Ask YC: How To Value Your Non-Launched Company - <AUTHOR> I guess you really have to have experience with angel investing for this one...
I know everybody is here is fan of 'build it yourself' but while building it I have this business plan and with my partner decided to go around family friends and other potential investors for investment. same question comes up again and again - "How do you value the company? You did you decide to ask for X percentage for that money you requested? You have no earnings and so you can't use a ratio to value your company at Y."
I know the 1/(1-n) equation which tells me how much it's worth to me and is basically the bottom line - not where I should start the negotiation.
Somebody suggested that maybe I should have a formula such that the investors have a better deal but I have the option to purchase some of the shares back upon completion of some of the steps of development. Makes sense, but is this even done?
So I am still in search for a way to determine how to present such a financial request to potential investors.
Any insights? <comment><USER2> I think people often structure the investment as a convertible loan specifically to avoid this question. The conversion part is that the loan converts to equity (with a discount) based on the valuation set during your series A. This way you don't have to come up with a make-believe valuation right now.

If you don't ever get to series A your company will either have to pay off the loan with interest or go out of business.

CRV offers this as part of their quickstart program and is very open about the terms. It's a good place to find out more.

<http://www.crv.com/quickstart>

"A standard interest bearing loan will be made to a corporation, which we will help you establish if you do not already have one in place. CRV will not seek a personal guarantee and will not hold you personally responsible for repaying the loan.

The loan converts into equity only if and when your company closes its next round of funding (typically a Series A round). If the company successfully raises its next round, in exchange for sharing the risk with the entrepreneur, CRV receives a discount on the conversion price when the loan is rolled into that next round. The discount will be a maximum of 25% (determined ratably at five percent per month, depending on how long it takes to close the financing, up to the maximum) off of the per share price. "

</comment><comment><USER3> Valuation is arbitrary before there are financial or other metrics with which to reason about comparables.

How much can you ask for with a straight face? How much do you need the money? (What's your 'BATNA'?)

Be honest about the prospects of losing all the money, and your hopes for making a lot. (With friends and family, be especially clear it could all be lost without recourse.)

If you trust your profit projections -- or at least the relative likelihood of different good, middle, bad scenarios -- you can do a discounted cash flow analysis, weighted by the different outcomes. Of course, it's all fantasy, but it's a way of deriving a bottom-line valuation from some numerical assumptions, and then you can argue about the assumptions.

You certainly can have contractual terms which give them first claim on dividends up to some rate, or where their returns are capped at some cumulative return, or where you have buyback rights at predetermined prices, and so forth. I think these are more likely when the outcomes are better understood -- for example when entrepreneur and investors are known qualities in a predictable market.

With something highly speculative, a vanilla "you have X% of the venture, boom or bust" may be safer, and less likely to make things weird if you later pursue more institutional investments.

Also: be sure to understand 'accredited investor' rules (or the equivalent in your jurisdiction, if not in the US). Don't skimp on good legal advice.

</comment><comment><USER4> 1\. Build the idea and take it as far as you can without any outside investors.

2\. Once you're out of money and your business is more mature, you will have a better idea how much your company is worth.

3\. You can now negotiate with investors.

Advice: Don't worry too much about the finances. Focus on building a great product first. =)</comment>


Windows 11 could run on Linux - <AUTHOR> https://www.computerworld.com/article/3438856/call-me-crazy-but-windows-11-could-run-on-linux.html <comment><USER2> I'll start taking these delusional ravings remotely seriously when authors try to analyze what it would be like to implement the driver stack, the graphics stack, the security model etc. on top of a different kernel, and demonstrate that it would change anything for the best. And not just throw away compatibility with twenty years of accumulated software and hardware.

So far it's only "MS did a Linux-to-Win layer with questionable performance, it means they could totally do the opposite with negligible loss while keeping drivers for millions of device models working! And compatibility with software that hooks at every point in the Windows APIs! See, Wine does a small portion of that _just fiiiine_ after the twenty six years of development."

<comment><USER3> This sort of thing reminds me of one of my favorite Microsoft UserVoices, which is asking for a Linux version of Visual Studio - hundreds and hundreds of comments from people who are presumably software developers, who seem to think that it would be trivial to port that behemoth of C/C++/.NET/whatever code, with its decades of accumulated cruft, over to run natively on another operating system.

devenv.exe isn't even 64-bit yet...

<comment><USER4> The idea of a Linux version does seem ridiculous like you said, but I'm not sure lack of 64-bit is a good example to illustrate it. They already migrated much of VS2008 to .NET when they did 2010, which to me seemed like a herculean feat, for what was quite questionable end-user gain (and I'm being quite generous with that assessment), and .NET should've made architecture- independent easier. Lack of 64-bit just seems to be due to the cost not justifying the benefit rather than the feat itself being so herculean per se.

<comment><USER3> The main problem there is that it runs like a dog and thrashes when you have big solutions and get near to 2GB of RAM usage. It's pretty silly on workstations that have 16-32 GB of total memory available. When they first justified the decision not to move to 64-bit a decade ago, it was more defensible, but time has moved on hard, and they've been fighting that decision, moving bits and pieces out of process ever since.

</comment></comment></comment></comment><comment><USER5> I'm open to the concept but not where this article takes it.

Registry backups shouldn't be expected to be any easier with a different kernel. In fact, if anything it will introduce a lot more bugs, even just from programs that rely on kernel bugs.

There's no reason to believe NT is any less 'fresh' than Linux. It undoubtedly does some things better. Even as a Linux user, throwing that away would seem a massive shame.

While basing Windows on Linux may make some development easier, it also throws away the unique proposition that Windows provides.

It would take a lot of internal motivation to overcome the people who founded their careers on building an operating system for Microsoft.

<comment><USER6> > There's no reason to believe NT is any less 'fresh' than Linux. It > undoubtedly does some things better. Even as a Linux user, throwing that > away would seem a massive shame.

> While basing Windows on Linux may make some development easier, it also > throws away the unique proposition that Windows provides.

Like what exactly? Do you have examples or just feel this way?

<comment><USER7> Two Words: Group Policies.

<comment><USER8> group policies are user mode

<comment><USER4> How would you implement a group policy like "Audit the access of global system objects" in user-mode on Linux?

<comment><USER8> Hmm interesting. I thought that guy meant the whole group policy system, which can change settings in user mode programs (such as explorer) and is akin to /etc files or in the kernel (like the one you mentioned) and is akin to sysctl

<comment><USER4> The entire value of group policy is in the whole thing, not the individual pieces. The group policy _system_ would be almost useless without the actual group policies it comes with; the actual policies and their vertical integration through the kernel and all the way to the UI are what bring in pretty much all the value. Viewing it as a glorified regedit or dconf-editor that's basically decoupled from the rest of the OS kind of misses the larger picture.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I use Linux everyday and I don't have Windows installed anymore.

But unlike many I actually like Windows though and used to be heavily invested as a .NET developer. I switched all that away though just because I didn't like the ads, forced updates, the cloud integrations and the tracking that were included in Windows 10 and felt forced.

This is what makes Windows 10 and Windows in general bad. Not the kernel or the other things in Windows. If Microsoft would start valuing these things again Windows would be less bad in my opinion.

I just use Linux because it's better, but it's only better right now and that could change in the future. I don't believe Windows 11 would be better if it ran Linux if it still had all those privacy-issues. It would be still as shitty in my view.

I am now heavily invested in Linux and has completely dropped my investment in the Microsoft-ecosystem. I start all new projects on Gitlab because I am actually mostly tired of big american companies that track and store everything and doesn't care about you.

</comment><comment><USER10> Kinda garbage article offering nothing. Is Windows NT kernel really so bad?

<comment><USER6> Yes, the registry is terrible and Windows applications basically do whatever they want. Once you install a few applications and then try removing them you'll end up with a ton of junk left over. Dot files and standard /etc config files are a blessing. Linux package managers are orders of magnitude faster than chocolatey, which isn't part of the OS. Windows Updates are notoriously bad.

<comment><USER11> None of which has anything to do with the kernel.

</comment></comment></comment><comment><USER12> Ok, you're crazy. The GPL licensing issues alone would be a nightmare for them, and possibly unsolvable from their business perspective.

<comment><USER13> Playstation, Mac OS and many others are based on BSD for that reason (and probably other reasons as well).

I cannot imagine a BSD-based MS Windows but it would be cool!

This would probably solve slow filesystem I/O (which is one of the major pain points for me when working under Windows, especially if you have a large number of small files).

However, it's important for Windows to keep backward compatibility for applications using old APIs. I think that's a major selling point vs. other platforms.

<comment><USER14> On the other hand, in my experience WINE runs older Windows apps better than my modern Windows 10 install does. Most things ~pre-2005 run really well, especially games which just refuse to boot on modern Windows (or require compatibility patches).

</comment></comment></comment><comment><USER11> That article makes no sense. Even if we take it as given that the "Desktop Windows has had so many problems", none of those problems have anything to do with the NT kernel. Swapping one kernel for another thus have no effect on the desktop or any its "problems".

<comment><USER15> That was my first thought too, but I do wonder about one aspect here. Doesn't Windows' relatively slow file i/o result largely from the architecture of the kernel-mode I/O subsystem? That's the impression I got from reading up on the issues Microsoft was having trying to speed up WSL (and hence, in part, the move to WSL2).

Having said that, slow file i/o probably wouldn't rank that high in the average user's list of Windows issues.

</comment></comment><comment><USER16> The layers of the os are a lot more tightly coupled than meets the eye. This would be a HUGE effort with the result of keeping the status quo. Not a smart investment. It would be far easier to port the various subsystems and grow communities around them, as they have been doing in recent years. Eventually, you'll be able to develop any Microsoft tech in Linux or windows, and then windows will slowly fade into the sunset, as the desktop isn't important anymore.

</comment><comment><USER17> That's not bad.

It's only taken 10 years and more since I suggested on Mini-Microsoft that Microsoft do 'an Apple' and put a Windows GUI on a Linux foundation just like Apple had put the Apple GUI on a BSD foundation. I remember that suggestion being howled down derisively by the Softies.

You can always trust Microsoft to do the smart thing .... after they've repeatedly wasted years and years and billions of dollars doing the dumb things.

</comment><comment><USER18> >As it prepares Windows 11, Microsoft has been laying the groundwork for such a radical release.

Can I read about this anywhere? I didn't realise there will be a Windows 11

<comment><USER11> Microsoft has repeatedly said that there won't be.

</comment></comment><comment><USER19> The article it explained. And its an obvious pipedream.

Windows has all the API, wine doesn't have the API they reverse-engineered the compatibility layer.

Since Windows has the code it wouldn't take a lot. Plus a lot of drivers and what not is already implemented in linux

Biggest probably would be graphics but then again they have the API/code as they made it so they can easily connect the dots to make it work

</comment><comment><USER20> If this really takes shape in some form I'd be interested in the status of WINE or how they would come up with any form of legacy emulation of older Windows programs. Right now it seems easier for Microsoft to emulate Linux programs with WSL or WSL2 than rewriting the Windows Kernel.

</comment><comment><USER21> This is not a new fantasy, I've heard exactly this same theory mooted several years ago. It's obviously a very compelling one. Who wouldn't love it if Microsoft did an Apple and wrote the userspace on top of the Linux kernel?

<comment><USER11> _Who wouldn 't love it if Microsoft did an Apple and wrote the userspace on top of the Linux kernel?_

But the whole conceit of the article is the Microsoft sucks at userspace.

<comment><USER21> Microsoft sucks at the desktop, but there's more to their userspace than that. If you want to play the latest games or use a lot of other applications, it's the only game in town* pretty much.

*Obviously, there's Wine and OSX, but still.

</comment></comment></comment><comment><USER22> Never gonna happen

</comment><comment><USER8> Too much fluff but nothing specific. What does it mean for "Windows 11 to run on Linux"? Port Win32 and DirectX to Linux? Start supporting Wine in some way?

</comment><comment><USER23> Major distros are shipping with a better desktop experience than Windows right now, and it has been like that for a while.

If you don't like LibreOffice, try SoftMaker FreeOffice.

<comment><USER24> > a better desktop experience

I think that's debatable at best. Of course the experience is better because you don't get in-system ads, forceful cloud integration, and all the bad stuff that comes with Microsoft.

But my personal experience of Ubuntu is a constant struggle against randomly occurring bugs, inexplicable performance drops, crashes, and bad design. It's still worth it because it's Ubuntu, but I wouldn't celebrate the UX too much.

Out of the box, Windows is _orders of magnitude_ easier to use for non- technical users.

<comment><USER25> Let me tell you about my latest Windows experience: I asked my son to bring his gaming notebook (Linux/Windows dual boot setup) so that I could test a tutorial on Node.js I'm giving next week. Of course, to download stuff I had to open a hotspot/WLAN access point for him on my phone. 5 mins later I received an SMS telling me my data was 80% exhausted. I setup the hotspot to disable his MAC, but then he needed additional downloads and I re-enabled his MAC so we could complete the tutorial test-run. He disabled automatic software updates, but 5 min later I received another SMS notifying me that my data plan was exhausted (all the while the notebook bringing up modals, toasts, and sounds like a gambling machine in a brothel). In the end it worked, but I can't understand how people can even work with Windows. The best thing about modern Windows IMHO is WSL/WSL2 to run Ubuntu. I've been using Linux and Mac OS exclusively since around 2003 or earlier, and I don't understand at all what people find hard about it. Installation of Ubuntu is about as easy as it gets. The most difficult part is deinstalling Windows when it comes preinstalled. But you can just buy a Dell notebook with Ubuntu LTS preinstalled for a much better experience unless you want to run games or legacy Windows apps.

<comment><USER26> > In the end it worked, but I can't understand how people can even work with > Windows

It sounds like you are far more familiar with OS X and Linux than Windows.

> Installation of Ubuntu is about as easy as it gets

I still have tearing issues on my screen from the graphics drivers that I'm not sure how to fix. Windows has no such issues for me. I know there are issues with Windows too - they just never seem to occur to me.

While I agree this comparison isn't fair to the hard working developers of Linux, it illustrates the point that both operating systems are complex. The more familiar you are, the less problems it seems to have.</comment></comment></comment></comment>


Ask HN: Sutherland's Sketchpad for linux? - <AUTHOR>

Is there something similar to Ivan Sutherland's legendary Sketchpad available for linux, or even an online javascript based version? Something which combines object recognition and the constraints management.
I could only find the geometric constraint solving tools as the closest approximation. <comment><USER2> It might be overkill, but the nearest analog (perhaps successor would be a better term) that I can think of is SketchUp.

<comment><AUTHOR> Thanks, but i was looking at something simple and more of a sketchpad clone. Its surprising that there aren't such software even 40 years later.</comment></comment>


New malloc in OpenBSD helps spot 33 year old bug in yacc - <AUTHOR> http://undeadly.org/cgi?action=article&sid=20080708155228&mode=flat&count=13

<comment><USER2> All those people running yacc parsers under valgrind memcheck or Purify probably just thought "Oh, it's _yacc_ , how could _yacc_ still have bugs after 30 years? I'll just add a suppression rule..." :)

<comment><USER3> I think lots of people run Antlr these days. <http://www.antlr.org/>

</comment></comment><comment><USER4> They also found a nearly-25-year-old bug in SAMBA a few months back. [http://undeadly.org/cgi?action=article&sid=2008050819325...](http://undeadly.org/cgi?action=article&sid=20080508193255)

<comment><USER5> that bug was in our libc, not samba. samba just had some code to work around the problematic behavior.

<comment><USER4> I stand corrected.</comment></comment></comment>


LBJ Tapes: Nixon Sabotaged Vietnam Peace Talks - <AUTHOR> http://www.outsidethebeltway.com/lbj-tapes-nixon-sabotaged-vietnam-peace-talks/

<comment><AUTHOR> Lede was buried by a mod, unfortunately. The point of the submission was that LBJ used the NSA and FBI to spy on a member of Nixon's camp.</comment>


Brutal reality of startup life - <AUTHOR> http://www.jwz.org/gruntle/nscpdorm.html <comment><USER2> Sick, but true.

I find I can't work at a reasonable pace. Either I'm slacking off, and for all intents look like an incompetent retard, or else, I'm in crisis mode and will do whatever it takes. Unfortunately, after crisis mode, I'm burnt out for a week.

There's an amazing feeling of monastic purity to working no-holds-barred on a problem, though. It's simplifying. No life -- no worries! That and the adrenaline rush of looking into the abyss and then finding some way around, or over.

</comment><comment><USER3> Amazing. I want that sort of lifestyle for a few years.

No, really.

At the company I work, it's beginning to feel big-companyish. There's around 100 employees now, and the bureaucracy is starting to set in. Despite that, we still get features rolled out at a nice rate, but I really have no emotional connection to the product we make. That doesn't mean I don't do quality work. That just means I'm not as interested as I could be.

On the other hand, if my future depended on the success of my product, then I'd be kickin'. I personally think that even with the stress, the time, the lack of sleep, that it would be one of the most fun experiences of my life, because I'd get to see my product morph from nothing into everything. Totally worth it.

Unfortunately, I have to feed myself, so I can't just quit and run after my idea. But if I manage to scrape even $15k together, I'm doing it.

<comment><USER4> Unfortunately, I have to feed myself, so I can't just quit and run after my idea. But if I manage to scrape even $15k together, I'm doing it.

You should read this article: http://www.doingsuccess.com/article_514.shtml

<comment><USER3> I see what you're getting at. What I meant was, I work 50 hour weeks. During my spare time, I'm getting my business up and running. If I can ever be in a position which I can focus on my business full time without starving, then I'll do that. That'll happen right around when I save up $15k, or the business is successful. Just because there's no way out of my job doesn't make me not an entrepreneur :P

<comment><USER5> You probably have a better spirit than I do. I have [well over 15k], and really enough to live on for years without FTE, but I'm waiting until I actually have a revenue stream before quitting my job.

<comment><USER3> It's tempting to do that, but check this out. I sat down and created a spreadsheet, listing all my monthly debts (including food). I then said, "Okay, I will go out on foot and pitch 10 teachers per month to use my service, resulting in $100 / month increase in revenue." In the spreadsheet, you'll be able to predict your total cost per month, and the month that revenue exceeds debt, the total cost is how much money you need to start your startup. But one last thing: Whatever your debt is, double it per month. Whatever you predict your revenue will be, cut that in half. I came to a total of $15k, because I have small debts since I'm 19. But it really puts into perspective just how little it costs to start a startup.

By the way, what's your startup?

Shawn

<comment><USER5> "By the way..."

Pre-alpha.

</comment></comment></comment></comment></comment></comment><comment><USER6> As a sophomore at the University of Illinois, my classes make me get up at 7 or 8am every morning. I usually get an average of 4-5 hours of sleep per night.

I find myself getting sick after doing this for periods of time. But it's definitely a hard-to-break behavior. I still average 4-5 hours per night.

Can't say I'd take it back for anything. There's probably not a full-time job opportunity in the world that will replace the excitement of being an entrepreneur.

</comment><comment><USER7> Ar the YC founders having this kind of experience? This sounds like a traumatic experience to me, but pg claims a 100% satisfaction rate.

</comment><comment><USER8> This is the best thing I've read in a long time</comment>


Turbo Pascal 3 port of the smallpt C++ 99-line global illumination renderer - <AUTHOR> http://iwasdeportedandalligotwasthislousydomain.co.uk/static.php?page=smallpt_tp <comment><USER2> I'm not sure if this code even uses the x87 opcodes or software emulation for the floats!

First of all, the source defines a "FloatType", which is set to "Real". But the real type is a 6-byte float type optimised for software floating point routines! I'd like to see the results when using the "Single" and "Double" types.

Also, it's easy to forget that x87 code generation in TP3 is an option that defaults to "don't".

<comment><USER3> I rememeber that TurboBASIC (Borland's clone of QBasic), could use x87 math. And it was using a TurboC like IDE

<comment><USER2> I'm not arguing TP3 couldn't produce x87 opcodes - I'm wondering if the author remembered to properly tell it to do so!

</comment></comment></comment><comment><USER3> If you like something like DOSbox but with better performance (near native, perhaps ?) you should have try DOSEmu.

Really, the difference of speed and performance is abysmal.

[https://en.wikipedia.org/wiki/DOSEMU](https://en.wikipedia.org/wiki/DOSEMU)

<comment><USER4> Except DOSEMU is Linux-only, whereas DOSbox is portable.

<comment><USER3> Well, works at very low level stuff, do real virtualization, instead emulating. The most similar stuff is using VirtualBox or KVM.

<comment><USER5> DOSemu was really joy to use for gaming even on Linux+486 + 10 Megs of ram. Oh those were the days :>

<comment><USER4> I remember them fondly. 10 MB RAM, though? What kind of high roller were you?! ;)

<comment><USER5> Hehee, my dad ended up buying some demo/test machine from AST in 92 or so. The comp had quite high end specs for it's time. It actually ran really fine for long time because of switching to Linux. Stopped using it in 1998. Probably could still remember all the IO, DMA, IRQ settings for hardware ^___^

</comment></comment></comment></comment></comment></comment><comment><USER6> I am a bit surprised by the bad performances of TP3. I remember that it was difficult to beat the compiler by using hand written assembly. Recent compilers may be far better than I imagined.

<comment><USER7> The TP compilers were pretty bad, all the way up to TP7. I (tried to) write a clone of Wolfenstein back in the day and the only way I could get close to the performance of the real Wolf3D was by replacing the inner loop by raw x86.

I even still have the source (keep in mind this was written ~20 years ago):

[https://grack.com/code/legacy/deathmatch3d/](https://grack.com/code/legacy/deathmatch3d/)

</comment></comment><comment><USER8> Hilarious, and a good remedy for my surprisingly frequent nostalgia for Turbo Pascal.</comment>


Show HN: Hacker News Reader (for iPhone and iPad) - <AUTHOR>

Hey everyone. I finally got my HN app approved with Apple. Check it out here - https://itunes.apple.com/us/app/hacker-news-reader!/id532402679?ls=1&mt=8 - and let me know what you think.
I've tried almost all of the available options and none of them were quite right for me. It probably isn't the prettiest option, but I find it to be easier to use and it's not missing and functionality (like voting and commenting).
It's a Universal iPhone/iPad app so you get it on both. It has a simple tab method to go back and forth quickly between the HN discussion and the article. You can share from email or on Twitter, and it has support for adding articles to Instapaper.
I'll leave a clickable link in the comments, as well as a few Promo Codes. <comment><AUTHOR> clickable link - [https://itunes.apple.com/us/app/hacker-news- reader!/id532402...](https://itunes.apple.com/us/app/hacker-news- reader!/id532402679?ls=1&mt=8)

Promo Codes RK4JY43F74EK R3YX9HAN39E6 LEYR9H379JJR

<comment><USER2> i redeemed the last one. thanks!

<comment><AUTHOR> no problem, hope you like it. Let me know if you have any issues.</comment></comment></comment>


Ralph Ellison in Opposition - <AUTHOR> https://www.commentarymagazine.com/articles/ralph-ellison-in-opposition/ <comment><USER2> After reading Rampersad's biography of Ellison, I feel like I'll eventually pick the book that this piece reviews. I'm not sold on the idea that Rampersad's biography was being wholly unfair to Ellison, at least on the subject of pointing out the gulfs or differences between him and Black writers who rose to acclaim after him.</comment>


Ask HN: Is Skype safe to use? - <AUTHOR> In the business I am in literally everyone wants to use Skype instead of PM's etc.
Is Skype currently safe? If not are there any good ideas to secure your work before connecting with someone on Skype?
Thanks! <comment><USER2> 1\. Skype itself is a closed-source, proprietary computer program, and you have no way to know what it is actually doing at any point in time.

2\. All communications, including audio, video, text, and file sharing, are passed through Skype's (Microsoft's?) servers, and is readable by them.

3\. If it is readable by Skype (Microsoft?), then it is readable by any government agency with access to their servers, whether by court order or voluntary participation.

It's your call.

<comment><USER3> You could say that for any internet based software, including web browser. Thanks for the FUD.

<comment><USER4> How would you word it?

</comment></comment></comment><comment><USER5> "Is Skype currently safe?" Safe from what? The NSA recording your conversations? Microsoft selling marketing information? Your competitors doing a bit of corporate espionage? Accidentally recording calls to a YouTube channel?

That is, what is your threat model?

Some of my clients, at a big pharmaceutical company, use Skype for Business (nee Lync), so I know some businesses find the risks to be acceptable.

<comment><USER6> But probably using their own server, entirely within their own network? I.e. you can't even connect without a VPN?

Not that that protects from backdoors but still.

</comment></comment><comment><USER7> Skype is not blocked in China. That alone should tell you a lot.

</comment><comment><USER8> I like Slack. No video chat unless there's a plugin I am not aware of.

</comment><comment><USER9> Well one way to test is to put honey links into an IM session and see which ones are pinged. Invariably they will be pinged from a co-lo situated in a remote U.S data center.

</comment><comment><USER10> Calls over Skype expose your IP address. In the past it leaked even if you didn't pick up, don't know if it still does.

</comment><comment><USER11> I've been using Zoom.us for video chat. Really like it.</comment>


Show HN: Dark Mode PDF Reader, Built Using Electron and Pdf.js - <AUTHOR> https://github.com/joeloya/nightpdf <comment><USER2> what's the advantage over other apps that do this natively, without electron, and also provide more bells and whistles?</comment>


Does Changing Your SSH Port Lower Your Risk? (2008) - <AUTHOR> http://danielmiessler.com/blog/security-and-obscurity-does-changing-your-ssh-port-lower-your-risk/

<comment><USER2> Correct me if I'm wrong, but it seems that the author's point can be summarised as:

Obscurity will (at least in the case of an SSH deamon) not make an attack any less likely to /succeed/, but it will make it less likely to /happen/.

Note that what he observed were automated, scan-everything-you-can, undirected attacks. I would presume that changing the SSH port will do very little against a targeted attack.

</comment><comment><USER3> Who really knows, but it will certainly keep your log files cleaner and this alone makes it worthwhile doing.</comment>


Ask HN: What non-profits went through YC? - <AUTHOR> Watsi was W13 - what others have there been since? <comment><AUTHOR> Found a more complete list here: [https://news.ycombinator.com/item?id=10575963](https://news.ycombinator.com/item?id=10575963)

</comment><comment><USER2> New Story, which builds houses for homeless people. They had this huge project in Haiti. I believe they were S15, but I'm not sure.</comment>


China's Didi Raises Over $5.5B in Record Tech Funding - <AUTHOR> https://www.bloomberg.com/news/articles/2017-04-28/china-s-didi-raises-over-5-5-billion-in-record-tech-funding <comment><USER2> It is not a coincidence that Uber's competitors are all raising money at this point in time. It was hard a year ago. Uber's struggles have not only boosted the metrics for competitors [1], but there is increasingly a plausible story about how Uber could fail.

1: [http://www.thedrive.com/tech/9739/lyft-bookings-ridership- so...](http://www.thedrive.com/tech/9739/lyft-bookings-ridership-soar-as-uber- deals-with-controversy)

<comment><USER3> Didi is not Uber's competitor any more. Didi acquired Uber China, is an investor in Uber, and owns Uber shares. So does Uber in Didi. They don't compete directly in any major market at this moment.

<comment><USER4> They do compete by proxy, like in Brazil, where Didi invested $100m in "99".

<comment><USER5> I guess we can say that Didi owns everything then...

</comment></comment></comment></comment><comment><USER6> Their pitch is probably "we will become the WeChat (transaction platform) for all transportation and freight related needs"?

Would make sense considering their user base has already been trained to expect a one stop shop ecosystem from an app, as opposed to Western markets which expect siloed special purpose experiences.

<comment><USER7> except Didi is already incorporated in Wechat plus they have monopoly in online car/taxi ordering, i don't think they can do anything about public transport, air or train tickets, only other realistic thing would be buying one of the bike sharing companies

</comment></comment><comment><USER8> > The round was said to have raised the four-year-old startup's valuation to > about $50 billion, up from a previous $34 billion after its acquisition of > Uber's China business.

Uber's valuation is ~$70 billion while Lyft's valuation is less than $10 billion. Therefore it seems like the two main players in ride-sharing will be Uber and Didi for the next while.

I can see Didi branching towards other markets (outside of China) and directly competing with Uber and Lyft. This will be interesting in the next while.

<comment><USER7> Chinese companies can't success abroad, because they win Chinese market with help of government protecting them from competition

name one Chinese service/software company which would be major player outside China

only partly successful companies are hardware companies like Huawei, Lenovo, xiaomi or DJI thanks to their prices with some of them growing to different segments over time

</comment></comment><comment><USER9> I'm seeing something right now. It's really, really difficult to figure out what kind of crazy valuations people will put on companies. It's reinforced my desire to own indexes all the more. I'll let buy a little of everything and let the money managers battle it out.

</comment><comment><USER10> Can anybody in China comment on how popular Didi is? Is it as universal (young to old people) and popular as Uber (don't want to hear the political commentary). What about average ride price per KM (Renminbi or dollars)?

Seems like Apple's $1 billion investment last year (May) in Didi might pay off huge.

<comment><USER11> Yes, Didi is universal across the country. You can order Didi through WeChat and actually what you get is a regular taxi car, not a Uber-type freelance driver.

<comment><USER7> you can choose if you want regular taxi or black car, it's up to you, you can even choose shared car with other passengers

</comment></comment></comment><comment><USER12> I just wondered for the first time: do these sorts of raises vacuum money away into one large basket, instead of bets on many smaller startups? Could it be zero-sum in a way?

<comment><USER13> The VC market expands and contracts like any other following the principles of economics. Therefore, the fact that the production possibilities frontier (is there a better term for a money market?) can move outward shows it is not zero-sum. In simple terms, as time goes forward, more and more resources can be created and injected into the market unlike a truly scare resource.

<comment><USER14> He said "zero-sum in a way" and that is true. At any given point in time it is zero sum, and for practical purposes you can approximate it as zero sum.

To say that if i robbed all of silicon valley investors of their money and claim it won't affect the funding prospects of new startups would be a lie.

<comment><USER13> Everything is zero-sum at an instant of time... I figured that was obvious enough that I didn't have to say it.

If you want to approximate it as zero-sum, be my guest. It's a functionally useless approximation.

</comment></comment></comment></comment><comment><USER15> Wow, the CEO is only 33.

<comment><USER16> You can google who her father is. It's a capital and guanxi/connection game, less about technology. Leveraging the direct/indirect capital resources they own and copycatting SV unicorn tech fashion in a walled huge market make them feel good. And they are really rich. It's their age now.

edit: added guanxi/connection

<comment><USER17> My failed attempt to find ANY information about his father somewhat proves your theory, or google doesn't wanna tell me?

<comment><USER18> The President's father is Lenovo's founder. I don't know if the CEOs father is a big shot.

<comment><USER16> I have to say it's a typical pattern for rich and connected kids in China to gain success. Top local college => top us college => join GS or whatever similar => trendy founder/CXO/etc. => Now it's their turn to have someone write articles to let ordinary people know they are not just rich, pretty/handsome, well-connected, but also they are super hard working, smart/intelligent, wise to earn their crowns all by themselves. We all know for well-connected in China, there are way more gates open to them. And the stake-holders in the western world can help them open other gates. As I said there is a long history of them doing all this kind of thing. Most people in China with enough experience in that society know that.

It's just a capital-intensive pretend play. They are the players and you have to watch them show off how good they played through mass media and your news feed. If there was an earthquake in that circle, new batch of players would show up.

<comment><USER19> Is that any different than how the USA works?

<comment><USER16> I forgot to mention the difference leaves different room for how much impact other factors can contribute to the final outcome, which, in my opinion, is more important.

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> That is massive. That is even more than the 3.5B Uber raised in the last round.

</comment><comment><USER4> Does this signal that Didi will likely enter an existing Uber market?

</comment><comment><USER20> WTF! Who raises $5.5B at one go?</comment>


Why Those Student Loans Aren't Getting Paid Off - <AUTHOR> https://mises.org/blog/why-those-student-loans-arent-getting-paid <comment><USER2> Instead of dealing with increasing costs of student loans we've thrown more money and accessibility at it (government sponsored, government backed, etc). Universities responded in kind with increasing tuition because well, people can get the money!

The other thing that happened is more and more of the job market requires a 4 year degree and some experience for entry level jobs! So while the price of education has increased, what your salary is after you are done has either decreased or not kept up.

We've overpriced the purchase of a degree, and made them a commodity in the job market making their value go down.

</comment><comment><USER3> I think we blew past the point of moral hazard when a degree became so expensive it required taking a loan.

Education has become one of the major economic predators of western civilization.

<comment><USER4> Substitute 'western civilization' for US/UK? In Europe there still are many countries with free or cheap higher education.

Education as a consumption good funded by loans is tragic though. The most expensive consumption good in a lifetime ...

<comment><USER3> I might have gone a bit hyperbolic on that. And I always wanted to study at U. Göttingen.

</comment></comment></comment><comment><USER5> Seems crazy that loan underwriters wouldn't take the type of degree into account. Shutting off the price signal of which jobs are in demand in the market seems extremely irresponsible. Reminds me of subprime lending problems that gave way to 2008.

<comment><USER6> Student loans are federally insured, so no one cares at all about the likelihood that the student will be able to pay it back.

<comment><USER7> These federally insured loans seem to be a common source of problems. The massive moral hazard means that incentives don't operate correctly. How do we fix it? Can we wind down and stop federally insured loan programs?

<comment><USER8> Likely not.

Students coming out of high school have no credit and generally only have a low-paying job. It takes some years to remedy these. The solution would be to have a co-signer, generally parents or other family member. This leaves young folks very much subject to circumstance. Orphan or in foster care? Good luck. Parent that thinks education is sinful, disowns you due to lifestyle, or is one of the 'you aren't my responsibility at 18' crowd? Even more good luck. Parents supportive but have bad credit? Yup. No loan for you.

This wasn't a problem when it was actually feasible to work your way through college, but it simply isn't anymore. A few pull it off, but many more simply can't.

<comment><USER9> I'm in a strong financial position and support my kids and their education to a very great extent.

Even given that, I'm unlikely to co-sign on a substantial loan for their education. Most parents would be even less willing (or in a less strong position) to co-sign for a loan that can't be discharged in bankruptcy. (And I completely support why they can't be discharged in bankruptcy.)

What we might be able to do is transition the federal guarantee to a private (or possibly still federal) insurance program with properties like variable PMI, factoring in credit, degree, grades, criminal record, or anything else actuarially linked to future repayment prospects. I don't love that idea, for many of the same reasons you mention, but that is a possibly workable middle ground of sorts.

</comment></comment></comment></comment></comment><comment><USER10> "But today, in a period when employment and earnings are vastly better than what they were in 2010, the delinquency rate for student loans is more than 11 percent..."

Might wanna check your crystal ball on that one: [https://en.wikipedia.org/wiki/Household_income_in_the_United...](https://en.wikipedia.org/wiki/Household_income_in_the_United_States#Recent_trends)

<comment><USER11> ???

The link you provided clearly supports this statement.

</comment></comment><comment><USER12> It's an interesting idea to treat educational loans like home loans, where the bank appraises the value of the home and sets loan limits accordingly.</comment>


Sen. Ron Wyden Asks NIST to Consider WireGuard to Replace IPSEC and OpenVPN [pdf] - <AUTHOR> https://www.wyden.senate.gov/imo/media/doc/Wyden%20Letter%20to%20NIST%20Re%20Gov%20Use%20of%20Secure%20VPNs.pdf <comment><AUTHOR> I love that Sen. Wyden was able to articulate accurately _why_ Wireguard matters. I have no idea to what extent they wrote the letter and to what extent they understand its contents, but I feel for a US Senator this is what trying looks like.</comment>


Why I left - <AUTHOR> https://github.com/zack-bitcoin/amoveo/blob/master/docs/why_I_left.md <comment><USER3> I'm not sure why the negative reaction to this post. I found it completely plausible and have no reason to doubt the author. It sucks that there are crappy people like this but unfortunately that's the real world. People will exploit you if you allow them to.

That said, threatening to sell exploits on the black market is a terrible way to fight back. Everything up to that point suggested the author had a case he could argue in court. If he does indeed proceed down that path he would likely find himself on the wrong side of the law.

<comment><USER4> _threatening to sell exploits on the black market is a terrible way to fight back_

My guess is that this is a clever way of destroying confidence in the coin and subverting the organization. He need not exploit the vulnerabilities; hell, they need not even exist. If he was really going to sell 0-days, it's not in his interest to announce it.

As someone who once had the experience of being forced out of an organization by someone who thought software teams could be swapped out like the janitorial staff, I love this. It won't make you rich, but sometimes it's nice to just watch something burn.

<comment><USER5> > _It won 't make you rich, but sometimes it's nice to just watch something > burn._

Cheers to this. :)

</comment></comment></comment><comment><USER6> I had a brief conversation on github with Zack few years ago over cryptocurrency implementation, great guy and really knowledgeable about cryptocurrency. Knowing Aeternity had him on the team, I immediately told my friends who invest in cryptocurrency they should pay close attention to it.

I also wanted to look into its code and help, but I'm not an erlang programmer.

To be honest, when I checked Ae's official website and found out that only one member is a technical person, I thought the structure is weird. I too have been approached by non-technical people who wanted to form a team, but rely on me to come up with both the idea and the product. I don't trust people who can only talk.

<comment><USER7> What one programmer can do in one month, two programmers can do in two months. -- Fred Brooks

As a programmer, I'd be happy in a team to be the only programmer as long as the rest of the team are experts in their domains.

<comment><USER8> > As a programmer, I'd be happy in a team to be the only programmer as long as > the rest of the team are experts in their domains.

As someone in that position right now, let me just tell you that it's not all roses (not that I think you'd necessarily assume it was!). For one, you have to deal with the stigma of being 'the nerd' in the team. You'll also end up doing a lot of menial tasks because "you're the technical one" (e.g. trying to fix the printer, explaining basic tech to other members of the team).

Finally, most importantly, other members of the team don't really understand what you do. They might devalue it, expect you to complete tasks in an unrealistic amount of time, or get frustrated when you're the bottleneck.

There can be benefits of course — you can probably plan your work yourself without being told, quite as much, what to do — but, contrary to expectations, I've found it quite problematic: you are in a very isolated position.

<comment><USER7> When you are in that role it's also your task to define the role. I can't fix your printer, I can take it apart (and it's usually 5 a year that suffer this faith for my hunger of cheap motors and axis to hack thing with). Your task is to implement a core asset of the company, not to fix a stupid printer. Estimates is a skill barely anyone is good at, put a higher estimate on tasks and tell the team that stuff is always work in progress and subject to change but change requests are the cheapest if the come early. Also, involve the team so they see the current state (and make it clear that this or that tiny functionality is still simplistic and will be improved later on).

</comment></comment></comment></comment><comment> King-Aaron > that he did something to me that both scared and injured me. I no longer > feel safe working with this person. I am walking with a limp a week later.

OP is happy to spill some pretty high-level corporate beans, but not detail a physical assault... I don't really know what to take from this article in all honesty. I feel there's a lot being left unmentioned.

<comment><USER9> And instead of getting a lawyer to resolve this, he says he'll just 0-day exploits for it. Seems like a poor negotiation strategy to me.

<comment><USER10> How does a lawyer resolve anything if there's no contract? And by extension, why should he refrain from publishing zero days if there's no contract? It's his software.

<comment> King-Aaron > why should he refrain from publishing zero days if there's no contract?

I can probably think of 77-million potential reasons that he might not be able to / want to.

<comment><USER10> None of those reasons apply to him.

</comment></comment></comment></comment></comment><comment><USER11> Their new CTO did an AMA on reddit recently. [https://www.reddit.com/r/Aeternity/comments/6vxiei/ama_sessi...](https://www.reddit.com/r/Aeternity/comments/6vxiei/ama_session_with_joel_reymont_cto_of_%C3%A6ternity/)

The relevant parts:

> There are no zero days. And we are not using any of Zack's code in the new > repo. Take a look at our Github. Zack's leaving has zero effect on our > technology and we are not using any of his code.

> We have been working alongside Zack for quite some time now and understand > the code. We felt that this is the right time to dump some accumulated and > unwanted technical baggage. We are starting with a clean source code > repository and will be bringing in pieces of code from the old repo as > needed.

<comment><USER12> Fascinating. That seems to confirm a lot of Zack's claims (not the physical assault parts, of course).

Highly unusual to start over with an empty repo when your lead developer quits. Which makes me suspect that the answer to the asked-but-unanswered question:

> Is this down to IP issues / lack of any contracts or legal agreements?

Is "yes".

<comment><USER13> Sure sounds like it. I've been through a somewhat similar (but less jarring) situation, mine was a customer silently started hiring people to clone a kind of trading system they licensed from us at the time, but the strangeness tastes the same way.

A bit of story, might entertain someone:

It started with them started asking somw weird questions, and generally behaving odd in our meetings about fixes and new features. Somehow, I came to the conclusion they had to be working on a clone, which I told everyone on the team. They were quite surprised by that, especially as I wasn't myself present at the strangest meeting. Que a year or so later, when my boss walked in. One sentence that said it all: - How the _hell_ did you know ? Turned out I was right. But truth to be told, I couldn't answer his questions. It was simply the only possible reason I could imagine.

</comment></comment></comment><comment><USER14> > my only way to get paid is by selling zero-day exploits for people who want > to attack Aeternity.

It sounds like a typical situation where a startup screws over a key early employee. Typically there are legal avenues to pursue if the author truly was taken advantage of. Threatening to sell 0-day exploits smells of immaturity and anger though. I'm not sure how the tech stack works or how long it was developed but $3.5MM to keep working there exclusively sounds either like the author insanely overvalues his work and skills or the technology is revolutionary in which case, they'll likely get huge and he could sue them for far more.

<comment><USER15> Sounds like the company did a token sale for $77M based on his work. So, no- he's not overvaluing his contribution.

</comment></comment><comment><USER16> >Things I have done for Aeternity

If this really was implemented entirely by one person, they have no moat.

>Instead the anonymous owner of Aeternity is deciding how the money is spent.

Yeah, that's how capitalism works. The person with the capital owns you. And now, I look into my crystal ball... I see the anonymous owner is going to sue you for running off with his intellectual property and starting a competitor with it.

Never heard of Aeternity, but this isn't going to end well for the author.

<comment><USER17> Also:

"If Aeternity is going to use the technology invented, and they wont pay me to make their software secure, then my only way to get paid is by selling zero- day exploits for people who want to attack Aeternity."

<comment><USER18> The irony. He rants about the unethical behavior of his associates and then clearly states that he will himself engage in unethical behavior. The only thing this rant proves is that the ICO space is over run by ethically challenged scammers much like the Bitcoin ASIC space was 3 years ago.

<comment><USER19> It may be ironic, however it's not unethical to engage in unethical behavior specifically against unethical actors.

<comment><USER17> Depends on your ethics. In mine that is absolutely unethical.

<comment><USER5> Sounds like they broke, or tried to break, his leg. Seems reasonable to me to want to fight back.

<comment> King-Aaron Honestly to me, it sounds like a junior (or at least, a non-business-savvy) person tried to extort somewhere in the area of $3.5 million from the owner of their company.

In this instance, "trying to break his leg" may have been more like "got shoved and fell over" (Which to be fair, _could_ be a reaction someone might have if their employee came into their office demanding several million dollars - who knows).

I don't know, I'd like to hear the other side of the story.

<comment><USER20> Junior? He has worked on the codebase since 2015 alone, then Aeternity stole his code and raised 77 million USD entirely based on his own work. He is the sole reason the company even exists so definitely not junior. And they stealing his code and starting a company based on it was how they got started so they are clearly not nice people.

<comment> King-Aaron Junior/younger/etc. Don't need to get too caught up in the terminology.

They also didn't 'steal' his code from the sounds of it. It sounds like he was in some form of verbal partnership to help develop a company (which they were clearly fairly far along with) but hadn't signed any real contracts. After two years someone isn't stealing your code, and you should be savvy enough to realise that the business world isn't really about being nice people - <USER2> need to cover your bases.

<comment><USER20> I don't care about terminology/title. That's irrelevant. My point is that the company raised 77 million of dollars based entirely on technology invented by this developer. Him asking to own a small part of that is totally reasonable.

I agree that he should have signed a proper contract with them and not rely on verbal agreements (but after reading little bit about him online he seems to be some sort of extreme libertarian, he doesn't believe in lawyers and contracts, just in voluntary exchanges).

But that doesn't mean it's not a bit evil for the company to just throw him away after using his name and technology to get people invest in them.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> The only conclusion I can draw from this is that it is written by someone who is highly immature and/or unstable. I mostly feel sorry for their investors who purchased yet another block chain hoping to make a quick buck with likely little to no diligence on what they buy. The more I hear about blockchains, the murkier it looks to me.

<comment><USER22> The author is effectively ousted from the "company", physically assaulted, signs nothing, then spends '5 days' with 'the Aeternity lawyer' mulling over a contract? All of this after not being paid while their colleagues are being 'paid regularly.'

My question is what/where is the legal void that this company existed in?!

<comment><USER21> Assuming you believe the OP. Things like "I didn't get paid so I am selling 0 days", or "I had to leave Europe to be safe because I fought with a guy", don't help me taking it seriously. Might be true. Might not be true. The only certainty is that this guy is a nutter.

<comment><USER23> Europe is large. Not sure what European country he's exactly in. Also even in the most advanced countries there are certainly still risks of the police not upholding justice.

<comment><USER24> Aeternety website says they are based in Lichenstein, even if their police was corrupt (which I seriously doubt) you could literally run to Switzerland or Austria. The way he talks about his allergies and they would be handled makes it seem he was in a 3rd world country which makes me question the veracity of the whole thing.

</comment></comment></comment></comment></comment><comment><USER25> Did I read this correctly, he was physically assaulted? Can he not press for criminal charges?

What's also interesting is I was approached by Aeternity at the end of June to join their team. Wonder if the timing coincided wtih the author's troubles

<comment><USER26> That was my thought. If anything, I would advise him not to sell 0-days out of spite and take the CEO to court.

</comment></comment><comment><USER27> Particularly alarming section:

> August 17- Aeternity finally makes an offer to hire me that I am comfortable > with. In the process of negotiating my employment, the owner of Aeternity > was asking me technical questions, and the honest answers I gave made him > angry. He wished that universe worked differently, and he blamed me, the > messenger of bad news. The owner of Aeternity was so upset by the technical > limitation, that he did something to me that both scared and injured me. I > no longer feel safe working with this person. I am walking with a limp a > week later.

He implies that a violent struggle took place but without saying so explicitly. Which is odd since a detailed description of a physical assault would draw immediate sympathy from we, the public-at-large.

<comment><USER28> The vagueness of that part reminded me of a time I worked at a small startup several years ago, and the owner got angry about something and kicked a chair which partly hit a couple of us. The damage was pretty mild but one of us did get banged in the knee so he limped slightly for a couple days.

I can only really imagine something similar happened in this case too

<comment><USER29> Eh.

So if someone walks into your office and demands $3.5 million or they walk, and you don't think they're worth it, two reasonable responses are to laugh in their face or to calmly explain why their expectations are unrealistic.

Kicking something across the room, punching the wall, yelling and screaming, or other displays of violent temper are not. I think it is reasonable to be scared for your physical safety if someone becomes violently angry around you, even if they do not initially direct that violence at you.

</comment></comment></comment><comment><USER30> It's amazing how we, geeks, fail to negotiate and secure our equity _before_ delivering our work and lose all leverage.

After countless examples where tech people have been exploited by business people, Tesla pops into mind as the most famous one, we still haven't learned our lesson!

<comment><USER31> Think if you're dealing with the sort of types who work in ICOs you need to be beyond business savvy and more expect to be screwed at every turn.

</comment></comment><comment><USER32> Upvoted this submission because it contains three very important lessons for technologists:

1\. Never, ever accept a cofounder arrangement where you deal with the code and someone else deals with all the money.

2\. If someone starts trying to exploit you, _get a lawyer_. The last thing you want is for the law to be on your enemy's side.

3\. If this is your hard lesson in the first two rules, and the bad guys offer you a substantial chunk of cash to walk away (and $300,000 is a substantial chunk of cash), take it. It's by far the least bad outcome for you.

</comment><comment><USER33> The fun part is that the owner of Aeternity calls himself Godfather of Ethereum.

[https://medium.com/@yanislav/king-of-bitcoin-godfather-of- et...](https://medium.com/@yanislav/king-of-bitcoin-godfather-of- ethereum-a9af9ecf56d5)

<comment><USER34> Delusional.

</comment></comment><comment><USER35> Start a new company and exploit somebody else while earning all the big bucks and credit, that's how capitalism works.

<comment><USER36> You left out an important part which requires trading capital for labor. It's not exploitation.

</comment></comment><comment><USER37> This is probably obvious, but the easiest way this can be avoided is by investors not investing millions of dollars in something when the ownership of that thing is not clearly defined.

Alternatively, if you don't know how ownership is to be divvied up, don't raise tens millions of dollars until you iron out the details.

</comment><comment><USER38> It seems to be a mistake on the author's part to allow himself to be exploited at first (working without having any of the promises in legal writing). It's unethical but not uncommon and alone wouldn't produce the outrage for an article detailing it.

The missing piece is why he doesn't feel pressing criminal charges and suing for IP is an option. The language seems to imply that the answer is for his physical safety. If he's writing this article because he feels safe enough to, then maybe he thinks battling in court requires people to be present and closes the distance safety net.

He's able to list pretty concretely his contributions but is suspiciously vague about the cause of his fear. I'm inclined to believe that it's because he might not think the public would unequivocally agree his fear is sound.

<comment><USER39> From what I've gathered from some people working in the blockchain community, some of the altcoins that are geared towards being a ponzi schemes have investors with Russian oligarch/mafia or similarly shady backgrounds. I wouldn't be surprised if that isn't completely contained to the obious scams.

</comment></comment><comment><USER40> I don't understand why he didn't nail down his equity situation _before_ doing any work. Yeah, it's pretty shifty of the 'founders' but then it's pretty basic for techies, especially early startup engineers.

<comment><USER41> Because of "don't worry - it'll be fine" thinking.

[https://news.ycombinator.com/item?id=15155068](https://news.ycombinator.com/item?id=15155068)

</comment></comment><comment><USER42> Why the author doesn't call out widely for assistance even if physically threatened/assaulted, but choosing to avoid all confrontations instead?

<comment><USER3> Passive behavioral trait. Shyness, unwillingness to engage in confrontation, I can empathize.

<comment><USER43> My impression was more passive-aggresive with a large dose of narcissism.

<comment><USER44> I didn't get that based on the fact that he moved to a whole other place where he felt safe. No one goes through that kind of hassle without having a good reason. His later actions justify or make me believe his story about the assault.

</comment></comment></comment></comment><comment><USER45> Isn't the code open source? Can he fork and start his own company?

<comment><USER33> He already started a new company. Amoveo

A scalable blockchain for financial derivatives. Optimized for scalability via smart contracts inside state-channels. Has a build-in oracle for integration with real-world data. Written in Erlang.

[https://github.com/zack-bitcoin/amoveo](https://github.com/zack- bitcoin/amoveo)

</comment></comment><comment><USER46> It's all fine when your startup is not making any money, but when millions of dollars starts to roll in things can get ugly. So always make sure you have the vesting worked out beforehand, and put it on a paper and have everyone sign it.

</comment><comment><USER47> No proof or evidence of anything. I've no idea about what happened here and I don't care but this post makes my BS detector fire in several places.

</comment><comment><USER48> If you're going to go to work on a ponzi scheme, don't be surprised when you end up working with entirely unscrupulous people.

</comment><comment><USER49> huh? I swear I just looked at the team page 5 minutes ago and still saw Zack listed as "Tech Lead", where now it shows Joel Reymont as CTO

<comment><USER50> Yup, I still had the page open before I reloaded -> [https://pasteboard.co/GINcLYZ.png](https://pasteboard.co/GINcLYZ.png)

</comment></comment><comment><USER51> don't understand how you can find zero-day exploits if your codebase was solid. If it wasn't maybe it's better that they don't use your code?

<comment><USER52> Exploit could be from dependant libraries or os related..</comment></comment>


CSS Sans – A font created in CSS - <AUTHOR> https://yusugomori.com/projects/css-sans/ <comment><USER2> This would be incredible for some privacy applications if you wrote a wrapper on top of it to obfuscate the class names. Clearly visible to users, very difficult for bots to pick up without clearly looking for it.

<comment><USER3> While this may evade simple scraping bots, it's easy enough to render the page then use some type of character recognition to get the content.

<comment><USER2> I don't disagree. But the bot / tool rendering it would need to know to look for it.

You could even pass around "not so hidden" messages with it. Tell your friends, add this CSS class to the body to see the message.

Bulletproof, not at all. Just pointing out a clever use.

</comment></comment></comment><comment><USER4> I am somehow disappointed that all the text on the website is not displayed using the font itself :p

<comment><USER5> That.

</comment></comment><comment><USER6> Pretty darn cool! One limitation I wish I could think of a workaround for is that "cutting out" parts of some letters (C, G, J, Q) requires laying a rotated white square over it, with white as the hardcoded background color. So this will only work with other background colors if you know the background color ahead of time or can configure it in JS or something.

<comment><USER7> Here's a 'C' without the white cut out using a transparent border-right.

[https://codepen.io/jeremyyeo/pen/eMaZmb](https://codepen.io/jeremyyeo/pen/eMaZmb)

</comment></comment><comment><USER8> This is awesome. Not everything built needs to be held to best practices and these sorts of projects are what make the web exciting!

I know I'm on HN but everyone responding is taking a tone like the creator said, "this is the best way to do it and everyone should use this in production" while on the page it only says they built it because they could -- because CSS has evolved to support it.

</comment><comment><USER9> Probably useless for any applications, but this is really cool! The page with the definitions of all characters A–Z is here: [https://yusugomori.com/projects/css- sans/fonts](https://yusugomori.com/projects/css-sans/fonts) It's interactive, so you can actually see how the definition (CSS code) of each character corresponds to the actual shape seen.

Something like this (but with different primitives, not CSS) is how Donald Knuth made the program Metafont, using which he created Computer Modern in all its variants (the font used by default by every TeX/LaTeX document). His intent was to capture the "idea" of each letter shape (glyph in the font), by writing a program for drawing that letter, instead of simply drawing it. He came up with something vaguely similar (pens of varying thickness, erasers, etc). The program is described in Volume C of _Computers and Typesetting_ ( _The METAFONTbook_ ), and Volume E is a thick hardcover book somewhat like this page, which gives the definition of (program for) each character next to a picture of its shape.

More Metafont-related links, if anyone finds this sort of thing inspiring:

\- [https://s3-us- west-2.amazonaws.com/visiblelanguage/pdf/16.1/...](https://s3-us- west-2.amazonaws.com/visiblelanguage/pdf/16.1/the-concept-of-a-meta-font.pdf) (this paper is a work of art!)

\- [https://www.metaflop.com/modulator](https://www.metaflop.com/modulator) (use the sliders)

\- [https://tex.stackexchange.com/a/423720/48](https://tex.stackexchange.com/a/423720/48)

Metafont may not have had the right primitives for character drawing, and CSS obviously doesn't (it's not what it's designed for), but the idea of _describing_ shapes is very interesting, and I still hope (despite decades of "failure") that it can catch on. Maybe with interactive input and immediate visual feedback, it would be more appealing, at least for some people.

<comment><USER10> To me, the most interesting part of Metafont is that it can take parameters. So your font could, for example, take a parameter for weight, letting you create as many different weight variants as you like. You can use one algorithm to create a Thin, Light, Regular, Medium, Demi, Bold, Black family of fonts. Or you could put a skew parameter in to generate an Oblique version (though true italics would require a separate algorithm).

<comment><USER11> We could skew fonts now if we wanted to. TTF fonts are mostly quadratic Bezier curves so we can redefine what the axes to use when rendering the font glpyhs. Instead of i = (1, 0), j = (0, -1) we can use i = (1, 0) j = (0.3, -1). There's a lot more to fonts obviously like bitmap glyphs, hinting, kerning, etc but we could build in some params if we wanted to.

</comment></comment></comment><comment><USER12> Awesome. I love that you have a section showing exactly what CSS properties are used to create each letter.

<comment><USER13> Hover over a letter's class to highlight the rendered stroke.

[https://yusugomori.com/projects/css- sans/fonts](https://yusugomori.com/projects/css-sans/fonts)

</comment></comment><comment><USER14> Discussed in 2015: [https://news.ycombinator.com/item?id=9204111](https://news.ycombinator.com/item?id=9204111)

</comment><comment><USER15> How outrageous, this site does not work with CSS disabled.

</comment><comment><USER16> How do these handle kerning? I'm guessing they are monospaced? Looking on the page I can't find any of the CSS Sans used in a sentence.

Edit: Found a demo page[1], it's monospaced.

[1] [https://yusugomori.com/projects/css- sans/archive](https://yusugomori.com/projects/css-sans/archive)

</comment><comment><USER17> It would be useful if you could add a LICENSE file in your repository.

</comment><comment><USER18> Creative, not sure if it's useful. Is it easy to change the font size?

<comment><USER19> You can use the font-size property as usual, if you convert the font definition from px units to em units.

EDIT: Demo with font-size: [https://jsfiddle.net/6cg8dLnz/](https://jsfiddle.net/6cg8dLnz/)

<comment><USER19> Baseline is broken with _display: inline-block_ but works with _float: left_ : [https://jsfiddle.net/eywwmL2o/](https://jsfiddle.net/eywwmL2o/)

Haven't figured out how to fix kerning if it's even supposed to work.

<comment><USER20> Like this: [https://jsfiddle.net/95v642n6/](https://jsfiddle.net/95v642n6/)

      .font div {
        display: inline-block;
        vertical-align: top;
      }
      .H + .U { margin-left: 2px; }
      .U + .G { margin-left: 1px; }
      .G + .E { margin-left: -5px; }

</comment></comment></comment></comment><comment> onion-soup What is next? OS written in CSS?

<comment><USER21> Someone's got you covered bro.

[https://codepen.io/ddietle/pen/zBjpVE](https://codepen.io/ddietle/pen/zBjpVE)

</comment></comment><comment><USER22> So are you supposed to write the whole thing using spans? Seems hard... maybe one way to pass the accessibility test (screen readers) is by putting the respective letter inside the span and set font-size to zero.

</comment><comment><USER23> The coolest thing I think is that all os's render the text/font the same way.

</comment><comment><USER24> Just because you can doesn't mean you should comes to mind :)

But that aside - pretty cool!

</comment><comment><USER25> reminds me of this nice icon project, where icons are also designed with one css block: cssicon.space

</comment><comment><USER26> Your scientists were so preoccupied with whether or not they could that they didn't stop to think if they should.

</comment><comment><USER27> Fuck accessibility, right? Neat project, but please don't actually use this for anything serious. A lot of people use accessibility tools to interact with the web, and this this would make it nigh impossible for them to consume your content.

<comment><USER28> Nope. While the characters are originally created with CSS rules, the resulting font is a web font standard .woff, completely accesible.

On-topic: I really like the hover animations under [https://yusugomori.com/projects/css- sans/fonts](https://yusugomori.com/projects/css-sans/fonts). Makes it really easy to get what was being done.</comment></comment>


Show HN: Like 99designs for User Experience Testing  - <AUTHOR> http://userexperts.com

<comment><USER2> Any idea what it will cost?</comment>


Ask HN: Preparing for YC interview, which one-liner do you think is the best? - <AUTHOR> I'm the co-founder of treble.ai, our interview at YC is coming, and we're preparing for it. I want to know what do you understand that my company does based on those one-liners.
Here's our demo video to provide more context: https://www.youtube.com/watch?v=8YkZdcLi65g
- We allow companies to obtain realtime feedback and insights through SMS and Whatsapp - We allow companies to ask questions and receive answers from their users without human interaction through SMS and Whatsapp - We allow companies to discover customer pain-points by chatting automatically with their users.
It would be great to know your opinion to improve our one-liner. <comment><USER2> You need to be way more direct and descriptive. The only one of those options that is decent is the second one.</comment>


Is Google OAuth Down? - <AUTHOR> <comment><USER2> We're seeing our OAuth login attempts be redirected to a "Clear Your Cookies" page help. Clearing cookies does not resolve the issue.

<comment><AUTHOR> +1

</comment></comment><comment><USER3> I don't think it's just 2fa - looks like more general reports of failure to sign in [https://downdetector.com/status/google/map/](https://downdetector.com/status/google/map/)

</comment><comment><USER4> At the bottom of [https://status.cloud.google.com/](https://status.cloud.google.com/) seeing:

> OAuth login issues

<comment><USER5> It's now been updated:

 _The Identity & Access Management issue is believed to be affecting a very small number of projects and our Engineering Team is working on it. If you have questions or are impacted, please open a case with the Support Team and we will work with you until this issue is resolved. No further updates will be provided here_

The delicious irony here is there's no way to contact GSuite support without logging in, and their login system is broken.

</comment></comment><comment><USER6> Seeing lots of issues with auth right now. Gmail is kicking me back to the sign in page repeatedly.

</comment><comment><USER7> Can't log into Jenkins right now because we use Oauth...

</comment><comment><USER2> Was able to log in (finally)</comment>


Offer HN: I will work for free. Anyone need a Sr. DevOps Engineer? - <AUTHOR> I have too much free time on my hands. I have 20 years experience in Linux and Open Source Projects. My Current responsibilities include Design, Architect and Support multiple Docker Orchestrators, DC/OS, Mesosphere, Marathon, Kubernetes. Toolchain and TechStack: Java, Ruby on Rails, Scala, AWS (Elastic Beanstalk, ASG, VPC, S3, CloudFormation, EC2 Container Service(Docker),ElastiCache, Terraform, Packer, Ansible, Jenkins, Datadog, New Relic, MongoDB, Redis, Vagrant, Virtualbox, GitLab, OSX, Ubuntu, Centos,CoreOS,Python, Bash, Shell. I'm available late afternoon and weekends. <comment><USER2> Would love to chat, I'm newish to this field and would love to bounce ideas

</comment><comment><USER3> What's your email? I would like to talk about some kind of mentoring time.</comment>


Google Blurs The Line Between Web And Native Apps On Android - <AUTHOR> http://techcrunch.com/2014/06/25/google-blurs-the-line-between-web-and-native-apps-on-android/

<comment><USER2>
        > the redesigned app switcher ... shows native apps as
        > well as active web tabs. Every web tab has the same
        > value as an app. It's huge.

For me that'll be literally, since i often have hundreds of tabs open. I really hope that will be an optional setting.

<comment><USER3> There's a cap at 100[1]. And individual apps can set a lower cap if they wish.

[1] [https://developer.android.com/preview/api- overview.html](https://developer.android.com/preview/api-overview.html) Concurrent documents and activities in the Recents screen

</comment></comment><comment><USER4> All web devs and Android app devs need now is an API for an app to dynamically add icons to the app drawer, so that web apps can be added to the app drawer via Google Chrome.

The permissions for this will have to be on an app by app basis, since I'm sure this is a feature that'd be ripe for abuse.

<comment><USER5> IOS already has an api by which a web dev can specify what the app icon looks like when the user adds the web page to their home screen. I imagine google would use the same api or something very similar.

[https://developer.apple.com/library/ios/documentation/AppleA...](https://developer.apple.com/library/ios/documentation/AppleApplications/Reference/SafariWebContent/ConfiguringWebApplications/ConfiguringWebApplications.html)

</comment></comment><comment><USER6> > the redesigned app switcher ... shows you your recent apps in a sort of card > drawer

eugh! I hate the Windows Vista task switcher, the Win+Tab 3D one, and this looks worse that that as I can only see what 4 of those apps are and it looks like there's a 5th at the back.</comment>


Ask HN: What is the future of Rust after the Mozilla layoffs? - <AUTHOR> HN, would it be wise to build a new open source embedded system in Rust after the Mozilla layoffs were announced?
Does Mozilla have the resources to continue to support Rust?  Will another company like Amazon or Microsoft step in to sponsor Rust?
Do these open questions make investing in Rust projects as a startup too risky? <comment><USER2> [https://news.ycombinator.com/item?id=24133342](https://news.ycombinator.com/item?id=24133342)

</comment><comment><USER3> My understanding is that a separate Rust Foundation has been in the planning phase for some time.</comment>


Ask HN: Is there a renewable drone? - <AUTHOR> I am looking to buy a drone made out of renewable materials. I understand the computer, battery and communication system cannot be renewable.<p>Thanks. <comment><USER2> For those of us who have been builders for years this is a strikingly odd request.

Before the mass production of flying things, it was considered quite normal that - assuming you could retrieve the parts, everything you built was renewable.

I've been building flying things for 30 years and counting - since I was a young kid. Mostly planes, but also a couple of quad copters and other wacky things.

I've become used to the following mantra in this hobby: "Build, fly, crash, build, fly, crash.."

This is why it's been fairly disappointing to see the AOL'ification of drone flying in the last few years. You kids with your fancy plastic junk are missing one of the most important aspects of the flight hobbyist world: build.

So it's kind of a weird position to be answering this question, because I feel it's born of a kind of consumer ignorance for how things work.

It's really not hard to build your own drone - and once you crash it, it's really not hard to build your own drone.. with a bit of flying in there too of course, or at least one would hope.

If you want to learn this key aspect of the flying hobby, a great place to start is that stalwart of flying things on the internet: [http://rcgroups.com/](http://rcgroups.com/)

Build your own drone! Crash the thing! Build it again! That is the true value of the hobby - the development of recovery and rejuvenation skills. With a bit of flying in there as well...

<comment><AUTHOR> Thanks for your response. As drones crash, sometimes they create plastic debris. I would love to build something myself but I don't have the resource to do so at the moment.

I'm looking to fly a drone over the ocean and don't want it to litter in case it crashes and I won't be able to retrieve it in time.

Hopefully there is demand for a drone like this.

</comment></comment><comment><USER3> What do you mean by renewable? Like recycled? Or do you mean modular, like Project Ara but for drones?

</comment><comment><USER4> Structural components can be built from light wood, like Balsa [1]. This migh be possible for the rotors too. I'm not sure a ready-made drone exists, but you could build this yourself.

[1] [https://www.youtube.com/watch?v=QMWjhyCWBlk](https://www.youtube.com/watch?v=QMWjhyCWBlk)

</comment><comment><USER5> [https://www.technologyreview.com/s/603552/these-paper- drones...](https://www.technologyreview.com/s/603552/these-paper-drones-are- built-for-one-way-missions/)</comment>


Virtually-No-Chance-Soon-for-Any-Bitcoin-Denominated-Mortgages - <AUTHOR> http://www.nationalmortgagenews.com/features/Virtually-No-Chance-Soon-for-Any-Bitcoin-Denominated-Mortgages-1040546-1.html?ET=nationalmortgage:e5242:472844a:&st=email&utm_source=editorial&utm_medium=email&utm_campaign=NMN_Daily_Briefing_010814&site=default_tech

<comment><USER2> As a buyer, it would be foolish to have a mortgage in such a deflationary currency.</comment>


WSJ: Spying on consumers a fast-growing business - <AUTHOR> http://online.wsj.com/article/SB10001424052748703940904575395073512989404.html?mod=WSJ_hpp_LEFTTopStories

<comment><USER2> I think facebook will make billions on this. Basically facebook will have the ability to track all your interactions in the facebook environment and develop good intelligence of your consumer preferences.

Facebook will then create a targeted ad platform that utilizes this intelligence. Advertisers will pay good money for better targeting.

Targeted online ad market is huge.

This is facebooks way of delivering targeted ads vs googles targeted ad method, of pairing ads with search terms.

The competitive advantage facebook has is that it's hard for a competitor to copy and replicate the same ad network and get the same amount of consumer intellligence. The competitor in essence has to create a hugely successful and popular social network and get people to interact/ share a lot on it before they can even think of competing with facebook.

Facebook wants you to share and connect with people because the more you do the more information they can use.

Facebook is sitting on a goldmine.</comment>


I "found" the database of a college app (2018) - <AUTHOR> https://yoginth.com/college-hack <comment><USER2> As far as I know, none of these keys (except the email/password) are considered a secret. The real problem here is that they aren't using Firebase/Firestore rules to correctly limit database access.

</comment><comment><USER3> Visible key isn't the bug. The bug is that the app should not have read access to other students.

<comment><USER4> Yep. Although this exact thing has happened to so many apps I'm beginning to doubt the wisdom of this "allow completely open dev settings at first and then YOU get to remember to fix it" model that fire base uses.

Maybe they could require an IP whitelist if the permissions aren't set yet or something.

<comment><USER5> This is the cause of many mongodb and redis woes as well.

</comment></comment></comment><comment><USER6> What makes this even more sloppy for the school is that I know for a fact that Firebase will send your admin account an email when it detects that you have weak security settings on your database. It also sends said email repeatedly, once per day.

I know because I intentionally have a developer db that is read access for the whole world and I get that email every afternoon. The admin of this app either is not competent enough to know what that email means, or is willfully ignoring it.

<comment><USER7> Or registered on a "throw-away" gmail account created for this app that no one is reading.

</comment></comment><comment><USER8> The media would have a field day and say that he hacked his school database. It's crazy how so many institutions are doing the digital equivalent of leaving an unlocked car in a bad neighbourhood and no one holds them accountable. Most people understand the concept of an unlocked car, not many understand that he didn't do anything special to hack his school db. He just strolled right in.

<comment><USER9> > he didn't do anything special to hack...

Someone who snatched a purse out the hand of someone else isn't "doing anything special" either. The illegality doesn't hinge on the difficulty of the action. Why is that so hard to grasp for technical crowds?

If you find a car with the keys in the ignition and the door unlocked, you won't get away with driving it a block down the road by telling the judge: "Oh, but it was obviously insecure, and I was just testing to see if I could steal it".

<comment><USER8> The data that's available isn't the school, it's student data! The school left the students "cars unlocked" and no one holds them accountable. They just say that people shouldn't steal cars.

<comment><USER9> They left the car unlocked in the same sense that your home is unlocked. With the right tools, it'll take me 5 minutes to gain entry. I could then claim that it's your own fault I gained entry because you don't have a metal enforced door, steel bars across windows, and a lock that can't be easily or Hardily picked...

Yes, someone technically minded with the right tools and access can break in. But that's less than 5% of the population, very similar to the percentage who could easily pick even a complicated lock, but Of cause near 90% will be able to take an ax to a door or kick in a window.

<comment><USER8> Even with that house analogy, I'd argue that you shouldn't store large volumes of other people's sensitive personal data in a house that has the bare minimum security.

The issue is organisations being reckless with our data and then blaming hackers when they lose it. It should be common sense that if you have sensitive information then it needs an appropriate level of security but someone companies have convinced everyone it's not their fault

</comment></comment></comment></comment></comment><comment><USER10> Did someone verify any of this?

If I recall correctly this `yoginth` is a known fraudster.

See: [https://twitter.com/sindresorhus/status/1015873644377935874](https://twitter.com/sindresorhus/status/1015873644377935874) or [https://twitter.com/natfriedman/status/1059865722904440833](https://twitter.com/natfriedman/status/1059865722904440833)

<comment><AUTHOR> Hey, that is too old and I have done it without knowledge, it's my mistake and I apologized for all of them personally and publicly!

Here this app belongs to my college, it's my attendance and work is mine!

<comment><USER11> You've built an entire online presence by copying everything from other people's work - from your blog theme to your content "without knowing"?

Adorable.

Also, by briefly reading the docs on the "platform" you are trying to peddle, I'm getting fairly certain you also copied that as well, as it is too well written in comparison to the drivel on your blog.

<comment><USER12> In all fairness on that last point, if you're referring to his "Gitote" project, the author has stated here [0] that it was a fork of Gogs, and seems to have retained the proper copyright notices in the source files:

"// Copyright 2015 - Present, The Gogs Authors. All rights reserved. // Copyright 2018 - Present, Gitote. All rights reserved." [1]

I agree it should probably have been given more prominent mention, but given the number of commits doesn't seem (at quick glance) to be a hasty "fork and rename".

[0] [https://news.ycombinator.com/item?id=20137624](https://news.ycombinator.com/item?id=20137624) [1] [https://gitlab.com/gitote/gitote/blob/master/gitote.go](https://gitlab.com/gitote/gitote/blob/master/gitote.go)

<comment><AUTHOR> It was accepted by the founder itself [https://twitter.com/jc_unknwon/status/1066713466524848128](https://twitter.com/jc_unknwon/status/1066713466524848128)

</comment></comment></comment></comment></comment><comment><USER13> A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

<comment><USER14> I'm not sure if you are in the industry, but attendance tracking is high up on most institutions lists of metrics to track. Aside from helping out the usual back office data, it's often a key indicator for students who are in trouble. The institution can then reach out and assist these students.

<comment><USER15> They might just not be from the US. Here in Germany, tracking or forcing student attendance is subject of large discussions and generally often frowned upon (or forbidden by regulation) in the University setting these days.

<comment><USER14> This is mind boggling. Failing someone for missing one or two classes is ludicrous, but giving someone a certificate who didn't engage with the course is equally so. University education isn't about the destination/exam it's about the journey.

<comment><USER16> This is a common practice in Europe as I understand, not just Germany.

The thinking as I understand it goes along these lines: there are requirements to get a degree (thesis, pass exams, score high enough in exercises), but the university is primarily a center for learning and you are an adult, so how you achieve the abilities to fulfill the requirements is your own business. If you want to do things on your own, you are free to do so.

<comment><USER17> Also, it is seen as a test by itself: Are you capable to take your responsibility and do your work?

This is a quite valuable lesson by itself. Most people need a few months to learn it (partying is fun, but doesn't get you a degree), some don't and indeed drop out.

</comment></comment></comment></comment></comment></comment><comment><USER18> I had to code-review a Django app using Firebase as a DB and swore never again. He did features and promised to do validation and security later by going to their editor and writing Javascript files. Django lets him write valid forms and correct SQL queries in almost same lines of code. Pagination was a pain in current version and present only in a version forever in beta. All the hard work coaching him on exceptions went out of the window.

An Android dev finally enlightened me where Firebase shines: offline sync of mobile to a server by eliminating lots of explicit CRUD calls and error handling.

</comment><comment><USER19> An Australian autistic developer found a top university's custom authentication database exposed to the internet in less than 10 minutes. Please, no more DIY crypto or running unaudited services willy-nilly. :prayer- emoji-here:

</comment><comment><USER20> I'm not familiar with Firebase, but is it unusual for end users to have direct access to a database at all? Why isn't there a web front end there?

<comment><USER21> Firebase has a "rules" feature where you set up security/authorization rules on your database:

[https://firebase.google.com/docs/database/security#section-a...](https://firebase.google.com/docs/database/security#section- authorization)

There's a "development" mode you can enable on your database that simply ignores all of the rules. The college app either 1) has no/unsafe rules set up, or 2) left their Firebase database in development mode.

</comment></comment><comment><USER22> Good spot, but be careful in the future in your approach. Some places will nail you for having not stopped at the point where you unpacked the apk resources and noticed the API keys. Downloading the credentials might not have been the smartest move.

</comment><comment><USER23> Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

<comment><AUTHOR> I think we can't hide keys up to my knowledge!

But make sure you just switched firebase to production mode.

In my case, the firebase was in development mode and the data is available public!

[https://yoginth.com/college-hack#mitigations](https://yoginth.com/college- hack#mitigations)

<comment><USER24> It's not about keys or modes, it's about the rules they didn't set up. Everyone uses firebase like that. Those "keys" are required to allow you to connect to the correct firebase app, nothing more. You don't get any direct special permission to do things on the database or storage. Here some more info about the rules: [https://firebase.google.com/docs/database/security](https://firebase.google.com/docs/database/security)

</comment></comment></comment><comment><USER25> Isn't this the opening to film Wargames?

Has Joshua asked you to play a game of global thermonuclear war yet?

</comment><comment><USER26> Is Gitote a fork of Gogs/Gitea?

<comment><AUTHOR> It's a fork of Gogs!

</comment></comment><comment><USER27> This seem to be the default on most G services.

</comment><comment><USER28> ITT everybody doing the same!</comment>


Heads down (thumbs up) - <AUTHOR> https://medium.com/life-hacks/17f71562a063

<comment><USER2> What is the deal with so many sites requiring you to log in to simply view content? This does not work.

<comment><AUTHOR> OP here: Weird. You shouldn't have to log in to view a Medium post. What screen are you getting?</comment></comment>


Ask HN: What does Google gain by working on Chrome the browser? - <AUTHOR> Do they guarantee a say in web standards to benefit themselves?<p>What do they gain by spending so many resources building a free web browser? <comment><USER2> This is a big one: its a browser they don't have to pay to have google made the default search engine: [https://www.cnbc.com/2017/08/14/google-paying- apple-3-billio...](https://www.cnbc.com/2017/08/14/google-paying- apple-3-billion-to-remain-default-search--bernstein.html)

It lets them use it as a jumping off point for some hardware: [https://www.google.com/chromebook/find/?utm_source=en-ha- na-...](https://www.google.com/chromebook/find/?utm_source=en-ha-na- sem&utm_medium=text&utm_content=bkws&utm_campaign=chromebookfamily&dclid=CI3H0s-969UCFciAYgod- zgNFA)

And it appears they now have an enterprise version: [https://www.blog.google/topics/connected- workspaces/introduc...](https://www.blog.google/topics/connected- workspaces/introducing-chrome-enterprise/)

I'm sure there's more, but I imagine, financially, I could have stopped after the first one.

</comment><comment><USER3> Google Search is the default search engine on Google Chrome. Ads on Google Search is where a large part of Google's billions of dollars comes from.

Ergo, Google Chrome is one of the most valuable properties Google has.

Thinks like being able to dictate how the rest of the Internet behaves by adding warnings on different things, removing certificates, blocking advertising competitors, determining web standards, etc. are all just side perks.

</comment><comment><USER4> Chrome has enabled Google to move beyond the link as the primary currency of authority (PageRank) and toward click-throughs as a more robust proxy with respect to search rankings, ads, etc.

</comment><comment><USER5> Google has slowed the adoption of ad-blocking by not making it a default in Chrome. That's a huge win for their main revenue stream.</comment>


6 Git Aha Moments - <AUTHOR> https://dev.to/henrikwarne/6-git-aha-moments-3097 <comment><USER2> "...from an SVN perspective" would probably have been a better title. Most of these are about adjusting to the differences between SVN and Git workflows (which is relevant to a lot of people, but probably not most of those who recently became developers).

Point number six, about converting WIP commits back to local changes, I would consider an anti-pattern. If you suddenly have to drop everything in order to work on some other branch for a while, or if your local changes were very small, it might be a good idea. But as long as the WIP commit represents a reasonable code state, it would be preferable to continue work on a new commit. If necessary, you can squash them later on.

</comment><comment><USER3> > If the original title begins with a number or number + gratuitous adjective, > we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to > "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is > meaningful, e.g. "The 5 Platonic Solids."

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment><comment><USER4> Problem 6 can also be handled using worktrees, which have been available since git 2.5 (July 2015).</comment>