Chaff Bugs: Deterring Attackers by Making Software Buggier - <AUTHOR> https://arxiv.org/abs/1808.00659 <comment><USER3> Back in the olden daze, people would take branded software, overwrite the copyright notice, and sell the result as their own "compatible" version.

On my game, it would check to see that the copyright notice was intact. If it wasn't, it would, at random times, overwrite a random byte in memory with a random value. The idea was for the "rebranded" game to appear to be uselessy buggy.

I have no idea if it was effective or not. Probably not.

<comment><USER4> It reminds me of the old "protection" in Settlers: when using an illegal game everything would work as normal except the iron smith would produce pigs instead of iron bars. That'd be surely missed by early crackers but definitely not by users.

<comment><USER5> Earthbound had a particularly punitive bit of hard-to-notice copy protection - it would be exactly identical up until right before the final boss, and then immediately crash and delete your save.

At which point it isn't so much copy _protection_ , but copy ... karmic punishment?

</comment></comment></comment><comment><USER6> The idea is quite fascinating and 'out there'. However, the authors themselves cover several clear drawbacks on the second page:

> We assume that the attacker has access to a compiled (binary) version of the > program but not its source code. Although this is a severe limitation (it > means that our technique cannot be used to protect open source software), it > is a necessary one. Developers are unlikely to be willing to work with > source code that has had extra bugs added to it, and more importantly future > changes to the code may cause previously non-exploitable bugs to become > exploitable. Hence we see our system as useful primarily as an extra stage > in the build process, adding non-exploitable bugs.

I wonder if running software through this additional build step would also cause headaches for developers debugging and triaging real bugs in the software.

</comment><comment><USER7> This could be a viable direction but I have some concerns. I feel it will simply push attackers to be selective and it will be difficult for these techniques to avoid standing out. For example, consider their technique of making things non exploitable by overwriting unused variables. What's to stop adversaries from prioritizing which bug to investigate based on profile data counting uses of variables? Now these chaff bugs need to somehow match the dynamic use counts of real variable. What about the over constraint? Well the authors point out that attacker's can use SMT solvers to determine that a bug is safely constrained. They propose spreading out the constraining to force the attacker to reason about all paths. Again, Nothing stops the adversary from profiling the memory regions to learn what constraints are being applied followed by prioritizing the least constrained regions.

While clever in that it tries to use fundamental limits of reasoning against the adversary, I need more experimental analysis before I am convinced that these chaff bugs are actually indistinguishable to an attacker unless they truly collect profiling data that is exponential in size of programming paths.

I think that a few runs would suffice to distinguish the chaff bugs and real bugs.

<comment><USER8> I think you're missing the point here: the exploitable bugs in their nature will exist forever. As you are either giving up the Turing-completeness, or are allowing them to possibly exist.

Just like it were in 2000s: the fight between the people who were capable of unpacking the executables from their respective defensive mechanisms and the people who implement various mechanisms of obfuscating the executable.

For example: online en/decryption of the code, or the later stages of this concept implemented first in Assassin's Creed, where the servers would store various connecting components between stages of the game. So you would need to reach point A under constraints C1 and C2, before the server would tell you what follows A.

My point is, you can't take defensive mechanisms implemented in software at their extreme. Simply because of Turing-completeness. The moment we've got the tools that could, under a certain amount of constraints, prove that you can never execute any code that have not been compiled into the executable - <USER2> the moment when we don't actually need to develop any new software to defend ourselves.

<comment><USER8> There's another addendum to this: an another issue that is incredibly relevant to software per se.

Most of the time when we build software, the only source of truth, that defines the way a given software must behave - is it's own source code.

Thus even when we can prove for sure, that the source code that is being executed is the source code we had just written - we might be missing the cases when we were the ones responsible for introducing the behaviour that we ourselves had not expected.

I think the only way to fix that is to introduce even more constraints on the already built system.

We use exactly the same mechanics in out legal systems: while there's a single source of truth for most of the laws - there's always the court that checks every single day, if these laws still hold true for a given moment in time, or if they hold true for a given specific scenario.

I believe a set of closed-source tests provided by different providers for open-sources software, for example - could work really well. E.G. every time you push a new commit to nginx repository - there's organisations A, B and C which would also report their independent findings on the possible exploitation of the new code.

Those findings do not need to be aiming for the same bugs. One of them might be more people-oriented, and another one would be incredibly technical, reaching for the bugs that happen due to compiler design.

</comment></comment></comment><comment><USER9> "Half the electronic engineers in the galaxy are constantly trying to find fresh ways of jamming the signals generated by the Thumb, while the other half are constantly trying to find fresh ways of jamming the jamming signals."

</comment><comment><USER10> One could think of this as a whitelist for allowed flow control paths.

This "optimization" is analogous to the same technique.

[https://fgiesen.wordpress.com/2012/04/08/metaprogramming- for...](https://fgiesen.wordpress.com/2012/04/08/metaprogramming-for-madmen/)

[https://news.ycombinator.com/item?id=7739599](https://news.ycombinator.com/item?id=7739599)

Control Flow Integrity should be built into modern processors.

</comment><comment><USER11> Imaging having a bug in your software that introduces bugs. Instead of introducing new non-exploitable bugs, it introduces exploitable ones.

This would probably be a nightmare to debug.

</comment><comment><USER12> The game Earthbound for SNES had code that detected if it was pirated or not.

If the game knew it was pirated, it would still quietly run... But it would make the enemies so difficult and powerful that you could barely get out of the first town or even enjoy the game.

Oh and as a bonus it would delete your whole game right before the final boss.

</comment><comment><USER13> Vaguely reminiscent of Ron Rivest's chaffing & winnowing scheme for secure communication from twenty years ago: [http://people.csail.mit.edu/rivest/chaffing-980701.txt](http://people.csail.mit.edu/rivest/chaffing-980701.txt)

</comment><comment><USER14> Is this a just a honeypot or a variant of one where you lead the attacker to believe they've succeeded, instead of actually making them succeed with an actual bug that leads nowhere?

<comment><USER15> It sounds like you just overwhelm them with dead-ends so they don't have the resources to exhaustively search for the things that aren't dead ends.

</comment></comment><comment><USER16> Alternate subtitle: "Complicated method of shutting down your bug bounty program"

</comment><comment><USER17> Interesting idea, but the article greatly downplays the dos angle. Most applications consume fair amount of resources to start up - there are config files to parse, caches to warm, and so on. So there is an imbalance of cost between an attacker, who has to submit another input, and target,who has to restart the process. Hence a great dos angle. Pooling only helps if you can replenish the pool faster than the attacker can drain it.

So if you running a multi-tenant service, where one of the tenants could be a potential adversary, having a crash-bug is enough for a serious denial of service attack.

<comment><USER18> Yep, there are plenty of applications where crashing is a big deal! But, we think, also plenty where that's not an issue. Note also that the "unused" strategy creates bugs that don't cause crashes (but they could be detected with something like ASAN).

</comment></comment><comment><USER19> Chaff bugs like something from WW2 is a valid technique of obfuscation, provided it doesnt eat into the time and money of the key revenue making activity. Whilst equates, libraries and OOP can reduce the incidence of bugs, perhaps the whole method of coding is flawed from the off? If you can abstract the code enough, you can reduce the incidence of bugs by many factors, but there is only one IDE/language I know of which seriously reduces the incidence of bugs and thats called Clarion by Softvelocity. Its old school (dos) DB orientated but the templates reduce the incidence of bugs but in my experience coders cant get their heads around the abstract nature of the templates. The templates not only give you standardised coding (in any language if someone wants to invest in developing templates for other languages), this means its easy to write programs which can rehash some of the exported app & dct code. In turn every customer/end user can have an identical in function but unique in code and thus hashed EXE to run on their own systems making the exploitation of bugs even harder. I think templates put most programmers off, but its the crown jewels for taking most business systems to the next level.

</comment><comment><USER20> I still like what 3d studio Max did in the 90s. The gradually degraded the polygon of a model over the course of months when a pirated copy was detected. The other funny one was with Adobe and technical support..."sorry but there was no Photoshop 4.5.1, and now we know you are pirating our software"

<comment><USER21> I don't think vandalizing users work is the same as making a game buggy to take it to the extreme what if windows if it decided your key was illegitimate decided to corrupt your files.

You could say they had no obligation to you since you didn't pay for the software certainly they have no obligation to run for example or not to crash or lock the user out but it seems like once you start destroying user data you are violating the users rights to their own property.

<comment><USER20> I disagree, you had no actual right to create the property in the first place. It's like trespassing and the actual owner grabbing a dumpster and cleaning out your stuff.

Literally the user has no rights in that case.

<comment><USER21> Property rights including intellectual property rights don't attach to the tools used to create them. This is why your drawings aren't copyright bic and bram moolenaar isn't a billionaire.

What property rights do attach do is clearly peoples physical property with precedent going back thousands of years before we dreamed of copyright. By extension the files on said property ought to be secure against vandalism courtesy of more recent rules.

Believing that a running application on another persons computer transforms their physical property into your property requires magical thinking. The IP right is an orthogonal issue that has no bearing on their right to their own machine and their own files.

Its as if you stole my pen and went on to write a manuscript and I broke into your house and burned it.

Both acts are orthogonal and the ethics don't intersect in the wholly magical way you imagine. I would owe you one pen or the money to buy one and I would owe you for your manuscript plus owe the country for the crime of breaking and entry or in this case inappropriate access to a computer.

</comment></comment></comment></comment><comment><USER22> If you can provable show that the bug is non-exploitable, then can't the attacker?

<comment><USER18> This is why the bugs are made non-exploitable by _construction_ rather than by doing a bunch of work to show they're non-exploitable. There's an information asymmetry at work: the injector can craft all bugs in such a way as to ensure their non-exploitability, but the attacker has to laboriously prove the non- exploitability of each one.

</comment></comment><comment><USER23> i feel so bad for security researchers trying to actually make software better when meanwhile stuff like this is being worked on.</comment>


Show HN: DotSauce Domain Club - <AUTHOR>

I've just launched the DotSauce Domain Club, a membership website for domain name investors of all experience levels.
The main selling point of premium membership is in being able to purchase a monthly allotment of quality .com domains for just $19 each. Members can then resell these domains for considerable profit. Details on this offering probably need to be more prominent in my copy.
I'm eager to hear any suggestions and field any questions from the HN community. Specifically, I would like to know how I can make this endeavor a success. Also, do I need to publish the entire inventory for all to view?
Launch Announcement: http://www.dotsauce.com/2011/02/17/introducing-dotsauce-domain-club/
Features and Pricing: http://www.dotsauce.com/signup
Thank you in advance for your feedback. <comment><USER2> This makes no sense to me. If it's really possible to "resell these domains for considerable profit" then why aren't you doing it yourself? Or, if it's not, then surely you're just preying on the greed and gullibility of those who sign up?

<comment><AUTHOR> I am an experienced domainer and am able to acquire new quality domains on a regular basis. I'm also very busy with manging the publication, DotSauce magazine and other projects.

I wish I could sell domains full time, but I have other commitments. It takes time to market and promote domains and sales don't exactly happen over night.

There are sample domains shown on the signup page. I think it's fairly obvious good keywords and brands are worth more than $19. It's not so far fetched to think someone could resell for much more.</comment></comment>


Show HN: Kempressor - Compress text with bad kerning - <AUTHOR> http://fancyham.com/kempressor/ <comment><AUTHOR> "It's like JPEG for text"</comment>


Why is Atom closed source? - <AUTHOR> http://discuss.atom.io/t/why-is-atom-closed-source/82/9 <comment><USER2> As far as I'm concerned GitHub is free to handle the licensing of their software however they like, but this opens up an interesting thought experiment:

We now have at least two companies making significant Chromium-based editors, one is Adobe and the other is GitHub.

One of them is developing the core of their editor technology using a fully open-source model (hosted on GitHub, naturally) under a well-understood and widely accepted license, the other isn't (or at least isn't currently planning to).

2 years ago, who among you would have guessed correctly that the one whose editor was open source would be Adobe's?

<comment><USER3> Adobe's Bracket front-end editor is open-source, yes, but does it have any traction? I have yet to hear any front-end developer friends who even bother to use it in any capacity other than testing it occasionally. I tried it a few times and couldn't justify why I'd want to use it over Sublime Text.

Historically, it appears that closed source front-end editors like Textmate, Sublime Text and others find more success and usage in the market than open- source front-end editors.

<comment><USER4> "Historically, it appears that closed source front end editors like Textmate, Sublime Text and others find more success and usage in the market than open- source front end editors"

I wouldn't classify Sublime Text as a front-end editor. When I think of front- end editors, I think of Coda, Espresso, and Brackets. Sublime Text is better compared to Notepad++, Notepad 2, Gedit, SciTE, Emacs, and Vim, which are all open source software and extremely popular.

If you're going to market your text editor as hackable and as flexible as Vim and Emacs [1], it's not a stretch for the developers interested in your product to assume it's going to be or should be open source software.

[1] [http://blog.atom.io/2014/02/26/introducing- atom.html](http://blog.atom.io/2014/02/26/introducing-atom.html)

<comment><USER5> Better than VIM? What do you say that?

<comment><USER6> I think he meant useability (by a newbie).

<comment><USER5> I have yet to find an editor that makes me more productive than VIM.

<comment><USER7> While I love Vim and agree that it's probably the most extensible editor available, trying to explain its idiosyncrasies to a new user could take quite a while. Trying to explain why you can't just grab your mouse, highlight a line, and cut it and paste it somewhere else in the document would probably lose a person. "Hey, you're going to want to find the text, go into visual mode, select it, hit :m38 to move it to line 38... "

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I guess the target market for Atom is those that already use a closed editor like textmate or sublime.

As an emacs user, I would be pretty happy if someone came along, took the super extensibility of emacs (which at first glance atom appears to do) and spun up a sexy, modern, not-lisp-using alternative. The thing is though, my number one priority for a text editor is that it's under a Free Software compatible license. This is simply not a negotiable point for me personally.

I honestly find it pretty amusing that despite the fact technology progresses at such a rapid rate, I'm using a text editor that was first developed a decade before I was even born.

<comment><USER9> Why not Light Table? It's released under a GPL license [0] and seems to very much be going for "super extensibility". Granted, it does use _a_ lisp, but ClojureScript is pretty nice.

[0]: [https://github.com/LightTable/LightTable/blob/master/LICENSE...](https://github.com/LightTable/LightTable/blob/master/LICENSE.md)

<comment><USER10> I'm an Emacs user and I've evaluated lighttable. I like a lot of what I see, but for now it's lacking some pretty fundamental user interface concepts that are critical in making an editor that's optimized for the long-term user and not just for the newbie.

For example, if I need to move my hand over to the mouse to do some common action, that's not ok. If I even have to move my hand over to the arrow keys, that's seriously suspect.

I would also never use the native OS file open dialogs for the same reason. It's fine to offer them of course. But anybody who's trying to get fast and proficient will rapidly move beyond them. For this, lighttable offers workspaces & the navigation pane, which is still really primitive compared to ido-mode (poor keyboard navigation, no tab completion of partial names, no ability to jump beyond a single, pre-created workspace).

</comment></comment></comment><comment><USER11> Closed source? Why hack it then? Why waste the effort to learn it or customize it?

It's kind of like the new/gnu reality, where the GPL, designed to protect the authors from commercial exploitation, makes this exact exploitation easier than less restrictive OSS licenses...

Making money off a text editor is going to be hard. Especially when it is meant to be hackable.

<comment><USER12> For an excellent description of another instance of this sort of issue, see [1] about Canonical and Mir.

Github seems to have things pretty figured out: they have a closed core that they control, with a veneer of hackability, and a lot of hype. You then get people to work for you for free by having them create plugins that, while open source, are effectively controlled by Github, Inc.

The key thing is to make people _feel_ that they're contributing to a community, even though that community doesn't really have ownership of the work. By the time the tension between the community's needs and Github's needs comes out, you've already locked everyone into your ecosystem.

Other notable instances of this phenomenon include the MAGMA computer algebra system, and the creation of SAGE (see [2]).

[1]: [http://mjg59.dreamwidth.org/25376.html](http://mjg59.dreamwidth.org/25376.html)

[2]: [http://sagemath.blogspot.ca/2009/12/mathematical-software- an...](http://sagemath.blogspot.ca/2009/12/mathematical-software-and-me- very.html)

<comment><USER13> Interesting story of SAGE here. What happened to it? Nowadays it seems that numpy/scipy has more users and community attention.

<comment><USER12> SAGE is still going very strong.

numpy/scipy have very many more users, but I don't think that they're really comparable: they're aimed at numerical computation for science, while SAGE aims to be a do-everything tool for mathematics. All of scipy/numpy is actually included in SAGE, and you can interoperate between numpy stuff, and, say, exact rational arithmetic, or group theory, etc.

<comment><USER14> And you can use R and Octave in a worksheet, too, but my understanding is that the point of SAGE is much closer to a superset of the types of functionalities that you find in SymPy. That is, that it is meant for symbolic manipulation.

</comment></comment></comment></comment></comment><comment><USER15> I think a lot of people were expecting it to be open source.

I don't have access yet to try it to see how it compares in terms of speed and feel. That said, this information seems to put it more in the category of a reimplementation of Sublime Text with a different tech stack and a much bigger company backing it.

</comment><comment><USER11> For me it just sounds like a stupid move. I might not have all the details, and I might be missing something. But I would expect some lone programmer or small team to try and commercialize a text editor. In some very rare cases a text editor today might be profitable for a very small team, because of people to afraid of VIM (vimps...).

I would not have expected a bigger and more modern company like GitHub to try and make money off a text editor. It's like building an inferior mouse trap in a world of open source mouse traps. So how this strategy unfolds will be interesting to watch!

<comment><USER16> I feel like a still-bootstrapped GitHub would have made Atom free and open source and used it as another tool to reach more developers, especially new ones.

But alas, they raised $100M and are probably feeling pressure to find new revenue streams.

</comment></comment><comment><USER17> The interesting thing is that they would accept pull requests (presumably from the devs they offered that "restricted" access), but might not share the profits from charging for atom.io.

Food for thought.

<comment><USER18> Disclosure: I'm a founder.

You may be interested in what we're doing over at Assembly: [https://assemblymade.com](https://assemblymade.com). Open source products that share profits between contributors.

<comment><USER17> This does look very interesting. Do you have any stats available, or is everything too new?

I'm just wondering if a developer could make a decent monthly living by working 40hrs/week on different projects.

Also, what happens if one of these projects wants to break out and go for VC money? Is each contributor's stake a legally binding "share" of the app?

Lastly, who owns the idea, in a legal sense? Would Assembly receive all revenue and distribute it, in which case it's logical that it would receive all ownership of ideas?

</comment></comment></comment><comment><USER19> I'm a little confused why Atom isn't free. It certainly couldn't be a major revenue stream for GitHub, which has major investment. I thought this was going to be a project to drive usage, like Chrome for Google, but I guess I was wrong.

<comment><USER20> Or does not freeing Atom mean that Github is not getting enough revenue from hosting? (Eek, are they dying? Should we move our stuff off to other services? =P)

<comment><USER21> Git is a distributed VCS though. It wouldn't really matter unless your only copy is on Git and isn't cloned anywhere. (In which case, set up a remote repository on Bitbucket/wherever)

If you're relying on GitHub for Issues/Wiki, then fair enough I suppose. Not as easy to get that data somewhere else.

</comment></comment></comment><comment> vezzy-fnord Of course they use the term "closed source" instead of "proprietary" because it sounds less scary.

Seems like they want to implement one of those Microsoft "shared source" models, which still count as proprietary.

</comment><comment><USER22> I expected better from GitHub, disappointed!

<comment><USER23> Why did anyone expect this to be open source? I don't understand this entitled attitude at all.

<comment><USER11> For one thing because Git is open source, and who would expect a profitable open source company to attempt to commercialize an html5 text editor?

<comment> vezzy-fnord GitHub itself is proprietary. Don't confuse the DVCS with the software hosting service that made it popular.

<comment><USER11> GitHub is based around open source software. Ruby on Rails, Git, various other tools in deployments. Working inside open source browsers mostly. Breathing the open source community on its site.

For me, GitHub is an open source company even if they don't open source all of their code...

I don't equate git with github, I just don't like bloating my posts with too much nitpicking.

<comment> vezzy-fnord A ton of companies are based around open source software. That's kind of the beauty of it. It has enabled the proliferation of businesses and has sped up innovation.

But by your logic, the NSA must be an open source government agency. After all, the Snowden leaks revealed that their technology (including XKeyscore) is built on open source software.

"Working inside open source browsers mostly."

Every website and web application is open source now? If you can find a way to arbitrarily lift server-side code from any web application, you'd be hailed as the next technological messiah.

No, GitHub using open source software does not make their platform open source. They do give back to an extent, sure. But that's hardly anything to celebrate by itself.

<comment><USER11> I did not say their platform is open source. I did say instead that the character of their main business puts them firmly in the open source space. Not even counting their own github account with open sourced software they created...

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Don't they know that if you want to open source something but don't want any contributors you're supposed to use GPL v3 with a CLA?

</comment><comment><USER25> As I recall, Github was making money from day one, and has been profitable for nearly as long. I'm sure that fact has contributed significantly to the quality of their products thus far.

The business model around a desktop application is bound to be different from the web services, and probably isn't even finalized yet. I'm just looking forward to trying it out to see if I like the editor or not. That bar is high enough, given that I'm pretty comfortable with my workflow as it is. To expect that something this new will be polished enough to make me alter my day-to-day process, but do so without _any_ viable business model, seems rather unlikely.

A free/open version would be great, but I'll feel better about adopting it if the project is clearly profitable.

</comment><comment><USER26> This is a little off topic, but I _really_ like the discuss.atom.io forum platform. Snappy, intuitive, clean. There are a few visual subtleties that would make reading large blocks of text difficult, but seem well suited to the short lengths of most comments (text is #333333, lines are spaced extra far apart).

Looks like Jeff Atwood is still creating great products. I even felt a nostalgic whiff of his Microsoft infused sense of style (the <code> font- family is "Consolas, Menlo, Monaco, "Lucida Console", "Liberation Mono", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Courier New", monospace, serif", in that order)

</comment><comment><USER27> So it can never be forked?

<comment><USER28> The one GitHub project that can't say "fork me on GitHub".

</comment></comment><comment><USER29> Expected that they need to make money with it. But then, how is it different from cloud9 ? ([http://c9.io](http://c9.io)) I thought they would try to have it open source (as it's non-core to their business) and use it as a trojan horse to sell more private repos.

But they could do that with free to use I guess. And it makes sense, then no one is allowed to removed the github-as-a-backend part, and people have to get the paid plans to develop closed-source software.

<comment><USER30> It's nothing like c9.io. Atom is a desktop app and relies on Node's FS modules...

<comment><USER29> It is. But my guess is that it will work on both desktop and web. We'll see.

</comment></comment></comment><comment><USER31> I am not sure about why so many people are surprised. Although GitHub promotes open source, it's not open source itself. And it's fine. At the end of the day, GitHub is a company. They need money to do the great things it does.

While Open Source is great and it's contribution to the world is amazing, we shouldn't forget that it's a small niche thing, if we are talking about % of programmers contributing.

<comment><USER10> > I am not sure about why so many people are surprised.

Because the whole premise of this editor is that it's "hackable". It isn't truly hackable if it isn't truly open source.

<comment><USER32> I interpreted "hackable" in this context to mean "personally customizable". Even if it's closed-source, that doesn't preclude an extension/library ecosystem from forming around the core Atom app, does it?

<comment><USER10> Except we would all be stupid to invest a lot of effort into said ecosystem when Github can pull the rug out from under it at any time, and Github will be the only one monetizing it.

Those of us who've been around longer have seen this play out many times. Free software isn't just dogma, it's very practical self-defense.

</comment></comment></comment></comment><comment><USER33> It sounds like they might be planning to charge for the software, include (limited?) access to the source with purchase, and put a no-derivative-works- or-redistribution clause in the license.

Actual FOSS would be nice, but non-free software + source still beats regular closed-source proprietary software.

</comment><comment><AUTHOR> Interesting to hear. Not sure how this half-open/half-closed source will work. Something like Red Hat? Then what about a CentOS equivalent for Atom?

<comment><USER34> This is a lot more like Android, where the code itself is open but the core services which make it useful are hosted and not open.

<comment><USER35> Nah, Android is the other way around. The core Android platform (the AOSP) is free software, but the Google services are proprietary.

This looks like they're going to allow people to view the source code, but not actually use it. My impression is that it would be similar to Assembla's not- really-open-source license [1]

[1] [https://www.assembla.com/wiki/show/breakoutdocs/Singleton_De...](https://www.assembla.com/wiki/show/breakoutdocs/Singleton_Development_License)

</comment></comment></comment><comment><USER36> No matter what they say, no matter what you say, and no matter what reason itself says, it is eminently comedic that _GitHub!!!_ would do a project that isn't plain open source.

As to why Atom, I'd bet this was something one or two senior guys just had an itch about, and they sold the project.

<comment><USER37> Really? The main source of revenue (GitHub.com) isn't open-source either, companies are free to promote open-source whilst being entirely closed and proprietary, GitHub releases _almost_ everything freely, and encourages the same – there's no hypocrisy that I can see.

There are some reasons that not everything is open-source here: [http://tom.preston-werner.com/2011/11/22/open-source- everyth...](http://tom.preston-werner.com/2011/11/22/open-source- everything.html)

<comment><USER38> Making it free and open source, with great GitHub support as well, would also be a good strategy :)</comment></comment></comment>


OpenWrt 19.07.2 down load and Release notes - <AUTHOR> https://openwrt.org/releases/19.07/notes-19.07.2 <comment><AUTHOR> Download link for 19.07.2 is here. [http://downloads.openwrt.org/releases/19.07.2/](http://downloads.openwrt.org/releases/19.07.2/)</comment>


Knot DNS: A high-performance, authoritative DNS server - <AUTHOR> https://lwn.net/Articles/606968/ <comment><USER2> The authors of this are CZ.NIC (whose website is confusingly [http://nic.cz](http://nic.cz)). They're the same people behind the thoroughly awesome Turris Router ([https://www.turris.cz/en/](https://www.turris.cz/en/)). The complete hardware design for this device is open and I can vouch for it being a very awesome bit of kit.

The benchmarks for the DNS server are very impressive. Way beyond our needs though: we're doing a few hundred million queries per month, so ~100qps. Knot handles >500k qps! We've recently switched our authoritative DNS from djbdns to gdnsd ([https://github.com/blblack/gdnsd](https://github.com/blblack/gdnsd)), primarily due to the GSLB features.

Lots of great stuff coming out of CZ.NIC - if you're reading this, keep it up!

<comment><USER3> re: Turris Router

Freescale P2020, 2GB Ram, 16MB NOR Flash (the stuff the CPU can directly execute from, ty), 256 MB NAND Flash (the stuff the CPU has to copy to RAM before executing), 4xGigabit LAN, Wifi N w/ 3x3 MIMO... All driven by OpenWRT. Awesome!

But what's their wifi chip? They don't mention it in their spec page, and I can't identify it in the schematics. I suppose it's a miniPCIe card?

<comment><USER4> Yes, it's [http://www.unex.com.tw/product/dnxa-h1](http://www.unex.com.tw/product/dnxa-h1)

</comment></comment></comment><comment><USER5> I just install djbdns everywhere. I have more confidence in djbdns not coughing up a shell on my machines than any other server.

DNSSEC, by the way, is a bug and not a feature.

<comment><USER6> But what about IPv6 records or DKIM/SPF TXT entries? It is hell to maintain more than a couple of these records for djbdns. I had to use an online tool every time to help me convert my entries to tinydns format.

I switched to PowerDNS mainly for this reason.

I remember that djbdns had some other quirks too. Like I had to setup a supervisor to run it (no integration with the init system), I had to run one instance for IPv4, one for IPv6 and one for IPv4 zone transfers. Also it didn't support zone transfers over IPv6.

Maybe all these have been fixed, it is a couple years since I last used it.

<comment><USER7> I've written a library in Scheme to generate my tinydns configuration from a functional program. It includes error-checking, IPv6 and SPF support (haven't used DKIM yet). I might clean it up and publish it if there's interest.

<comment><USER8> there is at least one person who is interested :-)

<comment><USER7> Ok, I'll publish it as soon as I can at

[https://github.com/pflanze/tinydns-scm](https://github.com/pflanze/tinydns- scm)

I'll send you notification when done if you give me your email (you can contact me at the URL in my profile). (Or supposedly you could "watch" the Github repo above for similar effect.)

Edit: the functionality on Github to get notifications is "watch", not "star".

</comment></comment></comment></comment></comment><comment><USER9> Two unrelated questions. Why would I prefer this over NSD?

Are ragel parsers really 100x faster than bison parsers? Off hand, that seems atypical and more likely the result of other changes.

<comment><AUTHOR> > Why would I prefer this over NSD?

Don't drop NSD, it's a cool piece of software and folks at NLnetLabs are our friends :). My advice would be to run at least two different pieces of software in any deployment since any software can have bugs. See this very nice presentation by Anand Buddhdev from RIPE NCC about their DNS infrastructure: [https://ripe68.ripe.net/presentations/284-AnandBuddhdev_RIPE...](https://ripe68.ripe.net/presentations/284-AnandBuddhdev_RIPE68_DNS_Update.pdf)

> Are ragel parsers really 100x faster than bison parsers?

I wouldn't say that generally, but it's true for our _zonefile_ parser. (Or maybe the bison parser we had sucked that hard :)).

> Off hand, that seems atypical and more likely the result of other changes.

Probably, but those changes came hand in hand with the change of the parser generator.

</comment></comment><comment><USER10> Still a big fan of maradns if you need something simple and fast.

And Deadwood if you just need a resolver cache.

<comment><AUTHOR> No EDNS0 (with DNS-over-TCP defaulting to off), no DNSSEC? This is very very sad reading.

But hey, if it works for you, then no worries :).

</comment></comment><comment><USER11> It's nice that they have tests. Not enough tests to back up all their claims about standards compliance and interoperability, but more tests than most of these open source hacks have, which is none.

<comment><AUTHOR> > It's nice that they have tests.

Thank you.

> Not enough tests to back up all their claims about standards compliance and > interoperability

As a part of each major release testing we replay a terabytes of real traffic to be sure we don't miss some bits. It's not 100% proof, but it's better than nothing, right?

</comment></comment><comment><USER12> I like nic.cz because they are utilising dnscurve.

But when I try to compile knot it demands a lot more resources than compiling djbdns (tinydns), or nsd. A bit too much IMO.

There is some amusing djb-phobia in this thread. Reminds me of djb-bashing from years gone by. Always good for a laugh. Time has shown the wiser.

Despite many early detractors (for reasons unknown), his software is still going strong without major flaws while the popular alternatives (who are often grubbing for consulting bucks) have suffered embarassment after embarassment because of poor design and sloppy coding. Unlike the usual bloated crapware that needs to be fixed/upgraded umpteen times (how is this ever a sign of quality?), his stuff is rarely if ever updated. Because it does not need to be. It just works. And keeps on working. In recent years it seems to me his work (crypto-focused) is now gaining more widepsread popularity. Never thought I'd see it in something like OpenSSH.

I use djb programs daily, from qmail to daemontools to ucspi to sntpclock to cdb. All very reliable. I wish there were more authors who could do what djb does. a@kx is another one I admire, but k is not open source. I think my favorite aspect of djb software is how cleanly it compiles, no matter what system I've got. His more recent packages do not even use make!

Anyway, if the guys behind knot can get it to compile as cleanly and easily as tinydns (or even nsd), I'll give it another shot. But methinks I should not need GB's of RAM or some hugh swap space to compile a simple authoritative dns server. Simplicity is paramount. To me, anyways.

I may have to get one of these Turris routers. Nice work.

<comment><USER13> _I like nic.cz because they are utilising dnscurve._

Unless I misunderstand you, unfortunately this is not the case. A quick way to check if a domain supports authoritative DNSCurve service is to do e.g.

$ dig +short ns dnscurve.org

You'll see labels that begin with the magic string "uz5" followed by a Base-32 encoding of a Curve25519 public key.

Unless you meant something else?

I agree with your post though. I also use tinydns, but with CurveDNS for DNSCurve support in front. They just work!

<comment><USER12> Please accept my apolgies - I was mistaken. I was thinking of dnscurve.cz and extrapolated this to conclude that nic.cz was dnscurve-friendly. But we now know this is not the case. They do not view it as being worthy of adoption as a "standard". Sad.</comment></comment></comment>


JFK Files – Extracted - <AUTHOR> https://jfk.fork.run/ <comment><USER2> A useful reference while reading:

[https://www.maryferrell.org/php/cryptdb.php](https://www.maryferrell.org/php/cryptdb.php)</comment>


My tmux setup - <AUTHOR> http://www.unwiredcouch.com/2013/11/15/my-tmux-setup.html <comment><USER3> I can't recommend Pragmatic Bookshelf's book on tmux enough: [http://pragprog.com/book/bhtmux/tmux](http://pragprog.com/book/bhtmux/tmux)

It's got the whole thing covered end-to-end if you ever wanted to get around learning it.

<comment><USER4> Author of that book here. Thank you for the kind words.

<comment><USER5> Reader of that book, you finally got me to kick my screen habit with it and now I have a new tmux addiction.

That said, tmux is way easier to use compared to screen. And with 1.8 and text reflow it pretty much has every feature from screen I ever wanted/needed/used.

<comment><USER6> I also love the new zoom pane that comes with 1.8 prefix <c-Z>. It comes very handy!

<comment><USER7> Is there an option/way to have "lables" in panes. Just like you have a info bar for windows, I would love to label my panes. Normally have a bunch of panes setup for logs, and it would be really nice to label them so i could tell what is in each pane.

<comment><USER6> not that I know of. panes have numbers windows have names afaik but I might be wrong.

</comment></comment></comment></comment></comment></comment><comment><USER8> For the vim lovers, this trick is quite good :

      unbind [ # free the weird binding
      set-window-option -g mode-keys vi # switch to vi bindings
      bind Escape copy-mode # ctrl-a ESC put your pane in a kind of vi normal mode
      bind-key -t vi-copy v begin-selection # start a visual select mode with v like in vim
      bind-key -t vi-copy y copy-selection # yank with y
      unbind p # free another weird binding
      bind p paste-buffer # paste with crtl-a p

<comment><USER9> How is p a weird binding? It's a pneumonic for "previous" and works the same as it does in gnu screen, which is tux's "competitor."

<comment><USER10> > It's a pneumonic for "previous"

I'm guessing this is autocorrect, but an autocorrect that knows 'pneumonic' (the Firefox spell-checker doesn't!) but not 'mnemonic' seems even less likely than a _person_ who knows the first word but not the second.

Anyway, 'previous' is perhaps less likely to spring to mind than 'back' or 'reverse' or even 'last', each of which would have different mnemonics. ('Last' has a particularly good mnemonic if you keep your hands to the Holy Home Row, which is why vi users, who are most likely to worship at the Altar of the Home Row, can't use it.)

<comment><USER11> previous is unambiguous. Last is extremely ambiguous. Last = Nth element or current -1? Similar with back or reverse. Previous means N-1 every time. Also it's a pretty commonly used programmer idiom.

</comment></comment></comment></comment><comment><USER12> I've used tmux so much in the past... so much that the only thing that my OS would do is run tmux ;-) So I've decided to use a different window manager: StumpWM. So, in a nutshell, all my window manager is now a big tmux - and I run browsers fullscreen in some screens. That's the best coding setup I've ever had.

</comment><comment><USER13> Love tmux

Here is mine - [http://dhaiv.at/dotfiles/](http://dhaiv.at/dotfiles/) I use ` (backtick) as my escape key, that makes jumping between windows just a double tap on `

`+" to list all windows, really handy.

`+| to split vertically

tmux.conf for interested [https://github.com/ceocoder/tmuxrc/blob/master/tmux.conf](https://github.com/ceocoder/tmuxrc/blob/master/tmux.conf)

</comment><comment><USER14> I highly recommend byobu - [http://byobu.co](http://byobu.co) \- which front ends screen or tmux. It uses the function keys for switching around, gives a good status bar by default etc.

</comment><comment><USER15> The last tip on naming windows after remote hosts is nice! Now it'd be nice if we could run similar to ssh's LocalCommand on exit too. Turned out that I'm not the first to ask this: [http://unix.stackexchange.com/questions/40899/ssh- localcomma...](http://unix.stackexchange.com/questions/40899/ssh-localcommand- on-exit) With workaround too.

The downside is that if go like ssh A then ssh B, display doesn't update. But I don't this too often anyway.

<comment><USER16> I spent a bit of time trying to figure out why it didn't work for me. Then why I couldn't even do the usual echo -e ... to change my gnome-terminal's title. Turns out I already had a PROMPT_COMMAND set to echo the last command into the title which was overwriting my changes.

</comment></comment><comment><USER17> We use a combination of tmux and mumble to get multiple remote-working coders all looking at one screen. It's very useful, even if we sometimes type over each other. It's also great when somebody has to give a demo but only the guy 3 states away can really get things configured properly--just fire up a shared tmux session!

</comment><comment><USER18> tmux is like that thing that you hear about quite often, that you think it's not that useful, but that, once you try, you realize why and where its fame comes from.

I adopted tmux about a month ago and I can't really complain much. It's just awesome. If you work a lot in the terminal (I do), I would highly recommend using it.

<comment><USER19> I did not switch yet. I use screen often, and each time I checked the diff with tmux it seemed to be the same thing with slightly different defaults.

<comment><USER20> I use screen quite a lot -- and with xmonad as my main wm, I really don't need many features from screen -- I just have one screen per terminal window.

A friend of mine uses OS X -- and there tmux comes more to it's right as there's no (Free) way to get sane (for biased values of sane) window management under OS X.

[edit: It might be worth noting, that after running into a lot of problems with unicode input and urxvt, I switched to sakura[1] for my terminal -- and it's basically a lighter gnome terminal that's easy to set up without any chrome. Under debian I bind that to my x-terminal-emulator alternative, and I can ctrl-enter to open a new terminal via xmonad (xmonad needs a short config to use x-terminal-emulator though).

[1] [http://www.pleyades.net/david/projects/sakura](http://www.pleyades.net/david/projects/sakura) ]

</comment></comment></comment><comment><USER21> How does that email script work? Here it is:

[https://github.com/mrtazz/bin/blob/master/imap_check.py](https://github.com/mrtazz/bin/blob/master/imap_check.py)

This looks for a file at ~/.netrc

What is the format of that file? Google results can't find this being used for email anywhere.

<comment><USER22> I'm using the netrc account field as an identifier on which I filter account info in the lambda function. More info about fields are here [http://linux.die.net/man/5/netrc](http://linux.die.net/man/5/netrc)

</comment></comment><comment><USER23> I've been using screen for years. It works well for me. Can someone list some reasons to switch to tmux? Just about the only thing which annoys me in screen is the awkward switch to "copy mode" to scroll, instead of just hitting PgUp.

<comment><USER24> no patching for vertical and horizontal splits (I know screen doesn't do one of them without a fair bit of work).

tmux isn't a dead project.

Spirit of exploration? I started with tmux and no screen experience, but I've converted a few people to tmux by them just giving it a chance, basically.

</comment></comment><comment><USER25> I found it helpful with z being the bind key. c-z c-z to switch windows. To send SIGSTOP, then ESC c-z. Checkout [https://github.com/carun/dot- files/blob/master/.tmux.conf](https://github.com/carun/dot- files/blob/master/.tmux.conf)

</comment><comment><USER26> Thanks for sharing! I was introduced to Tmux at work earlier this year. We used it primarily for remote pairing, but now I use it for anything and everything terminal.

</comment><comment><USER27> One of things I've been meaning to ask: do people who use tmux mostly run a windows machine as their desktop?

<comment><USER28> No. It is very difficult to get tmux running on Windows. Not impossible, mind, but not as simple as e.g. 'brew install tmux'.

<comment><USER29> recent post on using tmux on cygwin inside a mintty [https://news.ycombinator.com/item?id=6737795](https://news.ycombinator.com/item?id=6737795)

</comment></comment></comment><comment><USER30> glad to see love for tmux. I've been a user for 3+ years. Thank you nicm.

</comment><comment><USER31> Just this last week I was introduced to tmux, it's seriously awesome.

</comment><comment><USER32> jnycs: you have been hellbanned for no particular reason.

<comment><USER33> Probably getting his very first comment downvoted a bunch triggered some heuristic. jnycs: email firstname.lastname@example.com to appeal.

</comment></comment><comment><USER34> I have my prefix key as alt-j. Very convenient.

</comment><comment><USER35> I think this blog post needs some screenshots!

</comment><comment><USER36> >But the years of using screen have ingrained in my muscle memory to use ctrl-a

I still don't understand how this happened to so many people. Ctrl+a is already taken, how did anyone ever use screen without immediately changing it to something that doesn't conflict with a frequently used shell shortcut?

<comment><USER37> Indeed. I've been using Ctrl-\ as my Ctrl-a in screen (and occasionally tmux). Turns out that I _never_ use that keystroke in real life.

<comment><USER38> I've been using `

<comment><USER39> Same here. It's really hard to press if you don't swap Ctrl and Caps Lock though.

<comment><USER38> No key chords, just left pinkie, why would it be so hard?

<comment><USER39> My bad, I thought you meant Ctrl + `

</comment></comment></comment></comment></comment></comment><comment><USER40> Tmux is such a fantastic tool - its made a big difference to my work - <USER2> you and congrats to the authors.

<comment><USER41> Couldn't agree more. Switching and committing to tmux (and wemux for pairing) has helped immensely.</comment></comment>


Ask HN: Is RSS still worth the time? - <AUTHOR> I'm dealing with a project that lives through content and I was wondering if it's still worth the time to invest making some RSS features that someone suggested.
I honestly rarely hear about RSS. My idea is to build whatever users are asking and stop investing time in features that will go unnoticed but, since this is a young project, I might be wrong and losing something.
My question towards this community is...how many of you still use RSS to subscribe to content? <comment><USER2> I fear the day that RSS will become so unpopular that developers won't support it anymore. RSS is the basis of my information aggregation and is a necessity for me. It allows me to read news at my own pace and to get all the news with a backlog so that I'm sure I don't miss anything.

RSS allows me to go directly to an article without having to navigate through the website. Some websites (TheVerge comes to mind) have a pretty nice design, but make it hard to get an overview of all the news and you easily miss things. With RSS I know that when I start my client all the articles they posted will be there and they will still be there when I start my client next month. I can manually mark articles that don't interest me as read, but keep others for when I have more time.

I follow about 50 sites, so if I had to check manually if any of them had updates (often in various sections, because they don't have a main overview that shows everything) I'd lose way more time. It's also synced over all my devices. I use the Reederapp in combination with Feedly, and it syncs over my Macs, iPhone and iPad. I have a backlog of about 500 articles, some months old, imagine having to go through a specific site and scrolling back page after page after page to get to that specific article you saw the title of 2 months ago.

I wish more sites would show the entire article in RSS feeds instead of a short preview. I understand the advertising reasons behind requiring users to click through, but with RSS you have a plain article that's optimized for reading without all the distractions of a website.

<comment><USER3> RSS has largely become invisible. Many CMSs just support it, which is great if you use RSS, and irrelevant if you don't. Many RSS readers are flexible enough to find the feed if you point at a site's base URL too, so while that implicit contract is in place, life is good.

However, that very invisibility might prove to be its downfall: RSS is so incredibly useful to those who know about it that the only way to keep it going is for those of us who _create_ to ensure our platforms keep creating it.

I miss seeing that little orange RSS icon though.

edit: I also miss seeing Dave Winer comment on threads like this!

<comment><USER4> I just posted a long comment at the top level of this thread. ;-)

<comment><USER5> I just want to take a moment to hat-tip a legendary dev. I've heard of you at LEAST since MORE for the Mac rocked the sales charts when I was a teen (I also FONDLY miss Macworld Expos, attended a bunch of them!) Thanks for being an awesome nerd!

</comment></comment></comment></comment><comment><USER6> RSS is still the best tool out there for aggregating and curating written content on a personal basis. (One of) The reason you don't hear much about it is that it works and isn't sexy and breaks down walled garden monetization schemes.

</comment><comment><USER4> Without a doubt RSS is worth the time.

Think of RSS as an advertisement for the stuff on your news site or blog. If you don't publish RSS, how will people find your stuff? By visiting the home page of your site and looking for stuff they haven't seen before? Sure, some people will do that. But people who read your site systematically, people who you would think of as members of your community, can benefit from more automatic notification. That's what RSS is for. All kinds of networks have developed around RSS. If you don't provide a feed, your site can't participate in those networks.

Also, how do you think links make it to Twitter and Facebook? Very often they were posted by people who follow your site's feed. So while most people aren't aware they're getting their links from feeds, they are.

I'm not aware of how the plumbing works in NYC, but I live there, and depend on it. Water flows in and out. Treated on both sides. RSS is the plumbing for news. It's best when it just works without you having to even be aware of it.

Here's an example. Sometimes I get so interested in a subject I put together a river site dedicated to news in that area. Earlier this week I did one for Major League Baseball.

[http://mlbriver.com/](http://mlbriver.com/)

The vast majority of the sites I went looking for feeds on had them, and they worked with my aggregator. I didn't need to contact anyone. And now they have a new source of flow, that didn't cost them anything, since they were already supporting RSS.

<comment><USER7> Preach it from the mountaintops!

And Thanks so much for mlbriver. It will be a tonic for my seasonal affective disorder that I blame on the NBA and NFL seasons.

<comment><USER4> Glad you like mlbriver.com. I can't believe how it's expanded my knowledge of baseball in just a few days. It's been a long time since I got caught up. Too busy with other things I guess.

</comment></comment></comment><comment><USER8> I use Reeder/Feedly every day to keep up with a ton of different information sources. There's just too many interesting sources to manually check them all and aggregators like HN or Reddit can be hit-or-miss.

Edit: Something to consider is that the people who submit links to places like Reddit and HN are probably much more likely than the rest of your users to use some kind of feed reader. Even if feed subscription numbers are low, those few "power users" might have a disproportionate effect on how much your content gets shared.

</comment><comment><USER9> Let's just say that if it wasn't for RSS, I wouldn't have seen this page.

<comment><USER10> Neither would I.

</comment></comment><comment><USER11> I use The Old Reader to follow around 500 feeds. Basically all of them are blogs and sites that update less than once per week. I get a few new items per day into my reading list this way. I newer use feeds of news sites that have a lot of traffic, like HN. I visit those directly.

For me, RSS or Atom is the only usable way to keep up with rarely-updated sites. Twitter is too-fast moving, since it's very easy to miss interesting things in the noise. I don't like to use email because going through my inbox and acting on mail is very different from reading articles and blog posts and I like to keep them separate.

<comment><USER5> What's your opinion about bloggers that enjoy getting a bit of ad revenue from their posts?

</comment></comment><comment><USER12> Oh hell yeah. I love RSS and would not even consider any kind of content oriented project that didn't support RSS/Atom. If you believe that a decentralized / distributed Web is better than a centralized / walled-garden model, then RSS / Atom is a must.

Disclaimer: One of our products is heavily rooted in consume large amounts of content from RSS feeds and providing tools to help users filter/sort/mine that content to find the really useful stuff, etc. So I _do_ have something of a biased position here. But my position is truly as much ideological as anything.

</comment><comment><USER13> Please don't kill RSS just yet. Since the death of Google Reader, I've been using selfoss[1] actively to subscribe to news sources (HN is one of them). I can't live without RSS.

[1] [http://selfoss.aditu.de/](http://selfoss.aditu.de/)

</comment><comment><USER14> It's interesting that you asked that on the very same day that Github introduced a plug-in that automatically generate an Atom (RSS) feed from your posts on Github Pages: [https://help.github.com/articles/atom-rss-feeds-for- github-p...](https://help.github.com/articles/atom-rss-feeds-for-github- pages/)

RSS ain't dead!

</comment><comment><USER15> I prefer to use RSS and daily use a combination of Feedly and Reeder for iOS. I haven't found any better for keeping on-top of daily news.

I guess it depends on the content you're offering.

</comment><comment><USER16> I use an RSS reader (Vienna) and check it multiple times per day. I have, let's see, 28 active subscriptions in it. Most of them don't update often at all.

The best use case for RSS is if there's a source that occasionally puts out highly interesting content, on an unpredictable schedule. (This describes most of the feeds I'm subscribed to.) RSS (or something equivalent to it) enables you to not waste time checking it manually every day or whatever, while also being sure you won't miss anything when/if they do finally update. It's like switching from poll-driven to interrupt-driven I/O. I wish more things provided RSS feeds.

</comment><comment><USER17> Yes.

There isn't much buzz around RSS anymore, but there isn't buzz around telephony or email either, and yet all three technologies are still used every day by many people.

</comment><comment><USER18> I'd say it depends on your audience. If it's a technology-oriented site, RSS (or better, Atom... it won't make you tear your hair out nearly as much as the umpteen different versions of RSS, and most readers support it just fine) is going to be a win.

Spitting out an Atom feed really isn't that hard.

Edit: since it sounds like you have an existing feed, you could try going to some of the big reader sites (e.g., feedly) that tell you how many subscribers you have. For individuals using their own reader app, your server logs should give you an idea.

</comment><comment><USER19> Yes! I use theoldreader.com to follow around ~100 blogs/sites. RSS is particularly perfect for keeping track of sites that don't update often. I don´t use RSS to keep track of sites like HN/Reddit because their content is always changing rapidly.

</comment><comment><USER20> Every single day. It's how I get 99% of my news and other periodical written content.

Actually something will have to be extremely compelling for me to bother keeping up with it if it _doesn 't_ offer an RSS feed.

</comment><comment><USER21> I feel RSS/Atom feeds are still an extremely important way to subscribe to informational updates online - particularlly for news following/reading. I have always been hopeful for projects like Zone ([https://github.com/abouaziz/ZONE](https://github.com/abouaziz/ZONE)) to get more public interest, and RSS-social-reader products aimed at the facebook folks - such as [http://newsbae.com](http://newsbae.com), [http://popurls.com](http://popurls.com), [http://alltop.com](http://alltop.com), [http://skimfeed.com](http://skimfeed.com), etc - will raise awareness of the need for the public to still want this simple service to exist.

</comment><comment><USER22> I do. Search HN to find out how many people were disappointed by Google shuttering Reader, and how many people migrated to other services (e.g. Newsblur, which I use).

RSS might not be as popular as it once was, but it certainly seems very popular in the our demographic :)

</comment><comment><USER23> I arrived at this Ask HN through RSS.

</comment><comment><USER24> My RSS reader (digg reader) is my most visited site/app, far ahead of the social sites and only closely followed by gmail.

I would say that the people who do use RSS use it a lot. There might not be many left, but I'd say they would fit the "power user" category.

On the other hand, you might be able to skip building RSS features (idk exactly what kind of feature you were suggested) as long as you provide some kind of endpoint where people can plug ifttt and the like to get the same result (you can create the recipe yourself and advertise it)

</comment><comment><USER25> It's not dead! Without RSS I can't even use the internet properly. The hole that Google Reader left in my heart has since then been filled by newsblur.com.

</comment><comment><USER26> I use it with Feedly with around 600+ feeds. I also have a Google CSE set up with my subscriptions. Google Reader had the best search ever. Sad that it was shuttered.

The majority of content comes from few big sites so I put them into HF and just scan them and mark as read while others are organised as folders like:

      Interesting	|
      Interesting	| Australians
      Interesting	| Prose

      My state	| General
      My state	| Films
      My state	| Religion

      Religion	| General
      Religion	| Catholic
      Religion	| Orthodox

      Tech		| Personal Computing
      Tech		| Vendors

      Tools		| Excel
      Tools		| Emacs
      Tools		| Vim
      Tools		| PIM

      Career	| General
      Career	| SAP
      Career	| Professional accounting

      Books		| General
      Books		| Public domain
      Books		| University Press

      Language	| Blogs
      Language	| English
      Language	| Advice

      Country	| Defence
      Country	| Nutjobs
      Country	| Foreign media

RSS is really great and I wouldn't replace it with anything else from the restricted web.

</comment><comment><USER27> You also don't want to forget about aggregators who automatically grab your content and make it accessible to their audience. This is either a positive or a negative depending on your viewpoint, it's certainly a positive for me because it allows domain-specific search engines possible simply by collating a few feeds together for example.

</comment><comment><USER28> Yes - and the people who use RSS often are news sources for other people and are more likely to share your stuff. So even though there were only 100,000 Google Reader users, they probably shared to n+10 yet you won't see those stats in just people consuming your RSS feed.

</comment><comment><USER29> I stopped using RSS altogether when Google killed Reader.

<comment><USER30> If you're worried about being burned again, there's two good self hosted RSS readers out there:

Tiny Tiny RSS: [https://tt-rss.org/gitlab/explore](https://tt- rss.org/gitlab/explore)

SelfOSS: [http://selfoss.aditu.de/](http://selfoss.aditu.de/)

Both include mobile apps and are open source with web based interfaces and JSON based API's to let you implement your own clients.

<comment><USER31> And almost all of the RSS web services and apps I have looked at support OPML to import and export your feeds. It is really easy to move between RSS systems with minimal loss.

<comment><USER30> Nope. What about your _archives_?

I know that for me having an archive of the feeds is pretty darn important.

<comment><USER31> I can certainly see that for some (many?) people archives are important. I currently use Feedbin.com, and I have occationally searched for a past story.

Mostly, I bookmark and archive important articles, and use a search engine to find more general more none specific info

</comment></comment></comment></comment></comment><comment><USER32> I still use RSS for about 250 blogs/sites (tracked by Feedly). That's no near to what it was in times of Google Reader. Some sites stopped providing RSS. For some there was just too much content and it was a pain to filter out everything. I have settled down on those two approaches:

1) If blog/site generates content rare and provides RSS, I use Feedly to track it.

2) If blog/sites generates a lot of content I expect that someone in my Twitter feed will post link to really good article.

So yeah - RSS is still valuable.

<comment><USER31> Like you, some of the high volume sites I have removed from RSS. Others, I have organized into a high volume group or folder of my RSS Reader. Then I use some keyword filters to notify me of when stuff I really want to read comes through the high volume feeds.

</comment></comment><comment><USER33> The "fall" of rss has been one of the worst things to happen to Internet tools. Many thought rss would be replaced by Twitter it doesn't provide the same utility. I recall tools like netvibes, google reader, and others where I could consume vast amounts of information. Even the old pulse on iOS was great and was soon replaced by inferior versions. As the fall of rss tools happened, less sites published rss and we ended up in a negative reinforcing spiral.

</comment><comment><USER34> Many people in this thread have given different reasons why they use RSS. I emphatically agree that it's important, even vital. I use Feedbin to report new items to me.

</comment><comment><USER30> I just added RSS to my blog[0] after this thread reminded me, thanks. For anybody else who runs Jekyll it's about five minutes of work and well worth supporting the tech.[1]

[0]: [http://softholmsyndrome.com/feed.xml](http://softholmsyndrome.com/feed.xml)

[1]: [http://joelglovier.com/writing/rss-for- jekyll/](http://joelglovier.com/writing/rss-for-jekyll/)

</comment><comment><USER35> I read my news exclusively through RSS. Including Hacker News.

</comment><comment><USER36> +1 for RSS; I use digg reader[1] multiple times per day

[1] [https://digg.com/reader](https://digg.com/reader)

(edit for spelling mistake)

</comment><comment><USER37> I get my RSS fix on Feedly everyday.

I haves feeds grouped in the following Categories:

Tech News (all the major news tech sites which I check when I'm bored) Software (feeds from all the software I use so I get notified for updates etc). Photography (photography blogs I like to follow)

I still think its relevant and I actually find it very frustrating when I visit a site with content that could fit in RSS format but they don't publish a feed.

</comment><comment><USER38> Yes! I use liferea to keep up to date on many things. e.g.

\- You can watch your Github feed: it'll give you notifications of all pushes on repos you watch + things that people you follow do.

\- You can watch JIRA and Confluence: I haven't found a better way to catch up on what happened overnight with the team members on other side of the world

\- I subscribe to LWN.net for linux security alerts

\- I subscribe to ~30 blogs of developers I respect

\- I watch various comic strips.

</comment><comment><USER39> People that still use it will think "of course!" and tell you so. People that don't use it anymore will think "probably not, but maybe; I wouldn't know myself" and thus be silent. So you have a high prior chance of getting a ton of "yes" answers even if the real answer is "no".

</comment><comment><USER40> Aggregators like [http://skimfeed.com](http://skimfeed.com) use RSS/XML feeds to send you free traffic.

As a developer, you need to decide if it's worth your time to implement (it's a single database query and some layout code to build an RSS/XML feed, not difficult at all).

</comment><comment><USER41> Either RSS itself is fading or RSS might be called something else these days according to Google Trends [https://www.google.ca/trends/explore#q=%2Fm%2F0n5tx](https://www.google.ca/trends/explore#q=%2Fm%2F0n5tx). I personally don't use RSS.

</comment><comment><USER42> My RSS feed is like my bookmarks, except I actually read, listen to and watch the content that arrives by RSS.

Rawdog generates a new homepage for me a few times a day. I don't even have to put up with other people's crappy design and can enjoy information presented in my OWN crappy design.

</comment><comment><USER43> You should add RSS, it's one of the most passive ways ro share your content and gain new inbound traffic, you users will thank you, all prominents news web/mobile applications make use of rss to distribute their content and get new inbound traffic.

</comment><comment><USER44> From my opinion RSS it's a must for each content site. We use RSS at [http://grobyk.com](http://grobyk.com) for news aggregation in this way we deliver to teams the best articles.

</comment><comment><USER45> I would say it depends on your target market, but most of the time programming a RSS feed is pretty dang easy, so I would generally put it on my todo list for that type of site.

</comment><comment><USER46> I used feeds to subscribe to content, but I prefer Atom to RSS.

</comment><comment><USER47> I couldn't stay up to date on all the topics I'm interested in in an efficient manner without RSS. BTW I came here to comment through my HN RSS feed ;)

</comment><comment><USER48> I wouldn't care about any website if it does not come with RSS. I've been using Digg Reader and it's been working flawlessly.

</comment><comment><USER49> Although I use RSS everyday and every hour, I hate RSS because it is the reason why I am my procrastinating.

</comment><comment><USER50> RSS is the best thing has discovered yet :D Are you joking? I'm using feedly constantly.

</comment><comment><USER51> It is very simple to implement and provides immense utility to many. Definitely worth doing.

</comment><comment><USER52> Nobody but techies use RSS, so it likely depends on the target clientele.

</comment><comment><USER53> I cannot and don't want to imagine a web without RSS.

</comment><comment><USER54> I use RSS or Atom to read content constantly.

</comment><comment><USER55> Of course! Reading it from the diggreader.

</comment><comment><USER56> I love RSS, I use it.

</comment><comment><USER57> oh hell yes.

</comment><comment><USER58> RSS +1

</comment><comment><USER59> I use RSS heavily. Many people do. It is one of those things that is good as it is, so there's nothing to talk about.

I use inoreader.</comment>


Ask HN: Adding A Partner To A Bootstrapped Startup - <AUTHOR>

A couple years ago in the beginning I had a partner... he got married, had a baby & stepped away so I took full ownership.  I kept going, bootstrapped and eventually got it off the ground and am currently generating a bit of income.  Problem is I'm wearing too many hats and can't grow.  Not only is it very stressful doing it alone, it's at the point where it makes no business sense because it can't grow.
I could afford to hire a developer part time, but I really want somebody on the team who's passionate about building something that is theirs.  Also, I want another brain to help in all areas of the business, come up with ideas, provide camaraderie and support.
Perceived valuation is currently $1M - $1.2M
I've known a particular candidate for about 6 months and we get along well, I have trust in his abilities, and have an overall good feeling about him. I presented the idea and he expressed interest but couldn't come on full time without pay.  I don't really need full-time right now anyway so that's ok.  I'm thinking paying a reduced hourly rate (or no pay) and he can build some sweat equity.  Does a "working interview" make sense in this situation?  Where he "earns" his equity over the course of a 3-6 months through actual work and proof?  The tricky part is coming up with the numbers.  Any advice greatly appreciated here.
I'm curious about the different scenarios and approaches that can be taken. Also, some do's and dont's and what precautionary measures to take would be greatly appreciated.
Thanks! <comment><USER2> If you agree on terms, put them down in writing (especially contingencies like one of you dies, quits, or stops working hard), and have both of you sign it.

There is often a brief honeymoon period where people put aside grudges that simultaneously build up; part-time pay to help a friend out is much easier to justify at first but what are your plans 2 months out? 6 months out?. If your candidate loses their day job what then? If they feel helping you puts their day job at risk what then? What if they suddenly decide they are worth more than their initial equity schedule? These need to be agreed upon in advance, because people's senses of fairness oft go out the window when there's an income and survival involved.

</comment><comment><USER3> It is fairly common to have vesting schedules as someone earns equity of usually 3 to 4 years. So if for example you were giving up 10% total on a 4 year vesting schedule, each year would earn 2.5% of the 10%. Some of these can also be met with milestones.

I think your approach of bringing him on slowly makes sense from what you wrote. I recommend reading "The Founder's Dilemma," before finalizing any of your actions.

[http://www.amazon.com/The-Founders-Dilemmas-Anticipating- Ent...](http://www.amazon.com/The-Founders-Dilemmas-Anticipating- Entrepreneurship/dp/0691149135)

</comment><comment><USER4> Simple question.

Will a partner allow the business to grow to $5 million dollars in "percieved" value?

If yes, then giving the partner half the business more than doubles your "on paper" money.

If no, then why bother? Or rather, why bother trying to grow something that won't grow quickly in lieu of starting something together or pivoting which might?

Regardless, any equity should vest over time.

Regardless as well, hourly sweat equity is not conducive to creating determination in your partner.

</comment><comment><AUTHOR> Thanks guys! I think I may do a milestone based method. Each milestone reached will earn him X% equity. That way he can earn his way in and the risk is low for me.</comment>


Ask HN: If a 3rd World War happens, which country will economically suffer? - <AUTHOR> If during the 2020/2030 decade, something that looks like another world war happens (nuclear, technologic war... anything), which country / region will suffer the most / less economically talking?<p>But without looking at the loss occasioned by destructions (just no more global market, intercontinental exchanges disabled...) <comment><USER2> The people of North Sentinel Island will likely suffer the least as they are not connected to any market.

If you specifically want a country then, perhaps some nation in Micronesia or Polynesia?</comment>


An Analysis of the Distribution of Birthdays in a Calendar Year - <AUTHOR> http://www.panix.com/~murphy/bday.html <comment><USER2> In France when a person's exact birth date is unknown, a fictitious birth date is set on the 1st of January of the estimated or actual year of birth. I know a few African-born persons in that case. I expected to see that reflected in a slight bump in observed births on the 1st of January... But no such anomaly exists in the article's data...

</comment><comment><USER3> I think it's funny that there's a noticeable bump in births around nine months after wintertime (Nov/Dec).</comment>