The Clockwise/Spiral Rule of C declarations - <AUTHOR> http://c-faq.com/decl/spiral.anderson.html <comment><USER2> This has been posted before[1], and the "spiral rule" is a load of hooey.

The correct rule is "follow the C grammar". An easier to remember and also correct rule is "start at the identifier being declared; work outwards from that point, reading right until you hit a closing parenthesis, then left until you hit the corresponding open parenthesis, then resume reading right..." (this is sometimes called the "right-left rule"[2]).

The "spiral rule" dances around the truth without actually being precise enough to be useful.

[1] [https://news.ycombinator.com/item?id=5079787](https://news.ycombinator.com/item?id=5079787) [2] [http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html](http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html)

<comment><USER3> I used to complain about re-posts too. But now it is the first time i see a reference to this website, which seems interesting to me. So i'm happy with new url on my to-read list.

Thanks!

</comment></comment><comment><USER4> Way simpler: from inside out, read any subpart of the type as an expression. (Arrays have precedence over pointers, as usual.) The type that remains is that expression's type. So e.g. given the type:

        const char *foo[][50]

the following expressions have the following types:

         foo       -> const char *[][50]
         foo[0]    -> const char *  [50]
         foo[0][0] -> const char *
        *foo[0][0] -> const char

Another example:

        int (*const bar)[restrict]

          bar     -> int (*const)[restrict]
         *bar     -> int         [restrict]
        (*bar)[0] -> int

One more:

        int (*(*f)(int))(void)

            f        -> int (*(*)(int))(void)
          (*f)       -> int (*   (int))(void)
          (*f)(0)    -> int (*        )(void)
         *(*f)(0)    -> int            (void)
        (*(*f)(0))() -> int

(In this case, the last expression is more readily written as f(0)(), since pointers to functions and functions are called using the same syntax.)

<comment><USER5> What happened to the const in the second example?

<comment><USER6> Yeah, I think they confused

      const *

with

      * const

<comment><USER4> Nope, * const means that the identifier (i.e. thing to the right of the star) is const. That is, in this example, the symbol "bar" is const, not anything that it points to. So once you dereference it, the const no longer matters.

<comment><USER6> You're right, I got confused. const is read as "the thing to the right of me is const". const * means const pointer, * const means pointer to const.

<comment><USER7> Vice versa. Const pointer:

        int *const p;

Pointer to const value:

        const int *p
        int const *p

>const is read as "the thing to the right of me is const"

const is one of storage classes and is read at its order, not just "to the right".

<comment><USER6> Wow. I literally was staring at my test case when I wrote it and I _still_ got it wrong. I think I need to get some more sleep...

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> The real rule is that the type construction operators mirror the unary and postfix family of operators (declaration follows use). For instance unary * declares a pointer, mimicking the dereference operator, and postfix [] and () declare functions, mimicking array indexing and function call.

To follow the declaration you make use of the fact that postfix operators in have a higher precedence than unary, and that of course unary operators are right-associative, whereas postfix are left-associative (necessarily so, since both have to "bind" with their operand).

So given

       int ***p[3][4][5];

we follow the higher precedence, in right to left associativity: [3], [4], [5]. Then we run out of that, and follow the lower-precedence * * * in right- to-left order.

If there are parentheses present, they split this process. We go through the postfixes, and then the unaries within the parens. Then we do the same outside those parens (perhaps inside the next level of parens):

       int ****(***p[3][4][5])[6][7];
                   1 2  3  4
                765
                               8  9
           1111
           3210

Start at p, follow postfixes, then unaries within parens. Then the postfixes outside the parens and remaining unaries.

The result is in fact a spiral just from going root postfix unary out postfix unary out. We just don't have to focus on the spiral aspect of it.

</comment><comment><USER9> I used to think of the spiral rule as being a good guide, but then a commenter on HN showed me otherwise:

[https://news.ycombinator.com/item?id=12053206](https://news.ycombinator.com/item?id=12053206)

<comment><USER10> The real credit goes to Linus Torvalds, as I linked in that post, but I'll repeat the link again here:

[https://plus.google.com/+gregkroahhartman/posts/1ZhdNwbjcYF](https://plus.google.com/+gregkroahhartman/posts/1ZhdNwbjcYF)

</comment></comment><comment><USER11> The rule is misleading in cases like:

        int* arr[][10];

Spiral rule would state "arr is an array of pointers to arrays of 10 ints", where actually it would be "arr is an array of array of 10 pointers to int".

Instead, when you write declarations, do it from right-to-left, e.g.:

       char const* argv[];

"argv is an array of pointers to constant characters"

It doesn't help with reading, unfortunately.

<comment><USER12> I think the advice that helped me the most was "Declaration follows usage".

      int* arr[][10];

If you index twice into arr and then dereference, you'll get an int. So arr must be an array of array of pointer to int.

<comment><USER13> Declaration follows usage is much more easier to follow than the artificial spiral rules, IMHO with a few typedefs the declaration follows usage can make things pretty simple.

</comment></comment></comment><comment><USER14> Contrast the first example with Golang:

      str [10]*byte

which reads exactly as it is declared: "str is an array of length 10 of pointers to byte" (byte is Go equivalent of C char (mostly)).

<comment><USER15> It can also be simpler if you use idiomatic modern C++ with std::array<T, n> and std::function<R(T1, T2)>.

<comment><USER10> Looking at "idiomatic modern C++", I am often at a loss for words at what lengths they've gone to in order to reinvent things while greatly obfuscating them in the process. Is there a std::pointer_to<T> too? I don't know, but something like this

        std::array<std::pointer_to<byte>, 10> str;

certainly does not look any more readable to me than

        byte *str[10];

. (Disclaimer: I mainly work with C, but find some C++ features genuinely useful, although the majority of the time they seem more like absurd complexity for the sake of complexity.)

<comment><USER16> I've never seen nor heard of pointer_to ever being used to declare a pointer to something. I believe t's used inside of custom allocators for a generic type that might not use a normal pointer as the pointer type, but would never be used for normal declarations like this.

std::array is useful for letting the compiler avoid array-to-pointer decaying, value semantics, and also actually putting array length type info in a function parameter.

</comment></comment></comment></comment><comment><USER17> I read a paper somewhere from dennis ritchie, where he explained the development of C language, the pros and cons; and in there he mentioned that reading complex declarations is a problem in C, he said that if we had placed the * operator to the left of the type it was qualifying then it would have been easier to write and understand more complex declarations.

(PS. Golang has the right idea, since its developed by the guys who contributed to C)...

<comment><USER18> Go fixes a lot of C language design bugs, and the only cost you pay is (sometimes important) garbage collection and extreme memory layout control.

<comment><USER17> I guess thats a given with the amount of ease and fast prototyping that it provides, it had to have taken a lot of decisions beforehand for you...

</comment></comment></comment><comment><USER19> What makes me wonder is why C ended up with such a syntax. That is, its contemporary, Pascal, has a very straightforward, unambiguous syntax.

<comment><USER4> The type syntax exactly matches the expression syntax used to destruct values of the type. It is very intuitive once you realize this.

The alternative would be for the type syntax to mirror the expression syntax used to _construct_ values of the type. Functional languages tend to do this, particularly ones which prefer pattern matching over destructors.

<comment><USER20> Yeah, the rule is intuitive when I am writing the code, but I think the type declarations in other languages like Go are easier to read correctly when I am skimming through the code even though I am much more used to C. I am not sure how useful this mirroring of usage is in practice.

</comment></comment></comment><comment><USER21> Seems overly complex. The way I learned it, and now teach, is to read the type backwards (int const * is 'pointer to const int') for const correctness, but anything that requires more complex parsing by a human should just be typedef'd into submission.

</comment><comment><USER22> One problem with the web is that it will remember wrong information just as well as it will remember correct information.

</comment><comment><USER23> While cdecl was probably written before some of you where born it still does precisely one thing and does it well.

Cdecl (and c++decl) is a program for encoding and decoding C (or C++) type declarations.

[http://linuxcommand.org/man_pages/cdecl1.html](http://linuxcommand.org/man_pages/cdecl1.html)

<comment><USER10> Notably, one of the exercises in K&R (with a solution provided) is to write a mostly complete version of cdecl, which I think is great for dispelling much of the "magic" and increasing the understanding of how declarations are actually parsed.

<comment><USER23> That exercise was and probably still is above my pay grade.

</comment></comment></comment><comment><USER24> Once I tried to figure out how to parse complex C declarations just by reading the specification ([http://www.open- std.org/jtc1/sc22/wg14/www/docs/n1570.pdf](http://www.open- std.org/jtc1/sc22/wg14/www/docs/n1570.pdf)), that is, without consulting guides for layman like this. But I gave up. I looked at what seemed a BNF-like description of the C grammar but I had no idea what it tells about the parsing rules. So I ended up using this guide: [http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html](http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html) With this I managed to implement an imitation of cdecl.

</comment><comment><USER25> What is the value of bending ourselves to fit a confusingly designed old language, rather than bending the language to fit us? The very fact that articles like this have to be written indicates a failure of user interface design, which we needn't forever perpetuate.

</comment><comment><USER26> Things break down utterly in the presence of typedefs. What is this?

        foo(*baz(bing,boff(*bratz)(biff)))(buff);

<comment><USER27> The "spiral rule" is just an approximation of the actual rule as defined in the standard: declaration follows usage.

Even with typedefs, that declaration means "when you call baz with a bing and a pointer (named bratz) to a function of type boff(biff), then you get back a pointer to a function of type foo(buff)."

It's an extremely concise notation for expressing type information without (much) special type syntax, and I think it's quite elegant in that way.

<comment><USER26> I'm impressed. How did you know where to start?

<comment><USER27> In C, the statement "type declarator;" is an assertion that "declarator" has the type "type". In other words, if you read "declarator" as an expression (more or less), then it should have the type "type". So here:

        foo (*baz(bing, boff (*bratz)(biff)))(buff);

"foo" is the type, and the rest is the declarator. Then you just break it down according to the usual precedence rules:

        baz(…)

"baz" is a function…

        baz(bing, …)

…which takes a "bing", and…

        *bratz

…a pointer (arbitrarily named "bratz")…

        (*bratz)(biff)

…to a function which takes a "biff"…

        boff(*bratz)(biff)

…and returns a "boff"…

        *baz(…)

…and "baz" returns a pointer…

        (*baz(…))(buff)

…to a function taking a "buff"…

        foo (*baz(…))(buff)

…and returning a "foo".

With typedefs for function pointer types:

        typedef boff (*bratz_t)(biff);
        typedef foo (*baz_ret_t)(buff);

        baz_ret_t baz(bing, bratz_t);

Or for function types:

        typedef boff bratz_t(biff);
        typedef foo baz_ret_t(buff);

        baz_ret_t *baz(bing, bratz_t *);

</comment></comment></comment></comment><comment><USER18> The first red flag is that the rule says "clockwise" where there s clearly to way to distinguish clocwise from anticlockwise inside the code. Only the completely arbitrary choice of up/down direction of the drawing affects clockwiseness.

It's been 20years(!) Why is this incorrect advise still up at c-faq?

</comment><comment><USER28> symbols with equal amount of open and close parentheses in order are counted by Catalan numbers

        (())()(()())(())

these count different arrangement of parentheses for function application. this guy is describing something like contour integration for computer programs

</comment><comment><USER29> Or, as the book Expert C Programming says, declarations in C are read boustrophedonically.

</comment><comment><USER30> I always heard of the right-left rule, which seems simpler and more accurate to me.

[http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html](http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html)

</comment><comment><USER31> I'd take the striking simplicity of a lisp anyday compared to this mess.

Yeah, I know, I'm not good enough, I didn't study enough, I'm not enlightened enough. But why make things so overly comples in the first place?

</comment><comment><USER32> This is the reason why golang declares the identifier before the type and the return value at the after the function parameters. This allows parsing any declaration from left to right.

</comment><comment><USER33> Just don't make complex declarations in C, it's almost never useful and won't help anyone out. It'll confuse people and make your code write-only. Just put in a couple extra lines of code somewhere if you have to. It won't be the end of the world.

<comment><USER10> It'll certainly confuse people, but only those who aren't qualified to be doing anything with the code anyway.

"complex" is subjective. It reminds me of stupid "rules" like "don't use the ternary operator", "every function must be less than 20 lines" (I am not exaggerating --- this was on a Java project, however); and you could easily extend that to "every statement must have a maximum of one operator", "you must not use parentheses", "you must not use more than one level of indirection", etc. Where do you stop? To borrow a saying from UI, "if you write code that even an idiot can understand, only idiots will want to work on it." I don't think we should be forcing programmers to dumb-down code at all.

That said, I'm not advocating for overly complex solutions, and will definitely prefer a simpler solution, but you should know and use the language fully to your benefit.

<comment><USER34> >> It'll certainly confuse people, but only those who aren't qualified to be doing anything with the code anyway.

If the complexity can be avoided, why not avoid it. Removing complexity is not the same as dumb-downing code. It will improve readability and maintainability.

This mindset is defintitely applicable to declaration as well as code construct.

edit: clarity.

<comment><USER10> Note the last sentence of my comment. I am not advocating unwarranted complexity at all, but just saying that there are cases where an increase in local complexity can reduce _overall_ complexity of the system, and you should not be afraid of using the language to the best of your ability.</comment></comment></comment></comment>


"Growth Hacking" is BS - <AUTHOR> http://layeredthoughts.com/startups/growth-hacking-is-bsits-all-just-marketing <comment><USER2> _"So, why is the title "Growth Hacker" a bunch of BS? Because it's just a way for marketing averse startups to hire marketers without having to publicly say they're hiring marketers."_

This is false, as you disprove a few paragraphs later:

 _"The goal of a marketer is to grow a customer base. That's what these growth hackers are doing, they're just doing it in a more technically advanced way via data confirmation and split testing."_

That is the _entire_ point of using a different term for it. Precise language is a useful tool. A job title that says "we're looking for technically advanced marketers" in a concise way will get you a better signal to noise ratio.

I don't understand why this offends you.

<comment><USER3> To me, "growth hacking" evokes more than just marketing.

Let's say my startup hustles like crazy and carves out a deal with a major coffee chain (like Square did with Starbucks IIRC).

Suddenly we have access to a whole lot more users. We grew the user base drastically, yet it wasn't exactly a result of marketing but rather one of strategic dealmaking.

To me, that is the quintessence of growth hacking.

<comment><USER4> Why not just call it business development? Why do we need the word "hacking" as part of what has been the way businesses grow?

</comment></comment></comment><comment><USER5> There is too much talk about titles and too little talk about how to get a product development process in place that allows for great product design that also achieves key metrics.

This post doesn't go very far in furthering the discussion. The answers come not from anti-[job title] posts, but something more positive, like describing how things get done at Facebook, Dropbox, LinkedIn, Zynga, and other orgs that are good at shipping product.

I talk to a lot of companies, and it is pretty easy for them to think they want to focus on growth. The interesting problems appear when (as always) there is more to do than you have the resources to get done. How as an organization do you deal with that? Driving towards growth is pretty simple, but doing it in parallel to building and selling a compelling product is harder.

By the way, Dropbox had a referral program before I got there. I just helped turn the dial up a bit, in addition to separate product changes.

</comment><comment><USER6> Here's the bit i never understood with this 'growth hacker' meme: if you're working on or for an early stage startup then _everyone_ is a 'growth hacker', right? if your people aren't working to grow your product/service/community then what the hell are they doing?

To the self-proclaimed and aggrandized 'growth hackers' - the OP is right: You're a marketer who took (and absorbed) a stats class. Stop being so fucking pretentious. Joining facebook (or whatever) after the inflection point and claiming responsibility for its growth is like joining apple four years ago and claiming responsibility for tripling the share price.

<comment><USER7> Well, it's on my business card. I guess that's what I'm going to be defending for the next few years.

</comment></comment><comment><USER8> No. Context is very important here, and it's actually quite apt with regard to hiring and being hired.

Data-driven marketing (DDM) is a huge thing now because it reliably magnifies revenue streams. However, the skill set to execute on such strategies is a bit non-traditional for marketing. If you want to hire someone to help build your DDM team, you don't necessarily want a business grad or a top salesman. What you want is an math or engineering transplant, someone with the statistical and technical skills necessary but who knows or is interested in learning the business and marketing aspects.

"Growth hacker" moonlights as a buzzword, but it's actually a great way to spin a job opening to appeal to the audience you need to attract: tech-to- business transplants. Ergo, it can also be effective self-branding if you're a tech-to-business transplant looking to make $$$ for helping to create well- documented X% to XX% revenue improvements.

<comment><USER9> Totally agree with you. I think this is about hiring the right type of people. Honestly, marketing has a bad reputation with many technical people. So if you tried to hire a CS grad into an online marketing role, it might be tough. Hence the new title. Whatever works!

</comment></comment><comment><USER10> I disagree with this article. A "Growth Hacker" is an engineer that applies himself in the field of marketing. This means coming up with interesting and innovative ways of lowering the cost of user acquisition. The distinction is important since Marketing itself is a very loaded term.

Companies like Zynga thrived because they found cheap ways of getting users: early un-managed FB platform, and app referrals. Same with AirBnB and their craigslist post automation.

Growth hacking isn't going to make your product better, but more people will be aware of it.

<comment><USER11>
A "Growth Hacker" is an engineer that applies himself in the field of marketing.

or a marketer who learns how to code?

<comment><USER12> It's possible you might end up with an equivalently effective person, but I think it'd be easier to transition from coder->marketer. I suspect that the knowledge required _to be useful_ is about 70-30, or maybe 85-15, heavily on the coder side.

To pick up some marketing ideas that will start moving the needle on your startup, read a small book. You'd probably already know enough to start iterating on 3 or more techniques.

To get a marketer to pick up the most basic coding skills, start with flow control and variables. It could be a month before you're useful, in one language only. Then understand HTML, SQL, the server-side language, maybe jQuery, plus maybe security so you don't start adding lots of useful but dangerous code. Understand performance, so you don't kill the server with a loop in customer-facing code. Not just be able to click a "add new test" button, but integrate ABingo without hassling the rest of the team (if that's the best tool for the job). The point is: whatever it takes. You need to know enough technical concepts to be fast and loose with whatever will move the needle best. You're making few marketing decisions, but many technical ones.

So: fully agreed with your other comment. Marketers will be well-served by getting into some of the code, because it'll enable them greatly. But if I were hiring a marketer->coder, I'd be a lot more wary.

Up until today, I've disliked the growth hacker "thing". But these posts have clarified it for me. I'm generally irritated at the non-bschool vibe around here, but on this issue I'll lean heavily on the coder side.

<comment><USER13> All the details of programming are complicated and you can justify it with your expert knowledge as fact. Perhaps marketing is just as complicated but seems simple since you just see the output / results and do not have the expert knowledge to realize the detail that went into it?

<comment><USER12> I certainly don't think world-class marketing is simple at all. You get brilliant people in all roles, and I'm in awe of the best in the business. But most startups don't need killer deep-knowledge marketers who could design a marketing strategy for Coke but have learned to program a bit. Most startups need someone well-versed in technology who knows enough about marketing to move the needle on growth.

</comment></comment></comment></comment></comment><comment><USER14> Rather than pooh-poohing this new word or dismissing it by claiming that people use it so they can avoid calling themselves marketers, ask yourself: "Why do people find this distinction useful?"

That would make for a much better article, IMO.

Here's a thread where I attempt to justify the term: <http://news.ycombinator.com/item?id=4309570>

<comment><USER15> Absolutely. The term has a definite meaning. It refers to a software engineer with enough market awareness, copywriting savvy, and statistical ability to run a campaign full stack. There aren't that many people with this skillset, but they are valuable. By contrast, the typical person listing "marketing" on LinkedIn is just not that technical.

A good growth hacker can conceptualize and code the AirBnB/Craiglist integration; most of the people listing marketing on LinkedIn can't do that, skilled as they may be in other respects.

<comment><USER16> Sounds like you are referring to a generalist.

</comment></comment></comment><comment><USER17> I think you might have come off as more credible had you said that 'Growth Hacker' is a BS title. That is just a title and anyone can really have that. I have a site with 25 million page views per month, I've been running it for years all by myself, am I a growth hacker ? No. Did I do some growth hacking ? Yes. I used some innovative methods to garner and maintain traffic; methods that traditional marketing folks wouldnt't probably use.

Growth hacking might be a buzzword. But to me, it means coming up with a unique and viral way of attracting users to your product. There is a lot of unchartered new territory in marketing - social media being a big one. (turntable.fm had an interesting user acquisition route, I'd call that growth hacking)

Personally, I'm excited to see the new and innovative ways in which marketers will leverage these new technologies to reduce the cost and increase the speed of user acquisition.

</comment><comment><USER18> Maybe instead of arguing of meaningless titles for these roles, we should get back to building things, finding users, making money, and all that jazz.

</comment><comment><USER19> _An important art of politicians is to find new names for institutions which have, under old names, become odious to the public._

\-- Tallyrand

</comment><comment><USER20> Personally I've decided to accept that buzzwords and titles will proliferate, and that this is impossible to prevent. Isn't the whole not-caring-about- titles thing part of startup culture? As long as you can do your job, I don't care if your business card says growth hacker or marketzilla or SEOgasaurous. You might face greater scrutiny if your resume says "Rails Ninja" on it, but in the end it's about whether you can program, and whether a Rails Ninja is a good culture fit when everyone else is a Javascript Pirate.

Doing due diligence (i.e, a proper interview) for a hire means figuring out the truth behind the bullshit. If you don't actually have enough knowledge to differentiate between a bullshit $TITLE and a good candidate who happens to call themselves $TITLE, then you don't have enough information to make a good hire anyway.

Hell, the titles are helpful sometimes. Candidates non-ironically self- identifying as a trendy title can help you filter out idiots. They're doing you a favor.

</comment><comment><USER21> This post is at risk of becoming a "reverse" self-fulfilling prophecy by exposing more people to the buzzword. I have personally never seen it in the wild (except once through HN, when the term was first introduced).

</comment><comment><USER22> I think most marketers are supposed to have some technical experience if you are looking for a job in SV. I notice people saying being a growth hacker is like being a marketer but more technical. Most marketing job positions require at least a little "front end" developer knowledge. In short calling someone a growth hacker is annoying because it is trying to obfuscate an easy to understand job title and is unnecessarily buzzwordy.

</comment><comment><USER23> Confused. Growth hacking is BS, but growth hacking is marketing, and marketing is legit?

You summed it up nicely.. growth hacking is marketing using technical skills. I think that summary is very attractive to technically minded people, and makes it unique compared to traditional one way marketing.

If growth hacking is introducing marketing to a technical crowd and enable them to grow customers in a tech centric industry (startup), why the frustration? Is there some underlying issue with non-tech marketers not being able to connect with results in tech startups as well?

Having a foot in the technical and business world for the last decade has shown me that techs tend to learn more about business than vice versa. Capable people are everywhere though, maybe we need Growth Hacking 101 for marketers?

</comment><comment><USER24> I always thought "growth hacking" meant a hacker that has strong knowledge of "hacking" tactics (a/b testing, optimizing on boarding funnel, etc) as well as a keen business sense (markets, distribution, etc) to grow the startup's user base.

Anyone?

</comment><comment><USER11> You're right sir.

And this helps answer another popular theme of 2012: should people learn to code? YES.

This is a great example of what other professionals (non-coders) can do if they learn new tools, if they learn how to work with code.

</comment><comment><USER25> So, growth hacker is a marketer. Fine. But not all marketers are growth hackers. My understanding is that, growth hacking is a specialty in marketing which focus on consumer web marketing. It is also a very technical and hands on position. As a growth hacker, you not only need to have a marketing plan, but also need to implement or help implement the marketing plan. There is nothing wrong for giving a name to a sub-category of marketing profession.

</comment><comment><USER26> This would be a lot more credible if lean startup and cloud deployment weren't described as "talking to your customers early and often" and "hosting as a service".

</comment><comment><USER27> I think I've read the term "growth hacking" too many times between the post and the comments and now it sounds like something a bad oncologist does.

I should go to bed.

</comment><comment><USER28> I believe one of the nuances of the "growth hacker" title (cheeky title concerns aside) is the implication that user acquisition and product dev need to be interlaced. Consumer web is too competitive today to build a product and bolt on user acquisition. A role that sits on both the growth team and the product team is essential. Thus the birth of the growth hacker.

</comment><comment><USER29> While the term used is irrelevant.

I would say there is a big difference between the typical marketer and someone that's able to execute something like the airbnb/craigslist integration (and by execute I don't mean code every line).

Or someone that's able to take a product from 0 to 500k users.

I do agree though in terms of online, not knowing about any of this stuff makes you a much less effective "marketer".

</comment><comment><USER30> I partly agree to it. The web is full of buzz words meaning nothing. Growth Hacker, however refers to a combo of marketer +coder. I get totally pissed off at terms like _python rockstars_ , _javascript pirates_ _rails ninjas_. Seriously WhyTF do we need such pompous terms? An experienced programmer goes well.

</comment><comment><USER31> I somewhat get the argument that using the word "hacker" in relation to a marketing function somehow defiles the coveted word. But it does describe a role that is distinct from other marketing roles, so it deserves a different title. Call it what you will, but the semantics don't bother me.

</comment><comment><USER32> Everyone in digital media trying to have you click an ad is practically a "growth hacker"

</comment><comment><USER33> A bit off topic: how do I go about finding a freelance marketer? People I find on odesk seem to be of the spammy kind. Any advices?

<comment><USER34> You might want to try some of the business schools that are future looking and might have strong eng / entrepreneurship programs and often cross pollinate these students in their admissions or classrooms. Students are often willing to help out to gain their own experience, especially those desiring career changes from eng to business. for example: MIT, Stanford, etc.

</comment></comment><comment><USER35> It's different in a way that growth hacking looks at retention and marketing doesnt.

</comment><comment><USER36> So using the term "growth hacking" rather than "marketing" is marketing?</comment>


The $5 PoisonTap quickly, completely hijacks even a locked computer's internet - <AUTHOR> https://techcrunch.com/2016/11/16/the-5-poisontap-quickly-completely-hijacks-even-a-locked-computers-internet/ <comment><USER3> Previously: [https://news.ycombinator.com/item?id=12966673](https://news.ycombinator.com/item?id=12966673)

</comment><comment><USER4> The sad thing for me is that for years on "spy" movies and action movies the hero (or villan) would go into an office or a house or something, plug in a USB device and "boom!" own the machine. I took some comfort that this wasn't really possible, and then this happens.

<comment><USER5> It doesn't own the machine though, just MITMs some non-HTTPS websites. It's a weaker attack than what the movie villain could do by replacing your DSL/cable NAT box. (or adding a RPi "bridge" behind it)

<comment><USER6> Is this prevented by HSTS?

</comment></comment></comment><comment><USER7> Wow! I'm super impressed by what Samy Kamkar managed to pull off. Let's discuss mitigation on Linux because I don't want to cement the USB ports on my shiny new laptop just yet.

Some suggestions:

* When the GUI is locked, activating new USB devices or even activating a connection via a cable to the ethernet port should be delayed until it is unlocked and (optionally) the user confirms that it's ok.

* New unknown network devices should require confirmation

* A network interface that announces a subnet larger than /24 or /16 (for IPv4) should require a confirmation by the user.

What scripts and hooks are being called whenever there is a change to USB and networking? That would be the place to start. Can there be a /etc/udev/rules.d/ rule that matches all devices?

<comment><USER8> >* When the GUI is locked, activating new USB devices or even activating a connection via a cable to the ethernet port should be delayed until it is unlocked and (optionally) the user confirms that it's ok.

> * New unknown network devices should require confirmation

These two are the most confusing behavior from current OSes for me - <USER2> understand why there is network activity happening while machines are locked for some processes, but I am not entirely sure I understand loading new hardware devices when in a locked state and/or without user interaction of some sort. This suggests an oversight in my mind, and my feeble mind can't think of good reasons why it is this way.

The same issue with new network interfaces - it seems like it's a very intentional action that should be done by the user and not something that should happen automatically, and especially not in a locked state.

Would the same behavior happen on a least privilege account or even a restricted privilege account like something with parental controls enabled? I know that software changes are controlled via this, but hardware changes being allowed seems unusual.

</comment></comment><comment><USER9> If you put it into a smaller form factor such as USB sticks and drop them in the parking, you'll have a decent chance of getting inside that company. If you could make it very small then it could hide inside a iphone charging cable for example which looks completely harmless from outside.

<comment><USER7> I think the unique attack vector here is that it's sufficient to just connect the device to the computer for a minute while it's locked. You can then unplug it and the attack persists.

The whole "left behind USB stick" attack is already somewhat known and may catch attention.

</comment></comment><comment><USER10> The crazy thing is I knew about all of these technologies separately, but never would have guessed that this was possible. I knew my laptop prefers Ethernet. I knew an Ethernet-connected device could serve DHCP. I knew DHCP could provide DNS servers, and that the DNS servers could resolve to whatever they want. I knew if you could pwn DNS you could pretend to be another website, and sideload whatever other sites you want. I knew you could tell a browser via HTTP cache headers to cache something forever.

None of these technologies are remotely new. This has been sitting under everyone's noses for a long, long time. I wonder how long this basic idea has existed in secret.

<comment><USER11> Bingo

</comment></comment><comment> grey-area There are better details on this web page for the vulnerability, apparently it affects Mac, Windows, Linux computers with default configs:

[https://samy.pl/poisontap/](https://samy.pl/poisontap/)

<comment><USER5> Is there really a vulnerability in the sense of a security bug here? It's a cool demo of what happens if your computer is connected to an untrusted network, and a good lesson of why you always treat the network as untrusted.

It's doubly surprising that the reporter doesn't recognize that USB is used for wired networking, since Macbook Airs always use USB for that!

<comment> grey-area Well I think the bug is that even when asleep/locked computers will allow a USB device to connect, and give it a network interface, I can't think of a reason that's a good idea, and even if it was useful, it's too dangerous to allow.

</comment></comment></comment><comment><USER12> Mainstream OSes and desktop environments (and not just Qubes an people with extra software installed) should _really_ adopt the ask-before-using-USB- devices policy.

If you connected this to a Qubes computer nothing would happen, except a popup behind the lock screen asking for permission. But you could also generally forbid USB network controllers, for example.

<comment><USER7> It's the same thing with network interfaces, isn't it? If you connect a rogue device to an existing ethernet port I think you could pull off most if not all of the attacks that PoisonTap does.

<comment><USER12> With an Ethernet tap yes, just on the same switch not necessarily (without causing at least some disruption). For example, a DHCP configured client wouldn't accept a DHCPOFFER he didn't ask for, you'd need to do ARP spoofing which can be detected rather easily AFAIK.

IPv6 is another story though, it seems like IPv6 RA (which can also contain DNS configuration) are accepted by default by all OSes. My observation so far suggested that these overrule DHCPv6 as well.

</comment></comment></comment><comment><USER13> This is interesting, though, looks a bit like "attacker might replace explorer.exe" type of vulnerability: if you can physically access a device, you're already in; just like you need to be admin or root to replace system binaries, meaning pwnage long before executables are replaced.

<comment><USER7> The difference is that this attack requires only one minute, no tampering with hardware and thus it will also work against tamper proof devices.

Also it will be not immediately obvious that your device got hacked while you left for a minute because it will not have been rebooted.

</comment></comment><comment><USER14> This seems like it would be noticed quickly if access to the internet stops working. Can it proxy intercepted traffic to the real internet? Does the raspberry pi need its own internet connection in order to act as a proxy, or can it get a real internet connection via the host device somehow?

<comment><USER15> _PoisonTap responds with a barrage of data-caching malicious iframes for the top million Alexa sites. And those iframes, equipped with back doors, stick around until someone clears them out._

It sounds like this is the default response to any HTTP request, so I'm guessing these top million iframes are stored locally on the device. The TechCrunch photo shows a 32GB card - how many iframes could that store, alongside a tiny Linux-based OS?

And it's not that attacks can only happen while the PoisonTap is connected - it's that connecting the PoisonTap for just 60 seconds or so will likely have it install itself and respond to at least 1 request, seeding the laptop, desktop, or server with 1 million backdoor'd iframes, likely in some background AJAX process that you don't even know is happening in your browser, or when some process like Windows Update or Chrome or Firefox or Safari or Spotify or Skype or Hangouts or Dropbox tries to phone home. Or anywhere.

Then, once the PoisonTap is disconnected, those 1 million iframes are free to route through the same wifi or other connection the device used prior to the attack, to the general internet, for whatever secondary steps the attackers choose to perform.

What may be even more worrisome would be something like this, but with wifi capabilities. It could pose as a free wifi hotspot, possibly even bridging other free / easily hackable / commonly-known wifi hotspots - while replacing ad banners with the same malicious barrage. Or even filtering ads completely, for a "Knight in Shining Armor" solution.

<comment><USER7> It generates the response to the 1 million Alexa sites on the fly, no need to actually store them on the Pi Zero.

</comment></comment></comment><comment><USER16> just use https and you will be safe.

<comment> grey-area For certain values of safe.

Poisoning the DNS subsystem of your computer is not safe. At the very least it could record which requests you made indefinitely. This does need to be fixed.

<comment><USER17> > Poisoning the DNS subsystem of your computer is not safe. At the very least > it could record which requests you made indefinitely. This does need to be > fixed.

I'm assuming that if a domain used DNSSEC this would protect the user against this type of attack?

<comment><USER5> If your upstream DNS server and your OS support DNSSEC, it might require small changes to the attack (spoofing IP addresses instead of DNS names).

There really is no substitute for end-to-end crypto in networking.

</comment></comment></comment></comment><comment><USER18> You could accomplish the same thing by plugging in an Ethernet cable that ran traffic through a malicious reverse proxy. The difference here is that the USB device presents itself as an Ethernet device.

</comment><comment><USER19> I'm staring at my MAC now and wondering if my Little Snitch will prevent this type of hijacking. I expect the firewall to ask me how to treat a new interface before sending packets there.

<comment><USER20> No, the rules aren't per interface and there's no authentication of a new network device.

<comment><USER19> It appears you are mistaken: a properly configured little snitch will protect you. You can configure APS (automatic profile switching) to pause and ask every time your mac connects to an unknown network -- not a device, as I imagined, but a network.

Here is a detailed post: [https://blog.obdev.at/automatic-profile- switching/](https://blog.obdev.at/automatic-profile-switching/)

</comment></comment></comment><comment><USER21> Seems like an even worse problem for the new Mac Book Pro's, all Thunderbolt/USB-C ports. You could probably spoof any type of input.

<comment><USER7> Most types of [input] devices (mouse, keyboard, storage) would not be successful against a locked computer, only network devices.

</comment></comment><comment><USER22> How is this different from just using a WiFi Hotspot? It also "contains the whole internet" but does not need physical access.

<comment><USER23> How do you reliably force a laptop to connect to your hotspot? You have to guess a network it's willing to automatically connect to and that you can impersonate, hope that WLAN is actually on, ...

It's often a valid strategy, but the PoisonTap covers different scenarios (and vice versa)

</comment></comment><comment><USER24> The fix is to upgrade to the new Macbook. No more USB ports!

<comment><USER25> Your attempt at sarcasm fails.</comment></comment>


Show HN: Maker Monikers – Brandable domain names for side projects - <AUTHOR> https://makermonikers.com <comment><AUTHOR> I built this marketplace over the weekend as a hack project. It's basically BrandBucket but more affordable for makers and indie hackers who just want a decent domain name to start their project with.</comment>


Tabs could be coming not only to Explorer, but everywhere - <AUTHOR> https://arstechnica.com/information-technology/2017/04/tabs-could-be-coming-not-only-to-explorer-but-everywhere/ <comment><USER2> Oh wow. Is it 2005 already?

In other words, everything(tm) has had a tabbed interface for a decade now. Perhaps Windows is slowly backing off the impression "everything is a tablet"?</comment>


Let's talk about open-source sustainability - <AUTHOR> https://github.blog/2019-01-17-lets-talk-about-open-source-sustainability <comment><USER4> My personal feeling is that funding has got to be the biggest issue with open source sustainability.

I'm the lead developer of an open source project[1] used in radiation therapy clinics around the world and I know I would be ecstatic to be able to get enough funding to work on the software full time. I'm trying to bootstrap a consulting business[2] around the software now, but it's tough getting people to open their wallets (and it's much less fun than writing code)!

I think having funding in place for OS projects might have trickle down effects as well. I know I would spend more time contributing patches back to other OS projects I use if I didn't have to worry about trying to build a business so I can put food on my kids table. I imagine there are many other project maintainers who feel the same.

[1] [http://qatrackplus.com](http://qatrackplus.com) [2] [https://www.multileaf.ca](https://www.multileaf.ca)

<comment><USER5> I also think the biggest issue in OSS is incentives and see two ways of handling this issue:

1) Bounties: Some mechanism for people to easily pay $100 for fixing the bug, $1000 for implementing a feature, and so on. If Github takes care of the payment part, I think it can even be used in big companies and would definitely incentivize people. Sites like bountysource.com show that the model already works, it just has to be handled by Github so adoption would definitely be higher.

2) Second one is more ambitious: Although bounties are a nice way for people make money, it still cannot allow people to just focus on their OSS work, since it does not offer a revenue stream. Github should become what Youtube is to video creators. If Github were to share a percent of its revenue with OSS maintainers, that'd make a huge difference in the OSS space and in the world.

This recent tweet from the creator of ESLint captures the essence of the status-quo really well: [https://twitter.com/slicknet/status/1086053326007881728](https://twitter.com/slicknet/status/1086053326007881728)

<comment><USER6> > Github should become what Youtube is to video creators

What, a metrics-driven controversy/clickbait factory?

We'd be far better off with what _Patreon_ is to creators, a system that gives people enough predictability of income that they can make a job of it.

<comment><USER5> You are right about what Youtube is, but what I meant by Youtube instead of Patreon is this: With Patreon, you have to work for building an audience, but Youtube pays you based on your views. A Github that pays people based on the usage of their code might not be the easiest problem to solve, but what I'm suggesting in the end is the same thing with you. Only time might show what such incentives may turn the platform into, but considering the general audience of the site, I doubt it'd turn out like Youtube.

<comment><USER6> Getting the money from the intermediary to the developer is only half the problem. First you have to get the money into the intermediary.

On youtube this is done with advertising. I can't imagine people being happy with that embedded in open source software. People got upset enough about Ubuntu and the Firefox/Pocket deal.

> A Github that pays people based on the usage of their code might not be the > easiest problem to solve

A github that charges people to use code is even harder; that sounds like instant suicide.

<comment><USER5> I was happily paying 7 USD/month up until last week for the private repos, and they apparently had 300M USD/year revenue when Microsoft bought them a few months ago. I am not aware of their costs, but since they are part of Microsoft now and trying to foster adoption, integrating money into the system should be considerable.

</comment></comment></comment></comment></comment></comment><comment><USER7> Neat that that Github is looking into making open-source sustainable. I think a lot of maintainers hit a wall at some point. You have to have pretty thick skin to weather the entitlement people have to the thing(s) you put your life's free time into.

Some ideas that I frequently wish existed:

1\. It would be neat if there was some sort of place in Github where people could upvote interesting project ideas, i.e. "Load testing tool in Go"

2\. I'd also love to have a way to say, "I can devote 1-5 hours a week to this project" and be notified when someone tags an issue as 'help wanted'

3\. Harder, but still do-able (I think). A place for open sourcers to organize a "team" to get a new project off the ground. I often think that there _must_ be other people interested in the same sort of projects I am -- but we have no way to "discover" each other unless you're some high profile Twitter user.

4\. Moderation for trolls. Some people frequently open issues that frustrate maintainers. While they can just create a new account, I think creating a small barrier to entry would do some good.

5\. A way for companies / individuals / etc. to donate to maintainers through Github. I think this would be a huge incentive for people to continue their work long-term and not just "hand over" repositories to people with ulterior motives.

<comment><USER8> 5a) a way for me to add a bounty to an issue, I've had team members fix bugs and do pull requests that I'd have happily paid $50 $100 or more to the maintainer instead

<comment><USER9> This. I've always wondered why sites like GitHub/GitLab won't allow issues to have a bounty. It seems to me like its the obvious solution to crowdfunding OSS.

When I find an issue on GitHub requesting a new feature or reporting a bug that is important to me I should be able to throw down $5+ bucks to incentivize someone to fix it. I also know that I would personally contribute to OSS more if it didn't feel like I was doing community service but rather actually getting paid for my time.

<comment><USER10> Probably less of an issue now they're part of Microsoft, but if you're focused on source control / open source, you probably don't want to take on crowdfunding with all the associated drama and complexity, too. That's a business in itself.

<comment><USER11> True, but with the right hooks in place other providers could fill that niche.

</comment></comment></comment></comment></comment><comment><USER12> My suggestion was to add a page allowing maintainers to sell licenses. I think dual licensing can work really well if 1) there's a very easy and trusted way to buy licenses -with strong predefined terms set by a trusted third Party like Github, and 2) if there are well written and understood commercial licenses available for use that businesses can trust on sight.

Every oss project trying to make money by dual licensing currently sets up their own payment system, and winds up writing their own commercial license because the well known ones like MIT, Apache or BSD don't work (if a business buys one of those licenses they can just make a competitor to your project). Because each project writes their own license, businesses need to waste time reviewing each license carefully. It'll be so much easier if there's a Github Commercial License that's Apache 2.0 plus a non compete and no resale clause.

<comment><USER13> This is the best suggestion I've seen and yet the one which Microsoft cannot do for tear of people running after then with pitchforks.

<comment><USER12> Github could do it. Doesn't look they're rebranding into Microsoft Code Office Space (TM) any time soon. And one would assume they'd put the licenses on Github as well, so you could suggest changes and sell your project on whichever version of the license you want.

What Github would bring to the table are easy marketplace dynamics, trust, and a team of lawyers capable of writing good licenses. Also, the same code analysis tools that check for security problems in your dependencies could also license checking. There's a very compelling use case for businesses if all their code hosted on Github can 1) automatically check for license violations and 2) just pay for all licenses on a single screen with a single click.

</comment></comment></comment><comment><USER14> Well, here are two things that have been brought up many times:

1\. Required fields on new issues. Has been requested since 2016[0].

2\. Better issue search.

Open Source projects face a lot of issues. It's good to talk about them, but some GitHub can solve some GitHub can't. I'd be much happier to see these problem addressed instead of learning about updating my profile status[1].

Currently when a project becomes popular the issues easily drown the author. As the communication portal between OSS authors and users, GitHub can and should give OSS authors more power.

[0]: [https://github.com/dear-github/dear-github](https://github.com/dear- github/dear-github)

[1]: [https://github.blog/changelog/2019-01-09-set-your- status/](https://github.blog/changelog/2019-01-09-set-your-status/)

<comment><USER15> Regarding 1: Please no. Prefilling the entry box is a decent compromise and doesn't require turning the Github issue screen into a Jira issue screen.

<comment><USER16> If someone is filing an issue to an open source project -- whose maintainer will very often be working on said issue for free -- the least that person can do is submit the issue with the information that the maintainer requests.

I really like this idea if for no other reason that it would raise the bar for submitting an issue. So many open source maintainers on Github are overwhelmed with vague issues or support requests masquerading as issues.

<comment><USER17> Issue templates already exist. As I've seen recently the possibility for multiple issue templates (that also auto-apply some labels) even exists now. If an issue doesn't fall into any of those templates, they are still free to close the issue and ask for it to be resubmitted with the correct information.

</comment></comment></comment></comment><comment><USER18> If you're worried about the domain github.blog, be aware it's what blog.github.com redirects to. I really hate what's happened with TLDs, but at least this one is verifiable.

<comment><USER19> Hi! Thanks for clarifying this for everyone. Yes, we just migrated the blog, so both `github.blog` and `blog.github.com` work.

(I'm the open source PM at GitHub, for context... and yes I realize that's not directly verifiable from my sn here so feel free to tweet at me if you want to check: [http://twitter.com/devonzuegel](http://twitter.com/devonzuegel))

<comment><USER20> Hey, that reminds me about Keybase. It's not talked about that much anymore, as far as I can see, but it's nice how it lets you verify your identity across different sites.

</comment></comment></comment><comment><USER21> I think the biggest issue with open-source projects is that we can't incentivize the creators to do the work. What I'm looking for is an easy way to "donate now" on the library.

Without this, I can't pay someone to make some minor changes. I'm left hunting for their details, and when I do connect with them over GitHub or LinkedIn, I'm at their mercy to respond, and most of the time I can't give any valued weight to my request since I'm not paying them to do the work.

When I do hear back, devs aren't always the most gracious folks, and they don't have the same priorities I do. Money can help make people more cheerful, and helps me align their priorities to my own. I've lost count of times I've gotten a snarky, "I didn't build this to do what you're asking."

There are so many great libraries out there that went stagnant. I make money off their work, but I can't pay them to make upgrades and they find the work to be boring or my request to be out of their target audience (if they even think that way).

I think if GitHub could build in some features around donations that would be great.

<comment><USER9> It would be ideal to integrate the donation system with the existing issues system. That way individual issues could carry a bounty added by people wanting that issue fixed.

<comment><USER21> I love this idea.

"Fix this, and I'll pay you $50."

Only trick... how to verify the fix.

A lot of times someone would just mark the issues as done, but it'd need to be verified as being completed as expected. And that creates a situation where the person looking to make $50 does the work and (rightfully) says, "Pay me," but the person who has to pay the $50 says, "Uh... hold on, I have to do a new build, and that'll be 3-4 weeks minimum to get it prioritised and tested and through UAT and into production before I can get procurement to release funds for this," or, "Doesn't work on my build..."

Not impossible... just complicated in practice. Thinking it through, I can see why GitHub hasn't done anything like this yet. I think I'd prefer bounties, and donations -- I can easily get a donation approved as basically a "license fee" but bounties would be very hard to get through the accountants I think. At least in agency-land where I work.

<comment><USER22> I think for this to be feasible, a project would need to maintain firm to strict discipline about testing and versioning. Let me expand on that.

When an issue comes in, once verified, a test that reproduces the unwanted/unexpected behavior is attached to the issue. This lets both the reporter and dev prove the issue exists, and lets the dev trigger the behavior on-demand to aid in his troubleshooting efforts. Then, once the issue is fixed, the test proves it. Afterward, that test should go into the regression test suite that gets run before each release to make sure it doesn't come back.

When the fix is released, it ideally would be released only in a bugfix release, bumping only the patch version number a al SemVer, and not wrapped up in a feature release. It should be a lot easier to get a patch release prioritized through testing, staging, UAT, and finally into production when the version number tells you that the bugfix was the _only_ thing that has changed, and the test suite can prove that.

Coming back from fantasy land to reality there's other things that would have to happen to make this feasible, but it's well past bed o'clock for me. I'll try to remember to post an additional reply later this morning.

<comment><USER21> From a technical perspective, this isn't wrong.

From a finance perspective... I don't want to argue that this is sane, but a lot of firms view software still as a Capital Expenditure (CapEx), not Operational Expenditure (OpEx).

CapEx is like buying a car, or buying a laptop. OpEx is like a taxi service, or monthly power bill.

With CapEx, I generally can't get approval for payment until the product is fully delivered, and signed off.

A lot of companies use agencies to do software work for them, and see an agency as a sort of credit card / insurance policy for getting the work done before they have to pay, and getting work done on a fixed-price scheme.

A lot of times too, work has to come with like a 90-day warranty, and final payment won't be due until that period is up. For larger clients anyway.

Yes, I like bounties... and we use a lot of open-source software, but I don't think anyone would want to get paid the same ways as agencies get paid. Likely we'd be better off just being able to donate.

</comment></comment></comment></comment></comment><comment><USER23> Integrating bug bounties and donations into GitHub could be one of the best things to happen to Open Source. Funding new features and bug fixes could become seamless, and it would sway more devs to adopt this model for their projects.

</comment><comment><USER24> Oh nice, it looks like an _actual_ "let's talk", rather than a "I have something to say" like I've apparently started to expect that phrase to mean.

<comment><USER25> Have talked to Dave about sustainability. Strongly recommend.

<comment><USER25> Autocorrect fail. s/Dave/Devon/

</comment></comment></comment><comment><USER26> Also probably worth mentioning:

[https://sfosc.org/](https://sfosc.org/)

[https://medium.com/sustainable-free-and-open-source- communit...](https://medium.com/sustainable-free-and-open-source- communities/we-need-sustainable-free-and-open-source-communities-edf92723d619)

And my own personal take on this whole Game of Throne'ing that's currently happening out there with open source:

[https://medium.com/@echohack/we-need-more-sustainable- free-a...](https://medium.com/@echohack/we-need-more-sustainable-free-and- open-source-software-before-its-too-late-a168fdaf7237)

<comment><USER27> Some U.S. states have "social purpose corporation", which might work for open source: [https://en.wikipedia.org/wiki/Social_purpose_corporation](https://en.wikipedia.org/wiki/Social_purpose_corporation)

<comment><USER17> Something similar exists in Germany. Sadly in the past courts have ruled that even corporations that have been solely dedicated to providing a structure for open source projects are not eligible for tax exemption because "they serve special interest groups rather than the common good".

<comment><USER28> Seems to be not a hard rule though, since e.g. the Center for the Cultivation of Technology ([https://techcultivation.org/](https://techcultivation.org/)) managed to achieve gGmbH status.

<comment><USER17> I can't seem to find much info about the CCT. Have the actually picked up stewardship for any projects, and managed to file taxes without the tax authorities challenging their status? As long as there is nothing to tax, gGmbh status is quite attainable.

All the examples I know are from what seems to be much bigger projects, with all of them failing to be recognized as tax-exempt.

<comment><USER28> No, haven't seen much of them, just remembered reading about them somewhere, and looking at the issue tracker they link seems activity stopped a while back - if status is easier if not active, then that's a problem, I would have thought the initial step is hard already. :/

</comment></comment></comment></comment></comment></comment><comment><USER29> Maybe if github itself was open source people could make a lot of improvements to it to help other open source contributors. I don't understand why we expect people writing a closed source system to fully grok open source.

<comment><USER30> My thoughts, exactly! It's so ironic, isn't it? I keep saying this to fellow developers all the time, it seems I am talking against a brick wall.

</comment></comment><comment><USER31> It's not always about money. You put out free software because you're proud of it and hope it can help others. But I've given up on sharing and maintaining open source because of the users' toxic self-entitlement. It's not worth the aggravation.

Bounties are not a good incentive to maintaining high quality open source - <USER2> fact it's the opposite. It encourages putting in rarely used functionality that is not in line with the goal of the software. In the cases where adding a feature is warranted, a small bounty rarely comes close to the development time required to implement it.

Even the act of properly vetting pull requests is an extremely time consuming process. Will this contribution affect the stability and performance of the code base? Does it follow the conventions of the project and include comprehensive test cases and documentation?

Micropayment donations are nice in theory but don't work in practice. The handful of projects that are able to self-fund do so only because large corporations support them, not individual users. And even those popular projects do not pay for the development of the the many project dependencies they rely on - without which their software would not be possible.

So I don't have any solutions to free software sustainability. The users of the software derive great benefit, but the producers - not so much. By in large, open source will always rely on the charity of its creators.

</comment><comment><USER32> Thank you Devon for this post and for your ongoing efforts to help make the open source economy thrive. I'm very eager to see the follow up based on visitor feedback. This is Eric Berry btw

<comment><USER32> I should also mention here that I am the founder of [https://codefund.app](https://codefund.app). We generate recurring, consistent revenue for open source projects and developers through ethical advertising.

<comment><USER33> You were downvoted, maybe because some people consider all advertising as evil per definition, but _ethical advertising_ is an interesting subject. I made mention of Codefund in a forum discussion we have on the topic:

[https://community.humanetech.com/t/humane-advertising- ethica...](https://community.humanetech.com/t/humane-advertising-ethical-and- mutual-beneficial-it-is-possible/1419/9)

</comment></comment></comment><comment><USER34> I have a feeling this would be a bad idea for some reason I can't quite put my finger on but ... what if github added a sponsor/donate/pledge button and ran a service for doing such?

Some projects use Patreon. Why not just make it direct for those projects that are using github to host?

I think the harder problems are things like "who gets the money", "how is it used", etc... How to deal with scam clones. (once money is involved the scammers will show up)

<comment><USER35> "who gets the money" was a hard enough question to push me away from trying the patreon / tip jar approach. There are a ton of documentation / translation / one-liner style contributors on my project. Do they all get an ongoing cut of the funds? Or is it a one time thing? How is that number determined?

As soon as you introduce money, some people will get alienated, work 'value' will be ranked, just -- all kinds of new headaches on top of what maintaining a large project for free (which is already often a big headache)

</comment></comment><comment><USER36> I now list all of the open source (applications, libraries, etc) I use at the end of the year and I decide on a bucket of funds and split the donations between the top 5 most important projects to me this year (application, library, etc).

Giving money away feels great (not sure why) and you can pretty much count on a thank you note.

I am now trying out cloud providers that use and contribute to open source software and standards. ie, mailbox.org

</comment><comment><USER37> Thought: OSS Kickstarter - a developer puts up a page for say "improve config handling for apache spark" or "fix the radiation therapy UI".

Companies can commit a small amount till the funding point is hit

And then code is released for a limited time only to sponsors - the code base is released to everyone else only after a known time period.

We get scarcity, openness and funding???

</comment><comment><USER38> All those problems could be solved with money.

</comment><comment><USER39> "Sparse analytics" is not a problem; it's a feature.

</comment><comment><USER40> I love Github dearly but this proposal to "talk" is hard to understand. The questions we should be asking go to the economics of open source projects. Problems like overload or lack of resources look like symptoms not root causes.

My first question would be: Who are the users of your project and how did you find them?

</comment><comment><USER41> I'm working hard now on trying to make my project sustainable:

[https://getpolarized.io/](https://getpolarized.io/)

It's a weird situation as we're a desktop app. Many Open Source users aren't used to paying for things but if you want good tools there needs to be a economic background.

I've started polling my users to ask WHY they aren't donating and I'm getting some interesting initial feedback.

So far "I didn't know how to donate" is apparently a big issue I have to resolve.

Additionally a top issue is that the user base doesn't feel the core feature set is there.

Now part of this might be bias. They might not want to support simply because they don't have money.

In the next month I'm going to be turning on monetization so this should be an interesting process.

<comment><USER42> I tried polar at one point and found that adding web pages was a bit clunky in terms of UX. I'm looking forward to trying it again in the future however since I love the premise.

Have you considered scoping out a browser extension that would let you send polar a webpage with a single button click? I'm not sure what complications there would be getting firefox and polar to talk to each other, but maybe in conjunction with the sync feature it would be easier?

Might give you a feature to charge for too since you it does afterall cost money to run servers

edit - <USER3>

</comment></comment><comment><USER43> Crypto has crashed a bit but there could be some opportunity for an ethereum style contract to help here. Opensource projects are like the ideal 'DAC'(decentralized autonomous corporations) so they could have funding pools that pay out for feature or bug additions. Basically if enough of the DAC vote a feature or bug is important and you contribute code that addresses said issue, you get paid. Similarly OSS licenses could shift to a scheme where if your MRR > $X you are obligated to kick either ether or equivalent code value into pool. Self sustaining, self governing. Corporations might even open source more projects to basically outsource work where hiring dedicated software engineering doesn't make sense.

<comment><USER44> How exactly is a "smart" "contract" going to decide if some code fixes some bug? And how is it going to measure someones MRR?

The fundamental problem with "smart contracts" is that they are neither "smart", nor are they "contracts". Contracts deal with ambiguous meatspace issues, and are resolved through courts. Smart contracts are in no form a novel idea, they are just trading/finance bots with some added blockchain to get the suckers to give up their money. They cannot make any decisions on things that can't be verified on the network itself, which includes things like "who does this apple belong to?", "does this code solve the issue?" etc.

<comment><USER45> Smart contracts are smart enough to allow formation of groups of devs, form a vote and disperse funds. Devs who are directly responsible for maintaining a portion of code can vote if the contributed code solves the issue.

<comment><USER44> If a trusted group of developers is in charge of dispersing funds, why involve a blockchain/smart contracts at all? You can just donate to the developers, and they can disperse funds according to some predefined terms. The DAO or whatever is exactly that, but with extra steps. In either case, you still have to trust that the people in charge of distributing the funds will do so according to the terms that were agreed upon(fixing bugs or adding features or whatever).

<comment><USER46> They'd still be trusted in the sense that they decide if a bug was fixed or not, but at least transparency would be achieved. You could independently check exactly where your money went.

</comment></comment></comment></comment></comment><comment><USER47> I've been working on my own open source projects (the Gorgonia family of deep learning packages for Go[0]). Competing with TensorFlow and PyTorch is hard and I'm quite sure, unsustainable.

When the project started, Gorgonia had dynamic and static graphs. Then TF caught up and now has surpassed Gorgonia in terms of features.

I wonder what Github would be doing to help maintain projects. Right now it's just pretty five people maintaining Gorgonia. Sustainability for me would simply be more contributions to maintain feature parity with TF

[0]: [https://github.com/gorgonia](https://github.com/gorgonia)

</comment><comment><USER48> Definitely a problem. Initially I really enjoyed sharing open source projects. But after a while you get a little bit fed up with the support requests and random why you no haz feature x threads on Github.

<comment><USER49> We need new open source cultural leaders that set the tone for open source engagements. I see the poor attitude here on HN all the time. Someone posts about their open source project and they often get burned down for not doing x,y,z. It's open source. We should all be grateful for the work people are putting in so that we may benefit. I don't know why so many people regress to neolithic end-users when an OSS project they are using doesn't do something they like or has bugs. It's like just because they have access to it and use it, they are entitled to world class support, as one would expect as a paying user. It's a toxic situation. We need a cultural change that curbs this behavior.

</comment></comment><comment><USER50> I'm in the process of moving from macOS to Ubuntu for everything that is not my phone, and I was looking to replace Google Keep and Inbox as they are EOL this year. Found this note tool called Standard Notes ([https://standardnotes.org/](https://standardnotes.org/)). Linux and iOS support, extensions, 2FA and encryption, and FOSS. Tried it out. Plunked down $150 USD for a five-year membership without further hesitation.

</comment><comment><USER51> I find the communication tools to be lacking most, for the goal of solving the problems collaboratively. Github issues are absolutely unusable for discussions whenever there is more than 10 comments. External sites like discourse help a bit, but still far from ideal.

TL;DR: please give us a Google Wave analogue built into Github

</comment><comment><USER13> Github summer of code for projects except there is a voting from community taken into account for final decision.

</comment><comment><USER30> What is very ironic about this poll is that GitHub itself isn't open source at all.

For instance, to even use this site, you have to allow JavaScript in your browser. Otherwise, some features are completely broken (because fuck security-minded people, right?).

The JavaScript that GitHub ships is obfuscated and proprietary, so the moment you visit GitHub with default browser settings, you have already executed proprietary software. Heck, even the poll about open source does not work without proprietary JavaScript, which is _especially_ ironic.

</comment><comment><USER52> I think the biggest problem is the fundamental impedance mismatch between companies and independent open source projects, especially smaller ones.

As any b2b startup will tell you, the number one concern of a large client is "how do I know you'll still be here in a year?" They say nobody gets fired for buying IBM, but what they really mean is nobody gets surprised by IBM; nobody outgrows IBM and has to find a bigger vendor; nobody includes IBM insolvency in their contingency planning. IBM is predictable in the exact way an independent open source developer isn't.

The mismatch is that an ideal vendor delivers a predictable result across a wide price range, and a small open source project just can't do that. Think AWS: you can spend $1 or $100,000 and you know exactly what you're going to get. It's not so hard to get $100,000 of value from an open source project: just hire the maintainer. But how do you get $1,000 worth? Or even $10,000? You can definitely get a result for that much money, but you can't get certainty. Unless you're paying that maintainer enough to live off, they're always just one really good coffee chat away from the loving arms of FAANG.

I think the missing piece is a trustworthy intermediary to handle professional services contracts for open source projects. Rather than dealing with the overhead and uncertainty of a bunch of individual contributors directly, you just pay for one central service that covers your entire open source surface area. This organisation then contracts out to a network of interested open source contributors for maintenance and feature development.

In many cases, this would mean the maintainer of the project, but it could also be someone on the team, a new maintainer if the project is abandoned, or even someone to keep a fork up to date if you need changes that upstream doesn't want. The point is you don't have to manage this in great detail: you just pay the money like you would with any other service. In this case, the service is "all my open source software works, continues to work, and will grow with my business"

In order to be trustworthy, I don't think this could be a for-profit company. Many developers are skeptical of commercial interests in open source, and the larger independent projects often specifically limit the influence of any one company. For developers or companies to trust an intermediary, it would have to be provably acting in their interests. In other words: an independent non- profit with an open and transparent governance model.

Further, I think it would need to be run by respected figures from various open source communities. Open source is fundamentally weird to people who don't deal with it regularly, and there are plenty of opportunities for boneheaded mistakes that destroy trust. Why contribute and engage with the community rather than fork everything? Why invest in existing contributors instead of paying the cheapest contract devs you can find? Why not use your leverage against contributors that don't agree with your decisions?

The answer to all of those, as well as many similar scenarios it would be easy to imagine, is the same: it's bad for open source, which is bad for businesses that rely on open source. Businesses won't always know that or act accordingly, but an organisation working on behalf of the community will. And, of course, all of this only works if the projects and contributors in question trust it to do so.

There is a fair bit of successful precedent for community-driven foundations (eg Linux Foundation), the professional services model (eg Red Hat), and project-agnostic funding (eg Google Summer of Code). But, as far as I know, no initiative that combines all three. That's not incredibly strong evidence that it'll work, but at least suggests it might, and it's not like we're exactly drowning in workable ideas for open-source funding.

<comment><USER53> > how do I know you'll still be here in a year?

But this applies to early-stage startups just as well as to open-source projects?

</comment></comment><comment><USER54> The quickest and easiest thing to add first is bounties.

<comment><USER55> Quick and easy ≠ good

</comment></comment><comment><USER13> A Microsoft product using google forms. Lol. I mean I know they want to keep their image of "startup" but using inferior tools isn't necessary for that.

</comment><comment><USER56> Kudos to this initiative.

</comment><comment><USER57> Reads like begging the question for all the stuff they're saying will come at [https://spectrum.chat/features](https://spectrum.chat/features)

</comment><comment><USER58> These hyper-polished, exactly on-tone, on-message blog posts from what is basically Microsoft PR are causing credibility loss for the GitHub brand in my eyes. I don't really believe we'll see non-corporatese from them ever again, now.

<comment><USER59> ...what? Devon Zuegel doesn't come from Microsoft and she's not working in PR.

<comment><USER60> They do now.

</comment></comment></comment><comment><USER61> Honestly the person who wrote this post is absolutely out of touch with reality.

FOSS , except for a few technology, will never be sustainable .

Why ?

\- Because entreprises prefer to pay Billions to proprietary products and have someone that can be held accountable for failure.

\- Because entreprises executives consider that Open Source = You don't have to pay anything.

\- Because Oracle , IBM , Microsoft have spent the last decades telling entreprises executives that FOSS « does not scale » and is « very insecure » while they are actually just copying stuff from open source and rebranding it as their own.

FOSS will never ever be sustainable because the industry has been shaped around proprietary ecosystems by companies who are now worth hundreds of Billions of dollars.

Outside of few startups very few companies make donations to FOSS projects to keep them running.

Maybe it's juste me but I'm fairly confident that a blog post and a Google Form won't fix anything in the industry.

On the other hand , Microsoft , IBM advocating their customers to fund open sources instead of buying proprietary products while they are selling consulting services would fix the entire problem.

Will this ever happen ? It won't. Licencing bring billions in revenue to these companies it would be absolute suicide.

<comment> no-such-address When you say sustainable, do you mean, is it possible to train another generation of engineers to take over the maintenance and development of the software?

I wonder about software that has a secondary or supporting role in the ecosystem. Working on them does not provide the level of career opportunities that seem to be available from working on core distributed computing or machine learning platforms. Apparently the default is that they will be abandoned in place.</comment></comment>


Hazelcast Jet – In-Memory Streaming and Fast Batch Processing - <AUTHOR> http://jet.hazelcast.org/ <comment><USER2> The best part about these types of projects is also the worst: _Anything that is java.io.Serializable can be used for keys /values_

This means you can immediately save / load / stream your applications objects. Just tack on an " _implements Serializable_ " to you class header (or " _implements Externalizable_ " if you want to be fancy and do it yourself) and you're good to go. Plus with the native Map<?,?> interface writing code against it feels natural.

In practice this also means that you end up serializing arbitrary Java objects and get stuck in serialization/deserialization hell. Your data is stuck tied to a specific format, on a specific platform / language. It's somewhere between impractical and impossible to get it into an agnostic format usable by any other language so you're stuck in JDK land forever.

Anything that involves getting data into some other system or language requires you to also write a Java app to read (and possibly write back) your data.

Do yourself a favor and stick to something language agnostic for your data stores. You'll thank yourself many times over down the road.

<comment><USER3> Hazelcast is not really an database. Data are 'persisted' in RAM.

<comment><USER2> > Hazelcast is not really an database. Data are 'persisted' in RAM.

I purposely didn't use the words "database" or "persisted".

My comment applies even more so when data is persisted to durable storage (i.e. disk) but was meant to apply generally to any distributed data stores.

</comment></comment></comment><comment><USER4> We're quite spoiled on the JVM when it comes to stream processing frameworks. Just a few off the top of my head:

\- Apache Spark (especially Spark Streaming) \- Apache Flink \- Apache Storm \- Apache Apex \- Apache Samza \- Apache Ignite (also includes other things) and now Hazelcast Jet.

<comment><USER5> also, note _Apache_ prepended every time. Can't help thinking there is concentration risk there.

<comment><USER6> I'm hard-pressed to think of a feasible concentration risk for Apache projects. Can you be more specific?

<comment><USER5> Flink, Spark, Samza, Kafka (Streams). All under the Apache umbrella. All doing similar things. Competitors. There is a risk of spreading resources too thin on the space, there is a risk that some of the projects will be guided towards sub-optimal objectives so as not to compete too directly with others projects in the portfolio, and there is clear branding dilution. This is made worse by the fact that all the projects use the JVM, eroding differentiation even further. And there is concentration risk for Apache making tons of bets in the same space as opposed to diversifying across sectors. Just a lay observation as I happen to have been perusing the space for a financial markets compute graph I am building, and was surprised by the lack of options outside of Apache, and in particular, away from the JVM.

<comment><USER7> Apache projects are independently managed, not by anybody paid by the ASF. [https://community.apache.org/projectIndependence.html](https://community.apache.org/projectIndependence.html)

</comment></comment></comment></comment></comment><comment><USER8> I couldn't quite grok what this was supposed to be from the information on the site. What did help was their one-line description that it was basically a distributed implementation of java.util.stream.

I didn't know what java.util.stream was either, but this document made it clear: [http://www.oracle.com/technetwork/articles/java/ma14-java- se...](http://www.oracle.com/technetwork/articles/java/ma14-java- se-8-streams-2177646.html)

<comment><USER9> For those who know C#: It's the Java version of LINQ.

For those who don't know Java and C#: All regular collections now offer a .stream() (and .parallelStream()) method that returns the collection as Java 8 Stream<T> instance. With the help of lambda expressions, objects of a stream can be converted/mapped, filtered, sorted, aggregated, reduced, flatmapped, etc. by chaining methods on the stream. You can also create finite or infinite streams without a collection (Like of numbers ranges, random values or anything else you can think of).

I often end up writing complex stream method chains just to break them up in the end, thinking that they are too difficult to understand for others.</comment></comment>