Tesla's Elon Musk Swipes at Porsche-Buying Bill Gates - <AUTHOR> https://www.bbc.co.uk/news/technology-51546891 <comment><USER2> A whole article written about this one single Tweet? [https://twitter.com/elonmusk/status/1229568241552502784](https://twitter.com/elonmusk/status/1229568241552502784)

> @elonmusk My conversations with Gates have been underwhelming tbh

<comment><USER3> Journalism dawg.

1\. Copy something divisive that was posted publicly

2\. Add unnecessary setting i.e. state the obvious: "posted on Twitter last night" when there is a timestamp on the tweet. Did you know that Bill Gates is a Microsoft founder? Elon likes to tweet Etc.

3\. ??? aka run ads

4\. Profit

My experience with this "article" has been underwhelming tbh.

</comment></comment><comment><USER4> It's _Bill Gates_ ... let the man have his Porsche.

Regardless, the Taycan is a hell of a machine and is going to have better fit and finish than a Tesla. It's also the hot new thing, whereas the Model 3 is old news.

Assuming you can afford both, I can't think of anyone who'd take the Tesla over the Taycan.

<comment><USER5> Tesla has world class fit and finish... even Bob Lutz agrees.

"But, when next to the car, I was stunned. Not only was the paint without any discernible flaw, but the various panels formed a body of precision that was beyond reproach. Gaps from hood to fenders, doors to frame, and all the others appeared to be perfectly even, equal side-to-side, and completely parallel. Gaps of 3.5 to 4.5mm are considered word-class. This Model 3 measured up."

[https://www.roadandtrack.com/new-cars/a28008116/tesla- model-...](https://www.roadandtrack.com/new-cars/a28008116/tesla- model-3-build-quality-bob-lutz/)

<comment><USER6> > Tesla has world class fit and finish.

Anyone who genuinely believes this is lying to themselves.

How come you've copypasted this same comment 3 times in a row?

And anyway, the quoted bit is about panel gaps, that's only a relatively minor part of fit and finish. Try sitting in a tesla and an actually nice car.

</comment></comment></comment><comment><USER7> I have driven all the Tesla models. They are really quite cool, however I cannot reconcile fit and finish vs price point. I reached a point in my life where I could buy MB, Porsche, etc. and I did. It sets the bar higher on what you like. The Tesla's are not there. Most of price on the Tesla is because of the batteries, I understand that. This is why the Porsche properly equipped is ~180K. I will never buy another gas car so I am hoping the prices point on an electric from the luxury manufacture comes down rapidly. For me, I cannot rationalize paying 180K for the Porsche. That number is just over some line in my head, even if I can just write a check for it.

<comment><USER8> You can equip a Taycan 4S quite nicely for $130K US, but what you probably want is the electric Macan next year. Taycan is priced (and roughly sized) around Panamara, which sells for 90K to well north of 200K. Macan starts much lower at 50K. The BEV version will likely start higher than that, I'm betting even well equipped ones will be under 100K.

<comment><USER7> Thanks for sharing that! My wife has a Macan with 80K+ miles on it that we have started to think about a replacement for. I did not know this was in the works.

</comment></comment></comment><comment><USER9> Bill has owned a lot of Porches. It was his first big purchase:

[https://www.cnbc.com/2017/12/20/the-first-big-purchase- bill-...](https://www.cnbc.com/2017/12/20/the-first-big-purchase-bill-gates- made-when-microsoft-started-taking-off.html)

[https://www.motor1.com/news/76136/driving-a- porsche-959-in-t...](https://www.motor1.com/news/76136/driving-a- porsche-959-in-the-us-thank-bill-gates/)

I forget if that's what he was driving when he was arrested:

[https://commons.m.wikimedia.org/wiki/File:Bill_Gates_mugshot...](https://commons.m.wikimedia.org/wiki/File:Bill_Gates_mugshot.png)

<comment><USER10> Gates was arrested in his 911, back when Microsoft was still out of New Mexico.

As for Gates buying a Taycan, I'm _pretty sure_ he's the most important customer of Porsche of Bellevue. Not just because he's Bill Gates, but that he's still regularly buying 911s.

</comment></comment><comment><USER11> Hasn't Gates been driving Porsche forever ?

Plus when you have Gates' level of money you probably don't give a fuck about autopilot (which is tesla's only advantage) since you can hire as many drivers in rolls royce as you want.

<comment><USER12> Yes, he also had a Porsche he purchased stuck in customs and got a law passed to allow him to import it. He is a huge Porsche fan.

</comment></comment><comment><USER13> the tesla hype machine must continue...... Bill's been a Porsche guy, does he still have the 959?

<comment><USER14> Afaik he still has it , making sure to keep the annual millage under 2500 for that special import law he and some motoring aficionado's got passed.

<comment><USER15> This special import law is called "Show or Diplay" and is a statuary amendment to the Unite States Federal Motor Vehicle Saftey Standards (FMVSS).

"Because of the expense and effort required to import a vehicle with this exemption, the approved vehicle list is mainly limited to high-value sports and touring cars."

[https://en.wikipedia.org/wiki/Show_or_Display](https://en.wikipedia.org/wiki/Show_or_Display)

</comment></comment></comment><comment><USER16> Once again, Elon Musk proving that no matter how smart you are, you can still choose to be a total asshole.

</comment><comment><USER17> Top Gear recently reviewed the Taycan. It roasted the Tesla so there's one reason to pick that over the other.

<comment><USER18> I don't know how the Taycan compares to a Tesla, but Top Gear has had an anti- Tesla bias for a very long time, going back to when they did a negative review of the Roadster that was entirely fake and staged. So take its reviews with (un)healthy doses of salt.

<comment><USER19> This is a totally totally different generation of top gear. The serious car reviews are now mainly done by Chris Harris who is a very respected automotive journalist.

</comment></comment></comment><comment><USER20> Not only is Elon brilliant but he also has a great sense of humor.

<comment><USER21> If you're a misanthropic edgelord, yeah, he's the top of the heap.</comment></comment>


Should software be patentable? That's the wrong question to ask - <AUTHOR> http://www.zdnet.co.uk/news/intellectual-property/2011/10/29/should-software-be-patentable-thats-the-wrong-question-to-ask-40094152/ <comment><USER2> The central argument holds: a machine process implemented in hardware is in essence no different from one implemented in software.

But you can drive that argument in two directions.

1\. The hardware invention is patentable therefore the software invention should be patentable.

2\. The software invention is unpatentable therefore the hardware invention should be unpatentable.

Because it suits his purposes, the author article opts for the former.</comment>


Bugchecker.net – finds bugs in your binaries (symbolic execution) - <AUTHOR> http://bugchecker.net

<comment><USER2> As someone that does dynamic binary translation for kernel modules (to find bugs) and eventually wants to get into symbolic/concolic execution (to find bugs), this is cool. I would be really pleased if they're able to make a successful business out of this!

<comment><AUTHOR> Thanks! If you have any advice, we are all ears.

<comment><USER2> I'll try to come up with more ideas as they pop into my head, but given that you consume a binary, I'd like to see a service that consumes core dumps and does what " Automated Debugging for Arbitrarily Long Executions" (HotOS'13) does (a sort of reverse symbolic execution for find the root cause(s) of a the failure). An extension of this idea would be to operate on arbitrary program images, perhaps multiple images, as a mechanism of doing concolic execution.

Are you using concolic execution, or thinking of going in that direction as a way of generating more runtime-specific info, e.g. execution interleavings, data sharing, common values for memory locations, hot paths, etc.

I suppose a bunch of this is probably outlined in your API or integration with one's build system, but it would be great if a lot more about the process and capabilities of this system were detailed up front. For example, I think it would be useful to make some case studies of some programs, in a similar way that the Viva64 guy does for PVS-Studio, as a way of showing people how to use your system effectively.

Otherwise, I find the traces hard to digest. Unless there is some better interface for reading things, I think it would help convince people that your product is useful if, for example, your system reported the bugs it found in a very clear way. If debug info is in the binary then that should also be referenced, etc.

Finally, a passing note: I think your biggest "competitor" is going to be a tool like AddressSanitizer and other compiler extensions. I mean, I know solving more bugs is good for everyone and whatever gets the job done means better code out there, but I assume eventually you need to make money and convince people that you're going to solve a problem that a compiler extension can't. This is kind of the situation for DBT systems now :-P

</comment></comment></comment><comment><USER3> The About page talks about Klee, the program that Philip Guo talked about in his story about the trials of PhD life:

[http://pgbovine.net/PhD-memoir-prologue.htm](http://pgbovine.net/PhD-memoir- prologue.htm)

</comment><comment><USER4> Just read about: [http://bugchecker.net/about](http://bugchecker.net/about) \- apparently only x86-64 Linux executives. Which is still pretty awesome.

<comment><AUTHOR> Thanks for reporting this, looking into it. The Windows support is fairly unstable right now. About page updated.

</comment></comment><comment><USER5> I would change on the website:

1) Upload binary 2) Receive Bugs

to:

1) Upload binary 2) Discover Bugs

<comment><USER6> Looking at the picture, I'm pretty sure it's intentionally worded that way. A spin on "Push Button, Receive Bacon".

[http://knowyourmeme.com/memes/push-button-receive- bacon](http://knowyourmeme.com/memes/push-button-receive-bacon)

<comment><USER5> Ah, wasn't aware of that meme. I'd still go "Strunk & White" and keep it concrete rather than clever when writing for a business.

<comment><AUTHOR> Done.

</comment></comment></comment></comment><comment><USER7> The console app / bugchecker python script on this page: [http://bugchecker.net/console](http://bugchecker.net/console)

needs the BUGCHECKER_API_URL = '[http://localhost/api.php'](http://localhost/api.php') changed to '[http://bugchecker.net/api.php'](http://bugchecker.net/api.php') to work.

<comment><AUTHOR> Very appreciated, fixing...

</comment></comment><comment><USER8> Have you thought of using something besides uclibc? uclibc has all kinds of corner cases of non-conformity, musl would be a somewhat better alternative. Can this work on shared libraries as well if given a header?

<comment><AUTHOR> * It doesn't use uclibc. The way it works is the guest program is a snapshot of the target program process after it has been linked with its shared libraries. Usually this means it's linked with glibc (but not necessarily -- cyanogenmod programs are linked with bionic).

* Shared libraries: yes, and it doesn't need a header. Not supported yet in the interface. It does need access to the function symbols though.

<comment><USER8> Hmm are you thinking of open sourcing this at all? It seems much different than klee. Personally I would do a two tier model open source getting trickle down and the closed having extensions and target software companies that use things like coverity</comment></comment></comment>


What Makes a Good Teacher? (2001) - <AUTHOR> https://www.unicef.org/teachers/teacher/teacher.htm <comment><USER2> Great teachers come meet you where ever YOU are at in your knowledge.

Once they are next to you, they guide you to take the very first step, nothing more. Then just the second step, nothing more. Then the third etc.

If you are not understanding what is being taught: the problem is the teacher.

Soon you both see YOU have more confidence. That confidence is called learning and the best teachers know when to pull back and let you go on your own.

Great teachers do not judge you. If you are embarrassed in front of a teacher because you do not know something; the problem is the teacher.

The best teachers let me be myself and just showed me how to take the next step.

<comment><USER3> > If you are not understanding what is being taught: the problem is the > teacher.

That's obviously false. If you don't pay attention or don't do your homework or skip classes eventually you will fall back enough not to understand what is being taught.

Teacher can't repeat basics forever because there are other students in the class too, maybe they do pay attention and do their homework and would like to learn - wasting their time because one person doesn't care is absurd.

BTW I think online remote learning (which was implemented in my country because of COVID-19) could help with this issue. There's no reason for kids to be divided into classes according only to their physical location. It's possible to organize classes from all over the country divided by results of some placement tests, where every student has problems with the exact same concepts.

This shouldn't completely replace normal school, but it could be useful tool for keeping struggling kids up to speed (let's say there's 1 hour a week of remote math class where every kid is put into appropriate countrywide group of kids with similar problems).

<comment><USER4> I agree with you both. I like to think I'm a good teacher, and if they don't understand then it's down to me not them.

But I was given an 'apprentice' to teach. He was very willing to learn, very interested in the subject (programming) but only insofar as I poured the knowledge into his ears. He would not do any work I set him so pretty soon I threw in the towel. I really enjoyed teach, he really enjoyed learning, but his dismotivation finished it, what a waste.

</comment></comment></comment><comment> a-ve From Paul Graham's RAQ:

[http://www.paulgraham.com/raq.html](http://www.paulgraham.com/raq.html)

I'm about to become a teacher. How can I be a good one?

The best teachers I remember from school had three things in common:

(1) They had high standards. Like three year olds testing their parents, students will test teachers to see if they can get away with low-quality work or bad behavior. They won't respect the teachers who don't call them on it.

(2) They liked us. Like dogs, kids can tell very accurately whether or not someone wishes them well. I think a lot of our teachers either never liked kids much, or got burned out and started not to like them. It's hard to be a good teacher once that happens. I can't think of one teacher in all the schools I went to who managed to be good despite disliking students.

(3) They were interested in the subject. Most of the public school teachers I had weren't really interested in what they taught. Enthusiasm is contagious, and so is boredom.

<comment><USER5> > They had high standards. Like three year olds testing their parents, > students will test teachers to see if they can get away with low-quality > work or bad behavior. They won't respect the teachers who don't call them on > it.

A related anecdote: I was a TA for a course in which the students were required to write weekly essays. The first ones had grammar so bad that they were excruciating to read. Despite not being allowed to deduct points for such things, I copyedited all of them to fix the worst mistakes and returned them covered in red ink. By the next week, they had all figured out how to write in complete sentences, making my job much easier for the rest of the semester.

</comment></comment><comment><USER6> If you're interested in math teaching in particular, you may like:

\- How I wish I'd taught maths (Craig Barton)

\- How to solve it (Polya)

The former is written by an already-successful math teacher, who applied others' research to further improve his teaching.

The latter is about the stages of solving a math problem.

I've had an interest in math teaching for quite some time, and recently joined a company (Yup) that provides 24/7 on-demand online math tutoring. Our tutors are trained to first figure out where the student is in their process of solving the problem or understanding the topic. Only then can they take action to help the student continue their learning.

<comment><USER7> Craig Bartons book is very good - he has a podcast as well "Mr Barton Maths".

About online tutoring: I work in the UK as an Adult maths tutor. I get GBP 24 per teaching hour which includes an allowance for prep time. It's alright as tutoring jobs go.

I had a quick look at Yup as it seems interesting. But Glassdoor reviews state tutors get ~ $10-$15 an hour. (some say $11 an hour)

Ah c'mon. I find that depressing. They're looking for high quality flexible tutors and pay that? I could work in Tesco stacking shelves for that. Even Amazon in the UK pay more (and I've worked there as a picker)

I find it cynical that so much quality is demanded from certain online companies and the pay is derisory.

I suppose the flexibility they offer is worth it for some people... and the chance to work from home...

Anyway had to get that off my chest... I think teachers are under-valued and under-paid anyway!

</comment></comment><comment><USER8> A good teacher finds the kernel of knowledge at the center of something, and teaches you _that_ so that you can synthesize/derive the rest of it.

Doing that isn't easy, and it generally requires a very rich understanding of the domain. If you find a teacher that can do that sort of thing, you're very lucky.

</comment><comment><USER9> Someone who pisses you off enough to get better, but not enough to make you leave.

</comment><comment><USER10> I will take the cynical side and say good students.

</comment><comment><USER11> Same stuff that makes a good leader.

IMO; They will engage you, make you curious, inspire you to become a better version of yourself and help you work towards your goals and objectives.

A good leader will also be there for you to guide you when you need extra attention and most importantly let you have room to fail.

To the good teachers and managers I've had, and I am currently having. Thank you.

</comment><comment><USER12> Diagnose before prescribe.

Student is lost with only you on a walkie-talkie. You need to know where they are to know what instruction to give.

Gaps and misunderstandings must be identified to be corrected. It's debugging.

This is all very intensive, customized, one-on-one teaching. But there's no reason it can't be automated... in principle.

</comment><comment><USER13> Most, if not all, of these comments on unicef.org are bullshit/wrong.

Some literally are contradictory.

So what we have is, a lack of understanding what makes a good teacher in the broader community?

Or are we looking at the differing misinformed opinions as a way of understanding local cultures?

</comment><comment><USER14> Someone who truly understands what they are talking about from bottom to top and can fit the information into a larger worldview without introducing game breaking conflicts all over the place.

Someone who stakes a claim on the value of what they teach and personally self correct when flaws are found. He or she can debate the merits or justify the work being taught. The same person burns a path or spends the time to make somebody be taught something important and valuable.

</comment><comment><USER15> Obligatory link to Donald Knuth mishearing this question as "What Makes a Good T-Shirt?" [https://www.youtube.com/watch?reload=9&v=74BfHoE66rc&feature...](https://www.youtube.com/watch?reload=9&v=74BfHoE66rc&feature=youtu.be&t=42m17s)

<comment><USER16> What a great find. Made me smile for a few minutes! Thanks for sharing.

</comment></comment><comment><USER17> It is clear that secondary and primary level education is being addressed by this list. If it were tertiary, the list would sound very different, I hope.

Interestingly, and perhaps related... love is mentioned 14 times and friend 17 times, yet mastery and skill are each only mentioned twice.

</comment><comment><USER18> A good teacher is someone who has encourage your child to discover talent and find himself by having down to earth conversation. Not superficial character by being so cold and distant pretty much that's my opinion.

</comment><comment><USER19> Having to see kids learning up close, actual pedagogical knowledge matters.

<comment> barry-cotter True, but education in pedagogy doesn't. The effects of degrees in education on teacher effectiveness are not reliably distinguishable from zero.

<comment><USER20> All the best teachers in my school either where fresh graduates or didn't have a teachers license. My conclusion was simply that teachers burn out after a decade and should switch which is very hard if they have a five-year degree in pedagogy and not much else.</comment></comment></comment>


Why do numpads on keyboards and phones have reversed layouts? - <AUTHOR> http://ux.stackexchange.com/questions/16666/why-do-numpads-on-keyboards-and-phones-have-reversed-layouts

<comment><USER2> My personal theory is:

Until a few years ago, the middle digit of North American area codes had to be a 0 or 1 (it's how the area code was identified when dialed), so putting them further away would result in fewer mis-dialed numbers that would inadvertently request a long-distance line.</comment>


Laverna – Store your notes anonymously and encrypted - <AUTHOR> https://laverna.cc <comment><USER2> A good start. But...

The USP of Evernote isn't that you can take notes from anywhere as much as anything can be a note (An audio clip, your current location, a picture etc) and that can be very well organised, grouped and saved in the cloud and offline on demand.

It's basically a "database" for the non techies: Save everything in there and query by tags, organise by books or search in the content and meta data.

<comment><USER3> And that there is an app for most platforms. I'd actually love to see an open source version of OneNote (pen based abilities, search performance and OCR capabilities) more than Evernote.

<comment><USER4> Yup, mobile was the first thing I looked for. I can barely stand most browser apps anymore.

</comment></comment></comment><comment><USER5> The web is not a secure medium for this kind of application.*

This is because all the encryption features they tout depend implicitly on content (HTML and JavaScript) the server sends you every time you use the application. Because you receive this content anew on every usage, there's no way to verify what you're getting. Today it might be fine, but tomorrow it might contain a key logger or subtle cryptographic flaws.

You also can't depend on the community for help verifying this content, because it can be distributed selectively. The mass of users might get benign content while interesting targets get backdoored software.

* It might be safe to distribute something like this as an installable sandboxed web application. I'm actually not 100% certain. But the no-install-just-browse-to-this-url model is definitely insecure.

<comment><USER6> The best way is a browser extension, but even that has its pitfalls (firefox especially since there's no real sandboxing).

It's never a good idea to do crypto over a website.

<comment><USER5> > The best way is a browser extension, but even that has its pitfalls (firefox > especially since there's no real sandboxing).

I would be greatly interested if you could expand on some of the pitfalls of browser extensions and how they differ among browsers. Thanks in advance!

<comment><USER6> I think the general pitfalls of a browser extension is that you're essentially trusting that the browser, which is acting almost as an OS in terms of separating the memory contents of different extensions, to work correctly. The idea is if you have an extension doing crypto, an extension that is syncing data with google has no way of reading the data from the crypto extension. You also have to make sure the same applies for websites as well...extensions should be able to grab data from sites, but not vice versa. Without this kind of perfect separation, your crypto extension is really just a sitting duck and none of the data in it is safe.

As far as how they differ among browsers, Chrome (and I suppose Opera, now as well) does a good job sandboxing one extension from another, and from stopping websites gaining access to running extensions. Is it perfect? I can't really answer that.

One problem with Chrome extensions is that unless you want your users to have to download the .crx file, and drag and drop it into their browser, you _have to use the Chrome webstore_. This is especially retarded because in order to upload your extension to the Chrome webstore, they either need your private key you signed the extension with, or they generate a private key for you. This means that your private key _is not private_ and extension signing is a complete joke. So if you're releasing an extension for the security-literate, it makes sense to create a .crx file, sign it yourself with your own PGP key, and offer it as a separate download that they _have_ to drag+drop into Chrome. The chrome webstore is not a secure means of distribution.

Firefox, on the other hand, is more forgiving with installations but has no real sandboxing. This means it's possible for one extension to read another's data. Plans to introduce threading (and I think as a consequence of threading, sandboxing as well) are in the works, but it's still going to be a while until Firefox gives extensions the same protections Chrome does.

Really, if you can, it's best to do crypto in a native app where the sandboxing is done for you by the operating system and you don't have to rely on a browser. Node-webkit is a great way to do this since it merges the two worlds nicely (at least for desktop).

<comment><USER5> Thanks for the great reply!

I didn't realize the Chrome web store requires your private key. That's insane.

</comment></comment></comment></comment></comment><comment><USER7> Why choose such a loaded name? "In Roman mythology, Laverna was a goddess of thieves, cheats and the underworld."

<comment><USER8> hah, I _love_ that

</comment></comment><comment><USER9> "Laverna is webapp written on JavaScript which means it requires no installation and no registration."

"None of us can get access to your personal data because we are using IndexedDB and localStorage. In fact all your information will be stored only on client side."

So does this mean that clearing cookies in Chrome will delete all your information?

<comment><USER10> If the chrome devs in their infinite wisdom lumped cookies and HTML5 localstore together, then yes.

<comment><USER9> Yeah, it's one option in Chrome unfortunately:

"Cookies, site, and plug-in data:

Cookies: Files stored on your computer by websites you've visited. These files contain user information, such as preferences for websites or profile information.

Site data: HTML5 enabled storage types including application caches, Web Storage data, Web SQL Database data, and Indexed Database data.

Plug-in data: Any client-side data stored by plug-ins that use the NPAPI ClearSiteData API"

[https://support.google.com/chrome/answer/95582?p=settings_cl...](https://support.google.com/chrome/answer/95582?p=settings_clear_browsing_data&rd=1&hl=en)

</comment></comment></comment><comment><USER11> I've been looking for a self hosted open source version of Evernote. I was excited when I first saw this but this isn't it. Storing all data locally defeats half the purpose. You can't even create notes on your phone and view them on your PC. Add to that, this seems to be only for text notes, which makes sense, since localStorage has a data limit of about 2MB.

<comment><USER6> Try [https://turtl.it](https://turtl.it)

It offers a hosted option (the default) or an open-source server you can run internally if you want more control of your data (or don't want to pay). Disclosure: I'm building it.

Note that Turtl uses IndexedDB to store everything (encrypted) locally, but also syncs to the server. This means if you wipe your local storage, your profile will be re-downloaded back to the client (only un-synced changes will be lost).

Mobile versions are on the way.

<comment><USER11> Looks interesting, I'll try using it for a week or so and see where it takes me.

Bit of advise however: The front page of the website doesn't really describe it very well. There's barely any screenshots (and the ones that exist are hidden for two thirds of the time), and there's not much of a description of the actual application. There's descriptions of what features it has over your competitors, but not really anything about what the core product is. Honestly, if I saw the website outside of the context of this comment thread, I probably would have passed it by.

All in all it looks like a good alternative to Google Keep which I can feel good about using. Best of luck!

<comment><USER6> That's incredibly useful feedback. Thanks for taking the time to mention that.

I think one thing I'm definitely missing are use cases, which would help people understand that product better. I'll see what I can do about making the screenshots more obvious as well.

I've been toying with the idea of creating a demo with pre-populated content and letting people play around with it on the site. Would that be something you'd try out as a passerby who happened to land on the site?

<comment><USER11> I tend to treat such demos as nothing more than glorified screenshots. For example, Mailpile has a demo similar to what you described and I spent maybe 10 seconds in it clicking on a couple buttons. That said, I'm sure it is very useful to some other people. I'd recommend getting in touch with some of the Mailpile guys or anyone else who can relay their experiences about how useful it is.

</comment></comment></comment></comment></comment><comment><USER12> I've been looking for a replacement for Evernote for a while. So far I've tried wikis, bluenote, vim + git + markdown.

The most important feature keeping me with Evernote is the ability to drag and drop images.

<comment><USER13> You might like the open source Zim: [http://zim-wiki.org/](http://zim- wiki.org/)

It's completely replaced Evernote for me. You can drag and drop images from a browser or the file system.

<comment><USER14> That looks like a Tomboy clone? Interesting..

</comment></comment></comment><comment><USER15> Very cool. One comment: I wish you could edit notes from the main view directly, similar to simplenote ([http://simplenote.com/](http://simplenote.com/)).

</comment><comment><USER16> This is not an alternative to Evernote. It is an alternative to nvALT or Notes.app.

</comment><comment><USER17> As regards replacing Evernote, there is already the very capable and stable Zotero[1], which provides source to roll your own server[2]. It integrates well with LibreOffice and LaTeX/BibTeX.

It does nothing to address the anonymous or secure aspects however.

1\. [https://www.zotero.org/](https://www.zotero.org/) 2\. [https://www.zotero.org/support/dev/dataserver_setup](https://www.zotero.org/support/dev/dataserver_setup)

</comment><comment><USER18> The more secure place to store notes is in a notebook you carry around with you all the time.

</comment><comment><USER19> Keep an eye on DarkMail encryption, too, that maybe you can add later.

</comment><comment><USER20> Very, very cool. Will check it out in detail later.

</comment><comment><USER21> BTSync is an option.

<comment><USER22> No, the only cloud storage option is Dropbox. BTSync is a viable alternative, but it is not currently an option.</comment></comment>


Ask HN: Does cloudflare offer DNS over HTTPs API? - <AUTHOR> <comment><USER2> Only for DNS records under your account.</comment>


Linux PinePhone has physical kill switches for its cameras, mic, data, BT, Wi-Fi - <AUTHOR> https://www.androidpolice.com/2020/08/15/this-smartphone-has-physical-kill-switches-for-its-cameras-microphone-data-bluetooth-and-wi-fi/ <comment><USER2> I get the point of low cost phone to keep the price low. I also know that there is a group that, rightfully, enjoys hacking on low-powered hardware to push it to limits. However, I wonder if there is also an opportunity to also sell high spec hardware, maybe in limited quantity. These phones are not for the masses anyway and I'm sure there is a Linux enthusiasts segment with pockets deep enough to afford the hardware - they know what they are getting into. Atleast what works will work fast and the software will only improve as we move along - which means improved overall experience. Plus it helps with the project funding too.

<comment><USER3> The iPhone 1.0 came out in 2007 and it ran on a single core arm cpu under clocked at 412mhz and with 120MB of ram and the scrolling was butter smooth. I remember being shocked at how responsive the touch screen was compared to other smartphones at the time. The PinePhone contains an AllWinner A64 Quad Core CPU with 2GB of Ram. Sure, its a crappy 5 year old Soc but it is MUCH faster than the original iphone. I know, modern smartphones have a much higher screen resolution, but still. I mention iPhones instead of android phones because it took quite a few years for Android phones to achieve that same butter smooth experience.

The perceived slowness of the PinePhone is due to layers upon layers of software used to draw simple 2D stuff to the screen. I think a really simple bare metal GUI would be better than running a full blown linux desktop environment like GNOME. Even if you "skin" and strip it down for mobile, it is still laggy as hell.

Linux on a smartphone => yes

Linux desktop environment on a smartphone (even with Wayland support) => no

I am less interested in the "daily driver" part of the PinePhone and more interested in the power consumption and responsiveness of the device itself. Stuff like this is exciting (extending the standby time of a PinePhone to 100 hours): [https://github.com/crust-firmware/crust](https://github.com/crust- firmware/crust)

<comment><USER4> During Librem 5 development, they considered using GNOME but, after talking with the upstream devs, they abandoned the idea.

Gnome is slow even on laptops, it was made for X and later ported to Wayland, it uses Clutter/Mutter, JavaScript, etc. So here yes definitively it's layers upon layers.

On the other hand, Posh is based on Wlroots and there is no layers. It's pure C code talking directly to EGL/DRM/KMS (And in the future Vulkan) stack.

Even more interesting, Wlroots allows the use of hardware layers and with that you directly write to the screen and compositing is done in hardware. You can't go more optimised than that.

With this kind of approach you can totally write a convergent, both phone & desktop, environment which is butter smooth on low spec mobile.

But of course then the whole question is which apps you run on that environment, the typical Electron app won't run smoothly (but it wouldn't either on a IPhone 1).

On the other hand, GTK 4 should be GPU accelerated and Qt too so those could run pretty smoothly

<comment><USER5> > You can't go more optimised than that.

Phosh uses GTK, right? That's a pretty thick layer right there. You used to be able to put pixels on screen with a handful of ASM instructions [https://www.cprogramming.com/tutorial/tut8.html](https://www.cprogramming.com/tutorial/tut8.html)

<comment><USER4> Yes this is totally true, I should've been more precise.

There are two parts : 'Phoc' and 'Posh'. Phoc is the Wayland compositor (Wlroots & C), Posh is the launcher UI (GTK).

Phosh is just "an app" (with special privileges to talk to Phoc). All it does is display app icons and windows thumbnails (which are not actual live windows but just screenshots of the apps (like on Android)) it does not composite windows, it does not stand between the apps and Phoc.

This is unlike Clutter & JavaScript which do stand between the apps and the Wayland compositor (Mutter) on GNOME.

So my point is that apps on the Librem talk directly to Phoc (not Posh) which is a super minimal layer and can draw pixels on screen with almost no overhead (and potentially none at all when they'll support hardware layers)

(Note : this is the Librem architecture as far as I understood, maybe I missed something)

<comment><USER3> Very interesting, thanks! I wish there were more videos focusing on UI latency and snappiness for the Librem 5 but all you see are "feature" videos. It's hard to tell if the phone is laggy (finger move to eyeball time) or not.

<comment><USER4> Once hardware acceleration is enabled it will be very snappy :) : [https://social.librem.one/@dos/104218666011152589](https://social.librem.one/@dos/104218666011152589)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Off-topic but IMHO what is really needed these days is a privacy feature allowing all the UIDs to be changed freely by the user (without the need for rooting and firmware thinkering).

Including randomized IMEIs and randomized Android ID (In addition to the already offered randomized MAC and Ad tracking ID changes). Especially IMEIs which are commonly used by many applications and law enforcement to track users (see Banking apps for instance that all require your phone permissions to read such IDs).

Nor Librem nor Pinephone offer this functionality from what I know.

And no, it's not (yet) illegal (but might be against some ToS) in many countries to change your IMEI including the US (see [https://en.wikipedia.org/wiki/International_Mobile_Equipment...](https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity#IMEI_and_the_law)).

<comment><USER7> Changing the IMEI is illegal in the UK FYI and has been since 2002. [https://www.legislation.gov.uk/ukpga/2002/31/introduction](https://www.legislation.gov.uk/ukpga/2002/31/introduction)

Perhaps this legislation gives you a clue about how on the ball some Govt's are when it comes to security matters?

What you are suggesting is a phone that changes its obvious identifiers, but the problem with that is some services may not work, maybe an app purchased from an app store, or the network services you get from your cell provider, like answer phone facilities when you are in a dead zone. So if your phone is acting like a character out of Scanner Darkly, just how will it operate? How will your friends know its you calling if they dont recognise your number?

To have a cellular network that allows random identifiers, you would need a system which accepts prepaid communication time, but in todays age, just like bitcoins is a public ledger how would you convince someone to build a cellular network that accepted untraceable communication time tokens?

Whether you like it or not, Science stole your privacy the day you were born and continues to steal your privacy including your thoughts. Perhaps your best bet for some privacy is to limit your contact with other entities whilst also trying to change the laws for the better but as this requires interaction with other entities, it seems like you want a paradoxical situation to exist.

<comment><USER8> The IMEI just identifies your phone. The IMSI identifies your number.

So it's perfectly possible to change the IMEI if you leave your IMSI alone. The network will think you just stuck your SIM in another phone. Everything will work fine. You can't change your IMSI as it's hardcoded on the SIM (technically you could with an eSIM but it simply would be unrecognised and just not work then).

Of course they still know who you are, and they need to to connect your calls. But apps that look at the IMEI for identification will be confused. Not sure how much it helps in terms of privacy. I doubt it helps a lot as any app can just make up a random number and dump it in their long-term storage to know it's you (just like a cookie).

And yeah the illegality of changing it is an issue in some countries. Also, if you 'clash' with another live IMEI weird things happen :)

PS: IMEI changing was outlawed in those days to stop people stealing phones and changing IMEIs to resell them and bypassing carrier blocks of the stolen phone. It was never that successful as thieves are lawbreakers by nature and don't care at all whether they break an extra law or two. Apple and Google's activation lock were much more successful. I'm personally not a big fan of laws when there are technical solutions that are equally or more effective.

<comment><USER9> AFAIK, a SIM card itself has a card id (ICCID), which should not be changed and is not used often. The subscriber id (IMSI) is in the "application" layer of the card and theoretically could be changed by the provider, or as a speciality, multiple ones installed.

That being said, I've never actually seen a card's IMSI changed. They usually give you a new sim and IMSI, even for a replacement card.

<comment><USER10> Most SIM cards are one-time programmable, so they can't change anything on the card. They do still have a small RW area, but thats generally for user data (contacts).

You can get SIM cards that have large amounts of storage for running applets and have better support for OTA, but most carriers don't like the extra expense.

<comment><USER11> Aren't most SIM cards today use over the air provisioning since networks employ thin provisioning theses days?

<comment><USER8> Yes they do almost all support it (with many security vulnerabilities as a result, Karsten Nohl did a really great presentation on this at OHM2010). But the IMSI is almost always provided at manufacture time.

I think it's also because the card would not be able to be provisioned over the air without getting connected to the network first, and without an IMSI there is no network connection :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Is anyone usimg a linux phone? Love to hear use cases. I know about the PinePhone and the Librem, don't know if there are others.

<comment><USER13> I am using Sailfish OS on a Sony Xperia XA2. I am using it now for about 1 year. Before that I used Sailfish OS on the original Jolla 1 for 5 years. I have also used a Nokia N9 with Meego Linux, which can be considered a forerunner of Jolla/Sailfish.

It uses Qt, Wayland, Systemd. The original Jolla 1 even used Btrfs, which was deemed a mistake. Sailfish OS is available on more devices, like the Pinephone, Fxtec, Cosmo Communicator and others. If you have the official version for Sony Xperia, you get Alien Dalvik, with which you can run Android apps. I am using Whatsapp and Firefox as Android apps this way. I am still hoping that Signal takes off for mesaging, a native app like Whisperfish is something I would really enjoy. With Whatsapp a native app is not possible, there have been threats for lawsuits.

I am very happy with Sailfish, and have been for 6 years. I enjoy having plain linux on my phone, being able to use ssh as root and having a device that I trust. There are some 'costs' involved, like having less shiny bling and less apps available. Companies like Apple and Google can spend billions on their phone platform. Jolla only has about 100 employees in total. You do have to adjust your expectations somewhat.

Jolla have received criticism about not having open sourced all their software. I do understand that criticism, but that argument doesn't make Apple or Google look any better :) I am curious about where linux phones will go in the next years, but currently Sailfish is good for me.

<comment><USER14> > The original Jolla 1 even used Btrfs, which was deemed a mistake.

Why is that? Was it too young or is it generally impractical on a phone?

<comment><USER13> What I remember (not a linux developer) is that sometimes you have to rebalance the filesystem. You can have free space in megabytes, but no inodes left. (If I am wrong someone might correct me). There have been instances, especially later on in its lifecycle, where a system update was aborted due to no space (inodes) which ended in a lot of trouble.

<comment><USER14> I've been using btrfs as my main file system for about 6 years now and have run into the "no free space" issue about twice.

It's horrible. Everything stops working and freeing space is quite hard.

Other than that I had no issues with it. Subvolumes and snapshots are pretty cool to me, but I can see how the added overhead might not make sense in a processing power and space constrained environment.

</comment></comment></comment></comment></comment><comment><USER15> So, I like the accessibility of physical switches but how are they more trusting than software ones? Or light indicators such as Apple's green Dot?

Already trusting Open Source requires non technical people to trust others who can read the code to vouch for it. Here, we would need to expect an electronics engineer to understand (from looking at a disassembled device) that the switch actually does what it says it does, right?

<comment> ben-schaaf With software ones you still have to trust the hardware and firmware in addition to the software. With light indicators like Apple's you also need to trust the hardware - and since the designs aren't open it's more difficult to do so - but once verified that they work as advertised having kill switches is a much more active security function than an indicator light.

<comment><USER7> International standards can also be zero days. For example, the international standard for called ID, uses a dial up modem protocol which means the hardware has to have capabilities to read this data which means the hardware has dialup modem capabilities. So if you can compromise the firmware of the modem, a backdoor into a device is via the very telephone network you later rely on to communicate. [https://en.wikipedia.org/wiki/Caller_ID#Operation](https://en.wikipedia.org/wiki/Caller_ID#Operation)

Chips fall into 3 categories, fused by manufacturer, fused by branding company, or not fused allowing future updates, like bios chips. Even if the chip is fused, a backdoor may still exist, in some cases standard behaviour can be the backdoor.

With zero days appearing in hardware, software and standards, its very easy if you have the knowledge to get a persistent backdoor into a device beit a PinePhone, Librem 5 or Necunos to name just a couple. [https://forums.puri.sm/t/comparing-specs-of-upcoming- linux-p...](https://forums.puri.sm/t/comparing-specs-of-upcoming-linux- phones/6827) [https://tuxphones.com/yet-another-librem-5-and-pinephone- lin...](https://tuxphones.com/yet-another-librem-5-and-pinephone-linux- smartphone-comparison/) Its probably why people like Cobham, Thales and other openly public military manufacturers make their own kits for militaries around the world. [https://www.cobham.com/](https://www.cobham.com/) [https://www.thalesgroup.com/en](https://www.thalesgroup.com/en)

I even think its possible to hack the communication systems of the new Lockheed Martin F35, because the manufacturers are walking a logical development path (their mistake), but I've yet to have a go at it, so cant say for sure yet. [https://www.youtube.com/watch?v=_C25CwNlVjA](https://www.youtube.com/watch?v=_C25CwNlVjA)

<comment><USER16> Your comment is so in depth thanks. It really opened my eyes to some of the industrial subversion going on that I was unaware of, especially about the international standards being a vector for backdoors.

</comment></comment></comment></comment><comment><USER17> GNU/Linux Librem 5 phone not just has the kill switches, but they are easily accessible and therefore more useful: [https://puri.sm/products/librem-5/](https://puri.sm/products/librem-5/)

<comment><USER18> The librem phone is $750 and the pinephone is $150.

<comment><USER19> Also a crucial difference: You can get your hands on a Pine Phone, while Librem has yet to ship a phone.

<comment><USER20> ??? They have shipped a number of phones? Or do you mean they haven't entered production?

<comment><USER19> Yes, "shipped" refers to in the hands of customers.

<comment><USER20> I mean, I am holding one right now, and I am a customer (Well technically it's next to my laptop, typing with one hand is hard). So I don't understand what you mean.

</comment></comment></comment></comment></comment></comment><comment><USER21> What are the killswitches acting on ? Are they acting only on the dedicated "enable" or "poweroff" inputs of various chips ? Are they cutting the power supply of the chips ? Are they cutting both the power and logic busses, thus isolating the target chips (at least electrically) ?

<comment><USER22> From [https://wiki.pine64.org/index.php/PinePhone_FAQ#What_are_the...](https://wiki.pine64.org/index.php/PinePhone_FAQ#What_are_the_kill_switches_doing.3F)

      1  Modem | Pulls Q1501 gate up (FET killing modem power) | "On" enables 2G/3G/4G communication and GNSS hardware, "off" disables it.
      2  WiFi / Bluetooth | Pulls up CHIP_EN | "On" enables WiFi and Bluetooth communication hardware, "off" disables it.
      3  Microphone | Breaks microphone bias voltage from the SoC | "On" enables audio input from on-board microphones (not 3.5mm jack), "off" disables it.
      4  Rear camera | Pulls up PWDN on OV5640 | "On" enables the rear camera, "off" disables it.
      5  Front camera | Pulls up PWDN on GC2145 | "On" enables the front camera, "off" disables it.
      6  Headphone | Pulls up IN2 on analog switch BCT4717ETB | "On" enables audio input and output via the 3.5mm audio jack, "off" switches the jack to hardware UART mode.

<comment><USER23> With the microphone bias floating, what prevents some digital signal processing form recovering faint and fuzzy audio? I'm sure the microphone loses at least several dB of gain with the bias floating, but isn't it much safer to either disconnect the bias and tie it to ground, or else pull up/down the the digital output of the ADC?

I understand that with the bias floating, the microphone output will be a combination of radio and quantum thermal noise, but won't that noise still be slightly modulated by the microphone? Or is it that the noise being modulated will be below detectable by the ADC and the digital output will always be exactly 0?

<comment><USER24> Depends on actual hardware implementation, but those microphones are REALLY good at picking up audio. I once fiddled with some microphone and wondered why it works so poorly (lots of "digital" noise, faint audio), maybe cable broke or smth. Turned ot, it was "disabled" with hardware switch on cable, yet still picked up enough sound to "somewhat work".

</comment></comment></comment></comment><comment><USER25> Thank you for including the name of the phone in the HN title unlike the clickbaity original.

</comment><comment><USER8> This isn't actually 'news'. But Pinephone is ruling the roost where Purism dropped the ball, sadly.

PS: I love both companies, it's just sad about Purism :)

</comment><comment><USER26> In January 2020, Pine Microsystems Inc. was dissolved [1]

Anyone know if they just closed their US entity and now operate from another country or are they having financial difficulties?

[1] [https://businesssearch.sos.ca.gov/Document/RetrievePDF?Id=03...](https://businesssearch.sos.ca.gov/Document/RetrievePDF?Id=03928399-27737032)

<comment><USER27> From this Comment on Reddit [https://www.reddit.com/r/PINE64official/comments/g8dqx9/pine...](https://www.reddit.com/r/PINE64official/comments/g8dqx9/pine_microsystems_inc_in_california_is_dissolved/fonpafp/)

\</comment></comment><comment>

The Pine Microsystems becomes Pine Store Limited. Two reasons on such move:

1\. Increasing complexity of business compliance and reporting paperwork when operates in California. Since Pine Store primary business is not in California, no interest to keep continue to have such burden.

2\. Avoid legal mafia similar to what happens to Gnome on Q4 last year. Unfortunately, there are a lot of such legal mafias operate in State.

This move is not due to financial or politic reason. Pine Store Limited locates in Malaysia and Hong Kong.

\</comment><comment></comment><comment>-

Given the state of relations with HK and the US now this may makes things more complex for them as well

</comment><comment><USER28> All those fancy physical switches, and none simply for silent mode? My most- missed physical switch on Android devices.

<comment><USER29> These are all behind the back cover, and are (from what I understand) pretty tiny, so I wouldn't imagine 'em to be all that convenient for toggling silent mode.

But yeah, my PinePhone's supposed to ship on the 25th and I expect I'll be missing that feature.

</comment></comment><comment><USER30> This is great functionality. But on the other hand I already had Meizu MX4 Ubuntu based phone. Apart of bad network reception, main issue was lack of application support, literally I was struggling with simplest application. On positive note I could to development and bash very easy...

</comment><comment><USER16> I would love to buy one for the sake of security (especially the physical kill switches) but will wait until it is a little more usable.

</comment><comment><USER31> No kill switch for GPS though.

<comment><USER9> Modems (LTE modules) often have GPS and that's where it's handled in almost all phones.

AFAICT, the LTE switch disables GPS.

</comment></comment><comment><USER32> There is no mentioning of NFC, not here, not there? I like NFC for payments and things?

<comment><USER8> Not sure if it has NFC but I really doubt you're ever going to find a bank willing to do payments on a fully open phone.

</comment></comment><comment><USER33> That's cool, but hardware kill switches don't help your privacy.

Why?

Because nobody is ever going to want to turn off that functionality. I don't know anyone who turns off the software switches, why would they turn off hardware ones?

A smartphone without a camera, mic, Bluetooth, cellular data, and WiFi is basically useless.

What we need is a way to make these technologies more private while they're in use.

Also, the PinePhone is barely usable, and I say that as an owner. It's a neat toy but it's got a long way to go.

<comment><USER34> That is a huge, and incorrect, assertion.

If I could hard-off my mic, I would. I don't use it but once a day, maybe, while I use others frequently. I turn off location manually whenever I am not using an app that requires it. I leave bluetooth on because I use it frequently enough, but if it were an easy hardware switch, I could get in the habit of shutting it off.

<comment><USER35> > I turn off location manually whenever I am not using an app that requires it

Which is almost equivalent to teather from a security point of view. Either you trust the system, in which case you can trust that you can deny location to the programs that according to you "don't require it"; or you don't trust the system, in which case it will just broadcast the position whenever you enable the killswitch to everyone who could be even remotely interested. And again when you enable it is usually when you are most likely going to leak something interesting. There is here some usefulness in terms of having "another layer", but academically this is really debatable.

<comment><USER36> Switches are simple and predictable. Permission systems have shit UX, and are not granular enough anyway. Furthermore, suppose you need different things to be permitted at different times, e.g. you need the battery to last longer for a few days... good luck changing all your permissions manually.

</comment></comment></comment></comment><comment><USER37> If you're this worried about leakage from signals, cameras, etc. what about the tradeoff of security where now you need to patch and monitor for any attacks on your device, now that you're off of any normal OEM's support?

What's the risk of that being done poorly by you, versus having better control over these physical switches?

<comment><USER38> > any normal OEM's support?

What "normal OEM support" (like which company, for example?) has been good at regularly releasing security patches and keeping on top of various vulnerabilities? Especially past the 1-2 years after the release date of the device? Especially if you consider those companies that without any real consent from you install dozens of their own adware and spyware on each update that you can't even remove (like you can't remove system apps in android, only "disable" them, to make the phone nag you all the time to re-enable them).

Not having to rely on the joke of the "OEM support" from the big companies is the very reason to use these open phones.

<comment><USER39> Apple's average full support for iPhone is trending to around 4-5 years since launch. Several times they've issued critical security updates years after ending official support.

<comment><USER9> To be fair, they are an outlier, so not really normal in that sense.

<comment><USER17> Not even mentioning that after 4-5 years iphones turn into a brick with no possibility to install or update anything.

</comment></comment></comment></comment></comment><comment><USER40> Too bad the battery "kill switch" seems to be turned on permanently. I don't blame them - it's a hard problem to solve. Todays higher end phones go as far as to turn off parts of the chips on the fly, dynamically, on demand. But until it is solved, the device is more or less a curiosity rather than something useful in practice.

<comment><USER17> Why do you need it? You can simply remove the battery (without any tools).

<comment><USER41> Looks like sarcasm. (Your sarcasm kill switch might be toggled on.)

<comment><USER40> Sorry, forgot to add /s. Population density rears its ugly head again.</comment></comment></comment></comment>


Show HN: Away from Keyboard (AFK): Reduce eye strain with reminder to take break - <AUTHOR> https://akshaykadam.me/apps/away-from-keyboard/ <comment><AUTHOR> I am the maker of Away From Keyboard (AFK). Away From Keyboard is an app that reduces eye strain with reminders to take a break.

AFK tracks movements on the mouse & keystrokes on the keyboard. After a certain interval, it notifies you to take a break & tells you to do some other activity to reduce eye strain. It takes care of your eyes for you without getting in the way.

I was inspired by Aware but I needed more features which is why I built Away From Keyboard (AFK). Also it was a great way to learn some Swift.

This app has helped me immensely & my eyes & head are more relaxed now thanks to AFK. Happy to answer any questions you have :)

</comment><comment><USER2> What do mouse and keystrokes have to do with eyestrain, though? I guess it could be an indicator on how active you are using your computer, but I could imagine plenty activities that involve using your computer without actually interacting with it.

<comment><AUTHOR> Ohh yeah like reading. But other than that I don't think there can be other indicators to know how much active you are on your Mac.

Can you provide any other examples which does not include mouse & keyboard?

I think mostly Developers, Designers & Gamers spend their time the most in front of the computer & need breaks.

For me, this app worked immensely well because I for the past couple of weeks I've been coding for 9+ hours without a lot of break (not more than 5 minutes) & it hurt my eyes & also there is a lot of headache too. Now I don't have to consciously remind myself to take breaks. AFK takes care of that for me :)</comment></comment>


Least Resistance: How Desire Paths Can Lead to Better Design - <AUTHOR> http://99percentinvisible.org/article/least-resistance-desire-paths-can-lead-better-design/ <comment><USER2> Relatedly, the courtyard outside the Stata Center at MIT has several bizarre, intersecting sidewalks that cover all of the common paths that people traverse: [http://imgur.com/b1BpvlU](http://imgur.com/b1BpvlU)

<comment><USER3> The interior of the student union building at IIT was famously designed around these. The site was previously an empty field, and the building's main circulation paths are laid out so that you can still walk through the building along the worn down routes cutting across the grass.

[https://en.wikiarquitectura.com/index.php/File:MCTC_planta_a...](https://en.wikiarquitectura.com/index.php/File:MCTC_planta_accesos.jpg)

</comment></comment><comment><USER4> Related articles:

\- [http://www.opin.com/folksonomy-well-worn- path/](http://www.opin.com/folksonomy-well-worn-path/)

\- [http://www.adammathes.com/academic/computer-mediated- communi...](http://www.adammathes.com/academic/computer-mediated- communication/folksonomies.html) (from over a decade ago)</comment>


Stuck in a chair all day? How to sit properly - <AUTHOR> http://www.sitsmarter.com/content/3/index.html

<comment><USER2> This article is the original content on a made for adsense site. If I turn off my adblocker, I see an _enormous_ Google ad for some kind of cancer medication. I wouldn't be surprised if this is a very expensive keyword. I'm curious how the website creator triggered this ad -- unless Google is hinting that I have cancer.</comment>


Neanderthal, a static blog generator - <AUTHOR> https://github.com/MH15/neanderthal <comment><AUTHOR> Creator here- I created this tool to build my personal website/blog, so it has all the features I needed. I decided to build it out into a full tool others could use. My personal website ([https://matthall.codes](https://matthall.codes)) is rendered using this tool. For those unfamiliar with this space, Neanderthal is similar to Jekyll and Eleventy, but way less polished than Jekyll and more opinionated then Eleventy.</comment>


Google and China: Silicon Valley Is No Longer King - <AUTHOR> http://www.time.com/time/business/article/0,8599,1954184,00.html "But there is another story here, more prosaic but no less important to the future arc of global business and the global balance of power. Google has not been doing all that well in China, as many have noted in recent days, badly trailing the domestic Chinese search company Baidu. But it isn't just that Google has struggled. All of the New Economy western companies in the media and information business have failed to establish themselves in China." <comment><USER2> Silicon Valley companies are no good at negotiating with barbaric governments, therefor are no longer king?

Since when was that SVs claim to fame?

<comment><USER3> Last I checked, Yahoo was doing an alright job at that.</comment></comment>


Ask HN: How did you acquire your first 100 users? - <AUTHOR> <comment><USER2> I started with writing open source Ruby gem [https://github.com/ArturT/knapsack](https://github.com/ArturT/knapsack) for running tests in parallel on CI and later I gave a talk on local meetup event for Ruby developers.

With time I wrote more blog posts [https://docs.knapsackpro.com](https://docs.knapsackpro.com) and shared on Reddit, Twitter, LinkedIn profile or Ruby groups. From time to time posts landed in RubyWeekly newsletter.

Also asking users for recommendation might help.

I connected with each person on LinkedIn I talked to or who signed up and I followed them on Twitter. People who like your product can easily see you publish new content and can like or share it.

<comment><USER3> knapsack[1] and knapsack_pro[2] are both under MIT license and seem to have the same code. How do you keep companies/people from using the pro without paying?

1\. [https://github.com/ArturT/knapsack](https://github.com/ArturT/knapsack)

2\. [https://github.com/KnapsackPro/knapsack_pro- ruby](https://github.com/KnapsackPro/knapsack_pro-ruby)

<comment><USER2> knapsack_pro gem uses Knapsack Pro API which is paid. See more at [https://knapsackpro.com](https://knapsackpro.com)

It works similarly like tools for exceptions tracking, i.e [https://www.honeybadger.io](https://www.honeybadger.io) is paid but has MIT client [https://github.com/honeybadger-io/honeybadger- ruby](https://github.com/honeybadger-io/honeybadger-ruby)

Other than that I do support paying customers.

</comment></comment></comment><comment><USER4> Depends on what you offer.

      A lunch offering service like foodsby goes to a building manager of small office spaces to offer a coupon code

      A SaaS service drops a post on here

      If you are offering goods platforms like kickstarter or producthunt

I launched [https://extracttable.com](https://extracttable.com) on Aug'27 this year with a post here (no better place than HN), reached the first 100 customers under 60 days, with 22 paid customers. Right now, the count is at 197, hopefully crossing 250 by EOY

<comment><USER5> I laughed out loud at the "a SaaS service drops a post on here" \-- it's not that easy for everyone, I promise.

</comment></comment><comment><USER6> KeyDB got it's start as a post on here. Expect people to be skeptical but in the end quite a lot will try it.

The original post: [https://news.ycombinator.com/item?id=19368955](https://news.ycombinator.com/item?id=19368955)

[https://github.com/JohnSull1y/KeyDB](https://github.com/JohnSull1y/KeyDB)

</comment><comment><USER7> We hit the phones and met a lot of people.

After 100 paid customers, we've found true product market fit and are now gearing up for a true SaaS offering - we'll continue to hit the phones though!

</comment><comment><USER8> We started a private beta for our app, posted about it on social media and submitted it to sites like betalist.com</comment>


The MIT License – Clarity on Using Stack Overflow Code - <AUTHOR> http://meta.stackoverflow.com/questions/312598/the-mit-license-clarity-on-using-stack-overflow-code <comment><USER2> This to me (and excuse my ignorance) seems like a waste of time and money (on real-life lawyers). Stack Overflow and the associated sites are public forums, the users posting code surely realise they're posting information into the public domain and as such it should be recognised as being in the public domain.

Nobody (at least as far as I can tell.) is posting proprietary or self-written code under the pretence that they will receive attribution under a nominated license. It's a question and answer website, it's not a repository for complete software or work that needs to be protected under license.

<comment><USER3> >Stack Overflow and the associated sites are public forums, the users posting code surely realise they're posting information into the public domain and as such it should be recognised as being in the public domain.

Under current US law, just because something is publicly viewable doesn't mean it's in the public domain.</comment></comment>


Ask HN: If you woke up tomorrow and...part 2 - <AUTHOR>

in a follow up to http://news.ycombinator.com/item?id=526458
If all of the sudden all technology was gone (assuming we had knowledge of that technology)... What technologies would entirely be skipped in the rebuild?
Dumb examples: there would be no period of time we would think the world was flat.  There would be a very short period of time without movable print... <comment><USER2> Microsoft :P no, I jest.

Conventional knowledge would still exist for the most part (assuming an approx 10 year time frame), so we probably wouldnt have geocentric delusions or anything like that.

I would guess that as far as technologies went, the internet would be designed in a much more secure manner. Also, it probably would be designed as a scalable network instead of the scale-free network it currently is.

</comment><comment><USER3> Vacuum Tubes. We would go straight to transistors and other solid-state devices.

<comment><USER4> A world without Twin Reverbs, SVT's, tubs mic pres, and the like is one I wouldn't like to live in. (Marshalls, on the other than, I care not for...) Heck, even germanium transistors are being put to good use for audio nowadays.

This is a great example of how evolution can produce things that are still useful decades later, even as most people have moved on to the latest and greatest.

</comment></comment><comment><USER5> Drum brakes? ...something i have always found interesting is what mistakes could we have avoided. Serious mistakes brought on by ignorance and pseudo- science, such as the act of bleeding to heal.

</comment><comment><USER4> Anyone ever read "A Canticle for Lebowitz"? I recently recently discovered it and am very intrigued.

<comment><USER6> Don't bother reading the sequel it's not bad, but it's nowhere near as good as canticle.

</comment></comment><comment><USER7> no QWERTY!</comment>


What general ledger accounting software does your SaaS company use? - <AUTHOR> General ledger accounting software for mid-market companies is in dire need of a refresh.  For SaaS companies that have grown outgrown Quickbooks/Xero/etc. and need a double-entry general ledger accounting system, I'm curious to see which of the available options is best. <comment><USER2> I looked at this market about six months ago and agree its in need of a refresh. This best option (to me) up one step from Quickbooks/Xero looked like IntAcct. The main feature is reasonably good automated software revenue recognition support (obviously important for a SaaS company), including good support for custom B2B deal structures. The overall integration support seemed lacking, with an older SOAP API and no good built in integration for Stripe or Braintree. The look & feel is like Salesforce. A minimum deployment is going to be $1k/month.</comment>


Ask HN: Which hype you bought which backfired? - <AUTHOR> Many times we buy into something because of hype, it could be a flavor of the month programming language or javascript framework. Any professional would probably have made many of such mistakes, in hindsight we deem stupid. Please tell us about your hype-driven blunders which backfired. <comment><USER2> \- Frameworks. Not any particular framework, just Rails-style, monolithic frameworks with lots of magic. Every language got a Rails-like framework at one point, and many were/are popular.

\- Native mobile apps. They're not a good replacement for the vast majority of circumstances, and users are extremely reluctant to use (and keep using) them.

\- MySQL. I still have no idea why anyone would choose it over Postgres, and no one has been able to give me an answer. I chose it because it was the database of LAMP stacks, and then I got locked in because I knew it already.</comment>


The New Firebase Security API - <AUTHOR> http://blog.firebase.com/post/38234264120/the-new-firebase-security-api <comment><USER2> This is the one big thing that really needed to happen to Firebase to get it ready for the world and having worked with these guys a bit, I know it was a difficult problem to solve. I think the solution they came up with is actually pretty novel and exhibits the qualities I strive for these days:

1) It's as declarative of an approach as it can be without sacrificing flexibility.

2) It follows the structure of your data and is itself a datastructure that can be trivially manipulated.

3) It centralizes a concern. Security measures often end up spread all over the place, making it very difficult to reason about what is or is not correctly handled. Not so with this model.

I'm excited to see what people do with Firebase now that the one thing that was really holding it back has a solution. I know from my standpoint, it's certainly nice to have someone else dealing with the nightmares of real-time scaling and security so that I don't have to.

</comment><comment><USER3> We've been using Firebase now for about 6 months to power Roll20[1], it's allowed us to grow from 100 to 1,000 concurrents without having to make any changes to our code or even think about handling the additional scale. That's incredibly valuable to us, since it frees us up to focus on creating features and helping customers, not worry about keeping yet another server from crashing. Andrew, Michael, and James have always been available to answer questions, and it's been a pleasure to watch Firebase grow. The new security API is just the icing on the cake for us since it will allow us to further fine-tune what different participants have the ability to do in our games.

I highly recommend it if you're looking at creating a real-time app!

[1] <http://roll20.net>

</comment><comment><USER4> This is really great work, guys. We've been using Firebase for a while now. The uptime, low-latency, and consistency have been impressive. A good security framework was really our last hurdle. We're digging in to the new security features and pretty happy so far. Another good resource (in addition to the blogpost above) is the quick start page. [1]

Also, one side note: it's not always clear from reading the docs, but changes to the security rules can be made dynamically and take immediate effect.

[1] <https://www.firebase.com/docs/security-quickstart.html>

</comment><comment><USER5> It's nice to see "Uses BCrypt for password storage" instead of hand-wavy "industry standard" or "strong encryption" or something like that.

<comment><USER6> Hand-wavy terms are preferred if the text is end-user facing (and when end- users tend to not be too technical). Of course, a tooltip or "more details" link explaining the real technologies should then be used.

<comment><AUTHOR> [Firebase founder here] This is one of the nice things about running a company that is 100% developer focused. We can communicate in clear terms with customers that actually understand the nuances of what we're building. We'd much rather be specific than hand-waving.

</comment></comment></comment><comment><USER7> Has this been pentested or audited by a security firm?

I think this is awesome and I am glad you have it working. I'll be seriously considering Firebase for future projects.

<comment><USER8> For what it's worth, and as weird as this is going to sound:

You don't in particular want the "security API" of an app framework to get externally validated. For the most part, the "security" components of app frameworks are boring, modulo some really simple- to- answer questions ("how do you store passwords", "how do you handle password resets").

When people talk about "security frameworks", they tend to be thinking about what we used to call "AAA systems" (authentication/"authn", authorization/"authz", and accountability/logging). You don't need to be an appsec practitioner to look at an AAA system and see whether it's any good. Does it apply authn by default? How easy would it be to accidentally expose a method that didn't require a login? Does it apply authz rules by default? How much of a pain would it be to reliably apply authz rules across my project? If stuff is easy and has sane defaults, you'll use them and benefit --- like you do in Rails, if you use association finders off a "current user" instead of the class object finders.

The bad news is, what you want tested in an app framework is _everything else_. How's it handling database persistence? How does it handle corner cases, like deliberately pathologically huge queries, out-of-range numerics, conversions between multipart and standard encoding, output encoding of HTML, Javascript, and CSS, CSRF validation, file upload, database column access, &c &c. It's the stuff you don't normally think of as "security code" that's most likely to bite you.

At Matasano, we have a "seven deadly features" in web apps that we tend to find the first and worst flaws in web apps in; they're:

1\. Password reset

2\. Email functionality

3\. Interfaces to thick clients; "REST API" &c

4\. File upload

5\. File download

6\. Templating

7\. "Advanced search"

Only one of those is a security feature, and it's also a security feature that most "security APIs" don't actually implement (because every app wants to have a different UX for it).

Lest this sound self-interested: most frameworks haven't been formally externally tested. I'd be thrilled if someone had their framework tested formally, but I don't tell people not to use Rails or Django or Spring just because they haven't been pentested by an appsec firm.

<comment><USER9> How should one properly secure a "password reset" feature?

and/or

What are the most common dumb things people do with a password reset feature?

<comment><USER10> _How should one properly secure a "password reset" feature?_

Ooh, I think I can actually do this: You send the address on file an email which contains a random, time-limited, one-use token which allows them to log into their account. You should not disclose presence or absence of the account via the reset mechanism on the site (only via email), but that's a comparatively minor issues. A successful password reset should end all in- progress sessions for the account. You should also do all the table-stakes web development things like e.g. not allowing SQL injection or XSS on the page.

There's plenty of failure conditions for password resets:

1) You create non-random reset tokens, such as MD5(user.id) or MD5(user.email), potentially compromising security of accounts.

2) You allow resets of your teams' admin accounts to happen through the publicly accessible password request feature. (n.b. Almost never a good idea, for one because it means you're probably doing shared authn/authe between your app and your admin console and that is generally a very bad idea. I say this in spite of shipping it in every product I write.)

3) You allow password reset tokens to get re-used, which increases the attack surface against individual accounts by e.g. making saved-to-disk emails into attack vectors for them. (Standard reset mechanisms only make emails-in-flight into attack vectors.)

<comment><USER11> > You allow resets of your teams' admin accounts to happen through the > publicly accessible password request feature. (n.b. Almost never a good > idea, for one because it means you're probably doing shared authn/authe > between your app and your admin console and that is generally a very bad > idea. I say this in spite of shipping it in every product I write.)

Can you please elaborate more, or link to articles about why this is a bad idea? What are the common failure scenarios that splitting normal & admin users fixes?

<comment><USER10> Briefly: there are a lot of common vulnerability classes which can compromise a user of your application / their cookie / their DB record, for example mass assignment (to update the "role" attribute in a free trial account to "admin") or XSS (tweet at your support account and have them click a link to your domain, bam, the adversary now has your cookie and can log in as you).

Separating the admin app and the normal app upper-bounds the impact of those flaws at something lower than "The worst thing someone could possibly do with the admin console." Given that many admin consoles have fairly extensive functionality, that's generally a good idea. (I mean, my businesses are pretty low risk as things go, and my admin consoles would trivially do about $20k of damage just with refunds if compromised.)

</comment></comment></comment></comment></comment></comment><comment><USER12> From any one of the many security experts that hang out here - can you give us an assessment of how secure this actually is?

<comment><USER13> I'm curious about this as well. When I hear "without writing any server code" in the demo video, my mind says that this is client-side validation, which does not suggest it is secure to me. What server-side validation happens under the hood to deal with modified clients/proxies like Burp?

<comment><USER14> Here's a little secret. The security rules you, as a Firebase developer, write for your Firebase, are actually server-side validation code. It just doesn't look like typical code, and we've carefully designed them to have a lot of good properties regarding performance, correctness, and analyzability. And we (Firebase) take care of enforcing them for you.

But it /is/ server-side validation, that you as a developer get to specify.

(That said, we're definitely happy to get feedback on our approach from any security experts out there that want to take a look!)

</comment></comment></comment><comment><USER15> I have a beta acccount and was waiting for this until I started playing around with it. Thanks! I'm pretty excited about building something on top of this platform.

The Scratchpad.io tool that has been on HN for the last couple of days has really blown me away with what Firebase is capable of. Keep up the good work guys!

</comment><comment><USER16> We used firebase to power Scratchpad.io's back end (launched yesterday) and it was an awesome experience! The security features were super easy to use

</comment><comment><USER17> I especially like Firebase tutorials and docs. After finishing tutorial on Firebase first launch I immediately knew where and how can I use Firebase in the future. When the time came we used it for real-time worker/web-app communication at <http://dubjoy.com/> and it worked like a charm. I still don't know how to use web sockets and I hope I never will :) While working with Firebase we needed some ACL-like security features and Firebase delivered again. Amazing.

</comment><comment><USER18> Congrats guys! This is seriously impressive; I'm really excited to finally be able to put out some production code with Firebase.

As an aside, the model you guys ended up with is fairly similar to the one I proposed back in April: <http://news.ycombinator.com/item?id=3864430>

<comment><USER14> Thanks! We're certainly grateful for all of the input and feedback we received while designing this thing (especially from our beta users who came through time and time again, giving us countless security use cases and providing feedback on our prototype implementations).

I will point out though that what you described looks like an ACL system with groups (akin to unix permissions), and we think our Security Rules system is actually quite a bit more powerful than that (you could easily build ACL / groups on top of it, but you can build lots of other models too). :-)

<comment><USER18> Ah, brilliant. I haven't had time to dig too much into it yet, but it'll be really interesting to see how powerful this thing is.

</comment></comment></comment><comment><USER19> The example given doesn't address CRSF. Does anyone know if the API can prevent them?

<comment><USER14> Firebase doesn't use cookies for authentication so CSRF isn't an issue. You have to explicitly call auth() on our JavaScript SDK with valid credentials, or include valid credentials in the querystring of a REST request.

</comment></comment><comment><USER20> I like having the flexibility of being able to use Firebase's servers or my own, makes it easy to use for completely client-side apps, or alternatively you can throw it on top of a server-side application. Great work guys!

<comment><AUTHOR> [Firebase founder here] We did a ton of interviews with devs, and we found that authentication was one of the areas where developers wanted the most control / customization. We therefore opted for maximum flexibility here.

</comment></comment><comment><USER21> Very interesting. How are rules updated dynamically? Take a Flickr picture for example. I start it as public, then later decide I want to make it friends & family. How does the client side securely update those rules?

<comment><USER14> This is where Security Rules shine over ACL's or other more rigid security models. As the application developer, you have complete control over that sort of functionality since the rules are quite flexible and have direct access to your Firebase data.

So you could store a 'public' flag on every picture in your Firebase data, and then write a single rule that checks the value of that flag, and if it's true, allows anonymous access (and if it's not true, checks that the accessing user is in the picture owner's friends/family list).

Assuming your rules let the picture owner edit the 'public' flag, they'll be able to flip it on and off, granting or revoking access to non-friends/family. And since everything in Firebase is real-time, the change will instantly take effect.

<comment><USER21> Thanks, that makes sense. The rules are unchanged, but they refer to db fields, that themselves are protected by the rules.

I was critical of the firebase security situation when they launched, but this looks like a good solution indeed.

</comment></comment></comment><comment><USER22> Great work, the documentation as well as the tutorial are very easy to read and understand.

</comment><comment><USER23> Been playing with the beta for the last few weeks and love it. Props to the Firebase guys.

</comment><comment><USER24> This is a great update and really opens it up for a hackathon project that I wanted to extend after the event, but the security issues had meant that it was better to wait until now.

Well done James T. and the rest of the Firebase team.

</comment><comment><USER25> how is this different than meteor's security model?

<comment><USER26> [meteor dev] Meteor treats the server as an environment for running arbitrary privileged code. You can write server-side logic that consults third-party services, logs client writes to a separate audit trail, keeps authentication state between requests, or implements complex transactions across multiple tables. Similarly you can write code to run periodic database updates on an interval, or respond to incoming HTTP requests from other clients.

Not all apps need this stuff right away, of course, and some never do. But it's hard to do these things w/o a secure server environment for privileged code.

And then of course there's the usual tradeoffs between having control over your hosting environment (a la Meteor) and outsourced backends as a service (a la Firebase).

We're big fans of Firebase, BTW. We think more databases will move to a realtime model. Excited to check this out.

<comment><AUTHOR> [Firebase dev] I've mentioned this in the chat several times, but I should probably mention this on the HN thread as well.

We're big fans of Meteor as well. Firebase is just a data layer -- we do high- performance, scalable real-time data sync -- but we aren't a complete Framework for building an app. Generally devs will want to use something like Meteor (or Ember, or Backbone, or Spine, etc) to help them organize their code and manipulate the DOM.

In the future we hope to have a Meteor integration, so you can power your Meteor app without running any of your own servers (and do it on a super-low- latency, highly scalable backend).

<comment><AUTHOR> I should also mention that Firebase does let you run trusted code if you want to -- you can run a server as a Firebase client using our Node.js library or using our REST API. Then you can do anything you would normally do with a server, and still get Firebase's real-time updates.

The model is reversed in this case though, where instead of clients talking to your application server, clients talk to your database (Firebase), and your application server only ever talk to your database (Firebase). It's a bit of a conceptual shift, but we have many customers doing this in production and it works quite well.

</comment></comment></comment></comment><comment><USER27> Does anybody know how much the Candle Plan is likely to cost once Firebase leaves beta? Assuming that plan will remain in place, that is.

<comment><USER14> The Candle Plan is and will continue to be free! (All of the pricing on the website is just to give people an idea of what the pricing will be when we leave beta. It's not being enforced right now.)

<comment><USER27> Thanks! I'll be eagerly waiting for my access code ;-)

</comment></comment></comment><comment><USER28> I signed up just last night! Great to see such an intuitive product. Can't wait to start building with it :)

</comment><comment><USER29> So, the idea of using json rules rather than a simple javascript function is for speed performance?

<comment><USER14> Michael from Firebase here. By using declarative rules instead of arbitrary code to enforce Security, we can do lots of optimization and guarantee predictable execution time (arbitrary code can take an arbitrarily long time to execute). It also lets us do various static analysis on your rules to catch common mistakes.

Having rule expressions attached directly to data locations also ends up being much more concise (which means less boilerplate code and less opportunities for mistakes), which we think is important for a security API.

<comment><USER30> What are you using for static analysis? What are your thoughts on Fay?

<comment><USER14> Fay looks neat! I'll have to play with it.

Since the whole rules language is custom, we're not using any off-the-shelf projects presently, and to be honest, we've only scratched the surface of what's possible.

Most of what we have in place right now is at the level of type-checking and other expression-correctness checks (we're intentionally more strict about a number of things than JavaScript).

But given the nature of the rules we can do a lot of cooler analysis, like detect redundant or conflicting rules. We should also be able to do interesting analysis for the developer like answer questions like "What parts of my Firebase data can an unauthenticated client read or write?", "What parts can a user authenticated as 'joe' read or write?"

This sort of analysis should help developers reason about their rules and verify their correctness. Honestly, I'm pretty excited about the possibilities. :-)

</comment></comment></comment></comment><comment><USER31> How does this compare to security offerings from other BaaS providers like Kinvey, Parse, etc?

<comment><AUTHOR> The key difference is that we are a real-time backend. We push data changes down to clients when things change and trigger callbacks so the apps can remain responsive. Parse, Kinvey, etc are based on a request / response model. I know some of them can do mobile push notifications, but those aren't really analogous and are a separate service from their data service.

We're real-time, all the time.

We're also focused on the data layer of your app, and on the web, rather than being a mobile-focused company.</comment></comment>