More Intel speculative execution vulnerabilities - <AUTHOR> https://mdsattacks.com/#ridl-ng <comment><USER2> > We are particularly worried about Intel's mitigation plan being PoC-oriented > with a complete lack of security engineering and underlying root cause > analysis, with minor variations in PoCs leading to new embargoes, and these > "new" vulnerabilities remaining unfixed for lengthy periods. Unfortunately, > until there is sufficient public / industry pressure, there seems to be > little incentive for Intel to change course, leaving the public with a false > sense of security. Slapping a year-long embargo after another (many news > cycles apart) and keeping vulnerabilities (too) many people are aware of > from the public for a long time is still a viable strategy.

This is troubling.

<comment><USER3> Perhaps researchers can use the tested-and-proven "Full Disclosure" tactic to exert public pressure on Intel. It doesn't need to disclose everything, just two or three additional unpatched PoCs with full source code would be enough.

However, unlike buffer overflow exploits, most researches on CPUs are conducted within academic institutions, doing this certainly breaches the code of conduct. Also, CPUs are the most critical components of all computers and their vulnerabilities are difficult to fix, doing this would put a lot of users under immediate risks, unlike a root exploit, which is less risky and can be fixed within a week. Doing Full Disclosure of hardware exploits that users can not fix is much more ethically problematic than software exploits.

But leaving the users in the dark and allowing Intel to delay its fixes by _not_ to exert pressure is obviously irresponsible, which is the original argument for full disclosure.

So I'm not sure. Perhaps Google's Project Zero is a good model and a good compromise between resposible/full disclosure - embargo for 90 days, full disclosure later, all information becomes public after 90 days and no extension is allowed, period. For CPUs, perhaps we can use 180 days.

<comment><USER4> I wish FPGAs were fast enough because I don't see how else this problem can be solved. Easy to issue a patch that fixes logic implemented in FOGA. Impossible to fix hardware rooted issues unless they work around it at a huge performance cost, if at all possible.

Not an EE so I'm just dumping my thoughts.

<comment><USER3> One problem of FPGAs is that the absolute dependence on proprietary tools from the vendor, the hardware industry is much more closed in comparison. By using those tools, you have to agree the terms and conditions such as the following (this one is from Xilinx),

> By using this software, you agree not to: [...] display the object code of > the Software on any computer screen.

From a security perspective, it doesn't inspire confidence, there's no ability to do an independent verification, something like doing a reproducible build with an compiler which source code is open to audit. There's no equivalence of GCC or LLVM for FPGA.

Fortunately, there are some people working on it, just saw it on the homepage, although it's a long way to go... [https://news.ycombinator.com/item?id=21522522](https://news.ycombinator.com/item?id=21522522)

I'm not an EE, just my 0.02 USD.

<comment><USER5> _> By using this software, you agree not to: [...] display the object code of the Software on any computer screen._

I.e. ... I can print it? Good.

</comment></comment></comment></comment></comment><comment><USER6> So Intel failed to mitigate the vulnerability when it was first reported. Then they extended the embargo from May until November.

And they still didn't fix it.

What's going on with Intel? Like they're going all in with lying in benchmarks against AMD and straight up forgetting what has been reported as security issues.

<comment><USER7> One of the problems with Intel culture - especially under BK was that the philosophy was "Focus on our key goals to the exclusion of everything else". It was meant to keep focus and ensure we moved quickly. The problem with that is it meant we were entirely unresponsive. It doesn't matter if something important has come up because you've already agreed what the priority is, you've already committed to what you're going to do. So even if something does come up, communicating that problem to the team that needs to fix it is impossible because you'll get ZBB'd (if we do this, we will drop that). Then once you've got engineering to commit, the bureaucracy won't let you just release anything so you need to line up into a release process.

I'm sure no one intended to mislead, but organisationally Intel just isn't designed to fix bugs. It doesn't have a process to respond to issues.

<comment><USER8> Dumb question: Can you clarify what ZBB'd means in this context? I've never seen it before. There's a wiki page [0] with various meanings for the abbreviation, but nothing seemed to fit. Maybe Zero-based budgeting?

[0] [https://en.m.wikipedia.org/wiki/ZBB](https://en.m.wikipedia.org/wiki/ZBB)

<comment><USER9> Zero-based budgeting. It effectively means that a project is no longer getting funded or staffed and is therefore dead.

<comment><USER10> I have to wonder how many bitter Pyrrhic victory jokes get made by victims of poor implementation based on the creator's last name - Pyrrh. I've seen too many companies destroyed by superficially attractive budgeting schemes, even with how much tech has started to acknowledge perverse incentives they seem to get overlooked. The worst I had direct experience with was a company where they moved to all income being credited to marketing & bizdev and all other parts of the company being treated as losses to be minimized. We were both advertising supported (and thus needed content to sell anything) and had professional products that required analysts, but they when the market started looking rougher they kept the sales & ad people and concentrated layoffs on people who produced things or ran the infrastructure.

Ultra-simplified bookkeeping interpreted through the lens of too much coke nearly destroyed them. The dotcom bubble was a very strange time.

</comment></comment></comment></comment></comment><comment><USER11> To reiterate the written words from the authors: Intel prevented this particular problem gets to the public and than they flat out lied to the customer.

</comment><comment><USER12> > On July 3, 2019, we finally learned that, to our surprise, the Intel PSIRT > team had missed the PoCs from our Sep 29 submission, despite having awarded > a bounty for it, explaining why Intel had failed to address - or even > publicly acknowledge - many RIDL-class vulnerabilities on May 14, 2019.

What does this usage of the word 'missed' mean in this context? That they lost it / failed to deliver the PoC to the relevant team? Or that they released a "fix" knowing that it didn't defeat the PoC?

<comment><USER13> From the way the phrase is turned, I believe they released a fix that covered all previously known PoCs but not those from that submission.

Generally speaking, that really illustrate the dumb way Intel is going about it, fixing on a PoC basis rather than going after the strong underlying problem. It basically screams "there will always be issues, the question is can you find them !".

</comment></comment><comment><USER14> AMD is suffering much less from these flaws. Seems they didn't ignore as many security boundaries with their implementation.

<comment><AUTHOR> AMD (and ARM OoO chips) are vulnerable to Spectre variant 1 (bypass in-process array bounds checking) but not to the vast majority (any?) of the other issues which are Intel-only.

AMD chips don't have the feature that speculation failure is determined at instruction commit time when it is already too late, so most issues just can't happen.

<comment><USER15> AMD processors were also vulnerable to spectre v2. I don't know the status of the mitigations or whether it was fixed in zen 2.

EDIT:

I found the list I made a few months back. no guarantees, but i think it is mostly accurate.

Meltdown: Intel, IBM, some ARM

Spectre v1: Intel, ARM, IBM, AMD

Spectre v2: Intel, ARM, IBM, AMD

Spectre v3a: Intel, ARM

Spectre v4: Intel, ARM, IBM, AMD

L1TF: Intel, IBM

Meltdown-PK: Intel

Spectre-PHT: Intel, ARM, AMD

Meltdown-BND: Intel, AMD

MDS: Intel

RIDL: Intel

<comment><USER16> spectre v2, like v1, isn't one that is "fixable." The mitigations (retpoline & microcode updates) are essentially additions that are added in places where security checks are done to just disable speculation for that particular check. But you still have to choose when & where to use those or even if you opt to use them at all.

There are no sweeping fixes for either v1 or v2, and there probably won't be for a long time at best.

But the positive news is that v1 & v2 only matter at all if you do in-process sandboxing of untrusted code. Which most things don't do, so most things are not at any risk from it.

<comment><USER15> > But the positive news is that v1 & v2 only matter at all if you do in- > process sandboxing of untrusted code.

I don't think this is accurate. It seems to be a widespread misunderstanding that started because the original proof of concept was within a single process. Spectre, before mitigations, allowed userspace to read kernel memory if appropriate gadgets in the kernel could be identified and exploited.

My understanding is the impact is only intra-process after mitigations.

</comment></comment></comment></comment></comment><comment><USER17> Another nail in the casket lake. Is the solution just to throw everything out and start again? Do we just abandon speculative execution?

<comment><USER13> The problem for most of these is not speculative, it's not doing proper acl during speculation. Just because the cpu is speculating doesn't mean it shouldn't check if you are allowed to access this or that, but that's what Intel did, and they only did the security check at the end before giving back the result, except at this point its too late you've already accessed it.

Other manufacturers AMD included didn't get affected by those variants.

<comment><USER18> I wonder what the performance costs of those ACL checks are.

<comment><USER13> A single one might not be that big, but they add up (if there are several suchs checks to do in your speculated branch, instead of doing them when they appear during speculation intel chips pooled them up all at the end), and they disappear if the speculation was wrong (speculated the wrong branch ? Didn't lose any time on permission check).

They're the >~10% of cpu perf intel chips have lost in the last few years with all the mitigations.

<comment><USER16> > They're the >~10% of cpu perf intel chips have lost in the last few years > with all the mitigations.

Given AMD's Zen 2 has comparable IPC to Intel at this point without doing the ACL check late it's not evident that the difference in when the ACL is done was a key efficiency gain.

<comment><USER13> I was not talking about intel's 10% lead over AMD, I was talking about chips from 3-4 years ago, when tested again now with mitigations, perform 10% worse or more in affected workload (see [https://www.phoronix.com/scan.php?page=article&item=intel- ic...](https://www.phoronix.com/scan.php?page=article&item=intel-icelake- mitigations&num=4) for exemple)

<comment><USER19> Surely the mitigations are not the same as "doing proper acl during speculation" in the first place and have a worse performance hit?

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I worked at Intel in 1998 as a young engineer a few years out of college. Back then they were riding high on their CPU monopoly.

I left in about a year and a half and moved to a startup company. My issue with Intel was that, as a monopoly, they had grown fat and complacent.

I am not exaggerating when I say that in 1998-99, engineers were working maybe 4-5 productive hours in a week. Political savvy and alliance-building were the most important things for promotions and influence.

Those who actually produced good work had credit for their work diluted through many layers of management. You could do something amazing and your manager's manager might present it in a powerpoint to the company without mentioning your name at all, and acting like the idea was his all along.

I'm surprised the company has lasted this long. Its a place where mediocre people gather.

</comment><comment><USER21> Is there a list of the exploits found 'in the wild' that depend on speculative execution?

<comment><USER22> for regular consumers, its doubtful there are any.

</comment></comment><comment><USER23> another 0-4% performance hit for skylake

<comment><USER24> The really damning part is that it applies even for processors that are supposedly fixed in silicon because Intel dropped the ball by playing wack-a- mole with proof of concept exploits instead of thoroughly building their chips with security in mind.

If the history of Microsoft and Windows security is any indication, it'll take Intel many many years to turn that ship around.

There's a question of whether AMD has been mostly unaffected only because their chips haven't received as much scrutiny, but for the time being it does seem that if you care about security, you'd better go with Epyc.

<comment><USER25> I don't think anyone seriously expected Intel to be able to thoroughly harden their chips against Spectre-style attacks given just a year to tweak their existing microarchitecture. They were able to move some permissions checks ahead of some speculative actions, but they simply haven't had enough time to design an architecture that can unwind all observable side-effects of mispredictions. It was obvious that all the near-term fixes in silicon would be equivalent to or only slightly better than the microcode or OS-based mitigations.

</comment></comment></comment><comment><USER26> I recall a Google security blog that spoke more generally that with so many layers of code that you don't know what they're doing the result is that effectively they consider any speculative execution that exists at the time of writing the blog may be a potential vulnerability.

</comment><comment><USER27> Running the below over my machines gives me back the 8-30% cycles I originally paid for, depending on load type. This will have to do until everything is swapped to AMD. Note you only need 'mitigations=off' in later kernels.

        - name: Disable CPU-sapping security mitigations
          become: yes
          lineinfile:
            path: /etc/default/grub
            line: GRUB_CMDLINE_LINUX_DEFAULT="noresume noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off"

        - name: Update grub
          become: yes
          command: /usr/sbin/grub-mkconfig -o /boot/grub/grub.cfg

No I don't give a fuck about the 'risk' this introduces, but I expect my bank to.

<comment><AUTHOR> Your web browser runs untrusted code. On a computer that never runs untrusted code you can do that.

<comment><USER28> There have been more Chrome/Firefox 0-days than speculative execution vulnerabilities exploitable in Javascript (0). Sure, there is a chance that the Chrome/Firefox teams missed something, but there have been sighted no exploits since the release (of spectrev1) and the browser fixes.

It's not a crazy threat model to have on a personal PC, the risk is so very minimal. If your threat model is that strict you shouldn't be running JS anyway.

<comment><USER29> What are you even talking about? the introduction to this problem came with a proof-of-concept _IN JAVASCRIPT_.[0]

Session keys, private keys, passwords and all other kinds of access tokens that your system is using, it's the next worst thing from remote code execution.

Your browser runs so much untrusted code that it's really unreasonable, and yes, we should definitely be pushing back hard on this. But it's probably the most stupid thing you can do to disable these mitigations because they're not just theoretical, they're real, they're here and everyone knows about them.

This is like anti-vaxx philosophy. "the risk is low"; well, maybe the risk is low because of herd immunity, it's not feasible to run these attacks as they'll be obvious to those who have the mitigations in place (100% CPU), but if there's a 0.00000001% return then it becomes profitable to exploit, just like mail spam.

Do not fucking turn off these mitigations on desktop computers, they are too complex and run untrusted code all the time. Unless you can work without javascript and I doubt you can because the web today is basically unusable without it.

If you have a database which is only accessible internally, you can disable the mitigations, because those things are hit hardest by the mitigations and do not run untrusted code.

But really, your desktop is running untrusted code _a lot_. Please do not do this, not only for your own sake but for everyones sake. Don't make it profitable for malicious agents to run these attacks.

[0]: [https://www.reddit.com/r/javascript/comments/7ob6a2/spectre_...](https://www.reddit.com/r/javascript/comments/7ob6a2/spectre_and_meltdown_exploit_javascript_example/)

<comment><USER28> From the comment in your link:

> It's missing the entire actual implementation of the Spectre attack, which > requires analysis of read times to see if you're hitting the processor cache > or not.

"analysis of read times" is what the browsers "fixed" to mitigate the attacks (and site isolation later). Again, there has been no working attacks on updated browsers.

Please feel free to link an example of one though, I will gladly admit I'm wrong. You just seem to frankly have no idea how the exploits actually work though (did you actually read the code in the reddit post?), so I suspect that this conversation will be a waste of time.

<comment><USER29> The browser mitigation's only work with the kernel mitigation's. Neither is working well without the other. And yes. I'm very well versed on this topic.

<comment><USER28> >The browser mitigation's only work with the kernel mitigation's.

That's just not true. The timer precision doesn't have anything to do with the kernel mitigations.

<comment><USER29> The timing precision thing by itself doesn't twarte anything, it just makes the attacks harder or take more time.

The browser vendors themselves said this; and it's not a permanent solution as tech such as Stadia and WebVR rely on high precision timers.

But, whatever man, I'm telling you that it's stupid and you want to bury your head in the sand.

You just make these attacks more likely; I'm not going to be impacted except for a few trillion CPU cycles of idiots trying to exploit me.

You're the one who puts their entire digital life on the line by eking out 5% performance.

<comment><USER28> >The timing precision thing by itself doesn't twarte anything, it just makes the attacks harder or take more time.

Oh, so it just takes more time, so you have knowledge of an exploit? Fine, show me any PoC or similar bypassing the lower accuracy and site isolation.

You are such a big part of the problem with how this whole class of exploits have been handled. No technical knowledge, just spewing stuff like "You're the one who puts their entire digital life on the line", when we there is no indication that anything like that can transpire.

Please stop spreading misinformation.

<comment><USER29> Except that the Spectre paper already takes degraded timers into account and suggests to use a Web Worker thread that increments a value in a loop as a replacement.

This is not misinformation, _you_ are spreading "certainty" of safety surrounding a dangerous idea.

[https://spectreattack.com/spectre.pdf](https://spectreattack.com/spectre.pdf)

Even if I was wrong, and very wrong, why the hell would you choose to be less safe? this whole thread chain is absolutely baffling. Buy an AMD CPU or leave the mitigations on. Everything else is needlessly opening yourself up.

<comment><USER28> >Except that the Spectre paper already takes degraded timers into account and suggests to use a Web Worker thread that increments a value in a loop as a replacement.

Yeah, which was why SharedArrayBuffer was disabled when spectrev1 was released. It is still disabled in Chrome if site-isolation is disabled and it's still disabled in firefox.

You should really know all this if you are so very well versed in the subject.

>Even if I was wrong, and very wrong, why the hell would you choose to be less safe? this whole thread chain is absolutely baffling. Buy an AMD CPU or leave the mitigations on. Everything else is needlessly opening yourself up.

I don't run without migrations. I commented on the original parent comments threat model and that I think it's perfectly logical. And I maintain this, if your threat model is so strict, that you are afraid of speculative execution vulnerabilities hitting you through javascript, you should not run JS at all, as regular js 0days have hit while no actual speculative execution browser exploits have hit.

<comment><USER29> "Threat model is so strict" is weird to say when any ad network can access any and all memory on your desktop potentially.

That's a very wide attack scope.

<comment><USER28> You have misunderstood how the browser attacks work. They are limited to the memory assigned to the browser process. If site-isolation and the other browser mitigations were somehow bypassed, an ad-network would potentially be able to read some data from other loaded tabs.

You can't use the speculative execution vulnerabilities to just read all system memory using a javascript exploit. Like the exploit that is the topic of this post can't be used in a browser at all, as you are limited to what the JIT executes, you can't just execute TSX instructions in a browser.

You might be thinking of when you have native code execution.

<comment><USER30> The website covers a handful of things, and the RIDL exploits don't require special instructions.

> We leak a string from another process using Javascript and WebAssembly in > the SpiderMonkey engine.

<comment><USER28> > We leak a string from another process using Javascript and WebAssembly in > the SpiderMonkey engine.

They leak in flight data, using a detached spidermonkey engine, patched to make performance.now() return rdtscp at a rate of 1B/s while the victim application is spamming a load string instruction as fast as possible.

This does not allow:

>any ad network can access any and all memory on your desktop

This allows any ad-network to access random bits on the cache line. If the timing mitigation didn't already fix this, it seems impossible to me to get anything useful from it, the precision and bitrate is just too low (which is why the exploit just spams load instructions in a while 1 loop).

>and the RIDL exploits don't require special instructions.

Weird, in the new addendum it says it uses TSX, and in the PoC it uses XBEGIN. Must be a mistake.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> And yet, despite all of its security problems and issues with Intel, server vendors are buying more Intel than ever. On one hand they complain about Intel's pricing, threatening about making their CPU with POWER or ARM, on the other hand they happily use AMD as a tool to get better pricing.

The sales number dont lie, AMD doesn't even account for 10% of Server CPU shipment, and may not even happen in 2020 given Intel's new price cut.

</comment><comment><USER32> Is it possible to apply the mitigations on an per-application level in Windows? IMHO it'd be pretty useful to be able have them on by default, but disable them for specific applications where you care about maximum performance and know that you won't be running untrusted code.

<comment><USER33> Surely if you emulate a processor without speculative execution with good fidelity (Such as a good NES emulator) then the program running ON that emulator can't deduce anything from speculative execution?

Is the answer (for _home users_ ) to just sandbox some processes under an emulator layer? I'd be happy to just sandbox some sensitive processes like my browser even if it took a huge performance hit, so long as some other apps like games did not take the same hit.

<comment><USER34> Not very likely: the attacker is outside the emulated vulnerability-free sandbox, and the state of the emulator is exposed like the state of any other program.

Accessing the emulator's memory means accessing the emulated program's memory, it's just slightly obfuscated.

<comment><USER33> How is the attacker outside, assuming it's a process running on the emulator (I.e. the attacker surface here in the emulator example would be only the NES game, so he has to work with NES cpu opcodes, NES memory locations etc)?

<comment><USER34> The attacker is not a process running on the emulator, not even if you _assume_ it is. Security is about the worst case, not about hit or miss partial solutions.

<comment><USER33> I'm talking about a hypothetical future where there are mitigations in place such as running each app sandboxed in an emulator. Obviously if a malicious process can sidestep any such mitigation and run any way it wants, then presumably it can read the memory of any process too? Why would an app even need to rely on vulnerabilities then?

<comment><USER34> If this is your scenario, the attacker runs in its own emulator. A fairly thick pair of gloves, but not enough to prevent exploiting speculative execution vulnerabilities and reaching outside the emulator to poke into other processes.

As another comment points out, attacks from Javascript code that escape the browser sandbox have been demonstrated, which is exactly your sandboxing scenario minus the easy part of targeting what an emulator is emulating.

<comment><USER33> > attacks from Javascript code that escape the browser sandbox have been > demonstrated

As far as I understand you still need to be able to have some kind of timing information or cpu state available in the sandboxed program, which is possible if the emulator/sandbox runs close enough to the metal (Such as a js program in a modern browsee, because they need to be fast). Remove ALL timing info and it should be possible to make it impossible to exploit speculative execution. It might run 1000x or 10000x slower than a modern JS engine however.

<comment><USER34> I need to reiterate that optimism ("remove all timing info...") has no place in information security.

If you think you have removed all timing information sources you are aware of, many remain: those you aren't aware of at all, those you failed to recognize as exploitable, those you didn't actually remove by mistake, those that are degraded but still present... The attacker should be assumed to be clever and knowledgeable; as the saying goes, creating a system that _you_ don't know how to crack is easy.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> Ok this has been bugging me for a while. How does speculative execution roll back side effect like write to disk or send a packet on the network, when the speculation is wrong. At a guess there are safe instructions that can be run when doing branch prediction?

<comment><AUTHOR> Nothing like that happens. Writes to dram or pcie devices or data bus cannot be rolled back. You have a misunderstanding of what speculative execution entails. The things that get rolled back are writes to general purpose registers.

<comment><USER36> How is this implemented? Undoing register renaming?

<comment><USER37> Exactly. Also not committing writes that are almost in the store buffer.

</comment></comment></comment></comment><comment><USER38> Can we please have an architectural MSR to disable TSX?

<comment><USER39> The good news: There's a new MSR which lets you do this:

[https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c2955f270a84762343000f103e0640d29c7a96f3)

The less good news: as far as I can tell, Intel did not commit to how architectural this will be going forward. Considering the role TSX has played in speculation-based attacks, it appears to me to be a generic mitigation that would be great to accompany TSX wherever it is available in the future. Now that MSR_IA32_TSX_CTRL is defined, it should be easier to implement going forward.

Disclaimer: I work on Linux at Intel.

<comment><USER38> ...speculation attacks, and outright bugs in TSX, and the fact that even when everything is working it's a timing mechanism that VMX can't intercept. I really hope it becomes architectural (and gains a bit for HLE)!

</comment></comment></comment><comment><USER40> What would the performance impact be if they simply took away speculative execution (but not cashing)?

</comment><comment><USER41> Is disabling hyper-threading a via work-around for these vulnerabilities?

<comment><USER42> My understanding is that this works for many (but not all) of the vulnerabilities. Interestingly, in the past few years Intel has dramatically increased the number of non-SMT processors on their product list.

If that is going to be your personal way of mitigating the issue, you've got a choice of 4, 6, and 8 core parts at a significant discount compared to their HyperThreaded variants.

</comment></comment><comment><USER43> Lord Theo was right again!

</comment><comment><USER44> One question- do these vulnerabilities , including spectre and meltdown only help in stealing information or can they also hijack your computer to do arbitrary things?

<comment><USER45> To exploit these vulnerabilities, you already need (unprivileged, sandboxed) RCE.

These vulnerabilities "only" steal information; however that information could of course be leveraged into privilege escalation or anything else.

<comment><USER46> This isn't true unfortunately.

Being able to cause manipulate the control flow of code that already exists on the computer can be sufficient. See netspectre for an example that worked on real google cloud vms and local wired networks.

[http://www.misc0110.net/web/files/netspectre.pdf](http://www.misc0110.net/web/files/netspectre.pdf)

<comment><USER45> Wow, that is impressive.

Yes in _theory_ you could do that, but to actually exploit in practice I would have guessed couldn't be done.

<comment><USER47> Don't get too excited. From the paper: "In the Google cloud, we leak around 3 bits per hour from another virtual machine." This is, of course, under ideal conditions.

<comment><USER45> They estimated that with some dedicated hardware they could improve that by 2-10x.

Still not very useful for an attacker.

But still fascinating and impressive they could do it at all.</comment></comment></comment></comment></comment></comment>


Flag – the app that prints and mails your photos for free - <AUTHOR> https://www.kickstarter.com/projects/1306413684/flag-the-app-that-prints-and-mails-your-photos-for

<comment><USER2> Am I the only one that thinks that the picture of the woman in the "Words: Tell your pictures story" section named "Lena Campbell" looks exactly like retired porn start Erica Campbell? Just sayin'

</comment><comment><USER3> Back in the 90's, they tried to give you a free keyboard that was supported by ads. And a bar code scanner, again, supported by ads. Or free internet, supported by ads.

Good luck.</comment>


PostgreSQL versioning changes and next development cycle announcement - <AUTHOR> https://firstname.lastname@example.com <comment><USER2> Background: upgrading PostgreSQL has, until now, required a dump & restore across (what looks to the rest of the world like) "minor" upgrades (e.g. 9.4 → 9.5), due to on-disk format changes. This change brings Postgres more in line with most people's expectations; such releases will instead get a major version bump.

(I think until now, major version bumps (e.g. 8.4 → 9.0) had been reserved for backward-incompatible API changes, à la SemVer, but I could be wrong.)</comment>


A scam "conference" website set up to collect personal data - <AUTHOR> https://waset.org/conferences <comment><USER2> Why is it a scam?

<comment><AUTHOR> Check out the page for the "International Conference on Bayesian Statistics for Machine Learning":

[https://waset.org/bayesian-statistics-for-machine- learning-c...](https://waset.org/bayesian-statistics-for-machine-learning- conference-in-february-2020-in-lisbon)

What struck me was a section called "Special Journal Issues":

 _Special Journal Issues

ICBSML 2020 has teamed up with the Special Journal Issue on Bayesian Statistics for Machine Learning. A number of selected high-impact full text papers will also be considered for the special journal issues. All submitted papers will have the opportunity to be considered for this Special Journal Issue. _

Of course there is no such thing as a "Special Journal Issue". There are special issues of particular journals, for example the Special Issue of the Machine Learning Journal on Learning and Reasoning (that I was looking for when I stumbled on this page).

Every single conference on the site has the same text in this section... and in every other section with minor variations.

There are more hints:

1) The names of the conferences seem to have been generated by prepending "International Conference" in front of legit conference names.

2) The "Call for papers" page is just a list of subject fields.

3) The "Selected papers" don't have anything to do with the actual conference subjects and are in fact scraped from other conference and journal sites. For example, in the "ICBSML" page there's a paper titled :

 _Deep Learning Based Fall Detection Using Simplified Human Posture_

But if you click the link you see a pdf with this rubric on top:

      World Academy of Science, Engineering and Technology
      International Journal of Computer and Systems Engineering
      Vol:13, No:5, 2019

4) etc etc.

It's a scam.</comment></comment>


Umbrella Stand Hack with Rain Alert - <AUTHOR> http://openpicus.blogspot.it/2012/11/diy-umbrella-stand-hack-with-rain-alert.html?spref=tw

<comment><USER2> Fun idea. I like these 'ambient' indicators (I created one that shows me when the next bus is coming: [http://blog.jgc.org/2012/03/ambient-bus-arrival- monitor-from...](http://blog.jgc.org/2012/03/ambient-bus-arrival-monitor-from- hacked.html)).

</comment><comment><USER3> When will this sort of thing become affordable?

The wireless card is 50GBP+VAT and the board it plugs in to is 20. thats > $150 to control an LED wirelessly which is only a little bit insane.

I'd love to throw together little 'internet of things' projects here there and everywhere but the per-unit cost just doesn't allow it.

<comment><USER2> Well, his whole thing is over engineered. He doesn't need a PIR sensor (the LEDs can just be on all the time), he doesn't need RGB addressable LEDs (he can just connect an LED to a GPIO port with a resistor). He also doesn't need a computer with the power to handle a web server.

So, what you need is a machine that has WiFi connectivity plus GPIO plus a few components. I'd suggest that you can do this with a Raspberry Pi plus a small WiFi adapter.

Using Amazon.co.uk pricing:

      Raspberry Pi Model B:       £42.89
      Raspberry Pi Power Supply:   £3.95
      Edimax WiFi Adapter:         £8.15
      Some LEDs + resistors (est.) £2.00
      </comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>----
                                  £56.99

Which is $90. Of course, if you have any of these things (like an old USB WiFi adapter) you can cut the cost further. Or you can do as I do (see link above) and reuse old equipment. My bus monitoring project was done for the cost of the LED display from SparkFun ($12.95).

And the Pi has a lot of power to do other stuff. I have other ambient stuff in my house running off a single Raspberry Pi plus it's doing CCTV motion detection as well.

<comment><USER4> If you have some other machine on which to install a simple daemon you could just use one of these for $35

<https://www.sparkfun.com/products/10822>

It's a low-power WiFi client with a bunch of IO that you can configure to periodically do a TCP call to some server you own to get orders on what to do. If you don't mind having it always on you can invert that and have the server initiate the call. You lose the ultra-low power usage in that case. I've been evaluating it to create sensor/actuator networks and it's been great so far. It also has a serial port so your display example would work as well.

It's amazing that a full computer (the raspberrypi) can come so close to this on price but the raspberry is an energy guzzler compared to this and for anything you want to battery power that's a big deal.

</comment></comment><comment><USER5> I just want to say, that's a gross overgeneralization. I happen to enjoy rain, and don't believe in umbrellas. I tend to look at people running around in the rain with a sense of curiosity, perplexed at the idea that this fundamental element of life could somehow hurt them; as though it were not an awakening of life—a dance of life upon the dust—springing from the sky.

<comment><USER6> If it's cold out and you're wearing cotton, you're going to have a bad time. If your socks get soaked inside your boots and social conventions do not allow you to remove them, you're going to have a bad time. If you need to travel more than a mile and cannot afford the luxury of a car, you're going to have a bad time.

Alternatively, you could bring an umbrella.

</comment></comment><comment><USER7> I keep my umbrella in my car in the footwell between the seat and the door ... and forget it's there.

</comment><comment><USER8> Terrific piece of hack. Anyone know where can I find a similarly transparent umbrella stand?

</comment><comment><USER9> Great hack for home automation! It seems easy to implement and install in home.

</comment><comment><USER10> amazing hack! I'll copy this project and do it for my house. The umbrella hassle must be solved once forever! :-)

</comment><comment><USER11> Great! I love it :D</comment>


'Amazon Tax' Lands in New York - <AUTHOR> http://www.internetnews.com/ec-news/article.php/3740056/Amazon+Tax+Lands+in+New+York.htm <comment><USER2> From a bottom-line perspective, I bet Amazon would be better off if they simply dropped all affiliates based in New York and ban future New Yorkers from being affiliates. It then a) saves them the work of complying and b) eliminates the tax for consumers (my personal favorite). I believe fewer people in New York will buy from Amazon if they don't get the tax discount (except for certain books like tech books which are much cheaper than they are in stores here). And how much does Amazon make from New York affiliates anyway?

I'm surprised Spitzer had time to write up this memo given all of his other activities.

<comment><USER3> You really think any company would ignore the New York market (even just the New York affiliate market) over the extra few lines of code required to add a % sales tax to orders with a NY zip code?

If this were Vermont, maybe. But not New York.

<comment><USER4> They'd drop the _affiliates_ in NY, not all of the customers.

And to assume that the main cost to Amazon is in developer time is crazy. When the customer base suddenly starts getting taxes, the 'savings' at Amazon is lower in comparison to other competitors, and so they lose actual customers.

</comment></comment></comment><comment><USER5> Cripes! Now even our _states_ are resorting to protectionism!

I wonder how long it will be before an online retailer just refuses to ship to certain states because the tax code is too complicated there to make the sale worth it.

That brings up another interesting question, how does New York State prosecute someone in another state for a violation of NY state laws?

<comment><USER6> _I wonder how long it will be before an online retailer just refuses to ship to certain states because the tax code is too complicated there to make the sale worth it._

I bet they are hoping not long.

</comment></comment><comment><USER7> By saying that the affiliates create a physical presence, I would assume that Amazon would need to know each affiliates physical location (might not be the same as their mailing address) and need to know the local tax code and apply the local taxes as well as the state tax. Because of this, New Yorks law will probably fail in court. New York cannot make Internet companies apply only some taxes and not others it would raise a basic unfairness to the locality of the affiliate..

</comment><comment><USER8> grass roots is needed, people in New York (and everywhere) need to know this isn't right; Where were Amazon's lobbyist?! There are good things they do sometimes (this should have been one)</comment>


Ash dieback: tree disease epidemics could kill 95% of UK's ash trees - <AUTHOR> https://theconversation.com/ash-dieback-one-of-the-worst-tree-disease-epidemics-could-kill-95-of-uks-ash-trees-116567 <comment><USER2> So a fungus in uk and the emerald ash borer in North America.

[https://www.chicagotribune.com/lifestyles/home/ct- sun-0215-g...](https://www.chicagotribune.com/lifestyles/home/ct- sun-0215-garden-morton-20150209-story.html)

Here's a quote that stuck with me : "Some kinds of trees can stand for many years after they die, but the ash tree is not one of them," Corrigan says.

Don't delay, she says, because the more the tree dries out the more risky — and expensive — the job will become.

What's important here is if you have an ash tree on your property you need to take it down ASAP</comment>


How Yahoo can beat Google - <AUTHOR> http://storagemojo.com/?p=488 <comment><USER2> Google beefs up on machine learning, language processing, and research people.

Yahoo beefs up on people who actually know how to use PHP like a professional.

It's a basic difference in culture.

</comment><comment><USER3> Problem: People are lazy, Yahoo had way too many links on their homepage. While variety is nice, the first impression casual users get from Yahoo is "ok... where do I start?" For that reasons, so much of Yahoo's contents never get a chance to be viewed. To emphasize, Yahoo has great articles and analysis that are fun and interesting to read, Google doesn't.

Solution: Yahoo should change their homepage into something like Google, but add a second search bar with the label "What do you Yahoo to do today?" As someone types into the textbox, related Yahoo contents appear diretly (like the Vista search).

Bottomline: With a simple twist on the homepage, Yahoo does not really have to change much to become more popular than Google.

</comment><comment><USER4> The last paragraph is out of nowhere. Nice.</comment>


Python is One of the Most Popular Programming Languages - <AUTHOR> http://www.infernodevelopment.com/python-becoming-most-popular-programming-language#comment-10493

<comment><USER2> Here's a link to the "article", instead of to a random comment:

[http://www.infernodevelopment.com/python-becoming-most- popul...](http://www.infernodevelopment.com/python-becoming-most-popular- programming-language)

<comment><USER3> Please, can the original poster edit the link? It really doesn't make sense to link to an anchor in the template section.

</comment></comment><comment><USER3> It's true (and it's great news) that Python is becoming one of the most important and popular programming languages, but this article does a pretty poor job at showing this and explaining why.

Other than Python's popularity for web development (where it faces competition from Ruby and PHP) Python has been adopted in many other settings, and that probably contributed quite a lot to the numbers indexed. For example, in the last year many of the biggest financial institutions have moved to developing critical parts of their systems in Python. In fact, it can probably be said that Python became popular _despite_ not becoming very popular for web development until quite late in the game.

</comment><comment><USER4> I doubt I'm the only one but I really don't like python.

Python makes simple things hard. It has no switch statements, no lambdas. It has significant white space (I've tried and tried but I can't get over it).

There is no simple way to drop down to the command line which means I can't easily use it to replace the scripting I have to do on a day in and day out purpose.

On a side note I greatly prefer go's approach to white space. It's not significant but there is a piece of software that rewrites code to the "standard".

<comment><USER5> _> Python makes simple things hard._

Some examples might help here.

 _> It has no switch statements_

Python uses if/else, hashtables, OO constructs instead <http://www.python.org/dev/peps/pep-3103/>

_> no lambdas._

Python has lambdas, but their usage is discouraged in preference of explicit code blocks and named functions. You can use them if you must.

 _> It has significant white space_

The indentation level of your statements is significant, but not whitespace in general <http://www.secnetix.de/olli/Python/block_indentation.hawk>

_> There is no simple way to drop down to the command line which means I can't easily use it to replace the scripting I have to do on a day in and day out purpose._

Some people find Python usable for system administration. There is a book "Python for Unix and Linux System Administration" (2008).

<comment><USER4> > Some examples might help here.

I mostly script things so my programs are generally the type that are a bit too complicated for bash. Python makes this type of programming difficult.

For example. I want to run a command and get its output back. I'm then going to go and parse the output and preform transformations on it.

In order to accomplish this I have to use popen to open multiple pipes to the program and then read all of its output. I feel like I'm writing C.

> Python uses if/else, hashtables, OO constructs instead

Both if/else and hashtables are dirty hacks. Neither allows clean code. OO constructs can work but require large amount of setup to preform a simple task like parsing getopts.

> Python has lambdas, but their usage is discouraged in preference of explicit > code blocks and named functions. You can use them if you must.

You are correct. I replied to another person's comment but haven't/won't edit my previous post.

> The indentation level of your statements is significant, but not whitespace > in general

My apologies for using common terminology for significant indentation, significant indentation is what I meant. Either way I (subjective) dislike it. I personally find it harder to read than braces or ruby's end.

> Some people find Python usable for system administration.

I will strongly disagree here. I've tried to use Python on several occasions for system administration.

> There is a book "Python for Unix and Linux System Administration" (2008)

I'll check it out maybe it will show me somethings that change my views.

A lot of this is entirely subjective. At least for my type of work I find Python to be an annoyance more than a helper.

Though to be fair I find all languages to be pretty ugly/nasty when you take then out of their designed use.

<comment><USER6> Python is my language of choice for most things. That being said, it's not really a good choice for text processing (that is, using regular expressions) or glue scripts - I find Ruby to be an excellent successor to Perl for those.

For anything that I expect to be maintained, especially by someone else, I tend towards Python, though, because the language seems geared towards that. Significant indentation is nice because your code does what it looks like it does. Docstrings are a godsend. The approach to modules and namespaces is quite helpful _. Named arguments to functions prevent silly ordering mistakes.

_ I just finished writing up my thoughts on this in a bit of a longer form. You can read them at [http://changedmy.name/2011/02/16/why-pythons-modules- are-bad...](http://changedmy.name/2011/02/16/why-pythons-modules-are- badass.html) , if you like. I'm well aware that I'm not the best writer, nor am I the most educated or experienced person in this field, so any criticism is welcome.

</comment></comment></comment></comment><comment><USER7> The article is about the author that has been a fan of PHP for a long time and now he loves Python. This is the base of his claim of Python popularity.

</comment><comment><USER8> Its not surprising. We make extensive use of Python. Its great.

I get so busy doing so many things that I often don't develop for months at a time. This used to be a problem when I used C. With Python its a non-issue.

</comment><comment><USER9> > [...] Python, Ruby, Haskell, Ada are gaining popularity

Ada???

<comment><USER10> Defense Contractors</comment></comment>


A no-coding-required Google Reader alternative (prototype of the possibilities) - <AUTHOR> https://sites.google.com/site/usmsmnews/

<comment><AUTHOR> I cropped this together using nothing but Google Sheets and Google Sites.

It is not a bad alternative if you are of busy type and only wish to take a quick glance or view of news as it is happening on the day/time when you are viewing. It's a sort of River of News.

It is not a suitable alternative if you wish to save your feeds or even do search (something Google Reader provided as its best feature).</comment>


How I Overcame Sexism Early in My Career - <AUTHOR> https://code.likeagirl.io/how-i-overcame-sexism-early-in-my-career-286a28d3398b#.yfsgxykke <comment><USER2> No particular overcoming here, more like 98% luck and 2% smart avoidance of unwanted tasks.</comment>


An exception-like mechanism for Go - <AUTHOR> http://groups.google.com/group/golang-nuts/browse_thread/thread/1ce5cd050bb973e4

<comment><USER2> Just to note: It's a post by Rob Pike.</comment>


Hedy Lamarr - <AUTHOR> http://en.wikipedia.org/wiki/Hedy_Lamarr?

<comment><USER2> The US Navy refused to buy her technology saying it was "too bulky," only to start developing it themselves soon after the patent had expired. That may have been a pretext to avoid buying the technology, but in any case today her invention would be weightless -- implemented in software with SDR.

By the way, the movie she's best known for is boring in my opinion (especially if you don't speak German). _Boom Town_ and _Copper Canyon_ were more entertaining.

</comment><comment><USER3> The pet headcrab in Half Life 2 was named after her.

[http://half-life.wikia.com/wiki/Lamarr](http://half- life.wikia.com/wiki/Lamarr)

</comment><comment><USER4> Corel put her on their box... Now I know who it is!

</comment><comment><USER5> It's not Hedy. It's Hedley!</comment>


Agile in a Flash (Cards) - <AUTHOR> http://www.pragprog.com/news/agile-in-a-flash-cards <comment><USER2> Agile in a Flash -- is chock-full of a bunch of great insights by some real practice-based folks.

Caveat Emptor: you will not become an agile master in a flash by memorizing the cards in two days.</comment>


Online Unit Converter - <AUTHOR> Convert between most widely used Metric, Imperial, Basic, Scientific and advanced Engineering Units with just a click. There are more than 44 Unit Categories in this websit which performs more than 20000 conversions with extreme accuracy and speed.<p>Website : http://unitconverteronline.com/ Android App : https://play.google.com/store/apps/details?id=fourarc.com.allunitconverter <comment><AUTHOR> Website : [http://unitconverteronline.com/](http://unitconverteronline.com/) Android App : [https://play.google.com/store/apps/details?id=fourarc.com.al...](https://play.google.com/store/apps/details?id=fourarc.com.allunitconverter)

<comment><AUTHOR> Our Unit Converter is the most noteworthy appraised Unit Converter App in Google play store. Our application has over a Million client base.

Website : [http://unitconverteronline.com/](http://unitconverteronline.com/) Android App : [https://play.google.com/store/apps/details?id=fourarc.com.al...](https://play.google.com/store/apps/details?id=fourarc.com.allunitconverter)

</comment></comment><comment><USER2> The "Surface Tension" category is wrong. It use "Farads" as the units.

I'd like permalinks, for example to show a friend how many kg are in 3 pounds.</comment>


HN Prefers Vi over Emacs - <AUTHOR> http://blog.filepicker.io/post/27582342200/hn-prefers-vi-over-emacs <comment><USER2> Please don't feed the trolls.

<comment><USER3> I agree

</comment></comment><comment><USER4> Actually all this means is that only vi users are lame enough to use their editor in a web browser. ;-)

LONG LIVE EMACS!!!!!!!!!!!

</comment><comment><USER5> This is satire, right?</comment>


Are you a foreigner working in the US? How did you get a work permit? - <AUTHOR>

Having seen the strong job market for developers and designers in the US, I'd thought about working there in the future. However, I've been so put off by the stories of immigration (H1-B visa yearly allowances going in 5 days etc) that I've effectively ruled out working there anytime soon. I'm curious to know who has managed to get working rights in the US, and how they did it. (A couple of notes from me: I have a Masters in Design and a few years' work experience, so I do have demonstrable skills). <comment><USER2> I was not able to do it so i am in the New Zealand now - happy with 2 years work visa, residency in few years, minimal Bureaucracy as there is high demand for people with IT skills.

<comment><AUTHOR> :) Where were you originally from (rough area if you don't want to be too specific)? As much as I'd like to move back home I fear I've been spoilt by living in the UK to expect cheap and plentiful internet, great public transport, and loads of interesting opportunities!</comment></comment>


Create charts with one line of HTML! (web-component for Highcharts) - <AUTHOR> https://github.com/avdaredevil/highcharts-chart <comment><USER2> That looks like more than one line, and not technically HTML.

Check out [http://chartd.co](http://chartd.co) for one line of actual HTML (no JS required).</comment>


Bug 1130693 – bookstore.*.edu – "Secure connection failed" - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=1130693 <comment><USER2> Guarding patrons' library activities is considered a core value of the profession, written into the ALA's code of ethics: "We protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted."

Over the years, the U.S. government has tested the limits of how far librarians will go to defend that code. Near the end of the Cold War, FBI agents asked New York City librarians to watch for patrons who might be diplomats from foreign hostile powers trying to recruit intelligence agents or gathering intelligence.

[http://boingboing.net/2014/10/12/librarians-on-the- vanguard-...](http://boingboing.net/2014/10/12/librarians-on-the-vanguard- of.html)

[http://www.washingtonpost.com/blogs/the- switch/wp/2014/10/03...](http://www.washingtonpost.com/blogs/the- switch/wp/2014/10/03/librarians-wont-stay-quiet-about-government- surveillance/?Post+generic=%3Ftid%3Dsm_twitter_washingtonpost)

</comment><comment><AUTHOR> Also look for "bookstore" in: [https://bug1128227.bugzilla.mozilla.org/attachment.cgi?id=85...](https://bug1128227.bugzilla.mozilla.org/attachment.cgi?id=8560816)

</comment><comment><USER3> I'm not sure what's notable about this bug - I think most of these sites are run by the same company but that's the only point of interest I can find.

<comment><AUTHOR> I am looking for contact information.

</comment></comment><comment><USER4> What's going on here?

<comment><USER5> Following the bug comment[1][2],

In Firefox 36, they will disable TLS downgrade with "security.tls.version.fallback-limit", but Those website: bookstore.*.edu use the same server and can only use TLS 1.0 [3]. So Firefox 37 will whitelist them to use old protocols/ciphers (TLS 1.0, RC4 and so on).

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17](https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17) [2] [https://bugzilla.mozilla.org/show_bug.cgi?id=1084025](https://bugzilla.mozilla.org/show_bug.cgi?id=1084025) [3] [https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hac...](https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hacc.edu)

<comment><USER6> Why white list them, rather than showing a warning about the insecure cyphers?</comment></comment></comment>


Ask HN: Launch an App Month - What did you launch? - <AUTHOR> Curious to know how many took this up and actually launched something. <comment><USER2> Took an idea from jacquesm (thanks!): <http://fcgadgets.blogspot.com/2010/10/ad-spaces-gadget.html>

Launched this last month: <http://www.textmyoffice.com>

Some other things still in the pipe.

</comment><comment><USER3> I put up two sites this month, but I'm not sure they qualify. They don't have any chance at growing into a startup, but I'm going to list them anyway.

The first is a little game that lets you try to unscramble words [1]. It's hardest word list is from a post about the 1000 most useful words that came up here a while ago. My favourite thing about the site is that it fetches definitions and the like from wordnik so you can learn as you play. If you want to try playing let me know and I'll fix the last known bug. The focus is stolen from the input box when I check to see if the top word has changed, but I didn't fix it because I got distracted by more interesting projects.

The second is a personal website with links to my blog and a portfolio of past projects [2]. I figured starting to put together a portfolio would help to get me a job at some point and that it would be a nice way to start learning Clojure, which I've been wanting to try for a while. Still haven't decided on a domain name though.

Right now I'm working on a third project that people on Hacker News might be more interested in. I'm hoping it will bear some resemblance to Stack Overflow when it gets a little more fleshed out, but that won't be done this month. God willing it will be done some time in December so I can share it with all of you. I'm really excited about it.

1: <http://anagramscramble.appspot.com/>

2: <http://jcolessite.appspot.com/>

<comment><USER4> I enjoyed playing anagramscramble for a bit, and I think it's great timing as I'm prepping for the GRE in a couple weeks - playing your game might help my verbal score. A couple comments:

1\. You mentioned this, but it would be great if focus stayed on the input box. That would make it easy to play with just the keyboard, without having to tab.

2\. Sometimes there are more than one legitimate solution (for example: scalp, clasp) - you could try checking if the submitted word is real or not instead of matching it to the word you originally scrambled.

Thanks for an amusing 10 minutes or so.

<comment><USER3> I fixed the bug that was stealing focus. In case your curious the problem was that the code would always think the word had changed due to trying to select the current anagram with the wrong jquery selector (div instead of span).

As to allowing multiple words for the same anagram. Umm.. that not a bug that is a feature! It uhh.. it helps you to be more.. creative.. year that is what it does. More seriously though, I'm busy right now and don't think it really ruins the experience like the focus bug does, so I'm going to hold off on implementing that till I'm finished with my previously mentioned 'interesting project.

Oh and one more thing, thanks for playing!

<comment><USER5> I still managed to get my focus to escape the box when I tried playing it just now.

</comment></comment></comment></comment><comment><USER6> Here's my app for the month launched today. <http://www.previouslook.com>. Makes it easy to look back at the snapshots of popular web pages over time. So far it's a proof of concept with couple sites. Will expand to include more web pages.

Here's my other HN post about it, <http://news.ycombinator.com/item?id=1953087>

</comment><comment><USER7> I launched <http://www.hackerlunch.com>

It lets hackers meet up with each other for lunch (and hopefully an interesting chat). You basically make a post stating when and where you are free to have lunch and others can join in.

Launched it a few days ago but unfortunately haven't received much interest or feedback. I will probably release another polished version in a month and see if it gets more traction.

<comment><USER8> Make it more social. Once a lunch slot is posted, give it an unique url, encourage users to publish it to facebook/twtter, etc. Store user's location, advice if the new lunch slot can invite any existing users in the same region, etc.

Keep on working on it. Nice to have, can't see how it could be acquired, or make enough for ramien, or anything like that.

<comment><USER7> Thanks for the feedback. I noticed that you did not use the site to post a lunch-meetup, is it because you aren't interested in meeting up with others at the moment, or is it because the site lacks features?

I am working to make the interface a bit more appealing (new design: <http://i.imgur.com/KOaA8.jpg>). Then I will move on to add integration with facebook and twitter and let users do more with their posts (invites, privacy, comments, geo-tagging, etc.).

As for the future, I plan to extend this beyond hackernews and beyond lunches. Eventually you should be able to post any event you plan on doing and invite anyone. Kind of like a social network focused around events.

<comment><USER8> The site is fine. It's just me.

Good to hear that you have a plan to develop it further. One problem I have with my site is to give too much features which are not required, or I dun use myself. Do guard against that too. Less is more.

</comment></comment></comment></comment><comment><USER9> There are some already listed in this thread: <http://news.ycombinator.com/item?id=1938859>

I launched a CSS sprite generator at <http://instantsprite.com>.

</comment><comment><USER10> Launched a personal finance app 'Can I Afford it now?'

<http://caniafforditnow.com>

Get a Financial health checkup anonymously Get a second opinion before your Purchase

<comment><USER8> I think the app has quite a bit of potential. Right now, you are just focusing the user side, afford-ability side of things. Usage is more one-off.

Members option is possible.

Forward planning option to help users build things is also a possibility.

Integrate with other finance/expense tracking app will help too.

Do keep working on it. Love it to see it developed over time.

</comment></comment><comment><USER11> Instant map search for nearest hotels, foods, bars, parking, clinics etc. Launch it this month - <http://www.instamapsearch.com>

<comment><USER12> That's really cool and super fast (my god is it fast!).

If you are going to launch this, can I suggest that, rather than IP detection, you build out a series of pages for each location, e.g. New York City, London etc.

That way you can get SEO traffic (London has a non-ajax, SE crawlable page), and also provide people a better experience when they plan to go somewhere (e.g. London from NYC).

Lastly - revenue model? I assume affiliates for hotels etc? If so, you need traffic, so see my first point :)

</comment></comment><comment><USER13> I launched my personal/blog site. I also have a small app I'm hoping to get released by (tomorrow), but is not quite done yet.

<http://www.wulfpak.net>

</comment><comment><USER14> <http://droppic.com/> (<https://droppic.com/> too)

Drag-and-drop gallerys for designers to show mockups and comps.

Feedback appreciated! Was just about to post an RMS, but maybe I'll wait until the Nov rush has died down a bit. :)

(Idea from @glenmurphy's Dropmocks project from a couple months back + PSD support + big files + revisions + ipad viewer + ...)

</comment><comment><USER15> Though I started with a rough idea several months ago, I did most of my work coding <http://www.sparkmuse.com> during November. I'm not gonna make it by the end of the month, but I'll be opening the alpha in around 2 weeks. Right now most of the coding is done, I'm just on the lookout for more content to add to the site.

<comment><USER16> I love you design... Can you share any tips for these type of designing.

</comment></comment><comment><USER17> I launched <http://publiclog.com>

(The original post is here <http://news.ycombinator.com/item?id=1891808>)

It's a fun way to "log" every activity that you do (eating, drinking, working, playing, ...).

You can also see the "history" of all of your activities (Past, Present and Future)

</comment><comment><USER18> I launched a cool iPad game: <http://chopperdefense.com/>. Already have a few "paying customers" and even more Cydia freeloaders :) Now working on getting the word out and on a major update that would also bring it to iPhone, hopefully.

<comment><USER19> How are you tracking the Cydia freeloaders? This has been a concern of mine and I'm not sure what the best way to deal with it

</comment></comment><comment><USER20> I launched <http://guitaryst.com> today: a better way to read guitar tablature.

Hacker news launchpost here: <http://news.ycombinator.com/item?id=1950632>

</comment><comment><USER21> I took it up and brainstormed a product and wrote a few blog posts up at <http://WeddingBudgetBuddy.com> but I haven't launched a product yet. To me building audience is key, and I've been making slow progress getting relevant traffic. I'm going to try to launch soon.

I learned loads about starting a product (as opposed to a simple project) this month and it was incredibly valuable.

There's talk of it becoming a monthly thing, which I'd love to be a part of.

Well done to all who launched!

</comment><comment><USER5> Submitted a simple card game to the App Store and put <http://www.myspaceappstats.com/> online. If I could somehow let app developers know about it, I'm pretty sure many would visit it daily to see how their app is doing, but I'm not sure how to contact them. Tried just going through each dev and figure out their contact info from their homepage / app but that turned out to take a loong time.

</comment><comment><USER8> Launched this month: <http://tradesalerts.com> Revised it recently to include AGM Calendar, Downloadable Inc's Dividend records, etc. Low traffic, added quite a few enhancements to work in the pipline to automate things. Great to see it developed quite nicely over time.

</comment><comment><USER22> Failed miserably trying to write an app for my personal use within November. I have my back end done and ready and i need to put together a front end still. Was not possible to spend much hours due to work and also to be honest, time spent was not exactly productive i would say. Need to proceed and wrap this up soon.

</comment><comment><USER23> Launched a beta of <http://babble.ly> today. The concept was born in late October, and execution done this month. Would love feedback on it!

My Show HN post: <http://news.ycombinator.com/item?id=1954329>

</comment><comment><USER24> Haven't launched yet, but I've got half an app for planning camping trips using the new Active.com API. I decided to do it in Rails, so I was learning something brand new. It's close though. I've got a cool map mashup going at least.

</comment><comment><USER25> Launched a Windows Phone 7 App that is now in the Windows Phone Marketplace. <http://bit.ly/ezZv2t> I already know C# so making apps for Windows Phone 7 comes naturally.

</comment><comment><USER26> I took it up...but never finished :( Unfortunately this was the worst possibly month I could have picked to join. I had 2 major code releases and a bunch of late nights. Sigh...I'm so pissed!

</comment><comment><USER27> I've done a "soft launch" to begin driving traffic to ScheduleHQ:

<http://www.schedulehq.com/>

The goal is to grow organically as I build it out.

</comment><comment><USER28> I got a job.

</comment><comment><USER29> i launched <http://www.adobocode.com>

it's my way of sharing back to the community what i learned from it. a set of tutorials. hoping this will help some of my people here in the Philippines but sad to know that most people browsing it are from India and US. but still im hoping they'll learn from my site..

</comment><comment><USER30> We're right before the point of launching <http://suplify.me> .

</comment><comment><USER31> Launching a free weekly newsletter called NoSQL Weekly, which will feature curated news, articles, new releases, tools etc related to NoSQL. The first issue comes out tomorrow. You can go here, <http://www.nosqlweekly.com/> to subscribe to NoSQL Weekly.</comment>


Hulu puts itself up for sale - <AUTHOR> http://latimesblogs.latimes.com/entertainmentnewsbuzz/2011/06/hulu-puts-itself-up-for-sale-engages-investment-banks.html

<comment><USER2> Same theme over and over and it's frustrating: technology is fully ready to support streaming and on demand programming, but the content providers don't like licensing the content because it cannibalizes their TV product. And who can blame them really? They're the only show in town and they should cash in via whatever method best suits them.

The only real chance for things like Hulu and Netflix to succeed no-holds- barred, carrying everybody's content, is for them to carry their own content. Netflix is starting to do this and finally some competition in the form of fresh content is beginning to occur. Now if this behavior goes mainstream, people may stop watching traditional television in lieu of Netflix not only because they like the convenience but also prefer the programming. Then we have real incentive for the networks to get their stuff back on streaming platforms because it will no longer be a question of cannibalism, but one of losing viewersip altogether.

This makes sense in my head - hopefully it does too here ;-)

<comment><USER3> One thought I had was that Hulu/Netflix should buy the rights to cancelled shows that have popular followings and pay to have new seasons made. Obviously this is fraught with potential problems (people are committed to other projects) but it could be cool.

<comment><USER4> They would have to buy those rights from TV studios, who would for obviously reasons be loathe to part with them. Even producing their own shows is problematic, as the studios can blackball any actors/writers/directors/production people who work with them.

The television and film industry is a tight-knit group, and I can easily see them circling the wagons in order to protect their distribution monopoly.

<comment><USER5> Isn't that what Canada is for?

<comment><USER4> It's the same industry and same people. Also, our homebrew shows are mostly crap. Except Trailer Park Boys.

</comment></comment></comment></comment></comment><comment><USER6> Really throws the future of Hulu in doubt. If the big three media companies are no longer part owners, and they already see Hulu as undermining and upsetting their traditional partners, what incentive do they have to continue providing free content?

If anything at this point Hulu will be a talent acquisition.

<comment><USER7> i love Hulu and really dont like Netflix... if Hulu dies I'm going to be firing up Utorrent for the first time in a long time.

<comment><USER8> Why exactly do you like Hulu? It seems they offer the same content that exists if you go directly to TV channel websites (abc.com, nbc.com, cbs.com, etc). I never found anything on their site that didn't exist on the network's own sites.

Yes, Hulu Plus has older seasons for certain shows but so does Netflix.

If, and only if, they start streaming Mad Men or Breaking Bad then I'm in!

<comment><USER3> Do you use Kayak or go direct to the airline?

There's a lot to be said for aggregation + really nice UI. Plus they have streaming 720p (drool) and some pretty decent movies.

<comment><USER9> Netflix has HD streaming also.

</comment></comment></comment></comment></comment><comment><USER10> Hulu is probably the most surprising success on the internet today.

Remember when Google referred to it as ClownCo because of the chance they thought it had of succeeding[1][2]? Most people agreed with that assessment, given the lack of success News, Disney & NBC had with digital projects prior to that. What chance did a company have when it had to try & get them all to work together?

The Hulu CEO (Jason Kilar) has done an excellent job.

[1] [http://techcrunch.com/2007/03/22/confirmed-tv-networks- launc...](http://techcrunch.com/2007/03/22/confirmed-tv-networks-launch-new- company-to-counter-perceived-googleyoutube-threat/)

[2] [http://techcrunch.com/2007/03/23/what-we-know-so-far- about-n...](http://techcrunch.com/2007/03/23/what-we-know-so-far-about- newtube-isnt-good/)

</comment><comment><USER11> For context, last years IPO was expected to raise $300MM on a $2 billion valuation[1]. However, it was also reported that even with $240MM in revenue, a lack of long-term content licenses sidelined the whole affair[2].

What really boggles the mind is the stated reason for a sale: " _concerns that the site's success is undermining the traditional television business_ ". If Netflix can hold-on and capture enough quality content, these old-school players will eventually go the way of the big record labels. Hulu's existence actually indicated that they might have learned from the music industry's mistakes.

[1] <http://venturebeat.com/2010/10/08/hulu-ipo-report/>

[2] [http://www.businessinsider.com/hulu-ipo-knocked-off-track- by...](http://www.businessinsider.com/hulu-ipo-knocked-off-track-by-lack-of- long-term-streaming-rights-2010-12)

</comment><comment><USER12> _The popular online television site, which has been the cause of much consternation in Hollywood_

I don't get it -- why would it cause consternation? It was a joint venture between NBC, Fox and Disney as a means to make available their own content.

</comment><comment><USER13> Hulu with no content licenses is still valuable. The brand is established, they have significant traffic, the technology seems to be pretty well put together.

Maybe even valuable enough to recoup their $100 million investment.

<comment><USER14> > _The brand is established, they have significant traffic, the technology > seems to be pretty well put together._

Disagree.

If google reader couldn't use the NYTimes, ChiTribune, LA Times, etc. would it be valuable?

<comment><USER15> Yes. I don't subscribe to NYTimes, ChiTribune, LA Times or any other traditional media outlet in Google Reader and I use it every day.

Although the analogy is flawed, your point still stands that Hulu is nothing without content. The difference is that the television industry is so much more bound up in distribution rights than the web in general.

</comment></comment></comment><comment><USER16> Why doesn't Netflix buy Hulu? They seem complementary to each other--Netflix has movies, Hulu has tv. Unless this wouldn't be allowed for legal reasons.

<comment><USER17> Because the only thing HULU has over Netflix, is sweetheart content deals. Deals that are poised to evaporate for the publicly stated reason for the sale in the first place.

(the networks don't like how HULU is encroaching on their TV money)

</comment></comment><comment><USER18> Hulu feels technically _sufficient_ to me. It's about content now. A sale seems like it could go two ways:

1) They've been getting by on sweetheart deals from their owners, and once departed their licensing dries up and they are useless. (Their licensing already look pretty pathetic IMHO - for god's sake there's shows you can view for free online that you can't view _as a paying custom_ on a TV)

2) Separated from TV they can hire negotiators that are cutthroat and leave every negotiation making the content provider feel like they've been taken advantage of. Like negotiators who say "if you don't give your show A, I'm going to go to show B and give them everything they want and promote the hell out of them and bury you." And they mostly lie but sometimes do in fact destroy their opponent to make a point.

But if Yahoo buys them they are fucked, because Yahoo fucks everything up.

I assume Netflix's approach is to negotiate hard, but be willing to walk away from anything because the back catalog has become so large that no one thing is essential. Hulu isn't so different, but is strategically tied to current releases as a starting point.

<comment><USER5> _But if Yahoo buys them they are fucked, because Yahoo fucks everything up._

Viaweb?

</comment></comment><comment><USER19> Hulu should hire me as their CEO. Here's what I'd do:

1) Secure medium term content deals with all current partners. I'd like five years, but I'll make do with three years.

2) Start building my own high quality content. Try to grab someone like Sue Naegle or Carolyn Strauss (both HBO blood) to run this.

3) Pay crazy money to get DirectTvs NFL deal to Hulu+.

With all that said, I think they've done a pretty good job w/o me. :-)

<comment><USER20> Hulu is simply too small to do #1 or #3. They would have to spend phenomenal amounts of money, which they don't have - without an IPO, or perhaps even with one. #2 is doable but not a slam-dunk, it still can be hit or miss.

</comment></comment><comment><USER21> I hope netflix buys them. It would be a big step towards "cutting the cord".

</comment><comment><USER22> hope Yahoo! buys out Hulu!, and maybe even PopCap too

</comment><comment><USER23> Who'd want it, unless someone is looking to launch an inferior Netflix competitor.

<comment><USER24> Why wouldnt netflix want it? Other than Adrian is pretty damn smart in saying that netflix will only be a cloud consumer - so if Hulu is heavily reliant on their own HW infrastructure for their current delivery - then I can see netflix stating its not a good fit for their model.

<comment><USER25> 'Why wouldnt netflix want it?"

I'm pretty sure the correct question is "Why _would_ Netflix want it?" (companies don't generally acquire other companies "because why not?", at least not ones that hang around long), and I can't say I see a good answer to that. The only thing that Netflix could win with would be licensing deals, except Hulu doesn't actually have them, as they are all short term deals. If Netflix and NBC want to get together, or not get together, Netflix's possession of Hulu isn't going to affect anything either way in that case.

It isn't even worth buying them to squash them; they're doing a very good job of that on their own, and the list of buyers who stands a realistic chance of reversing that is very short.

<comment><USER26> Just to play devil's advocate here, if you step back and see, Hulu is not a bad acquisition for Netflix and why? Its because Hulu will bring Netflix the 'scale' and additional premium customers. I know a lot of people who purchase Hulu or Netflix, but cannot justify buying both.

<comment><USER25> I do not recall recently reading stories about how Hulu traffic is now 30% of the internet traffic during peak times. I do recall reading this: [http://www.telecompetitor.com/report-netflix- represents-30-o...](http://www.telecompetitor.com/report-netflix- represents-30-of-peak-internet-traffic/)

I don't think Hulu has much scale to offer Netflix.</comment></comment></comment></comment></comment>


China: Crowdsourced tax enforcement - <AUTHOR> http://www.bunniestudios.com/blog/?p=2269 <comment><USER2> In theory that's how it works - but it over-looks a price optimization that everyone uses. Essentially, when I walk into a restaurant/business to buy something, I'm in one of two situations:

a) I have some relationship with my employer whereby I need fapiaos to essentially reduce my income tax (i.e. count my personal expenditures as business expenses). Thus, I will ask for a fapiao.

b) I don't need a fapiao to write off income tax. Now, we play a simple numbers game: Say there is a 10% chance of me winning some small percent of money by receiving the fapiao. But there is a 100% chance that if I ask for the fapiao the business will need to pay tax. So, we strike a win-win deal. The business gives me a discount, that is, say, 50% of what the tax is. I pay less. They make more. Everyone but the government wins.

Other notes:

a) The lottery on fapiao has been around for a while. Its not new.

b) The above deal is less and less common in big cities as more people use UnionPay (debit cards) and businesses essentially assume that people will ask for fapiao.

c) There are a few factual errors in the article. Some restaurants, yes, provide a "stack" of pre-printed fapiaos. Most have a printer that is essentially connected to the tax collection offices computer and can print at the bill's value.

<comment><USER3> As for (c), it depends on the city and even restaurant. Many places can't afford fapiao printing machines, and so the government is more lax and lets them use preprinted anonymous fapiaos. These are being phased out, but if you leave the big cities you'll still see a lot of that, and even in Beijing we get fapiao tickets at some lower end places.

</comment></comment><comment><USER4> >>China's clever solution is to make every fapiao a lottery ticket.

That's not "China's clever solution" but quite common. They had that in Mexico already more than 10 years ago when I lived there (the cash register in stores whould print out these "lottery numbers" onto the receipt).

The fapiao in the picture is from Guangdong, elsewhere I have seen only 100 kuai with scratch off fields, not ten kuai.

<comment><USER5> Taiwan also has a variation of this, being an even closer source of inspiration than Mexico for China.

It's crazy - the cleaning staff at my dormitory was absolutely obsessive about fishing each one of them out of the trash, even though the chance of winning is terrible...a good indicator of how little some people's time is still worth, sadly.

<comment><USER6> The worth of someone's time is not determined from how much they are paid for that time.

<comment><USER5> Hm, what other conclusion would you draw from this?

<comment><USER6> Simple: They think the possibility of earning more money for their time is less than the possibility of winning the lottery.

It's a matter of desperation, not a matter of low worth.

</comment></comment></comment></comment></comment><comment><USER7> _you are supposed to receive a stack of fapiao of equivalent face value._

In the past 9 months I've never received more than one of these _fapiao_ , if they even gave it to me at all. Also, the prizes are pretty small, enough that there isn't that much of an incentive to ask for these "lottery tickets". The largest "prize" i heard about (because i've never seen anyone win) was about the equivalent of $6 USD.

<comment><USER3> It used to be more common in the past: you buy something, and the fapiao (certified tax receipt) would include some sort of scratch off thing that was like a lottery; so you had some incentive to collect your fapiao and preventing the department store from low balling their taxes.

Store owners are not supposed to recycle unclaimed fapiaos, that is definitely illegal, and many companies who follow the law to the letter (like Starbucks) make it very convenient for you to exchange your xiaopiaos (normal receipts) for one fat fapiao in bulk, since they are not gaining anything by not issuing a fapiao.

Likewise, Microsoft (my employer, an American company) doesn't require us to play the fapiao game for most of our benefits. However, we need fapiaos for any expenses that occur in China, while there are a few benefits that require fapiaos (a travel and gym benefit) that are easy to get and one foreigner-only benefit where we can get back our tax on rent if only we could ever get our landlord to issue a fapiao (unlikely, they would just jack up the rent for the taxes they weren't dodging).

And let's not get started on getting the name right for the fapiao. It must be in Chinese and it must be the official name of our company. I think for Microsoft China its something like Microsoft (China) Limited, but all in Chinese characters, and its bad if you can't write that down exactly right.

[Edit] Let me describe the fapiao game: your company (usually a Chinese one) low balls your salary (say 2 or 3K RMB a month) but allows you to claim lots of personal expensive as business expenses. Even more fun: some require you to collect fapiaos but don't reimburse you for your expenses (universities do this a lot!). Fapiaos now require the name of the company that will be claiming the tax benefit so you can't just exchange them with your friends, meaning you need to be diligent about collecting fapiaos. Taxi fapiaos are the easiest, as they don't require names (so you can collect them and exchange them with friends if you want).

<comment><USER8> If you're getting only 2 or 3K RMB per month, I think that's seriously robbery, even if you do have the ability to claim expenses on everything else. That's what only new graduates get, and low-level Chinese university new grads at that. I have a friend who just moved from IBM to Microsoft recently (we're both in China). Microsoft definitely pays more than that. I have no idea where you're getting this 2 or 3K number?

To the gp, I usually don't get fapiao if I don't ask for it, but it sometimes comes. I always get it if I ask for it, or they offer me a Pepsi on the house or something to avoid giving me fapiao. So it's always in play, as far as I can see.

<comment><USER9> I read that as "the employer pays you 2K or 3K RMB less than what it otherwise would" , not "the employer pays only 2K or 3K RMB per month."

<comment><USER8> That would logically make much more sense.

</comment></comment></comment></comment></comment><comment><USER10> If you skim read like me then you might not have understood how this works:

1\. Companies pre-pay tax by buying vouchers called `fapiao` which the article states, costs 10-20% of the kuay (Chinese yuan) value. (I assume rates differ depending on overall income of the business).

2\. A transaction takes place and the customer pays the business in yuan and receives one of these fapiao tickets as a receipt. Incentives to get this ticket is that is acts as a lottery ticket also, with modest prizes.

3\. The tax enforcement is therefore 'crowdsourced' because if any customer doesn't receive this ticket then they can report the business.

4\. Any fapiao tickets leftover can be used for tax rebates.

The biggest problem I see is that businesses have to prepay tax which is 'estimated'. If this was too high then it could cause problems for the business's balance-sheet.

Other problems the article details:

\- Not much incentive for people to collect their fapiao tickets

\- Bribes, fraud and stealing by the business due to their incentive to keep tickets

</comment><comment><USER11> In Greece they crowdsource the tax enforcement by requiring everyone to submit a stack (to a certain amount of euros) of purchase receipts with their tax filing. This is to ensure that customers always ask for receipts, so that stores always enter everything into the register (which goes into the store's tax filing).

<comment><USER12> > This is to ensure that customers always ask for receipts, so that stores > always enter everything into the register (which goes into the store's tax > filing).

It's fairly easy for a store to use a register that has nothing to do with the store's tax filing.

Receipt matching would defeat that, but only if stores submitted their receipts.

However, you can use customer receipts to estimate a store's revenue, but that has nothing to do with whether or not a register is involved.

</comment></comment><comment><USER13> With small tweaks i think all of the shortcomings mentioned here can be taken care of. e.g. provide much larger tax rebates as lottery instead of actual money. These rebates are much more beneficial to the rich who spend the most and are the ones who evade taxes the most.

<comment><USER14> Then most of the ordinary consumers(people) will confuse and lose the motivation to ask for this receipt. Because a lot of Chinese people don't, don't need and don't know how to fill tax return.

The government don't want to do that as well, because if then they are indirectly educate people there is a concept of tax return exists, which is most people don't aware of. That is a big chunk of money government steal away from people every year.

</comment></comment><comment><USER15> The lottery aspect of it makes me think of a human-powered, authoritarian bitcoin.

</comment><comment><USER16> Fascinating! In the US lottery is a tax collection, but in China tax collection is a lottery.

</comment><comment><USER17> Small Chinese correction: 元 is yuan2. Kuai4 is 块. Kuai4 is just a measure word for Qian2 (钱).</comment>


Ask HN: How does one choose a programming specialization? - <AUTHOR> How did you choose how to specialize in frontend/backend web development, mobile development, security, ML, etc?
How long did it take you from when you started programming, or started your first job?
What advice would you give to someone who's tried many things but can't seem to decide which to commit to?
Thank you.
-
A bit more personal information:
I switched from Art to CS at my university halfway through, and thought I was finally specializing and that everything else would fall into place.
At the end of college I got an offer to be an Android developer, declined it to work for my university's NLP department, then got a job as a platform engineer at a startup in San Francisco, then was offered a 50% raise to become a full-stack but frontend-leaning web developer at another, became unhappy there and started looking for a new job but realizing I didn't know what I wanted to do. Now I'm attending the Recurse Center in a week.
This has all happened in the last three years, and now I'm seriously looking hard at my career because the pattern seems unsustainable, yet none of those roles stands out immediately. I've even considered not being a developer anymore. In college I had done a lot of photo, video, and animation work. I think I'm over that though, that work is too repetitive and the software pay is too good.
To throw another wrench in, I visited Mexico City and was awe-struck at how inexpensive it was to live there, and how people at my hostel lived - remote working a few hours a week and just traveling and enjoying life. I could become a freelancer and have the same. It's appealing, but I'm worried that this is just another shiny new path that'll dull quickly, and I'd still have to decide what type of work to do.
I've been trying to talk to as many people as I can about this in order to narrow down my decision space, but it just seems to do the opposite, new options keep appearing. <comment><USER2> I didn't even recognize what I specialized in until after I retired and got retrospective. The word career and careen are so similar for a reason. My career (and those of others I think) was like a canon ball careen through a battlefield, moving in one direction, then bouncing off something into another direction and another direction and on and on. Based on my experience, one does not really control one's career so much as respond to opportunities.

</comment><comment><USER3> When in dilemma, always choose the work which pays the most.

<comment><AUTHOR> That's kind of how I got here, I kept on choosing jobs that were significantly different from what I was doing before, but were willing to give matching significant pay increases. That can't last forever though, unless I'm mistaken.</comment></comment>