C++ IDE), it is a neat little device, with the emphasis on little. That is both a plus and a minus. Plus, it is cheap, minus, it is little, not a lot of processing power there. (forget Python if you are doing anything serious).

The way I worked around it is put all the processing in the cloud and basically the vpn passes straight through it. Interestingly, it actually is being used in a number of consumer products, but for very basic iot apps (I believe there is a wifi enable light socket and an automobile ODB link device things like that).

Fun device to mess with :)

<comment><USER10> Have you even tried MicroPython on it? Granted, you need to consider performance -- where you need it, and where you don't. But is is quite easy in MicroPython to create a C-extension module for performance critical components, and have the luxury of a Python REPL loop for debugging high-level logic.

<comment><USER9> Interesting idea. The client wanted C, but that could make dev work easier perhaps.

<comment><USER11> Great, but don't say "forget Python if you are doing anything serious", unless you just read the title and not the article. The article pretty clearly talks about MicroPython.

</comment></comment></comment></comment><comment><USER12> You can even broadcast analog NTSC with it.

[http://www.rtl-sdr.com/broadcasting-color-analgoue-ntsc- tv-w...](http://www.rtl-sdr.com/broadcasting-color-analgoue-ntsc-tv-with-an- esp8266/)

</comment><comment><USER13> FYI ESP8266 doesn't run Python, but it runs MicroPython: [https://github.com/micropython/micropython](https://github.com/micropython/micropython)

<comment><USER10> I have some experience using MicroPython on the PyBoard (not the ESP8266). MicroPython is a very nice implementation of Python 3.X. A few differences because of the need to be _extremely_ parsimonious with RAM usage -- mostly only noticed if trying to inherit from built-in types. Nothing that is onerous to avoid. MicroPython is an outstandingly good project IMHO, with a great community.

<comment><USER14> Damien George, the creator of MicroPython, is an extraordinarily talented individual. He's also extraordinarily generous having volunteered a substantial block of time and effort to get MicroPython running on the upcoming BBC micro:bit (a million of which will be delivered to the UK's 11 & 12 year olds).

</comment></comment></comment><comment><USER15> There is an excellent project named PlatformIO to program this and other chips: [http://platformio.org/](http://platformio.org/)

A ton of work went into it and setting up the toolchain is as simple as `pip install -U platformio`.

<comment><USER6> I consider PlatformIO a must have at this point. It's made code deployment so much more easier and scriptable, I love it.

</comment></comment><comment><USER16> Now all we need is for AWS IoT to support TLS 1.1 with symmetric keys. Currently the ESP8266 arduino libraries only support TLS 1.1 which is not compatible with the TLS 1.2 minimum for AWS IoT. I am super excited for this board and would love to be able to kick of lambda functions automatically in response to device events. If anyone from the IoT team comes across this please make this a priority, all of us makers will thank you.

<comment><USER17> > Now all we need is for AWS IoT to support TLS 1.1 with symmetric keys.

Making the ESP8266 libraries support TLS 1.2 is a better idea

<comment><USER18> Discussion here: [https://github.com/esp8266/Arduino/issues/43](https://github.com/esp8266/Arduino/issues/43)

</comment></comment></comment><comment><USER19> While this is a very cool chip for hobbyists, it is quite hard to do real TLS with this chip making it basically useless for commercial applications.

It CAN do TLS but it leaves very little left over if you have any kind of real business logic.

<comment><USER20> TLS is one of the reasons I'm really hopeful for the ESP32 that's supposed to have a good bit of hardware help for doing TLS and such. [http://esp32.net/](http://esp32.net/)

</comment></comment><comment><USER5> I feel like the title is a misnomer given the article is called "ESP8266: This $5 Microcontroller with Wi-Fi is now Arduino-Compatible," and on that front it's really easy to get started with these [0]! ESP8266 boards abound on AliExpress, the easiest of which to get started with are NodeMCU variants. One example with seemingly good documentation is the Wemos D1 Mini [1] that comes with a USB-to-serial chip onboard. Here's another decent reference I found to getting started with them [2].

[0] GitHub repo for plugging into the Arduino IDE: [https://github.com/esp8266/Arduino](https://github.com/esp8266/Arduino)

[1] [http://www.wemos.cc/wiki/doku.php?id=en:d1_mini](http://www.wemos.cc/wiki/doku.php?id=en:d1_mini)

[2] [http://www.averagemanvsraspberrypi.com/2015/11/esp8266-node-...](http://www.averagemanvsraspberrypi.com/2015/11/esp8266-node- mcu-setup.html)

</comment><comment><USER21> If you're looking for great projects with the ESP8266 have a look at [https://aisler.net/search?query=ESP8266](https://aisler.net/search?query=ESP8266)

</comment><comment><USER22> Somewhat remotely related, I've been playing with this tiny wifi router on a usb stick for a week now with OpenWRT and it is amazing for $10

[https://wiki.hackerspace.pl/projects:zsun-wifi-card- reader](https://wiki.hackerspace.pl/projects:zsun-wifi-card-reader)

The future is filled with tiny wifi devices!

<comment><USER23> I ordered a couple of these as well but GearBest is taking their sweet time shipping...

<comment><USER22> It's that Chinese spring holiday I think?

Though mine seems to have come from Singapore.

Once you get a tracking number you can enter it into this box and see the progress until it gets on a cargo ship:

[http://22.214.171.124:8032/xflquery.aspx](http://22.214.171.124:8032/xflquery.aspx) (use chrome translate)

The number they give you will also work in DHL tracking system.

Mine took 48 hours to ship and then 17-18 days to get here.

The tracking stops once it hits the ocean though, blind from there.

<comment><USER23> Thanks for the reply. After a month I ended up canceling my order. I'll just pay a bit extra from Amazon.

</comment></comment></comment></comment><comment><USER24> I advice checking out this tutorial [http://www.whatimade.today/esp8266-easiest-way-to-program- so...](http://www.whatimade.today/esp8266-easiest-way-to-program-so-far/) I found it very helpful

</comment><comment><USER25> Neil Kolban has written a nice book on this if you want to do some initial research before taking the plunge on this device.

[https://leanpub.com/ESP8266_ESP32](https://leanpub.com/ESP8266_ESP32)

</comment><comment><USER26> cool chip! I can't find the SRAM size, anybody has an idea?[https://nurdspace.nl/images/e/e0/ESP8266_Specifications_Engl...](https://nurdspace.nl/images/e/e0/ESP8266_Specifications_English.pdf)

EDIT: 2015 article, maybe put that in the title?

<comment><USER27> 64 KiB of instruction RAM, 96 KiB of data RAM [https://en.wikipedia.org/wiki/ESP8266](https://en.wikipedia.org/wiki/ESP8266)

For whatever reason the Make dead-tree-edition of the original article posted has a "Table of Boards" in it and they list the ESP8266 as having 1MB of "Memory".

It's also a new article. It's recently run in the February/March 2016 edition of Make: Super (Cheap) Computers.

Edit: While the OPs link is not the new article, it is in the current edition of Make. I was /confused as I had picked it up in the airport and was looking into the ESP8266 referenced in it.

<comment><USER20> The 1MB is likely referring to the SPI flash device that the ESP-01 modules use. Many of the other boards feature larger SPI flash chips up to 4MB, and I believe it's possible in theory to boot of an SD card with them too if you remove the flash chip.

<comment><USER27> Thanks for the clarification!

</comment></comment></comment></comment><comment><USER28> Esp8266 also runs Lua, which provides first-class co-operative co-routines and is a really nice way to do cooperative multi-tasking.

I've been playing with a Esp8266 NodeMCU configuration where one co-rountine monitors and maintains the wired-access connection, another CR blinks the activity led on a timer, and another presents a telnet-like command interface listening on a tcp/ip socket.

The entire OS layer has been avoided, yet there is almost no loss of functionality.

</comment><comment><USER29> I'm working on an ESP8266-to-Arduino bridge much like the GrovePi project. If you're interested in driving 5V sensors or actuators, or getting more digital or analog pins, it will be useful: [http://www.esproto.com/2016/02/20/esproto- iot-coming-soon/](http://www.esproto.com/2016/02/20/esproto-iot-coming-soon/)

</comment><comment><USER30> There was a good talk about these at LinuxConf AU: [http://mirror.linux.org.au/linux.conf.au/2016/05_Friday/Wool...](http://mirror.linux.org.au/linux.conf.au/2016/05_Friday/Wool_Museum/Free_as_in_cheap_gadgets_the_ESP8266.webm)

... they're a very exciting device and incredibly cheap, and the supplied SDK libs look very nice, even though they aren't quite fully open source.

The NodeMCU boards are very useful even if you're not interested in Lua, they add power, USB and breadboard friendly headers in a smallish package.

I've started messing around with different ways to program them for educational purposes: [http://nick.zoic.org/etc/flobot-graphical-dataflow- language-...](http://nick.zoic.org/etc/flobot-graphical-dataflow-language-for- robots/)

</comment><comment><USER31> "with Wi-Fi"-onna-chip always has me wonder: can it handle wireless security (WEP, WPA, WPA2, ..)? because having to dedicate an open access point is often prohibitive.

<comment><USER15> Yes it can do these

<comment><USER32> Do you know if it can do promiscuous mode?

<comment><USER33> In theory it can, though you might need to downgrade to an older SDK version.

</comment></comment></comment></comment><comment><USER34> Question to those who know the landscape of little microcontrollers well: if I wanted to build a small pet tracking chip (gps and cell, probably) that would work way out in the boonies (like middle-of-nowhere-Wyoming), where should I look? Am I right to be thinking gps+cell, or is this something where I could get away with just GPS (and somehow track where that GPS is pinging from)?

And would something like a tumble generator provide enough power?

<comment><USER35> I think there are dog trackers on the market that use GPS + Cell. At least there are motorcycle trackers.

Generally the problem with WiFi is if it's close enough to work the dog can usually hear you. You could use a directional antenna but an extra 10db isn't going to buy you much. And at 2.4GHZ WiFi gets attenuated rapidly when not line of sight. Same is true for anything else in the 900MHz/ 2.4GHZ bands. Cellular gets around this by putting their antennas up high to clear local clutter (buildings, trees, hills, etc).

Problem with Cellular is the power drain and the monthly bill. On the other hand, probably will work. Cellular coverage is pretty good everywhere now. If you want to mess about I think there are modules with Cellular and GPS.

You also might be able to use a 900MHz solution[1] where you just send a ping of the GPS coordinates every so often. If you up the power to the max allowed (Like 20-30db) and drop the data rate down to a few hundred/thousand bits per second. You could probably go two to three miles. I think your current choices here are some sort of FSK radio or the newer LoRa radio. The reason is FSK radios and LoRa both allow you to turn the bandwidth way way down. The lower the bandwidth the better the signal to noise for the same transmit power.

[1] The lower the transmit frequency better it will propagate through clutter on the ground. But lower frequency means a bigger antenna.

PS: If you're messing with RF using module or manufactures dev board is the way to go. It's very hard to tune the RF path and antenna without experience and a spectrum analyzer.

PSS: I've found the transceivers from SemTech to be pretty bulletproof. They have their own power regulators on board which makes them insensitive to being powered by crappy supplies.

</comment></comment><comment><USER36> also note that an upgraded part, the ESP32 is in the works from the same manufacturer.

[http://makezine.com/2015/12/09/meet-esp32-new-big-brother- to...](http://makezine.com/2015/12/09/meet-esp32-new-big-brother-to-iot-board- esp8266/)

</comment><comment><USER37> Is it possible to do real time programming in a garbage collected language?

<comment><USER38> Sure. What latency do you need?</comment></comment>


Ask HN: Is Perl 5 or Perl 6 still worth learning in 2019? - <AUTHOR> <comment><USER2> Perl knowledge has been extremely valuable for me, but I first learned it when it was still _the_ scripting language of choice for just about everything (web, CLI, one-liners, etc.). Even Perl 5 is multi-paradigm and that's been helpful for me when I find myself parachuting into a new codebase in some language I don't know well. It's been easy for me to pick up Ruby, Python, JavaScript, Tcl, and even Rust, because of my Perl knowledge. I don't know if many other languages are quite as effective at teaching that kind of cross- paradigmatic approach, and Perl 6 should be even more effective, since it integrates even more paradigms.

I still prefer Perl 5 for most CLI scripting tasks, but use Python for a lot of stuff lately because I work with others who know Python and don't know Perl. Perl has better docs than Python (the Python standard docs are almost entirely free of usage examples which is just plain terrible). Perl has better out of the box support for writing good CLI tools. e.g. color and better options parsing are in the standard modules, which require additional modules in Python. I also think Perl has better testing tools included, though this one may be a matter of taste. Perl used to have a better/friendlier community than almost any other language, but that's no longer really the case...it's a lot of old-timers who can be extremely impatient with new learners (there's been discussion of this problem and there is a desire to do better, but it's still a thing).

The biggest OSS project I work on is almost entirely in Perl 5, so I still have reasons to keep using Perl, but I also tinker with Perl 6 now and then for fun...it's a cool language that I always seem to learn something new from. I might even take a stab at re-writing portions of our Perl 5 code in Perl 6 at some point.

</comment><comment><USER3> I would say it's only worth learning Perl 5 if you work in a shop that has a lot of old Perl code, otherwise Python is probably the most sensible option to learn (as much as it pains me to say) if you haven't got a job yet. It will also help you with tools like ansible. Go might also have a future where Perl once thrived since you can compile your dependencies into the program. Dependencies sort of sucks with all scripting languages.

<comment><USER4> Lots of people agree dependency management sucks. So they wrote tools to help - the most useful wrappers being [https://metacpan.org/pod/Carton](https://metacpan.org/pod/Carton) and [https://metacpan.org/pod/App::FatPacker](https://metacpan.org/pod/App::FatPacker).

</comment></comment><comment><USER5> IMHO there are two different things at work here: one is the tool or language that you are using for your job. This is highly specific, and most people will not be working with Perl 5 or 6 in their day job.

However, we all need to learn general software engineering much more as well, and that is a very different piece of problem: here the tools are not specific, you can do that in any language.

More importantly, no single language will allow you to truly understand software engineering, you must look at it from different vantage points, i.e. very different languages and development philosophies. In this area Perl, especially 6, is super interesting because it allows you to study a variety of interesting concepts while still being modern and accessible (compared to the alternatives of learning LISP, Prolog and who knows what). So: studying Perl will help make you a better software engineer, you can then apply that in whatever other language is required on that day for the current job.

That said, I think most systems I have worked on in C++ and Java could have been written in Perl 5 _or_ 6 equally well. Some things would have been easier, some others harder...

<comment><USER6> > More importantly, no single language will allow you to...

That's one of the reasons why P6 is actually a braid of languages, plural, rather than a single language.[1]

> most systems I have worked on ... Some things would have been easier, some > others harder [using a different language]...

That's another reason. The braid (which languages are mixed together), the braiding (how they're braided together), and the strands of the braid (individual languages) in the standard P6 distribution, are all mutable, evolvable, forkable, mergeable, via a principled, governable mechanism.[1]

cf Racket, except that P6 adopts the position that s-expressions aren't a good default syntax for most of the core code; macros aren't a good default approach for building up the majority of higher level constructs; automata other than turing machines need to be taken into account; and it all needs to be suitably version based so that various versions of languages in the braid, and of modules written in those languages, can peacefully co-exist.

[1] [https://www.reddit.com/r/ProgrammingLanguages/comments/a4z68...](https://www.reddit.com/r/ProgrammingLanguages/comments/a4z68q/what_principles_have_you_adopted_for_your/eblgbzn/)

</comment></comment><comment><USER7> Perl 6 is a great language to learn if your goal is to become a more all- around versed programmer. It has constructs from every major family of programming languages and some features that I've never seen in any other language (NFG strings, operator overloading/declaration with precedence, whatever-code (Lisp has a similar construct), slangs, etc.)

But if you want to learn a programming language that you'll use in your day- to-day job, then unless your day-to-day job is fairly unusual, you won't be using Perl 6. It's fairly slow, very light on surrounding modules unless you want to call out to a Perl 5 compatibility layer and in many modern areas none of the Perl variants have a significant footprint (machine learning comes to mind).

Don't get me wrong. I love the language and program in it daily, but not for work. I write Perl 6 code because I enjoy thinking in highly abstract ways using whatever programming paradigm comes to hand. I write JavaScript, Python, Bash and rarely Java for work.

</comment><comment><USER7> I gave a separate answer for Perl 6, but as for Perl 5: Yes, absolutely. I think everyone should know Perl 5 if you ever touch a Linux system. It's installed everywhere and gives you the largest power/keystroke for command- line utility. It's more effective to learn Perl than AWK and Perl has incredibly deep Unicode support and what I call 4th-generation regular expressions (pre-POSIX, POSIX, and then the explosion of early Perl/PCRE/Python-re being the first three and Perl 6's full parser engine being the 5th) which, together, make it like the mythical tool it's often labeled as: the Swiss Army chainsaw.

Don't make the mistake of trying to write anything over a few lines in it, though. You'll find yourself in a deep hole trying to use Moose and "experimental" features just to get back to parity with every other modern language, and you'll still have thin if any support for many modern tools (i.e. those that entirely post-date 2010).

</comment><comment><USER8> Perl 6 is my go to scripting language. The concerns about code styles don't apply at that point because it's all me. And the multi paradigm nature of Perl 6 means I can solve any given algorithm using a style that fits how I'm feeling in that moment.

</comment><comment><USER9> I usually consider languages when I'm also choosing what to use it for. E.g. framework/language, or use-case/language such as Go for a small/low-level service.

Other than that I'll look at curious languages/implementations that are not yet widely known/adopted (e.g. Pony, Crystal, CHICKEN Scheme) for its own sake but not for main usage.

I would be interested in Perl6 if I had a use case for it. I don't write shell scripts that need more than bash and in those cases Python works for me. Anyone know any good Perl6 frameworks/libs (maybe for cli or ncurses)?

<comment><USER6> > I'll look at curious languages/implementations

Evan Miller felt Rakudo/MoarVM fit that niche. [1]

P6 automatically converts an ordinary P6 function call into a documented cli program. [2]

Cro, a distributed system framework, is a P6 showcase. [3]

[1] [https://www.evanmiller.org/why-im-learning- perl-6.html](https://www.evanmiller.org/why-im-learning-perl-6.html)

[2] [https://www.youtube.com/watch?v=D16wa- gnFwE](https://www.youtube.com/watch?v=D16wa-gnFwE)

[3] [https://cro.services/](https://cro.services/)

</comment></comment><comment><USER10> May not help your resume much.

But I would say go for it (Esp. Perl6) just for the fun of it. It is a very modern multi paradigm language which is still accessible to regular folks.

</comment><comment><USER6> Of course. (For some people.)

Here are some videos to give a flavor of the last few years of Perl 6 as it graduated from alpha in 2014 to beta in 2015 to the first ready for production releases of the Rakudo compiler in 2016, to outsiders doing videos about it in 2019 (last video).

* 2014. "There's this question of belief". 30 seconds.

Charming point made by Perl creator Larry Wall (during a long talk).

[https://www.youtube.com/watch?v=enlqVqit62Y&t=37m40s](https://www.youtube.com/watch?v=enlqVqit62Y&t=37m40s)

* 2014. "My first P6 program". 3 minute "lightning talk" presentation to an audience of Perl folk.

P5er Stefan Seifert shows what they learned and pulled off less than 24 hours after first writing P6 code. (This start led to [https://modules.perl6.org/search/?q=inline](https://modules.perl6.org/search/?q=inline))

[https://www.youtube.com/watch?v=m_Y- lvQP6jI](https://www.youtube.com/watch?v=m_Y-lvQP6jI)

* 2015. "P5 Pigs". 6 minute "lightning talk" with audience participation at a Perl conference.

Stephen Scaffidi sings his heart out about tensions in the Perl community about Perl 5 "vs" Perl 6. (In reality it's not "vs". They're different languages in the same family, analogous to the way Clojure and Racket are both in the Lisp family.)

[https://www.youtube.com/watch?v=e5_7v7q98-g&t=48m10s](https://www.youtube.com/watch?v=e5_7v7q98-g&t=48m10s)

* 2015. "Hacking on Rakudo Compiler". 10 minute live coding screencast.

Rob Hoelz looks into 3 bugs.

[https://www.youtube.com/watch?v=adUdmol7cLU](https://www.youtube.com/watch?v=adUdmol7cLU)

* 2016. "Perl 6 for beginners". A conference keynote. An hour, or 15 minutes if you're in a hurry.

Damian Conway is brilliant and hilarious. If you've never seem him, you're in for a treat. I strongly recommend the full hour. You will not be disappointed.

The first link below is for the full hour, the second jumps to the closing 15 minute "crash course on quantum computing".

[https://www.youtube.com/watch?v=Nq2HkAYbG5o&t=5m](https://www.youtube.com/watch?v=Nq2HkAYbG5o&t=5m)

[https://www.youtube.com/watch?v=Nq2HkAYbG5o&t=46m](https://www.youtube.com/watch?v=Nq2HkAYbG5o&t=46m)

* 2017. "How to hack the MoarVM JIT compiler". 47 minutes.

Bart Wiegmans, author of [http://brrt-to-the- future.blogspot.com/](http://brrt-to-the-future.blogspot.com/), introduces tools that enable others to make MoarVM go incrementally ever faster. Probably only of interest to the hardest core hackers.

[https://www.youtube.com/watch?v=N5_drt7TEqE](https://www.youtube.com/watch?v=N5_drt7TEqE)

* 2018. "8 ways to do concurrency and parallelism". Hour+ presentation to P6ers.

Like Damian (previous video) Jonathan is another P6er who is also a great presenter.

[https://www.youtube.com/watch?v=l2fSbOPeSQs](https://www.youtube.com/watch?v=l2fSbOPeSQs)

* 2018. "Perl 6 grammars for simple compilers". 4 minutes 20 seconds live coding screencast.

Andrew Shitov creates a toy language, its formal grammar, a parser, and its interpreter/compiler, from scratch, in less than 5 minutes, with full commentary explaining what he's doing as he does it.

[https://www.youtube.com/watch?v=rxaB6m_sQKk](https://www.youtube.com/watch?v=rxaB6m_sQKk)

* 2019. "Learn Perl 6 In One Video". 80 minute screencast.

An "outsider" covers P6 basics at speed.

[https://www.youtube.com/watch?v=N5_drt7TEqE](https://www.youtube.com/watch?v=N5_drt7TEqE)

<comment><USER6> The last link is wrong. It should be [https://www.youtube.com/watch?v=l0zPwhgWTgM](https://www.youtube.com/watch?v=l0zPwhgWTgM)

</comment></comment><comment><USER11> try and decide</comment>


Netflix 'now primarily a streaming company,' could offer DVD-less plan this year - <AUTHOR> http://i.engadget.com/2010/10/21/netflix-now-primarily-a-streaming-company-could-offer-dvd-les/

<comment><USER2> Here is a really good talk by Adrian Cockcroft[1] from Netflix on this whole project to move to AWS over the last two years. It was given last week at hacker dojo in Mountain View. Video could be better but there is some good stuff in there.

<http://www.ustream.tv/recorded/10209077>

I think he is giving a talk at <http://qconsf.com> that goes more into the nitty gritty of the software side of things Nov 2nd.

[1] <http://qconsf.com/sf2010/speaker/Adrian+Cockcroft>

</comment><comment><AUTHOR> Yet another company moving away from optical media. Thank You. <http://news.ycombinator.com/item?id=1814233>

</comment><comment><USER3> this would be great if the streaming could work internationally (or if they'd develop partners in local countries). iTunes manages so it's not intractable.</comment>


FreeBSD 500% if_bridge Performance Improvement - <AUTHOR> https://www.freebsdfoundation.org/blog/500-if_bridge-performance-improvement/ <comment><USER2> > Through clever use of concurrency, epoch (9) allows the safe use of > protected data structures without acquiring a lock (either a mutex or a > read/write lock) at all.</comment>


Web Revenue Models - <AUTHOR> https://hackpad.com/EgXuEtSibE7#Web-And-Mobile-Revenue-Models-%28final%29 <comment><USER2> There's a best practice acronym for creating lists like this - MECE: mutually exclusive, collectively exhaustive.

I'm not sure this list passes the "mutually exclusive" test - for example, eBay fits into both the "marketplace" and "auction" category. "Freemium SaaS" is clearly a strict subset of "SaaS". Might seem like a minor quibble, but a categorisation system isn't very useful if the categories are all jumbled up.

<comment><USER3> I am wondering how you really apply MECE in a complex environment like this. Any suggestions on how to adjust the list so it becomes MECE?

<comment><USER2> I'm not sure. One first step would be to define whether you're talking about simply _revenue models_ or _business models_. (I see revenue models as how you make money, wheras business models also incorporate elements like marketing. So "freemium" is a business model but not a revenue model, because being freemium doesn't make you money, but it does help you find customers).

I'd probably focus on pure "revenue models" as they're easier to define. Then you can ask: who pays you (all your users / some of your users / someone other than your users), how often do they pay you, and how much do they pay you? The benefit of this scheme is you can plot different revenue models on a 2-dimensional or 3-dimensional graph. Eg, if all of your users regularly pay you a little, you have a B2C subscription business. If someone other than your users occasionally pays you a lot, it's likely you're selling user data or high-end advertising. If your users pay you a one-off, medium amount, it's likely you're in ecommerce or equivalent.

I'd also look at the most frequently used revenue models first, because I think people are sometimes tempted to find "innovative" ways of making money when boring old banner ads would do better. Advertising, subscriptions and selling physical or virtual products seem to be the most proven business models. Affiliate marketing or transaction fees can work, but they're harder to pull off. Stuff like "selling user data", contrary to popular belief, only works if you really know what you're doing (I briefly worked on one of those "subscription food service" ideas with the bright idea of selling customer feedback data - turns out there's a ton of enterprise companies like BrandView already selling far more detailed customer data).

That kind of info is more useful imo because it actually helps people figure out a model that's more likely to work.

</comment></comment></comment><comment><USER4> I hope you don't mind, but I couldn't stand reading that list and cleaned it up in a gist instead: <http://pygm.us/cjvjHnCi>.

The list itself is amazing and just what I have been looking for, though. :)

</comment><comment><AUTHOR> Credit should go to avc.com's Fred Wilson ([http://www.avc.com/a_vc/2012/12/mba-mondays-revenue- models.h...](http://www.avc.com/a_vc/2012/12/mba-mondays-revenue-models.html)) ... this provides a good map.

<comment><USER5> he posted it himself. <https://hackpad.com/ep/profile/-2QvfuRcguKs4h2YzNropQf>

</comment></comment><comment><USER6> Do these revenue models need to be sustainable? I noticed 'Donations' is missing. An example could be Wikipedia, which afaik has donations as only revenue.

Some other opensource projects also fund parts of their development through donations, either from businesses or consumers.

It won't make you rich, but it might bootstrap you into some better revenue model.

Also awesome list, definitely saved for later :)

<comment><USER7> Wikipedia is in the list - under "Subscription", whatever that means. :)

It says the last update was five days ago, so I take it that you missed it. Either that or the "last update" feature is borked.

<comment><USER6> Eh oh that's strange, I didn't expect it to be under subscriptions so I just glossed over it I guess.

<comment><USER7> I can't really wrap my head around why the list is entitled (final). More like (abandoned). :P

<comment><USER8> Fred Wilson explains in his blog post,

[http://www.avc.com/a_vc/2012/11/mba-mondays-the-revenue- mode...](http://www.avc.com/a_vc/2012/11/mba-mondays-the-revenue-model- hackpad.html)

that he wanted this "final" version to be edited by invitation only and wasn't sure how to make the change to the original version.

</comment></comment></comment></comment></comment><comment><USER9> The page seems totally broken in Android. They need to turn off that "join the conversation" modal.

</comment><comment><USER10> Trying to add something without logging in, it lets me type a few letters and then I keep getting this really annoying pop-up. Either allow people to edit without login or don't. This teasing is really frustrating.

Anybody can edit Wikipedia without logging in, why not this?

</comment><comment><USER11> I don't know if this is an actual discussion or a "launch" for a site, but using page down just bounces you back to the top of the page. (Chrome beta, OS X).

</comment><comment><USER12> Which ones have a higher revenueAmount/effortPutIn ratio?

<comment><USER13> The amount of effort you have to put in is going to be different than someone else. It would be a much better idea to choose something you are familiar with. Something you can can get excited about.

<comment><USER12> That is good advice but, I'm interested in knowing, which revenue models are known for generating higher amounts of money, generalising and removing the specificities of the people who might be implementing the model.

<comment><USER14> You and everybody else are interested in that. However, if that knowledge existed the list would probably be a lot smaller.</comment></comment></comment></comment>


Shrinking my static site - <AUTHOR> https://hampton.pw/posts/shrinking-this-sites-docker-image/ <comment><USER2> You could even use nginx on scratch to remove alpine as well.

[https://github.com/gunjank/docker-nginx- scratch/blob/master/...](https://github.com/gunjank/docker-nginx- scratch/blob/master/Dockerfile)

</comment><comment><USER3> Sometimes you can get space savings on docker images from seemingly odd sources. For example, I found that running a chown command on files after they've been COPY'd in bloats the image size significantly (100s of MB). However, at some point Docker added a "\--chown" flag to the COPY command which brings it back in line.

</comment><comment><USER4> I'd suggest changing this:

        COPY package.json .
        RUN npm install

to this:

        COPY package.json package-lock.json .
        RUN npm ci

`npm ci` installs the exact dependencies specified in the lockfile. This way, transitive dependencies that were upgraded via `npm audit fix` are guaranteed to be installed. It therefore forces the image to be rebuilt when a transitive dependency changes. Copying only the package.json wouldn't do that. It also errors if the lockfile and the package.json are inconsistent.

[https://docs.npmjs.com/cli/ci.html](https://docs.npmjs.com/cli/ci.html)

<comment><USER5> +1. npm ci is typically quite a bit faster too in my experience.

</comment></comment><comment><USER6> Can we put "Docker image" in the title somewhere? Otherwise, it seems like the article is talking about the site itself (i.e. having less JavaScript, optimizing the images, …)

</comment><comment><USER7> 3 minutes to build a static blog (with a grand total of five posts) that doesn't look any different from decade-old blogs. Pulling hundreds of MB from the Internet in the process. Wow.

[https://github.com/herohamp/eleventy- blog/tree/master/posts](https://github.com/herohamp/eleventy- blog/tree/master/posts)

<comment><AUTHOR> yes it is sub-optimal, but that is not because building it takes so much time, it is because of the node_modules. I am looking into migrating to Hugo as has been suggested by MANY people

</comment></comment><comment><USER8> Back in 2015 when cloud offerings were still marginally new, a lot of big providers were gettting into the game with Docker offerings (ie, IBM Bluemix) where the charge was based entirely on RAM*Hours.

Naturally this lead to me gaming the system and making my docker images as in RAM usage small as possible. In the end I even abandoned SSH as too heavy and switched to shadowsocks (2MB resident) for networking the docker instances together.

</comment><comment><USER9> Aside: one should not use package.json to install dependencies. Use either package-lock.json (and command "npm ci") or yarn.lock (and... I forget). Keep the lock file as part of repo too, or each build could be different.

<comment><USER10> > or each build could be different.

Or not working.

</comment></comment><comment><USER11> How about binary patching your container? - pretty sure I've seen this done somewhere but can't find the link to it.

</comment><comment> globular-toast Why even have a docker image for a static site? If the site has to be built like this one then just put the output of the build process behind some webserver. We were doing this back in the 90s and didn't have to write blog posts about how _not_ to make your site 400MB.

<comment><USER12> > just put the output of the build process behind some webserver.

That's what this is doing.

You are skipping over two other parts which are installing and setting up nginx / similar and creating a process for the build itself. This ties the three together.

</comment></comment><comment><USER13> The initial build time is "about 3 minutes" but I'd like to know the build time of the final image.

</comment><comment><USER14> You can probably shrink it even more. The Caddy alpine image is 14MB compressed.

[https://hub.docker.com/_/caddy/](https://hub.docker.com/_/caddy/)

You also get automatic TLS certificate management and tons of other goodies that nginx doesn't offer out of the box.

<comment><AUTHOR> all of my docker containers are placed behind traefik which handles TLS certifactes, HTTPS redirect, compression, and routing to the correct container

<comment><USER14> This post talks about a single-container setup though, with the static site bundled with Nginx. That's what I'm replying to, not the usecase where you have many containers you need to proxy to.

</comment></comment></comment><comment><USER15> If you're using multiple steps anyway, there's no need to use nginx base on every step.

        FROM nginx:1.17.10-alpine as npmpackages
        RUN apk add --update nodejs npm

Just do:

        FROM node:10
        RUN npm [...]

<comment><AUTHOR> that is true, ill switch to that when i get around to it

</comment></comment><comment><USER16> tl;dr author discovers multi-stage build to throw away useless nodejs dependencies.

Same also applies to even Java. Maven downloads tons of stuff these days. You may only be using single static string from a dependency.

</comment><comment><USER17> This approach is akin to installing all of the build tooling inside of Docker, _then_ generating the build artifact. I'd think it'd be even slimmer to generate the build artifact first, then just copy that into the container.

Is there an advantage to building inside of Docker?

<comment><USER18> Wouldn't the advantage be consistent build fragments? If you use the build tools outside of docker, you won't get the same repeatable build artifact across different machines (or as your own host system changes). Maybe I'm not understanding you though.

</comment></comment><comment><USER19> Why are we scared of disk space in 2020?

<comment><USER20> I'm scared of _everything_ in 2020.

</comment></comment><comment><USER21> I'm glad they shrunk the image to make space for the _HUGE_ documentation link.

</comment><comment><USER22> Static site and docker shouldn't be seen together.

<comment><USER23> Could you elaborate on that statement, why should static site and docker not be seen together?

<comment><USER24> It depends what you're optimizing for.

One of the beautiful things about a static site is it's ability to be served by object stores like S3 as your origin, and cached by a CDN.

From an operations standpoint, you are not responsible for maintaining much of anything, the performance is super fast, highly available, and relatively cheap (no dedicated servers, just paying for bandwidth and storage costs)

Contrast that with a docker container as your origin... it must be running (and that is your problem to ensure it is).

If you're optimizing for developer convenience, your traffic is low or not mission critical, or maybe you have a globally distributed highly available k8s cluster and that is "the way" your company does all the things... sure why not

<comment><USER25> Docker is nice because you end up with the same configuration in development and production. There are many hidden details that "just let someone else host your site" or "just rsync your files to a server" gloss over. Who is renewing your TLS certificate? Where do you configure headers, redirects, mime type mappings, etc.? Where do access logs go? How do you update the version of the web server? What effects does that update have?

When you manually do these things, you rely on a bunch of implicit defaults. Maybe your production server and your workstation happen to have the same version of nginx, and happen to set the same defaults. So you can test a change on your workstation and the same change works in production. But more likely, that is not the case. So you get weird differences between development and production, and you only notice when you push to production. That is not ideal. Building an image with your webserver and static files ensures that you see the same things in both places. There is no need to test anything in production, as you have a copy of the exact code and data that is going to be running in production, locally. You can tweak and poke to your heart's content, confident that you'll have the same effect when you push to production. There is no need to maintain documentation about how to build your project and what versions of things you use; you specify them in a machine- readable format and the machine dutifully builds the project correctly every single time.

(One disadvantage of clean builds, though, is that sometimes you want old artifacts to exist. Consider a case where you use webpack to generate javascript. Typically, you'll output a bundle like "main.abc123.js" which is loaded from "index.html" via a script tag. What happens when the browser loads index.html from your last build, then you the next request goes to an updated server, which says to get "main.def456.js" instead? The page silently breaks, because the server doesn't have a file called "main.def456.js" anymore. "rsync --delete" has the same problem. And if you never delete anything, you eventually use an infinite amount of disk space. So there is definitely room for improvement here, but "it will probably work if I don't think about it and cross my fingers" is not the improvement we're looking for.)

</comment></comment></comment></comment><comment><USER26> > This docker image resulted in a 419MB final image and took about 3 minutes > to build. There are some obvious issues with this. For instance every-time I > change any file it must go through and reinstall all of my node_modules.

He doesn't tell whether there have been any build time improvements after the changes to the Dockerfile. Will the builder docker images get cached and thus reduce the build and deployment time?

<comment><USER27> Well, the article mentions an obvious improvement. The node_moduoes won't be rebuilt after any changes to the code, only changes specific to the packages.json.

Basically the main step is the COPY . . step (previously COPY . /app) which will invalidate the cache every change to the code.

Also that on the builder, the steps beyond npm run are not needed, but well they won't improve much on the performance or space of the overall process.

<comment><USER26> > The node_moduoes won't be rebuilt after any changes to the code, only > changes specific to the packages.json.

But that's only if the builder image gets cached and can be reused, right?

<comment><USER9> Correct.

</comment></comment></comment></comment><comment><USER28> I have no idea why they need an nginx image in their second FROM, they are just doing some npm.

<comment><AUTHOR> yeah, that is a mistake. I just did not fully rethink my code when I moved the build layers. I will be removing that tonight along with a few changed suggested here

<comment><USER28> On a second thought, I also don't understand why do npm in two different images, why not just copy the webpack bundles from the builder image into the nginx image ?

For me the cause of the big image size was in

COPY --from=npmpackages /app /app

From your third Dockerfile, it seems replacing the above with the following would have done the trick without adding an extra stage

COPY --from=npmpackages /app/_site/ /usr/share/nginx/html/

<comment><AUTHOR> I do npm in two different images so that the node_modules can be cached between builds. this massively speeds up my build. The npmpackages layer only installs the npm modules

<comment><USER28> I see, this speeds up when you change a dependency, because at least then your whole node_modules is not thrown away is that right ?

</comment></comment></comment></comment></comment><comment><USER29> YOU DON'T NEED DOCKER FOR A STATIC SITE. That's why it's called "static". There should be no moving parts in it.

<comment><USER30> I have had several problems with static sites being broken by library updates. I now have a vagrant disc image which will let me always build my site.

</comment></comment><comment><USER31> in my eyes this is all madness. deploying sites via github to some docker shit.

how about good old ftp and a cheap shared webhost? like its been done for 30 years.

<comment><USER32> To be honest, GitHub sites have been amazing for me. I just have a simple static website with personal information. HTML and CSS with minimal JS. Purchasing a shared webhost still means extra cost on top of domain registration. With GitHub, I just followed their instructions with my domain, and everything just worked. I'm also not paying anything per month or year besides domain registration which is really nice when you have to start budgeting tightly.

I don't know about docker and all of that, though.

<comment><USER28> With GitLab Pages it's even easier, just fork one of the examples in gitlab.com/pages, push a content update in a commit and it's online a minute later thanks to GitLab-CI and GitLab Pages.

<comment><USER32> This workflow seems almost exactly the same as GitHub Pages, I'm not sure it's worth my time to switch platforms and go through the hassle when everything works now.

</comment></comment></comment></comment><comment><USER33> This post says a lot more about the javascript ecosystem than Docker. Multi- stage image builds are nothing new or extraordinary, and in fact it's Docker 101. However, being forced to install 500MB worth of tooling and dependencies just to deploy a measly 30MB static website on nginx is something unbelievable.

<comment><USER34> How is that any different from build tooling for any other language? On my system, gcc with a bunch of commonly used dependencies requires just about the same space (and it's a full Linux system, not a trimmed down container).

<comment><USER35> > How is that any different from build tooling for any other language?

On the one hand yes, on the other hand it's a large amount of crap just to build a static site. `npm install @11ty/eleventy` pulls 600 packages and yields a 100MB node_modules folder.

Even Sphinx (whose scope goes way beyond static site generation) "only" pulls in about 75MB worth of stuff (a third of that being Babel) over two dozen dependencies (half a dozen being sphinx's own subcomponents).

<comment><USER36> The problem with JS ecosystem is less about size and more about the number of files.

<comment><USER37> There _are_ real problems with NPM, like the proliferation of packages that include things they shouldn't (babel included a picture of Guy Feiri for a while...) but the simplistic "there's a lot of files" argument is nonsense. If you need a lot of files then you need a lot of files.

<comment><USER38> > babel included a picture of Guy Feiri for a while...

I refuse to believe that there are real people so eager to jump on the JS hate bandwagon that they unironically believed every word of an obviously satirical article.

(babel has never included a picture of Guy Fieri.)

<comment><USER39> It might not have been a picture, but there was an ASCI art of his face that got checked in.

[https://github.com/babel/babel/blob/f36d07d30334f86412a9d277...](https://github.com/babel/babel/blob/f36d07d30334f86412a9d2771880cb566a82a9b6/packages/babel- core/src/api/node.js)

<comment><USER38> It was checked in as a humorous response to the very satirical article I'm talking about, and never actually published to the package registry.

But again, people are so ready to froth at the mouth wherever JS is even mildly concerned that I really shouldn't be surprised they'd take a meme that lasted for a handful of days seriously.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER40> I use Hugo as my static site generator, single binary, no dependencies, generating hundreds of pages in milliseconds ... so reading this feels so wrong, I want to call it JavaScript masochism.

Taking a simple concept like a static site and adding a ton of complex tooling around it because it is the trend now?

Why would you even need a docker image to run a static website? The best thing about a static website us you can host it everyone without requiring any extra resources, like putting it directly to some CDN as files, etc.

<comment><USER41> Speaking of complex tooling you don't think Hugo is a bit complex itself?

Took Hugo for a test drive using official quick start.

Half the themes from official docs wouldn't compile.

Started looking into architecture but official docs do not explain the big picture just a bunch of instructions.

The official documentation does not explain on what is going behind the scenes very well.

I mean, I will obviously want some sort of scaffolding and a way of changing it but this [https://gohugo.io/getting-started/directory- structure/](https://gohugo.io/getting-started/directory-structure/) is not helping very much.

Since you are not supposed to write go code everything has to be done through .toml config files as far as I could grok.

I feel I'd rather write my own static generator in language of my choice(say Python) than keep up with the Hugo docs.

<comment><USER42> For simple websites you need no "scaffolding", you can just edit the html in a text editor. Really just write the text between the tags. Better to meditate over simplicity and minimalism than to start another software project just to publish a blog.

<comment><USER41> That's the thing, I've been writing HTML for 25 years and JS for over 20.

Lately I've been writing a lot of .md when writing Jupyter Notebooks.

Thus I figured that Hugo would offer some advantages to relatives who wanted a dead simple site that they wanted to add some posts from time to time.

Static site would be perfect for them but I do not want to manually add their posts...

Started looking into Forestry.io and well it is not quite as simple as Netlify.

<comment><USER42> Ah ok, you started with suggesting Hugo might be a bit complex...

I thought I might have found an ally, someone who has been around for a bit and wary of the cambrian explosion of software projects. Someone who no longer believes in all that software that comes out, with new, cool features that add functionality, but, in my opinion, add subtle difficulty along the way that's hard to account for, death by a thousand cuts that must eventually lead to some kind of fatigue. Things that update and break and change and are deprecated and abandoned and require use of a different language, different build chain, different mental model, just to "add some posts from time to time" to a blog.

Please excuse this little rant. I truly believe that anyone can find their sweet spot with any system. But what is the right fit for your relatives who want it _dead simple_?</comment></comment></comment></comment></comment>


Ask HN: Do startups tend to cross-promote each other? If not, why not? - <AUTHOR>

I think this is a pretty straight-forward question, but in case I'm wrong:  Lots of startups have ways of contacting users.  And we are always looking for more.  Cross-promoting seems easy, if not obvious, yet I don't see it very often.  Am I wrong, and if not, why doesn't this happen? <comment><USER2> I see it fairly often on blogs.

From a strictly pragmatic perspective, it is boring if you only talk about yourself all the time, while talking about the interesting things others are doing lets you promote yourself less overtly.</comment>


Writing presentations with org-mode and beamer - <AUTHOR> http://emacs-fu.blogspot.com/2009/10/writing-presentations-with-org-mode-and.html

<comment><USER2> If you want to do your presentations in Emacs, consider eslide: <http://github.com/jrockway/eslide>

It is like takahashi.xul, but everything is contained in Emacs. That means your syntax-highlighted code-blocks look the same on your slides as in Emacs :)</comment>


How to Sell Ads Online. Simplify The Advertising Process (7 of 7) - <AUTHOR> http://www.trafficspaces.com/blog/2010/02/02/how-to-sell-ads-online-simplify-the-advertising-process/

<comment><USER2> The series is essentially trying to make the case for self service advertising.

It makes sense. GAM and OpenX are good systems that will both work well for people that rely (or want to rely) mostly on ad networks and occasionally get a few direct sales enquiries.

However once you move into the realm where lots of advertisers are contacting you directly, it is much much better to have an self-service ad management system.

Think of Facebook, it makes a large majority of its revenue from self-service advertisers. Not GAM, not OpenX but Facebook Ads. [http://digital.venturebeat.com/2009/09/18/facebooks-self- ser...](http://digital.venturebeat.com/2009/09/18/facebooks-self-serve-ads- crushing-it-lead-to-profitability/)</comment>


This seem legit... - <AUTHOR> http://www.trustico.ch/ssltools/match/cert-and-key-pem/check-if-certificate-and-key-match.php <comment><USER2> To clarify: DO NOT DO THIS.

1\. Never give your private key to anyone

2\. Especially not if it is sent over an unencrypted connection (the site doesn't even use https)

3\. Don't. Just don't.

This is either the weakest attempt of the NSA to collect private SSL keys ever, or this company actually has zero knowledge of the product they're selling and shouldn't be trusted with your site's security

<comment><USER3> I love how suddenly the NSA is the only entity out there who has an interest in private keys.

<comment><USER4> at least we know that's it is the most interested, funded and staffed to do it.

<comment><USER5> No, they're just the only ones dumb enough to get caught ;)

</comment></comment></comment></comment><comment><USER6> Apparently the feature is widespread:

[https://www.sslshopper.com/certificate-key- matcher.html](https://www.sslshopper.com/certificate-key-matcher.html)

[http://www.ssltools.com/cert_key_match](http://www.ssltools.com/cert_key_match)

[https://certificatesssl.com/ssl-tools/match-ssl- details.html](https://certificatesssl.com/ssl-tools/match-ssl-details.html)

[http://www.mobilefish.com/services/privatekey_match_certific...](http://www.mobilefish.com/services/privatekey_match_certificate/privatekey_match_certificate.php)

[http://sslchecker.com/matcher](http://sslchecker.com/matcher)

<comment><USER7> Scary. To be fair, although this kind of tool should not exist at all, the sslshopper tool at least has a warning, enforces https and informs users how to check it properly on the command line. The others, however, do not.

</comment></comment><comment><USER8> I contacted their support:

Me: I wanted to know more about your certificate key matcher isn't the private key always meant to remain... private?

Emanuele: Yes, it should. We offer the tool to help verify the correspondence SSL certificate it is lost.

Me: But it would be sent over HTTP and viewable to anyone along the network.

Emanuele: The page can also be accessed through HTTPS.

Me: I think it should be enforced. Also something like this should be done client side. Perhaps using crypto.js

Emanuele: OK, I will pass your comment to our General manager.

<comment><USER9> So leaking my private key to somebody is OK if I do so over HTTPS, and even better if I encrypt it with a javascript crypto library beforehand?

I don't think you've thought this through.

<comment><USER10> I think he was suggesting that, instead of sending the private key to this web server, the check they're doing could be implemented client-side, thus avoiding the need for the key to transit the wire.

I haven't been able to access the site though, so I may be way off in my understanding of what it does.

</comment></comment></comment><comment><USER11> Hi,

The tool was made available for customers to legitimately check if the Private Key matched the SSL Certificate that was being installed - a common question and feature request from our customers.

However, upon review of the comments made in the internet community we have made a decision to remove this specific tool and to review all other tools that we make publicly available via our websites.

We also saw a heavy attempt to hack/abuse this tool over the past few hours, perhaps to look for exploits, an action I find absurd for those who make out to be security conscious.

I welcome any further comments on how we can improve our service and do hope that our actions to remove the tool today were prompt and satisfactory.

Zane Lucas General Manager Trustico Online Limited

<comment><USER12> Since you are a site that sells SSL certificates, it would be appropriate for you to enforce HTTPS when communicating with your website.

</comment></comment><comment><USER13> BITCOIN ADDRESS MATCHER

Want to make sure that your bitcoin address works? Just send money to

1JqjU7zBvbhyrDFjtJG6xAwMm5BUVmtpau

and if you don't receive an error, you can rest assured that your bitcoin address works!

<comment><USER14> [https://blockchain.info/address/1JqjU7zBvbhyrDFjtJG6xAwMm5BU...](https://blockchain.info/address/1JqjU7zBvbhyrDFjtJG6xAwMm5BUVmtpau)

Watching with interest... xD

<comment><USER13> Empty as expected :) Edit: Nevermind, somebody send a cent. Your address works! ;)

</comment></comment></comment><comment><USER15> Related: [http://www.inutile.ens.fr/estatis/password-security- checker/](http://www.inutile.ens.fr/estatis/password-security-checker/)

<comment><USER6> I love the "Test another password?" prompt. I wonder how many people actually use it.

<comment><USER16> c. You agree to pay $ 100,000 for your use of the Estatis Free Password Security Checker if we ever ask for it.

<comment><USER17> I was assuming you were joking. but no, it's in there, point 6.c)

... Wat?

EDIT: I am a dumbass, the terms and conditions are clearly facetious. Read them, they are hilarious in parts.

</comment></comment></comment></comment><comment><USER9> It would be really cool if they parsed the issuer from the certificate you provided, and informed your CA that your private key was just compromised if the key matched.

</comment><comment><USER18> So I tweeted them earlier and just got this response:

"Hello, the tool will be removed from all our websites within the next 30 minutes. Thanks."

[https://twitter.com/MrTrustico/status/395905251313586176](https://twitter.com/MrTrustico/status/395905251313586176)

<comment><USER18> Update: and it's gone

<comment><USER19> What was it?

</comment></comment></comment><comment><USER7> Wow, at first I seriously thought this site was a fake copy of the official Trustico site (they have trustico.ca, trustico.com, etc)... but the form exists on all their sites:

[http://www.trustico.ca/ssltools/match/cert-and-key- pem/check...](http://www.trustico.ca/ssltools/match/cert-and-key-pem/check-if- certificate-and-key-match.php)

</comment><comment><USER20> Woah, I couldn't ever envisage ever trusting a "security company" that not only encouraged you to disclose your private key, but also provided a form for doing it over a non encrypted connection!

My personal opinion is don't use these guys; this is either a school boy error/complete incompetence or totally dubious.

</comment><comment><USER21> But has a verysign logo. It has be trustworthy.

</comment><comment><USER22> I just tested the form with a key+cert pair I created for this sole purpose. It actually performs as advertised - it checks if key and cert belong together.

<comment><USER23> You have not provided any proof that it actually performs as advertised.

Maybe it just says that for any and all inputs??

<comment><USER22> To clarify the issue: I performed the following steps:

1\. created a CA key+cert (selfsigned) 2\. created a keypair K 3\. signed the public key of K with the CA 4\. uploaded the CA-signed cert and the private key of K --> "Your Certificate and Key match" 5\. uploaded the CA cert (not the one of K) and the private key of K --> "Certificate an Key do NOT match."

</comment></comment></comment><comment><USER11> Hello,

that tool will be removed from all our websites within the next 30 minutes.

Trustico Online Limited

<comment><USER24> Congratulations. Your customer base today = (customer base yesterday) - (hacker news readership).

</comment></comment><comment><USER25> I had these guys @reply me on Twitter when I tweeted about how it's easier to figure out what cipher suite to use compared to figuring out what SSL product I need.

They were helpful but thank god I didn't buy a cert from them: this page is a terrible, terrible idea that erodes their trust completely.

</comment><comment><USER17> And it's been taken down. This is still up though and just as bad:

[http://www.trustico.ch/ssltools/convert/pem-key-to- der/conve...](http://www.trustico.ch/ssltools/convert/pem-key-to-der/convert- pem-private-key-to-der.php)

</comment><comment><USER26> At the very least, I hope a successful submission is rewarded by a redirect to: [http://www.youtube.com/watch?v=awK0NrgHUbk](http://www.youtube.com/watch?v=awK0NrgHUbk)

</comment><comment><USER27> This should be a feature on the NSA website.

</comment><comment><USER28> "The page you have tried to access is not responding properly and we can't display it at the moment." \- looks like they are embarrassed enough to take it down. Anyone have the original text for me to snigger at? Way-back machine and Google don't seem to have it cached.

</comment><comment><USER29> haha, Its hilarious, reminded me of this [http://d24w6bsrhbeh9d.cloudfront.net/photo/350850_700b_v1.jp...](http://d24w6bsrhbeh9d.cloudfront.net/photo/350850_700b_v1.jpg)

<comment><USER30> This is of course an old joke from bash.[1]

[1][http://www.bash.org/?244321](http://www.bash.org/?244321)

<comment><USER29> yes it is, actually this one is better ;)

</comment></comment></comment><comment><USER31> I was hoping it was at least javascript...

</comment><comment><USER32> What was it?

</comment><comment><USER8> Brilliant.</comment>


Show HN: Active Window Logger – Transparently capture usage analytics - <AUTHOR> https://github.com/TheCodeArtist/Active-Window-Logger <comment><AUTHOR> The goal is to have a lightweight tool that can absolve the user from the task of calculating how much time was spent performing the individual tasks over a given period (usually a day).

Useful when hooked-up with various GTD and Pomodoro tools, or for filling JIRA timesheets, or simply to measure your work-patterns on a typical day and plan for the next.

<comment><USER2> There are a few tools out there that use a similar paradigm.

RescueTime, uses the same principal (active focused window) [https://www.rescuetime.com/](https://www.rescuetime.com/)

Wakatime, which is similar, but closer to your "goals" I think. Which issues "heartbeats" of open files / websites / w/e you want that can be related to a given project programatically. [https://wakatime.com](https://wakatime.com)

Though generally just love this, I constantly strive to automate timekeeping for the trivial stuff.

</comment></comment><comment><AUTHOR> Initial ALPHA release out now.

Basic functionality includes:

\- Play/Pause feature to enable/disable logging at run-time.

\- Reliably logging any window active even for a fraction of a second.

\- Reliably logging system lock/unlock events.

\- Exporting log as csv

[https://github.com/TheCodeArtist/Active-Window- Logger/releas...](https://github.com/TheCodeArtist/Active-Window- Logger/releases/tag/v22.214.171.124-alpha)

</comment><comment><USER3> Is there something similar for OSX ?

<comment><USER4> Hammerspoon could probably do it with a simple scripty bit.</comment></comment>


The "Real World Haskell" Book Site Now Re-Directs to "Red Bean Software" - <AUTHOR> https://book.realworldhaskell.org <comment><AUTHOR> I've been reading the book online -- I have the paper copy but it's easier to work the examples with copy/paste -- and I've had a tab open for a while. I opened it again this morning to read a chapter or two, and I got a cert error...

I tried to back it up to the internet archive as proof in case/when the original owners regain control but the Wayback Machine wouldn't accept it with the bad cert.</comment>


Ask HN: Apps asking for access to Facebook messages - <AUTHOR>

Whenever I see this (http://i.imgur.com/S7SMOTq.png), I get really freaked out. Is this a normal permission? If there is a data breach, does that mean private messages will be out in the wild? <comment><USER2> There adding features to the application beyond the typical scope of Facebook API [ie. Publishing]. Unless you are willing to allow access to your account it would be advice to stay away.

</comment><comment><AUTHOR> Also — does it mean the developers can just browse private Facebook conversations of their users?

</comment><comment><USER3> Http://www.facebook.com/johannie.stpierre.1

<comment><USER3> Hey</comment></comment>