Order of Operations - <AUTHOR> http://adam.blog.heroku.com/past/2009/3/18/order_of_operations/ <comment><USER2> I disagree strongly with making "security" step 4. By the time you finally get around to making the app functional you may have fallen into several fundamental traps that require massive work to get out of the hole.

The vast, vast bulk of security holes are due to simple things that are easier to get right even in the prototype stage than to retrofit later. Concatenating strings into an SQL statement is _harder_ than using a proper library for escaping. Properly escaping HTML isn't that hard if you know what you are doing _and_ plan for it in advance, but is hell to go back and fix later. Buffer overflows are easy to avoid today by using secure libraries or languages in the first place but can be very difficult to fix in an audit phase. Even things like implementing a basic role/capability system are a lot, lot easier to implement from the beginning than to try to retrofit, and they are not hard. If you have some experience and know what you are doing frequently the right way has been made easier than the wrong way anyhow.

If you are still at an experience level where you still have to think about how to properly encode an SQL query value... well, charge forward I suppose, but I promise you, you will pay. There's no way around that.

Concerns with a similar pattern: Handling string encoding. You will come out ahead if you start out aware of how encoding works and how to handle it, rather than trying to retrofit it later. Internationalization: If you know what you are doing, it is not significantly harder to do at least basic internationalization first (a string table instead of typing a raw string, with a bit of work you can make it an emacs macro so it costs one whole extra keystroke per string), and retrofitting it is extremely hard. If you encounter one particularly hard string, label it in a comment and bail if you're in a hurry, but you're still ahead for having thought about it and having everything else set up properly.

If you feel you should object to my point by saying "But those things are too hard!", you're missing my point. For someone with decent experience, they _shouldn't_ be. I don't have to think too hard about any of these things even in my prototypes. (Except encoding, which is hard to think about because it's a hard problem, even for a prototype, unless you are blessed to be working in an environment that has a sane encoding story.)

<comment><USER3> I agree that security shouldn't be a last-minute thought, but those are terrible examples!

If you're prototyping, think at a higher level, and prototype with native language objects, or if you need to use a DB, use an ORM. Writing raw SQL is only fast the first time, and then you're no better than assembly-coding your database.

For string encoding, just take out non-alphanumeric characters, unless you're dealing specifically with non-English, and then expand your target audience once you can do it safely. Most blogs, for example, don't deal with i18n in urls; they just convert any non-alphanumerics (include spaces) to hyphens, which is safe and easy. Again, that's a simple regexp: in Ruby, .gsub(/[^0-9a-z]/,'-') . If non-Anglophones sign up in droves, you have a massive user base, which is motivational inertia enough.

<comment><USER2> "If you're prototyping, think at a higher level, and prototype with native language objects, or if you need to use a DB, use an ORM. Writing raw SQL is only fast the first time, and then you're no better than assembly-coding your database."

Yes, good job, part of my point.

"For string encoding, just take out non-alphanumeric characters, unless you're dealing specifically with non-English, and then expand your target audience once you can do it safely."

No, the real solution is to learn what encoding actually entails and learn how to do it right without a lot of fuss. That approach is actually harder than doing it right, because it's "only one regexp" in a quick HN comment; in practice it'll blow up in your face. That's just a panic response brought on by not knowing what you're doing with encoding.

</comment></comment></comment><comment><USER4> Rather than thinking of these steps as a strict sequence, one should think of them as parallel processes with shifting resource allocations.

Ultimately, the development process comes down to the experience and habits of the developer. If you have a lot of experience, your marginal cost of "getting it right" from the beginning is lower, because you already have the necessary domain expertise.

For example, if you're inexperienced, you might build a login system that simply stores plain text with a note to "hash passwords" later. You might then move through unsalted via manually salted hashing to finally arrive at something like bcrypt.</comment>


Program Your Digital Tattoo Designs to Present an Image, Mood or Reminder - <AUTHOR> http://www.walyou.com/blog/2008/04/09/program-your-digital-tattoo-designs-to-present-an-image-mood-or-reminder/ <comment><USER2> sounds like another baseless patent in the making with no actual engineering work done towards it...</comment>


How should i document my code? - <AUTHOR> I have been working on a hobby project in JavaScript/three.js + browserify for 5 years now.
I've been pretty good at testing my code and refactoring it whenever appropriate. I thus have more than 2500 test cases and I feel that my code is pretty solid.
However, I haven't been so good at documenting my code. I have some comments here and there in the code base, pertaining to certain functions. But that's it. I miss documentation that explains all the 'glue' and the big thoughts in the code. I always wish I had this, whenever I revisit code that I wrote a while ago.
So what's the best approach to this? Is there any kind of systematic approach to this task, beyond autogenerating API docs using / ... */ comments? Or any kind of guideline I should have in mind when starting this project? What's the best practice when embarking on documentation projects like this? <comment><USER2> Who is your audience? Folks using your API or folks who are going to dive into your codebase and contribute to it?

For folks using your API, there are two types of documentation you want:

1) Tutorial: Documentation that guides the user through a few steps of working with the API. This should be an integrated experience. The aim is to help a user build a mental model of your project and introduce them to the shape of the major parts of your API.

Example: [https://developer.gocardless.com/getting- started/api/introdu...](https://developer.gocardless.com/getting- started/api/introduction/)

Since you're doing this for a library that you can write automated tests for, you should consider showing your user how to test. This helps prevent a user from getting lost and gives them a clearer way to integrate with the rest of their tooling.

2) Reference: Documentation that someone can use to look up the answer to a specific question that they have. This is not an integrated experience but should integrate well with their workflow when building something and searching for answers. The goal here is to be highly searchable, which requires thinking about what words they would look for when trying to find it.

Example: [https://developer.gocardless.com/api- reference/](https://developer.gocardless.com/api-reference/)

This is something I love thinking/talking about, so feel free to email me if you want to videochat and bounce ideas off me. My email is in my profile.

</comment><comment><USER3> My suggestion would be to start at the high level, and work your way down putting emphasis on things that aren't going to change or change much--that way, when you change things the docs won't become as wildly out of date as quickly.

So, document things like "What are the big conceptual pieces of my project?", "How does data flow around?", "If a user sees <X>, what's behind it?".

Then, if you feel it needful, dig down into function-level and deeper stuff.

<comment><AUTHOR> This sounds like a good suggestion. Now my thought is to pair code files with similarly named doc files. Higher level code files will go first, and only later will I fill in the nitty gritty files.

The next question is: how do I get a good work flow? Due to a handicap, I am limited in my computer keyboard typing, but _not_ limited in typing on my phone. Thus the optimal would be to find an Android markdown editor and an android git client. I'll check out the Play store :)

</comment></comment><comment><USER4> I aim to exercise Contract Driven Development. Write contract first, in python this would be in a doc-string of your stub. Then depending on your methodology either write your tests first followed by implementation (or vice-versa, depending on your preference). Then in the code document things that required you to run research (or more thinking power than usual).

</comment><comment><USER5> I wrote up an article on this: [https://medium.com/@jcahill84/insurmountable- documentation-s...](https://medium.com/@jcahill84/insurmountable- documentation-shortfalls-131aa6be7f62)

</comment><comment><USER6> Using only Kafka - [http://thedailywtf.com/articles/Who_is_Gregor_Samsa_0x3f_](http://thedailywtf.com/articles/Who_is_Gregor_Samsa_0x3f_)

</comment><comment><USER7> I worked for a job that taught me how to document. I was actually a coder who fixed bugs for auto body software. What made my job easier was probably knowing what the file I was -- what exactly it was doing. I didn't love doing the job, but it taught me what I needed to know.

As I began developing for myself, I would often just not document my code, thinking the best: "Oh I'll know what this does when I see it." Add a dozen projects into the mix: "Yeah, I remember that.. what did it do?" I knew I had to start documenting again. I also figured: Why not document? If I ever need to go back to it or hire someone to work on something, I -- and they -- will not be so lost when looking at it.

So, how I document my code is by adding this template at the top of every page.

      // FILENAME: dashboard.php
      // STATUS: ACTIVE
      // PURPOSE: Shows basic information when user logs in
      // NOTES: Dashboard will display the most recent transactions

FILENAME lets me know what file I am in.

STATUS lets me know if this file is actively being used; or INACTIVE, for not being used at all, or SEMI-ACTIVE (usually for TEST files)

PURPOSE lets me know what exactly is the function of this file within the program I've built.

NOTES are optional, but these just let me know if there is any additional information I need.. such as "Admin use only" meaning this file is used by administrations, not regular users.

Those four keywords give me everything I should probably know about the file. You can add additional lines too, such as one that I might sometimes use: LOGIC. LOGIC explains exactly what the code is doing and how it works in more technical terms. (Grab user input, add to database, update Table1, Table2, and Table3 of database, return user back to Dashboard)

Before you even begin writing code in your file, you should start off with this template. It will keep you organized and make you feel more in control of your code. I mean, I've developed a few programs that have hundreds of files each, and the very first program I wrote: Very little documentation.

You feel like your code is going to crash, burn, and you won't be able to figure it out. By documenting, even if there are issues, you can pinpoint what it is doing and where, and that should lead you to the file you need to focus on.

The rest of the file is usually optional for commenting, though it is great practice to keep at it. If you think you can't pick up something from the code by reading about the file, than you may want to continue documenting throughout the file. I only document the remainder of the file if there is some complicated code in it.

I mean, after writing something that connect to the same database 100 times, I may have only documented the most used files that use that code. For smaller files, if I forget, I can always revert back to the major files to remind myself of what this code is doing.

Anyways, its up to you, but it also helps that if you ever decide to sell your code or someone wants to buy it from you, you've already done the work for them, and imo, it adds a lot of value to your code.

</comment><comment><USER8> in limericks or haiku</comment>


Ask HN: Wanted – a D3.js mentor - <AUTHOR>

I have underway a long-term project to try to map math in a way that hasn't been done before.  I need a front end, but people with the skills I need are either not answering my calls for assistance, or are too busy.  So I'm going to have to do it myself.
Or at least, I'm going to have to get a rudimentary version working so I can then gain momentum.  But I really have no desire to become a web developer - I have enough things to do - so I need to so just enough.
But researching on the web is slow, because tutorials take you through the steps they think you need, concentrating on things I already know, and not explaining the bits I need.  I need a core, and then very specific extra bits, and it's a really, really slow process.
So what I need is someone of whom I can ask quick and simple questions to get just the knowledge I need, when I need it.  I need someone with experience in D3 to give me the nuggets, so I can then do the monkey work.
I'm willing to negotiate how this works, and money or other recompense.
Previously I tried to get people interested in this by explaining where it was going, and giving them some control over how it works.  Maybe people don't actually want control, or maybe they aren't interested in the objectives, I don't know.  So this request for a mentor is trying a different approach to get the project bootstrapped.
Do you know D3?  Can you provide the feedback and hints/assistance I need?
Please let me know: topicsinmaths (at) solipsys.co.uk
Or if you can think of a better approach to get the help I need, feel free to tell me I'm an idiot, and what I should be doing instead! <comment><USER3> I was in the same boat, but I stumbled upon [http://www.jsgraphs.com/](http://www.jsgraphs.com/) most are based on d3 and they simplify using it. I just picked the one that had the features I needed

<comment><AUTHOR> Thanks for the reply ...

I've spent _hours_ searching for a clean example that has the features I want. I can't believe that what I want is new, or even unusual, and yet I can't find an example to copy and mutate.

I want

* text boxes containing a small amount of text - about 10 words - that are connected by arrows;

* force directed layout, with the ability to drag boxes, and in some cases pin them in place.

* Buttons to click on the arrows with call-backs that adjust the underlying data

* Buttons to click on the boxes with call-backs that adjust the underlying data

I find it hard to believe no one has done this, and I find it hard to believe, looking at all the D3 stuff out there, that this is difficult. Many, many hours of searching is making me doubt my beliefs.

<comment><USER4> Hi Colin - I had to implement something with d3 force before that might be kind of similar. I hadn't used d3 before so my solution is pretty hacky.

\- [http://bl.ocks.org/mbostock/3750558](http://bl.ocks.org/mbostock/3750558) \- for basis of pinning nodes.

\- setting CSS marker-end attribute on the line to get arrow (based off this example but in the end I didn't need as fancy as them so I just set it on all .link instead of dynamically: [http://bl.ocks.org/mbostock/1153292](http://bl.ocks.org/mbostock/1153292))

I basically throw my data into there and let force directed work it out. Then I manually pin any of the nodes I want and basically have a save functionality, so next time I load the graph, any pinned nodes are back in the same place. I'd share the code but it's work and besides which, it's pretty simple (each graph has an id, there's a db I have where I store (id) => text(string(graph => json))).

As for boxes of text it shoudn't be too different then with circles - <USER2> personally went with onHover using qTip.s for extra data (my node are either circle or some custom images, and they all have a text besides them that is server fqdn).

Not entirely sure where you want the buttons to be in this graph though.

<comment><AUTHOR> That's definitely part of the solution I need - thank you for that. I'll take a copy and see if I can munge it with some of the other things I need.

Cheers!

</comment></comment></comment></comment><comment><USER5> Metacademy are doing something similar for Machine Learning and related areas. The code is open source too - [https://github.com/metacademy/metacademy- application](https://github.com/metacademy/metacademy-application)

Here's an example visualization: [https://www.metacademy.org/graphs/concepts/red_black_trees#f...](https://www.metacademy.org/graphs/concepts/red_black_trees#focus=0svwl3x5&mode=explore)

<comment><AUTHOR> That is _very_ nice, and certainly has a good half of the things I need. It would be an excellent base, if only I can understand enough of it to enhance it the way I need.

My fear is that it is already sufficiently comprehensive that I won't be able to make the changes I need, but it's an excellent example to show people part of what I'm aiming at.

Many thanks - very useful. I've noted it, and will look to evaluate it soon.

Cheers.

</comment></comment><comment><USER6> This sounds like exactly what [http://stackoverflow.com](http://stackoverflow.com) was designed for.

</comment><comment><USER7> Another D3 powered lib is C3.js - it can make charting a bunch easier</comment>


Why Facebook's API starts with a for loop - <AUTHOR> https://dev.to/antogarand/why-facebooks-api-starts-with-a-for-loop-1eob <comment><USER2> When I interviewed at Facebook as a new grad 7 years ago, I used my "Ask your interviewers a question" time to ask precisely this because I'd been trying to play around with the client side javascript and the constant infinite for loop always stood out to me.

<comment><USER3> Cool story! How did it end up?

<comment><USER2> Been working there since :). I got a better/full answer after joining from one of the security engineers giving one of the starting training talks.

<comment><USER3> Congratulations! That's a heck of a good story - thanks for sharing.

</comment></comment></comment></comment><comment><USER4> This, and this sort of thing in general, are why I'm not very enthusiastic about security on the web.

Facebook and Google can avoid security holes like these, sure. Perhaps you will too -- that is, you'll avoid this particular one. What about the fifty others, subtly interdependent sources of security problems?

</comment><comment><USER5> Google's version is half the size of Facebook's! I love that some engineer went to the trouble of saving four bytes.

</comment><comment><USER6> Yet another reason third-party cookies shouldn't exist

</comment><comment><USER7> Of course, another approach to securing data might be to stop using things for purposes they weren't designed to be used for in the first place... I'm afraid I don't see that happening any time soon, though.

<comment><AUTHOR> While the attack is using things for a different purpose, using JSON to provide data to a website is totally legit.

I don't see how people could have prevented this without the knowledge of such an attack

</comment></comment><comment><USER8> I think this is outdated. I tried in Chrome, FF and Safari, and even when I follow what the original linked article does it still does not work.

</comment><comment><USER9> Just use explicit authentication for API endpoints. Explicit authentication prevents this attack, CSRF and other confused deputy problems.

</comment><comment><USER10> Amazing site, it tells me that I'm offline :)

<comment><USER11> What's the deal with this? The Atlantic, Wired, and dev.to all tell me I'm offline on first load. I have to use ctrl-shift-R to get any page content, and I've never been offline when this happens.

I mean, I'm assuming there are service worker shenanigans at play here, but given that it's always wrong about my online status, this seems like a fairly big bug on someone's part. Just wish I knew where to file or check its status.</comment></comment>


Turn your idea into an experience - Part 1 - <AUTHOR> http://joshrweinstein.com/post/16245110979

<comment><USER3> Well put. I would say that things have changed since even an year ago. Nowadays, if you are building a MVP and plan on a closed beta launch - <USER2> moaning & groaning about your unpolished UI. People just _expect_ well- designed experiences from day 1.

<comment><USER4> I recently tried a beta for a company that received wide acclaim, won a bunch of competitions, and appeared on Tech Crunch. Yet their product had a lot of big bugs. You know, the kind that slow down your computer and make you worry about data loss. Fun stuff like that. It was clear that they decided to launch the beta even though they had to have known about these serious bugs. That's what you should bitch about.

<comment><AUTHOR> Ooo, good point!</comment></comment></comment>


Ask HN: Why is Mac OS X/iOS not called a flavor of Unix? - <AUTHOR> OSX and iOS are built on linux why aren't they called flavor of linux? <comment><USER2> Depends on what you mean by Unix.

But OS X is UNIX. www.opengroup.org/openbrand/register/brand3602.htm

<comment><USER3> Thank you. I don't understand why this is even being debated.

Conformance statement for El Capitan: [http://www.opengroup.org/csq/repository/RID=apple%25252FXY1%...](http://www.opengroup.org/csq/repository/RID=apple%25252FXY1%25252F9.html)

<comment><USER2> It is what it is, trying to define it makes for a good bonfire story but that's about it.

Today there are only "Unix-like" and UNIX certified systems left. And I bet it wouldn't be too hard to certify MS Windows with SFU installed, as a UNIX.

</comment></comment></comment><comment><USER4> Because they're not.

"OS X's core is a POSIX compliant operating system (OS) built on top of the XNU kernel, with standard Unix facilities available from the command line interface. Apple has released this family of software as a free and open source operating system named Darwin. On top of Darwin, Apple layered a number of components, including the Aqua interface and the Finder, to complete the GUI-based operating system which is OS X.[32]" \- "OS X", _Wikipedia, the free encyclopedia_

[https://en.wikipedia.org/wiki/Mac_OS_X](https://en.wikipedia.org/wiki/Mac_OS_X)

<comment><USER5> Even though OS X isn't pure UNIX, it is UNIX certified.

[http://www.opengroup.org/openbrand/register/brand3612.htm](http://www.opengroup.org/openbrand/register/brand3612.htm)

</comment></comment><comment><USER6> Because it is wrong, they are not build on Linux. The roots go back to a BSD, so it's a Unix.

<comment><AUTHOR> Yes, correct... There are falv of Unix too - [http://www.linfo.org/flavors.html](http://www.linfo.org/flavors.html)

<comment><USER7> Right, it is considered to be a flavor of Unix. But OS X has nothing to do with Linux other than a common ancestor.

<comment><USER8> Linux is not an ancestor of any flavor of Unix. It did not evolve from a Unix codebase.

It is the epitome of a "Unix-like" operating system. At an early point, it might've been fair to call it a _spiritual_ successor of Minix, though.

<comment><USER7> > Linux is not an ancestor of any flavor of Unix.

I don't think I suggested that it was.

</comment></comment></comment></comment></comment><comment><USER9> Why is Mac OS X/iOS not called a flavor of Unix?

Because for a time, Unix was a trademark, therefore everybody else didn't have a unix offereing, but a Solaris, a A/UX, a A/IX, a Xenix, a FreeBSD, an OpenBSD, a Darwin, a GNU/Hurd, a GNU/Linux, etc.

OSX and iOS are built on linux

No. They're built on Darwin/Mach.

Why aren't they called flavor of linux?

Because they have not a single bit in common with Linux.

</comment><comment><USER10> TL;DR: OS X is a Unix, while iOS is merely Unix-like but cannot, due to legal reasons, be called a Unix. Neither are based on Linux, which is itself another Unix-like but not a Unix.

Unix is a complicated concept and it has embodied different things in the past decades. It started out simply enough as a single body of code (with various additional patches made by different groups using it) and a trademark on the name at AT&T in the '70s. AT&T partnered with various educational institutions to help explore the concepts in Unix. The most important of these educational institutions was University of California, Berkeley which created its own patches for Unix and called them BSD ("Berkeley Software Distribution"). In the early '80s, AT&T decided it could make money by licensing the code out to commercial third parties, giving sale and binary redistribution rights. The many licensees (major ones were IBM, HP, Sun, and Microsoft) added additional code to their versions of Unix, much of which implemented similar features but which were all slightly incompatible with each other. In order to reign in the incompatibilities, various standards were created, such as the various versions of POSIX, and a Unix vendor could pay to be certified as meeting one of these standards. In the early '90s, AT&T sued Berkeley so Berkeley decided to rewrite all the copyrighted parts of BSD with freely-licensed reimplementations. Later in the '90s, AT&T sold the rights to the Unix intellectual property to Novell, who eventually transferred it to X/Open Consortium, who later merged with OSF and ultimately became the Open Group, where it remains today[1].

GNU/Linux is an operating system created in the early '90s that was heavily inspired by Unix (we say it is "Unix-like"), but which does not use any copyrighted Unix code and which is not certified as meeting any of the Unix compatibility standards. Due to its free nature, a belief that it was "good enough" for various commercial purposes, and its avoidance of violating the Unix copyright, it became a nice alternative to the licensed Unixes in the '90s, since many of those cost money, or were then in legally ambiguous situations.[2] The Linux kernel itself has continued to grow over the years and is now used for various operating systems beyond just GNU/Linux, the biggest of which is probably Android. As far as I know, none of the Linux- based operating systems today are certified by the Open Group.

Meanwhile, Mac OS X is based partially on BSD, which was not considered an official Unix, especially after AT&T's lawsuit. At some point, Apple decided to pursue Mac OS X compliance with the Open Group's UNIX 03 standard, which just required meeting a lot of technical requirements, and first got it with Mac OS X 10.5 Leopard. This makes Mac OS X an official Unix. El Capitan retains the UNIX 03 certification.[3] Since iOS, watchOS, and tvOS are based on Mac, they are Unix-like. But they're missing a lot of the requirements from any of the official Unix standards and so cannot be legally called Unixes.

Also, since none of Apple's operating systems use the Linux kernel it would be incorrect to say they were a flavor of Linux.

Hope this helps!

[1] [https://en.wikipedia.org/wiki/History_of_Unix](https://en.wikipedia.org/wiki/History_of_Unix)

[2] "Just for Fun" by Linus Torvalds. [http://www.amazon.com/dp/0066620732](http://www.amazon.com/dp/0066620732)

[3] [http://www.opengroup.org/openbrand/register/brand3612.htm](http://www.opengroup.org/openbrand/register/brand3612.htm)

</comment><comment><USER11> OS X is built around the XNU kernel. XNU stands for "X is Not UNIX" so that's a clue :-)</comment>


No week since 2013 without a mass shooting - <AUTHOR> https://www.washingtonpost.com/news/the-fix/wp/2015/10/01/theres-been-no-calendar-week-without-a-mass-shooting-during-president-obamas-second-term/?postshare=8451449091941819 <comment><USER2> America is broken on so many levels. The slaughter phenomenon probably reflects citizen frustrations as much as it does cynical corporate exploitation of the masses for power and profit. It does not pay to look away. This problem is urgent and real.</comment>


Being Successful as a Distributed Team - <AUTHOR> http://squeejee.com/blog/2009/10/28/being-successful-as-a-distributed-team/ <comment><USER2> Something this article doesn't mention, but was crucial (IMO) to the success of the Weblogs, Inc virtual team I worked in for a long time, was real-world meetups. (I believe Jason Fried alluded to this as well at Startup School.)

Campfire, IRC, IM, Skype and active chat email lists are all great for feeling connected to people, but the first time I really felt _part_ of the company itself - not just a remote node on a graph - was when I covered an event and hung out/coordinated with a load of other bloggers doing so. It really instilled a sense of camaraderie - it was a very high pressure task and it was great that we had been working together virtually for so long (and that some of the others had worked together in person before too), as that avoided some of the uncomfortable situations that can occur if a group of strangers tries to achieve something in a short space of time.

Obviously this only really worked for the blogging/journalis model, but sending a group of devs to an engineering conference, having a team retreat (we also did this but as I was in the UK, I never got to go) and generally finding excuses to hang out productively a couple times a year really makes a big difference to the team feeling, in my experience. It might be slightly different if you're writing code, not articles; mind you, at least if you end up disliking your cow-orkers in person, you don't have to spend that much time with them!

</comment><comment><USER3> I did this for three years as a consultant. I worked from the home office (US) 3-4 weeks, and then travel to Europe for a one-week co-lo...rinse, repeat. We grew from 7 people up to 3-4 teams with about 30-40 people. In the end we had a well-oiled machine. What made it effective: good engineers, good build, continuous integration, and co-lo whiteboard design sessions (can't say enough about that last one).

I wish there was a job board that highlighted companies that use distributed teams and are looking to draw talent without requiring re-location.

<comment><USER4> how does the whiteboard thing work?

<comment><USER3> I mean a real whiteboard with real people in the same room and some markers :)

We would alternate one week co-located and have intense design sessions in smaller teams, then go back to our own time zones and code it for 3-4 weeks.

I've looked at a lot of digital whiteboard solutions, but honestly nothing compares to the real thing. I feel this is still an unsolved problem, and a good startup idea.

</comment></comment></comment><comment><USER5> You will lose some time if you use a distributed team. I've seen 4 people spend all day in the same room with each other, talking, and even then it can be hard for each person to communicate to the other people what they are really thinking. When you are not in the same room, things slow down even more. Communication gets harder.

If you are working on the kind of project that needs to ramp quickly, then the whole project should try to adhere to agile practices. Agile practices have 2 main hopes:

1.) to allow a fast-forming team to quickly become highly-productive.

2.) to control costs by ensuring discipline in regards to goals and deadlines.

I use the word "hopes" instead of "goals" because the ultimate aim of agile practices is more of an ideal to be aspired to rather than a reality that can be achieved, and by that, all I mean is that we are constantly learning more about what these practices mean, and in the future we can reasonably hope to do better than we are doing today.

Programming is an art, and art needs passion. Many agile practices are aimed at soliciting a greater emotional commitment from the programmers. I might write "For an agile project to go well, the programmers need to emotionally commit to it" but that isn't quite right. What would be more correct would be "For an agile project to go well, the programmers need to emotionally commit to their own professional ideal." That is, they need to care about the craft of programming. They need to be constantly pushing themselves to always be better programmers.

I would never argue that agile practices are needed on every project. If a project is routine, then long-distance, non-agile practices might be perfect. For instance, suppose you decide to launch a new online magazine. After researching your options, you decide you will use WordPress as the software that powers your site. I'd suggest you find a good designer, local to you, and work with them to come up with the design. Once you have the design, the rest of the process is mundane. You could certainly hire a team in India to install WordPress and implement your design for you. And you would not need agile practices for such a project. In fact, you do not even need great programmers for such a task. Mediocre programmers can do a reasonable job with tasks that are standard, routine and mundane.

However, I would argue that agile practices are needed at projects that need to be fast moving (this would include most start-ups), or at any project where the aim is to create something altogether new and unique. If your project is venturing out into the great unknown, if you are going where no one has ever gone before, you will need a team of excellent, committed adventurers to go along with you.

Many agile practices depend on physical proximity. The programmers need to be able to meet, preferably every day ("every day" in the sense of casual conversation, not "every day" in the sense of "let's have a formal meeting"). Consider some of these practices:

1.) pair programming (two people looking at the same screen, checking for errors)

2.) the use of index cards to map objects

3.) stand up meetings (meetings kept short and lively because everyone is standing)

None of these make any sense if the programmers are in different countries (or different parts of one country).

Again, for routine work, I think a distributed team can be fine. But for a startup, I would always insist that the team be in physical proximity.

<comment><USER3> Some fine points. I agree about the quality of the people and the passion, but I disagree that distributed teams only work for routine work. I worked on a large, complex project wherein we re-built a company's internals from scratch. The details are moot, but the point is we executed like a startup -- we had protection from management, and it worked well. There were bumps in the road, but we continually evolved the process (yes, we did agile) to make the team more and more effective every iteration.

Standup was done via phone every day adjusted to meet time zones.

Pair programming was done with VNC when we needed it -- mostly used to mentor / bring on new employees who need hand-holding.

We did not use index cards to map objects. We did do the following things at a one-week-long co-location: 1-2 days of planning and 2-3 days of whiteboard/design. Iterations were typically 2-3 weeks long after that.

I've used this same model at the last couple of contracts I've done and it can work very well if done right (e.g. right people, right tools, right process, right mgmt).

</comment></comment><comment> bjelkeman-again I pretty much agree with what he says. We use a different set of tools, but they largely do the same job.

On the "People management" I think that the key thing is finding the right people. I manage our software development team and there is a big difference to being in the same room, or the same building, which I have done at previous startups, with several of the same team members.

You have to trust people and you have to allow them to do the job. I have always tried to hire people I trust to do the job, but when they are anything from one to nine time zones away there is no conceivable way I could "monitor" them and make sure they do their work. If I tried to suggest something like Webspy (as suggested in the article) to "check up on them" I would be first in line to kick myself out of the room. It is all results based. Did you get what you expected at the end of the day/week?

There are certainly drawbacks with not being in the same room. How I would love to be able to round em all up more often and have a whiteboard session (not sure they want that too though... :)). But on the other hand you get very independent and self propelled colleagues instead.

We try to have a group get together every 6 months, but it isn't always feasible, but you really notice the increase in "bandwidth" when everyone is in the same room for a couple of days to a week.

Would I want all of my team in the same town? You bet. Could I have assembled my team or one like it in the same town? With great difficulty. So, overall, we are better of with a distributed team, as the alternative would be to have no team. But it isn't always super easy.

<comment><USER6> We have been working remotely for a while. It is difficult but it can be done. I would like to add a couple of applications that we have used to make our life easier:

\- Etherpad.com for real-time document colaboration \- Google documents, if privacy is not a concern

Also, because it is very difficult for us to get together, every time that we can do it we try to maximize the time (no dumb and useless meetings, going straight to the important points, etc.). As result, our face-to-face meetings are very productive.</comment></comment>


Looks like Twitter is down? - <AUTHOR> http://twitter.com/ <comment><USER2> Since it's up and down, intermittently, I'm guessing that it might be a load balancer or network switch problem. Worst case would be a DNS issues.

</comment><comment><USER3> <http://news.ycombinator.com/item?id=5093964>

And it's fine for me.</comment>


Songkick integrates Twitter to go realtime and preserve your gig tweets - <AUTHOR> http://uk.techcrunch.com/2009/09/25/songkick-integrates-twitter-to-preserve-your-gig-tweets/ <comment><USER2> Is "go realtime!" the new "go social!"? ;)

>> "preserving the moment when everyone was tweeting enthusiastically about the band they were watching."

Do people seriously sit there watching a band whilst tweeting about it? Man I feel old.

Also it seems like twitter could _really_ do with some allowance for meta-info with tweets. For example if you could send a tweet and add a meta-location attached to that tweet. There's only so many hashtags you can fit in 140 chars... And that info would be better taken out as meta-info rather than text in a tweet.

{tweet:"Wow he's on fire tonight!", location:"o2arena", event:"Billy Joel concert"}

Might be worth songkick doing their own "twitter for concerts" later on where you can just choose the concert you're at and comment on it? Seems like a good strategy to attack twitter with a niche usage by doing it better than twitter.

Cool update though :) WD songkick :D

</comment><comment><USER3> If any of you guys are going to shows soon and use twitter, we'd love your feedback.</comment>


UFO VPN claims zero-logs policy, leaks 20M user logs - <AUTHOR> https://www.comparitech.com/blog/vpn-privacy/ufo-vpn-data-exposure/ <comment><USER3> Unsecured Elasticsearch, once again.

([https://www.theregister.com/2020/07/17/ufo_vpn_database/](https://www.theregister.com/2020/07/17/ufo_vpn_database/))

So ES has insecure defaults, I get that and it's been discussed to death.

But who the heck, in this day and age, exposes clusters directly to internet traffic? I don't care what the defaults or security measures you have. DONT EXPOSE SERVERS.

Place them inside a VPC, preferably a private one(in AWS parlance, behind a NAT GW). Use _something else_ to send traffic to them. If you are on AWS or similar (but not Azure I guess), add a load balancer to it. So now access would require creating a new load balancer, pointing to the servers in question, adding listeners on the desired ports, and configuring the appropriate security groups. Only then you can send external traffic. On the specific ports you configured on both listeners and security groups only.

Do this everywhere and you are in a much better shape. You still need to configure servers correctly, but if you mess up, nothing happens, unless you mess up many other things in an error cascade.

<comment><USER4> What's the difference between a VPC and iptables? I agree that you shouldn't expose insecure services. But why do I need to introduce an entire private address space and cloud-managed SDN services to achieve that goal? If it weren't industry status quo, I'd almost call you a shill for the union of ops teams working to secure jobs for years to come. Almost.. (;

<comment><USER5> I would think that the post you respond to either supposes a hosted service (you do not control the server and its iptables) or that it multiple layers of protection is good for something critical.

But yes, if it's your own server, everyone should remember that regular Linux features are darn powerful, too.

</comment></comment></comment><comment><USER6> According to The Register, UFO VPN is just white-labeleing a parent service[1]. The full list of compromised providers is thus UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN.

[1] [https://www.theregister.com/2020/07/17/ufo_vpn_database/](https://www.theregister.com/2020/07/17/ufo_vpn_database/)

<comment><USER7> Never buy a VPN with these kinda names. You can tell they are shady from their names and websites.

UFO, Secure, Pure VPN, etc

<comment><USER8> Which name is better in your opinion? PIA? Nord? Express? All their web sites look alike as well.

<comment><USER9> IMO, this [https://www.privacytools.io/providers/vpn/](https://www.privacytools.io/providers/vpn/) is currently one of the best sources on deciding for a VPN provider. Or you could host your own on a cheap VPS.

But, there are few reasons to actually use a VPN nowadays, there was a discussion on HN a few days back, but I cannot seem to find it at the moment.

Edit: Found it: [https://news.ycombinator.com/item?id=23566390](https://news.ycombinator.com/item?id=23566390)

</comment></comment></comment></comment><comment><USER10> This feels like someone scuttling the ship. \- VPN based in Hong Kong. \- VPN claims to not keep logs but does (ie. willing to descieve customers and secretly compromise their security). \- New national security law effecting Hong Kong speech and liberty. \- VPN likely to be challenged to turn over user data to Chinese authorities in the relatively near future. \- Hong Kongers acquiring VPN services in droves for the explicit purpose of avoiding Chinese state monitoring of their internet traffic and communications records.

If I was working at UFO and saw the risks to my fellow citizens created not just by the company's poor security but their willingness to descieve customers I'd worry the company would quietly hand over whatever the Chinese authorities asked for - no "warrant canaries" or truth in advertising - and if probably look to throw a figurative grenade into their operations. If that meant data exposure, better now before they perfect the application of the new security laws then later when everyone feels comfortable and the CCP is just sucking up all of UFO's traffic and logs.

</comment><comment><USER11> VPN providers are something you should have especially high standards for. They are largely unregulated, can see all of your meta data and have an economical incentive to sell it (IIRC some big player has been caught doing that).

If a provider shows even the slightest amount of fishiness, instantly discard them (NordVPN immediately comes to mind, with their weird influencer marketing campaign).

<comment><USER12> How? I mean how do you measure VPN services? I never understood why people working in tech would ever trust a VPN service? A VPN is seeing all your traffic, and you have to take their word that they do not log any of it? I use free tier AWS servers across the globe with wireguard. It might not be perfect, but I still prefer that than using a VPN service.

<comment><USER13> The only standard you can really trust is when they actually get subpoenaed and don't have anything to give to the court. An example of this is Private Internet Access.

<comment><USER14> Piggybacking off of this, Private Internet Access (PIA) has actually had their no logging policy "proven in court" via this method multiple times. [1][2]

Full disclosure: I work at PIA.

[1][https://torrentfreak.com/vpn-providers-no-logging-claims- tes...](https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in- fbi-case-160312/)

[2][https://torrentfreak.com/private-internet-access-no- logging-...](https://torrentfreak.com/private-internet-access-no-logging- claims-proven-true-again-in-court-180606/)

<comment><USER15> Is there any way to prove that is not NSA, say, and set up to only catch the biggest fish, or to always present parallel construction for criminals caught this way?

<comment><USER14> That's an interesting philosophical question.[1][2]

[1][https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)#P...](https://en.wikipedia.org/wiki/Burden_of_proof_\(philosophy\)#Proving_a_negative) [2] [https://en.wikipedia.org/wiki/Evidence_of_absence](https://en.wikipedia.org/wiki/Evidence_of_absence)

<comment><USER15> I like you. I tend towards pyrhonism (or maybe I don't!) so I appreciate that response.

Degree of proof is a relative: Maybe a terror organisation use PIA, NSA go fishing for evidence PIA has nothing. Terror org assassinate NSA head. PIA could be a front, but NSA head had to be willing to lose his life to hide the fakery, and terror org wasn't a big enough fish ... more likely you're currently in a coma. Lots of places for false premises to creep in.

Dial it back, is there a point where there'd ever be enough evidence?

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I wouldn't trust any VPN under China's sphere of influence.

<comment><USER17> That's actually not an entirely crazy idea if you're trying to hide from Western governments. Are you more worried about the Chinese government coming after you? Likewise, if someone in China is trying to hide from the Chinese government, it might not be a bad idea to use an USA based VPN. Maybe string up a bunch of VPNs in regions that are at least somewhat hostile to each other and it might be too hard to track an IP back to its source. I guess trust no government and use their hostility towards each other to your advantage? Just an idea prompted by your comment.

<comment><USER18> > That's actually not an entirely crazy idea if...

Except that it gives them a direct avenue into your network for their own surveillance and other network attacks ... If you think comcast injecting their own JS into http pages is bad, wait you see what the d̶a̶r̶k̶ ̶a̶r̶m̶y̶ CPC could do with such power...

<comment><USER19> What's stopping any domestic TLAs from doing the same though?

<comment><USER18> Its more about trust. I trust them to try their best to be benevolent

</comment></comment></comment></comment></comment><comment><USER20> Oeck claims no-logs and details how they've achieved that (they don't even have hard drives). Support is responsive, you'll be responded to by those who actually built the platform. They're planning support for WireGuard.

Unfortunately they have admins in Australia which has some pretty hefty laws similar to those in the US (look at gag-orders issued, and recent responses to media outlets for publishing vetted and leaked data). You can find their intro post in Whirlpool forums.

They configure a PXE and have a system in place for distributing the OS in each region (and thus each data center).

For debugging issues they try to replicate things on a local environment and my assumption is if there's any networking issues, they likely have a node on the same data center they can remote to, to test connectivity issues - <USER2> functional issues require replication locally. No SSH access to the box.

So I think for now, Oeck or Mullvad are good choices. I only wish these services did 1 thing differently - and that is, release a live video stream of their server farm's rack and video-document the entire process of compiling and shipping their hardware, as well as the systems in place for loading the OS to ensure no exfiltration data from malicious services or agents on the box.

This could be done relatively cheaply - I'm surprised none of the VPN providers have yet. A fish-eye lens attached to a webcam on a rack would be cheap to install. It's the closest thing we have to proof a VPN server hasn't been owned without a zero-day. If you're using up-to-date services, a LEO, government or APT using a zero-day to own your server is really the only means of exfiltrating user data in this environment.

<comment><USER21> > I only wish these services did 1 thing differently - and that is, release a > live video stream of their server farm's rack

This is security theatre. Anyone wanting to surreptitiously access the server farm only has to stream an alternate video to defeat this.

<comment><USER22> But it still builds trust in the brand.

No one is safe from a state actor.

<comment><USER21> Trying to gain trust against something you have no control over is the very definition of security theatre.

<comment><USER22> Um, no.

I'm saying that staff can be observed as behaving correctly, professionally, and more. This would build trust in the brand from multiple perspective, not just security.

There are been a few cases in which this has turned around public opinion re: trust.

</comment></comment></comment></comment></comment><comment><USER23> I've come to the sad realization if you want anything approaching no logs, you're going to have to use something slow like tor, or you're going to have to do the illegal thing and make a botnet.

VPNs are only useful for avoiding ISP / local network surveillance like comcast, your workplace, your school, airports, etc and to avoid DCMA scare letters. Making your own with a VPS is worse, since VPSs log on some level and directly forward the DCMA scare letters to you.

<comment><USER11> What about chaining VPNs? Even at 2 they'd have to cooperate to unmask your traffic, right?

Somewhere in the back of my mind is stored that minimaxir does this, but I couldn't confirm it with a quick search.

Edit: I was actually thinking of mirimir.

<comment><USER24> Provider#1 only knows all traffic goes to provider#2. Provider#2 knows everywhere your traffic goes. They don't know your IP, but you need to login, so they know who you are anyways.

<comment><USER15> I think you need 3 levels. First level gets you to the second level. 2nd gets access to web-based email and bitcoin or single-use credit card payment to get the third level, which accesses data.

Obviously you use assumed identity.

With only two layers you'd need to access emails, say, for account confirmation direct from your own system; with 3 you put a VPN in that gap.

Do VPNs re-pack and modify the timing on packages they pass on to clients? It seems like they're need to if they're too avoid coordination attacks.

I'm recalling how a research paper showed an extraordinary high number of pages visited (80%) over HTTPS could be identified using page size alone. If a TLA is watching all traffic into and out of a VPN's server can they pair upstream traffic to downstream clients at all?

</comment></comment></comment></comment><comment><USER25> This was necessarily going to happen at some point and I hope it serves as a cautionary tale to not blindly trust "no logs" claims.

<comment><USER26> This isn't the first time VPNs with those claims have turned out to have them, they've been used as court evidence IIRC.

Edit: [https://proprivacy.com/privacy-news/no-logs-ipvanish- hands-l...](https://proprivacy.com/privacy-news/no-logs-ipvanish-hands-logs- homeland-security)

</comment></comment><comment><USER27> What's the most trustworthy VPN that HN users recommend? My 3 year subscription to my local one is about to run out! Looking for advice on what is trusted nowadays!

<comment><USER28> No such thing. You would be better off renting an inexpensive VPS and running your own VPN on it.

Public VPN services have to be the one of the greatest lemon markets to have ever existed:

You want people's private data? People will _pay_ you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get.

People realize this, so you end up getting a disproportionate number of customers that don't worry about you getting their data because they're only using the service to behave abusively... which drives up costs.

So an honest provider has to deal with dishonest competition selling below cost and a customer base that is saturated with problem customers because good customers are savy enough to avoid VPNs.

<comment><USER6> Running your own VPN provides no privacy, since you're the only user.

Of course other VPNs don't provide privacy either. The belief that they do is due to marketing, and misunderstanding what the "Private" part of VPN means: it means that two non-publicly routable IP networks (10/8, 172.16/12, 192.168/16) are virtually joined into one network. VPN companies took advantage of this (and that the connection is usually encrypted) to imply that they offer a privacy product.

The main use of a commercial VPN is to bypass region locks and other legal controls that depend on location. Pick a VPN provider (or VPS host) in a jurisdiction that won't cooperate with your home law enforcement. Assume the VPN provider spies on all your traffic.

<comment><USER29> This is such a deeply misleading statement.

Privacy fundamentally is about keeping things private ... _from someone_.

If that someone is everyone, then nothing is private. Any sufficiently powerful entity can just overpower you, torture you into submission, guarantee a backdoor into a system you thought was cryptographically private, etc.

I for one do pay for a VPN service, because it keeps my home traffic stream private from _some people_ \- namely my ISP - with high probability.

It also obfuscates various types of traffic I generate and makes it harder, though I agree not impossible, to collate my traffic into a usable form for spying agencies.

For me that's easily worth paying ~$100/year for someone else to manage, and if they base their business reputation on not collecting logs, etc., there's enough incentive to trust that while also staying vigilant to verify what I can and switch providers if they are shown to be lying.

Self-hosting a vpn is utterly not an alternative for my use case, not even for technical reasons as I am an engineer who works on production web services all day. Just from a cost effectiveness / value POV, third party vpn vendors are a good solution for me.

<comment><USER6> Right, I overspoke. It provides no _extra_ privacy, against anyone except your ISP. If they're the threat, AND you're able to safely assume that the VPN provider is less of a threat, THEN it provides some privacy.

</comment></comment></comment></comment></comment><comment><USER30> The old saying trust but verify always seems to come up. Companies claim x and we find it to be untrue. They apologize, share statement they will do better and the cycle continues. Is anyone else tired of the tomfoolery?

<comment><USER31> Do you have a suggestion on how to verify the claims of a company you only interact with over the Internet?

(edit: not that I disagree with you, I honestly don't see a practical way to do that. It's not like security seals have proven their worth in pixels either)

<comment><USER32> The sensible thing to do is to assume a cynical mind. Unfortunately, with stuff like this, you'll probably be more often right then wrong, though you may never find out.

</comment></comment></comment><comment><USER33> With WireGuard, it is easy these days to setup a VPN on our own server([https://www.freecodecamp.org/news/how-to-set-up-a-vpn- server...](https://www.freecodecamp.org/news/how-to-set-up-a-vpn-server-at- home/)). Obviously it won't give us anonymity, but it is a good choice for security when browsing from public wifi.

</comment><comment><USER34> On a reddit thread about this news, they mentioned that the company behind ufo vpn (dreamfii hk limited) is actually owned by lippo limited, which is owned by lippo group. I can't find any information on the web that back this though. But if this is true, this kind of shenanigans (saying they don't keep log but actually keep them anyway, then leaks it due to sheer incompetence) is not surprising considering lippo group's well known history of corporate malpractice and screwing up their customers and partners alike. How companies this shrewd (so shady and well known they became a meme) continue to survives (and thrives!) is beyond me. Maybe there is money in screwing people after all.

</comment><comment><USER35> I don't know why anybody ever cared about logging policies. How would you even know if they keep logs or don't, or what they do with them if they do?

<comment><USER36> You can't possibly know. You have to just assume all VPN companies are logging your activity indefinitely regardless of what they say. Though I suppose you'd rather go with a VPN company that claims it doesn't do any logging, over one that says it does.

<comment><USER37> Exactly. The only way is to make logs useless to begin with. See my comment earlier: [https://news.ycombinator.com/edit?id=23881148](https://news.ycombinator.com/edit?id=23881148)

</comment></comment></comment><comment><USER38> Know what's valuable? Internet traffic from people who think it's important enough to hide, and who have technical skills to get jobs with them. The value of privacy viewed this way would mean that a truly private VPN service would be hugely expensive, like the way a new Rolls Royce is priced at 50x that of what you need to get from A to B.

</comment><comment><USER39> VPN providers are just internet resellers with a side business of affiliate marketing other VPN providers comparing "privacy" claims and acting unbiased

I'm amazed at the smart people that fall for that

The best test are court cases where investigators were stonewalled by a particular VPN provider

If you dont want the US knowing something but dont mind China knowing something, Express VPN got you

</comment><comment><USER40> More importantly is that all this internet traffic is routed through China. Explicit MITM attacks are a courtesy.

</comment><comment><USER41> Why would you trust a VPN when any TLA/CIA/NSA/FBI can set up 1/10/100 options relatively cheaply. Unless you go through TOR or use a false MAC address you have no guarantees, even then fingerprinting and fake TOR exits points are a serious risk if you are trying to be truly anonymous.

</comment><comment><USER42> I think that at this point it is far easier to just setup a socks proxy with an vloud based machine than to research which firms have shady practices and which dont. I went into a womrhole over NordVPN vs PIA vs ProtonVpn and then just went with a proxy server. Costs peanuts with the cloud compute ecosystem.

<comment><USER43> >then just went with a proxy server. Costs peanuts with the cloud compute ecosystem.

The problem with personally operated VPN servers is that all the traffic ties back to a single user: you. This is fine if you're on a malicious network and need secure exit node for your data, but for anonymity (eg. ad tracking, DMCA) it's objectively worse.

</comment></comment><comment><USER44> If they promised no logs why did they take the extra steps to log. That's the opposite of a lazy mistake.

</comment><comment><USER45> How can you tell when VPN provider is lying when they say they don't collect logs?

They say that they don't collect logs.

<comment><USER37> The only way is to make logs useless to begin with. See my comment earlier: [https://news.ycombinator.com/edit?id=23881148](https://news.ycombinator.com/edit?id=23881148)

</comment></comment><comment><USER46> [https://news.ycombinator.com/item?id=21326484](https://news.ycombinator.com/item?id=21326484) still valid

</comment><comment><USER47> Why does anyone think with the prevalence of "free" VPN that these companies aren't storing and selling the crap out of your info?

</comment><comment><USER48> Entrusting a third party to only play the role of protecting your privacy always sounds like a dangerously bad idea.

They've got no dog in the fight.

</comment><comment><USER49> if you want a vpn ur better off running squid on a $5/month vps box , less likely this kind of nonsense happens

</comment><comment><USER50> You can't trust firms hosted in HK anymore. It's as tainted as China is.

</comment><comment><USER51> Must have had an encounter with an unidentified filing object...

</comment><comment><USER52> There needs to be a serious rethink of VPN services

<comment><USER37> We did exactly that.

See my comment earlier: [https://news.ycombinator.com/edit?id=23881148](https://news.ycombinator.com/edit?id=23881148)

</comment></comment><comment><USER53> Can you chain two VPNs?

<comment><USER14> Yes you can.

<comment><USER37> While you can, this is really hard. Let us do it for you.

See my comment earlier: [https://news.ycombinator.com/edit?id=23881148](https://news.ycombinator.com/edit?id=23881148)

</comment></comment></comment><comment><USER54> Can the title be updated to include the name of the "firm" (article says "Hong Kong-based VPN provider called UFO VPN")?

@dang

</comment><comment><USER55> @dang: can the title be changed to "UFO VPN claims zero-logs policy, leaks 20M user logs". So users don't have to click through to the story to find out which firm?

<comment><USER56> Ok done.

Edit: I also changed the URL from [https://www.hackread.com/vpn-firm-zero- logs-policy-leaks-20-...](https://www.hackread.com/vpn-firm-zero-logs-policy- leaks-20-million-user-logs/) to what seems to be the original source.

<comment><USER55> Thanks!</comment></comment></comment>


Apple resetting iCloud iTunes Match libraries on September 26 - <AUTHOR> http://thetecherra.com/2011/09/23/apple-resetting-icloud-itunes-match-libraries-on-september-26/

<comment><AUTHOR> It blows my mind that Apple, of all companies, thinks that it is actually okay to delete all of a customer's data from their cloud storage service 'in order to serve you better', especially in a case like this where most of the files are probably music you bought from iTunes in the first place.

Apparently it's okay because it's still a 'beta', but this just seems lazy to me and may undermine any early adopters' faith in Apple's cloud services.</comment>


Show HN: PTP Encrypted Identity Manager that doesn't store passwords in a cloud - <AUTHOR> https://myki.co <comment><AUTHOR> The Myki Password Manager & Authenticator is designed in a way that prevents hackers as well as governments from accessing your accounts.

In our opinion, cloud storage of passwords, keys and certificates is convenient but constitutes a big security issue. Hackers shouldn't be able to compromise a publicly accessible server and as a result gain access to users credentials.

Myki follows a different approach by creating a private cloud in your pocket. All of your passwords and keys are securely encrypted on your smartphone (secure backups are automatically made on other devices that you own in an ad- hoc manner).

You can pair the Myki app with your computer browser by scanning a symmetrical encryption key (AES256 PBKDF2) generated by the browser extension.

This create an encrypted P2P connection between your phone and your browser.

When you need to login to an account on your computer, you receive a push notification to your smartphone. You can grant access from your mobile lock screen by using your fingerprint or a pin code.

The passwords are then encrypted with the shared key (generated by the browser) and sent to the browser extension that decrypts them and injects them in the website.

As a result of our unique architecture: \- Our servers are only used as relay servers (they don't hold any sensitive information, we can't get subpoenaed, if our servers are compromised they don't hold sensitive users' data)

\- No master password needed (another password to secure all other passwords? Really?!)

\- Myki can pair and log you in on an unlimited number of computers.

\- Myki stores and auto-fills two-factor authentication tokens.

\- Myki can remotely log you out of any account on your computer from the myki app on your phone

For more information about how myki works, visit: [https://myki.co/privacy](https://myki.co/privacy)

You can get the app on iPhone and Android from [https://myki.co/download](https://myki.co/download)</comment>


Trusting your team - <AUTHOR> https://medium.com/p/49da6ecb9019

<comment><AUTHOR> Wrote this blog post from my notes from the Google Ventures Summit. Would love to hear feedback.</comment>


Toxorhynchites – Mosquito Eater - <AUTHOR> https://en.wikipedia.org/wiki/Toxorhynchites <comment><USER2> Spiders are also useful. My exgf lived in a farm and had dozens of harmless spiders in the ceiling of her bedroom that ate all mosquitoes. It nuanced my view on spiders.

<comment><USER3> How do you determine if they're harmless? I had a spider bite a couple of weeks ago that gave me a welt the size of a dime (and super itchy).

<comment><USER4> Depends where you live but you can look up what spiders are in your area and which ones are dangerous. For example, in most of the US you only really have to worry about black widows (which are pretty distinct) and brown recluses which have a characteristic violin on them but IME often somewhat resemble the harmless wolf spider, which is common in my area.

I'm pretty good at identifying the dangerous spiders now (i.e. distinguishing brown recluse from wolf), but it took several instances of trapping the spider under a glass and then breaking out my cell phone and looking at lots of pictures.

If your area has _lots_ of kinds of dangerous spiders then it might be more of a pain, though.

<comment><USER5> There are plenty of spiders in the US that are harmful if they bite you but aren't "dangerous."

I think what the parent comment was worried about was painful bites more-so than death (though that's also worrying).

</comment></comment></comment></comment><comment><USER6> I recently found out that Bedbugs are still a thing (I thought they were largely eradicated). I also found out that I'm allergic to them, and While a mosquito will bite once of twice (until it finds blood), these guys leave a line of bites as they move around sampling your blood (my back, neck, and shoulders were covered in welts).

I generally avoid killing/ removing spiders (they also prey on moths, keeping clothes etc hole-free), wasps too to an extent (but they are still largely a pest).

The Bedbugs were quite easily eradicated with insecticide around and under the bed, but that's last a resort as it is toxic to virtually everything (including pets and humans), something I don't doubt as the smell is more irritating than Ammonia. I'd much rather use natural remedies (especially when you don't have to do anything), than strong chemicals that we don't truly understand the effects on the environment or the food chain.

<comment><USER7> [http://npic.orst.edu/factsheets/degen.html](http://npic.orst.edu/factsheets/degen.html)

Diatomaceous Earth is a dusty substance made from the shells of tiny sea creatures. The shells are so tiny (and then ground finer) they wedge into the exoskeletons of insects and eventually kill the bbugs. But it's pretty safe for larger animals and safe for home use

<comment><USER8> DE is also used for swimming pool filters.

</comment></comment></comment><comment><USER9> Dragonflies are another great bug. They feed on mosquito larva during their own larval stage, and as adults they chase down adult mosquitos.

<comment><USER10> Are these effective to have in your room to hunt down mosquitoes?

<comment><USER11> You can have geckos. They are quite effective and don't care of human presence. They just stay on the wall or on their branch.

<comment><USER12> they poop all over your wall though

</comment></comment></comment></comment><comment><USER13> Missed opportunity: "mosquiters", although that also sounds like a cutesy way to say "mosquito".

<comment><USER14> It's too close to "skeeters" to be interpreted any other way.

<comment><USER15> skeeter-eater

</comment></comment></comment><comment><USER16> The biology of Toxorhynchites mosquitoes and their potential as biocontrol agents [http://www.cabi.org/bni/FullTextPDF/2000/20003030873.pdf](http://www.cabi.org/bni/FullTextPDF/2000/20003030873.pdf)

</comment><comment><USER17> Oh, I thought mosquitoes had no predators.

<comment><USER18> Birds?

<comment> mark-r When I was a kid, it was believed that Purple Martins ate lots of mosquitoes. People would build big houses for them to encourage the population.

Later it came out that Purple Martins much preferred dragonflies, which are a more effective mosquito eater.

</comment></comment></comment><comment><USER19> Scent of Chicken can drive away Mosquitoes [https://archive.fo/IJm4Y](https://archive.fo/IJm4Y)

</comment><comment><USER20> So all the money spent on mosquite coil, net , aerosol, skin cream ( while harming your own body ) was worth for nothing ? Nature had a better solution all along.

If we lived in forests mosquitoes won't be a problem, well at least all those activities increased GDP.

<comment><USER21> The ignorance in comments like these is bugging (yes) me.

If you truly believe nature itself is perfect and human inventions are stupid, leave the comfort of your home / office and try to survive buttnaked in the jungle, all by yourself.

<comment><USER22> People who think nature is all beautiful and perfect and benevolent ironically are the same people who have never tried to survive in the harsh wilderness.

<comment><USER23> Oh, I do believe nature is all beautiful and perfect and I did survive some very harsh wilderness. I just never believed it is allways nice to be, if I am unprepared ..</comment></comment></comment></comment>


Vulnerability vs Exploitability: Using Exploitability to Manage Vulnerabilities - <AUTHOR> https://medium.com/deepfence-cloud-native-security/exploitability-vs-vulnerability-leveraging-exploitability-for-vulnerability-management-2c27b46eebf2 <comment><AUTHOR> Thousands of vulnerabilities are disclosed every month and developers get overwhelmed while managing so many vulnerabilities in their cloud infrastructure. Read our blog post on how Deepfence ThreatMapper helps developers and security analysts to prioritize and mitigate their most exploitable vulnerabilities in an efficient manner.

[https://medium.com/deepfence-cloud-native- security/exploitab...](https://medium.com/deepfence-cloud-native- security/exploitability-vs-vulnerability-leveraging-exploitability-for- vulnerability-management-2c27b46eebf2)

#kubernetes #cloudnative #devsecops #k8s #cybersecurity #cloudsecurity #vulnerabilities</comment>


What is the difference between capitalism and the free market? - <AUTHOR> Google definitions:
Capitalism: An economic and political system in which a country's trade and industry are controlled by private owners for profit.
Free market: An economic system in which prices are determined by unrestricted competition between privately owned businesses.
Those sound like the same thing?  Why do we have two separate words for them?  Can free market exist without capitalism or vice versa?
I have yet to get an answer without circular logic on this. <comment><USER2> There is no real difference. The term "capitalism" is felt to be dissimilar from "free market", but no one is usually able to articulate a coherent difference. The central problem is that "capitalism" took on negative connotations over time and became deeply connected to Marxist/anti-Marxist rhetoric. At its core, though, it's still largely about ownership, even in Marxist critique or anti-Marxist defense. "Free market" is also a loaded term, it seems to signal being a libertarian, but generally refers to exchange restrictions; libertarians usually use "property rights" with respect to ownership issues. "Market" is fairly neutral, I think.

To take a stab at it, "capitalism" emphasizes the ownership elements of markets; "free market" emphasizes the exchange elements of markets; "markets" is just a neutral term, there aren't markets without ownership (rightful or not) and exchange (good or not). Neither "capitalism" nor "free market" _deny_ exchange or ownership, it is merely a rhetorical emphasis; both specify the same set of objects, they just signal which features the author intends to dwell on.

</comment><comment><USER3> Capitalism deals with ownership, specifically of the production means.

Free markets is when the markets allow actors in the market to exchange goods and services without the interference of external powers, specifically the state.

These _can_ theoretically exist independently, but are generally interdependant for mutual success.

</comment><comment><USER4> I don't think you can escape circular logic because the terms are vague and overlapping. The focus on private owners is also a dehabilitating diversion. The core is economic competition. Any self-interested actor will try disable competition through various means, including corruption of the public sector, so public/private loses meaning quickly in practice. A focus on private also means that the entirely rational strategies that China takes of locking in natural resources on a global scale and building long term competitive infrastructure are not open to the less competitive economic strategies championed by the US.

</comment><comment><USER5> This is not the forum for this...

</comment><comment><USER6> It only depends on your definition, which will always end up being twisted for political purposes anyway.

I would say a free market is one without coercion, and capitalism is when private property rights over the means of production are well respected. But many others would alter this, such as saying that it requires a government money supply etc, which I think is not part of an appropriate definition. Not a meaningful discussion really.

</comment><comment><USER7> The difference is the word 'unrestricted.'

</comment><comment><USER8> Capitalist systems could be described as systems where the government plays a larger role in monetary policy through banking, loans, etc.

In a true free market the government wouldn't bail out bad private investments or use public funds to bet on what politicians think are good investments.

</comment><comment><USER9> "Why do we have two separate words for them?" ... did you just ask Hacker News why synonyms exist? Why does this one bother you more than ire versus anger or common versus ordinary?

</comment><comment><USER10> One word refers to an economic and political system, the other describes a market.

It's possible to have a (mostly) free market in an different type of political system.

</comment><comment><USER11> A better place for this question is <http://www.reddit.com/r/AskReddit/submit>

</comment><comment><USER12> They are different. You can have a regulated market, where while the country's trade and industry is still owned by private owners, the government dictates the rules that will establish the price for certain products and services.

This is a big generalization, but it's easier to understand this way:

Rich and industrialized countries, generally advocate for total free markets, because they already have well established and competitive industries. They have gone through the hassle of building those sectors from scratch decades ago, and now have easier and less expensive access to the newest technologies. As the first ones to develop much of the methodologies and technologies used by industry, they own the patents, so the basically control those markets. As most of their industries are now mature and richer (e.g. pharma, electronics, energy, chemical), if a new business rises in a developing economy with free market, they can often force an acquisition (for example through a hostile bid), and that way, maintain the status quo.

On the other side, many developing countries prefer the opposite. This happens for different reasons.

One reason may be trying to assure that the entire population has the possibility to access to certain products. One example that comes to my mind right now is milk. If local people can only pay $1 per litre, but the international price is.. say $3 per litre, the producer indubitably have a stronger desire to sell it to foreign countries ( _with evil face_ Eat when you have money!! Mua-ha-ha!). So, by regulating milk price, governments will let poor people access to elemental goods (and this usually happens with energy, water, oil, food, health).

Other reason is that in order to let the industrial sector grow and flourish, that nation has first to make a sacrifice, and, like a little plant, try to protect that sector from the outer world. One way of doing this is by subsidizing it (e.g. tax exemption, lower energy costs, cheaper credits and so on), and often, limiting the amount of entrance to the country of competing products that will make the local product look as overpriced and obsolete (import quotas). One way of limiting the importation of foreign products, is by applying import duties to that kind of product and setting import quotas. That way, the government tries to equal or put in advantage the local product vs the imported product, creating a local market that eventually will let local companies grow. As the local companies evolve, develop and compete, they will start to have more access to new technologies, higher quality products, and so they'll be able to compete in a regional market, and then, if lucky... a global market :) (Well, that's in theory, but it worked in many countries).

But then, It happens to exist a threat. Some countries will try to impose their products in other countries (imagine, who are the ones here?), and eventually dismantle local competitors doing something called "dumping" [1], which is basically predatory pricing. This is (as wikipedia states) "the act of charging a lower price for a good in a foreign market than one charges for the same good in a domestic market". For example: Country One (C1) wants to place their products in Country Two (C2). C1 has already a large industrial sector, and wants to expand its market globally. So, the government helps their industries to expand into other economies, choosing C2 as a target. They subsidize exports to C2, basically annulling import duties from C2. This way, C1's company can place their products in C2, much cheaper than C2's local products. C2 industry eventually can't compete anymore and goes bankrupt. C1 now controls the market, and can start to raise prices. As dumping is hard to prove (WTO theoretically forbids this behavior), and fighting it usually involves heavy diplomatic consequences, those countries trying to maintain a certain industrial sector, and let it grow, work in advance by protecting that sector by the means of protectionist policies [2].

Of course, other countries will start to complain, because they can't sell as much products there as they want, calling for a free market. But the most funny thing, is that while those countries complain, they usually protect some other sector by themselves. (One example of this is the EU and USA and their agricultural protectionism).

Of course, as in the jungle, the stronger prevails. While richer countries call for free markets, poorer ones try to protect their own markets. But very often, developed countries also start to protect their own markets during certain economic cycles and crises, in an attempt to avoid unemployment and hostile acquisitions of their companies from foreign companies (look at Europe right now). So, one solution for this usually comes in the form of trade agreements. Some trade agreements include the possibility of a country selling certain product to the other, and vice-versa, while also usually establishing some kind of preference for those types of products to be traded between the signatories. Other treaties are much more open - the Free Trade Agreements, which virtually eliminates all kind of import quotas and tariffs on almost all goods and services trades between the signatories. The problem with the latter, is that if those two economies (countries, regions, trade areas, etc) don't complement or there are large differences between their competing industries, usually, the final result is the same as with dumping. That is, the weakest economy's companies closing, the strongest economy's companies controlling the market.

International trade is hard, because everyone wants the best for their own. There's only one cake, and everyone wants the biggest piece.

Hope it helps!

[1] <http://en.wikipedia.org/wiki/Dumping_(pricing_policy)>

[2] [http://en.wikipedia.org/wiki/Protectionism#Protectionist_pol...](http://en.wikipedia.org/wiki/Protectionism#Protectionist_policies)

Edit: BTW, As others wrote, this is not the best place for this kind of question. But after writing all of this, I'll leave this answer here anyway.</comment>


SMIs are Eeeevil (2005) - <AUTHOR> https://blogs.msdn.microsoft.com/carmencr/2005/08/31/smis-are-eeeevil-part-1/ <comment><USER2> Part 2, for those who are looking [https://blogs.msdn.microsoft.com/carmencr/2005/09/01/smis- ar...](https://blogs.msdn.microsoft.com/carmencr/2005/09/01/smis-are-eeeevil- part-2/)

Unfortunately, Part 2 also mainly consists of throat-clearing and the promised third article doesn't appear to exist.

Not a very fulfilling series of articles

</comment><comment><USER3> Is SMM still used? Why not have a separate CPU for the job?

</comment><comment><USER3> 2005</comment>


World's first quantum-cryptographic satellite network is likely to be Chinese - <AUTHOR> https://www.economist.com/news/science-and-technology/21727889-quantum-cryptographys-early-birds-first-quantum-cryptographic-satellite <comment><USER2> The fact is that we have political circus in the US that will kill the nation long term.

The Chinese have a 100 year plan for dominance they are working toward.

The only thing the US appears to have is a strong military and a current monopoly on the available technologies.

In 100 years, china will likely dominate the globe.

<comment><USER3> China is willing to displace 1.5 million people to build a dam. [1]

We are unwilling to hang powerlines. [2]

China is going to win economically. That usually also equates to militarily.

[1] [http://www.bbc.com/news/world-asia- china-17754256](http://www.bbc.com/news/world-asia-china-17754256)

[2] Too many to cite, but for starters: [http://www.baltimoresun.com/news/maryland/harford/aegis/ph-a...](http://www.baltimoresun.com/news/maryland/harford/aegis/ph- ag-norrisvile-power-project-opposition-0616-20170615-story.html)

<comment><USER2> Yep, and this has been widely known for decades.

The fact that there was an article almost ten years ago titled "china invades Africa" which talked about the Chinese resource grabbing in Africa illustrated the long term plans.

The us political system is an utter joke, and we will lose the economy pretty fast.

Oligarchs in the us can only think about five years out. I'd say the only long term thinker in the us currently is musk, even with all his flaws, he is building real systems of longevity.

Everything else is ephemeral.

<comment> nv-vn Long term thinking isn't possible in the US because we have a democratic government. The only 'solution' that would make it possible is to centralize under one party and create an oppressive government that doesn't give a shit about its people. I don't really know if that's what you are advocating for here, but I think it's important to highlight that the reason China is so good at planning ahead is because it will let nothing get in its way. Saying that the 'us political system is an utter joke' makes it seem to me like you think China's is somehow better, but I don't get how you can think that based on the parent comment you're responding to. Should we be calling for the US government to displace millions of people for every construction project? Should we limit the rights of every minority (whether biological, religious, political, etc.) and continue moving against their will? Should we ban access to information which criticizes our government in order to stop political dissent?a

</comment></comment></comment></comment><comment><USER4> > This phenomenon depends on the fact, surprising but true, that particles > with identical properties which are created simultaneously are entangled in > a way that means one cannot have its properties altered without also > altering the other, no matter how far apart they are.

This implies FTL communication, which is impossible. I thought entanglement was more like if you cut a coin in half along the edge and then observed that your half was heads, then you knew the other half was tails no matter how far away. I don't see how this helps detect eavesdropping.

<comment><USER5> Imagine that I give you a magic piece of paper with two binary digits (00/01/10/11) on it. I also keep such a paper for myself. If we both start by looking at our first digits then those will mysteriosly match, but if we then look at our second digits they will have just a 50% chance of matching. However, if we both start by looking at the last digits, then those will match, and our first digits will have a 50% chance of matching. If you and I start by looking at different digits, then the digits we read are just standard random bits.

The cool thing about this is that our magic paper will also work instantly even if we are lightyears apart. However, if you decide to look at the last digit and you see a 1, then that tells you nothing about me or which digits (if any) I have looked at, so I can't send you a message with this paper.

<comment><USER4> Ah, so if I understand correctly, you could detect message eavesdropping as follows:

1\. We agree ahead of time to always observe the first digit of magic papers first.

2\. I send you a message that includes eavesdropping-detecting magic pieces of paper

3\. We then compare what you measured as first digits to what I measured as first digits

4\. If the digits do not match, it means someone eavesdropped on the magic pieces of paper I sent and observed the wrong digits first.

But then aren't we back to the same secret distribution problem, where the secret is which digit we should observe first on magic papers?

<comment><USER5> As you point out, that protocol is flawed.

Here is a protocol that works (BB84):

Needed:

* A way for Alice to communicate (classically) with Bob that can be read by Eve, but CANNOT be manipulated by Eve.

* A way for Alice to send magic paper (qubits) to Bob, that CAN be intercepted and manpulated by Eve.

Steps:

1\. Alice sends a bunch of magic paper to Bob.

1.5 Eve potentially intercepts the shipment and manipulates it.

2\. For every piece of paper, Alice randomly decides which digit to check. Bob does the same independently.

3\. Alice and Bob tell each other over the classic channel, that Eve cannot intercept, which digits they checked.

4\. They discard the papers where they checked different digits, and use the rest to form a One Time Pad.

</comment></comment></comment></comment><comment><USER6> It seems hard to find non-blockchain related/ ethical, crypto jobs in the US which would lead to quantum cryptography type output.</comment>


How to do Responsive Web Design? - <AUTHOR> http://pixelstech.net/article/index.php?id=1336046380

<comment><USER2> There are a couple of errors in this post: mainly, _we cannot use absolute widths_. Of course you can, you just need to combine them with Media Queries. My personal preference is to use media queries in CSS rather than selectively loading the stylesheets. I don't think the extra traffic justifies more connections.

</comment><comment><USER3> This looks very similar to <http://www.alistapart.com/articles/responsive-web- design/> \- they've even used the same graphics!

</comment><comment><USER4> Enjoyed that a lot, thank you - will definitely be passing it to designers I run into at agencies who are new/struggling with it

</comment><comment><USER5> I'm not convinced that horrifically fugly scraper site knows anything about "web design" - other than how to steal content</comment>


Browse test cases · jsPerf - <AUTHOR> http://jsperf.com/browse <comment><USER2> FYI, this has been submitted before: <http://news.ycombinator.com/item?id=1565257></comment>


Good Login Auth system in CodeIgniter?  - <AUTHOR>

Building a website that I hope to have a lot of users on eventually. Need a good user login authentication system that uses email not captcha. Can anyone recommend a library? <comment><USER2> I am using iAuth library and is quite powerful those days. You may check it right here: <https://github.com/benedmunds/CodeIgniter-Ion-Auth></comment>


Input: Fonts for Code - <AUTHOR> http://input.fontbureau.com/info/ <comment><USER2> Nice but nothing will replace Iosevka for me now, the fact they have alternative glyphs for common programming usage and that you can rebuild the font to whichever set you want combined with extremely legibility at small sizes and a default condensed design (more characters per line for same width screen/window) makes it close to the perfect programming/terminal font imo.

<comment><USER3> Agreed. Coming from SourceCode Pro, everything seemed a bit taller, but adjusting the space between the lines fixed that perception. Looks smooth on my 2015 MBP, and external 24" 1920x1200 monitor.

<comment><USER2> My #2 is PragmataPro it still has nicer/more ligatures than iosevka but I expect that to get fixed over time.

It's a beautiful (but not free/open) font though.

</comment></comment></comment><comment><USER4> FWIW, the Input Mono family are the best coding and writing fonts I've found over the years, "Inconsolata" being a runner-up.

These days I use Input fonts in Emacs, all terminals, and writing apps like Ulysses, also on iOS. Nothing else comes close in terms of readability.

<comment><USER5> I found out about Consolas by way of Inconsolata.

One day I spent an afternoon looking for a better coding font.

I liked Inconsolata. When I Googled to find out more about it, I learned it is a knock-off of something that was hiding right under my very nose: Consolas found on Windows boxes.

I tried that and found it better. I now have Consolas all over the place. I'm typing in it on Firefox. I have it in Ubuntu right inside Gnome terminal and other places.

Thank you, Microsoft!

<comment><USER6> Agree! Conolas it's the best for me. And it's already there.

</comment></comment></comment><comment><USER7> Looks nice. Good thing they included stylistic alternatives for their default curly brackets, because that default would really bother me.

I don't like the weird proprietary licence though. There are plenty of excellent free software fonts out there (e.g., _Hack_ or its ancestor _Deja Vu Sans Mono_ and sibling _Ubuntu Mono_ — all three exist today because of the permissive licensing of their common ancestor _Bitstream Vera_ ).

</comment><comment><USER8> I've wanted a proportional font for coding for a long time! I sympathize with Rob Pike:

[https://twitter.com/rob_pike/status/567476552187641856](https://twitter.com/rob_pike/status/567476552187641856)

I much prefer reading proportional fonts. This new font solves a problem I've had: punctuation is hard to discern in proportional fonts. But I'll still have trouble with deeply-nested functions not lining up.

<comment><USER9> In the example in that stream of tweets, you have:

        put   = blah
        get   = blah
        post  = blah
        patch = blah

gofmt accepts it as aligned, but the equals signs are visually unaligned when using a proportional font.

I wonder what it would take to create an editing environment where you have a proportional font that shrinks or grows the (visual) whitespace to align those, and whether it could scale to things like nested functions.

<comment><USER10> Surely, one logical space of variable width is a tab? I prefer spaces to tabs - but if one makes concessions to readability like variable-width fonts - it's time to bring back tabs, too? (I do think this is a good idea, but "before" spaces won, in no small part because pre high-resolution screens, I think monospace was the better choice. With high dpi comes pretty layout - also of code).

<comment><USER11> The solution: Elastic Tabstops ([http://nickgravgaard.com/elastic- tabstops/](http://nickgravgaard.com/elastic-tabstops/))

<comment><AUTHOR> This is awesome - thank you!

</comment></comment></comment></comment></comment><comment><USER12> Maybe it's familiarity but having just tried this (and Iosevka recommended elsewhere in the thread), I much prefer Consolas. Find it a lot easier on my eyes (this is with the Monokai-Cobalt theme on VSCode).

</comment><comment><USER13> I tried switching all my UI fonts to Input recently, under Linux. Input Mono is pretty cool, but for whatever reason Input Sans and Input Serif have their kerning all messed up, making them very tiring to read.

At least Linux seems to handle the multitude of visual weights decently these days; when Input first came out it seemed like Linux would pick one weight as Regular and one as Bold and every other weight was mapped to one of those two.

</comment><comment><USER14> Happy user of Input Mono ever since it came out back in 2014. Never looked back once!

</comment><comment><USER15> Don't agree with there arguments about proportional fonts for coding though

</comment><comment><USER16> I tried many programming fonts, and nothing so far was able to surpass the ergonomics of DejaVu Sans Mono.

</comment><comment><USER17> Beautiful writing, ugly font.</comment>