GnuPG 2.1.0 "modern" released - <AUTHOR> http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html <comment><USER2> Congratulations Werner and GnuPG team!

> GnuPG now support Elliptic Curve keys for public key encryption. This is > defined in RFC-6637. Because there is no other mainstream OpenPGP > implementation yet available which supports ECC, the use of such keys is > still very limited. [1]

Google End-To-End [2] supports ECC by default. We are working on supporting Ed25519, but encrypting and signing with NIST curves should work and be compatible with GnuPG. That said, we've had a lot of compat issues, so it'll be great if Hacker News readers and GnuPG users can help test our implementation against GnuPG. You can generate keys in GnuPG and import them to End-To-End and vice versa, or you can encrypt/sign messages on one software and decrypt/verify them on the other. If you found a bug or anything that doesn't work as expected, you can report it at [https://code.google.com/p/end- to-end/wiki/Issues?tm=3](https://code.google.com/p/end-to- end/wiki/Issues?tm=3). If it's a security bug you're eligible for a monetary reward under our bug bounty program :-).

[1] [https://gnupg.org/faq/whats-new- in-2.1.html#ecc](https://gnupg.org/faq/whats-new-in-2.1.html#ecc) [2] [https://code.google.com/p/end-to-end/](https://code.google.com/p/end-to-end/)

<comment><USER3> Hopefully this is not too obvious, but what is the advantage of ECC crypto compared to what GnuPG 2.0 is using?

<comment><USER2> Speed. Key generation (and most other operations) in ECC is order of magnitude faster than in RSA, DSA or ElGamal. Last time I checked it took End-To-End's Javascript library seconds to generate a key pair in RSA, but only milliseconds in ECC.

<comment><USER4> Key gen time probably doesn't matter too much in the particular case of pgp, but key size is a big deal. Keys that you might conceivably type by hand. Keys, not fingerprints, that can fit in tweets. Or tattoos. :)

<comment> glass- Do you know of anyone with a signify (or reop) key tattoo yet?

<comment><USER4> Heh. No, I'm not trying to encourage that, but I think it's useful as rough measure of practical size for exchanging data. Like "Olympic swimming pools" is a popular measure.

</comment></comment></comment></comment></comment></comment><comment><USER5> One particularly nice feature of the new version: gpg-agent no longer just stores the passphrase and hands it out to gnupg. Instead, gpg-agent actually holds the private keys and does crypto operations with them, and never lets any other process have the private keys or the passphrase (other than the pinentry program that prompts for the passphrase).

See [https://gnupg.org/faq/whats-new- in-2.1.html#nosecring](https://gnupg.org/faq/whats-new-in-2.1.html#nosecring)

<comment><USER6> Does that kinda imply that gpgagent would be usable as a building block for programmable access to gpg, ie next-gen gpgme?

<comment><USER5> Yes, exactly; with 2.1 out, I expect future versions to start moving towards a usable "libgpg".

</comment></comment></comment><comment><USER7> This is great news, but if you're life-or-death dependent on crypto (and PGP is one of the very few tools you might ever consider being life-or-death with), you might consider letting the modernized GnuPG (and particularly it's ECC code) percolate a bit.

<comment><USER8> Looks like you know more about this than I do. Is the crypto code new to libgcrypt or just to GnuPG? Given your statement I assume it's the former.

\---

Apparently libgcrypt hasn't been updated since late August[1]. Also relevant, GnuPGP 2.1 has been in Beta for over 4 years[2].

[1]: [http://directory.fsf.org/wiki/Libgcrypt](http://directory.fsf.org/wiki/Libgcrypt) [2]: ftp://ftp.gnupg.org/gcrypt/gnupg/unstable/

\---

Just for the record, I agree that under severe circumstances choosing the new ECC features might do more harm than good. However, given the context that somebody else asked whether it's a good idea to wait for a 2.1.1 release, I'd say no, use 2.1 right away. Interpreting version numbers like that (especially when the crypto routines have their own module anyway) seems overly suspicious and might do more harm than good as well.

<comment><USER7> It's gcrypt, but I have no idea who has looked carefully at that code.

<comment><USER9> Out of curiosity, and I apologize if this is radically off-topic, do you have a list of "usual suspects" for auditing crypto libraries (GPG, OTR, etc.)?

(Or is the answer simply: the modern-crypto list subscribers?)

<comment><USER7> Thai Duong, Juliano Rizzo, Kenny Patterson's team at Royal Holloway, Daniel Bernstein, Trevor Perrin, Nate Lawson, the Riscure guys, the Cryptography Research team at Rambus.

<comment><USER10> Are there any well funded national intelligence organizations that does this, and still do public recommendations? In theory the NSA, MI5 etc should be advising their various governments and businesses on how to protect secrets (not just military, but protecting against corporate espionage, protecting journalistic foreign sources (think: Chinese dissidents etc)). Obviously the NSA have some very real trust issues -- but does anyone have an update on whether or not they've actually sacrificed large parts of their mission on the altar of total information awareness? Does Navy Intelligence still provide support for Tor?

</comment></comment></comment></comment></comment></comment><comment><USER11> > For many people the NIST and also the Brainpool curves have an doubtful > origin and thus the plan for GnuPG is to use Bernstein's Curve 25519 as > default. GnuPG 2.1.0 already comes with support for signing keys using the > Ed25519 variant of this curve.

That's great to hear, but it seems like this represents a split from the OpenPGP standard, which requires NIST curves[1]. Will other OpenPGP implementations (e.g. OpenPGP.js), start to have to offer extensions to be compatible with GPG?

[1] - [http://tools.ietf.org/html/rfc6637#section-4](http://tools.ietf.org/html/rfc6637#section-4)

<comment><USER2> Great question. The core crypto library in End-To-End has already supported ECDH on Curve25519 and Ed25519 since day one [1]. We're discussing with GnuPG team on extending RFC 6637 to include these algorithms in the OpenPGP standard.

[1] [https://code.google.com/p/end-to- end/source/browse/javascrip...](https://code.google.com/p/end-to- end/source/browse/javascript/crypto/e2e#e2e%2Fecc).

<comment><USER11> I spent the weekend digging into both End-to-End and OpenPGP.js, and it appears the End-to-End has the primitives for Ed25519, but it doesn't recognize signature packets that use Ed25519. Is there an e2e bug tracking compatibility with GPG 2.1 signatures that use Ed25519?

</comment></comment></comment><comment><USER12> Favorite easter egg: in [https://gnupg.org/faq/whats-new- in-2.1.html](https://gnupg.org/faq/whats-new-in-2.1.html) the examples showing how modern gpg works includes the identities 'Glenn Greenwald', 'Laura Poitras', 'Daniel Ellsberg', and 'Edward Snowden'.

</comment><comment><USER13> It's all well and good adding support for new algorithms, and streamlining the UI. But still, access to the key servers are done over plaintext[1]. Which could allow an attacker to modify your request/response from the keyservers.

Am I correct in believing that this is a critical issue not to address?

[1] "Support for keyserver access over TLS is currently not available but will be added with one of the next point releases. " \-- [https://gnupg.org/faq/whats-new-in-2.1.html](https://gnupg.org/faq/whats-new- in-2.1.html)

<comment><USER14> I don't believe that this is a critical issue. The PGP-trust model doesn't need you to trust neither the keyserver nor the connection to the keyserver. You are supposed to look at the actual key, and the actual signatures of the key to decide if you trust it.

Anyone can usually upload any key to the keyserver, so even if you use TLS that wouldn't make a difference from a security perspective.

</comment></comment><comment><USER15>
      - Commands to create and sign keys from the command line without any
        extra prompts are now available.

=> thanks god, at last

</comment><comment><USER16> This should allow interoperability with Google's Chrome End-to-End GMail PGP extension. I hope this ends up in package managers quick.

</comment><comment><USER17> ECC support?? FINALLY

<comment><USER18> What happened to the patent issues around ECC? I thought Blackberry/Certicom were holding that tech pretty close.

<comment><USER19> D.J. Bernstein stated that he wasn't aware of any patents that applied to Curve25519[1]. This leads to the following statement in the GnuPG v2.1 FAQ[2]:

>For many people the NIST and also the Brainpool curves have an doubtful origin and thus the plan for GnuPG is to use Bernstein's Curve 25519 as default.

[1] [http://cr.yp.to/ecdh/patents.html](http://cr.yp.to/ecdh/patents.html)

[2] [https://gnupg.org/faq/whats-new-in-2.1.html](https://gnupg.org/faq/whats- new-in-2.1.html)

</comment></comment></comment><comment><USER20> Anyone have any guidance on building this on Ubuntu Trusty?

<comment><USER21>
        # wget http://GPG/source/gpg-blah-tar.gz
        # wget http://GPG/source/gpg-blah-tar.gz.asc
        # gpg gpg-blah-tar.gz.asc
        # apt-get build-dep gnupg2
        # apt-get install devscripts ubuntu-dev-tools
        # apt-get source gnupg2
        # cd <The gnupg2 version directory something like gnupg2-2.0.26 >
        # uupdate ../gnupg-2.1.0-blah-tar.gz
        # cd <the directory uupdate tells you to cd into>
        # dpkg-buildpackage -uc -us -nc
        # dpkg -i ../gnupg2*.deb

<comment><USER22> Please, post the same for OS X (Yosemite)! I tried and it seems 'modern' requires extra libraries not present.

</comment></comment></comment><comment><USER23> Great news and congrats to the GnuPG team. A practical near-term consideration: there are plenty of installs of GPG v1 still in the wild --- people who never even upgraded to 2.0. It might not be a good idea to rush to ECC keys if you want to interoperate with these legacy installs. But for the long term, this is a great development.

</comment><comment><USER24> What's a good, cheap smartcard to use with GPG 2.1? Ideally it should support ECC as well as RSA (4096 bits).

<comment><USER25> Second that question. In fact, I'd be happy for a not-so-cheap one (up to $100). Do ECC smartcards compatible with GPG2.1 exist?

</comment></comment><comment><USER26> Another large codebase in C that deals with security. How thoroughly has it been audited and tested for bugs? Should we soon expect a new "Heartbleed"? Why or why not?

<comment><USER27> If you wrote it in a language you consider "more secure" you'll open yourself to timing attacks and loose portability.

<comment><USER28> How would you lose portability by moving to a high-level language?

Further, why would timing attacks necessarily be more or less of an issue in a higher-level language than C? This is a genuine question.

I feel like in any case, there are some things that should just not be done in C. For example, the base64 encoder/decoder that gpg uses for ASCII-armoring should not be written in C; in general any parser should not be written in C; there's no reason for the code that interfaces with the user (for example, checking a password given to gpg-agent) to be written in C. You could write these in OCaml, use the FFI to natively link them into a single executable, and you'd have safety for string handling while retaining fine-grained control of the hardware during crypto.

However, I'm skeptical that you literally cannot use OCaml to implement crypto that's secure against timing attacks. You can always fall back to C for primitive operations, and you can control the garbage collector enough that gc pauses wouldn't be an issue.

IMO, the most compelling reason not to do this is that for all its fatal flaws, C is the most widely-used systems programming language, and so it has the largest share of experts ready to review code. But this doesn't seem like a good enough reason, given the severity of memory corruption bugs.

<comment><USER29> The way you lose portability by moving to a high level language is that you don't have an implementation of that high level language for as many platforms. You're not losing abstract portability in the sense that the semantics of the high level code is very highly machine-independent. But an actual port requires an actual toolchain.

C is not inherently portable, and it takes a lot of know how, care, testing, and sometimes luck, to write C that is portable.

C is de facto portable in the sense "able to be actually ported" by having the tools --- but possibly at the cost of combing the code for nonportabilities that have to be uprooted.

</comment></comment></comment></comment><comment><USER30> Seeing as this is crypto software, is it a good idea to wait for a 2.1.1 bugfix release?

<comment><USER31> Well, this announcement refers to a beta version. Draw your own conclusions.

<comment><USER32> The _previous_ announcement refers to beta, this is the final.

</comment></comment></comment><comment><USER33> With each new release I feel kind of nostalgic. I have been using this since year 2001.

</comment><comment><USER9> Excellent news! Ed25519 signatures ftw :D

<comment><USER34> Pfft. Not Ed448-Goldilocks? I'd rather not use a long term identity key with less security than the 4096-bit RSA that people are already widely using for long term keys.

Or really, wheres the SPHINCS+Ed25519 option for pgp master keys? :P

<comment><USER35> I take your point, but honestly I don't think at this time that Curve25519 (or _properly implemented_ RSA-3072) will fall cryptologically in any reasonable timeframe without either a quantum computer or a _really_ fundamental development in factoring/discrete logs that would probably threaten RSA-4096 roughly as badly.

Ed448-Goldilocks is great, and may indeed be a good contender for certificates as it seems to represent a good inflexion point of security versus performance.

The Crypto Forum Research Group at the IRTF is currently considering recommendations to make to the TLS Working Group (and perhaps to be used more widely) regarding elliptic curves: I've been a, um, vocal participant there already. I've raised this development there, as it may spur the discussion forward.

Goldilocks is one of the potential curves on the table there. There's potential enthusiasm for recommending two curves: one strong, fast curve with ≈128-bit workfactor (quite likely Curve25519 in my opinion) and one super- strength curve, at least 192-bit workfactor (possible candidates include MS Research "NUMS" P384/P512, Curve41417, Ed448-Goldilocks, and E-521). The option of generating entirely new Brainpool-style random curves isn't off the table either, and some have been asking for that, but I'm _really_ not sold: the software performance of random curves is absolutely dreadful, the implementation can be the kind of hairball we want to avoid, those asking seem to be asking because they're heavily committed to hardware with aged generic (RSA-targeted) hardware multipliers with anti-side-channel blinding that is no longer great and doesn't work right over special primes - and besides, if we wanted Brainpool, we could just use Brainpool. (Brainpool is indeed in this GnuPG release if you want it.)

If I was not performance-sensitive and wanted the highest level of security I could reasonably get from curves, maybe I'd choose E-521, which has impressive rigidity, being independently discovered and confirmed by multiple research teams, and good performance for its class due to being a Mersenne prime. But you do pay quite a bit of performance to go from the ≈224-bit to the ≈250-bit+ range, and it's not clear to me that's particularly meaningful in all cases. (Of course, maybe PGP _is_ one of those cases, and performance isn't usually a big deal there unless it's _really_ bad.)

Regarding SPHINCS, 41KB signatures are remarkable for what they are, but not practically ideal for OpenPGP, especially with the way the keyservers are now, but you know, I could maybe live with it. I could see it start to get ugly for keys with a lot of verifying counter-signatures on them, however.

Do remember OpenPGP _doesn 't_ bring everything to the table: for example, forward security. And MUAs have a reputation for _awful_ UX regarding it - operator error is extraordinarily frequent. But it seems to at least be Pretty Good in practice. Thanks Werner & team!

<comment><USER34> I'm kinda bummed that all the considered sexy curves are cofactor!=1, beyond losing a bit of rho security, it makes implementations more complex and complicates derivation schemes. (I think it also shows there is more flexibility in supposedly rigid schemes than people give credit for; IIRC brainpool _required_ cofactor 1, but a speedup is suggested (montgomery ladder instead of using a slower constant time addition law) and tada, relaxed in future curve specs. This is especially acute for PGP where performance on this sort of scale is basically a non-issue: practically no one needs to verify tens of thousands of PGP signatures per second.

Indeed, PGP doesn't bring everything to the table (You fail to mention non- repudiation, but the fact that I can't authenticate a pgp message without producing a transferable signature is a pretty big flaw for general correspondence)... but, considering the the limitations and usability concerns, it appears to me to be most suited and widely used for higher security applications authenticating software distributions with long term keys, which effectively all the rest of our computer security ends up resting on it. Other things end up being protected by OTR, TLS .. or not at all. :( We effectively have no general widely deployed "high security" option for long term person to person encryption and authentication except PGP.

<comment><USER36> This is incorrect. Cofactor 1 does not have a complete addition law, nor did original specs forbid cofactor >1 on security grounds. The Montgomery ladder doesn't have certain kinds of weaknesses common in naive implementations of Weierstrass form addition. Clearing the cofactor is easier. I can fit Montgomery ladder in 10 lines, and can't do that with a secure Weierstrass implementation.

</comment></comment></comment></comment></comment><comment><USER37> GnuPG scares me. In all kinds of ways.

And Werner Koch must be some kind of demi-god.

<comment><USER38> I'm curious, why does GnuPG scare you?</comment></comment>


Building your own apps with Zengine - <AUTHOR> http://research.gigaom.com/2014/09/building-your-own-apps-with-zengine/ <comment><USER2> minor nit: Plugins allow you to customize or extend a Zengine applicatoin by a</comment>


Notifo (YC W10) Will be Shutting Down - <AUTHOR> http://blog.notifo.com/notifo

<comment><USER2> Sad to see this go. On a more positive note, I'm really impressed with this shut down notice.

It gives a brief explanation of the situation, clear indication of what might happen next and alternatives that people might consider.

I've had to draft one of these before so I know it's difficult. Especially the part where you mention alternatives because there's no going back after that. The only thing I'd have done in addition is to email the same message to all users (but that might already be in progress - Edit: It is).

Kudos and thanks for the service so far.

<comment><AUTHOR> Thank you. I worked very hard to make sure that the announcement was as 'professional' as possible. I've seen too many other companies get railed for poor interaction with their users when shutting down, and I wanted to avoid that.

I sent an email to all service account owners with the same information to make sure that they read it, since they will be impacted the most by having to switch to a new solution.

<comment><USER3> I'm curious, have you considered leaving the site online, but charging a small amount per month for personal access?

I'm guessing there might be a fair number of people (myself included) who will miss it, and it might at least provide you a little extra income on the side without too much effort or expense.

<comment><USER4> Agreed. I too find the service useful enough that I would be willing to pay for it.

</comment></comment></comment></comment><comment><USER5> Chad, I am sorry to hear about this. I understand the frustration and other negative feelings associated with shutting down something that you've put a lot of effort and hope into.

I have a question. You mentioned that Notifo never gained enough traction with publishers or consumers. Can you share with us some of the metrics around this, in terms of targets and actual usage? Also, what are some of the things you tried to do in terms of marketing when it was clear that word of mouth and the other methods weren't working?

</comment><comment><USER6> Wow...kudos on having the balls to a) admit this finally - especially given the implicit pressure you must feel being a part of YC with PG's "perseverance is everything" mantra. and b) admit it so candidly and publicly.

Why could you just not leave it running (on Heroku's free plan for instance) and not maintain it for a while and see what happens?

Or did you do this already and realized that it needed you hands-on daily to work?

Or is there some pre-text to have taken money from YC and Yuri Milner that you basically have to officially kill it and liquidate everything?

<comment><AUTHOR> Well, I didn't get the Yuri money (that started two batches after mine), otherwise the runway would have been much longer.

The system is too custom to run on any of the Heroku-like services out there. I'm exploring other potential options, but I'm not one to give out false hope.

<comment><USER7> Just my opinion, but there's no shame whatever in killing it dead, and it is probably optimal for both you and your users/customers. I take a salary to be the on-call ops guy for my services. If Notifo isn't paying the bills, _the heck with that_. A server dying at 3 AM in the morning is your problem if _and only if_ you are getting compensated to worry about that.

You have a life to lead, at Twilio (or wherever) and all the parts of your life that are more important than working. The Notifo chapter is over. Much love to users from those days, but they don't get a moral claim on your time until doomsday because you happened to write some code that one time.

It's also maximally in their interests to be clear about this: Notifo is going away. It will not be improved, it will not be maintained, it will not be supported, it will probably not be turned into whatever some does-not-do-this- for-a-living person thinks is an ideal way to continue providing service to them for free to far-too-cheap. If your notification needs matter to you, start transitioning now.

<comment><USER8> Patrick -- are you going to change the name of Appointment Reminder now? I think I remember you posting that you had notiphone.com registered for it - but went with the boring name option instead of clashing with a new yc company.

<comment><USER7> Prior to reading today, I would have said "I might change the name of Appointment Reminder at some point in the future, but have no specific plans to do it in the near future." I think that's pretty much still true.

<comment><USER9> Plus "notiphone.com" sounds like an anti-Apple website.

<comment><USER10> FWIW, I read it as Not iPhone dot com at first.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The founder's post: [http://blog.jazzychad.net/2011/09/08/fouling-out-moving- on.h...](http://blog.jazzychad.net/2011/09/08/fouling-out-moving-on.html)

</comment><comment><USER12> So what am I going to use for my HN replies notifications and my retweet notifications now?

I always liked notifo, and this is a sad day for software.

<comment><USER13> Boxcar (<http://boxcar.io>) can send you retweet notifications, and I'll be reaching out to pg here shortly to add Boxcar support for HN notifications.

We would love to have you as a customer.

<comment><USER4> Is there any chance you'll support Android devices in the future? That was one of the huge selling points of Notifo, that it actually worked on more than just Apple products.

<comment><USER13> Yes, definitely. If you have an android device and would like to beta test it, email me (boxcar.io/about) and I'll send you a link.

Please help spread the word in return. :)

</comment></comment></comment></comment><comment><USER14> Kudos for the perfect message. Sad to see it go, though. It works so well and it's so easy to integrate. I'd gladly pay for the service, even the basic level, simply for the ease of use.

Why can't we save notifo?

<comment><USER15> Very sad to see it go, Notifo is probably one of the most frequently opened apps on my iphone. I'll second the sentiment: I'd gladly pay for the service.

</comment></comment><comment><USER16> I've been using Notifo for almost a year now (I think) and I always liked everything about it except the fact that it was free. I couldn't see how the company stands to make money without charging users.

So I always suspected this moment would come and I always wondered — why not simply charge people? I would have gladly paid, say, $20 a year — just for the limited amount of notifications I receive. It's a valuable service that appeals to an audience that values their time. Sure, you can hack your own notification system, but why bother if someone already did it for you?

I use Notifo with github, my monitoring systems, my backup systems and a bunch of other things. Again, charge me on the order of $20-$30 a year, and I'll pay.

<comment><USER17> I think the problem was they couldn't find enough people who wanted to use it for free, to bother trying to charge some of them with a premium package.

</comment></comment><comment><USER18> Seriously bummed. This was a reliable and (very) useful service for all of our environments on EC2. We had it tied in with Nagios and it worked quite well to alert us of issues.

Since this is official, we will probably start relying on PagerDuty now.

</comment><comment><USER19> Sorry to hear this. I am a technologist at Cisco and I enjoyed showing the capabilities of Notifo in tech demos (for example, having a virtual assistant send links to my phone).

</comment><comment><USER20> Them shutting down is going to have some interesting side effects with their Github integration. Wish Github would buy them up and continue running the service.

<comment><USER13> Boxcar (<http://boxcar.io>) offers Github notifications. We would love to have you as a customer.

<comment><USER20> Yeah, signed up yesterday at the request of a coworker.

</comment></comment></comment><comment><USER21> Damn, that sucks. But why don't you try to make money in a different way? When I look at <http://notifo.com/pricing> I can't see you making (immediatly) money with this strategy. I think you'll have to become really big before services will pay for it.

I read in the comments that people like the github notifications, why not focus on developers & try to ask eg. $27 a year for it? I think if you look for low hanging fruits, you can certainly make a living from it. And once you do that, grow, grow,.. :)

</comment><comment><USER22> Will you think about open sourcing the backend? Or selling it?

<comment><USER23> There is a similar type thing at www.notify.io which existed before notifio was around anyway.

<comment><USER24> Here are the bad news: it's also owned by another twilio employee and the single person behind it doesn't listen to the community, nor cares about it.

</comment></comment></comment><comment><USER25> What a bummer. I integrated notifo into my (as yet unreleased side-) project, and it was really easy to get going. The main purpose of my app is to send alerts, and I'd planned to highlight notifo integration as one of the features.

Good luck on your next adventure, Chad!

</comment><comment><USER26> Sucks to see this happen, and to see Convore (which jazzychad wrote an iPad app for) floundering as well.

<comment><USER27> What indication is there that Convore isn't doing well? What is the measure for success for it?

<comment><USER28> Two of the three founders left to do a new startup.

<comment><USER29> Source? (Edit: I believe you. I am just curious what they are doing now)

<comment><USER30> <http://boilerplateinc.com/>

<http://cantwa.it/about/>

</comment></comment></comment></comment></comment><comment><USER31> It was a great ride! Have fun with Twilio and come by for a drink after your first day. :)

</comment><comment><USER32> I'm the author of Howl (<http://howlapp.com>), another alternative for general push notifications.

Howl supports notification icons, stores notifications locally for offline viewing, and is a universal app. There is an official Growl plugin, and API for integration elsewhere.

<comment><USER33> Love the name "Howl", whoever came up with that should get a bonus.

</comment></comment><comment><USER34> Sorry to see this go. "Create a Notifo plugin for automation platform" has been at the top of my second-tier TODO list for quite a while. I hoped to be a big commercial purchaser of Notifo services. There's definitely a need for a unified notification system, but I respect that you need out and need a way to pay the bills. I only hope that the other services are as easy to interface with and support as many platforms as Notifo. Good luck in the future!

Edit: if there's any way for a paid option to keep Notifo going as a zombie process, please let us all know.

</comment><comment><USER35> That's a bummer. Any chance of a public release, to keep it alive? Also, Hacker news will need an update now.

<comment><USER36> I was just thinking this. It seems incredibly selfish to put software into its grave simply because the current developer can't afford to continue working.

</comment></comment><comment><USER37> Sadly, my own project 1pix.me, which is based on Notifo will probably shut down when Notifo shuts down, as I probably won't have the time to change over to a different service.

But thank you for the great service - it was great while it lasted (I got your email earlier today).

<comment><USER37> I do want to add that as a developer who used the API to send 37916 (and counting) notifications, I fully expected to get an email one day asking for money. I never did, and that makes me sad.

</comment></comment><comment><USER38> This is a shame. Notifo was a great service, and to add insult to injury, I just finished adding Notifo support to my side project (<http://loglet.radbox.org/>) _yesterday_. [https://github.com/sampsyo/loglet/commit/4b6923f7aaf9b076cdc...](https://github.com/sampsyo/loglet/commit/4b6923f7aaf9b076cdc404988216a23014577172)

I found the API straightforward and intelligible and signing up a new service was a breeze. I hope one of the alternatives is similarly well-designed.

</comment><comment><USER39> I'm sorry for the founder that this didn't work out.

However, I always find it a bit crappy when services just suddenly shut down. Was there not the option to ask users for more money and/or donations?

Perhaps just being naive here and I admit I know nothing about Notifo... but it does seem like there's a systemic problem with innovative startups suddenly shutting up shop after running out of cash when perhaps they could have turned things around if they'd admitted to their customers earlier that they were short of cash.

Any thoughts?

<comment><USER40> the economics might not work out. if it brings in $30k a year, it's not worth the long days and exhaustion of keeping the service running.

i'd be comfortable paying about $10/yr for my account (since i don't use it a ton) but at that rate it's hard to make a living and justify the time and effort. notifo is really handy but it's not something many people want to pony up for.

<comment><AUTHOR> Yes, exactly. As a consumer product the numbers would not add up, sadly. There are other factors on the publisher side that led to this; I'll be doing a more in-depth post mortem at some point.

<comment><USER39> So basically it's the business model that failed, rather than you personally. You had an idea that seemed good enough to spend time on but the market just wasn't there. No shame in that. Better luck next time!

</comment></comment></comment></comment><comment><USER24> Have you considered releasing the code as open source and turning the current notifo service into a paid service or something like that?

I'd happily contribute to the source.

I've given both notifo and notify.io a shot, but they both lacked a lot of features along with an extensible API.

It looks the only way to do it is to either extend something other than notify.io or write something like this from scratch.

Whatever your decision might be, I hope notifo will continue to exist under one form or another.

</comment><comment><USER41> That's sad.

I've used Notifo to be notified about HN replies and I'd say it was very useful. GitHub integration was useful, but I've actually used it only once or twice.

What was a major turn-off to me is lack of GNU/Linux client and client API. Thanks to HTTP notifications, I were able to hack my own desktop client, but it was a kludge far from being convenient.

</comment><comment><USER42> Notifo always seemed like a perfect acquisition for a number of the services it integrated with. I would have imagined Twitter snapping it up well before Bagcheck – it's a real shame no one ever bit.

Chad obviously knows his stuff, though. I'd imagine he's learned an enormous amount from the experience, and I'm looking forward to seeing where he goes next.

</comment><comment><USER43> Good luck, Chad.

A while back, I hit a point where I felt like my startup wasn't going to make it. I needed a change. I took a job with an established startup, and about a year later, I was ready to move on and do my own thing again.

This is a marathon, not a sprint, and you have quite a while to make your mark.

</comment><comment><USER44> Thanks for the work - I loved notifo and have it hooked up through Growl to ping me when important things happen. It pains me to need to search for a replacement when it worked so well, but after all, nothing is permanent. Good luck with your future endeavours.

</comment><comment><USER45> Sorry to hear that Chad, I've already mentioned it to ya many times but keep working hard, lots of us out there recognize and appreciate the work you've put in (and enjoy reading your code). You'll make it one day even if it was not as easy as you imagined

</comment><comment><USER46> FWIW, I'd have paid $50 p.a, I don't have many notifications setup but those that I do are important enough to actually prefer to pay for the service. Thanks team Notifo!

Anyone know of anything similar that works with Android?

</comment><comment><USER47> Sad to see it go, but good on you for having a solid go at it. No shame at all. Something to be extremely proud of for seeing the entire life-cycle of a company from the inside...something you can't learn any other way.

</comment><comment><USER48> Damn. Notifio was one of the more immediately awesome ideas I'd heard. Sad to see it wasn't able to become a thriving business.

Good luck Chad. Excited to see what you make next. High hopes.

</comment><comment><USER49> One of the most inspiring comments on this post - 'Sad news. Congrats on what you achieved though. Much respect. Best wishes on your next project.'

Seriously, chad, Congrats. :)

</comment><comment><USER50> I've been a heavy user of notifo myself, and will be sad to see the service go. Also agree that the notification was very professional and should set an example for other services.

</comment><comment><USER51> sorry to hear, chad. i relied on the android app to send notifications from various things to my phone without sms.

anyone know of a free android alternative that uses c2dm?

</comment><comment><USER52> A shame, I actually use this. Not as much as I'd want, but Github and Pingdom notifications are very very handy.

Any other simple Pingdom notification systems for Android?

</comment><comment><USER53> Definitely sucks to have to shut something down. Best of luck in the future, and I'm sure having to do this will help then too.

</comment><comment><USER54> It's sad to see Notifo shut down, but this is beginning to feel like 2000 all over again. There are simply too many startups.

<comment><USER16> I think there are too many startups that don't even try to charge users. If the word "free" is all over your web page, I'm immediately worried.

As we can see from this discussion, there are people who would gladly pay -- obvious question is how many and whether they would support the business.

<comment><USER55> Yes, but it's sad that they didn't even try to charge...

</comment></comment></comment><comment><USER56> anyway we can get a post mortem, about what you learned, could of done better or different, things like this ?

<comment><AUTHOR> Yes, I'm planning on doing this at some point, but it might be a while.

</comment></comment><comment><USER57> Sorry to hear this.

I'd like to know, though, how many users did the service get?

</comment><comment><USER58> I really like this service; I use it everyday. I'll be sorry to see it go.

</comment><comment><USER59> It was great while it lasted.

</comment><comment><USER60> why dont you just ende the free service and start charging?

</comment><comment><USER61> What killed the service for me was the lack of .io domain.</comment>


Show HN: Airgram - Send iOS/Android notifications, without building an app - <AUTHOR> http://www.airgramapp.com <comment><USER2> Ok, so having tried the app — I won't actually use it until there is a "quiet hours" setting. Notifo got that perfectly right: there are certain hours where I do not want to be interrupted by notification sounds from the service (but I might want to keep other sounds on).

<comment><AUTHOR> Yes, absolutely. Quiet hours will show up in a day!

</comment></comment><comment><USER3> I like the idea of unified notifications, but ultimately you have the chicken- egg problem, and for that you need to find an entry point. I'm working on the same problem and whoever solves it, it will create some great value. Can't wait until notifications get detached from email.

<comment><USER4> excuse me, but what kind of chicken-egg does he have??IF someone needs notification pushed to their phone, they can use his simple web/app. There is no chicken/egg here...

<comment><USER3> users are not gonna download the app unless many services are using his api, and not many services are gonna use his api unless there is a big user base ... sounds like a prime example of chicken and egg

<comment><USER5> The way I see it is that non-mobile application owners can recommend their customers to install this app, rather than create and publish a new one just to listen for notifications.

That's why I don't see the chicken-egg problem.

<comment><USER4> exactly! pretty much everyone in "too expensive/too complicate/we don't want this know" wagon that still want to have some sort of presence on the mobile devices could still have it without any investment other than redirect to his site.

<comment><USER6> This approach is exactly the opposite of what users want on mobile devices.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Push notifications are a great way to consume time-sensitive information, like price/airfare, sports, stocks, app reviews, etc. Airgram makes it dead-simple to deliver these alerts _without_ having to build your own app, so that you can focus on building interesting services.

Give it a spin! <http://www.airgramapp.com>

"I think notifications will become the primary way that we consume on the mobile device and may be the reason we move away from downloadable software and back to web based software on our mobile devices." - Fred Wilson (<http://www.avc.com/a_vc/2011/03/mobile-notifications.html>)

<comment><USER7> Congrats on the app, it looks nice.

I launched Pushover (<https://pushover.net/>) this week, which looks to be pretty much the same exact product as yours: an HTTP API to push messages to an iOS and Android client.

I built it over the past 4 weeks to replace my use of Notifo, which shut down last year. There are a few other apps already available, like Prowl, Boxcar, and NotifyMyAndroid, but none were cross-platform, so I built Pushover.

I am charging for my app as a way to pay for the server costs, as I'm not sure how else these types of apps can make money and stay around. Notifo had a lot of users but their apps were free and I don't know if they even had any paying content providers pushing large amounts of messages. How do you plan to make money with yours?

<comment><USER2> So did Notifo actually shut down or not? I mean, it still works for me, and the web page is up. I offered many times to pay for the service.

<comment><USER8> It's still running, but I'm not working on it, so it's kind of in zombie mode. There are some plans afoot, but I can't talk about them yet... however, you should assume it will go away. I will try to give 30 days notice if/when the plug is ultimately pulled.

<comment><USER2> Thanks! It's refreshing to have such an open conversation and you deserve high praise for it. I can now look for an alternative.

As to Airgram, I'm worried because I don't see where they charge money. Pushover looks much more reasonable for me. I became wary of "free" — what "free" usually means is that eventually I am either a) bombarded with ads, b) the service disappears because there is no money or c) somebody acquires the startup because of their stellar subscriber growth (remember "free"?). In all cases I am left out and have to re-invest my time into looking for an alternative.

I also noticed over the years that the most stable and trouble-free services are those which I regularly pay for. I'm quite happy with SmugMug and Squarespace for example, even though there are free alternatives in each case.

Funny how this perspective is different from what you hear if you are a startup founder: as a founder, you are supposed to "build something people want", and the rest is supposed to sort itself out. But if you do build something people want, but never charge for it, you end up disappointing those people sooner or later...

jazzychad, thanks again for the frank statements and giving us the time to find another solution!

</comment></comment></comment></comment></comment><comment><USER9> Can you explain how Airgram compares to (now deceased) Notifo?

<comment><AUTHOR> We believe that mobile web apps need to become much more powerful than they are today. Developing native apps for various platforms is not easy, and frankly, unnecessary for most services. This is just our first step in bridging the gap between native apps and mobile web apps.

We are looking to provide a suite of services around notifications that not just make it easy to deliver the notifications, but provide better targeting, management and analytics.

<comment><USER6> > Developing native apps for various platforms is not easy, and frankly, > _unnecessary for most services_ [emphasis mine]

I think the fact that you've developed a native app here provides sufficient falsifying evidence for this declaration.

When looking for the optimal (for the user) solution, the decision as between a web site or a native application should be made on the basis of user requirements, and the solutions that best meet those requirements, not based on the technologies that you, personally, are comfortable with.

If you ignore an organization's existing investments in web engineering and web-focused infrastructure, webapps aren't empirically and objectively easier or cheaper. Rather, they're a mechanism by which an organization can leverage money they have already invested in building a web-centric team.

I see this as a temporary state, initially caused by the rapid adoption of the web, and will ultimately disappear as more broad, less web-centric development experience and infrastructure investment becomes the norm.

<comment><USER10> You're right, native apps will win out. Just like they did on the desktop..

<comment><USER6> How is ChromeOS doing?

</comment></comment></comment></comment></comment><comment><USER11> I am really skeptical (though I'd be more than happy to see someone prove me wrong) about these "framework" apps, that doesn't actualy do anything by itself, except to provide an API of some sort for others to take advantage of. They reminds me of those obscure ActiveX plugins (3D model viewers, etc) that sites make you install. I am usually somewhat hesitant about getting them on my computer unless a see great value (eg growl), but I suppose I'll be even less willing to have these on my iPhone, as an app that sits somewhere on my home screen. My users might feel differently about this, but it certainly would be very difficult for me to explain to them what is it that they are installing and the experience could become quite confusing.

<comment><USER12> I would really like to send mobile push notifications to users of my service. (I send emails and/or SMS right now.)

Developing an iPhone & Android app - even a simple one that simply lets me alert users - is beyond my mobile dev abilities, and (I assume) would cost tens of thousands of dollars for someone to build.

Airgram might be the answer for me to let users get push notifications as an alternate alerting mechanism.

<comment><USER13> Thanks for considering Airgram! We would love to chat with you to understand how you plan on using us, and what new features you would like to see. Please e-mail me @ tommy at aircrunch dot com if you have some time to chat.

</comment></comment></comment><comment><USER14> would be nice if I, as a Service Owner, could see how many subscribers the service has.

<comment><AUTHOR> This first version is light on management features for the service owner because we wanted to get it out early to get feedback. What you suggest is absolutely on our list of things to do soon.

</comment></comment><comment><USER15> I like this. I do think my phone is starting to become a bit too noisy though (too many text messages that start being more like email) and I am not sure how to keep it all organized. Perhaps you guys can help.

<comment><USER13> Thanks for the feedback! We are thinking about various ways to give users a good, easy-to-understand set of controls to manage the noise. Stay tuned.

</comment></comment><comment><USER16> Have you figured out how could a website determine if your app is installed? It'd be cute to have a reddit style notification when people reply to your comments in a forum etc.

</comment><comment><USER17> Just curious - what's your privacy policy? Are you storing any of the messages that get pushed through this service?

<comment><USER13> Tommy here, Airgram co-founder. Currently, we are storing these messages, but if our users have some use cases that require messages to not be persisted, we'd be happy to add this feature. Do you have a use case in mind? Would love to hear about it -- e-mail me @ tommy at aircrunch dot com

</comment></comment><comment><USER18> The API page seemed to break on smaller resolution pages (read: thinner).

<comment><USER13> Tommy here, Airgram co-founder. Thanks for the bug report; we are looking into it. Which browser are you using?

</comment></comment><comment><USER19> Boxcar?

<comment><USER20> thanks for the mention josh. it's pretty cool that you know we exist.

-jdg

<comment><USER19> i think i learned about it on HN.

i was using it for home automaton notifications a while back.</comment></comment></comment>


Photographer Jacob Riis showed "How the Other Half Lives" in 1890s NYC (2017) - <AUTHOR> https://mymodernmet.com/jacob-riis-how-the-other-half-lives/ <comment><USER2> If you are in NYC, I recommend the Tenement Museum's tour of a preserved apartment from the time.

[https://www.tenement.org](https://www.tenement.org)

[https://www.tenement.org/visit/tenement-apartment- tours/](https://www.tenement.org/visit/tenement-apartment-tours/)

<comment><USER3> If you live in NYC, you might be underwhelmed. I toured a couple years ago, and my main reaction was "This looks like a bigger version of my current apartment!" A huge percentage of the walk-up buildings in Manhattan are from the tenement era, so it's pretty likely that you or a friend already live in one.

<comment><USER4> I live in NYC with my wife and two kids in a 1 bedroom unit in a prewar building. I've never been to the Tenement Museum and it sounds like I don't need to.

<comment><USER5> 1 toilet or outhouse per 20 people? (The Tenement House Act of 1867, [https://www.history.com/topics/immigration/tenements](https://www.history.com/topics/immigration/tenements))

"The Conquest of Pestilence in New York City" [http://eportfolios.macaulay.cuny.edu/tenementmuseum/files/20...](http://eportfolios.macaulay.cuny.edu/tenementmuseum/files/2013/05/Screen- Shot-2013-05-12-at-1.47.15-AM.png)

<comment><USER3> That was the most interesting part to learn about for me, but they don't have the outhouses, and many of the tours are in units that were retrofitted with indoor plumbing and bathrooms later. Those units look essentially the same as they do now, except they have older furniture and kitchen fittings.

</comment></comment></comment></comment></comment><comment><USER6> The older I get the more of a connection I feel with historical images/video/audio. Viewing life on this planet without the constraint of time feels as profound as contemplating the depths of space. It's just out of my reach, but I keep reaching for it because that is where the answers are. Some things seem to be in a constant state of change while others remain in a constant cycle.

</comment><comment><USER7> If you're in Seattle his photographs are currently on show at the National Nordic Museum until March 15, 2020. [https://www.nordicmuseum.org/exhibition/riis](https://www.nordicmuseum.org/exhibition/riis)

</comment><comment><USER8> from a photography standpoint, Jacob Riis is one of the most interesting characters in the field. He committed one of the cardinal sins of photojournalism: many of his photographs were lies, with staged subjects. He spent effort to make the conditions look worse than they were- for his own gain, and also likely because he really believed in showing the conditions of urban life.

many outside of photography will overlook fussy criticism of Riis- his work helped pass laws that positively affected the lives of millions, who cares if he directed street urchins where to sit and made situations seem more desperate than they actually were? after all, the conditions were often extremely desperate.

but his job as a photojournalist was to portray things as they were- especially since he portrayed his photos as journalism. arguably, his photos also flattened the immigrant experiance to poor, crime ridden, and full of disease, rather than poor, crime ridden, full of disease, full of opportunity, and often with a great sense of community that made up immigrant life at that time. He also directly profited from simplifying and lying about urban life.

to me, Jacob Riis symbolizes how positive change isn't always done by the most scrupulous of actors, and the complicated relationship of truth and nuance with social change and politics. in order to pass a law, society often needs to have an uncompromisingly negative opinion of whatever status quo will be overthrown.

[https://research.steinhardt.nyu.edu/scmsAdmin/media/users/gr...](https://research.steinhardt.nyu.edu/scmsAdmin/media/users/grp224/downloads/hasiariis.pdf) [https://en.wikipedia.org/wiki/Jacob_Riis](https://en.wikipedia.org/wiki/Jacob_Riis)

<comment><USER9> It's a hard question. Ultimately it's a does the end justify the means type of question. I suppose if you agree with the result then yes maybe, if not then probably not.

I don't know in this particular case how far the truth was stretched but we see this every day in for example advertisement and I think kind of expect it. I do wonder though if there is a version of the world where we can all present the objective truth, or as close to it as possible and have the "right" outcomes. I suspect not, since then you'll be at a disadvantage to those who stretches the truth a little.

<comment><USER10> I wonder how his audiences back then perceived this issue. The indoor pictures he made by just entering and firing a pistol with magnesium (later a frying pan). The outdoor ones he had to stage to some extent because of the long exposure times. Of course he took advantage of this, and the immigrants also wanted to pose for the camera. For anyone back then knowing anything about photography (which in his audience might have been quite a few) it should have been obvious that e.g. the photo of three boys stealing from a drunk man was staged, you could not make snapshots of quick actions.

</comment></comment></comment><comment><USER11> _How The Other Half Lives_ [0] really is a worthwhile read, if you're at all interested in the history of NYC or of social reforms, or just want a reminder to be grateful for your own modern middle-class living conditions. The poverty described can be deeply overwhelming.

It's also basically the American counterpart to Engels' classic _The Condition of the WOrking Class in England_ [1].

[0] [https://www.gutenberg.org/files/45502/45502-h/45502-h.htm](https://www.gutenberg.org/files/45502/45502-h/45502-h.htm) [1] [http://www.gutenberg.org/files/17306/17306-h/17306-h.htm](http://www.gutenberg.org/files/17306/17306-h/17306-h.htm)

</comment><comment><USER12> Fantastic to see this, and great timing as I just finished reading "The Rise of Theodore Roosevelt".

Roosevelt befriended Riis and the journalist had a large influence on him and his policies. As Riis confidence in Roosevelt's political perspectives grew, he also helped promote TR through his journalistic work.

I would recommend the book greatly for anyone interested in the politics of this era, or just Roosevelt himself.

[https://en.wikipedia.org/wiki/The_Rise_of_Theodore_Roosevelt](https://en.wikipedia.org/wiki/The_Rise_of_Theodore_Roosevelt)

</comment><comment><USER13> Could you imagine life prior to widely available HVAC? These cramped streets, heaving with people and heat. It's all the more remarkable given the sartorial expectation of the time. How did people wear suits and dense dresses regularly?

<comment><USER14> There were non-air-conditioned subway trains in New York City well into the 1980s.

<comment><USER4> There will still be non-air-conditioned subway cars in New York City this summer.

</comment></comment></comment><comment><USER10> I just visited the Jacob Riis Museum in Ribe, Denmark this Monday. [http://www.jacobariismuseum.dk/](http://www.jacobariismuseum.dk/)

The museum did have pictures of water pollution.

</comment><comment><USER15> I thought "the other half" was the rich! I guess this is looking at things in reverse

<comment><USER16> It certainly means either: [https://www.merriam- webster.com/dictionary/other%20half](https://www.merriam- webster.com/dictionary/other%20half)

I'd say most of us see "the other half" as the rich, because we see ourselves as poor, relatively speaking [0]. I think Riis titled his book to give the rich an idea how bad things were for others, to try and draw some empathy from them.

0 - of course, wealth distribution isn't 50/50 today (and probably never was)

</comment></comment><comment><USER17> Fun fact. The population of Manhattan during the 1890s was roughly the same as it is today.

</comment><comment><USER18> Great stuff. It really captures the mood. To bad they didn't rescue all of the pictures from the horrible museum UI.

</comment><comment><USER19> Things like this really should make you realize how bad you don't have it.

This is what unions fought, not when the office mgr takes away the nespresso machine.

<comment><USER7> It's all relative. Why shouldn't people aim for a continued improvement in the way we're all treated?

<comment><USER19> I think people have it too good. I think bored people are creating problems to solve.

/2 cents</comment></comment></comment>


Show HN: Payback, a web app to make spending and borrowing money easier - <AUTHOR> http://payback.io/

<comment><USER2> Great idea, looks like, but I do hope you're aware there are many of these around.

<http://www.buxfer.com/>

<http://www.splitwise.com/>

<https://wesplit.it/>

<http://www.billsarein.com/>

<https://www.paydivvy.com/>

<https://www.billmonk.com/>

<https://splitabill.com/>

<http://flatmin.com/>

<http://expensure.com/>

I personally use the first two, in my roommate / office situation respectively. They work great, frankly. I have very few complaints about either.

If you can do it better, more power to you, but as with any crowded space, I have to ask, because I'm genuinely interested—why did you choose to start from scratch?

<comment><AUTHOR> Ha, I'm aware this is a well populated space! I made this mostly as a learning experience for myself - I'm trying to improve my skills with Rails and I wanted to make something useful for my apartment and this is the result! I'm not trying to beat out any existing services by any means, just wanted to share my take on it.

<comment><USER2> Awesome, it's an excellent project to learn with. Simple data model, a clear problem, easily solved by a web app, with a high requirement for usability and simplicity. Glad to see your take on it too, keep it up!

</comment></comment></comment><comment><USER3> We have a similar app, Flatmin (<http://flatmin.com>) that's targeted more specifically at shared living situations.

We built it a few years ago, and h(ave|ad) big plans to expand into household chores and shopping lists. It's an interesting problem from a couple of perspectives. We've found the more Facebook integration we can do, the better as the target market are very comfortable with Facebook.

It's also a difficult one to make money from - we have some ads on there, but I think to really make it work you'd need integration with another app or some kind of freemium offering (daily deals?)

Yours looks nice - if I could make a suggestion, it would be great to enter email addresses of people to invite, as sending them a hex string is less common and more likely to get lost!

<comment><AUTHOR> Very cool! Flatmin looks like an awesome service! Payback is definitely still feature-minimal :p Everything you suggested is actually a major item on my to- do list! Facebook integration has been brought up several times and I very much agree about the hex string scheme - the next thing I'm going to do is look into an invite by email/ join with referral link, etc. I have no intention of trying to monetize either - I made it purely as a learning experience for my own apartment, and it does seem like a difficult space to get into.

</comment></comment><comment><USER4> Great to see this packaged as a nice service for people!

I built something a lot like this in 2004 and used it with a household of 6-8 people for over 5 years with great success. We split rent, utilities and food with it. I let a few other households use it as well, and everybody had a great experience with it.

I've been surprised that nobody has come out with an easy to use service for this, so I'm excited to check yours out!

My one suggestion is to give me a little more information about the service before signing up. Screenshots would be great to see.

<comment><AUTHOR> Is your version still available? I would love to check out your take on it! I built this for the exact same reason - I'm in a shared apartment of 6, so I'm hoping people in similar situations will be able to get some use out of it.

Good suggestion about screenshots - I'll put more up soon!

<comment><USER4> Back on my computer (commented from my phone earlier). I don't know if you just added more screenshots already, or if you were just hiding from the mobile view! They look good tho!

Unfortunately my old version is not generally available, but you can take a look at a few screenshots! Feel free to leave comments with questions: <http://flickr.com/gp/aaronpk/LAMz1d/>

<comment><AUTHOR> Ah yeah, the screenshots that are on there are hidden from small views. I really like your version, especially the graph idea - I would imagine there are lots of possibilities for interesting visualizations!

</comment></comment></comment></comment><comment><USER5> I was looking for something like this to share our car costs. Unfortunately it lacks some stuff I really need:

\- Exclude people from cost (only 4 of 5 people do the road trip)

\- Fully claim some cost (someone needs the car for a day to move some stuff for himself)

Are there other apps like this with a nice iPhone client?

<comment><AUTHOR> Maybe I'm misunderstanding what you're looking for, but you should be able to do this already. For the first one, you can select specific group members (a 'group' expense is just the default) and then do the split option. For the second, just select the user and the payback option!

</comment></comment><comment><USER6> Check out my site: <http://goodmate.co>

We do similar things and you might find some inspiration or things you'd like to build into yours. PS. I also did mine for getting familiar with some new web techniques (Backbone + Rails in this case)

<comment><AUTHOR> Goodmate looks fantastic! You definitely have a lot of features that I would love to try and build into Payback. I'm actually thinking of doing my next project in Backbone too - do you recommend any particular resources for getting started?

<comment><USER6> Sorry for the delay, highly recommend using backbone-rails [1]. Reading the docs for Backbone and then the source for the adapters in that gem was really helpful. Ryan Bates also does a screen cast on it, but it costs money [2]. Nonetheless, his pro-line of casts are great if you can swing the $10/mo.

I also think backbone looks great in CoffeeScript, and since rails prefers it anyway, I think it works out. Here's a good tutorial on that: [3]

[1] <https://github.com/codebrew/backbone-rails> [2] <http://railscasts.com/episodes/323-backbone-on-rails-part-1> [3] <http://adamjspooner.github.com/coffeescript-meet-backbonejs/>

</comment></comment></comment><comment><USER7> I built a windows phone app around a similar concept ([http://www.windowsphone.com/en- us/apps/7745a9a4-6926-4767-9e...](http://www.windowsphone.com/en- us/apps/7745a9a4-6926-4767-9e61-837fdd1faba5)) but it hasnt really caught on.

<comment><AUTHOR> I think the same can be said of windows phone :p In all seriousness, I love the design of the app! I would definitely use it if I wasn't on Android. How do you have 'taking' set up?</comment></comment>


We are shutting down Talkshow on December 1 - <AUTHOR> https://medium.com/talkshow/we-are-shutting-down-talkshow-on-december-1-98ea1dacf3c8#.cyj6u0mut <comment><USER2> People talk about how no one's downloading apps anymore, but I think it has more to do with events like this.

It's become easier to build apps nowadays, so the creators have less patience, they move on very easily. I'm guilty of this too. When something's not working out well, you start thinking "i could be spending my time working on something else that will do well. It will only take a couple of weeks, why am I wasting my time?"

From a user's point of view, they've been burned too many times to trust that their favorite app will stick around next year, so they invest less in the app, which is a downward spiral.

But the thing is these are all illusion. Today's fad is gone tomorrow. So you better work on something you believe in, instead of building "a messaging app with a twist" just because messaging apps are hot nowadays. Or building a "bot platform" because bots are hot. Or building an "AI stuff using Tensorflow" because everyone says they're the next big thing. They are not. If you trace back towards where all the hype originated, most of them are from some VCs or media pundits who are "looking for the next big thing", which is the worst possible direction you can start from.

</comment><comment><USER3> Original announcement 6 months ago, for those wondering what this is about: [https://medium.com/talkshow/talkshow-is-texting-in- public-c0...](https://medium.com/talkshow/talkshow-is-texting-in- public-c063b591596e)

</comment><comment><USER4> I hope their new project is in the same space. Talkshow felt close but not quite at a great product/market fit.</comment>


Loss of America's Largest Aquifer – the Ogallala (2018) - <AUTHOR> http://duwaterlawreview.com/crisis-on-the-high-plains-the-loss-of-americas-largest-aquifer-the-ogallala/ <comment><USER2> Let me tell you about the oil companies. They say they drill the saltwater disposal systems to _below the aquifer level_ so they "aren't contaminating it"... I call bullshit.

I think there is more than just water level depletion at risk. And don't get me started on T Boone Pickens and the coming water capitalism boom...

<comment><USER3> Yup when you drill through them all you end up connecting the aquifers. Yet it shocks me how all these frackers say it needs more study. US government has Superfund sites with these problems and it's well researched....

<comment><USER4> Turn their FUD around on them. If it "needs more study", then ban it immediately until the risks can be better understood. Anything else would be irresponsible.

</comment></comment></comment><comment><USER5> Wikipedia's article "Ogallala Aquifer" says that its volume has reduced 9% since the 1940s, 3% in the period 2001-2008 alone (32% of 9%). At this rate of depletion, the aquifer has 240 years left, and once depleted, it would require 6000 years to recharge. Assuming that drawing on the aquifer is feasible only at a volume much greater than 1% of capacity, its useful life would be significantly less than 240 years.

<comment><USER6> You don't have to "deplete" it like so to cause problems. Some areas that are higher up will lose access before others. In some places, wells will have to be drilled deeper, and everywhere, the water table will drop.

You can't get something for nothing.

</comment></comment><comment><USER7> "Success" seems to mean reducing the decline of the water table from 21 inches/year to 17 in isolated places, with the rest still pumping madly away.

If we needed another example of Late-Stage Capitalist Failure, we needn't look far. Fittingly, conflict between Nebraska and Kansas is over water from the Republican River basin.

<comment><USER8> _conflict_

Nebraska has certain well-understood longstanding obligations with respect to water flowing into Kansas, but that is a normal thing and there haven't been arguments about it since 2002. Kansans learned not to initiate shooting wars with neighboring states back when we burned Lawrence.

Nebraska and Kansas have used different enforcement regimes, but a variety of regulatory approaches is one of the benefits of the federal system.

It seems unlikely that the aquifer will be restored within the next century, but slowing the rate of destruction is still desirable. IMHO attempting to do it all with well pumping enforcement won't work. A better approach would be to end all government subsidies for USA grain production. Grain farmers would complain, and some would go out of business, but the result would be less intensive irrigation.

<comment><AUTHOR> What do you think should be done to restore aquifer strength not just in that region but also every where else..like out west in CA.

<comment><USER8> The California situation is different, perhaps more similar to Arizona than to the Great Plains. IMHO, Arizonans should realize that they have built huge cities in the desert, and consequently should cease irrigated agriculture completely. That would allow some dairy to return to the Midwest where it belongs, but that's a mere aesthetic preference of mine.

My thoughts about California are not quite so drastic because the most intensively farmed areas did not start out as deserts. Still, ISTM a proper pricing structure for irrigation water would not result in _almonds_ dominating the southern Central Valley as they do.

<comment><USER9> Arizonan here. I understand the thought behind the above suggestion in re : cessation of irrigated ag, but the truth is that irrigation has been practiced here for over a thousand years [the current system is an expansion of / was built on top of the one created long ago by the indigenous people known today as Hohokam] and most of that was done in a responsible, sustainable manner.

I certainly agree that a revision of the current practices is indicated. There is a huge amount of water wasted in AZ on lawns, golf courses, fountains, etc etc. A revamp of ag practices [maybe including some of the indigenous strategies e.g., sunken-bed planting] and wise restrictions on frivolous use would be better than eliminating irrigation; AZ is naturally a high-yield area due to the abundance of sunlight and relative paucity of pests.

p.s. AZ is home to some of the most water-wise crops in the world such as tepary beans, and the corn cultivar Chapalote which has its gene center here is one of the oldest continuously cultivated food cultivars in the world

<comment><USER8> Thanks for responding. Progress is being made on lawns, but I don't think you're going to be able to get rid of the golf courses in the near future. We're told that Millennials are killing golf so it might happen in another 40 years... I won't miss it. Lawns and golf courses aren't the only reasons that cities need water.

As I hinted with the dairy comment, alfalfa is a more problematic crop for Arizona than tepary beans and Chapalote.

<comment><AUTHOR> This is true re alfalfa being a thirsty crop and is mostly exported. Demand from China has multiplied multiple times over. [1]

Interestingly the reason China needs alfalfa exports is because their aquifers can't support the demand for forage for their dairy industry. It's relatively new with the new middle class needing milk. It's one billion plus that is hungry for stufff they never knew they needed before.

Meanwhile dairy in USA is crumbling(not least of the reasons is due to the subsidies). Dairy farmers in the US make less than what it costs. What a mess!

Meanwhile, Fonterra co-op in NZ started selling milk powder to China and is losing money. We are looking at a new economic landscape.

I don't even know what to make of it to predict how it will end up. Regardless, it will certainly mean more consumption. And more loss of biosphere and water becoming a more precious commodity than even black gold of the 20th century. Interesting times indeed..

[1][https://www.farmprogress.com/forage/exports-may- drive-2018-w...](https://www.farmprogress.com/forage/exports-may- drive-2018-western-alfalfa-market)</comment></comment></comment></comment></comment></comment></comment>


Little-known Soviet mission to rescue a dead space station - <AUTHOR> https://arstechnica.com/science/2014/09/the-little-known-soviet-mission-to-rescue-a-dead-space-station/ <comment><AUTHOR> A detail thrown in at the end of the article is that this station was one end of humanity's only journey from one space station to another. They flew some equipment over to Mir from Salyut 7.

Bit of a reality check for 'muricah that we don't have any idea when we'll do that. Sure there was the moon, but that was a stunt. This mundane chore to fetch some stuff is far more meaningful as a measure of progress.

<comment><USER2> I don't know that I'd call docking and transferring cargo a Soviet space win. The first successful Soviet manned spacecraft rendezvous and docking was in 1969, the same year that the Americans landed on the moon. Americans had been docking for years by then.

<comment><AUTHOR> That's precisely my point, though: it wasn't "a win" at all. It was just getting shit done that in hindsight, was a pretty remarkable event not to be repeated for decades. So much of the narrative of the space race is childish bragging for doing X first or biggest or farthest. Ultimately those trophies are worthless.

"be right back, getting the stuff from the old space station" is the sort of thing that should have become commonplace by now. Making that progress would have been much more important than having landed on the moon 50 years ago.</comment></comment></comment>


AngelList Docs - Close your round online - <AUTHOR> https://angel.co/docs

<comment><AUTHOR> Seems like a natural fit for Naval et al. We used something similar last year -- <https://www.clerky.com/>

<comment><USER2> I just incorporated using Clerky. Superb service.

<comment><AUTHOR> New startup Ivan? Been a while, should catch up sometime!

<comment><USER2> Yes on both

[http://giantrobotlasers.com/post/26853484573/im-doing-a- new-...](http://giantrobotlasers.com/post/26853484573/im-doing-a-new-startup)

Want to grab a beer tonight?

</comment></comment></comment></comment><comment><USER3> Nivi from AngelList here. Please me know if you have any questions.

<comment><USER4> Just wanted to say thanks, you're making my life a lot easier.

<comment><USER5> +1. Thanks Nivi! You made our last funding effort so much easier, we can't say enough good things about angel list. I look forward to trying angel docs for my next startup when the time comes!

</comment></comment></comment><comment><USER6> Cherian from Cucumbertown (<http://www.cucumbertown.com/>) here.

I think we were among companies to do the AngelList Docs online. Can answer related questions.

Edit: First

</comment><comment><USER7> If the documents are in relatively stable form and there won't be much negotiation, it absolutely makes sense for a law firm to do this for free particularly as you are then establishing a relationship with what is viable start-up. At least in the sense that they have been able to attract financing (which may or may not stand for very much in the long-term of course).

Of course, if the documents are in a relatively agreed form and are not generally negotiated, it makes me wonder why a law firm needs to be involved at all (speaking as a lawyer). Perhaps this is where Clerky comes in...

I also wonder if the free provision of legal services for the financing is conditional on the company spending fees with WSGR on related agreements? I'm sure there'll be a fair amount of pressure from WSGR for the start-up to use WSGR's paid services.

</comment><comment><USER8> Lots of details here: <https://angel.co/help/docs>

</comment><comment><USER9> First step to crowdfunding for equity online. I think AngelList is being smart and honing down what that would begin to look like.

</comment><comment><USER10> This is a brilliant move. A lot of entrepreneurs would likely still want to take it offline (if their needs don't satisfy Series Seed) but for the majority of people this will make life a whole lot easier - especially with no legal fees! Brilliant move on AngelList's part.

Congrats Naval + Nivi.

</comment><comment><USER4> Brilliant idea. The only other tools I use in conjunction with AngelList are Trello (Investor management) and a mindmap for keeping track of who knows who (AL has asynchronous following so their "You know via" isn't that helpful to me personally)

</comment><comment><USER11> Nivi, great idea -- thanks! The fine print says WSGR will help (for free?) if the startup is "qualified," what can you tell us about their qualification process?

<comment><USER12> Yes, WSGR will do the closing for free, for any startup that they're willing to take on as a client (i.e., credible). We'll be announcing other law firms who will do the same shortly.

</comment></comment><comment><USER13> This is a good first step, the question is how much protection founders gets. Are there any triggers if the founder is pushed out?

<comment><USER12> In most Series Seed financings, the Founders retain Board Control and can't be pushed out by just the Investors. If they're pushed out by the other founders and by the investors together, then their vesting agreement will govern what happens.

</comment></comment><comment><USER14> Wicked move. Love how it's so integrated into the platform.

</comment><comment><USER15> Sexy.</comment>


Inside a Poundland computer mouse [video] - <AUTHOR> https://www.youtube.com/watch?v=NwfZBRTqXFY <comment><USER2> Big Clive's videos are always informative and invariably entertaining. He goes in to so much detail, and often includes little circuit sketches. Perfect for casually learning about electronics.

Without a doubt the funniest is the teardown of South Park's Nosulous Rift device - [https://www.youtube.com/watch?v=Ucymk0q70aQ](https://www.youtube.com/watch?v=Ucymk0q70aQ)

<comment><USER3> Entertaining? Yes. _Always_ informative?

[https://m.youtube.com/watch?v=n2ZZbuOeNmw](https://m.youtube.com/watch?v=n2ZZbuOeNmw)

<comment><USER4> Probably educational in the sense that V = IR rather than "for mysterious reasons you must connect a 120V appliance to 120V and not 240V".

<comment><USER5> Oh hai....would you prefer a 470ohm or 1k ohm hotdog for lunch?

</comment></comment></comment></comment><comment><USER6> On the shoulders of giants. This single chip mouse has its origins in HP, they needed precise paper tracking for big format printers. HP spun it off to Agilent, who spun off Avago Technologies, current optical mouse sensor giant.

Interview with Optical mouse inventor: Oral History of Gary Gordon [https://www.youtube.com/watch?v=TxxoWhCzIeU](https://www.youtube.com/watch?v=TxxoWhCzIeU)

<comment><USER7> Ironic that this tech is actually pretty bad for precise tracking.

As the paper thickness varies, or the paper roughness varies, the distance between the paper and the lens goes up and down, effectively zooming the image in and out.

Since the focal length is so small, even a surface roughness of a few micrometers can have a 1% change in the measured distance travelled from the sensor.

In the case of an optical mouse, you can test this out. First turn off any "pointer acceleration" by your operating system, so the cursor position represents the actual movement of the physical mouse. Now move the mouse to the left, push down on the body of the mouse, while moving it back to the start point in the real world. Notice the cursor isn't at the screen start point?

That's because pushing down very slightly changed the optical distance, and the mouse thought it moved further than it really did.

<comment><USER6> It worked great for its intended application. You dont have to worry about paper thickness/distance in a commercial machine using high quality source materials. I dont even think it would play major role, measurement is done by correlation, moving closer/further only scales the picture.

Commodity mice are terrible as distance meters tho [https://www.youtube.com/watch?v=CIRKRzw54Zs](https://www.youtube.com/watch?v=CIRKRzw54Zs) because you cant completely turn off acceleration/interpolation inherent to particular sensor package. It would require low level access to sensor parameters/options, something only available to clients doing xx thousand units per month volume from vendors like Broadcom.

<comment><USER8> > I dont even think it would play major role, measurement is done by > correlation, moving closer/further only scales the picture.

Scaling the picture is the problem. What parent is trying to say is that the distance the physical paper has to move for the sensor to see 1 pixel of movement depends on the height of the sensor above the paper.

If you want to know how many millimeters the paper moved based on sensor input, this is important (especially if you want precision on the order of dot size in high-dpi printing).

</comment></comment></comment></comment><comment><USER9> Big clive on HN. Hurray!

He earned my respect from a video on a USB charger with an electrocution risk and why you should never buy cheap USB chargers. [https://youtu.be/3Hdn0MuCK_0](https://youtu.be/3Hdn0MuCK_0)

</comment><comment><USER10> This video of his made laugh for about an hour straight. I must've rewatched it at least a hundred times by now. [profanity warning] [https://www.youtube.com/watch?v=QLWKNTUHiEU](https://www.youtube.com/watch?v=QLWKNTUHiEU)

</comment><comment><USER11> I got one about a year ago as a backup (thought why not), actually works rather well, small, but perfect for laptop bag, cheap enough to not stress and small enough to not take up much space. Not pondered scrapping one for parts, but certainly something I've become more mindful of since Maplins closed.

<comment><USER12> I own one too! Very happy with mine, I have also loaned it to people with small hands, RSI and other reasons to use it.

The scroll wheel is not to my liking but otherwise it is a very useful mouse.

I did actually try to buy another but they had a different design to the one shown here and not as good. Maybe stocks vary by outlet or it is seasonally available.

</comment></comment><comment><USER13> For US viewers - Poundland is basically a dollar store.

<comment><USER14> In Poundland, all but a few items cost £1. In U.S. dollar stores, prices vary a lot, and most items cost >$1.</comment></comment>


Taking a Step Back from ORMs - <AUTHOR> http://thoughts.davisjeff.com/2012/02/26/taking-a-step-back-from-orms/

<comment><USER2> I would argue that an ORM does get in the way in a good way. A decent ORM can do things such as extra full-text indexing behind the scenes (Thing Hibernate and Lucene) to provide a much better search over almost any database. You only have to tell it to do so (i.e. configuration) and it springs to life.

Similarly, if you decide that you don't like PostgreSQL and want to move to MySQL. You can go through your code and change all of your SQL to match the PostgreSQL dialect. Or (with Hibernate) you change one configuration parameter (the hbm2ddl one) to use the MySQL dialect as opposed to the PostgreSQL one.

Hibernate (I'm using Hibernate a lot, because it's the one I use at work, so I'm quite familiar with it) can also be configured to check the database schema at start, update it to match your models, create a new schema or create a new schema and schedule it all to be dropped when your application terminates. This is useful, because your test configuration can be create- drop, and your live can be validate. When upgrading the live system, you can just redeploy with "upgrade" as the configuration.

In short, ORMs do have a lot of behind the scenes magic going on, but they can also offer developers a heck of a lot. Not to mention that they're thoroughly tried and tested bits of code. Hibernate even has the capacity to take on various transaction managers (Bitronix allows you to do one transaction over two databases, even if those databases are from different vendors).

<comment><USER3> _You can go through your code and change all of your SQL to match the PostgreSQL dialect. Or (with Hibernate) you change one configuration parameter (the hbm2ddl one) to use the MySQL dialect as opposed to the PostgreSQL one._

I hear ease of switching often being given as an advantage of ORMs. What worries me is that this might be code for, "You have to settle for the least common denominator."

For example, in the PostgreSQL/MySQL example: Will Hibernate recognize when it's appropriate to use a common table expression when working with PostgreSQL, and also degrade to something that works with MySQL's feature set when you switch? Or will Hibernate take advantage of MySQL's INSERT IGNORE statement, and happily switch to MERGE if you go over to Oracle?

</comment></comment><comment><USER4> I agree that using SQL more powerful and easier to debug . Play Framework Anorm transforming result to objects approach is the best approach that I think we do not need to an ORM. [http://scala.playframework.org/documentation/scala-0.9.1/ano...](http://scala.playframework.org/documentation/scala-0.9.1/anorm)

</comment><comment><USER5> Every ORM should allow for easily seeing the SQL queries which it is generated. With this, a discerning programmer is able to recreate the SQL calls as if it were the application, as well as often do an overview to make sure the SQL calls make sense and are efficient. If one keeps tabs on what is being generated, and understands what's going on behind the scenes, ORMs can be excellent for code readability.

Granted, I do appreciate the commentary and think the best point is that it is important to be able to know how to leverage the tools of your specific DBMS when appropriate. This is a huge thing that is often overlooked with novice programmers who jump into ORMs.

</comment><comment><USER6> Totally agree. I've done exactly the same with the excellent node_redis driver. A thin layer to remove boilerplate, but still directly fire commands at the DB.</comment>


I fear, therefore I learn - <AUTHOR> For years, I have spent countless hours in and out of work learning new computer and electronics skills. From embedded control systems and building op-amp PID filters, from signal processing circuits to learning every new JS framework and boutique language like Go, Swift and Rust; frontend, backend, devops, AWS, digital ocean, Azure... to re-reading new versions of books on the Linux kernel and crypto and networking... just... everything.
I do it partially because it is interesting, but in the past few years I've come to realize I do it out of fear. I read articles on online forums like this one and I'm terrified of being turned out to pasture without enough skills, so I focus dedicated effort on learning as much as I can because I'm scared of being destitute in the future. Despite no evidence.
Am I alone? Has anyone overcome this career-related hyper-FOMO? Is this a common anxiety? <comment><USER2> I am not sure. I am a c++ programmer. We don't have a sexy new framework every week or something like that. I am not really worried. I suspect that if I wanted to I could write c++ until I retire. I changed jobs some time ago to keep writing c++ instead of being forced into c#. I kind of hate microsoft, that is mainly why. Rust sounds kind of interesting but I just skimmed the manual a bit. In my spare time I program coq instead. Just because it is interesting. I don't have much anxiety.</comment>


Moving from Gulp to Webpack - <AUTHOR> https://medium.com/stratajet-tech/moving-from-gulp-to-webpack-9064b6cf2e08 <comment><USER2> The overlap in JS tools is a bit confusing to me. There's Webpack which bundles and transforms some aspects of your code. There's Babel which transforms (and sometimes bundles) some aspects of your code. There's TypeScript which transforms and can also bundle your code. Recently I have needed to use all three, but it's very difficult to know just how to mix and match them. It feels like the JS community has a lot of great isolated ideas, but hasn't quite mastered inter-project coordination.</comment>


China's Tencent takes on the App Store with launch of 'mini programs' for WeChat - <AUTHOR> https://techcrunch.com/2017/01/09/wechat-mini-programs/ <comment><AUTHOR> What is Apple's next move? This is a clear violation of App Store policy. Apple is now playing double standard?

<comment><USER2> How is it a violation any more than Exponent ([https://getexponent.com/](https://getexponent.com/)) or Microsoft's CodePush ([https://microsoft.github.io/code-push/](https://microsoft.github.io/code- push/))?</comment></comment>


Ask HN: How do you perform penetration testing on your webapp? - <AUTHOR>

Is there a browser plugin or app that can help me reveal security holes in my web app? Something like a Metasploit for the web.<p>So far I've been writing my own tests, but there is no question someone smarter than me will find a vulnerability. There are a number of great resources on the different types of exploits and how to fix them, but I havent found anything to tell me if I've implemented the solution correctly. <comment><USER2> You can use Netsparker Community Edition (free) <http://www.mavitunasecurity.com/communityedition/>. It will scan your web application against SQL Injection and Cross-Site Scripting vulnerabilities.

</comment><comment><USER3> ZmEu @ WhiteHat Team – www.whitehat.ro

is probably one of the more common ones. nessus <http://www.tenable.com/products/nessus> looks for published vulnerabilities as well, but that would be more along the lines of using an exploitable pop3 daemon or having phpmyadmin visible from your site. Zmeu does some of those scans, but, will also try to do SQL injection.

</comment><comment><USER4> Take a look at <https://www.owasp.org/> and review your source code for common vulnerabilities.

A very helpful tool for testing: <http://portswigger.net/burp/proxy.html>

<comment><AUTHOR> OWASP looks great. Found some tools to help test CSRF (bottom of page) [https://www.owasp.org/index.php/Testing_for_CSRF_(OWASP- SM-0...](https://www.owasp.org/index.php/Testing_for_CSRF_\(OWASP-SM-005\))

Also found a large PDF about testing with suggestions for tools <https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf>

More tools listed <https://www.owasp.org/index.php/Appendix_A:_Testing_Tools>

</comment></comment><comment><USER5> <http://samurai.inguardians.com/>

</comment><comment><USER6> tinfoil.com

<comment><USER7> i think you meant <https://www.tinfoilsecurity.com/></comment></comment>


Bitcoin Going Mainstream: Here is Why Cypherpunks Shouldn't Worry - <AUTHOR> http://techliberation.com/2013/10/31/bitcoin-is-going-mainstream-here-is-why-cypherpunks-shouldnt-worry/

<comment><AUTHOR> The way I read this article,it seems to me as if the author doesn't think cypherpunks can also be good entrepreneurs.</comment>


Apple iPhone launch 2007: 'We invented multi-touch.' - <AUTHOR> http://www.businessinsider.com/and-boy-have-we-patented-it-2010-3

<comment><USER2> 1996? huh?

<comment><AUTHOR> Sorry, went for an eye test yesterday, had a blast of air shot at my eyeball, and have had a thumping headache for the last two days. 2007 it is.</comment></comment>


Don't teach your kids to be coders - <AUTHOR> https://code.likeagirl.io/dont-teach-your-kids-to-be-coders-3c3195efde5a <comment><USER2> "To code is to problem solve. You are trying to get X to happen in Y way using Z constraints. It requires you to see the solution to the problem first. Then conceptually work backwards to reverse engineer that solution. Then build each step on the ladder to reaching that solution. Oh — and do it in an alien language."

Reading this made me angry. Coding can be so much more than this.

We live in a digital world, and coding can enable you to explore that world, discovering things you never knew were possible. You can develop an algorithm that has some unintended side effect and opens a flood gate of ideas & creative motivation. Procedurely generated virtual worlds blew my mind growing up.

Creativity and coding are not mutually exclusive</comment>


Simple one time pad - <AUTHOR>

I've been reading quite a bit about encryption and what not and came across the one time pad. And am wondering if this is an accurate example or have I missed something.
Message:loveyou
key of random characters:spgbwoz
encrypted message = message + key modulo 26 <comment><USER3> you have it right M=loveyou K=spgbwoz

C_i =letter(order(M_i)+order(K_i) mod 26)

where order() and letter() backward and forward lookup in this table: 0 - a 1 - b 2 - c ... 24 - y 25 - <USER2>

The Decryption function is similar to the encryption function but you subtract the key from the cyphertext to get back the message.

Claude Shannon proved that the one-time pad is unconditionally secure using the concept of entropy H(). Very simple argument which you could try to lookup.

</comment><comment><USER4> Yes, as long as the random characters are really random. This seems trivial but is actually quite difficult to get right.

<comment><USER4> Also you technically leak a little information by not padding your plaintext to a larger block size, but its not really an issue in this particular example.</comment></comment>


How much is an idea worth? - <AUTHOR> http://startups.stackexchange.com/questions/7772/how-much-is-an-idea-worth <comment><USER2> Nice timing. I've always had ideas that I just don't feel like going to work on. I recently started posting all my ideas in case anyone else is interested in them. Just having the idea is worth nothing unless you turn it into something. See my recently submitted stories.

<comment><AUTHOR> Thanks. I was doing market research on a startup an acquaintance of mine has that's similar in scope to site in OP. His is [https://capitalandgrowth.org](https://capitalandgrowth.org) (shameless plug for him - promise it's not for me).

Anyway, I stumbled upon this 10-month old question on startups stackexchange and it hit a nerve, so I wanted to share. The answers are spot on. As a programmer, I gravitate towards this answer:

[http://startups.stackexchange.com/a/7804](http://startups.stackexchange.com/a/7804)</comment></comment>


Ask HN: How does a recent grad get started in the business side of a startup? - <AUTHOR>

<comment><USER2> Show up. Physically go to the startup and say you're there to help and ask what needs to get done. Worry about a contract/salary later on once you've shown you're solving headaches.

<comment><AUTHOR> I like this - time to start hunting for interesting startups in NYC</comment></comment>


Step out of your box. And show some respect. - <AUTHOR> http://alexshye.wordpress.com/2012/07/26/step-out-of-your-box-and-show-some-respect/

<comment><USER2> From someone that went from being in the military to software engineering I really believe this is a great mindset. We shouldn't feel like we are chained to one profession.</comment>


Florida cops hope Amazon Alexa can solve bizarre murder case - ga-vu https://www.bbc.com/news/world-us-canada-50269667 <comment><AUTHOR> Seems kinda superfluous, given that the suspect's explanation that _Ms Galva broke off one of the pointy bedposts and "it ended up inside of her"_ seems too incoherent to qualify as a 'reasonable doubt'.

On a side note, I know it's Florida but $65k bail for a murder case?! That seems insanely low considering the rather plausible allegation that the defendant stabbed his victim with a piece of furniture.</comment>


Its now Illegal In Arizona to be Offensive on the Internet. - <AUTHOR> http://cbldf.org/homepage/arizona-legislature-passes-sweeping-electronic-speech-censorship-bill/

<comment><USER2> The law doesn't take effect unless it's signed by Governor Brewer, who would hopefully have the sense to realize that it would probably be struck down by the first court that weighed its constitutionality. Media Coalition, a First Amendment activist group, has urged her not to sign the legislation into law. A link to their letter, and more information about this law, can be found on this page:

[http://mediacoalition.org/Arizona-House- Bill-2549-Censoring-...](http://mediacoalition.org/Arizona-House- Bill-2549-Censoring-Electronic-Speech)

<comment><USER3> As usual this could be a good law, but it is so poorly written that it can be used for anything. The stated intent of the law is to criminalize the act of following someone around online and continually harassing them. Which I personally view as a form of stalking that should be criminal, there is a huge difference between saying your piece and continually harassing a person via a communications medium. One is an exercise in the free speech the other is the victimization of a person. As a rule of thumb a persons rights ends when it victimizes another person.

The problem with this law and many others like it is that they do not codify at what point does it stop being speech and begin being harassment, they do this to give law enforcement leeway but it is leeway that they neither need, nor have they shown any responsibility in utilizing. If they are going to write these laws the need to codify at which point one steps past the law. Is a person that rebuts another person on Facebook every time they post in violations of it, if they add a nasty comment at the end? how many infractions have to happen before it crosses the line? As it sits now, it looks like it could be as little as two. The should have a provision that it has to be unprovoked as well, we have all seen flamefest in which one party would love to be able to have the other party arrested, but they reality is they are just as guilty.

</comment></comment><comment><USER4> "... Christopher Hitchens' expressing his disdain for religion ..."

First, Hitchens' arguments clearly aren't 'intended to offend, annoy or scare' and it's frankly a little disheartening lumping him in with Rush Limbaugh or Ann Coulter, two people who spew inflammatory rhetoric with the only goal being to gain listeners and page views.

Second, Hitchens' isn't going to be arrested any time soon.

<comment><USER5> Because he's dead.

<comment><USER4> Yes, that was to implication of him not going to be arrested 'anytime soon'.

</comment></comment></comment><comment><USER6> "H.B. 2549 would make it a crime to use any electronic or digital device to communicate using obscene, lewd or profane language or to suggest a lewd or lascivious act if done with intent to "annoy," "offend," "harass" or "terrify."

Dear Arizona legislative twit, I write to you via my electronic digital device to annoy and offend you by calling attention to the brain dead legislation you have sponsored. You may look forward to weekly harassing emails on this and other subjects. This is meant to terrify you regarding your re-election prospects. You may now take your legislation and do you know what with it, you know where; please interpret that in the most obscene, lewd and profane way available to your limited imagination.

</comment><comment><USER7> If I find this law offensive, can I have the people who wrote it put in prison?

</comment><comment><USER8> This law is offense, and on the internet.

Your move, Arizona.</comment>