Clojure Ring Defaults - <AUTHOR> https://github.com/ring-clojure/ring-defaults

<comment><AUTHOR> Working with Clojure, I used to be jealous that the eco-system around Ruby had gems as good as this:

[https://github.com/twitter/secureheaders](https://github.com/twitter/secureheaders)

Just reading the README is a bit of an education about Content Security Policy (CSP).

But over the last 2 years I've been impressed by how much the eco-system around Clojure has been catching up, and the new Ring Defaults is an example of that. These automatic security features are the kinds of things that drive people toward monolithic frameworks (so they can get these benefits without having to think about it) but I'm increasingly able to get these things (almost) automatically in the world of Clojure, while still keeping to the Clojure convention of using small, composable libraries, rather than monolithic apps (and for the micro-services I build, monolithic apps are not an option).

:anti-forgery - Set to true to add CSRF protection via the ring-anti-forgery library.

:content-type-options - Prevents attacks based around media-type confusion. See: wrap-content-type-options.

:frame-options - Prevents your site from being placed in frames or iframes. See: wrap-frame-options.

:hsts - If true, enable HTTP Strict Transport Security. See: wrap-hsts.

:ssl-redirect - If true, redirect all HTTP requests to the equivalent HTTPS URL. A map with an :ssl-port option may be set instead, if the HTTPS server is on a non-standard port. See: wrap-ssl-redirect.

:xss-protection - Enable the X-XSS-Protection header that tells supporting browsers to use heuristics to detect XSS attacks. See: wrap-xss-protection.</comment>


Behind the scenes at YC Demo Day [video] - <AUTHOR> https://techcrunch.com/video-article/behind-the-scenes-at-yc-demo-day-where-the-hottest-new-startups-pitch-their-companies/ <comment><USER2> Needs a [video] tag.

That didn't seem like a "behind the scenes" kind of video, more like an overview of what Demo Day is, with montages of each presentation, some off- the-cuff conversations with people, and a (to me, odd) conversation on marijuana beverages.

I like this as a basic, "What Is Demo Day?" video.

Although, I would be interested in an actual 'behind-the-scenes' video, conversing everything from startups preparing & testing their presentations, to the back-end software, to venue operations.

<comment><USER3> Yeah, it's literally the opposite of behind-the-scenes. Would have loved to see some backstage jitters by the founders, what they do in the last minutes before their pitches, etc.

<comment><USER4> Don't have a video but: packed a bit in a green room backstage (a room with water and snacks), about 25 startups at a time, either muttering the pitches to ourselves or watching the startup on stage on a small TV. High-fiving and congratulating the startups as they come out with their faces of relief. For them, it's over! The room begins to empty. You get mic'ed up, go on stand-by by the stage in front of the dark audience, watch one last startup pitch, and then you're on!

</comment></comment></comment><comment><USER5> Anyone else feel like that Tito guy is trying too hard? He seems like a preposterously bad fit for Techcrunch.

He tries this comedic approach but all his jokes fall flat. I've entirely given up on TC video section (blocking it through uBlock) because I can't stand to watch videos with him in it.

<comment><USER6> To each their own, I liked the video and found the general relaxed tone quite appealing.

It was clear to me I wasn't watching a stand up comedy show and neither did he try. He was just friendly and genuinely happy about being there.

</comment></comment><comment><USER7> Why there are so many online mattress-in-a-box companies?</comment>


Show HN: OpenHacker, a weekly competition for hackers - <AUTHOR> http://openhacker.co/

<comment><USER2> I think it would be interesting to shift the focus of OpenHacker to platform where companies can post challenges and offer prizes.

For example, Netflix hosted a competition for a $1M prize for the "best collaborative filtering algorithm to predict user ratings for films." Another example was the Ansari X Prize, which "offered a US$10,000,000 prize for the first non-government organization to launch a reusable manned spacecraft into space twice within two weeks."

[http://en.wikipedia.org/wiki/Netflix_Prize](http://en.wikipedia.org/wiki/Netflix_Prize)

[http://en.wikipedia.org/wiki/Ansari_X_Prize](http://en.wikipedia.org/wiki/Ansari_X_Prize)

Contact big companies and startups to see if there is a challenge they want to put out there to the global community. The value proposition is that they gain access to the global talent pool at a relatively cheap price.

<comment><AUTHOR> Yeah, I've thought of this.

But the site needs a user base first! And the world has problems to be solved!

<comment><USER2> Your first challenge is selling your platform to companies and organizations. It does not matter if you are selling to the Gates foundation or Netflix. Once the company/organization buys into the platform, they will do a lot of the marketing/promotion for you through social media and traditional marketing channels. Once you sell your platform, focus on getting users for that competition.

Pitch the various competitions and prizes to journalists. The X Prize foundation has a lot of media buzz around them. I am sure you could do the same.

You can make money from both sides. Like Kickstarter, charge companies a percentage of the prize for listing on your platform. Second, you could also charge a nominal entry fee like $5 for each submission, which will select for higher-quality submissions.

</comment></comment></comment><comment><USER3> My advice would be to make it a monthly competition and add in a donation box (to increase the possible prize) that would increase quality as well as interest.

<comment><USER4> love the idea of a donation box

</comment></comment><comment><USER5> I love the idea, but is one week a long enough time limit for anything substantial?

<comment><AUTHOR> Would a monthly competition work better do you think?

</comment></comment><comment><USER6> Any way to ask question or add comments about the challenges?

<comment><AUTHOR> It's on the features list on GitHub.

</comment></comment><comment><USER7> Heads-up: you got competition from the YC-backed hackerrank

[https://www.hackerrank.com/](https://www.hackerrank.com/)

<comment><AUTHOR> I'm a hacker rank member. Cool site.

I'd like OpenHacker to be more about solving real world problems than fun programming challenges though.</comment></comment>


Twitter Emoji for Everyone - <AUTHOR> https://twitter.github.io/twemoji/

<comment><USER2> Is it possible just to treat Emojis just like we treat regular typeface fonts? Is there something preventing me from downloading Apple's Emoji "font" and setting it as the default on my Android device?

This would allow developers to specify their own preferred sets (and allow users to override).

<comment><USER3> Copyright law. Apple's Emoji font is not under an open license for you to copy and redistribute.

The only two emoji sets that I know that are under an open license are now Twitter and EmojiOne

<comment><USER4> Debian releases ttf-symbola (as part of ttf-ancient-fonts), so I imagine that has to be free as well, given Debian's policies.

<comment><USER5> [http://users.teilar.gr/~g1951d/](http://users.teilar.gr/~g1951d/)

Symbola font distribution terms: "In lieu of a licence - Fonts in this site are offered free for any use; they may be installed, embedded, opened, edited, modified, regenerated, posted, packaged and redistributed."

</comment></comment></comment></comment><comment><USER6> I just wrote my own... Seems like adding an entire library for this is definitely overkill.

        var emojify = function(message) {
            var codes = [
              '\ud83c[\udf00-\udfff]',
              '\ud83d[\udc00-\ude4f]',
              '\ud83d[\ude80-\udeff]'
            ];
            return message.replace(new RegExp(codes.join('|'), 'g'), '$&');
          }

Edit: If this isn't clear, you'd then define an emoji based font family for the `emoji` CSS class. This means no image based emoji and therefore no colour, but IMO it's much simpler and actually more visually pleasing (black and white forces smarter emoji designs).

<comment><USER7> The library is simple and works well for us and Tweetdeck. Everyone is welcome to tweak it.

The value like stated in the blog is that the permissive licensing of this project/graphics will enable more spread of emoji across platforms. (see something like this blog for why licensing has been a PITA: [http://words.steveklabnik.com/emoji- licensing](http://words.steveklabnik.com/emoji-licensing))

</comment></comment><comment><USER8> Interesting. These seem to strike a balance between Apple's decidedly glosss- but-normal-shaped emoji and Google's flat-but-ghost-shaped emoji. I'd say that we really need an open emoji standard, but we all know how that goes.

<comment><USER3> There is a Unicode standard, see [http://arstechnica.com/gadgets/2014/06/unicode-7-0-introduce...](http://arstechnica.com/gadgets/2014/06/unicode-7-0-introduces-2834-new- characters-including-250-emoji/) which explains a lot about emoji.

There is room for interpretation to what each drawing will look like in each implementations. The standard simply says something like: "Cloud With Lightning"

</comment></comment><comment><USER9> Note that graphics are licensed under CC-BY-4.0, which means if you're using this on your blog you have give attribution to Twitter Inc (most likely in your footer).

No, thanks under these circumstances.

<comment><USER7> Attribution in the source would suffice if it really bothers you. Almost all open source software has attribution as a requirement (ever look at your iPhone Settings->About->Legal->Legal Notices)

That being said, we could potentially CC0 the graphics in the future but attribution isn't much to ask.

<comment><USER10> Attribution requirement is enough to break the FSF guidelines, and not compatible with free licenses. What means that this font can not be used in BSD or GPL software.

No open source software has attribution as a requirement by definition.

Anyway, there's nothing wrong with any of that if it's really what you want. What's wrong is thinking that the requirement is banal, and thus harmless.

<comment><USER7> True but I didn't say all, I said most. I do think the requirement is banal because almost every piece of open source software you use requires some level of attribution.

</comment></comment></comment></comment><comment><USER11> thanks for this guys!

</comment><comment><USER12> The name of this repository/API (twemoji) is unfortunate in my opinion. It is odd and makes me think there is something misspelled.</comment>


Show HN: Flashover - online flash decompiler - <AUTHOR> http://flashover.ifihada.com

<comment><AUTHOR> This is a side project of mine which I've been failing to finish for several months.

Feedback, comments, pull requests and bug reports keenly welcomed!</comment>


Tim Cook's refusal to help FBI hack iPhone is validated by 'WannaCry' attack - <AUTHOR> http://bgr.com/2017/05/15/wannacry-ransomware-apple-ios-tim-cook/ <comment><USER4> The damages caused by US agencies* are easily underestimated. It's not just the equipment rendered useless and data lost due to their software. It's also the millions of hours spent by IT departments worldwide battling with infected computers and securing not yet infected computers. Damages are easily in the tens of billions of USD.

And then there is the loss of credibility of the US government and the companies involved.

*Edit: FBI changed to US agencies.

<comment><USER5> The recent hacks used NSA tech, the FBI had nothing to do with it. The OP is generalizing that un-closed vulnerabilities in the hands of any government agency are an unacceptable risk, which I agree with, but let's put the blame for the current issue where it belongs.

<comment><USER4> Agree and edited, although it really is two units under the same government - and that's where the blame belongs.

</comment></comment></comment><comment><USER6> I'm generally in favor of everyone's computer working but I think it would be wonderful if the WannaCry malware infects the NSA to the point they're shut down for a week or two. I don't know if I'll call it karma but they should at least share some of the pain. If it hadn't been the health-care system, I would have been cheering for the compromise of any of the five-eyes partners as well.

Note to the NSA/CIA - I want to cheer for my government, to be proud to be an American (even the U.S. variety) and it would be wonderful if the U.S. could return to being viewed as "the good guys". I'm not sure that type of patriotism will ever return.

<comment><USER7> It concerns me more that the UK's healthcare system runs on a no longer supported operating system. Something that important should be kept up to date.

The UK's NHS computers were running Windows XP (which was EOL). [http://www.telegraph.co.uk/news/2017/05/12/nhs-hit-major- cyb...](http://www.telegraph.co.uk/news/2017/05/12/nhs-hit-major-cyber-attack- hackers-demanding-ransom/)

Otherwise, the patch to fix the security flaw was released back in March before it was a real problem. There will always be holes in software, it's important to have a system in place to patch them in a timely manner.

<comment><USER8> "only" 5% of the computers are running XP, which is an improvement driven through after a report given to Hunt last year about the risks of old IT.

It wasn't just affecting XP machines, it was affecting other machines if they hadn't been patched.

[http://www.bbc.co.uk/news/uk-39918426](http://www.bbc.co.uk/news/uk-39918426)

> We know there have been warnings before about IT security in the NHS - <USER2> > summer a review said it needed looking at.

> But the problem is that over the last three years the capital budget - <USER3> > is a ring-fenced fund used to pay for buildings and equipment - has been > raided by the government to bail out day-to-day services, such as A&E.

> Last year a fifth of the capital budget was diverted.

> That, of course, makes it more difficult for trusts to keep their systems up > to date.

EDIT: Here's a better post [https://www.instituteforgovernment.org.uk/blog/nhs-cyber- att...](https://www.instituteforgovernment.org.uk/blog/nhs-cyber-attack-about- more-old-computers)

> One of the problems with digital government is reforming the technology > infrastructure which underpins its services ('legacy'). There has been much > speculation about how the continued use of Windows XP operating systems > within the NHS contributed to the cyber-attack. Although only 4.7% of NHS > devices use Windows XP, these are spread across 90% of trusts. Computers > that have not been updated with Microsoft's latest software were susceptible > to the ransomware. Meanwhile, NHS legacies are further complicated by the > patchwork of contracts across trusts. This digital fragmentation is in > keeping with the scale of fragmentation within the NHS itself.

<comment><USER7> > it was affecting other machines if they hadn't been patched.

My point is mission critical software should always be up to date. To go months without installing the update on important systems is unacceptable. It doesn't matter who originally released this exploit, exploits routinely become available. It's about fixing them in a timely manner when they appear.

</comment></comment></comment></comment><comment><USER9> This is a shallow, incorrect argument.

As a reminder, a custom version of iOS is absolutely useless without the means to get it onto a device. In fact, it's possible and relatively cheap for a talented team to make that custom version without Apple's help.

That means is a key held only by Apple, needed to sign software before it can run on any iOS device. Apple uses this key every single time any iOS device around the world is updated- a nonce is generated on device, sent to Apple, signed along with the firmware, then verified on-device before it allows the new software to run.

Creating the software may have been work for Apple, but would not contribute in any way to making phones less safe. Signing a piece of software inside their own premises for a particular nonce and device ID can likewise not be used to make any other device unsafe. This is a process Apple does many times a day, whenever any device updates.

<comment><USER10> If the started that, local law enforcement companies would also ask to have their govOS signed by apple to be installed on a particular device. How do you make sure that a) the link from the local law enforcement branch is authentic and has not been compromised, b) make sure that the person requesting such an update is actually authorized to do so (and not just some criminal how gained access to the law enforcement computers).

Not matter what you do, there is still a very good chance that somehow unauthorized people get access to sign an OS for any of apple's devices device they want. It might not result in such a huge attacked but nonetheless, there is still damaged to be done.

<comment><USER9> The right answer here is they need a valid writ from a court, just like the FBI had.

We don't have much of an issue with criminals getting wiretaps through faking subpoenas to phone companies (although I did find [https://arstechnica.com/tech-policy/2017/03/feds-brooklyn- pr...](https://arstechnica.com/tech-policy/2017/03/feds-brooklyn-prosecutor- forged-judges-signatures-to-wiretap-lover/) when searching.)

Note that I'm not arguing that Apple should have complied, that the court should have said a particular thing, or anything like that (did enough arguing last year when the case was going on). All I'm saying is the comparison is invalid, and the author doesn't know the technical details and is therefore wrong.

</comment></comment></comment><comment><USER11> The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10.

The only people to blame are those that don't follow manufacturers instructions.

They were warned ahead of time. There were even news reports about this.

Target and Home Depot both had credit card hacks precisely because they did not follow manufacturer (again Microsoft) instructions of upgrading Windows XP embedded to a supported version of the OS.

I don't understand how hospitals can get accredited if their IT systems are not up-to-date and verified by cybersecurity experts. Since the companies and the NHS can't be counted on to follow manufacturer instructions, this is extremely important.

May 11, 2017: British Medical Journal: The hackers holding hospitals to ransom - Hospitals need to be prepared to avoid shutdowns [http://www.bmj.com/content/bmj/357/bmj.j2214.full.pdf](http://www.bmj.com/content/bmj/357/bmj.j2214.full.pdf)

Also: Hospital accreditation [http://www.uktreatment.com/why-the-uk/hospital- accreditation...](http://www.uktreatment.com/why-the-uk/hospital- accreditation/)

EDIT: The computer systems are capital equipment and like any other form of capital equipment (eg, vehicles in the motor vehicle pool) they must be maintained. Complex machines undergo changes over the life of the equipment and manufacturers issue updates (eg, field change orders) that should be followed by the purchasers of the equipment.

Regarding proper cybersecurity, that would include hardware upgrades since later Intel CPUs incorporate hardware that assist with proper security that is taken advantage of by later versions of the Microsoft OS.

The problems of hospitals both in the US and in Britain were because of a refusal to follow the manufacturer's (Microsoft's in this case) instructions.

Those familiar with the hacks of Target and Home Depot would know that they were hacked because Target and Home Depot refused to follow Microsoft's instructions to upgrade their point of sale software from _unsupported Windows XP embedded_ to a later, supported version of the OS.

<comment><USER12> > The reason the attack happened ...

A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it.

And, of course, the NSA could have disclosed the bug when they found it instead of hoarding it. Or better protected their tools from theft. Or the Shadow Brokers could have better audited their disclosure to avoid spilling active hacks into the public.

Almost all of these things were required to get to where we are, and all of them are "simple and expected" from at least someone's perspective.

Lots of blame to go around, basically.

<comment><USER11> > "A reason. Real events have lots of root and proximate causes. MS could also > have avoided writing the bug, or discovered it themselves with better > auditing. NHS could have disabled SMB on systems that don't use it, or > otherwise firewalled it."

No machines are built perfectly from the start and there are changes made over the capital equipment's life be it airframes, jet engines, or computer systems.

When purchasing capital equipment or buildings, bridges, etc, part of the responsibility of the firm is to follow the manufacturer's or builder's instructions and including maintenance upgrades. In the case of Microsoft, they gave warnings for years that the Windows XP software would not continue to be maintained.

The issue was not Microsoft, but NHS (and other governments, firms) decisions not to budget for and perform maintenance for the capital equipment that they purchased.

</comment></comment></comment><comment><USER13> His refusal was already more than validated by acting as a safeguard for privacy.

<comment><USER14> Not sure how much apple care about my privacy when they force the phone to call home after factory reset and using it as a dumbphone and blackmail you to provide a valid credit card before installing any free app...

If you care about privacy you don't collect data on your users.

<comment><USER15> > force the phone to call home after factory reset

Sounds like a useful anti-theft measure?

<comment><USER14> Yes. Banning cash and making every transaction public without bank secrecy is great anti money laundering measure But we are talking privacy. Privacy means also privacy from the vendor. It is almost impossible in iOS.

<comment><USER16> People ate already "laundering money" using cryptocurrencies, so banning cash won't fix anything. It will just make it easier for the government to _take_ the taxes directly out of your account. And then invent some new taxes, until you will have to resort to "money laundering" yourself to make ends meet.

</comment></comment></comment></comment></comment><comment><USER17> If two people know one secret is one to many. How many people in USA work for the FBI, CIA, NSA, police departments, have top secret security clearances? Millions of them. One is all it takes, as shown by Snowden, Manning etc.

So thanks, but no thanks.

<comment><USER18> > How many people in USA work for the FBI, CIA, NSA, police departments, have > top secret security clearances? Millions of them.

To be fair, the number of people who had direct access to the NSA/CIA exploit archives was probably in the hundreds. TS information is usually compartmentalized so only the people who need to access it can (known as TS- SCI).

Still bad that they have that many who can access it, but not in the millions.

<comment><USER17> Turns out I'm right. I thought about the military and contractors as well. _" A Top Secret clearance, meanwhile, costs the government nearly 20 times more, at an average of $3,959 per background check. At that rate, investigating the 1.5 million people with Top Secret passes may have cost as much as $5.9 billion over several years. _ [https://www.washingtonpost.com/news/the- switch/wp/2014/03/24...](https://www.washingtonpost.com/news/the- switch/wp/2014/03/24/5-1-million-americans-have-security-clearances-thats- more-than-the-entire-population-of-norway/)

"As of last October, nearly five million people held government security clearances. Of that, 1.4 million held top-secret clearances. More than a third of those with top-secret clearances are contractors, which would appear to include Mr. Snowden." [https://www.wsj.com/articles/SB10001424127887323495604578535...](https://www.wsj.com/articles/SB10001424127887323495604578535653583992418)

Now we can get into semantics until the cows come home but even tens of thousands of people are way too many. Imagine 1+ million people.

<comment><USER19> A TS clearance isn't some magical pass card to every piece of TS information.

<comment><USER17> I know you can't walk to NSA HQ and demand to see everything that they have in TS but Snwoden and Manning case showed that stuff isn't that compartmentalized

</comment></comment></comment></comment></comment><comment><USER20> Couldn't Apple have updated the phone with an iOS that bypasses the verification, then destroy that iOS installer? Then the FBI can access the phone, but they don't have access to the OS, so they can't use it on other phones?

<comment><USER21> >then destroy that iOS installer

You can't do that in forensic investigations. Everything that is done to the phone needs to be verifiable to prove evidence wasn't planted. And besides, the FBI was more looking to set a precedent for future investigations than it was concerned about that one phone.

<comment><USER22> Apple has designed both server side and client side keystores to now be resistant against "future evil Apple".

Basically, even apple the company now can't break into their phones with software updates. The phone requires an erase or user unlock to update. It's scary because now apple can't even fix bugs in certain parts of the system without erasing user data.

</comment></comment></comment><comment><USER23> I do think that someone needs to have a good go at suing these exploit hoarders.

<comment><USER24> I'm not sure what you mean by "exploit hoarders," but that got me thinking. [edit: ah, thanks]

Institutions weigh costs, and somewhere these hospitals decided that having unmaintained, aging information systems, was more cost-effective than either maintaining or upgrading the systems.

Thus, problems like this will not go away until NOT-fixing the systems is more expensive than fixing the systems. So what does that take? Fines?

Irony alert: the hospital that ignores aging systems and hopes that they never get hacked are not at all unlike people who lack health insurance and hope they never get injured or sick.

<comment><USER23> I meant the NSA in this case, but I agree there is are problem organisations with data protection responsibilities that do not prioritise them highly enough.

</comment></comment></comment><comment><USER25> Of course, this doesn't end the negotiations, it just means that that privacy advocates have just gained a bit of leverage. Now, how do they use it?

</comment><comment><USER26> Gotta love a government that stockpiles exploits to use against citizens (them loses them), rather than shares them with companies to protect citizens.

</comment><comment><USER27> My Company lost a lot of money due to WannaCry. Should I sue the USA Gov?

</comment><comment><USER28> another article bullshitting, yeah, coz no one is doing it already... great!

</comment><comment><USER29> That whole story stunk anyway, we still don't know if the FBI withdrew the request because they just found some other way into the device that they wanted to access. So forgive me if my first thought in the midst of all this chaos is not to praise Tim Cook's name.

<comment><USER30> > we still don't know if the FBI withdrew the request because they just found > some other way into the device that they wanted to access

We do know that. It's public knowledge. The iPhone 5C didn't have Secure Enclave (later iPhones did), so it was crackable in another way (that more modern iPhones can't be).

[https://www.washingtonpost.com/world/national- security/fbi-p...](https://www.washingtonpost.com/world/national-security/fbi- paid-professional-hackers-one-time-fee-to-crack-san-bernardino- iphone/2016/04/12/5397814a-00de-11e6-9d36-33d198ea26c5_story.html)

[https://www.washingtonpost.com/news/post- nation/wp/2016/04/0...](https://www.washingtonpost.com/news/post- nation/wp/2016/04/07/fbi-director-says-method-for-unlocking-san-bernardino- iphone-only-works-on-narrow-slice-of-devices/)

</comment></comment><comment><USER31> BGR logic strikes again. There is a world of difference between a backdoor and an exploit...

Neither is desirable but one can at least be secured by a key or something.

<comment><USER32> A hoarded vulnerability and a hoarded backdoor key are difficult to distinguish is this context, ie, leaking of either results in the same catastrophe.

<comment><USER9> Apple already has a backdoor key which they use every single time any iOS device needs to update. The FBI wasn't asking for the key, they were asking for the key to be used to sign one update. That signature would inherently have only worked once, as it includes a nonce and device ID.</comment></comment></comment>


How to crack a Binary File Format - <AUTHOR> http://www.iwriteiam.nl/Ha_HTCABFF.html <comment><USER2> Note that a lot of this advice applies to cracking a network protocol too, such as Steam's game server list.</comment>


Average American Has Just 4 Hours, 26 Minutes of Free Time per Week - <AUTHOR> https://www.studyfinds.org/survey-average-american-free-time-week/ <comment><USER2> Anyone else think at least part of this survey feels off? Specifically, the big red flag to me is:

> Researchers also put together a list of the top ten things Americans plan to > buy with their tax refunds.

> 1\. Motorcycle tires

> 2\. Playstation 4

> 3\. Trip to casino

> 4\. Niagara Falls trip

> 5\. A party

Intuitively I find it hard to believe the number one thing Americans want is... motorcycle tires. Or a Playstation 4. Or a casino trip. Or a trip to Niagara Falls. A party, maybe.

I really don't buy the "4 hour 26 minute" narrative either. I know plenty of super busy people and everyone has far more than 4 hours of free time. They're really saying that the _average_ person has barely more than 30 minutes of free time a day, including weekends?

I'm inclined to believe that this article is either inaccurately reporting the actual results or the study was poorly done.

<comment><USER3> Car tires should be far more common than MC tires, atleast.

Niagara Falls? It's seems really specific. "Freedom from credit card companies" nr.7 seems like a one off comment.

I would guess they messed up the list generation if they have actual data at all.

The number 4,5h seems bogus too. I can't find any source of the study so I assume it's bogus SEO click-bait spam to increase the rank of H&R.

Searching for the quotes reveal some spammy articles with convenient url-links to H&R.

<comment><USER4> > Car tires should be far more common than MC tires, atleast.

Remember, though, it was a purported list of what people buy with their tax refunds. A lot of people treat their tax refund as a windfall to spend on something fun rather than on something necessary.

I'd expect that for most people, if their car needs new tires they fall under the "necessary" category and they get them soon after realizing they need them. A motorcycle is often for recreational use, and new tires might fall into the "for fun" category, to be put off until some extra money is available.

</comment></comment></comment><comment><USER5> It's hard to believe this for the following reasons.

> A new survey finds that the average American adult logs just four hours and > 26 minutes of time to themselves in a given week.

So this includes retired people?

> According to a Nielsen report, United States adults are watching five hours > and four minutes of television per day on average (35.5 h/week) (2016 > statistics)

[https://en.wikipedia.org/wiki/Television_consumption](https://en.wikipedia.org/wiki/Television_consumption)

> Time Flies: U.S. Adults Now Spend Nearly Half a Day Interacting with Media

[https://www.nielsen.com/us/en/insights/news/2018/time- flies-...](https://www.nielsen.com/us/en/insights/news/2018/time-flies-us- adults-now-spend-nearly-half-a-day-interacting-with-media.print.html)

<comment><USER6> I don't doubt people have the tv on for 5 hours a day. I do doubt that people are intently watching every minute. Making dinner, washing dishes, straitening up, and folding laundry are all sort of obvious things people do while the tv is on.

Heck, that second reference included 'game console' which, i think, is the only one listed that really requires full engagement. that's 14 minutes a day.

the 2.5 hours on a web/app on a smartphone is an interesting one. Does listening to spotify at work count? that would definitely pump those numbers a lot.

</comment></comment><comment><USER7> This doesn't pass the smell test. I'm pretty sure most Americans spend hours per day watching TV, on social media or playing video games.

</comment><comment><USER8> If you're like me and you constantly procrastinate, then you have 20+hours of free time every week!

<comment><USER9> Procrastination is a symptom of being overwhelmed.

</comment></comment><comment><USER10> That sounds like BS. I have two kids and I can usually eek out an hour every day, sometimes two. So that puts me at 7 hours minimum, but I can usually make 10-20 happen. My kids wake up around 7 and go to sleep around 8. If we assume 8 hours of sleep, that leaves me with 3 hours unaccounted for every day.

Perhaps they're counting chores as "not free time", but most of those can be done while doing other things. For example, clean dishes while waiting for a pot to boil, or clean the toilet after or before taking a shower. I've done these types of things to free up time after my kids go to bed. If they're safe enough for me to get the restroom, they're probably safe enough for me to clean something.

I wonder how much time we'd end up with if we included time on a smartphone not doing productive tasks. It seems people spend time on their phone when they have a few minutes instead of doing chores, and then do those chores during their "free time". If you want more free time, find ways to squishing more into your non-free time.

</comment><comment><USER11> I always aim for 4 free hours per DAY.

If this is true, I really don't understand how people can live in the USA.

Go to Canada, Europe or something!

<comment><USER12> Do you have children? If you have children, you can easily wind up with negative free hours per day.

If you averaged say, 4 parents and 4 non-parents free time, I could see how someone would easily arrive at a number where the "average American has just 4 hours of free time per week"

<comment><USER11> Yes, I do. One, and she is old enough now. Even when she was little, I had free time.

If you do not have enough free time for your child, maybe you should consider not having them. The same way you would if you did not have the finances right or anything else that may affect them...

</comment></comment></comment><comment><USER13> How on Earth does this have 60 votes? It's a content marketing piece for H&R Block based on a throwaway online survey that probably had ten people in it. Are HN readers just upvoting because they want validation?

<comment><USER3> I read the article because I thought "this can't be right, right?", and sure enough, it seems like SEO click-bait.

Their marketing will now be able to show a spike in traffic because of me searching for their stupid product and can report marketing success to their boss even tough I would never though the company again.

I fell a bit dirty ...

</comment></comment><comment><USER14> > _A new survey finds that the average American adult logs just four hours and > 26 minutes of time to themselves in a given week._

> _And if that amount seems high, you're also in good company. Four out of 10 > people surveyed said they get even less free time than that total, > incredibly._

Since the median and the average are usually [citation needed] not far away, this is not surprising at all.

</comment><comment><USER15> I can definitely relate. I think all the administrative things are what annoys me most. Such as sifting through mail, bills, taxes, figuring out procedures to apply for things, etc.

Because it all feels so disconnected to real impact and result. Like all administrative work feels imaginary. Like we created the problem for ourself.

Yet, I don't know how to automate it, or get rid of it.

</comment><comment><USER16> This is why I wouldn't go to America, the work life balance is non existent.

<comment><USER17> It's really company dependent. I love my work life balance.

</comment></comment><comment><USER18> I'd be curious to see how these numbers change with and without kids.

</comment><comment><USER19> And people wonder why I quit my job to go on walkabout every few years.

<comment><USER20> Love the idea of this... Any details you can provide about your trips? Where, how long, etc?

<comment><USER19> I try to take at least a two-week vacation every year, to travel somewhere new. Every 2-4 years, I quit my job and move somewhere. So far I've lived in four US states and the Cayman Islands for a few years each.

In between about every other job, I'll take an extended trip. I did six months around Southeast Asia. I've done extended around-the-US travel. A couple months in Belize/Guatemala. Currently in the middle of three months in Cayman/Honduras.

If you've got no mortgage, no debt, no kids, it's easy to do at any income level. I've made these choices. It's not a tradeoff that many people want to make, but it's available to most people should they choose it (I realize kids aren't always planned).

Most of my trips are low-to-medium budget. SE Asia and Central America can be done for $20-50/day. Cayman is expensive, but I used to live here, so I've got free housing and loaner cars from friends (yet it's still costing me close to $100/day). The US can be dirt cheap if you don't mind car/tent camping.

</comment></comment></comment><comment><USER21> I wonder if an average American works more or less than 4 hours per week ( _actual work_ , assuming 40 hours work week)?</comment>


Amazon rumor sends Bitcoin surging to record highs - <AUTHOR> https://thenextweb.com/cryptocurrency/2017/10/13/amazon-rumor-sends-bitcoin-surging-record-highs <comment><USER2> Had not heard this rumor yet, thanks. If Amazon does in fact accept Bitcoin, $5700 sounds like a steal.</comment>


systemd's syslogd replacement supports JSON output - <AUTHOR> http://www.freedesktop.org/wiki/Software/systemd/json/

<comment><USER2> There some competing trends in the *nix world today.

On the one hand, there are some huge, monolithic packages like Xorg that have split in to many smaller, more independent packages.

On the other hand, we have something like systemd absorbing ever more functionality, becoming more monolithic with feature bloat.

I am personally more in favor of having many small, simple tools that each do one function well and can be easily integrated together, and understood independently of each other, rather than going the monolithic route.

To me, systemd is one gigantic step backwards from this vision, even if it has some (or even many) good ideas.

<comment><USER3> A quick look into systemd reveals that it's comprised of multiple components. For example the journal service is a separate daemon. What part of this does not align with your vision?

EDIT: looks like the "monolithic" myth has already been busted: [http://0pointer.de/blog/projects/the-biggest- myths.html](http://0pointer.de/blog/projects/the-biggest-myths.html)

I would say the distinction between systemd and older systems is that systemd follows the "better is better" mantra of design, while older systems follow the "worse is better" mantra of design. Older systems often feel like quick hacks. For example SysV init is a collection of init scripts. Yeah it is "simple" in that the init service itself is simple, but writing the scripts themselves is anything but simple, and they are brittle as well. How often have you seen init scripts failing during startup or boot? And why must you write daemon management code over and over again your init scripts? All this does is pushing complexity out of the init service and into the scripts. Systemd is taking complexity upon itself so that the scripts can be simple.

<comment><USER4> It's monolithic because you can't pick and choose the components.

You have to use all of systemd, or none of it. You can't replace bits of it, or use just parts of it.

<comment><USER3> And how exactly does Xorg allow you to use parts of it? More importantly, what parts of systemd do you not want to use or do you want to replace, and why?

EDIT: what you're saying appears to be untrue. According to [http://0pointer.de/blog/projects/the-biggest- myths.html](http://0pointer.de/blog/projects/the-biggest-myths.html), they provide configure switches for enabling or disabling many things, not unlike how the Linux kernel allows you to enable or disable features.

You know, there are _so_ many people here bashing on Lennart, I'm wondering whether any of you have done your homework at all or because you just bash Lennart for the sake of it. I'm not even using systemd and I found these things in 5 minutes.

<comment><USER5> I'd like to not use udev. I have a custom Linux that runs both on standardized(internally defined) servers and also virtualized(known hardware) servers. As such, I'm well under 900ms boot times that systemd mentions by using SysV init. But the systemd project does not accept patches ([http://freedesktop.org/wiki/Software/systemd/MinimalBuilds/](http://freedesktop.org/wiki/Software/systemd/MinimalBuilds/)) to disable what is considered a core component.

<comment><USER3> Alright, point taken. Then systemd is not for you. However I want to argue that not all software _should_ cater to everybody. While modularity (which in this discussion is apparently defined as "the ability to disable or swap components") is often seen as a good thing, there are quite a lot of downsides as well:

\- Certain guarantees and consistencies disappear. Instead of having a system that you know you can rely on, it suddenly becomes entirely dependent on the configuration options. While it sounds nice if any part can be enabled, disabled, moved or swapped, then the system's predictability goes down. Furthermore, some combinations may be incompatible because abstractions are inherently leaky. Good luck finding out whether you're suffering from a compatibility problem or not. You can compare this to the many complaints about Android fragmentation. Because everybody can customize Android, writing an app that works on all Android devices becomes extremely difficult.

\- Installation complexity goes way up. It's much easier to install a system if it states "I need this, this and this", instead of "I can use this, or this, or this, if it's configured in X, Y and Z way".

\- Certain features cannot be implemented in a simple manner because you have to cater to the lowest common denominator. XFree86 was like that. Because it had to be portable, it cannot assume any kernel capabilities. And as a result XFree86 came with its own mode setting code, its own ELF binary loader, had to run as root, etc etc.

<comment> vertex-four > However I want to argue that not all software should cater to everybody.

The issue here is that the Linux kernel developers are starting to make decisions that assume systemd is being used. For example, the (proposed?) new cgroups API is being built with the idea that systemd will manage it, and anything else that wants to interact with it will go through systemd.

<comment><USER3> That isn't what I read at all. The cgroups maintainer wants a flat cgroups list so that the code is easier to maintain, but Lennart said he must have hierarchical tree so that systemd can take full control over at least a part of the tree. That's hardly "being built with the idea that systemd will manage it".

<comment> vertex-four You've read wrong, unfortunately. [http://lwn.net/Articles/557082/](http://lwn.net/Articles/557082/) describes that:

> Unprivileged access to the cgroup hierarchy will be strongly discouraged; > the hope is to have a single, privileged process handling all of the cgroup > management tasks. That process will, in turn, provide some sort of higher- > level interface to the rest of the system.

and that:

> This hierarchy becomes private property of systemd. systemd will set it up. > Systemd will maintain it. Systemd will rearrange it. Other software that > wants to make use of cgroups can do so only through systemd's APIs.

That is, systemd will implement a manager on top of the new cgroups API, and all cgroups users will be assumed to go through systemd.

<comment><USER6> systemd manages cgroups on systemd based system. The systems that do not use systemd can implement their own cgroup managers. The kernel makes no assumptions on what manager you use on userspace. Other managers could also reimplement the systemd dbus API for managing the cgroups.

<comment> vertex-four > The systems that do not use systemd can implement their own cgroup managers. > [...] Other managers could also reimplement the systemd dbus API for > managing the cgroups.

True, except that the systemd developers are in charge of defining this API and have no reason to consult with other cgroups manager developers when defining it. This is, to make an analogy, equivalent to allowing Microsoft to unilaterally define all web standards from now on. The competitors are always going to be playing catch-up, and there's going to be tons of edge cases where the competitors don't quite work the same.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is of course exactly the killer feature that would convert me into a true systemd believer. The only thing better would be to have an ASN.1 representation of the logs as the native format, for the sake of portability. After all, if you don't have tools to analyze your logs for you, you might as well not even have logs.

</comment><comment><USER8> After hearing both sides of the argument over and over again (for systemd and against systemd), my only regret is that Ubuntu is not replacing upstart with systemd, so that Loonix will have a uniform boot system.

To all the systemd naysayers, please read the docs before commenting, 90% of the comments against systemd look like they've been written by someone who:

a) hasn't used systemd

b) hasn't read anything relevant about systemd

Basically most comments come straight out of the blog post about systemd myths. That's really, really sad.

</comment><comment><USER9> Before this thread devolves into the same arguments all over again, maybe everyone could read the following:

[http://0pointer.de/blog/projects/the-biggest- myths.html](http://0pointer.de/blog/projects/the-biggest-myths.html)

</comment><comment><USER10> Is this a good time to define Poettering's Law - any simple and useful Unix service will eventually get rewritten into a monstrous uber service that requires a supercomputer just to run, what should be, a simple service.

<comment><USER3> Which is easy for you to state, were it not for the fact that the "simple service" is broken in various ways.

Let's start with the implementation-specific brokenness. I configured a log host with rsyslog. Rsyslog's configuration format, as well as documentation, is completely abysmal. And once in a while, rsyslog would use 100% CPU for no reason. A quick strace reveals that it keeps reading or writing to a file descriptor, but getting EAGAIN as error. Looks like a bug to me. And oh yeah, there's a race condition in rsyslog with regard to privilege lowering, so that sometimes it would great directories owned as root, and then it would lower its privilege, and then it would be unable to write to its own created directory. Just great.

The above are all fixable. But what bothers me more is that __syslog is entirely unauthenticated __. Any process can write to syslog, claiming that it is any process. A malicious user can write a syslog entry saying that "init[1]: the system is unstable. please reboot now!". As an administrator, you will not be able to tell whether the message actually came from init (or PID 1) or not. A quick look at systemd's journal mechanism reveals systemd at least has thought about these problems: [http://www.freedesktop.org/software/systemd/man/systemd.jour...](http://www.freedesktop.org/software/systemd/man/systemd.journal- fields.html). It would log the process's PID, UID, GID and more, and the sender is unable to fake that.

<comment><USER11> systemd can log the PID, UID and GID of a message because its using a Linux- specific feature of datagram based local sockets; such a feature cannot be supported on other Unix systems. But there are other reasons to use syslogd/rsyslogd/syslog-ng besides logging to local files, and that's to forward the logs to a centralized logging service. Of course, there are issues with that, as the default syslog protocol also allows any process, anywhere, to claim it is any other process (and if root, even fake its own source address) but it's being addressed (I know rsyslogd is, I'm not sure about other syslogd replacements).

My issue with systemd is that forwarding logs to a central server is an afterthought, if even that. And the problem with that is that it won't be as secure or work as well if it's part of the design. And another issue with the "afterthought support for remote logging" is that I _still need_ to run syslogd/rsyslogd/syslog-ng because I have a ton of other network equipment (routers) that can forward their logs via the syslog protocol (which I have used on networks I've managed---by doing that, I've been able to receive notifications of OSPF routing changes, for instance). And if I have syslogd/rsyslogd/syslog-ng already running, what are the benefits of systemd logging?

<comment><USER3> Regarding PID/UID/GID logging: if it has to use a Linux-specific feature to be less broken in that regard, then I'm all for it. In my opinion, authentication is such an important security feature that other Unices should just implement similar mechanisms (or, preferably, the same mechanism). Right now I've only seen the BSD people complaining that systemd uses Linux-specific features, but doing nothing to solve the problem.

Regarding central logging: indeed, that is a problem. Has Lennart ever spoken about this issue?

<comment><USER11> The impression I've gotten is that he isn't interested in centralized logging, as that is outside of what he is trying to do.

I could be wrong though.

</comment></comment></comment></comment></comment><comment><USER12> Lennart, please add the f*ng mail reader in there already and be finished with it.

</comment><comment><USER13> The way this is going, Linux will end up as a single process operating system, that will do everything at web scale. All outputs in glorious binary format.

Funny, the crowd got distracted over Gnone3, Unity or Mir, or the latest worry of the day, yet never saw the big threat in their camp.

Linux isn't done until the text processor won't run.

<comment><USER6> systemd is hardly monolithic as it is build of over 80 binaries. A normal system with systemd runs at least four processes: systemd (PID1), systemd- udev, systemd-journald and systemd-logind. There's various smaller services that are run on startup and other occasions. Then there are many configration utilities like timedatectl (systemd-timedated), hostnamectl (systemd- hostnamed) and localectl (systemd-localed).

</comment></comment><comment><USER14> But what if it's used for evil? :0

<comment><USER15> It doesn't look like they are using Douglas Crockford's JSON implementation, so using it for evil is probably OK.

<comment><USER14> Thanks for the upvote. I did not know my karma would get busted for my comment.</comment></comment></comment>


Vitamin D deficiency worsens Respiratory Tract Infections: Meta-analysis - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6747229/ <comment><USER2> Absolutely, not only respiratory but all the illnesses. It affects your immune system. But with cavaets:

\- It won't make any effect for around month once you start taking it

\- it only has effect if you have serious deficiency.

I used to be sick really easily for years, always tired. Finally got doctor to make blood tests and if normal level 100, min is 60, then my vitamin D levels were 12. Ofcourse my body immune system struggled. After started with suppliments got more energy, got less often sick. Felt like a normal person.

There is also other extreme, taking too many will have negative effect. I've experienced them myself.

I do live in a northern climate (imagine Finland) with long dark winters and only sun time is spend in the office.

<comment><USER3> If you take a lot of vitamin D, you have to make sure that you are getting enough magnesium.

Also, vitamin D really shouldn't be taken any other time than before noon.

(Not sharing this for you in particular, just for anyone reading who decides to try vitamin D supplementation for the first time. Doctors aren't always sharing she vital info about how to take vitamin D)

<comment><USER4> > Also, vitamin D really shouldn't be taken any other time than before noon.

I'm sure I could go find sources, but it might be helpful if you link them here. It's hard to believe comments that give medical information and disparage doctors.

<comment><USER5> I'm actually just completing a high-strength vitamin D tablet course and the advice for taking it in the instructions is to take it with your evening meal, so sounds like a load of hogwash.

Here, for example, are the instructions that came with my tablets:

[https://www.sunvitd3.co.uk/site/wp- content/uploads/2019/01/S...](https://www.sunvitd3.co.uk/site/wp- content/uploads/2019/01/SunVit-combi-PIL_v24.pdf)

Note the:

"Please Note: SunVit-D3® tablets should be swallowed whole with water and taken in the evening with a main meal."

<comment><USER6> The reason for that recommendation is that Vitamin D absorbs better in a meal with fat, and dinner is the biggest meal for most people.

See my other comment in reply to parent. There might be lower quality sleep because of the timing.

[https://www.gwern.net/zeo/Vitamin-D](https://www.gwern.net/zeo/Vitamin-D)

</comment></comment></comment></comment></comment><comment><USER7> While one supplement is in trend, as now with vitamin D, when you search and try to make a decision if you should supplement it, you always end up deciding it is beneficial, or at least doesn't hurt to. But as the trend fades, you may find that it is not that important or even harmful to overdose in specific situations.

So I am skeptical of supplements as a rule. Of course there are a couple of odds, like iodine, which is so beneficial to supplement in general community, that it is added to table salt as default, you only skip if you have specific conditions like thyroid problems.

I wish there were more research or comments on possible harms and disadvantages of excessive use of vitamin D, than I think I could more easily decide to use.

<comment><USER8> I really don't see the issue. All vitamin d sales come with daily dosage information. There's (always going to be) some issues with literacy to understand this information, but that's it.

If you follow the daily dosage information, you won't even get near harmful levels of vitamin d. Recommended is about 600 IU daily. If you take 60.000 on a daily basis for months, you build up toxicity.

For that you typically need to take 30 pretty strong 2000 UI pills on a daily basis for months, while ignoring the label that states each pill is typically 250% of the daily recommended amount, and the instruction which notes the tolerable levels max out at just two daily pills.

Toxicity is extremely uncommon. Whereas deficiency is extremely common. Up to a billion people are expected to have some form of vitamin d deficiency.

That's not to say it's not a problem, but rather that it's very rare, nothing like say an opioid overdose problem. As with all things, balance is key. You can overdose on 5 cents of water in the span of 5 minutes. Acute vitamin d overdose is known to happen if you take something like 300-1000 pills of 2000 UI over a period of days, which is pretty insane.

<comment><USER9> You reminded me of a paper that suggested that there was an error made in developing the RDA of Vitamin D; the 600IU RDA may be wildly wrong.

" It also estimated that 8895 IU of vitamin D per day may be needed to accomplish that 97.5% of individuals achieve serum 25(OH)D values of 50 nmol/L or more."

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4210929/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4210929/)

</comment></comment></comment><comment><USER10> A similar article was discussed previously here [https://news.ycombinator.com/item?id=22463713](https://news.ycombinator.com/item?id=22463713)

<comment><AUTHOR> This is a more recent meta-analysis, but thanks it's helpful that you're linking to the discussion.

</comment></comment><comment><USER11> From the first sentence in the abstract:

"however, findings are inconsistent"

<comment><AUTHOR> Agreed - I believe the meta-analysis and the underlying studies are likely of poor quality.

I think it might be worth for people here to reanalyze everything.

The effect sizes seem large and clinically significant.

So this is big if true.

</comment></comment><comment><USER12> I fear that the second this hits major mainstream media, all vitamin D capsules still left in stores will immediately be hoarded by the same people who hoard toilet paper...

<comment><USER13> You're two steps behind. Who do you think pushed all these "nutritional recommendations" ?

</comment></comment><comment><USER14> Vit D deficiency is omnipresent in today's society. Literally almost everyone I know has it. Supplementing Vit D drastically changed my mood. Too bad public healthcare in Europe, especially the NHS in the UK, doesnt recognize Vit D deficiency as a problem.

<comment> globular-toast I'm highly sceptical of it being anything but a placebo for most people. I live in the UK so I'm a good candidate for deficiency but I don't actually feel anything is wrong with me. Everyone thinks they are tired all the time and their sex drive isn't as high as it could be. If I supplement vitamin D the only thing it does is give me constipation. I'm sure there are some people with actual deficiency, but if you're white and go outside sometimes you're probably fine.

<comment><USER15> There's a difference between sickness-causing deficiency and optimal level. Most people are somewhere in between. If you tried and it didn't make a difference, then you're probably around the optimal level.

However, the specifics do matter; see e.g. [https://www.gwern.net/zeo/Vitamin-D](https://www.gwern.net/zeo/Vitamin-D) \- this is n=1 but consistent with many other n=1 self-experiments I'm familiar with; personally, my sleep is improved with increased protein consumption AND 10,000 IU D3 before 10AM (Both contribute; I've not gone about 10,000 IU, but 5,000 UI has a much lesser effect)

I have not find a peer reviewed time-of-taking-D3 paper when I looked, but D3 is recognized as a timing mechanism ("Zeitgebber") in many papers I've found.

</comment></comment></comment><comment><USER16> Kind of expected if you consider [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5684962/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5684962/)

<comment><USER17> Interesting, vit D deficiency and TB immunity both run in my family.

<comment><USER16> Sunshine has always been helpful for people with TB, I wonder if that is why people get more chest ailments in winter, ie colds and flu?

</comment></comment></comment><comment><USER18> (2019)

<comment><USER19> Vitamin D went out of fashion in 2020?

</comment></comment><comment><USER20> Also consider combining w/ K2 (as MK-7) for better absorption.</comment>


Ask HN:  When should I stop telling people about my business? - <AUTHOR>

I run a bootstrapped startup that's three years old and growing steadily.  Revenue is doubling year over year.  We'll hopefully do $400,000 in 2014 sales with a gross margin of 25-30%.  I'm having a lot of fun, learning a ton, and the business is providing a living wage for me and my one full time employee.  I'm almost 23.
I share a monthly update of our financials and a general summary of what is/isn't working with a group of 20 friends and mentors.  The goal is to get feedback and spark ideas based on what's working for me.  If someone asks me out in public about how the business is doing, I still tend to tell them our revenues and my goal for the year.  I want to give out real info - not hide behind "we're doing well".
I think that, being an HN reader, I'm inspired by others' stories and I want to share mine to have the same impact.  However, I think at some point I'll have to stop sharing all of our info with such a broad group.  I'm concerned that some friends may become jealous and the updates will have a negative impact.  I'm concerned that the updates could come off as arrogant.  And to some slim degree, I'm concerned about the info being used maliciously.
What do you think? - Is sharing financials and updates about a young startup beneficial for others to hear?
- When is it time to tone down the updates? - Is it likely to come off as arrogance when giving financial context to non-startup friends? <comment><USER2> Probably now, since it's starting to concern you.

I know the feeling of wanting to tell people when you hit certain milestones. It's not bragging about money, it's validating your success at something you work hard on.

But now that it's working it's sort of like your friends telling you every raise they get.

Also, some people will get weird once the numbers get above a certain amount.

</comment><comment><USER3> I think you will want to consider it as more than just an issue of arrogance. You're showing your hand to your competitors (or potential competitors) as well as potential employees, etc. etc.

It's fine to share the details with some close confidants, if you feel it will help you and them. But are the numbers at this stage really as valuable as you think? From the info you've given, you're talking a gross margin of just over $100k last year. That is nice as a young person bootstrapping a start-up with only two employees. It isn't great as a business, depending on what you want it to be.

If your goal is to run a lifestyle business, than why share the details of your revenue and margins? That seems to me to be completely about ego. How will knowing your revenue and margins enable somebody to help your business? I suspect if you just told them about what you're doing, you'd still get similar feedback and ideas about how to improve or grow your business.

If you're looking to create a large company from your start-up, you've got a long way to go. Your current revenues need to triple or quadruple. You need to grow exponentially. The info you're sharing, in this case, just lets everybody know how far you have to go, and could put doubts into if you'll actually make it.

By all means talk about your business, but be smart about what you share, and with whom. As a test, see what sort of response you get when you stop mentioning revenues and margins to people. Do you feel they are giving you less feedback? Or less valuable feedback? Do you feel that by mentioning the numbers to everybody in sight, it makes you feel better about what you're doing, rather than the effect it is having on them?

Do some A/B testing on yourself and see what happens.

Out of curiosity, what made you post this question? Maybe the answer to your question is in that alone.

</comment><comment><USER4> I would definitely keep your advisory board. Having a group like that is so valuable, especially if you are getting a ton of feedback.

Most people don't expect to hear exact numbers, but from personal experience they (I) do like to hear percentages. Other statistics could be helpful as well. For instance I tell people last year we had 8 employees now we have 12. Great question, thanks!

</comment><comment><USER5> Maybe skip the gratuitous sharing of financial milestones, and instead update people on the cool new stuff you're building/doing, or start a discussion about the user feedback you've received recently or some interesting results from the A/B testing you conducted recently -- that sort of thing.

</comment><comment><USER6> Can't you share updates with less details to avoid feeling like a braggart?

For instance: "We're on pace to double last year's six-digit revenue and holding steady at a 25% gross margin."

Or talk to friends who can be happy to hear you're doing well.

</comment><comment><USER7> Follow your gut. Cull the list, and share details with a select few who truly provide strategic insights and valuable feedback.</comment>


Tell HN: My (personal) Airport App Challenge - <AUTHOR>

I'm taking a flight to Orlando in about 3 hours, and will have a 2-3 hour layover at Miami in between.
Turns out, that airport (and the Orlando one) is part of the Free Google Wifi for the holidays thing [1], which was nice. Since I will have quite some time in my hands, I decided I won't work on my current project, but instead will see what kind of app I can build in that short time; visual design and planning included.
I was also hoping that, if anyone is flying today, or soon, they would also attempt the challenge and see what comes out of it. <comment><USER2> Well, I'm not traveling this week, but I often use flight time for hacking.

On a trip to Australia in 2006 I brought my MBP and a small thinkpad that was running a full linux LAMP environment. Along with a crossover cable so I could "network" the two to test some database stuff I was working on at the time. Was a great distraction-free 14 hours of productivity.</comment>


Meet Magit - Git Mode for Emacs - <AUTHOR> http://vimeo.com/2871241

<comment><USER2> I keep trying to like magit, but I really can't make it work for me nearly as efficiently as doing everything on the command line, especially with as many git status indicators built into my prompt as I have (branch name, ditry/clean tree, and whether or not branch == origin/branch)

</comment><comment><USER3> I wonder... what percentage of Emacs users actually prefer video to text? I'd think that particular demographic would lean toward "I can read faster than you can demo, so just get on with it already".

</comment><comment><USER4> I really like magit for some stuff, I haven't had the chance to look at the video but I am hoping they are showing the ediff between branches feature or easily stacking only the change you need to commit.

</comment><comment><USER5> i tried magit before. i soon gave it up for the command line. the command line is much faster.</comment>


Apple CEO Tim Cook Created His Sina Weibo SNS Account - <AUTHOR> http://weibo.com/p/1005055524254784

<comment><AUTHOR> Just in a few hours, his Weibo fans has increased to 259816...

Many Chinese IT stars on Weibo forwarded his first Weibo msg and sent their welcome.

<comment><AUTHOR> His first Weibo MSG said that:

> Hello China! Happy to be back in Beijing, announcing innovative new > environmental programs. > 你好,中国!很高兴再次来到北京,并宣布创新的环境新项目。[http://www.apple.com/cn/pr/library/2015/05/11Apple- > Announces...](http://www.apple.com/cn/pr/library/2015/05/11Apple-Announces- > New-Environmental-Initiatives-in-China.html)</comment></comment>


Ask HN: Not requiring users to sign up - <AUTHOR>

I'm building a website and want to get around the issue of requiring users to sign up/ register with a username + password combo.
A while back I read an article on HN about giving users their own domain for their social accounts and I was wondering if anyone else has implemented anything similar. The alternative is just to use sign in with Facebook / Twitter / Google etc but I want to keep it as simple as possible.
Has anyone implemented something similar? <comment><USER2> Hey Mike,

I've implemented Facebook, Twitter, Google and GitHub auth as well as a custom domain login at Kobra.io

It was pretty easy to set up using Firebase SimpleLogin. Overall my goal was to get as many people to try the app as possible, and then if they like it have them sign up. I didn't want to lose people that may not actually sign up but would if they tried the product, so I also allow anonymous usage of the app.

Let me know if you have any specific questions for me :)</comment>


FlyScreen Launches An iOS 5-Like Lockscreen API For Android - <AUTHOR> http://techcrunch.com/2011/11/24/flyscreen-launches-an-ios-5-like-lockscreen-api-for-android/

<comment><USER2> What's the legality of a lock screen, if it's got a password or access code, revealing information without having to unlock it? Does Flyscreen not work if you have a passcode to unlock your phone?</comment>


Donald Knuth's First Computer - <AUTHOR> http://www.catonmat.net/blog/donald-knuths-first-computer/

<comment><USER2> The latest volume in Knuth's "Selected Papers" series, "Selected Papers on Design of Algorithms" is due out any day now. (According to Amazon, it was supposed to be released on the 15th, but my pre-ordered copy still hasn't shipped...)

<comment><AUTHOR> Yep, I am also waiting. I got the Selected Papers on Analysis of Algorithms, Discrete Math, Computer Science and now waiting for this.

<comment><USER2> Are you planning on posting notes for the Papers, or are you going to do the "Musings" videos first?

<comment><AUTHOR> I am going to intermix Musings and Papers. Some weeks will post Musings videos, some weeks notes of Papers. The next Knuth related post will be Musings.

</comment></comment></comment></comment><comment><USER3> I went to Case and was a border (renter, not member) one summer in his former fraternity's house (Theta Chi). Kind of cool to see the composite photos from the late 50's which included him.

<comment><USER4> Wow, I didn't know he was in Theta Chi. When I was going to Case, that place was straight out of Revenge of the Nerds.

</comment></comment><comment><USER5> He looks so old for 20.

<comment><USER6> I think that's from his style, not his physical looks.</comment></comment>


Launching Co-Sign Pages and M-of-15 Multisig API - <AUTHOR> http://blog.coinkite.com/post/102291566521

<comment><USER2> Is your multisig compatible with other multisig solutions (Copay, Armory ...)? If yes, to what degree? Are there any standards for multisig?

<comment><AUTHOR> We are using P2SH and multisig transactions the same as everyone else, and we tried to interop with others, but it's not easy. They problems are discussed [in the FAQ]([https://coinkite.com/faq/multisig](https://coinkite.com/faq/multisig)). Key generation is open and interop with brainwallet and bip32.org

We've added this to help you with that. [http://cl.ly/image/0g2d3x1T3o0H/Detail%20View%3A%20Account%2...](http://cl.ly/image/0g2d3x1T3o0H/Detail%20View%3A%20Account%20'test- prod'%202014-11-18%2010-30-41.png)

        Do Coinkite shared accounts interoperate with other vendors?

        Although we are using the latest Bitcoin standards and technologies, it is hard to interoperate because of the following issues:

            - Both parties need to correctly track all future and past P2SH addresses.
            - Other "multisig" vendors are using P2SH and multisig in very limited ways.
            - Most other vendors are keeping one private key to themselves, which prevents any useful interop.
            - The BIP32 HD wallet paths are not well standardized.
            - Any mistake or incompatibility can lead to lost funds and very bad karma.

        However, to encourage progress in this area, we do include a "data export" option for one US-based exchange (Coinbase) and will add support for other vendors if it is useful. We also provide a one-click data export of all the details of the shared account, in our own simple JSON format.

        We cannot provide technical support for individual end-users attempting to interoperate, but we are willing to speak to other vendors and support the greater crypto-currency community.

*edit: layout

<comment><USER2> Thanks, how can I send bitcoins out if Coinkite shuts down? Let's say I made copies of all MofN pribkeys.

<comment><AUTHOR> Assuming you have the xprvkey for M of your N keys, then you just need to find the UTXO for your funds and publish a transaction that moves that to another key.

We list all UTXO for your account (with all the transaction hashes needed) in what we call the "audit report" and that includes multisig accounts now too. The subkey needed (M/x) is indicated in that report as well. Armed with that information, a site like ms-brainwallet can produce and send the transaction you need.

Also for you doomsday planning: we email a copy of the HSM private keys associated with your multisig account, encrypted with Coinkite master key that would be published after we shutdown. (Very similar to what we've always done with regular accounts).

</comment></comment></comment></comment><comment><USER2> This is amazing, specially because I can upload my own keys.

<comment><USER3> I have in the past been a vocal critic if Coinkite, but now I take it back.

This is a very intelligent move and this does offer the security that is in line with Bitcoin principles - actions speak louder than words and in this case they have listened to criticism and acted correctly.

<comment><USER4> I've always told people in the past the Coinkite's model - trust Coinkite to handle security for you - has a valuable place in the Bitcoin ecosystem, however it's certainly not for everyone. I personally use Coinkite to store a portion amount of my Bitcoin savings as a diversity measure, but I'd never trust them with everything.

But this new multisig support gives you the option to have the best of both worlds: Coinkite helps keep your Bitcoin's safe, and so do you. And I'll probably move the Bitcoins I currently store at Coinkite to a Coinkite multisig account myself.

Disclaimer: I'm Coinkite's Chief Naysayer. [http://blog.coinkite.com/post/85842528071/peter-todd- joins-c...](http://blog.coinkite.com/post/85842528071/peter-todd-joins- coinkite-as-chief-naysayer)</comment></comment></comment>


Rapid Prototyping of Interactive Data Science Workflows in Jupyter - <AUTHOR> http://willcrichton.net/notes/rapid-prototyping-data-science-jupyter/ <comment><USER2> I've invested a lot of time into the IPython & Jupyter tools. In one job, I even wrote a 0MQ kernel to leverage ipython as a repl for a programming language created inside my company (which had horrible developer tooling).

After working on several large machine learning and data science projects over the years, I've sadly come to the conclusion that the notebook environment is a very wrong approach to take for shareable, extensible or reproduceable systems. On my team now, aside from the tiniest, most ephemeral prototypes that can be thrown away entirely, nobody ever uses Jupyter notebooks for anything.

The projects I'm referring to are very similar to those of this post too — an in-house image annotation tool we wrote with PyQT instead of notebook widgets, lots of interactive Flask web apps with simple React pages to demo and explore face detection results, diagnostic graphs, search engine output, and prototyping systems for layouts of image search results pages under different ML based ranking algorithms.

The main reason the notebook caused problems is that it leads to poor software craftsmanship, which should be a consideration even from the earliest stages of models and prototypes (because it will make you produce higher quality output faster, not for any spiritual commitment to coding standards).

When notebooks contain code you wouldn't want merged into a given library or project's main branch, it needs code review. And notebooks are awful units of work to review because they break models of automated testing, lack the same context for enforced style guidelines, and are generally written with a mix of priorities usually focused on the way the code author wants to think about the prototype, instead of separating these concerns into decoupled units.

Through review, you quickly realize that anything that needs code reuse has to be using good design principles, separating concerns, organizing things into decoupled functions or possibly classes.

When you factor these all out of the notebook and into a helper module (and write tests), then you see a bunch of the magic constants or initialized parameters that need to be factored out into a parameter file so that you can easily vary parameters, have it version controlled, and have a way to connect results artifacts (usually embedded plots or tables and saved data files) with parameter settings used to generate them.

Then you realize you need to make the overall software environment also reproducible, because a notebook itself is never "reproduceable" apart from the overall software environment it was run in, and other people picking up your notebook would need the same data and possibly a Docker container or other container or VM to match the same software, libraries, network settings, port number, etc.

And this process goes on until you realize you had to factor things into a tested module, automate the creation of the surrounding Docker container or other environment, extract out & document all your parameters, and so on. Until finally there is nothing left in the notebook but custom plotting code or data displays.

And the display units could be e.g. a version controlled latex file that picks up image files or renders table templates with data, or a separate web app that uses good design to implement reusable video display or something, all called from a boring non-notebook launch script, all of which could be driven by a simple custom Makefile — making the whole thing just as interactive, generally more so, as the notebook which suffered all the problems.

I fully agree this requires a team with good software craftsmanship skills. But anybody competent enough to write the original notebook can also learn these skills, and reorganize the work with just a few craftsmanship principles that almost immediately reveal the notebook as something that just gets in the way and slows you down.

And for teams needing to make reproducible data studies or reproducible model training environments for real business situations, this effectively makes a notebook inappropriate most of the time.

The main use cases where the notebook remains value-additive are situations where you can throw away the prototype at any time, it does not need any maintenance and it has no code or analysis within it that needs to be reused.

This does happen for some kinds of tutorials, some pedagogical uses, and some totally ad hoc work, like slinging some code to whip together a quick answer for someone on the business team. The notebook can still be good for these cases.

But these really represent a small number of use cases, certainly much smaller than the set of use cases the notebook is marketed towards.

My experience, after being a zealot for IPython notebooks in the early days, is that notebooks are just way oversold, and they encourage thinking in a low- craftsmanship manner, and are best avoided as a general rule of thumb.

<comment><USER3> I feel like most of the problems you list come from trying to version control notebooks, which may just be a futile endeavor.

I primarily use notebooks as a worklog for explorative analysis. I can use them to track down the history of experiments and thought processes that led me to those experiments, to help me avoid treading over similar waters and to keep a single cognitive thread throughout the whole process. And if any idea is worth building actual software for, it then becomes a good reference for those projects.

The crucial idea here is to NOT change the notebook over time, just add to it. Then there are no versioning issues. And when it gets too large to navigate efficiently, just break it apart and continue the thread in the next notebook.

Of course in a collaborative environment this kind of thing is less useful, but for keeping track of individual work it can still be effective.

<comment><USER2> I am sympathetic to your perspective, especially because it's basically what I thought when I was in grad school too, and I totally know where you are coming from. But I wanted to highlight what I think are reasonable counterpoints to some of what you wrote:

> "I can use them to track down the history of experiments and thought > processes that led me to those experiments"

But this is exactly what you _can 't_ do with notebooks, mainly _because_ they are not well-suited for review. This is true even when working alone, but is amplified when working in a team because even experimental choices require code review.

For example, I worked on a problem once where we needed to train a neural network for age prediction. Someone on the team very familiar with how to write this using Keras began writing up an ad hoc training script, meant to be a "playground" for changing parameters, re-running analysis, etc.

But through code review, even before any experiment was run, we detected bugs in some of the code, mistakes in how the data was being loaded and data cleaning steps, and assumptions that had been made about parameters for less frequently used activation function parameters. By having extra reviewers look at it and _review the intended experiment itself, as well as the code to implement it_ we saved a lot of time, gained from diversity of opinions about how to handle it, avoided needing to debug incorrect diagnostic or accuracy charts to backtrack to these bugs later.

Code review doesn't always solve all of these problems, much the same way that it doesn't solve all the problems of straight software engineering. But it is clearly such a valuable tool that it almost always should be a baked-in, mandatory part of the process, even for greenfield experimental code. And the notebook makes this so hard that people don't do it, and when they do it, they don't benefit much from it.

> "The crucial idea here is to NOT change the notebook over time, just add to > it. Then there are no versioning issues."

I wish it were that easy, and that effectively "undo" resolved all versioning problems, but that is extremely rare. In many cases, you need to run the same analysis notebook with a variety of different parameters, and each one corresponds to a separate experiment. Doing this by manually tweaking parameters, hoping you didn't make a typo, and then storing the output artifacts in a file called "run7_alpha3.0_learningrate_0.001_04242018.tar.gz" leads to awful problems of reproducibility.

The other thing is that even if you only add to a notebook, you might be adding the use of new third-party libraries, or adding code that assumes some version of something has been implicitly upgraded in the background. So you'd still need a ground truth source of all your dependencies, like requirements.txt for Python, with possibly more information about the Python version itself (does your notebook code rely on stably ordered dictionaries starting in Python 3.6? How would someone coming to the notebook know that if they are using 3.5 and the results seem funny for no discernible reason?) -- and in general you'll need some overall environment management setup to ensure, for reproducibility, that other people can download the same data, setup the same language environment, get the right versions of the required libraries, and have other system dependencies if there are any (maybe they need a certain version of CUDNN installed? Or maybe you used TensorFlow built from source with extra optimization flags enabled?)

The idea is to take a good "project hygiene" and software craftsmanship approach out of the box, to avoid situations when someone says, "why is this notebook broken on Bob's laptop? It works on Alice's Ubuntu server...". And to always design for code review and testability from the start, because they are huge productivity enhancers and the benefits compound over time. Even for research-oriented prototypes.</comment></comment></comment>


$1.5 Million to take on Craigslist. Good Luck. - <AUTHOR> http://www.techcrunch.com/2008/08/21/stealth-startup-ilist-raises-15-million-to-take-on-craigslist-good-luck/

<comment><USER2> I think all the people saying it's hard to take on craigslist are right.

My own spin on it is simply that craigslist has been around since the dawn of the popular web, it was founded in 1995, and started growing rapidly in 1999. The fact is, it takes time to build the network effect inherent in business models like craigslist (and ebay, also founded 1995).

The current startups trying to tackle these problems all seem stuck in the 'get big fast' mode of the 2000 bubble era companies, aiming for millions of users in a couple years. It ain't gonna happen (most likely). You are most likely going to be growing slowly, and if you really want success in this field, you need patience to whether the storm of not much activity (we're talking years here, I'd say minimum 4).

But most start ups usually aren't built for that, they are taking 1.5 million funding, burning through it promising big returns and large growth month over month, and investors get tired of that game real quick if a site is not delivering.

I think it's a good opportunity from someone in the hacker news mindset to build something simple NOW, work on it on the side for a few years (4+), and see what happens. Heck, I may do it myself.

<comment><USER3> Countless articles I've read about Craigslist say they could make a lot more money than they do if they were more business-like, more aggressive. They choose not to. As I understand, they only charge for job ads, nothing else.

Also, a small but important point about the identity of Craigslist as a community is that Craig Newmark has a purpose behind sticking with .org instead of .com.

</comment></comment><comment><USER4> In Norway there's a service called Finn (www.finn.no), that translates to "Find"

They were backed by a large news corporation, so that probably helped. The corporation really didn't want to look too much at classifieds on the internet, since they had a paper business to protect. That's why they waited until 2000 before the site was released.

When it comes to real estate, I think they have close to 100% of the market. Only real estate agents are allowed to post ads, and I think they pay a lot to do so.

They are also huge in the motor market. You have to pay 76 USD to add your used car to the listing. There are numerous free alternatives, but people still use Finn because it is _the_ place to go.

When free alternatives can't compete, what can? When someone has a lot of market share, it is hard to compete.

But on the positive side, there's not a lot of spam :-)

Examples: <http://www.finn.no/finn/car/used/result?CAR_MAKE=749>

<http://www.finn.no/finn/realestate/homes/result?areaId=20061>

</comment><comment><USER5> This is interesting, especially after yesterdays thread (<http://news.ycombinator.com/item?id=281741>). I think we determined social functionality wasn't the answer. Hope they read that before they launch :)

</comment><comment><USER6> The way to take on Craigslist is 1) to be better than they are, which is not hard, and 2) to have some way of getting past their network effect advantage. 2) is hard. Maybe it can be accomplished in a particular niche. But you aren't going to be able to take them on across the board without a _lot_ of resources.

<comment><USER7> I'm not sure I agree. I've heard the sentiment that the network effect is unbeatable a few times. I think people are so hungry to take over CL's market that if you had a good product it shouldn't be so hard to get it well publicized. ESPECIALLY if you beat them in how housing is done.

There's no need to take on the rants and raves service CL provides.

<comment><USER6> Words placed in my mouth again. I don't think Craigslist is unbeatable. I just think that beating the network effect is going to be hard. Either have a _lot_ of resources, or do a tactical concentration in one area. Apparently, there are lots of competitors to Craigslist overseas because they could avoid the network effect. There are also local market competitors.

<comment><USER7> I responded to you, but the sentiment I mention is here on HN in a bunch of places.

</comment></comment></comment></comment><comment><USER8> probably will fail. Facebook marketplace is pretty much what these guys sound like, and its a failure. And these guys are trying to replicate this w/o the millions of users

<comment><USER9> Facebook's marketplace failed cause it wasn't a core product and they didn't want to advertise it. I'll bet most members didn't even know it was there.</comment></comment>


Why does Dropbox download so slowly? - <AUTHOR> http://www.flickr.com/photos/scriptingnews/5212518385/ <comment><USER2> It will gradually pick up in a few minutes. I've had that before too. Not sure why sometimes it starts up slowly.

<comment><AUTHOR> It takes a lot longer than a few minutes for it to speed up. Sometimes I come back the next morning and it's still running in the 2K-5K per second range.

I thought it was peer-to-peer, I don't think they're even keeping copies of the data.

BTW, I'm running the 0.8 version, it's supposedly faster, but so far -- doesn't seem to be.

<comment><USER2> I don't think they're using peer to peer. From what I know they use local syncing on the client and the content is uploaded via SSL, and stored encrypted on EC2 storage.

<comment><AUTHOR> Thanks -- a friend and I were discussing that the other day. I wasn't sure, he thought for sure it was P2P.

<comment><USER3> It is peer 2 peer within the lan ( see options - enable lan syncing ). This is great for companies that manage shares though dropbox. This way you don't have 40 people download the same bit.

</comment></comment></comment></comment></comment><comment><USER4> You don't need a camera to take a screenshot.

<comment><AUTHOR> Thanks. Usually true, but in this case, I did.

</comment></comment><comment><USER5> Usually when this happens to me, I close Dropbox (quit the application), wait a few minutes, then re-open it. Typically that fixes the slow speed and ramps it back up to capacity (I'm on Verizon Fios).

</comment><comment><USER6> Ceph or AFS may be worth a look-see

<comment><USER7> While Ceph is a cool project (in my heavily biased opinion), it's in a completely different realm from Dropbox.</comment></comment>


Lawmakers Warn Against Private Equity Firm's .Org Takeover - <AUTHOR> https://gizmodo.com/top-lawmakers-warn-against-private-equity-firms-org-ta-1840612552 <comment><USER2> Asking the right questions starts with looking at the wrong candidates. Is a central-control domain system a good idea? What else is there? What else can one think of? Is trusting anyone good architecture? Is there still hope to implement something else? Are domain names the first kind of e-coin? Are the keepers innovative companies or just rent seekers? Do the customers have any influence or are TLD's an unavoidable monopoly?

<comment><USER3> Central control over this type of resource is demonstrably a good idea. Domain naming, considering the global scope and collision possibilities, is analogous to the electromagnetic spectrum from a regulatory perspective. If we didn't have the FCC and instead relied on private entities to regulate our radio spectrum, I am almost certain we would be amidst technological anarchy on a daily basis. Even with the FCC as the central authority, we continue to have a number of conflicts that come up. It would seem as technology progresses this space is getting harder and harder to manage. Satellites, self driving cars, next-generation cellular communications...

I hesitate to start involving real-world geopolitics, but perhaps this is yet another compelling use case for a body such as the UN. Perhaps you don't trust one nation (e.g. the USA) to administer the entire domain naming system, but you would almost certainly trust a quorum of (ideally peaceful and democratic) nation states to do so.

<comment><USER4> Wireless spectrum isn't a great analogy for domain names. Spectrum is extremely scarce in practice, names aren't. There are hundreds of bits of entropy available so we're never going to run out of domain names even in an individual TLD. Even _good_ names aren't particularly scarce because there are so many TLDs.

The real issue here is that once you start using a name, it becomes a dependency. You may not have any preference for example.org over example.us on day zero but you sure do after you've been using one of them for a decade.

So the thing that works really well looks a lot like Namecoin, but not quite. You do want some modest annual maintenance cost per name just to discourage squatting on short/common names and cause people to return names to the available namespace once they're not using them anymore. What you don't want is for anybody to be able to ever cancel an active registration or change the terms or cost once a name is already registered.

You could do that with blockchain like Namecoin, or you could do it through legislation or contracts. Either way, it shouldn't be possible for anybody to cancel or change the terms of a registration for a name that's already registered, and that's the biggest failing of the existing system.

<comment><USER3> Yes the spectrum is scarce in practice, but in theory it doesn't need to be. The problem in practice is that there are massive chunks of extremely useful spectra locked up in legacy telecommunications stacks that make the spectral efficiency of 4G look like an impossible feat by comparison.

If we had a magic wand and could instantly put everything on a standardized global DSSS/CDMA-style scheme (across any arbitrary frequency ranges), I feel we would have far more to go around.

<comment><USER4> That doesn't really change the comparison. It would be better if we made more efficient use of the wireless spectrum, but if we did then people would just replace more copper and fiber with wireless. The wireless spectrum would still be in contention as a scarce resource in a very practical sense.

By contrast, people registering every possible domain name is never going to happen. Just the computational resources necessary to do that don't even exist in the world.

What makes a name valuable isn't that names are rare, it's that people know your name. Things point to it. So we don't really need to ration them but we do need to make it so that once a name is yours, it stays yours. Nobody should be able to hold your own name hostage from you.

</comment></comment></comment></comment></comment><comment><USER5> Does anybody know whether `.ngo` and `.ong` -- also managed by PIR -- are part of the package? Hunting around on the PIR website produced no hint either way.</comment>