Successful People Start Before They Feel Ready - <AUTHOR> http://jamesclear.quora.com/Successful-People-Start-Before-They-Feel-Ready#

<comment><AUTHOR> Found this particularly interesting as I was using "not feeling ready" as an excuse not to start. I feel like with most people, they never quite feel ready enough to even start. Though readiness in these cases is usually just an excuse to procrastinate change and things that might be hard. I feel that for myself anyway.

</comment><comment><USER2> Not only is this a message of starting before you feel ready, but appreciate the hustle as well! Renting a charter plane you can't afford and then go sell the tickets, that's ballsy!</comment>


Shared Virtual vs Dedicated vs Colocated server hosting - which do you use for your startup? - <AUTHOR>

<comment><USER2> Unless you have money to burn, I would definitely recommend against hosting at a colo.

At the last startup I worked at we had no end of fiascoes regarding our colos. The startup bought over a _million_ dollars of servers and then was paying high-priced employees and consultants to set them up at a colo. But then once the servers were all set up, the colo discovered that they didn't have enough power for our servers. Then we had trouble getting out of the big colo contract that we had signed and had to move all the servers and get them set up at yet another colo. Turns out the next colo also didn't have enough power for our setup even after many reassurances at the beginning that they did. So all in all, this waste of resources put us months behind schedule. Then, ironically we got acquired and no longer even needed our setup because we could then just use the bigger company's server setup.

This is another case of 'premature optimization is the root of all evil'. Seriously, we could have done the whole startup with a couple of Dreamhost accounts and launched earlier with a better product and with WAY (millions) more money in the bank. They were optimizing our server setup for HUGE traffic when they should have just been focused on the product.

I'm glad I was able to see those mistakes close up. It gave me confidence to do my own startup self-funded since I knew how low I could keep my burn-rate.

So now, I'm using EC2 for my servers and it's an amazing experience. I set up a custom server image and then can run multiple instances of it for only 10 cents per server per hour. I can kill instances that I'm not using and bring up a new server within 2 minutes. My server bill is less than $50 a month during development and will be about $100 a month once I launch. I'll also have the ability to scale up VERY quickly and cheaply if I need to.

Anyway, that's my take on it from my limited experience. I'm sure there are some guys that are obsessed with doing their own custom server setup at a colo. Good for them. But you have to realize that you'll have _much_ higher capital costs up front and will be exposing yourself to _much_ greater risk. Focus on your product and find a server solution that is cheap, low-risk, and flexible. Remember you can always scale later - but you have to have a reason to scale first! Have the faith to focus on product and don't fall into the trap of an 'intriguing' 'interesting' academic experiment in server setups!

</comment><comment><USER3> If you want a dedicated server, aplus.net has "value servers" that are basically unmanaged dedicated servers using last-gen hardware. I pay $50/mo for a 2.5 GHz P4 with 512 MB RAM.

</comment><comment><USER4> The problem with VPSes at least is if anyone on the physical box manages to crash the machine, it goes out for everyone. Xen has historically been buggy -- just starting SBCL would crash it(!). Count on Murphy's law -- I had just finished some work and was waiting for a client to take a look at it, and of course my webhost decided to reboot the VPS right before the client checked. Since I hadn't put a restart in rc.local yet, it was just down.

Even with all your other ducks in a row, you don't want a third party rebooting your machine while someone is in the middle of using your site, especially if there's anything important going on, like customers purchasing with a CC or investors taking a look.

Jey's suggestion of cheap dedicated servers for $50 sounds better than EC2 if you're CPU-bound (2.5 GHz vs. 1.7) and is cheaper ($72 per node for 24-7 EC2 usage) and won't wipe everything on restart like EC2 does.

Note that mileage varies widely with webhosts. The majority of them do not understand even the basics of computer security, e.g. the importance of publishing their SSH key fingerprints (via https).

</comment><comment><USER5> I'm running at home off a DSL circuit. I host using a mixture of virtual FreeBSD servers under Parallels on an Intel Mac Mini and two real servers. It works pretty well for low traffic web sites, but the VM's need to have a real hardware NTP server to keep their clocks syncronized. I also run NFS on real hardware. It works surprisingly well. Watch how you allocate VM disk I/O across your physical disk spindles. I have three physical drives plugged into the mini.

</comment><comment><USER6> I started out with shared virtual hosting, but after getting a couple of paying customers I moved to dedicated hosting with LayeredTech.

If you try out the demo you'll see it's really responsive:

<http://ourdoings.com/>

As compared to shared virtual hosting, where even a trivial sample app is sometimes sluggish:

<http://brlewis.com/map.brl>

</comment><comment><USER7> Classic "that depends" question there. I'd suggesting going to <http://www.webhostingtalk.com/> and doing some searching. You'll see some wide ranging opinions on Dedicated vs. Colo vs. VPS.

Go there for an hour or so, ask around. It's mostly a hangout for infrastructure dudes but you'll still learn quite a bit.

</comment><comment><USER8> At my company, we decided to get a few dedicated servers from LT. Prices are great and so far -- knocking on wood -- it's been a great ride.

VPS are not the best for mission critical services, because you never now what you neighbours are doing. Colo is just to expensive and not practical.

</comment><comment><USER9> I'm ok with running my own machine, so I have a dedicated box from Layered Tech that's not too expensive, and has a gig of memory and hardware raid. One thing you can do with a box like this is, while you're ramping up and don't use the full capacity, share it with a friend.

</comment><comment><USER10> Related: What's a provider that can give me lots of CPU time when I can no longer host CPU intensive processes from my home computers? What about for cost less than a dedicated server?

<comment><USER2> Amazon's EC2!

<http://aws.amazon.com/ec2>

</comment></comment><comment><USER11> After a lot of testing, we went the colocated route. VPS was the second best option but the memory issues (too little) that we've experienced with two hosts were unacceptable.

</comment><comment><USER12> I am going with Media Temple (GS) I can't give you feedback about them yet, but they cost $20 a month and their grid server can grow with your needs...

<comment><USER13> I recommend doing a Technorati search on that. Lots of people have received less than reliable service on the Grid. They do great marketing, but their tech is overrated from I've been reading.

<comment><USER14> I agree, my friends actually just switched off MT because of their difficulty hosting RoR apps.

</comment></comment></comment><comment><USER15> Textdrive</comment>


How we improved our product development process with Trello (Gantt chart free) - <AUTHOR> https://medium.com/@_andymac/how-we-started-building-the-right-stuff-faster-at-teachboost-36b35d07dc29 <comment><USER2> Great article on the development process and balancing internal and external forces!

</comment><comment><USER3> great read! I've had to manage the company Trello board in the past and it gets overwhelming</comment>


How 3-D Printing Threatens Our Patent System - <AUTHOR> https://www.scientificamerican.com/article/how-3-d-printing-threatens-our-patent-system1/ <comment><USER2> Good. Your patent system is broken anyway, because

> awarded for inventions that are nontrivial advances in the state of the art

is not true for a long time in US.</comment>


Code Sharing agreement - <AUTHOR> Hello community,
I am making a collaborative code development with a company. We agreed that:
1- They send me the code, I get back whatever I make using their code.
2- Neither of us would be allowed to redistribute the other's code without the agreement of the other.
The issue is they are not comfortable with just a handshake agreement, neither are willing to open source.Also, getting lawyers involved would kill the project because of cost and bureaucracy involved.
Is there a license model that I could use on Github (or elsewhere) that contemplate this situation?
this is critical to build my MVP, so I SUPER appreciate if someone can help!
Thanks! Alexandre Lordelo <comment><USER2> Honestly, and IANAL, but I would never do a handshake agreement when it comes to code. Paying several hundred now for an attorney will be worth it if something happens to go wrong. You are only protecting yourself. Even a simple agreement, reviewed by an attorney, is better than just grabbing something off the internet and hoping it works for your situation. It's all fine till a year from now when you hear about them redistributing your code, then you are out thousands of dollars to try and defend a handshake agreement, where it is your word against theirs. Or worse, a year from now when someone from their company says you are violating the agreement and they go after you.

<comment><AUTHOR> Thanks Jeff!

But isn't there an existing open source license model that contemplate this case? Involving lawyers would surely kill the project, as the developer of the company already mentioned...

<comment><USER2> You can probably find a software license fairly easy on Google or try RocketLawyer. I can't emphasize enough though, to have an attorney review anything prior to signing. A few hundred now, can save you thousands down the road. It sounds like the company you are trying to work with knows this and is insisting on a licensing agreement. Why not have them write up an agreement, and you pay an attorney to review it for you. That shouldn't cost you more than several hundred dollars.

I am not sure I understand why you think it will "kill the project". There are really only two reasons you would think that. First is you are afraid of the cost, and any cost alone would kill the project. The other reason is that the type of project and agreement is so confusing and one-off that any formal agreement is impossible, in which case I would seriously reconsider the project itself.

<comment><AUTHOR> jeff, sorry if I didn't make myself clear...

The company itself don't want to go bureaucratic and involve lawyers into this. They want something like a standard open source license, were we can just copy and paste into a file on a Github private repo.

<comment><USER2> Got ya. Without knowing all the details, it really sounds kind of shady not wanting to have a licensing agreement that is reviewed by attorneys. I would be a little skeptical.</comment></comment></comment></comment></comment>


Ask YC: A good IDE for Python programming? - <AUTHOR>

I am trying to get into python programming for the OLPC, and would like to know what a good IDE for it would be? I am an experienced developer so learning the language or OO is not a hurdle (although functional programming will be new but not difficult).
My other question is an environment one - the OLPC isn't geared up for full blown dev yet so I plan to develop on an Ubuntu VM and then package up an activity and deploy onto Sugar VM and then OLPC. I'm aware that Sugar Activities need to use custom python libraries but I don't know how I would approach getting those libraries into Ubuntu and whether it would work?
Currently looking at wing IDE as an option, I use eclipse a lot and have tried the Jython plug in. I'd like something with code completion and ease of use so not looking for suggestions around Vi or Emacs! <comment><USER2> Try Komodo - quite a good package. PyDev is good if you're already an eclipse user. I hear good things about Kate.

I'm an Emacs user myself - the power is addictive.

<comment><USER3> 'Nother vote for Komodo.

<comment><AUTHOR> thanks I'll look up Komodo.

</comment></comment></comment><comment><USER4> I've done some OLPC development. It's fairly easy to get the environment set up on Ubuntu, and then you can use whatever dev tools you want: <http://wiki.laptop.org/go/Sugar_on_Ubuntu_Linux>

Getting Komodo to autocomplete on the Sugar libraries might be non-trivial though.

</comment><comment><USER5> To just answer the headline question, my preferred IDE for Python is TextMate. But it sounds like that's not really going to suit your needs in this case...I'm not familiar with OLPC, but vim (or maybe emacs? it's larger) might be easily usable across all the various platforms it sounds like you're using.

</comment><comment><USER4> Also, if you're familiar with GDB, you might find that PDB gets the job done for debugging Python. It uses many of the same commands as GDB.</comment>


Reddit Names Marty Weiner, Early Engineer at Pinterest, Its First CTO - <AUTHOR> http://techcrunch.com/2015/08/18/reddit-names-marty-weiner-founding-engineer-at-pinterest-its-first-cto/ <comment><USER2> There are comments from /u/spez and /u/jedberg on the reddit thread:

/u/spez: "I cannot overstate how excited we are for Marty to join us!"

/u/jedberg: "Omg /u/spez. Worst decision ever!

I am of course totally kidding. I've spent a lot of time talking to Marty about both technology and engineering culture (even specifically reddit's technology) and I can't think of a better choice than Marty to be CTO of reddit! Just don't let /u/MrWeiner anywhere near a console."

[https://www.reddit.com/r/technology/comments/3hgni3/reddit_n...](https://www.reddit.com/r/technology/comments/3hgni3/reddit_names_marty_weiner_founding_engineer_at/)

</comment><comment><USER3> It is clear that Reddit is facing some problems with scalability. I often get server errors during peak hours. But I think that politically-based censorship, which is being enforced by many moderators (with the help of Reddit admins), will kill this service sooner than scalability problems. Users will simply left Reddit when they will become censored. Many users I knew already did that. Moreover, moderators of many subreddits want to have more powers, including ability to see user IP address, ban users basing on IP address and ban users globally (not only on subreddit they moderate). Granting them these privileges will accelerate the decay.

[https://np.reddit.com/r/Leakeverything/comments/3c0d9e/some_...](https://np.reddit.com/r/Leakeverything/comments/3c0d9e/some_freshupdated_rmodtalk_leaks_cancer_mods_want/)

It is no coincidence, that /r/europe mods are the ones who ask the most loudly for more powers. They massively ban users on their subreddit, for variety of reasons, but the most common last months is criticizing current EU immigration policy. Some users create new accounts and come back after few days. That's why they want to have the ability to ban IP addresses. It is much harder to change IP address.

Exemplary user stories:

[https://www.reddit.com/r/europe/comments/3b86ws/mods_of_reur...](https://www.reddit.com/r/europe/comments/3b86ws/mods_of_reurope_stop_sweeping_islamist_violence/)

[https://www.reddit.com/r/subredditcancer/comments/374s5i/thi...](https://www.reddit.com/r/subredditcancer/comments/374s5i/this_week_i_was_banned_from_400_subreddits_in_a/)

<comment><USER4> There is no need to bring reddit intra-site politics here. I doubt readers could care less about SJW vs anti-SJW factions on _another_ site. Furthermore, the actions of certain moderators have nothing to do with this staffing announcement, so you are doubly off-topic. It would make me happy at least if we could contain reddit politics to reddit itself.

<comment><USER3> Readers already pointed out here lack of IP banning tools as one of the technical challenges Reddit is facing. I wanted to bring up the context of such demands.

</comment></comment></comment><comment><USER5> What is a "founding engineer"? It must not mean founder, since then one would just say "founder". It's clearly not Director of Engineering, CTO, or VP o E.

I had just assumed this was new phrasing used by recruiters and business people trying to get early engineer hires that they don't want to give a real title to (because if/when the company grows they'll bring in adults to run things and get those titles.)

Note, seriously asking - and not trying to take imply anything negative about Marty's (whom I don't know) abilities, or contributions to Pinterest.

<comment><USER6> Basically "Engineer hire #1" (or similar) that was on board super early but wasn't part of the founding team when the team itself was formed.

I am guessing the distinction is to delineate the fact that the engineer did not join 1+ year from company founding, which is often the case for Engineer #1.

<comment><USER5> So basically founder minus the shares?

<comment><USER6> Well in the case I saw it was founder minus the shares plus quite good pay.

</comment></comment></comment></comment><comment><USER7> What are the technology challenges is Reddit facing? Clearly not scaling as it's been pretty reliable. New features? What more feature does one need from Reddit? It's pretty good for what it's doing.

<comment><USER8> Maybe one day they will fix search?

<comment><USER7> Most people I know just use Google for site search by adding the site name to the query. More sophisticated queries can use site:reddit.com syntax, but usually adding reddit to a query should have the desired effect.

If any DuckDuckGo guy around here, is there a command for reddit search, like !rd or something.

<comment><USER9> The only DuckDuckGo ones I know of (!r, !reddit) use reddit's own search. Not sure if there are any others that don't

</comment></comment></comment></comment><comment><USER10> I met Marty Weiner last summer. Really nice down to earth guy.

</comment><comment><USER11> ok</comment>


The Google Play store, coming to a Chromebook near you - <AUTHOR> https://chrome.googleblog.com/2016/05/the-google-play-store-coming-to.html?m=1 <comment><USER2> It looks like the year of the Linux desktop will finally come and Linux users will converge on a common package manager: the Google Play Store.

The universe certainly has a great sense of irony.

<comment><USER3> I was just saying this. The year of the Linux desktop, with the Chrome distro and Play package manager. Irony indeed :/

(And tangentially, let's not forget: Java running on lots and lots of scaled down hardware.)

</comment></comment><comment><USER4> Meh. Wake me up when the Google Play store comes to a Chrome browser on Windows or Mac

<comment><USER5> That is going to happen in a year or two as well. Thats the reason I feel they are removing chrome apps from other OS apart from chromebooks.

</comment></comment><comment><USER6> >Schools in the US are now buying more Chromebooks than all other devices combined

That probably won't last once news of the 5 year EOL policy gets around.

<comment><USER7> And what exactly is going to replace it?

<comment><USER8> Dell Inspiron 11 3000 @ approx $150/unit with no OS (Windows later). Which is pretty competitive to most 11" Chromebooks which come in at $150/unit with Chrome OS.

Obviously that "No OS" part is a gotcha, but School Districts are practically given Microsoft licenses for pennies on the dollar, so pushing an image of Windows 10 Enterprise isn't exactly a big ask.

The biggest downside of Windows isn't the cost of the devices, it is the staffing costs. With Chromebooks you may be able to spread one full time IT support tech between three or four schools, with Windows it might be one support tech for two schools, and they'll need to be shadowed by people handling systems like AD/Exchange/et al.

I will say that in my limited experience larger school districts do very well with a Windows solution, but smaller ones do better with Chromebooks. That's because larger ones can absorb the cost of the AD/Exchange/server admin easily, whereas for smaller ones you'll have to lose IT support tech staff to go handle that (which hurts end users).

Microsoft has been trying to combat some of these limitations with Azure/Office 365. They, again, give School Districts a huge discount and it allows the school district to outsource some of their staffing needs to Microsoft. Will it work? Time will tell.

I will add this: iPads have been an unmitigated disaster. Everyone rushed to buy them and then had no idea what to do with them once they got them. No money was spent on apps or lesson plans (that focused around an iPad), and even for generic "research" carts they're very underwhelming.

Both Chromebooks and Windows (w/Office) do what students and teachers need: Student email, student portal, research, typing, and spreadsheets.

Ever watch a student try to research something and type a report on that subject using an iPad? It is damn painful, many just start writing the information on paper, then writing up their report at the end, whereas a Chromebook and Windows machine (and MacOS in fairness) are full on multitasking.

Watch this video of someone multitasking on a Chromebook[0] and now an iPad[1]. The iPad is a toy by comparison. I won't even insult anyone's intelligence by linking to videos of Windows/MacOS, both are solid as a rock for multitasking too (MacOS just isn't "realistic" for budgetary reasons).

[0] [https://www.youtube.com/watch?v=5-AJasVMb1Y](https://www.youtube.com/watch?v=5-AJasVMb1Y) [1] [https://www.youtube.com/watch?v=jorwzOsPAYs](https://www.youtube.com/watch?v=jorwzOsPAYs)

<comment><USER9> I don't think the main problem with Windows PCs is the cost of AD/Exchange/etc although it's a big problem. IMO the main problem is that even well managed Windows installs have a way of turning to shit (mine did recently). OTOH ChromeOS is the exact opposite: unless you put your Chromebook into developer mode you cannot muck with the OS at all. And even if you manage to somehow get your device into a bad state, reinstalling from a factory image is easy. So Windows might have more apps and be a more capable OS than ChromeOS but its support costs are too high for it to viable.

<comment><USER8> Windows doesn't have those problems if it is well managed. The second you get the wiff of a problem on a specific device, you just rebuild it from scratch over the network using WDS to select which installation you want, hit go, and walk away.

But as I said above, managing the services behind the scenes (inc. WDS and the images) costs money and smaller school districts struggle to absorb that overhead. I think all you've done is describe the same problem in a roundabout way.</comment></comment></comment></comment></comment>


A Better Way to Learn Swift: Build Modern iOS Apps - <AUTHOR> https://thinkster.io/ios-tutorial/a-better-way-to-learn-swift/

<comment><USER2> Anybody use Swift for iOS game development? I've been meaning to check it out, but it seems that the hype has died down a bit since Apple announced it.

<comment><USER3> It will be the way to go in the upcoming years!

<comment><USER2> At this point, for a new iOS developer, would it make sense committing entirely to Swift training?

<comment><USER3> I would go with yes. It's much easier language to learn and understand as a beginner. The hardest part is learning all the iOS libraries to be honest.</comment></comment></comment></comment>


ZEIT Is Now Vercel - <AUTHOR> https://zeit.co/blog/zeit-is-now-vercel <comment><USER2> "ZEIT is now Vercel. This new identity aligns with our new focus — to provide the ultimate workflow for developing, previewing, and shipping Jamstack sites."

(╯°□°)╯</comment>


$99 pocket-sized i386 with wifi - <AUTHOR> http://en.qi-hardware.com/wiki/Ben_NanoNote

<comment><USER2> To add wifi (or any networking at all) you have to buy a $120 microSD wifi adapter with a specific custom chipset made by exactly one company in Japan. Now you've passed the price of an eeepc on ebay for a machine that struggles to play an ogg.

Sounds like a solution without a problem to me.

</comment><comment><USER3> Erm, the Nanonote is MIPS and doesn't have Wifi...</comment>


The Linux Credit Card - <AUTHOR> https://www.linuxfoundation.org/offerings/linux-credit-card <comment><USER2> I love Linux as much as the next sysadmin, but given how central it is to the bottom lines of so many corporations, there's no way I'm going to donate to it as an individual. Let the companies that profit from it fund it.

<comment><USER3> I think that's a pretty misguided statement. If you _can_ donate you should. Imagine having to deal with any other platform...

The more people (and companies) donate the better we're all off IMO.

<comment><USER4> If he can donate to this, he can donate to everything. The "if can, should" principle would have him exhausted of money on much more worthwhile charities long before he'd get round to linux.

What he's saying is that linux is part of a sustainable economic system from which companies profile, so that (now) it does not require individual charitable contributions.

<comment><USER3> Fair point, but that's not what I meant exactly.

If he "wants to" \+ "can", then he should.

The argument was against "I can but why should I if companies will", which I think misses the point of contribution. The more the better.

</comment></comment></comment></comment><comment><USER5> I always find it eyebrow raising to check the corporate membership list, and see Suse sitting as Gold member while Red Hat is down in Silver.

<comment><USER6> Red Hat would rather use that ~$80,000 to hire another kernel developer, the member ranks are just about political clout.

<comment><USER7> Because Red Hat never does anything that is about political clout?

<comment><USER6> No, they aren't donating more to the Linux foundation for political clout.

</comment></comment></comment></comment><comment><USER8> >> A percentage of every purchase made on your Linux Foundation credit card goes back to Linux Foundation <<

Would be nice if they actually mentioned what that percentage is exactly.

<comment><USER9> For affinity cards from this company (UMB/Cardpartner) it's typically 0.3%.

Source: [https://www.owasp.org/images/0/08/CardPartner_Kit.pdf](https://www.owasp.org/images/0/08/CardPartner_Kit.pdf)

<comment><USER10> 0.3%?! It'd far more effective to get a 2% cash back rewards card like the Double Cash, and donate the money to the Linux Foundation.

<comment><USER11> Only if you actually remember to donate your rewards balance. Effortless transactions are powerful.

<comment><USER12> Depending on your payroll provider, you may be able to automate this. (Gusto used to make this easy, though they recently changed it so that each charity has to be signed up with their backend provider. Not sure about other payroll platforms.)

[https://www.charitynavigator.org/index.cfm?bay=search.profil...](https://www.charitynavigator.org/index.cfm?bay=search.profile&ein=460503801)

</comment></comment></comment></comment></comment><comment><USER13> Site isn't loading. Web Archive: [https://web.archive.org/web/20161201162722/https://www.linux...](https://web.archive.org/web/20161201162722/https://www.linuxfoundation.org/offerings/linux- credit-card)

</comment><comment><USER14> Would be nice if we could find out what percentage of the total Linux Foundations donations, payments from member companies and members actually go to the people making useful contributions to Linux developers and related technologies/tool developers, as opposed to "management retreats".

</comment><comment><USER15> I had one of these 15 years ago. I got a "cute penguin" comment almost every time I used it.

<comment><USER16> Same here. I believe it was via linuxstart.com

</comment></comment><comment> matt-tingen Why not just get a card with 1.5% cash back or more and make a donation? The Foundation would get more and it's tax deductible for the cardholder.

<comment><USER17> You certainly could, but the downside is they are decoupled. With this card, every purchase is coupled with money going to the linux foundation.

It might be less than what you could earn/donate elsewhere, but it gives them an additional source of recurring revenue that they can plan against.

</comment></comment><comment><USER18> I used to have the FreeBSD version of this card. I never knew how much was being donated, which was disappointing.

<comment><USER19> I'm holding out for a Docker card.

<comment><USER20> Why would you donate money to a business that, you know, sells products?

<comment><USER19> You don't think the Linux Foundation makes money? Heh. The secure BSD project had hard time raising few thousands of dollars last year.

<comment><USER20> The Linux Foundation is a non-profit, for one, but I don't see what a BSD project having difficulty raising money has to do with donating to Docker.

</comment></comment></comment></comment></comment><comment><USER17> I'm moving all my banking away from Wells Fargo because of their involvement with the north dakota access pipeline, and this will be a great replacement for my CC!

</comment><comment><USER21> Sadly I'm a student and haven't started a line of credit. I'd love to buy one of these but I'd definetly not be allowed.

</comment><comment><USER22> If it just had no Tux on it.

[https://piss.io/how-tux-the-penguin-ruined-it-for- linux-8b22...](https://piss.io/how-tux-the-penguin-ruined-it-for- linux-8b221fe63387#.uv85jbl2i)

<comment><USER17> I like Tux and am glad its on the credit card; he's the Linux mascot and it wouldn't be the same without him.

Also, that blog post is full of needless profanity and hate. If you wanted to present some kind of reasoned argument against tux being on the card, that was not it.</comment></comment>


Pokemon Go – Permissions Update - <AUTHOR> https://support.pokemongo.nianticlabs.com/hc/en-us/articles/222648408-Permissions-update <comment><USER2> I'm glad they involved google to make sure the change happens to anyone and also to verify their claims about access. This is the type of response we should expect/demand from other companies. Well done.

<comment><USER3> I agree it is helpful to involve Google so it can be changed for existing Pokemon Go users. But I don't see how Google has verified the claim, since Google themselves have yet to release a statement.

By the way, Google indorsed this comment. Believe me?

<comment><USER4> It's probably much easier to involve Google when you are a Google spinoff company.

<comment><USER5> Yeah, because they likely have the phone number of someone they can call.

</comment></comment></comment></comment><comment><USER6> This is the same message that was released to the press yesterday.

I'm surprised Google itself has not said anything, as they are also at fault for not showing the permissions workflow in the first place.

<comment><USER7> Exactly, that's what I'm more worried about - Google needs to present clear information about what access is provided BEFORE I accept the account connection. It's not necessarily Niantic's fault for asking for too much, it's Google's for not at least making me aware.

<comment><USER8> It's entirely plausible that Niantic didn't realize they were asking for too much specifically because Google didn't show the permissions being asked. So any time they tested their own app, they would have just seen what everybody else saw, which is that the app asked for access to the Google Account with no mention of what permissions.

<comment><USER9> Despite that, it is wexing that they wouldn't come across this issue during testing. Maybe it's a production issue. I am very interested in a technical explanation from either Google or Niantic. They surely had to test iOS app and check their Google permission page. Otherwise it would be really sloppy testing.

</comment></comment></comment></comment><comment><USER10> Isn't this a bit: "Accidentally left open gate to castle. Now closed. No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Share and enjoy." ?

On another note, from the "privacy policy":

1\. REVISIONS TO THIS PRIVACY POLICY

Any information that is collected via our services is covered by the privacy policy in effect at the time such information is collected we may revise this privacy policy from time to time if we make any material changes to this privacy policy, including any change that we propose that will have retroactive effect, we'll notify you of those changes by posting them on the services or by sending you an email or other notification, and we'll update the "last updated date" above to indicate when those changes were made

So, they'll _let you know_ if they apply _retroactive_ changes to the policy? How is that any different from "lol, you give data, we do what we want, ok?"

<comment><USER11> > So, they'll let you know if they apply retroactive changes to the policy?

Pretty standard for a lot of apps and web services. The alternative is not to use them, or to be very conscious about what data you supply them with. Most people just click accept (as with any EULA).

<comment><USER10> Seems like a privacy policy that amounts to "lol, whatever" can't possibly be lagally binding in the EU at least. If it _is_ (found to be) void they could be required to delete _all_ customer data - as they have no legal grant to store it or use it for any purpose?

</comment></comment></comment><comment><USER12> I really appreciate that they were able to make a change quickly and provide transparency about the issue and resolution.

<comment><USER13> Though, I always feel kind of bad about the whole torch-and-pitchforks almost certainly resulting in some poor sap(s) working 24/7 to fix the issue ASAP when it really could have been fixed, oh, Thursday. (assuming the absence of malice, it's just important it get fixed reasonably soon) Especially considering they doubtless have all kinds of other major issues on their plate- like the server load problems.

<comment><USER14> As much as I don't like the torch and pitchforks approach; this is the kind of oversight that should be found long before an app is released. It also shows that the market won't tolerate broad security overreaches.

I certainly want to try Pokemon Go, but after seeing these articles, I decided to wait.

</comment></comment></comment><comment><USER15> On Android, Pokemon Go requests permission to access your contacts. I declined this access, and the app still seems to work (modulo the crashes & bugs that others have reported).

Accessing the camera and location I can understand, but I don't want to give Pokemon Go access to my contacts.

<comment><USER16> I assume that its for a yet to be implemented find friends feature, but I was also concerned at that permission request.

</comment></comment><comment><USER17> This update completely broke login for people with Pokemon Trainer Club accounts. It doesn't even send the HTTP request: [https://www.reddit.com/r/pokemongo/comments/4sjbeq/ios_users...](https://www.reddit.com/r/pokemongo/comments/4sjbeq/ios_users_who_login_using_pokemon_trainers_club/)

</comment><comment><USER18> From the 1.01 iOS release notes: "-Fixed Google account scope"

<comment><USER6> Not documented, Pokemon Go now asks for Notification permissions. (Which is typical of mobile games and should have been done at launch, but ironic given current circumstances.)

<comment><USER19> > should have been done at launch

Generally speaking, this is the worst way to do it, as the app hasn't made a case for why it needs to send notifications.

It should do it in a contextual way so the user understands that notifications will enhance their experience of the app.

<comment><USER20> Why is it the worst way? It would make total sense to combine those ideas.

<comment><USER21> Typically the user should be primed, given reason for what the notifications will entail, how frequent they might be and so on. It makes users much more receptive to them if you tell then why they should want to have this optional feature enabled, rather than a blind notification popup in first launch.

<comment><USER20> Right - a popup at launch with useful context rather than a blind "We want $ALLTHETHINGS".

<comment><USER19> Exactly - I just meant not the default popup as soon as you launch without any explanation or justification.

This is what developers would do in the past with location access also, but as privacy awareness takes hold people are far more likely just to deny these permissions.

In iOS it's a pain for a user to actually reenable the setting after the fact.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Keep in mind you dont have to login with your google account - you can create a free pokemon club account and use that.

<comment><USER23> That site has been down continuously for days, so it might not be a real option.

Edit: OK, _continually_ since it does seem to be up sometimes!

<comment><USER22> I just did it this morning - just refreshed the page once and it worked fine.

</comment></comment></comment><comment><USER24> I'm slightly curious how we prove the statements to be true.

There wasn't the normal "this app wants ___ permissions, is that cool?" message from the Google OAuth dialog. I had not idea I'd authorized Niantic to go scrape all my emails, access Google's own processing on them for advertisement system training or review my location history, for example.

I'm not so sure why I should believe they didn't do that.

</comment><comment><USER25> I wonder how many applications do the same thing and haven't been called out on it.

<comment><USER26> The difference here is the "grant full access" screen was never shown to users. That shouldn't be possible and speculation is that either the app somehow hijacked past the screen, or Niantic being an ex-google company was whitelisted to avoid this.

I can easily see how the second would happen, I wonder if Ingress (their previous inside google app) even showed up on your list of authorized third parties?

<comment><USER25> From what others have posted here, any native app that loads the oauth flow in a web view control or whatever it's called, has full control over it, and so can do anything it wants.

</comment></comment></comment><comment><USER27> I didn't think they were doing anything nefarious but you never know. I think I will install it now, to see what my grandchildren have been talking about.

<comment><USER28> The concern (at least for me) wasn't that Niantic was doing anything nefarious, it was that if they didn't even know they were asking for full permission are they professional enough to prevent that full permission from being misused by a malicious actor? The app is so popular that an exploit could be a gold mine for black hats.

Glad to see Google patching the permissions server-side, as I bet a lot of people just checked the app out once out of curiosity and won't launch the updated version.

</comment></comment><comment><USER29> Take a look at this list of potential things you can ask for as a developer:

[https://developers.google.com/identity/protocols/googlescope...](https://developers.google.com/identity/protocols/googlescopes)

And most folks will click "Approve" without really reviewing the list. That said, Twitter and Facebook (two other popular OAuth providers) heavily restrict certain "full" access to only trusted applications that they either have a business relationship with or otherwise review the application before allowing those scopes to be requested or used. This incident may prompt Google to do more of that, which isn't entirely great news for the more responsible developers with purpose-built apps.

<comment><USER30> That's why Facebook changed their APIs in 2014. Before any app could ask for anything. Now apps can only ask for public profile data, email address and a list of your friends that have also installed the app.

Before you could also get stuff like education and work history, family relationships, relationship status, sexual orientation and a whole load of other stuff that could potentially cause a lot of trouble. And people would happily click OK just to play FarmVille or whatever.

Now Facebook makes it so any app needing advanced permissions data has to be reviewed by Facebook first.

See [https://developers.facebook.com/blog/post/2014/04/30/the- new...](https://developers.facebook.com/blog/post/2014/04/30/the-new-facebook- login/)

</comment></comment><comment><USER31> Great. Although this is really a left-pad situation: it's good that they fixed it, but that fact that it was a problem in the first place is pretty damn disturbing.

</comment><comment><USER32> Inital thought: Wow that company is so great... that they did the right thing...

...Wait a second do i think a company is great just cause they do things the way they should do them.

<comment><USER33> Yes. Because it's an uncommon thing for a company to do right by their customers, and everyone that does IMO deserves praise (and more business).

</comment></comment><comment><USER34> It is indeed fixed but updating iOS app alone does not change the permissions. I had to sign out of the app, revoke the permissions on google and then sign back in.

<comment><USER35> thats why they're involving google, Google is handling the permissions changes

</comment></comment><comment><USER36> Oh good, I can finally feel comfortable about installing it.

</comment><comment><USER37> Is the button that takes me to login with Google account the same as using a Google email address to create an account?

</comment><comment><USER38> Perfect response! :)

</comment><comment><USER39> Bit of OT

Played Pokémon GO yesterday (iOS 1.0 version) and it was very buggy. Many bugs looked like they were server side (requests freezing), but there were strange rendering errors (like seeing only waves on the ground where Pokémon are, and not the actual Pokémon on them) that could be fixed by restarting the app several times. The phone also got absurdly hot, I never play on it, I don't know if it's normal for it to get like that, but I could barely hold it in my hand.

I literally couldn't understand all the fuss about the game, it was unplayable for me...

<comment><USER40> Yep, that's about right. This app is shit on iOS. I thought the App Store was supposed to have a quality review process, but this thing crashes all the time.

<comment><USER41> Haven't played it, but testing an app without any significant load would seem to be pretty different from scaling up the backend to twitter-scale in a couple of days.

<comment><USER40> Why should the app crash or hang for backend issues?</comment></comment></comment></comment>


Reforming land use regulations - <AUTHOR> https://www.brookings.edu/research/reforming-land-use-regulations/ <comment><USER2> To the overall premise of the article, I do agree- land use regulations have played a huge role in the decrease in supply to real estate, increasing housing prices in the places where it's most needed.

But (if there was no 'but' why even comment?) I think it's also important to not throw the baby out with the bathwater. There's a case[0] ongoing in Ontario wherein the premise is basically "conservation authorities don't have the right to tell me what to do with my land". But those same regulations are the ones that have helped prevent major flooding throughout the province for the last 60 years. Some regulations aren't just there for NIMBYism- some are there to prevent the tragedy of the commons.

It's important to recognize the difference.

[0] - [http://canadianjusticereviewboard.ca/articles- caselaw/case-l...](http://canadianjusticereviewboard.ca/articles-caselaw/case- law/gilmor-et-al.-v.-nottawasaga-valley-and-the-township-of- amaranth-2015-onsc-5327)

<comment><USER3> Sometimes those regulations just create a _different_ "tragedy of the commons".

For example, building affordable apartments often requires finding "loopholes" and squeezing something through the regulatory process before it gets shut down.

If I may quote at length from the Seattle times[0]:

> It was the brainchild of the late Bellevue developer Jim Potter, who found a > loophole in Seattle's building regulations.

> At the time, the city allowed up to eight unrelated people to live in one > "dwelling" with a shared kitchen. The code didn't say the rooms had to be > tied together as a single unit, so Potter built a cross between an apartment > building and a boardinghouse, where someone could rent a sleeping room as > small as 100 square feet with a private bath and share a kitchen with up to > seven others renters.

> A micro-housing building spree ensued that gave Seattle more such units than > any city in the country. At last count, 782 micro-housing units were cleared > for occupancy in Seattle, with another 1,598 units in the pipeline. No other > American city comes close.

> Once the pipeline is cleared, though, no future Potter-style hybrids will be > allowed: The city changed the rules in October after neighbors railed > against the projects. Congregate housing — group housing arrangements such > as dorms and senior housing that use common areas — is still allowed. But in > the future, micro-housing will mean efficiency apartments of at least 220 > square feet, each with its own bath and kitchen.

\</comment></comment><comment></comment><comment></comment><comment>---

I'd argue that on the whole, more people are harmed by heavy-handed regulations that limit the mark

I know regulations contain more than just "affordable housing" issues, but often the impact of land use regulation is to drive up the cost of housing for everyone, which makes households more sensitive to job loss, and dependent upon a steady income.

The 2007-2008 recession could have been partially mitigated if inexpensive housing stock was available for purchase.

So, I'd argue that preventing major flooding is good, but the tools by which governments try to prevent that flooding (and other "negative externalities" cause problems more severe than they solve.)

[0] [http://www.seattletimes.com/pacific-nw-magazine/seattles- mic...](http://www.seattletimes.com/pacific-nw-magazine/seattles-micro- housing-boom-offers-an-affordable-alternative/) [1] [https://www.strongtowns.org/journal/2017/4/20/the-high- high-...](https://www.strongtowns.org/journal/2017/4/20/the-high-high-price- of-affordable-housing)

<comment><USER4> Microhousing doesn't sound like much of a good thing, if I'm honest. It pushes a lot of functionality normally fulfilled by a house (such as entertainment, eating, work, storage, etc.) onto the city at large - you live in the city, and just sleep in the house. If the city isn't prepared to support such externalities, there's going to be a lot of chaos.

2,000+ families living around Bellevue (a suburb of Seattle, not even Seattle proper) doesn't sound great to me. Seattle isn't known for being a great place to spend your day in the park... Seems to me more like a scam to sell more homes at the cost of the city.

<comment><USER5> While there may be good arguments in favor of limiting migration into a city, there's this little problem called _freedom of movement_ stemming from the Privileges and Immunities Clause of the Constitution [0]. Cities _do not_ get to write immigration policies. It's _totally irrelevant_ that you think an area shouldn't have more people in it. They're coming anyway.

Short of a Constitutional amendment, a city can only decide _how_ to house new residents once they arrive. Do they move into new units alongside existing residents, or do they displace those with lower income? Do the new beds cram illegally into existing bedrooms, or do the buildings get taller?

If blocking housing construction were an _effective_ way of preventing immigration, that would be one thing. Instead we are all suffering crowded conditions and long commutes because you have cause and effect backwards. Housing units don't cause residents, and the absence of housing units doesn't prevent residents! Residents _would_ , absent your intervention, cause housing units.

[0] [https://en.wikipedia.org/wiki/Freedom_of_movement_under_Unit...](https://en.wikipedia.org/wiki/Freedom_of_movement_under_United_States_law)

</comment></comment></comment><comment><USER6> The only part of this article that is worth reading is the last paragraph, where the author is unmasked as a spokesman for the realty industry, who clearly have an interest in more high value low cost housing, for which regulation needs to change. It's a pity this sort of rubbish can't come with an appropriate disclaimer at the start.

</comment><comment><USER7> Why is it that American think tanks can only think of regulations as a scalar? It's not 'more regulation' or 'less regulation' we should be discussing. It's better regulation, where better requires a more nuanced discussion of what kind of regulations should be instituted.

I generally agree with this article that many land use regulations have restricted building and it has generally hurt all of us. I'm all for density, and one of the ways in which we could increase density is with 'better' land use controls, not fewer or more or whatever. Regulation should not be thought of as a scalar.

<comment><USER8> "If states do want to reform local land use controls, they might start with a serious cost benefit analysis and then require localities to refrain from any new regulations without first performing cost-benefit analyses of their own."

Sounds a lot like "a more nuanced discussion" to me.

</comment></comment><comment><USER9> I'm not surprised when the Brookings Institute concludes that the answer is less regulation.

The article ignores the market dynamics of real-estate development. Those dynamics are created by the the limited fungibility of real property. Real property may be exchanged for cash, but following such a transaction the cash can not (usually) be used to replace the original property because there is only one property at a particular location.

In general, real-estate development seeks to maximize profits by pushing parcels toward their highest and best use. Removing regulations affecting real-estate entitlement won't change the economics affecting what developers build. Class A office space will be more profitable than a used car lot. A Porsche dealership will be more profitable than a Greyhound station. Luxury apartments will be more profitable than a tenement. Those are what developers will try to build.

Suppose a luxury housing developer controls a parcel, removing entitlement regulations does not mean the developer builds a tenement. It means either the luxury housing developer builds luxury housing or waits until there is demand for luxury housing or someone makes an offer on the parcel that meets the luxury housing developer's expected internal rate of return from developing the property as luxury housing. An affordable housing developer who wants the parcel has to pay the price of a parcel suitable for luxury housing to obtain it. So will another luxury housing developer or an office building developer and for them the price will make more economic sense.

One way of thinking about real-estate is that each and every parcel is a monopoly. Some monopolies are worth more than others. Removing entitlement regulations does not change the value of locations. It does not change the economic incentives of highest and best use. It does not remove market demand.</comment>


Medieval Speech Bubbles - <AUTHOR> http://medievalbooks.nl/2015/01/23/medieval-speech-bubbles/

<comment><USER2> Not about medieval but somewhat related example. There are no visible speech bubbles but the characters nevertheless "talk" to each other: [http://notetoself.typepad.com/.a/6a0115705a75a1970b0120a66db...](http://notetoself.typepad.com/.a/6a0115705a75a1970b0120a66db65e970c-popup) (Ancient Greek amphora by Exekias from the museums of Vatican).</comment>


Data Consistency Checks - <AUTHOR> https://slack.engineering/data-consistency-checks-e73261318f96 <comment><USER2> An analog in code that I've seen so often I've given up fighting it is this "pattern" (in Java, but it's universal):

        try {
            doSomethingImportant();
        } catch (Exception e) {
            logger.error("oops", e);
            // continue on, even though the result is useless at this point
        }

... and hope that somebody will pay attention to the logs (hint: they won't). Of course, if you can actually recover from an error (hint: you probably can't), you should catch it and recover from it, and of course, you should definitely log what happened so you can investigate later but FOR THE LOVE OF GOD DON'T JUST KEEP GOING!

Unfortunately, this sort of papering over error conditions is not just accepted, but encouraged - most organizations bizarrely seem to prefer to return wrong answers than admit that an error occurred. Old mechanical adding machines had moving parts that would degrade over time, making the answers less and less accurate as the parts started to wear out. Adding machine manufacturers addressed this by adding a gear that would cause the machine to lock up completely so that the operator knew not to continue using it. While it seems obvious that most users would rather get an error than the wrong answer, most programmers seem to consider doing the opposite the "safe play".

<comment><USER3> Oh god. I inherited a codebase like this (except in many places it didn't have the log). It was horribly unreliable, and when a customer reported a bug it was almost impossible to tell what had caused it. The funny thing was they had a pretty extensive e2e test suite. But it was mostly useless because it only tested happy paths. The rule is now that if you touch a file for more than a single-line change, you have to remove any such code.

</comment></comment><comment><USER4> There seems to be a trend where companies are creating tools to monitor data quality...

* Great Expectations: [https://github.com/great-expectations/great_expectations](https://github.com/great-expectations/great_expectations)

~2 years old, does data profiling

* Data Sentinel: [https://engineering.linkedin.com/blog/2020/data-sentinel-aut...](https://engineering.linkedin.com/blog/2020/data-sentinel-automating-data-validation)

It's not open sourced however.

* Data Anomaly Detector: [https://www.slideshare.net/iblaine/using-airflow-for-tools-d...](https://www.slideshare.net/iblaine/using-airflow-for-tools-development)

Something I built at One Medical that is not open sourced...but this deck has some interesting concepts in it. The approach here is to minimize the effort, lines of code, number of clicks needed, to test your data.

* Amundsen: [https://github.com/lyft/amundsen](https://github.com/lyft/amundsen)

This is open sourced, and some contributes are building features for data quality analysis. Amundsen seems like it has a bright future.

</comment><comment><USER3> This is why I think schemaless databases ultimately cost more time than they save. If your database is typed then you get a poor mans version of a lot of these kind of checks essentially for free. Otherwise it's _very_ easy to end up with all sorts of inconsistent data in your database, which will result in lots of difficult to track down bugs which consume _far_ more time than writing out a database schema.

</comment><comment><USER5> I think we need to caveat _what_ is a database when we make statements like this:

> Databases. They are the single source of truth for our most critical > business data, yet as engineers we tend to overlook tooling with this in > mind.

Most folks, like myself, will assume that we're talking about traditional concepts of databases, like RDBMS or Key/Value stores etc. But over time, after building distributed systems, it is important to realize that _logs_ are also a form of a streaming database and we need it to treat it like such.

This is the basic principle behind the venerable article by Jay Kreps (one of the authors of Kafka): The Log: What every software engineer should know about real-time data's unifying abstraction [1].

Once we start thinking this way, then we realize that everything ends up having a schema (protobuf, thrift, avro, etc.) -- just a "database" with a completely different view point.

IMHO, and consequently this is true where I work, The Log is considered the single source of truth and what is traditionally referred to as a "database" is just a "just-in-time" view of data that is materialized from The Log.

Anyway, that is just my 2c.

[1]: [https://engineering.linkedin.com/distributed-systems/log- wha...](https://engineering.linkedin.com/distributed-systems/log-what-every- software-engineer-should-know-about-real-time-datas-unifying))

<comment><USER6> It seems like there's a fundamental distinction between systems where you control data entry (it's manually entered and you can refuse to accept data if it doesn't follow the rules, until the error is corrected) and systems where you are recording whatever you got.

In the latter case, it's often better to keep data for debugging purposes than drop it on the floor. The raw data may not conform to any particular schema, but perhaps you transform it or only use a subset of it for more advanced queries, and do something else with the rejects.

In older systems, this may be the difference between the paper form you got in the mail and what gets entered in the computer.

Refusing to accept input has implications for power relations. Who loses when data is rejected? Who gets a chance to fix it, and how hard do they try? What error messages are there and long does it take to retry?

Case study: vote by mail.

<comment><USER7> >In older systems

If only it were older systems!

I get data from a variety of undocumented sources, and I started logging what I actually receive next to the normalised data, e.g. I either put raw JSON into the database next to the actual data it contains, or I put all downloaded data into a git repo and update the repo after every query.

Why raw JSON? I've had data come back as JSON that did not validate like not escaping quotes, blank fields that were missing a value e.g. {"dog": , "cat": "yes"}, just plain wrong data (a number field that was "no number at present"). Putting it into the DB lets me fix the errors and reprocess.

With non-JSON, I've had a raft of other errors/problems, and I find git works well here to show what changed and caused the errors.

When dealing with anyone else's data, not just validating but also logging in a structured way that makes discovering errors easier is vital.

</comment></comment></comment><comment><USER8> So, how is this approach significantly better than good database design and practices ensuring data consistency? E.g. column length, foreign keys, stored procedures for updates/inserts that require validation logic?

<comment><USER6> From the article:

> Some databases can enforce relationships at the systems level, using foreign > keys, constraints, and other similar concepts, but these built-in checks and > constraints represent only a small set of possible characteristics that may > be modeled in any given system. Likewise, ORMs like ActiveRecord can check > data at write time using validations, but these often need to be disabled in > performance sensitive code, and can themselves contain bugs.

<comment><USER9> You can add domain-specific validations that are hard or impossible to capture with database constraints.

For example, I built similar tool that you could write simple rules to validate product data. This would run every night and generate a report for the data quality team. One of the advantages was that you could decide have stricter requirements and then choose if they only applied to new products, or if the team had to go back and fix all the old products too.

Some rules I remember:

\- Validating min-length, max-length, and casing of product names. Spell checking words founds.

\- Verifying product images existed and where the right dimensions, below a certain file size, etc.

\- Making sure that certain product categories had dimensions, and that the metric/imperial conversions were rounded in the industry-norm way (e.g. 3 3/4" was 96mm)

\- Making sure that pricing/margins made sense on a vendor/product category level, to try to catch typos like $1 or $1000.

The thing I found handy was to add new rules when problems occurred that fixed historical issues.

</comment></comment></comment><comment><USER10> This is great! As a CTO, having live integrity checks would strongly increase my trust, versus our current unit tests that cover data integrity. Development is nice, but live systems are real.

<comment><USER11> Strictly speaking, data integrity isn't part of your role. Properly implementing business-wide data governance policies is the domain of the CDO. Data integrity and validity is not a property of any single application, but should be formalized as part of the business requirements and processes. This includes:

\- identifying data flows: which data travels across which systems?

\- determining data authority: which application/data store is authoritative for which piece of data?

\- assigning data stewardship roles: which manager is tasked with maintaining data integrity for which authoritative data?

\- documenting data definitions: what are the exact semantics of certain data fields?

Once the business has formalized its requirements on its data, you can use those requirements in your technology strategy (both in purchasing decisions, in-house development and worker training). But in the end, these requirements are business-driven, not technology-driven.

<comment><USER10> You don't know a single thing about my organization. Why are you telling me what my responsibilities are?</comment></comment></comment>


Why I Unlicense - <AUTHOR> http://kibabase.com/articles/why-i-unlicense

<comment><USER2> As one of the original authors of the Unlicense, always nice to see yet more people opt out of the copyright racket.

The growing visibility of unlicensing is a good thing what with the copyright industry increasingly running amok. Sometimes things have to get worse before they can get better.

The project list at <http://unlicense.org/> could probably use an update sometime soon. Link suggestions are welcome via the mailing list as usual.

</comment><comment><USER3> I've used Unlicense before, but I have since been persuaded that this was a mistake. Frankly, I think that unlicense inadequately protects user freedom. It does not contain a patent grant or estoppel. While I don't care about attribution, the disruption of provenance is problematic. I should hope that there are few companies interested in shipping code that, as far as they can tell, fell off the back of a truck.

Suppose that Foo Corp releases Unlicensed code that includes patented material. Baz Ltd goes on to develop a widget that uses Foo's code. Later on, Bar Inc buys Foo Corp and files suit against Baz.

No disrespect meant to Arto, but he simply isn't a intellectual property attorney. (Edit: And neither am I.)

<comment><AUTHOR> _While I don't care about attribution, the disruption of provenance is problematic._

Heard that loudly and clearly several time in this thread.

 _Suppose that Foo Corp releases Unlicensed code that includes patented material. Baz Ltd goes on to develop a widget that uses Foo's code. Later on, Bar Inc buys Foo Corp and files suit against Baz._

Good point. The problem only exists because patent exists.

<comment><USER4> The point is that copyright dedications are not licenses. Therefore, if you want to submarine someone... do a copyright dedication (but don't grant patent rights). Wait till your "public domain" work is broadly adopted, then sue. Or, conversely, if you want to get sued... use works in the public domain where the person doing the dedication hasn't also granted patent license.

At least if you use a standard MIT license there may be an "equitable estoppel through acquiescence" in which the copyright holder might not be able to sue you for patent infringement since the MIT license said you could _use_ the work.

<comment><USER5> It's better to use the Apache 2.0 license which includes a patent grant, though.

</comment></comment></comment></comment><comment><USER6> Why not CC-BY? I see attribution is something that protects the rights of consumers (by preserving the provenance chain) as much as it protects the rights of producers.

Personally I find myself going the other way. I see many free data products in the semantic web space that are only marginally succeeding, and a lot of it is that, without the profit motive, the people involved don't have a motivation to do the fit-and-finish work that's necessary for people to pick the product up and actually use it. I'd rather be working with a few people who really want the product and prove that they want it by paying for it, rather than dealing with a huge number of uncommitted people.

<comment><AUTHOR> _Why not CC-BY? I see attribution is something that protects the rights of consumers (by preserving the provenance chain) as much as it protects the rights of producers._

I want my work to spread as widely as possible. Sometime when your work get remixed so much that it doesn't make sense that somebody should preserve attribution.

 _Personally I find myself going the other way. I see many free data products in the semantic web space that are only marginally succeeding, and a lot of it is that, without the profit motive, the people involved don't have a motivation to do the fit-and-finish work that's necessary for people to pick the product up and actually use it. I'd rather be working with a few people who really want the product and prove that they want it by paying for it, rather than dealing with a huge number of uncommitted people._

You still want more dedicated customers. The way to get a lot of those people is to be well known. Whether or not you are able to filter them is another matter.

This article isn't arguing against high price. To me, getting paid for dead tree copies of your book is the very definition of charging a leg and an arm because they COULD read it for free on the internet.

</comment></comment><comment><USER7> I don't understand this bit: _Under both system of copyright and copyfree work, J. K. Rowling, author of the Harry Potter series of book, became a billionaire_

JK Rowling became a billionaire through licensing her characters to film- makers, toy-makers, etc. a method that is totally dependent on intellectual property.

Am I missing something?

<comment><AUTHOR> Thanks for spotting an error. What I really meant is that J. K. Rowling would probably earn a lot of money either way, even if not with such ludicrous rent. I updated the text to reflect what I actually mean.

</comment></comment><comment><USER8> Sounds like "The Free Music Philosophy": <http://ram.org/ramblings/philosophy/fmp.html>

</comment><comment><USER9> Different types of creative work may deserve a different treatment. (The same people who want copyright protection reduced to 5 years max probably haven't thought through the GPL implications!)

Imagine you wrote a truly great short story. Straight up copyright might be optimal. It'll get copied around regardless. Encouraging derivative works probably doesn't buy you much. And CC-BY seems as low as you'd want to go. Anything less, and Hollywood just gobbles it up and nobody sees your name on the poster. This goes against your strategy of "getting known by getting copied."

Also, times change. Musicians who license songs CC-BY-NC are free options in the Vimeo music service that offers background tracks to video creators. Meanwhile, old-school artists are one click away from actually getting paid. And public domain music seems deeply buried in the archive.org ghetto. So choose carefully, grasshopper.

License choice is part of modern web marketing. But it's a short-term bump and nobody knows the long-term effects. Also: if the most interesting part of your art is the license, you're doing it wrong.

<comment><AUTHOR> Good points. I should addresses some of these concern in the future.

However, people tend to attribute you anyway, 99% of the time, in my experience. I got one guy who published a book on amazon and he attributed my work anyway, even though it was copyrighted to the max. One guy just attributed the author, but not the zine. I didn't find anybody who doesn't attribute my content in some way, at least not yet.

The other reasons why I make my stuff public domain is that I want to maximize the usefulness of my work as well ethical reasons. However, these are not explored in the article. Maybe I shouldn't have neglect those dimensions, but I am not quite sure yet.

<comment><USER2> Indeed. Those who are going to attribute you will attribute you anyway, without needing a gun held to their head about it. Those who won't, won't.

Many of these concerns are addressed in Peter Saint-Andre's essay "Who's Afraid of the Public Domain?":

<http://stpeter.im/writings/essays/publicdomain.html>

</comment></comment></comment><comment><USER10> I've always contemplated doing this, but as I understand it, public domain isn't recognized internationally, and therefore anything you release to the public domain can later be copyrighted by someone else in those non- recognizing regions. Can anyone who is more well-informed weigh in on this?

<comment><USER11> Public domain is ambiguous in some countries: [http://stackoverflow.com/questions/219742/open-source-why- no...](http://stackoverflow.com/questions/219742/open-source-why-not-release- into-public-domain)

There are ways to work around this such as what SQLite does (public domain + explicit license to anyone who asks): <http://www.sqlite.org/copyright.html>

and CC0: <http://creativecommons.org/choose/zero/>

<comment><USER4> The CC0 is currently under an license-review discussion at the OSI. The CC0 explicitly excludes patent rights from the permission and therefore may not be a great choice for a free software license.

</comment></comment></comment><comment><USER5> _However, to gain a reputation so that one would be able to earn a living is the conundrum that every entertainment entrepreneur must face.

One person who solved this conundrum is the author behind The Alchemist, Paulo Coelho. _

I don't get it. Paulo Coelho was already well known in '99. Two of his books were already bestsellers in Brazil and "in 1993, HarperCollins published 50,000 copies of the book, which was the largest ever initial print run of a Brazilian book in the United States."

Like Jason Rohrer, he gained his reputation before starting to distribute his novels for free.

<comment><AUTHOR> Jason Rohrer gains his reputation through previous works, just like the author behind The Alchemist.

</comment></comment><comment><USER12> Why not just use the shorter, largely-equivalent and already used ISC license rather than creating yet another one?

<http://en.wikipedia.org/wiki/ISC_license>

<comment><AUTHOR> Two reasons: the ISC license isn't public domain and I didn't create the Unlicense.</comment></comment>


We Programmers - <AUTHOR> http://blog.cleancoder.com/uncle-bob/2018/03/29/WeProgrammers.html <comment><USER2> This is a very new-left way of looking at the issue. This is sensationalist, irresponsible, and actively luddite.

Engineering, in case the author has forgotten, has built the cars that are the leading cause of accidental death. Engineering has budgets that have to factor in a cost of human lives. The Hoover Dam was built on a foundation slick with the blood of workmen, slain like a modern Remus.

Programmers, almost without exception, have reduced that cost in lives. I in no way feel remorse for Elaine Herzberg's death, because those cars have, by the statistics, already saved far more nameless others, who will never be a headline, or a sob story aimed to impede progress.

Would you ask a doctor to mourn and beat his breast and tear his hair at every patient he lost, over every slip in judgement, or slip of the scalpal? No! It would destroy him, and weaken his judgement for the hundreds of patients he may yet save.

To the author, yes, let's grow up and look at the human cost of code. You have a long way to go. As a child, you are fixated on a single sad story. When you realize that the safety and freedom of millions will _always_ cost a life, and that you don't get to pick who lives and who dies, then you may write again about the moral weight of the code we write, and earn my attention.</comment>


Internet generation at risk of rickets (chronic lack of Vit D) - <AUTHOR> http://www.breitbart.com/article.php?id=CNG.eb12878e97afd5d10486b229643303fd.01&show_article=1

<comment><USER2> I can't believe this has been spun as just the "Internet generation". Vitamin D deficiency affects almost everyone, not just "kids on that damn Internet!" Most of us work inside, spend our leisure time inside, wear sunscreen when outside, etc.

</comment><comment><USER3> Yes, I've recently become a vitamin D convert and have learned quite a bit about it through William Davis' Heart Scan Blog: <http://heartscanblog.blogspot.com/>

It turns out that as you age, your ability to absorb vitamin D through sunlight decreases, so past 40, you probably need supplementation.

I simultaneously did two things starting Jan 1: I stopped eating wheat and started taking vitamin D. Although I can't pinpoint which of these is the determining factor, I can report that I have much more energy (no post lunch drag, nor desire to nap after work) as a result. I also seem to sleep better. Check out:

[http://heartscanblog.blogspot.com/2010/01/getting- vitamin-d-...](http://heartscanblog.blogspot.com/2010/01/getting-vitamin-d- right.html)

<http://www.thevitamindcure.com/blog/>

</comment><comment><USER4> I take 4,000-6,000 UI of Vitamin D3 daily in gelcap/softgel format (Vit D is fat soluble, the dry tablets aren't absorbed nearly as well, which has been confirmed by blood tests).

It costs almost nothing. A bottle of 360 softgels each containing 2,000 UI costs about $25 (Carlson Laboratories brand).

Just make sure you also take enough vitamin A.

<comment><USER5> you'll get both if you take the cod liver oil that this article mentions.

<comment><USER4> I've never seen cod liver oil being recommended over purified D3 in gelcap format. I'll do a bit more research just to make sure, though.

</comment></comment></comment><comment><USER6> _"Some consumers and doctors are becoming convinced vitamin D can help reduce the risk of a long list of diseases, despite a lack of gold-standard research proving it."_

<http://www.cbc.ca/health/story/2010/01/04/vitamin-d.html>

</comment><comment><USER7> Recent, similar article with discussion: <http://news.ycombinator.com/item?id=1042545>.</comment>


Tell HN: The Economist is still blocking Lynx, 2 months after contacting support - <AUTHOR> I've been a subscriber to The Economist for many years. I usually read it on the app, although it's nice to have the paper edition too. Both feel quite clean.
Almost 2 months ago, I read of someone complaining about lynx being blocked: https://news.ycombinator.com/item?id=11379473
I checked, and found the same. So I logged a support request. I was a given a case reference (EDGQ999577X), but AFAIK nothing has been done to resolve the issue.
I've followed up by email 4 times since filing the original request on 30th March. Each time, I've received either:
A) No response, OR
B) A generic response like 'We can confirm that we have passed this on to the relevant team for further investigation. We will contact you as soon as this information has been received.'
In my last email I asked for contact details for their complaints department, but that also went unanswered.
If you work for The Economist in some relevant capacity it would be great if you could chime in here. <comment><USER2> I use lynx too but I've come to expect a lot of sites just won't work with it anymore. Its annoying. Might be wortwhile to see if lynx will support some variety of textual rendering of JS...

<comment><AUTHOR> In this case lack of JS is not the cause. The Economist is serving an error after seeing the user agent string. Spoofing the user agent string would be enough.</comment></comment>


In gaming, everything is amazing, but no one is happy - <AUTHOR> http://arstechnica.com/gaming/news/2011/09/gaming-everything-is-amazing-and-no-one-is-happy.ars <comment><USER2> I want more attention paid to realistic games. The early Ghost Recons were going in that direction, but the later ones turned around and went for arcade mode, letting you get shot many times, aim effortlessly etc. Seems they're trying to catch up to Battlefield, when they could carve out their own niche.

In the Total War series, they barely improved gameplay since Rome, focusing instead on superflous graphics.

It's called gaming, not rendering but the focus is on showing pretty screenshots to sell more games.

And yes our first world problems are important and we shouldn't apologize for them. We won't be solving any other problems.

</comment><comment><USER3> Aside from DRM restrictions that stop me from buying a couple games out of principle, I think gaming is better then ever and people are happy about it. Gaming is more popular then ever before and digital distribution makes it a snap for people with an internet connection to try out something new. Not sure why he thinks people are complaining. Deus Ex:HR, Skyrim, and Saints Row 3 this year alone. I'm in heaven.</comment>


New headphone awareness device SoundBrake 2.0 - <AUTHOR> https://www.indiegogo.com/projects/soundbrake-2-0-awareness-device-for-headphones-music-audio <comment><USER2> This is going to work splendidly for anyone who uses public transit.

I wear headphones so I don't have to hear train screeches...</comment>


Show HN: My Word Cloud (Valentine Edition).  Words + Heart = Art - <AUTHOR>

Happy Valentine!  I know it's a bit late but I just put together an app for Valentine's Day that takes a collection of words of your choice, and turn them into a neat word cloud in the shape of a heart.
http://www.mywordcloud.com
Some of you may find this familiar.  Yes it is based on Tagxedo (http://www.tagxedo.com).  Besides from bringing Tagxedo to feature complete, I took it one step further and make a server-side version available as well.  So this app -- My Word Cloud -- works on IE/Firefox/Chrome/Safari/Opera, as well as smart phones and tablets.  Not sure if it works on WP7.
Anyway, check it out, and let me know how you like it.  If you don't mind, please help spread the love if you like it!  You may even have some forgetful friends who would find this the most timely and unique gift for today :) <comment><AUTHOR> Clickable link: <http://www.mywordcloud.com>

An example E-card: <http://www.mywordcloud.com/cards/18694af4eaaf4748></comment>


Ask HN: can we fix the tiny HN font size? - <AUTHOR> With Chrome on Android, reading HN is really hard for us with failing eyesight. The fonts are tiny and the only solution is to either scale the text size up massively, which breaks all other websites, or continually pinch to zoom, which means lots of left to right scrolling to read a full comment.
How hard would it be to offer a font size option in the user preferences?
I understand that most HN readers are young and have excellent eyesight, yet this is a real accessibility problem.
Afaics it's been like this for years. HN, pretty please, it is dicriminatory. Can we fix this now? <comment><USER2> Quite, it's horrible. I've emailed HN about this in the past, heard from dang. The recent comment collapse feature is a plus.

Ironically for this post, the "Ask HN" font colors are even worse than most.

</comment><comment><USER3> I have been bumping up the zoom level recently as I'm finding it hard to read. Also, the grey text on the (yellow?) background is somewhat hard to scan at times.

</comment><comment><USER4> My advice: contact the moderators using the link at the bottom of this page.

<comment><AUTHOR> That's an excellent suggestion. I've done it. Thank you! :)

</comment></comment><comment><USER5> I mostly read the site on a tablet and the font sizes are microscopic, especially in the comments.</comment>


Ancient Greek manuscripts reveal life lessons from the Roman empire - <AUTHOR> http://www.theguardian.com/books/2016/feb/10/ancient-greek-manuscripts-reveal-life-lessons-from-the-roman-empire <comment><USER2> I hope in the future we're not judged by the contents of our current foreign language books.

<comment><AUTHOR> There are worse things for our civilization to be judged by.

Sitcoms. Reality shows.

Really you could not blame aliens for destroying us.</comment></comment>


Find the right analytics service for your project - <AUTHOR> http://AnalyticsMatcher.com

<comment><USER2> This definitely will give you some interesting leads, but a spell check ahead of posting here might gain more positive support. "Our Questionairre. We analyze your answers to a series of specially crafed questions designed to understand your business objectives" .. the words Questionnaire and crafted have typos.</comment>


The Divide Between Silicon Valley and Washington Is a National-Security Threat - <AUTHOR> https://www.theatlantic.com/ideas/archive/2018/12/growing-gulf-between-silicon-valley-and-washington/577963/ <comment><USER2> If you treat the whole country as a battleground and the people as the enemy, don't then ask those same people to pretend you aren't hostile

The moral high ground was lost once mass surveillance with no judicial oversight started. It's not Silicon Valley's problem that the current establishment has a bad reputation and can't poach engineers

<comment><USER3> You alredy said it better than I can, but anecdotally, when I stopped counting 5+ years ago, my license plate / id was being logged by the government at least three times each way to and from work. Since then, my friends and I have been victims of numerous property crimes that could be solved with a database query or two over those logs, but they're not available to the people that investigate crimes, apparently.

On the other hand, I can name all sorts of ways technology is used to shake people down for committing victimless crimes...

</comment></comment><comment><USER4> Living in a country with no such divide (Israel), articles like this one are alarming. Civil and military bonds run deep here, with a draft military producing graduates who end up in the tech sector and go back to reserve duty on occasion until they're in their 40's. As a result, lots of technologies that might seem incredibly new to the American military have been long since evaluated, tested, and implemented in the Israeli military, because of the cross-pollination that happens here.

Americans need to get their shit together.

<comment><USER5> America hasn't fought a defensive war in awhile, the last few wars were about projecting power. A less charitable way of putting it would be: ever since Vietnam the US war machine seems to be concerned principally with bombing poor people in other countries, why should we support this?

Also unlike Israel the US is in a pretty good location defense-wise, surrounded by allies and two oceans, and with the worlds largest nuclear arsenal. I think we're good..

</comment></comment><comment><USER6> In the UK, when I started out, I remember once seeing an advert for a GCHQ job.

The salary was a tad more than half the starting salary in the private sector, working for an ethically neutral company.

(It'd probably be 25-33% or less of the salary of a Google or Facebook).

I imagine the case is similar in the US and that it's just like finance vs. the regulators.

Except in technology it's way worse because of the trust issues. Working for a financial regulatory body isn't evil, just boring.

</comment><comment><USER7> Say I'm working at NSA and somebody puts a code on my desk, something no one else can break. Maybe I take a shot at it, maybe I break it. And I'm real happy with myself, 'cause I did my job well. But maybe that code was the location of some rebel army in North Africa or the Middle East. Once they have that location, they bomb the village where the rebels are hiding. Fifteen hundred people that I never met, never had no problem with, get killed.

Now the politicians are sayin', "Oh, send in the Marines to secure the area" 'cause they don't give a shit. It won't be their kid over there, gettin' shot. Just like it wasn't them when their number got called, 'cause they were all pullin' a tour in the National Guard.

[https://www.youtube.com/watch?v=mJHvSp9AKYg](https://www.youtube.com/watch?v=mJHvSp9AKYg)

the divide between silicon valley and washington is that not everyone views the world in adversarial us-versus-them terms. washington needs more bridge building than bomb dropping, physical and cyber.

</comment><comment><USER8> People are talking a lot about how good machine learning engineers don't want to work for the defense industry. But I think the bigger problem is that defense work is really high pressure. If you're working on a radar system to detect an incoming missile and deploy countermeasures if your system doesn't work the pilot dies. So relying on a definable program is more comforting than some kind of unproven machine learning model. So even though the military has pioneered other technologies, they were pretty reluctant to try out anything close to machine learning on something that could potentially kill american soldiers. It was short sighted because machine learning does classification really well, and now nobody in the defense contracting space really knows how to do this now. And the government is forced to get help from companies that can do machine learning like google.

</comment><comment><USER9> I think this divide is a great thing. You don't want the state having access to and controlling your social networking -- as is the case with Tencent WeChat / China.

</comment><comment><USER10> > Telling them what Kevin tells potential recruits: If you do cyber operations > for anyone else, you'll get arrested. If you do them for me in the Air > Force, you'll get a medal.

"Join the military-industrial complex and violate laws with impunity!"

Sounds like a winning sales pitch to me.

<comment><USER11> This is just the cyber equivalent of "Shoot someone and you'll go to jail, join the military and shoot someone, get a medal".

</comment></comment><comment><USER12> If Washington cut military spending, stop waging wars around the world, and pour the money into education, infrastructure, and things that improve citizens' everyday life, SV will definitely be on board.

</comment><comment><USER13> Offer more money in defense jobs. Talent will show up.

<comment><USER14> It's not just about the money.

I've worked for product companies and was forced to interact with government clients.

Bureaucracy, bureaucracy, bureaucracy. No risk taking, no point in standing out, promotions based on time in service. You could offer me quadruple my salary to go and work for the government and I still wouldn't take the job.

Just supporting the government clients on a part time basis made me want to quit my job just to get away from the government clients.</comment></comment>