Acting French - <AUTHOR> http://www.theatlantic.com/features/archive/2014/08/acting-french/375743/

<comment><USER2> The author, Ta-Nehisi ("Tah-Nuh-Hah-See") Coates, has been just killing it at the Atlantic for the last couple of years.

He has an amazing approach. It's simultaneously cerebral and heart-felt, and very grounded in his identity as a black man who grew up in an intellectual home in a black neighborhood in Baltimore during the crack era.

Coates never excelled in formal schooling, but he has really driven hard in his blog writings to deeply understand some topics, in particular how they relate to slavery. No matter how much you think you know about the black experience, slavery, and the Civil War, I guarantee you that you'll have a lot of aha moments reading his work.

For example, I did not know about the value of slaves on the eve of the Civil War -- the slaves were worth more than all the manufacturing base in the country. Thinking about that makes the stakes for the South in the Civil War so evident.

</comment><comment><USER3> It is a beautifully written and interesting article.</comment>


How to Make Money with Open Source - <AUTHOR> https://www.howtocodejs.com/3-ways-to-make-money-with-open-source/ <comment><USER2> Article should probably include "open core", which is a bit different from dual licensing.</comment>


Google to Fix Location Data Leak in Google Home, Chromecast - <AUTHOR> https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/ <comment><AUTHOR> "When Young first reached out to Google in May about his findings, the company replied by closing his bug report with a "Status: Won't Fix (Intended Behavior)" message. But after being contacted by KrebsOnSecurity, Google changed its tune, saying it planned to ship an update to address the privacy leak in both devices. Currently, that update is slated to be released in mid- July 2018."</comment>


Individualism, Self-Selection, Cultural Change During the Age of Mass Migration [pdf] - <AUTHOR> https://annesofiebeckknudsen.com/wp-content/uploads/2019/01/thosewhostayed.pdf <comment><USER3> Great paper. Some good discussion from the author (and other interesting research links) here:

[https://twitter.com/ASBeckKnudsen](https://twitter.com/ASBeckKnudsen)

<comment><USER4> I didn't read the entire paper. But since is it does seem to be based on naming, did it also address the changing naming conventions of the time? Because early 20th century is also when people stopped taking their fathers name as a family name.

</comment></comment><comment><USER5> Regarding migrations, one clarification.

American society so far has demonstrated a tendency to alternate between mass migrations coming in from abroad, and mass _internal_ migrations.

The last great internal migration was the 1940's to 1970's as cars and highways became widespread.

The period of mass migration from abroad coming in happens in the mid 70's with significant events being Vietnamese refugees in 1975 and Iranian refugees in 1979. The end of the Cold War meant the stopping of US support to many anti-communist dictators which also increased these numbers. I believe though it was a change in the immigration law in 1965 that made this possible, which reversed the quotas put in place in the mid 1920's and established family unification as a priority.

With that all being said though, it seems that mass migration from abroad has become more controlversial in the US, and perhaps we are entering the next great age of internal migrations.

<comment><USER6> Actually, American geographical mobility has declined significantly in the last twenty years with little end in sight. Obviously there are multiple factors but the significant difficulty of renting and finding a job in most place has to be one significant part.

This article talks about the consequences but that there has been a decline is a given.

[https://equitablegrowth.org/the-consequences-and-causes- of-d...](https://equitablegrowth.org/the-consequences-and-causes-of-declining- geographic-mobility-in-the-united-states/)

<comment><USER5> I think we're in agreement on our points?

Periods of mass external migration into the US also depress wages and make jobs tougher to compete for, which also hinders moving.

The next phase of internal migration has begun / will begin soon but won't be significant or peak for another 30 years.

<comment><USER7> > Periods of mass external migration into the US also depress wages

Empirically, this is not the case, at least in the long term[1]:

> Empirical research in recent decades suggests that [...] when measured over > a period of more than 10 years, the impact of immigration on the wages of > natives overall is very small.

(This is from a 2017 overview. The next few pages starting after the linked passage summarize the currently known evidence, if you're interested.)

[1] [https://www.nap.edu/read/23550/chapter/9#267](https://www.nap.edu/read/23550/chapter/9#267)

<comment><USER8> George Borjas has pointed out that:

Wage trends over the past half-century suggest that a 10 percent increase in the number of workers with a particular set of skills probably lowers the wage of that group by at least 3 percent.

Even after the economy has fully adjusted, those skill groups that received the most immigrants will still offer lower pay relative to those that received fewer immigrants.

[https://www.politico.com/magazine/story/2016/09/trump- clinto...](https://www.politico.com/magazine/story/2016/09/trump-clinton- immigration-economy-unemployment-jobs-214216)

<comment><USER9> Don't forget that some industries can't exist if there aren't enough workers. Density of human capital is sometimes a prerequisite to a sustainable business.

For example, silicon valley would be much smaller and the net value of companies much lower if not for the global inflow of talent. Even if the average wage was reduced (and I doubt it, I think it's only likely for commodity labour, scale enables specialization which pays more) the total wage is much higher. You also need to look at the displacement effect - <USER2> happened to jobs with other sets of skills that now have fewer workers.

<comment><USER10> Would that necessarily be true? There would be a Google equivalent and a Facebook equivalent.</comment></comment></comment></comment></comment></comment></comment>


Norvig vs. Chomsky and the Fight for the Future of AI - <AUTHOR> http://www.tor.com/blogs/2011/06/norvig-vs-chomsky-and-the-fight-for-the-future-of-ai

<comment><USER2> There's actually room here to mention Michel Foucault as a hidden partner in the discussion in two ways:

* The political debates between Foucault and Chomsky in the seventies: Chomsky wholeheartedly believes in the application of justice to injust actions, Foucault was interested in _how an act becomes just or unjust_.

* The revolution in historical method effected by Foucault lies eliding the descriptive apparatus with which we usually explain the transmission and transformation of ideas (author, book, oeuvre, influence, tradition, consciousness); or, imagine if we did history as if consciousness and its attendant concepts were disqualified as descriptors.

The key to comprehending Foucault here is to suspend the following ideas:

* There exist a particular set of universals regulating historical description of a domain of knowledge

* "Consciousness", whatever that is, is a constitutive principle for that historical description

* The particular set of universals and consciousness exist inextricably, the latter buttressing the concepts of the former

Basically you can sketch a considerable amount of human history without reference to any human subject. You can accomplish a lot just by looking at _what was said_. What's more, you'll discover a completely set of rules and regularities when you do.

So I have a speculative interest in what discoveries for linguistics might be discovered with Google's method.

</comment><comment><USER3> I feel like Chomsky's argument is being mischaracterized a little here. I don't think Chomsky is necessarily looking for 'simple' rules, but he wants models that explain. Norvig is looking at statistical models that can predict what is going to happen, but don't explain why.

I think Chomsky is bringing up a good point here, but he is also being a little hard on people analyzing the data. We are gathering more data now than ever before, it's impossible to carefully analyze every piece of it to understand exactly why things happen how they do.

We can use data and statistical models to predict stuff, so they are useful for the short term. I think in the long term, analyzing this data will give leads at where to look for understanding.

</comment><comment><USER4> Great article. This is a question that's come up before in Mathematics, for example the Four-Color theorem. "Can a proof that's not comprehensible by humans really be called a proof?"

Personally I'm with Norvig. While finding simple patterns is extremely nice and useful, there's no inherent reason why the Universe should follow an easily described set of rules. If it's the difference between an elegant but useless theorem or a useful but incomprehensible pattern, I'll pick the latter every time.

</comment><comment><USER5> "Why learn anything when you can look it up?"

I'm certainly no linguist but isn't this confusing learning with remembering facts and details?</comment>


Ask HN: Best source for discovery of new startups? - <AUTHOR> What is the best source to discover new startups?
Techcrunch, etc only feature prominent ones.
Crunchbase is more broad.
Any other suggestions? <comment><USER2> <http://killerstartups.com> <http://makeuseof.com> <http://go2web20.net> <http://feedmyapp.com/>

<comment><USER3> I write for ReadWriteWeb, but I gotta say: KillerStartups is really good. TheNextWeb also finds a lot of things before anyone else I know does.

<comment><USER4> I'm sorry but Killerstartups is really lacking. Try searching for Dropbox for example. Nothing there. It's also hard to not click on an ad. I'm all for making money given that they are free but it's very spammy.

Also, what's up with their grainy images? Me thinks they should have set the jpg quality to at least 80 and not 10. Maybe they can't justify the extra half a cent/month?

Summing up here: I think Killerstartups is a horrible site with a great name.

On a more positive note: feedmyapp.com looks promising. As I said before I do wish HN would separate out review/rate my startup posts. Most web startups worth talking about are talked about here.

</comment></comment></comment><comment><USER5> I like:

The Museum of Modern Betas <http://momb.socio-kybernetics.net/>

and

eHub <http://emilychang.com/ehub/>

</comment><comment><USER6> <http://younoodle.com> is pretty good.

</comment><comment><USER7> Quora's been great for finding about under-the-radar startups because of the strong community of entrepreneurs and VCs

<http://quora.com> (invite-only right now)

</comment><comment><USER8> <http://springwise.com> is another website I use to discover new and interesting ideas. Reality is you need to keep your ear to the ground in a few places.

</comment><comment><USER4> Google this:

site:news.ycombinator.com "rate my" or site:news.ycombinator.com "review my"

I wish there was a better way. Might be nice to have an entirely separate category for new startup posts on HN...

</comment><comment><USER9> I found this one lately. Reminds me of TC in its early days. <http://pjentrepreneur.com/>.

</comment><comment><USER10> Venture Pimp has some unique startup reviews: <http://venturepimp.com/>

</comment><comment><USER11> ReadWriteWeb, within the web app/social media scene. Scoble is a good source too, through his video interviews.

</comment><comment><USER12> <http://appuseful.com>

</comment><comment><AUTHOR> Thank you for all the suggestions.

</comment><comment><USER13> The product my company is building. No, you can't use it, but you can come work for us.</comment>


Creating a Simple Bloom Filter - <AUTHOR> http://maxburstein.com/blog/creating-a-simple-bloom-filter/

<comment><USER2> Or how chrome checks for malicious URLs</comment>


Priest Demands Owner of Wi-Fi Called "Lucyfer" to Rename Network - <AUTHOR> https://news.softpedia.com/news/priest-demands-owner-of-wi-fi-called-lucyfer-to-rename-network-528721.shtml <comment><USER2> Lots of priests down here, says Lucyfer.......join the net...</comment>


Ask HN: Who is hiring Product Managers? - <AUTHOR>

My technical friend wants to get into product management. What companies would be interested in hiring a green PM with a technical background? <comment><USER2> It's hard to make a lateral career move in a weak jobs environment. It seems to me he might be better off finding a job that needs his technical background, but also has a PM component where he can develop those skills and maybe grow into doing it full-time. Being a developer does not necessarily prepare you for being PM any more than the reverse is true; they are separate and unique roles.

</comment><comment><USER3> This brings up an interesting parallel to my situation - I'm kind of in the same boat, but I've also founded two different products myself (with lots of press attention) and have years worth of experience managing remote teams of designers, developers, writers etc for various projects.

Problem is I've been self-employed my entire ten years in the biz so don't have a "Product Manager" title on my resume that isn't self-applied.

I've been applying for PM jobs with lukewarm response. Its very frustrating since I'm at a point where I feel like its the thing I'd be best qualified to handle considering how much experience I have with pretty much every aspect of the role except for the titled position itself.

Curious if anyone has any incite into this - going from botched Founder to fulltime PM...

<comment><USER4> IMO you may be better off framing your previous experience as product management consultation, or just give yourself a product management title at the names of your products/companies, and include revenue/sales figures. In my experience, the "founder" sorts of titles can be a turn off to employers as it might indicate you have high expectations of control or other things that could hinder your organizational conformance if hired.

I once worked with a newly-hired PM who had recently seen a handsome exit from a company he cofounded. By any measure on paper, a very credible and qualified candidate. The development process instituted in our enterprise was a little too rigid for his hardened startup mentality and 2 weeks later, he was let go. Beyond amending your resume with a higher focus on product management, it's important that companies see you as a good fit from process and cultural standpoints.

<comment><USER3> Thanks this is really valuable information. I've actually been concerned about this culture issue as well.

One of the reasons I'm seeking out this role is due to startup collapse based on poor revenue. Would this failure be a major point of contention or are companies willing to look at this as a learning experience?

<comment><USER5> In the vast majority of places, product managers aren't responsible for revenue. I don't think this counts against you at all - it wouldn't if I was the hiring manager.

</comment></comment></comment></comment><comment><USER5> The sweet spot is probably larger startups, with an already-established, multiple-person product management team. Small startups with limited product staff are unlikely to take a risk on someone with no experience. Public companies, on the other hand, are often too bureaucratic to hire someone without 'credentials'.

Your friend will likely have to settle for a junior role at first - I'd search for 'associate product manager' or 'assistant product manager' roles. But a product manager with a technical background is a truly a blessing, and he should be able to get promoted within the company or move to a more responsible role at another company after a year or so of experience.

<comment><USER6> I'm biased, but I think you're right.

If you're in the Boston/Cambridge area, HubSpot (<http://www.HubSpot.com>) is looking for a product person.

We're particularly partial to entrepreneurial folks that have a technical bent.

</comment></comment><comment> bjelkeman-again I wish I had the budget to hire a product manager right now. I need one. :)</comment>


What SteamMachine will you be building? - <AUTHOR>

I'm thinking of building my own SteamMachine http://store.steampowered.com/steamos/buildyourown for Christmas. Are you planning on building one and which parts will you be using? <comment><USER2> I don't want to built a SteamMachine, I want to buy one.

Now, hear me out. I got into computing in the late 80s. The first computer in our house was a serious one, an IBM PC clone in 1985. It had a short stay, but in 1988 we got an AT&T 6300 8086 and a 2400 baud (lightning fast) modem. In middle school I was coding databases in Turbo Pascal, by 1996 I was making websites (one of which is still up), palmtop apps in the early 2000s, running Linux, etc. I've built many computers, done some electronics projects, etc.

Now I'm in my mid 30s and the last thing in the world I want to do is spec out and put together a gaming PC. When consoles finally got Good Enough, I was overjoyed - I didn't have to deal with the all the crap inherent to PC gaming anymore. Memory problems, graphics card issues, driver issues, poorly designed input, etc. I moved from PCs to consoles because when I play games, I want to pop in a storage device and I want it to work flawlessly every time. I don't want to source parts, spec them out, find deals, etc. I just want it to work.

My current work computer is a year and a half old, the one that it replaced was purchased in 2008. That's how I like it. It might not be the latest and greatest, but the value of not having to care about it not being the new hotness is, to me, quite tangible.</comment>


Content, Forever - <AUTHOR> http://tinysubversions.com/contentForever/ <comment><USER2> _Why 2014 Was the Year of Sony Hacks

Something went wrong. Try another search term?_

Simple and to the point, then moving onwards to the next query. This engine is next level.

</comment><comment><USER3> [http://i.puthtml.com/content_forever/phpQnrhxq](http://i.puthtml.com/content_forever/phpQnrhxq)

From Smash Mouth to cryptography and signet rings.

From what I can tell: "Fush Yu Mang" was an album, albums were once made as LPs, which were developed by Western Electric, which was an appendage of AT&T back during the Ma Bell ("We don't care. We dont have to. We're The Phone Company.") days, which had a statue called The Spirit of Communication at its 195 Broadway location, which jumps directly to AUTODIN for some reason (195 Broadway was owned by Western Union... ?), which leads to leased lines, which leads to OSI, PKI, csexps, digital signatures, and signet rings.

The End.

It's like when I take too much caffeine.

</comment><comment><USER4> I would suggest having much more continuity in the content. I think there would be much more value in a probabilistic content retrieval mechanism that doesn't combine pieces of content but understands how interesting and relevant the content is and how long it would take to consume. It really isn't far off from what you have, just a lot more simple and would be much more pleasant to read.

</comment><comment><USER5> Seems like an engine used to make a content bot site where they hang lots of ads and try to get google and others to send users there via search.

</comment><comment><USER6> Another interesting project by the same author is Startup Idea Generator: [http://tinysubversions.com/startups/](http://tinysubversions.com/startups/)

</comment><comment><USER7> >> What Can We Learn From windows? >>> After a lengthy development process, Windows Vista was released on November 30, 2006 for volume licensing and January 30, 2007 for consumers.

...

>>> Many types of aquatic animals commonly referred to as "fish" are not fish in the sense given above; examples include shellfish, cuttlefish, starfish, crayfish and jellyfish. >>The End

</comment><comment><USER8> It's nice. Good idea being JS based so we don't load the server, but one tweak it could use is not to download every picture on every wikipedia article it goes too. The wikimedia server / our bandwith is being flooded with traffic that goes to waste since it only displays a few of them but downloads every single one.

<comment><USER9> Okay, I fixed it, it only loads images that it plans to render. Thanks again, that was a little embarrassing for me!

</comment></comment><comment><USER10> _What Can We Learn From butter?

It generally has a pale yellow color, but varies from deep yellow to nearly white._

...

 _In telecommunication and radio communication, spread-spectrum techniques are methods by which a signal (e.g._

</comment><comment><USER11> Many of the steps seem reasonable, but I couldn't follow some of the associations:

E.G.

"The first large proton synchrotron was the Cosmotron at Brookhaven National Laboratory, which accelerated protons to about 3 GeV (1953–1968)."

directly to:

"The stated purpose of the one-party state was to ensure that capitalist exploitation would not return to the Soviet Union and that the principles of Democratic Centralism would be most effective in representing the people's will in a practical manner."

Very entertaining.

<comment><USER12> Probably chronological - the quote comes from the Soviet Union page section on Stalin, who died in 1953. [http://en.wikipedia.org/wiki/Soviet_Union#Stalin_era](http://en.wikipedia.org/wiki/Soviet_Union#Stalin_era)

</comment></comment><comment><USER13> This isn't working for me. Whenever i click "Submit" the console logs a JS error that $ is not defined in $("share") ... missing jquery? (or maybe it's because the google domains are blocked at my current location and you must be getting your JQuery from there)

EDIT: yes, on closer inspection i am getting a 502 on the GET jquery.min.js from ajax.googleapis.com

</comment><comment><USER14> Does it have a character limit from whatever text source and then search the last phrase in the source text and repeat ad infinitum?

</comment><comment><USER15> I thought I would learn something but I didn't take the full 1 minute to read the results on "beer".

<comment><USER16> Here they are for you:

Samuel Adams is the brand name for beers produced by the Boston Beer Company (NYSE: SAM) and its associated contract brewers.

Battle rapping, which can be freestyled, is the competition between two or more rappers in front of an audience.

In the 1980s, battle raps were a popular form of rapping - Big Daddy Kane in the book How to Rap says, "as an MC from the '80s, really your mentality is battle format...

He is most famous for creating the acclaimed film Sweet Sweetback's Baadasssss Song, which heralded a new era of African-American focused films.

The gains made by African Americans in the Civil Rights and Black Power movements not only obtained certain rights for African Americans, but changed American society in far-reaching and fundamentally important ways.

</comment></comment><comment><USER17> [http://i.puthtml.com/content_forever/phpjmHA51](http://i.puthtml.com/content_forever/phpjmHA51)

... what?

<comment><USER18> I recognize that headline. If I'm not mistaken, it's from the Evening Standard in London last night (18/12/14). No idea why that's stuck in my memory!

</comment></comment><comment><USER19> Some cadavre exquis?

</comment><comment><USER20> Tangent generator

</comment><comment><USER21> w.o.w.

Absolutely amazing and chilling at the same time. I typed in "sex" and had 1 minute of free time. It seemed coherent but the subject matter seemed to drift far away. Some tweaking and it would be very convincing.

<comment><USER22> Lucky you. I typed in "sardine" and got back a load of stuff about Trichomonas "a sexually transmitted infection of the urogenital tract". Which, thanks to the bot, I now know is a common cause of vaginitis in women. Great... o_O

[http://www.puthtml.com/content_forever/phpgiA2yA.html](http://www.puthtml.com/content_forever/phpgiA2yA.html)

<comment><USER21> you learn something new everyday haha

</comment></comment></comment><comment><USER23> Try this. The results are laugh out loud funny. In a good way.</comment>


Iran Declares War on 21st Century Media - <AUTHOR> http://www.fastcompany.com/blog/kit-eaton/technomix/iran-declares-war-21st-century-media <comment><USER2> Tough to be a dictator in these days, you'd almost pity them.

An 8G micro sd card could eaily contain enough information to bring down a government (or two) and can be smuggled out in in lots of ways. Don't underestimate the sneakernet. The internet is great but as long as access is more or less centralized it can be shut down or monitored.

Private individuals carrying data are far harder to detect and / or shut down.</comment>


Google announces realtime search, voice searching and more - <AUTHOR> http://googleblog.blogspot.com/2009/12/relevance-meets-real-time-web.html

<comment><USER2> If you add &esrch=RTSearch to your the URL after you've done a google search, you get the feature. You also need to selelect "Latest" from the "Show Options" menu.

Example: [http://www.google.ca/search?q=copenhagen&hl=en&sa=G&...](http://www.google.ca/search?q=copenhagen&hl=en&sa=G&esrch=RTSearch&tbo=1&output=search&tbs=rltm:1)

</comment><comment><USER3> Is this not working for anyone else? The blog post made it seem like it should be live now.

<comment><USER4> It's not working for me. I'm guessing it's much like new features for webapps, only rolled out to a select number at first and gradually expanded.

</comment></comment><comment><USER5> Neat in concept, but this still looks like it was hastily deployed. I see more twitter traffic than anything else, and that's only really great when it concerns google's products.

</comment><comment><USER6> Here's hoping Scoopler can rise to the challenge of staying one step ahead of this...</comment>


2010: The year of the products + a new way of working - <AUTHOR> http://37signals.com/svn/posts/2099-2010-the-year-of-the-products-a-new-way-of-working

<comment><USER2> I hate to break this to all of you, but all thats happening here is the natural evolutionary process of a small company growing in size. I think 37Signals has shared a lot of concepts/opinions in the past that are relatively novel and great, but it is inevitable that as they grow in size, they're going to become what they preached against -- unless ofcourse they stop hiring.

For every person you bring on, you're going to feel compelled to 'do more' because surely you don't want an employee sitting idle (even if you only do work for 37 hours in a week). And as you try to ensure no one sits idle, you start to introduces ideas about timelines, deadlines, iterations -- all of which have organically grown in software companies first, and then became institutionalized.

<comment><USER3> Perhaps, but I hope not.

One big difference is that they _are_ advocates of "a new way of working." Also, they are being open about it and discussing and sharing their ideas with the world.

If it fails, so be it. If it succeeds (or more likely, some variation of it succeeds), then we're all the better off for it.

</comment></comment><comment><USER4> The teaming system seems interesting. But, I just finished going through their book 'Getting Real' and a lot of what they're aiming for in the blog post seems to go somewhat against the principles they outline in the book. In the book, they encourage you to be conservative with feature releases and to be moderately stiff when it comes to changing the product, yet here they're hoping to release at least one feature every two weeks, for one team. Also, this new system seems to depend too much on time constraints, deadlines, and logistics, to where I can see a lot of energy being put to making sure everything runs according to schedule, which could take away from the creative process, let alone ensuring the product is heading in the right direction. Of course, this is all speculation and I'm sure they have guidelines set in place to prevent such things from happening. It all seems interesting anyway, and I'm all for experimenting, so I wish them good luck.

<comment><USER5> They're growing. This is the part I've been waiting for. :-)

A good number of small companies work the "getting real" way, if not overtly, at least by default. As companies grow however, they start to change. One of the most significant part of this change is the formalization of aspects of business.

37Signals is the first company I've seen to adamantly adhere to small company principles, not only embracing them, but expanding them into mantras and guiding principles.

Now that they're growing it's going to be interesting to see how well they can stick to their original ideas and how much they adapt into methods that are more similar to what other companies do.

The one thing they have going for them is that they're not afraid to try new things. I suppose we'll all just have to watch from a far to see how it all turns out.

</comment></comment><comment><USER6> Can I be on the slack team? Slacking is what I do best and as they say you should always work with your strengths.

<comment><USER7> I'll join you.

<comment><USER8> Yeah, as a team we can maximize our output.

</comment></comment></comment><comment><USER9> It will be fascinating to watch how 37signals copes with its growth. If they can cultivate a corporate culture where people don't mind switching teams frequently, I'll be impressed. As soon as you get a multitude of personalities interacting, unless they are very disciplined and/or fully bought into the company vision, there will be some relationships and interactions that will be sought out and some that will be avoided. Even small teams have personality conflicts.

I expect the ideas behind this direction aren't being handed down by Jason and David from on high, but rather came from employee feedback. They're probably still small enough to test out some of these ideas without doing damage, so I'm interested to see what comes out of it and what modifications they make and what we can learn from this.

</comment><comment><USER10> I tried to do this in the late 90s with a team I lead. The plan was for an A and B team. The A team (did the theme song spring into your head?) would work on new features and the B team would do bug fixes in existing code. The teams would switch roles back and forth each month with the idea that the team that just released something would be the logical bug fixers when it went into production. The main problem with it was cross-polination -- ideally you want the teams to mix up every iteration but that breaks the follow on bug fixing period.

I think we made it 3 months before it collapsed due to conflicting outside schedule pressure I couldn't control.

</comment><comment><USER11> _"... Each team will stay together for two months (a "term"). When two months are up, the teams split up and form again with different people. ..."_

This is going to hurt. Akio Morita ~ <http://en.wikipedia.org/wiki/Akio_Morita> used this method on his design teams to build the first Camrecorder. [0] The idea behind this was to build a better product. The teams despised him for continually breaking them up.

[0] Sony, "Betamovie Beta" <http://www.thehistoryof.net/the-history-of- camcorders.html>

</comment><comment><USER12> This immediately reminds of what IBM was making noise about doing around 2000: assigning partners and small teams, changing job focus every few months, and forcing more employees to work in a shifting open space rather than offices. I never heard what became of their work environment policies but I assume this was more a PR and recruiting move than an actual shift in process.

The 37s approach sounds like a formal structure culled from bits and pieces of Scrum and the always-unfortunately-named Extreme Programming.

</comment><comment> brown9-2 For what it's worth, this new process sounds like the great parts of Scrum, just without using the name "Scrum" and all the annoying acronyms and terminology.

<comment><USER6> Or the need to pay someone to anoint you as a "Certified Scrum Master".

</comment></comment><comment><USER13> Before things went south, this is how I had always wanted to grow Publictivity in terms of software development. I found two devs + a designer working in teams to make new modules/features would be a good way to get things done. Set an overall high level vision with everyone, then let the teams build things that made sense. I kind of saw it as a 3 month long hackathon.

</comment><comment><USER14> good grief. aren't these the simple software people? if this is their process how over-designed is their code?!

<comment><USER15> Very. Rails is extremely overdesigned internally to provide concise magic to the programmer using it.

It happens to work, usually providing a steady stream of warm fuzzies.

<comment><USER16> Problem with such design is that when it does not work, it's very hard to figure out why. Douglas Adams comes to mind.</comment></comment></comment>


How to avoid being unhappy and how to find happiness. - <AUTHOR> http://markmaunder.com/2012/07/28/how-to-be-happy/

<comment><USER2> sleep enough, eat healthy, drink in moderation, have real friends that you can trust and that trust you, listen more than you talk, do some good for others, follow your intuition, listen to your body, seize the day.

<comment><USER3> Listen to some happy music! This[1] always puts me in a good mood.

[1]: <http://www.youtube.com/watch?v=CIJfdVPACyw>

<comment><AUTHOR> I see your Pete Rodriguez and I raise you a LMFAO.

<http://www.youtube.com/watch?v=KQ6zr6kCPj8>

</comment></comment></comment><comment><USER4> Ah, another article on depression by somebody with no understanding of it, telling us how to be happy.

</comment><comment><USER5> I've read that happiness has some specific conditions and that it comes into being when those conditions are fulfilled.

Snippet from an article:

> What is happiness indeed? What is the law of happiness?

> Once we live without hunger, without loneliness and with bright mind; those > kinds of minds exist, that is happiness. In order to live without hunger, > loneliness and darkness, we ourselves should make those conditions.

Complete (and free!) article there:

[http://www.members.tripod.com/tathagata2000/happiness_and_pe...](http://www.members.tripod.com/tathagata2000/happiness_and_peace.htm)

</comment><comment><USER6> I'm going to assume that a linux kernel hacker probably enjoyed the long hours in front of a monitor in solitude. But however enjoyable, in the long run, the solitude can change a man.

But a keyword in this, as with everything, is balance.</comment>


RPG.net bans posts in support of Trump - <AUTHOR> https://forum.rpg.net/showthread.php?835849-New-Ban-Do-Not-Post-In-Support-of-Trump-or-his-Administration&fbclid=IwAR23N1yA74ZRZVbPVS5ZZEszdRSWVAk66ReriZgxJAI9ojRRke2FnhGMrws <comment><USER2> Jesus this is terrible. People are quick to point out that First Ammendment doesn't apply, but Freedom of Speech isn't just that, it's the principle - _" I disapprove of what you say, but I will defend to the death your right to say it"_. Discussion is what makes peaceful progress possible, otherwise you get revolutions!

<comment><USER3> >People are quick to point out that First Ammendment doesn't apply, but Freedom of Speech isn't just that, it's the principle - "I disapprove of what you say, but I will defend to the death your right to say it".

I'm sorry, if I'm paying for hosting and you come to a page I run and start saying stuff I don't care for yeahhhh I'm removing it. That's my right. It's not a public venue, domain names are usually handled as real-property as far as taxation and hosting fees are a real thing. If you come into my house and start spouting stuff I don't approve of, I'm showing you the door.

I'm all for free speech, and being allowed to support who and what you believe in but not on any given website. If you use a website, you have to play by the owner's rules. If you don't want to do that, go make your own... it's pretty easy and affordable.

<comment><USER4> Not to necessarily disagree, but "go make your own... it's pretty easy and affordable" only holds so long as you can find a hosting provider, network provider, and DNS registrar.

As has been shown a few times now, this capability can be summarily revoked.

<comment><USER5> There was a time, brief I'm sure, when making something available on the internet basically meant paying for a high speed connection to be installed wherever _you_ were operating, rather than a big cooled building filled with servers.

The rental model isn't an inherent part of web hosting, it's just much easier and much of the internet is geared toward things working that way.

I'm quite sure that it would be impossible to do that in some situations and for some use cases now, and in some areas it would not work out well, but in other areas it's trivially easy to find "business class" fiber service with at least 1-Gbit up and down, which is faster than the pipes a lot of hosting providers offer.

There's a _much_ stronger case to be made against ISPs tampering with or denying service to those sorts of customers, who are directly paying for a physical connection to wherever they're located.

</comment></comment></comment></comment><comment><USER6> They have the right to do this.

I still think this is terrible.

Echo chambers are becoming more common with the wide-spread adoption of the internet and people are increasingly worse at handling disagreements. It is so easy to immerse yourself in communities that validate your ideas. Many online services push you into these echo chambers because, in general, people engage more with groups that express ideas they are comfortable with.

The internet is a never-ending record of the adverse effects of echo chambers. Politics, religion, game consoles, programming languages, frameworks, operating systems, browsers, text editors... they exist for just about everything and the effect is always the same. People immersed in echo chambers gradually stop being able to show empathy to those outside their group. Perceived public opinion is a powerful thing and we love to point to popularity as justification[1].

Humans need to be challenged in order to grow. Maybe RPG.net isn't the right place for people to be challenged politically. Then the mods should just ban discussions about any real-life politician. Targeting one politician just creates another echo chamber.

Again, I know they have the right to do this. They should be allowed to do it.

I think it's bad.

[1] Apparently it's called "argumentum ad populum". Cool! [https://en.wikipedia.org/wiki/Argumentum_ad_populum](https://en.wikipedia.org/wiki/Argumentum_ad_populum)

<comment><USER7> Not sure if a gaming forum is an apt comparison to a politcal echo chamber

<comment><USER8> The part that is terrible is that they are not banning all political discussion, they are just banning the part they don't like. The rule says:

> _New Ban: Do Not Post In Support of Trump or his Administration_

If they want to keep the gamming forum on topic they can ban all political discussion.

(As a comparison, HN has a ban in political discussion. It's difficult to ban all political discussion because the is an spectrum between 100% political and 100% technological, and some posts are both political and technological, and in some case there is not clear threshold.)

<comment><USER9> > If they want to keep the gamming forum on topic they can ban all political > discussion.

This isn't about being on topic, as it's a sitewide rule which applies even in the open-topic forums on the site.

So, criticizing it as not the best way to keep things on-topic is missing the point.

> As a comparison, HN has a ban in political discussion.

No, it doesn't, though it did as a quite controversial experiment for a few days a while ago. (If it did, this discussion, which is 100% political, would be banned.)

</comment></comment></comment></comment><comment><USER10> Privately owned and operated forum makes sensible moderation rules on how they would like to operate themselves. Now to Jim with the weather.

<comment><USER3> >Privately owned

Ding ding ding! A website is effectively the owner's house, if you come through their door you follow their rules or you leave.

<comment><USER11> That's not accurate. Do you believe that an owner should be able to deny services based on political or religious leanings?

<comment><USER3> Absolutely. It's not a public park, it's virtual private space.

If you say something on a website the owner is allowed to remove it, if you don't like that you are more than welcome to go make your own website for as cheap as probably 15$ a year with shared hosting.

<comment><USER11> Well, I'd argue that you are using a service and being denied use of that service arbitrarily does have some guidelines to it. It's not about how cheap it is, it's about whether or not it's discriminatory.

</comment></comment></comment></comment></comment><comment><USER12> I am fully in support of this, and actually quite surprised by the negativity in this thread about this decision. All the major hold outs online, like the Donald, already do the reverse of this and ban anyone who challenges their viewpoints.

<comment><USER6> /r/The_Donald isn't exactly a community I would hold up as an example of this sort of policy working out.

I have a general distaste for communities like this and it's always disappointing to me when I see any community voluntarily turn itself into an obvious echo chamber.

</comment></comment><comment><USER13> Why not ban just ban all political discussion? That would be more fair than calling out specific politicians you aren't allowed to support (but you are allowed to condemn)

<comment><USER14> If you read the link he's explains it in great detail. I won't rehash it all, but basically: we have 0 issues with conservative ideology, we have a lot of problems with politicians who support hate groups and promote racism.

</comment></comment><comment><USER15> To those who say this is OK but net neutrality is something that should be, why? If people can ban others for speech, because they're the ones providing the hosting. Should ISPs not be able to throttle whoever they'd like for the same reason?

<comment><USER16> This is not even a close comparison. In one case the owner is providing a space at no cost to users where they have many choices.

In the other, a company is proving you a connection to the network and nothing more, but in exchange for payment and often with no other choices.

</comment></comment><comment><USER17> If they ban all politics equally I'm all for it. Off topic moderation. Seeing American politics being hawked everywhere is rather tiresome. Makes me appreciate what Canada has to go through every day.

</comment><comment><USER18> Eh it's their website. Personal property. They're idiots though.

</comment><comment><USER19> The infractions section is going to get interesting: [https://forum.rpg.net/forumdisplay.php?138-Infractions](https://forum.rpg.net/forumdisplay.php?138-Infractions)

</comment><comment><USER20> A question for all the "my business, my rules" crowd: do you also support a cake shop refusing to bake a wedding cake for a gay couple?

<comment><USER21> I'm honestly not sure of my answer to that question, but there's a huge difference between refusing service to someone because of their sexual orientation and refusing service to someone because of active support of white supremacists and other hate groups.

Not only is one discriminating because of what you _are_ and the other because of what you _do and say_ , but the "do and say" side in this case is doing and saying things that are unquestionably morally repugnant, and in many cases actively inciting (or at least condoning) violence against classes of people...mainly because of what those people _are_.

<comment><USER22> > their sexual orientation

Which I believe is considered a "protected class" \- [https://en.wikipedia.org/wiki/Protected_group](https://en.wikipedia.org/wiki/Protected_group) \- whereas being a racist/white supremacist/alt-right (currently) isn't. That's the difference.

<comment><USER21> While that's true, and the legal definitions are derived from the moral foundation I'm applying here, they themselves aren't really my point. Rather, it's that the reason they're protected classes in the first place is because they're (basically) things people either can't control about themselves.

</comment></comment></comment></comment><comment><USER23> I was against this until I thought about it this way: if an individual on the forums posted the opinions that they are quoting Trump as saying they would likely be banned. For example, if I actively made fun of a disabled person or sexual assault victim I would rightfully be ostracized from the space. Now they are saying that showing open support for someone who uses that as their main rhetorical tactic is as bad as saying it yourself. I'm conflicted about it, but I understand it.

</comment><comment><USER24> Hate to be the one that says this...Why is this being posted on Hacker News? A privately operated forum is using moderation tools in ways that not everyone finds agreeable, how is this news in 2018?

We have a lot of discussions on free speech but do we really need to post every single site that uses these tools to reiterate the same points?

>Pro:Free exchange of ideas is being threatened and is creating an echo chamber; i don't agree with the ideas but will die for you to say it >Con: They are privately operated and the first amendment isn't a catch all for _all_ speech; XKCD comic showing you the door...

Maybe i'm cynical but most discussions just devolves to the same conversations being repeated with nothing interesting to add to the already long list of FB, Google, Go Daddy, Twitter posts/groups that have been censored/deplatformed. At this point it seems everyone already has their opinions firmly placed and nothing will really convince them otherwise.

</comment><comment><USER25> Hate speech laws, deplatforming, or political bans don't actually accomplish any of their stated goals. In the Weimar Republic, there were hate speech laws ([https://www.newyorker.com/news/news-desk/copenhagen- speech-v...](https://www.newyorker.com/news/news-desk/copenhagen-speech- violence)). Relevant quote:

"Researching my book, I looked into what actually happened in the Weimar Republic. I found that, contrary to what most people think, Weimar Germany did have hate-speech laws, and they were applied quite frequently. The assertion that Nazi propaganda played a significant role in mobilizing anti-Jewish sentiment is, of course, irrefutable. But to claim that the Holocaust could have been prevented if only anti-Semitic speech and Nazi propaganda had been banned has little basis in reality. Leading Nazis such as Joseph Goebbels, Theodor Fritsch, and Julius Streicher were all prosecuted for anti-Semitic speech. Streicher served two prison sentences. Rather than deterring the Nazis and countering anti-Semitism, the many court cases served as effective public- relations machinery, affording Streicher the kind of attention he would never have found in a climate of a free and open debate. In the years from 1923 to 1933, Der Stürmer [Streicher's newspaper] was either confiscated or editors taken to court on no fewer than thirty-six occasions. The more charges Streicher faced, the greater became the admiration of his supporters. The courts became an important platform for Streicher's campaign against the Jews. In the words of a present-day civil-rights campaigner, pre-Hitler Germany had laws very much like the anti-hate laws of today, and they were enforced with some vigor. As history so painfully testifies, this type of legislation proved ineffectual on the one occasion when there was a real argument for it."

Nothing gets stopped by merely refusing to extend some small measure of legitimacy to whatever is deemed "bigoted". These policies and norms do not change minds, which is the skill these wannabe social engineers need to master.

<comment><USER9> > Nothing gets stopped by merely refusing to extend some small measure of > legitimacy to whatever is deemed "bigoted".

The targets of bigotry being subjected to both the bigotry itself _and_ the additional insult of the community they are participating in legitimizing it is, in fact, stopped by the community not legitimizing it.

As that has long been a central purpose of RPG.net policy on acceptable participation, I think this particular rule is probably doing exactly what is intended.

> These policies and norms do not change minds

Perhaps, but in this case they aren't intended to, so that's not an argument against the policy.

<comment><USER25> Still don't think it's wise to adopt a burying one's head in the sand approach. It just leaves the participants unprepared when confronting this "bigotry" in the real world, as inevitably they will.

<comment><USER9> > Still don't think it's wise to adopt a burying one's head in the sand > approach.

No one is suggesting that, so I'm not sure why you are beating that strawman.

> It just leaves the participants unprepared when confronting this "bigotry" > in the real world, as inevitably they will.

Just because I'm quite prepared to (and used to) dealing with inclement weather in the "real world" doesn't mean I forego HVAC in my home or places I rent for social gatherings where that weather isn't conducive to the purpose of the gathering.

</comment></comment></comment></comment><comment><USER26> One moderator wrote:

"No. You know what? Fuck that noise. Ethnic cleansing is not "different views." Racism is not "different views." White nationalism is not "different views." Dogwhistling that attacks against your political enemies will continue if the media doesn't stop saying things you don't like is not "different views." Putting children in cages is not "different views."

This is not an argument over tax rates or the proper role of government in education. This is an argument about who will be allowed to exist in America.

Get the fuck out of this thread. Don't post here again."

Whether you agree with their decision to ban Trump support on their (privately owned) forums, you have to agree we are in a pretty grim state here in America.

<comment><USER27> That is indeed very grim, given the number of angry straw men that moderator came out with.

Has Trump ever supported "ethnic cleansing"? No. Has he even supported racism? As far as I know, no, despite attempts to cast his criticism of illegal immigrants as generalised racism.

Those claims are absurd and extreme. This person appears to believe any sort of functioning immigration system at all is the same thing as mass murder.

It looks to me from my vantage point abroad like a section of American society has become so totally swamped in righteous anger, that they have concluded - _but are unwilling to explicitly say_ \- that US immigration controls and borders should be entirely abolished. The Democrats are not campaigning on that platform though. So what happens next?

<comment><USER26> > This person appears to believe any sort of functioning immigration system at > all is the same thing as mass murder

Where is that coming from? It seems completely out of context with what was said.

Trump has been consistently proven to be racist, xenophobic, misogynistic - none of which are a crime - but should be considered seriously when at command of the United States.

These aren't straw men points. There are real victims out there suffering real consequences because of the hate and regression Trump has promoted. Children ARE being locked in cages. To say it's all Trump's fault would be careless and wrong however, but at the same time we wouldn't say the civil rights movement happened without Martin Luther King. Trump happens to be the leader of a hateful movement no one can hide from. It is indeed very grim.

</comment></comment></comment><comment><USER28> In post-ww2 Germany, they essentially adopted the policy of suppressing Nazi ideology and it was regarded as a good thing, thought every German except post-war Nazi holdouts. They came to find out its not all that much dif't in fx than shouting "fire! in a crowded theater. Not just those who went throught he war, but especially all those who were born afterwards. This here is just doing what Germany did except pre-emptively. Like Woody Guthrie's guitar. The 1st Amendment is a great step forward in democracy, but Rupert Murdoch has a ) day exploit on the constitution and pretending he doesn't = owned

</comment><comment><USER29> Trump literally proclaimed himself a nationalist a few weeks ago. As far as online communities go, these bans are _long_ overdue.

I'm not interested in sharing an online space with people who are more than happy to tear my country down.

</comment><comment><USER30> The title is a little misleading. RPG.net is banning PEOPLE who publicly support Trump on their forum.

Look at these 5 videos. People on the left are allowed to bring their whole selves to RPG.net. People on the right are not welcomed to do the same.

[https://www.wsj.com/news/types/voices-from-a-divided- america](https://www.wsj.com/news/types/voices-from-a-divided-america)

<comment><USER21> If your "whole self" wants to dehumanize and kill entire classes of people because of their perceived race, sexual orientation, gender, etc, then I don't think it _should_ be welcomed. Anywhere.

And if your "whole self" actively supports others who espouse such views, even if you do not directly do so yourself, then while I won't go so far as to say you're _as_ bad, you're certainly bad enough that you should also not be welcomed in that way.

<comment><USER30> @danaris - Thank you for stating out loud what many people think a Trump supporter is. You summed up the stereotype very well. That's important.

Now please take a few minutes and look at the people in the videos (see my previous comment) who are Trump supporters. Those are real people who support Trump. Please let me know specifically which ones are bad enough that they should not be welcomed.

<comment><USER21> Trump espouses the views I enumerated. He supports the dehumanization of, and in some cases violence against, women, LGBT+ people, and people who are not white.

Therefore, anyone supporting _him_ also supports these things, and should not be welcomed.

<comment><USER30> I conclude from that, that you do not welcome Scott Bowen, the Bi/Gay man in this video, to participate in conversations with you.

[https://www.wsj.com/articles/i-shouldnt- exist-1540823580](https://www.wsj.com/articles/i-shouldnt-exist-1540823580)

I'm disappointed in you, @danaris.

<comment><USER21> Well, I haven't watched the video (skimmed the article), but if he's a Trump supporter who's also LGBT+, then he's not only supporting fascism, nationalism, and bigotry, he's also kinda dumb for supporting an ideology that wants to eradicate him.

The article says he's a fiscal conservative, so that explains _why_ he's a Trump supporter, if he is (it doesn't actually outright state that, just says that he's a conservative), but I don't consider it to be a good enough excuse. Maybe two years ago before we knew just what kind of politician and President he would be, but not now.

I understand the dilemma the Republican party has right now. Many of them don't actually believe in the horrible things that Trump supports, but feel like they don't have any choice because the Democratic party opposes so many of their policy positions.

But policy should take a back seat when you're confronted with actual evil, and that's what we're dealing with right now. Nazis. Literal, not-even- slightly-kidding gas-the-Jews lynch-the-blacks ethnic-cleansing white-power Nazis are what Trump truly represents right now, and the Republican party leaders, by and large, won't even denounce them and say they don't support that shit.

If you support Trump, _now_ , you support the rise of literal Nazis, and I don't care what else you believe in or support, that's something I can't see any value in even allowing in the debate.

</comment></comment></comment></comment></comment></comment><comment><USER31> It's their perogative, no problem there, but I do find it a little childish that a moderater in that thread can keep their post footer as:

"Eisenhower got elected President for overseeing a war that was ALL ABOUT killing Nazis. We should return to those days." — Cessna"

Why not just ban all political posts?

<comment><USER12> Because they are taking a stand.

<comment><USER31> Yeah, some real modern day Eisenhowers there.

</comment></comment></comment><comment><USER32> I'm surprised by some of the response; I actually think they were pretty articulate about exactly what they were banning and it certainly wasn't all political speech. Trump stands for so much hatred and bigotry and it's hard to vocalize support for him without implicitly/explicitly supporting that stuff yourself. We need to stop pretending like this is political discourse.

Intolerance of intolerance is the only acceptable form of intolerance. I think that this intolerance for others through trump support is what they are banning first and foremost.

<comment><USER33> > Intolerance of intolerance is the only acceptable form of intolerance.

This seems vulnerable to a meta-level attack: "who gets to decide what is intolerable?"

<comment><USER32> I wish I had the definitive answer but in my books that line has been crossed in this context. I don't think it's as gray as we might want to pretend it is right now. The state of discourse online seems like some level of indicator something has happened recently that is descending us into chaos. Personally I do blame Trump and RPG.net seems to share a similar sentiment.

<comment><USER25> The state of discourse online is such because of the Culture War, and the Culture War predates Trump, and possibly caused Trump to be elected in the first place. The current phase of the Culture War began with universities getting creative with their definitions of "bigotry", "white supremacy", "racism", and "sexism". The worldview promulgated there eventually percolated to the mainstream and is a massive driver of the ongoing cultural conflict.

<comment><USER32> Thanks. Trump is certainly a symptom of something that existed before he took the stage. I don't think that absolves him but the problem isn't going to go away just be putting him out of sight and out of mind.

(p.s. the Thanks is generally for your response. Just want to be appreciative for peoples thoughts while discussing this topic)

</comment></comment></comment></comment></comment><comment><USER34> Can't see the actual site/post because of overly eager nanny firewall at the client, so I'm just going to comment on the title.

So? It's a privately-run forum.</comment>


MoleCool: The coolest molecule  - <AUTHOR> http://en.wikipedia.org/wiki/File:Ascaridol2.png I am no fan of chemistry but I accidentally came across wikipedia article about Ascaridole and WOW!!<p>Also, wikipedia continues to annoy me.. this time with a thank you note :D <comment><USER2> <http://en.wikipedia.org/wiki/Ascaridole></comment>


Ask HN: Would it make sense to have a "Wall of Fame" section on HN? - <AUTHOR>

Some links get posted on HN more than once, yet each time they manage to gather enough upvotes to rise to the front page.
The latest example is "A brief, incomplete and mostly wrong history of programming languages," which has been submitted at least three times to HN, on each occasion gathering hundreds of upvotes:
http://news.ycombinator.com/item?id=599164
http://news.ycombinator.com/item?id=1327746
http://news.ycombinator.com/item?id=3503896
Would it make sense to add a "Wall of Fame" section on HN to which we can nominate submissions that deserve a special, permanent link somewhere on the site? <comment><USER2> Or maybe a page with different ranking parameters. If it pays less attention to time the all time greats stick around longer.

<comment><USER3> This sort of exists already. There is a URL Parameter you can use to show stories rated over X votes. Or, build it yourself, post it on HN and get shit- tons of traffic - that's one of the great things about this site, there are very few features, but they're super-permissive about what you can do with the content.

Just for fun, <http://news.ycombinator.com/over?points=500>

<comment><AUTHOR> Thanks for that tip. You're right: the limited feature set _is_ one of the best features of HN. As is the site's super-permissive policy.

Alas, many if not most of the popular submissions returned by the "?points=" URL parameter are of an ephemeral nature (e.g., posts about SOPA and PIPA that no one will care about in a couple of years), as opposed to submissions of lasting relevance for the HN community (e.g., essays like "Worse is Better" -- <http://www.jwz.org/doc/worse-is-better.html> \-- or "The Story of Mel" -- <http://www.pbm.com/~lindahl/mel.html> \-- both of which will be of interest to the HN community for a long, long time).

I'm not sure it's possible to separate the truly timeless submissions from the ephemeral ones without relying on the judgment of the community.</comment></comment></comment>


Convox – Launch a Private Cloud in Minutes - <AUTHOR> https://convox.com/ <comment><USER2> Hello! I'm part of the Convox core team and happy to answer any questions.

Convox is an app deployment platform that you can install into your own AWS account. It uses ECS, ELB, Kinesis, and many other great AWS services under the hood but automates it all away to give you a deployment experience even easier than Heroku.

Convox uses Docker under the hood so if you want to customize anything (distro, dependencies, etc) you can simply add a Dockerfile to your project.

Convox is entirely open source. Check it out at [https://github.com/convox](https://github.com/convox)

To get started with our installer go to: [http://docs.convox.com/docs/getting- started-with-convox](http://docs.convox.com/docs/getting-started-with-convox)

<comment><USER3> Is there likely to be support for other clouds in the future? Amazon is great and you're far cheaper than Heroku itself but I'd love to throw this on DigitalOcean or Vultr.

<comment><USER4> Vultr's website looks... interesting. And their control panel is also... interesting. BUT.

I've been very impressed by the performance of my nodes.

Tops DigitalOcean easily. I don't have any hard numbers (I can provide some if people would like) but with the performance and number of locations they provide it's hard to beat.

$50 credits for two months: [http://vultr.com/freetrial](http://vultr.com/freetrial)

Vultr also offers a "dedicated cloud" which I think is just dedicated resources — similar to RunAbove ([http://www.runabove.com](http://www.runabove.com))

Whenever I talk about hosting, I seem like I'm affiliated with the providers. I am not :) I am simply a vet, a student, and a product of the hosting space.

If anyone has any questions, see my profile and reach out. I love to talk hosting :)

<comment><USER3> I'm also a big fan of Vultr, hence why I mention them :)

When I've run tests, they beat DO on every metric on unixbench (for equivalently priced/RAM filled instances [0][1]) and they let you use whichever ISOs/images you want (including fun stuff like BSD), unlike DO.

Their SATA storage nodes are really handy too.

You didn't post numbers but here are mine:

[0] Vultr benchmark: [https://gist.github.com/bobobo1618/0972fc51f49d90fb37af](https://gist.github.com/bobobo1618/0972fc51f49d90fb37af)

[1] DigitalOcean benchmark: [https://gist.github.com/bobobo1618/81aa3f413b99aaab1f0d](https://gist.github.com/bobobo1618/81aa3f413b99aaab1f0d)

</comment></comment></comment></comment><comment><USER5> Cool product! This is fairly unrelated but since you've open-sourced your code (thanks!) I was just browsing around the 'cli' project and saw heaps of the following:

      if err != nil {
          stdcli.Error(err)
          return
      }

Is this idiomatic Go? It's just sprinkled everywhere and makes it hard to follow logic at a glance.

<comment><USER6> Explicit error handling is part of Go. It's pretty common to see lots of conditionals in a Go codebase.

</comment></comment><comment><USER7> You have a "Convox, Inc" copyright on the website - is there a business / monetisation-plan behind this, or is it just the open source project?

<comment><USER2> Yes, there is a business behind Convox. The founders are all ex-Heroku engineers and have we all have a great deal of experience building this type of tooling and automation.

For now we are focused on building a great open-source platform.

</comment></comment><comment><USER8> How is this a private cloud if it's running on AWS which is most certainly a public cloud? I don't mean to take away from the product but I find the messaging to be odd.

<comment><USER9> My guess is that it's them playing slightly loose with the AWS term VPC: Virtual Private Cloud. My guess is that this is the way most people that have done work with AWS will understand their statement this way.

<comment><USER6> You're right. It's technically a virtual private cloud. We've found that nowadays VPC works for most people. The days of on-premises platforms are numbered.

<comment><USER8> Days numbered or not (aside: take a look around Fortune 1000 and you'll see it's alive and well) the term private cloud has a definition. Someone should come up with a term for subnets inside a public cloud.

<comment><USER2> Thanks for the interest :) We have been trying to figure out the best way to describe our platform and "private cloud" seems the closest.

[https://en.wikipedia.org/wiki/Cloud_computing#Private_cloud](https://en.wikipedia.org/wiki/Cloud_computing#Private_cloud)

<comment><USER8> Fair enough. Btw, is this what Nitrous became?

<comment><USER6> This is a separate venture from Nitrous.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Sounds like Deis:

\- [http://deis.com/](http://deis.com/)

\- [https://github.com/deis/deis](https://github.com/deis/deis)

<comment><USER2> It is similar to Deis in goals but it differs substantially in implementation. Because Convox runs on AWS we can rely on stable and scalable services only available on that platform such as ELB and DynamoDB. Deis uses its own internal Postgres and implements a custom load balancer, scheduler, etc. We believe using the hosted services will help you keep your operational costs down over time.

<comment><USER11> How does Convox compare to Empire? I see a bunch of similarities (good use of AWS features in particular), and they both look pretty great.

(Empire: [https://github.com/remind101/empire](https://github.com/remind101/empire), [http://engineering.remind.com/introducing- empire/](http://engineering.remind.com/introducing-empire/))

<comment><USER12> Creator of Empire here. Empire and Convox are kinda like brothers and sisters, both really similar in implementation and philosophy. There's a couple of subtle differences, like how Empire expects that you've already built a Docker image somehow, whereas Convox can just take some code and do it for you (hosts it's own docker registry). Convox also supports streaming logs, which is pretty awesome (although, coming soon to Empire too :)). Convox is a little more reliant on AWS, whereas Empire was designed to be able to work with other backends like Kubernetes for example (not implemented yet). I would say, use which ever one best suites your needs, they're both great, and like David said, we talk a lot and share ideas back and forth.

<comment><USER6> Thanks Eric!

+1 Check out Convox and Empire. See which one works best for you.

</comment></comment></comment></comment></comment><comment><USER13> "The simplicity of Heroku. The power of AWS."

The privacy of "?". Was waiting for this part since it was included in the title.

<comment><USER6> Good point. Any suggestions?

<comment><USER13> The HIPAA-compliance was a nice mention. "zero-knowledge" privacy resonates with me as well when it comes to privacy, though I realize that's out of your control with AWS.

</comment></comment></comment><comment><USER14> This looks amazing! Thanks for making/releasing this as open source.

<comment><USER2> You're quite welcome! All three of the Convox founders are huge proponents of open source. We've already seen the benefit from this as a user has mapped out the missing pieces to host HIPAA-compliant applications on Convox and has already started making the necessary changes.

[https://github.com/convox/kernel/issues/92](https://github.com/convox/kernel/issues/92)

</comment></comment><comment><USER15> Anathem reference?

<comment><USER6> We have a winner :)

</comment></comment><comment><USER16> Super awesome. I can't wait to start porting some of my heroku apps over to aws using convox.

<comment><USER2> Let us know if there's anything we can do to help! I'm firstname.lastname@example.com

</comment></comment><comment><USER17> I would like to use Convox to spawn several instances of a Java app in order to benchmark Java messaging lib within the VPC (no ELB needed). Is Convox suitable for such use case?

<comment><USER2> Absolutely! We have a few people using Convox to run and scale workers without a web app.

</comment></comment><comment><USER18> Good stuff! Looks very promising!

Haven't had a chance to take it for a trial spin yet, but I was wondering if there is anything in here for applications that have a limited lifespan? Working on a system right now that would have the need for a "central" application that would need to regularly launch subworker apps for a specific task (planning on running each sub app on it's own micro AWS instance) and then "kill it off" once the job was completed.

<comment><USER2> You could definitely do this. Create one master app and then have it connect back to ECS to spawn more apps.

</comment></comment><comment><USER19> Could someone familiar with Convox give us a brief answer to the question "how is this different from the myriad DevOps tools that Amazon provides for AWS?"

<comment><USER6> We're most familiar with OpsWorks. The main difference is simplicity. Convox doesn't require you to think much about infrastructure or write big JSON config files. We want the developer experience to be very app-focused like Heroku.

</comment></comment><comment><USER20> Previously: [https://news.ycombinator.com/item?id=9976938](https://news.ycombinator.com/item?id=9976938)

</comment><comment><USER21> Is anyone using this in production? If so, at what scale?

<comment><USER12> One of the great things about stuff like Convox and Empire is that, because they're built on existing stable technologies and utilize AWS managed services, you're basically asking if ELB, EC2 and ECS can scale. The most unstable component in all of this is probably Docker. In our experience running it in production at scale, it's faults have been pretty minor (things like push/pull being agonizingly slow) and failure modes get taken care of by ECS managing desired state well.

</comment></comment><comment><USER6> If anyone here would like an invitation to the Convox #public Slack channel please email me at firstname.lastname@example.com.

</comment><comment><USER22> sounds very similar to tsuru:

[https://tsuru.io/](https://tsuru.io/)

<comment><USER23> There is a tremendous amount of awesome work happening in this space. Tsuru is one such great project, thanks for adding it to the thread.

One big difference is that Convox uses managed services over writing and running our own components. For example, we use DynamoDB for saving build and release records. And we use ELBs for load balancing and routing.

This approach ties us closely to AWS, but results in a stack of infrastructure that has minimal operational overhead (e.g. Amazon is keeping DynamoDB Available, you don't have to manage an etcd cluster), and great scaling potential (vs tuning and scaling individual HAProxy nodes).

</comment></comment><comment><USER24> How does this compare to Cloud Foundry? Do they solve different problems and therefore should not be compared directly?

I can (and will) google this myself in an effort to triangulate and understand but I figure it would be valuable to hear from people who are more informed and experienced.

</comment><comment><USER25> This is really great! I'm interested in trying this out for our products in place of OpsWork.

The documentations says "by default provisions an Elastic Load Balancer and 3 t2.small instances", is it possible to change the number/size of servers dynamically?

<comment><USER2> This was recently added by a contributor!

[https://github.com/convox/cli/pull/48](https://github.com/convox/cli/pull/48)

You can update an existing cluster using something like `convox system scale --count 5 --type c4.xlarge` from the CLI. If you change the instance type your cluster will be rolled one at a time with no downtime.

<comment><USER25> That's great. Is it possible to add additional servers after installation? I looked into the CLI project but I haven't found anything yet, the scale option appears to be for processes not servers.

<comment><USER2> Woops, I ninja-edited my comment above before I saw this. Yes you can do this, see the CLI command above.

<comment><USER25> Very cool, thanks so much for your hard work!

</comment></comment></comment></comment></comment><comment><USER26> Just getting started here and wondering if there's a way to choose the region all this stuff is being installed to?

Can apps be launched in specific regions?

edit: Looks like it defaults to us-east-1. I'd much prefer to use Sydney due to the latency here in AU :)

<comment><USER6> Correct. It does default to us-east-1. The main reason is that we are using some fairly new AWS services that aren't launched in all regions, but we do want to and expect to expand to more regions.

</comment></comment><comment><USER27> What does it take it to adapt Convox to be installed on a baremetal server like Hetzner?

Can I rent 2-3 servers at Hetzner and have a small cloud of sorts?

Or is that not something that is suggested to be done?

<comment><USER2> It may be possible but it would take a substantial amount of work and I wouldn't recommend it. Convox achieves much of its stability and scalability from relying on hosted a AWS services.

</comment></comment><comment><USER28> Great product - exactly what I'm looking for in infrastructure. Was able to get a bunch of esoteric services up and running on AWS without having to pull out my hair.

</comment><comment><USER29> When you will support other vendors?

<comment><USER2> We are considering other vendors but currently focused on AWS. What vendors would you like to see?

<comment><USER30> Google Cloud

<comment><USER6> Thanks for the input. Google's offerings are really picking up steam. We've been in touch with Google and are excited about expanding onto their infrastructure in the future.

<comment><USER13> What about IBM Bluemix?

<comment><USER6> That one hasn't been on our radar, but we'll definitely check it out.

<comment><USER13> It's based on CloudFoundry, and supports OpenStack and Docker, so lots of choices.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> Funny, we have a similar tag line but quite different products.

[https://cloudron.io/](https://cloudron.io/)

(Cofounder of cloudron.io here)

<comment><USER6> Great minds think alike ;)

Cloudiron.io looks cool. I'll definitely check it out.

</comment></comment><comment><USER32> Is it even legal to use the phrase "The simplicity of Heroku. The power of AWS." if you're all ex-Heroku engineers? Seems sketchy as hell.

</comment><comment><USER33> How is this different than Dokku?

<comment><USER2> Unless it has changed since I last look Dokku only runs on a single server.

The other major difference is that software like Dokku is trying to run anywhere. Because we are only trying to run on AWS we do not need to build custom schedulers, load balancers, routers, etc. We believe this will reduce your operational costs over time.

<comment><USER34> As one of the dokku maintainers, I wholeheartedly agree with ddollar. Convox seems _extremely_ interesting to me, since our goal is a single-server heroku experience. I personally would never be able use Dokku in production exactly because of this, but its quite good for throw-away sites, as a test-bed for side projects, etc.

Good work ddollar. I quickly looked at the github repos and once I saw your name attached, I knew it was going to be a quality project :)

<comment><USER6> David had to go AFK, but thanks, on his behalf. I'll make sure he sees this :)

</comment></comment></comment></comment><comment><USER35> So what does Convox, Inc. offer?

<comment><USER2> Currently we only offer Convox the open-source platform :) In the future we are considering paid support and other monetization strategies but the base platform itself will always be open-source and available for you to do with as you please.

</comment></comment><comment><USER22> any plans to support stateful apps like Wordpress?

<comment><USER6> You could run Wordpress today, afaik. Anything that can run in a Docker container can run on on Convox. You'd just need to use some sort of hosted database service like Amazon RDS to persist your data.

edit: Just looked at Wordpress a little closer. I didn't realize it expects a persistent filesystem, which I guess is what you're asking about. Convox follows the 12factor.net philosophy of ephemeral filesystems, so you'd need to figure out a way to persist files to S3 or similar...

</comment></comment><comment><USER36> awesome!

<comment><USER6> Thank you!

</comment></comment><comment><USER37> It's just another toy for AWS kids with "private cloud" buzzword.

<comment><USER38> Don't you think it makes it easier to deploy a "private cloud" though. It looks like it take away a lot of the tedium.</comment></comment>


Scheme Programming Lessons from Tarot - <AUTHOR> https://rain-1.github.io/scheme-1 <comment><USER2> When I read the headline I had hoped this would be about esoteric but useful programming lessons learnt from Tarot deck divination.

</comment><comment><AUTHOR> Part two: [https://rain-1.github.io/scheme-2](https://rain-1.github.io/scheme-2)

<comment><AUTHOR> Part three: [https://rain-1.github.io/scheme-3](https://rain-1.github.io/scheme-3)

</comment></comment><comment><USER3> This uses a difference list data structure, which, when I learned it in Prolog, requires lazy evaluation of the tail of the list.

Erlang doesn't seem to allow lazy evaluation; am I wrong about that? Is there some way to do difference lists in Erlang?

<comment><USER3> Correction: it needs _unbound variables_ , not lazy evaluation. Erlang doesn't have unbound variables; I suspect one would have to implement some form of that before implementing difference lists.

</comment></comment><comment><USER4> Scheme syntax is so arcane that it appears divination by tarot cards is a viable option to understanding it.

Like numerology and magic number'd Clang ;)

<comment><USER5> yeah, s-exprs are very hard, right? compared to bazillion new keywords that can't be used by user programs and various kinds of brackets for different purposes.

<comment><USER6> Some people find s-expressions hard to read because they are almost too uniform. Having different brackets and braces mean different things can aid those folks.

There are languages that allow user-defined syntax and aren't only parenthesis/s-expressions, so arguing one requires the other is a false dichotomy.

<comment><USER7> Often the information that different brackets and braces would represented in other languages becomes the _shape_ of the s-expressions. I find that easier to parse than most[1] languages. With rainbow-delimiters[2] (example[3]), parsing nested parens becomes _far_ easier.

[1] Ruby is a rare exception.

[2] [https://github.com/Fanael/rainbow- delimiters](https://github.com/Fanael/rainbow-delimiters)

[3] [http://i.imgur.com/xS4y6rT.png](http://i.imgur.com/xS4y6rT.png)

<comment><USER8> In Racket and other Schemes parens and square brackets are interchangeable. The Racket style guide suggests to use square brackets in let- or cond-like expression, or generally any expression with a list of lists of fixed length that are not supposed to be evaluated. The expression you posted would become like this:

        (do ([i 1 (+ i 1)])
            ((> i 100))
          (display
            (cond [(= 0 (modulo i 15)) "FizzBuzz"]
                  [(= 0 (modulo i 3))  "Fizz"]
                  [(= 0 (modulo i 5))  "Buzz"]
                  [else                i]))
          (newline))

I personally think this helps a lot with the problem of parsing s-expressions visually.

<comment><USER9> Also: It is rare to use `do`.

        #lang racket
        (require math)

        (for ([i 100])
          (displayln
           (cond [(divides? 15 i) "FizzBuzz"]
                 [(divides?  3 i) "Fizz"]
                 [(divides?  5 i) "Buzz"]
                 [else            i])))</comment></comment></comment></comment></comment></comment>


Helping Wikipedia by using WebRTC (p2p) in your browsers - <AUTHOR> http://b2bwiki.cc.gatech.edu/wiki#Main_Page <comment><USER2> This is a great alternative to help wikipedia to sustain operation instead of monetary donation. Users are able to contribute with no hassle of installation of any software or extension. And it works on all major browsers (i.e., chrome, firefox). Most importantly, the decentralized architecture brings higher resilience to single point of failure which wikipedia is expected to survive. I believe the community based decentralized solution is the trend for operating big non-profit contents service like wikipedia.

</comment><comment><AUTHOR> B2BWiki is a project that attempts to help Wikipedia in reducing down its network burden by delivering and sharing the page content among users by using in-browser P2P (WebRTC). Each user can contribute his/her network capacity as well as own local storage (e.g., localDB) in browser while reading the page, and a larger organization might even contribute to the community by deploying own servers (no out-of-pocket money!), similar to a mirroring server in an old good day.

</comment><comment><USER3> Reminds me John Hiesey's demo at SF WebRTC Meetup at Twilio [https://www.youtube.com/watch?v=sNi92K0ddEw](https://www.youtube.com/watch?v=sNi92K0ddEw)

Just added to RTC.news: [http://www.rtc.news/posts/4Gt7n6dtCf6sPg2cx/show- rtcn-helpin...](http://www.rtc.news/posts/4Gt7n6dtCf6sPg2cx/show-rtcn-helping- wikipedia-by-using-webrtc-p2p-in-your)

</comment><comment><USER4> It works great in my desktop environment!</comment>


Show HN: Mallard – A mysql migration tool - <AUTHOR> https://bitbucket.org/koalephant/mallard <comment><AUTHOR> This project grew out of me needing to support a third-party (but still OSS) python based migrations tool because the bugs we found on a client project weren't being fixed quickly by the upstream/original maintainer.</comment>


What Exactly Is End-To-End Encryption? - <AUTHOR> https://medium.com/ink-different/what-exactly-is-end-to-end-encryption-d43752476e44 <comment><USER2> As the article points out, encryption is an already solved problem. The problem that is, and always has been problematic is key distribution.

Companies that offer encryption products use various mechanisms to allow the sender and the recipient to end up with matching keys. It is surprisingly difficult to do correctly.

It is not enough that the communication stays encrypted from the sender, through the server, and to the recipient. It is also important that no one besides the sender and recipient has the ability to decrypt that communication.

<comment><AUTHOR> Yeah, this is an excellent point. For the Inky product mentioned in the article, a good explanation of how they handle key storage and distribution is provided here: [https://medium.com/ink-different/how-inky-stores- encryption-...](https://medium.com/ink-different/how-inky-stores-encryption- keys-safely-c3715756b224)

</comment></comment><comment><USER3> Inky has posted a document entitled "Inky Security White Paper" here: [http://inky.com/secure/](http://inky.com/secure/)

Haven't tried the software or given their paper a proper read yet.

Initial thoughts: No forward/future secrecy. Stores user private keys on their server encrypted with user supplied passwords. Their centralized service is trusted for identity. Not sure how users update their secrets if compromised.

Adding proper E2E crypto to legacy email is hard. I don't think they solve it.

</comment><comment><USER4> To me, this mostly reads like an ad for OP's product Inky.</comment>


Introducing Qubrit.com - Contacts Management Startup  - <AUTHOR> http://qubrit.com Qubrit lets you create, share and exchange your virtual business cards with anyone and manage your professional contacts. For free. Qubrit changes the way professional contacts and business cards are used. <comment><AUTHOR> Want to get people's opinion on it</comment>


Android Needs a Heart - <AUTHOR> http://www.slate.com/articles/technology/technology/2011/11/google_android_4_0_there_s_not_enough_to_love_about_google_s_overstuffed_mobile_os_.html

<comment><USER2> This is more of an amateur blog post (with nice writing) than an article. Mostly just the author's opinions.

Android inspires joy in me, while using an iPhone doesn't. But that doesn't make me write stupid blog posts titled "iOS needs a Heart!"

I comes down to what you like in a phone. As a hacker, I like freedom. I want to do whatever I want. In that regard, Android is much more loveable. On the other hand, the iPhone 4 has a snappier interface than my Nexus S.

You can't really tell people which mobile OS is the most loveable with a straight face. That's like saying food x is a better food than food y simply because of the taste.

<comment><USER3> "This is more of an amateur blog post (with nice writing) than an article. Mostly just the author's opinions."

Why do you think that a subjective opinion about a heated topic, with a catching headline and written as if the opinion was a fact, is a sign of an amateur's post?

This is exactly how you get to the frontpage of techmeme. Most professional tech blogs like techcrunch or engadget generate their income this way.</comment></comment>


The greening of the grid: Demystifying solar inverters - <AUTHOR> https://eengenious.com/the-greening-of-the-grid-demystifying-solar-inverters/ <comment><USER2> Very Informative. InPhase Power Technologies Private Limited manufactures "world class" solar inverters in India that are completely designed & developed In India. (They also used high quality components from Texas Instruments.) The Inphase inverter received an Award of Excellence for "Innovation in Renewable Energy and Power Quality Solutions" on May 3rd 2016, by the Union Minister, Government of India

</comment><comment><USER3> "I agree that the solar inverter is a fertile field for engineering innovation. This short video is a good, quick overview: [http://goo.gl/VkqaFs](http://goo.gl/VkqaFs)

</comment><comment><USER4> Nice information for how to evaluate and select the right digital controller for your design</comment>


A History of Haskell (2007) - <AUTHOR> http://research.microsoft.com/en-us/um/people/simonpj/papers/history-of-haskell/index.htm <comment><USER2> Thank you tobik. I think it's a must read for anyone getting started with Haskell.</comment>


Pros and Cons in Using JWT (JSON Web Tokens) - <AUTHOR> https://medium.com/@rahulgolwalkar/pros-and-cons-in-using-jwt-json-web-tokens-196ac6d41fb4 <comment><USER2> Wow, I found this to be a naive view of JWT usage. I'm not advocating it's usage for every circumstance, and, the author does add the disclaimer that he knows little about it, but I feel the author misses a number of basic concepts of JWT's. Here are some observations:

1\. you are able to decode the headers and payload of the token regardless of what algorithm was used. This is because both are base64 values of the content they represent. The purpose of the JWT is to securely identify a user in a stateless environment. The token's use is therefore to pass basic user information (as well as token information for purposes of identifying how to decrypt the token, it's validity time, etc) along, while identifying the user at the same time. The former requires that data be easily readable, hence the base64 hashing of that content. The latter part is achieved by using an algorithm that generates the signature of the token using the first 2 parts and by providing a secret key. If the data in the token is modified in any way, the signature won't match. Hence the validation of the token fails.

2\. You should never be including any sensitive data in the payload of the token. Such as password hashes. The example given in the post is akin to a developer storing a users sensitive details in a cookie. You could probably get away with "higher sensitivity" data stored in cookies in certain cases, but overall it's just wrong and as a developer one should know better.

3\. Persistence of tokens is typically an issue admittedly. How I've typically countered such things is using shorter token lifespans, as well as such things as the inclusion of a "session" key on my users table. This doesn't prevent a db lookup, but the value of which can also be saved to a redis instance for example. The value of this field remains mostly static and can initially be the same across all users for example, and the value of which is included in the token payload itself. For example, all users can have the same value of 1 (very simple case, but bear with me). Now, if you need to invalidate a user session for some reason, or log them out of all their devices, or some similar action, simply change the value of this field. Your token validation would need to include a check against this value as well which makes this not very different to session storage (or rather a user cache) , but it's not a worse performance than server session storage and because the value remains mostly the same, is actually easier to implement in my opinion.

4\. A single key used to sign all user tokens is generally a bad idea to begin with regardless... but that's like not salting passwords or taking any proper measures when securing users. The case mentioned in the post could be likened to someone accidently typing out an admin password for a web login in a public forum... in which case, shit happens. Sure, in such case it's easy to update the password without affecting user logins, but to be fair, the use of insecure methods for security in general rarely if ever leads to secure implementations. Can't expect a sturdy wall if you don't plaster the bricks together. So related to my point 3 above, use of the user's password hash, for example, or some other, non public, identifier in addition to the signing key helps tons. Or use an RSA implementation signing algorithm. If however, you want HMAC, or such, your performance using a user cache is not unlike server side session storage, and is easier to implement and maintain. All the while keeping the benefits of JWT.

Again, not for every use case, but it's not as broken or insecure as the post makes it out to be.

<comment><AUTHOR> Hey Wetwiper, i like your Nickname :) thanks for the review :-) 1\. Yeah, I do understand the working of JWT and Signatures, it was made in a simpler format for naive first time users. There is no security flaw in that 2\. Yeah, you are right in a way, but I have seen people do it in case of JWT, as they store the User-id there as well 3\. Hahaha.. that's a DB lookup, you loose ;-) 4\. I don't understand how multiple would work. Well, as for your "insecure methods" comment, I have a classic example of employees leaving the Tech team. And as for Signing algorithm you can never say anything. A few years back MD5 was considered most secure and could not be broken and used in every Digital Signature. Now there are websites that generate the text based on the HASH value.. that is not using Rainbow tables. So, even salts in this case wont work :-|

I agree, that my review was biased (isn't everyone? :-o )

<comment><USER2> Hehe... nick chosen for a variety of reasons :) I'm going to point out that storing user IDs and such in the payload is perfectly acceptable, and one possible means of transporting a user id around rather than as part of a url path, query string, etc. Because the payload is typically meant to be readable, there should never be any sensitive data like password info added to it. Note that while JWTs are used for authentication typically, thru are also used as a means of secure message passing. Anyway, proper use of a technology comes down to developer awareness, but I would hope that the developer implementing any means of security would do some research into doing it properly. We can't blame the tool for being used incorrectly :) Perhaps the problem in this case is a lack of sufficient proper documentation? Can't say I've found lack of docs to be a problem, but I guess people's mileage differs.

As for my points 3 and 4, I did mention that they included a DB lookup. I don't believe I've ever read anything that claims that it prevents a DB hit. In fact, this[1] page states that they help to prevent more than 1 DB hit for user info. However, what I was trying to allude to in my previous comment was that you can store the bare minimum info of your users in a cache. This cache can be used during the validation of the token (and even with token generation) , which prevents a db lookup. Since the data in the cache should contain data that rarely changes (should only typically be updated on password change, or when any of the details used in the payload of the token changes) , management and maintenance of your user cache is simpler. Specifically on point 4, what I was suggesting is that if you are planning on using something like HMAC as the algorithm for signing, then the signing and validation steps of the token can include the password hash or similar unique value for the user in addition to whatever key is provided. In addition, if your tech team has access to your production DB, you have a concern when anyone leaves anyway, regardless of what authentication method you are using. So not really something specific to JWT. In the case of JWT and using HMAC for example, I would have my production key stored in the prod environment only.

I will say that changing a key is a real concern, if your key does become compromised... but it is possible with a bit of thinking upfront about it. I've successfully implemented something like this previously.

Again, it's not the right tool for every circumstance, but when used in the right circumstance and in the correct way, I don't find most of your post to be relevant (meant with good intentions and I'm not trying to be provocative).

Perhaps a quick read through the Wikipedia page [0] on the topic, but more importantly, the JWT IO page [1] on the matter provides usage and implementation guidelines, as well as confirms some of what I've mentioned previously.

[0]: [https://en.m.wikipedia.org/wiki/JSON_Web_Token](https://en.m.wikipedia.org/wiki/JSON_Web_Token) [1]: [https://jwt.io/introduction/](https://jwt.io/introduction/)</comment></comment></comment>


Hackers wanted for $200k MIT Clean Energy Prize - <AUTHOR> http://mit100k.com/cep/

<comment><AUTHOR> I'm the new lead organizer. I want hackers to submit business plans - <USER2> Energy doesn't just mean solar and wind turbines. How can I reach out to them?

Also, our website needs some love - are you passionate about our energy challenge and want to volunteer your skills?

</comment><comment><USER3> Why does this say 200K and the page say 100K?

<comment><AUTHOR> 100k is the MIT business plan grand prize. Clean Energy Prize is the energy track that turns out have a bigger prize on its own (200k).</comment></comment>


Show HN: NERD – SPA Starter Kit - <AUTHOR> https://github.com/ConflictingTheories/nerd-starter-template <comment><AUTHOR> Hey, this is my first post - I wanted to see if there some feedback I could get from the community. I have been doing some interviews lately and its seems the popular thing to do is have a take-home challenge. I have been struggling to keep up with all of them, so I have decided to start making templates to help speed up the process.

My first template is a NERD stack. (Nginx, Express, React, Docker) alongside an MySQL Database.

Let me know what you think, I would love the feedback. Cheers!</comment>


How Technology Wrecks the Middle Class - <AUTHOR> http://opinionator.blogs.nytimes.com/2013/08/24/how-technology-wrecks-the-middle-class/?gwh=4CDFBE246499183D8711226F308E94BD

<comment><USER2> Articles like this always remind me that here in the UK (or at least I) have a very different view of what 'middle-class' means compared to the US.

This article implies that middle-class means jobs like radiology technician, phlebotomist, nurse technician. Those don't strike me as middle-class whatsoever!

To me middle-class means privately educated, own reserves of money, probably a large house in the country as well as an apartment in the city, two kids, a labrador and a Barbour quilted jacket: bankers, doctors, baristers etc.

Then beyond that people like the Duke of Westminster, Bill Gates, the Kennedys etc are the upper class - not random Google engineers who joined in the last few years like some US people seem to imply!

<comment><USER3> But the British also have an odd idea of public vs private schooling... :)

<comment><USER2> People hate on the public schools (for Americans that means the very top end of private schools), but their history is that they were set up before there were any state schools, and provided education for the public, rather than their own people, so the name is apt. You had to pay or get a scholarship, but still like any other school at the time they were open to the (paying) public.</comment></comment></comment>


What to Build MVP or Beta? - <AUTHOR> https://tractific.com/blog/mvp-vs-beta <comment><USER2> An MVP is neither a video or a landing page. Neither of these are products but are marketing material.

An MVP, as the name makes rather plain, is the minimal whole product that you can build and actually sell.

So if you made a video or landing page and think the proposed product might have potential then you build and MVP as version 1.

A beta version is an immature version. You can launch a beta of your MVP or a beta of any subsequent version. A beta does not imply less features, it implies that the features it contains may still have a few development issues.</comment>