When It's Darkest Men See the Stars - <AUTHOR> http://steveblank.com/2010/11/24/when-its-darkest-men-see-the-stars/ <comment><USER2> There is a more nuanced view to be had of the current situation. For instance, Richard Florida has a new book out called The Great Reset.

[http://www.amazon.com/Great-Reset-Working-Post-Crash- Prosper...](http://www.amazon.com/Great-Reset-Working-Post-Crash- Prosperity/dp/0061937193/ref=sr_1_1?ie=UTF8&qid=1290619261&sr=8-1)

Florida offers compelling evidence that the 1930s were the most innovative decade of the 20th century. Many new business practices were invented at this time. And this is when Hewlett Packard got going, and with it, what later came to be called "Silicon Valley".

The 1930s were also, at the same time, the worst economic disaster in the history of the USA. So an era can be both disastrous and very innovative. Those are not opposites. To say (as Steve Blank does) that we are at the beginning of an entrepreneurial revolution is inspiring. But he should be able to see that we can have both an entrepreneurial revolution and an economic disaster. Both are possible at the time.

This can be shown with a very simple graph. I will post that later.

<comment><USER2> I promised to post a graph, so here it is:

[http://www.smashcompany.com/business/if-the-usa-is-the- most-...](http://www.smashcompany.com/business/if-the-usa-is-the-most- innovative-nation-on-earth-then-how-can-it-have-a-period-of-economic-decline)

I offer this as a simple model to show how a country can be both extremely innovative, yet also face dramatic long-term economic decline.

<comment><USER2> About rounding the numbers, sure, I could do that, but I didn't want to put the time into it. This is what I could do in 15 minutes using Google Docs.

The graphs show the real picture. You don't need to look at the numbers.

<comment><USER2> Okay, I rounded the numbers.

</comment></comment></comment></comment><comment><USER3> It's sad to see so much pessimism here. You are underestimating the power of technology to fix seemingly intractable problems such as energy or healthcare costs.

Here is a key quote from his post:

 _Revolutions are not obvious when they happen. When James Watt started the industrial revolution with the steam engine in 1775 no one said, "This is the day everything changes." When Karl Benz drove around Mannheim in 1885 no one said, "They'll be 500 million of these driving around in a century." And certainly in 1958 when Noyce and Kilby invented the Integrated Circuit the idea of a quintillion (10 to the 18th) transistors being produced each year seemed ludicrous._

<comment><USER4> You're overestimating technology innovation being able solve the ills of government/corruption/war/debt.

<comment><USER3> I bet I'm not. The printing press had a pretty big effect, and I expect the Internet will be similarly powerful.

<comment><USER5> The internet is turning out to be more like TV and less like books/newspapers on that front.

Signed, Someone who used to be an idealist about that.

<comment><USER3> If you expect everything to suddenly change overnight, of course you're going to be disappointed, but if you can't see things changing, you are blind.

<comment><USER5> Okay, as I'm a bit grouchy, I will bite. Here are some of the changes I see:

There's a generation rising up that largely sees privacy as disposable rather than precious.

Groups of what I'd call the wilfully ignorant -- hate groups, cults -- are thriving out in the information age; most of them growing far faster than they would have been able to previously.

Decades ago, society's malcontents may have organised, marched, and changed things. Today: they can organise, march, and be ignored due to our society- wide ADD and the incredible media sophistication wielded by the powerful.

Or, more often, they can do none of that, vent on the net, and still be ignored.

Then there's the huge, undeniable, centralisation going on. Even without evil being actively done within organisations like Facebook or Google, it creates huge vulnerabilities for abuse, as we've already seen.

There are all of the extremely bright people who ought to be contributing to the next technological revolution(s), instead looking to reinvent online marketing.

In short.... I do see change. I don't see much change for the better -- not when it comes to "reshaping the face of society" kind of change, in any case.

How's that for your daily dose of cynicism?

<comment><USER6> It's easy to be a cynic, and it's hard to argue with one. But cynics don't change the world for the better. Your opponent in this argument has done it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Wow, its so optimistic, I hate to say anything to the hurt of the optimistic message. However, it feels to me like what is happening in the software startup world is that, thanks to the falling cost of launching a product, the pie is not only being distributed to the smaller guys, but it is also shrinking... because the small guy is willing to put out a competing product in some cases just for the fun of it.

Edit: One more thing... I think the end-game here is perfect competition, and I don't think that will be good for anyone.

<comment><USER8> Well, in market economics, 'perfect competition' is usually considered a good thing. It allows for maximum innovation and and the maximum alleviation of 'scarcity.'

I think the problem is that so long as this new wave of entrepreneurship is limited to web-startups, we're going to see diminishing returns. There are only so many ideas that can reshape the way we do communicate and do business while remaining within the confines of a webapp. Future startups will presumably have to chase smaller and more niche problems in order to remain relevant.

<comment><USER9> A byproduct of the maximum alleviation of scarcity is that there is no more economic rent for firms. This means that web/software entrepreneurs in general wouldn't be making huge money, they'd only be making enough to cover their opportunity cost of their next best alternative.

In this scenario, people would be motivated to do it because it's either the only thing they know how to do, or their true passion and more important to them than anything else. Either way, while the consumer wins, the entrepreneur loses in terms of cash (but maybe not in terms of personal fulfilment).

</comment></comment></comment><comment><USER10> When it is darkest, men see the stars.

<comment><USER11> Thanks for this; I could not make sense of the title. I am not a native speaker of english

</comment></comment><comment><USER12> I'm afraid he doesn't see the underlying trend about higher energy availability from the end of the 18th century up to just a couple of years ago. For a more gloomy prospect, see this extremely interesting analysis of the long decline (3 centuries) of the Roman Empire : <http://europe.theoildrum.com/node/5528>

</comment><comment><USER13> The limit of this thesis is that I think a great majority of human beings are looking for security more than for a job.

I'm not sure the "be your own boss" scheme is what everybody's looking for.

I however agree with the author that the West will not collapse if, we've seen worst in the past (well at least in Europe we have).

<comment><USER14> Unless every entrepreneur is starting a company of exactly, precisely one employee, it really doesn't have to be.

It's not about a transition to 100% entrepreneurship. It's about a big enough rise in quantity that it becomes a qualitative change, where working at a "startup" no longer raises eyebrows, where the social system adjusts to accommodate this instead of considering it an exception (universal healthcare if you're leftward inclined, breaking health insurance away from employers and moving it back to individuals if you're rightward inclined), and so on.

</comment></comment><comment><USER4> All the innovation and multitude of startups can't plug the sinking ship that is the US economy. For example, how will these problems be fixed:

\- US national debt at 13 Trillion.

\- US debt held by foreigners at 4 Trillion.

\- US total debt at 54 Trillion. Unfunded social security and medicare liabilities.

\- a costly army stationed at 150 countries around the world

\- an aging baby boomer generation, which will reduce their consumer spending (70% of the US economy is consumer spend)

\- U6 unemployment rate at 17%

Not to mention in this economy, the web startups face

\- closed platform dominance from facebook/google/zynga/apple. if you build something they want, they will duplicate the functionality quickly

\- too many other 'me-too' startups. all the seed camp startups are starting to look alike.

\- lack of monetizing opportunities, as most people still don't like to pay for things online.

<comment><USER15> _a costly army stationed at 150 countries around the world_

I keep seeing this number, always without any kind of citation. What's really interesting is that there are only between 150 and 200 countries in the world. But wait--the US has an embassy in every country it has diplomatic relations with, and each embassy has a detachment of Marines. There are 125 of these detachments (<http://en.wikipedia.org/wiki/Marine_Security_Guard>). 125 and 150 are within the standard rounding error of urban legends, but there's probably another 25 countries you could add to the list if you count military advisors, peacekeeping/humanitarian missions, and even a handful of actual foreign deployments.

It's pretty disingenuous to count 1,000 Marines distributed over 125 embassies as stationing the US military around the world, if that's indeed what the people who came up with this number are doing. I'd really like to see a breakdown of this "150 countries" business.

<comment><USER16> Especially if you count that way, what first world country _doesn't_ have troops stationed in 150 countries?

We obviously have major detachments in Germany, Japan, and Korea. Plus the countries supporting the war in Iraq and Afghanistan (I'm sure those two will join my first list in 20 years). Then there are a _lot_ of logistics bases around the world. Does that really count? If we want to be able to project our navy to the other side of the world, you need a refueling stop in Guam. So unless we are talking about cutting the military down to a tenth of what it is now, the # of bases is not what is driving US costs.

# of and cost of weapon systems drives it all.

<comment><USER17> > what first world country doesn't have troops stationed in 150 countries?

Switzerland, maybe?

<comment><USER15> They still have embassies. Being neutral doesn't necessarily imply being isolationist.

<comment><USER17> Do they have troops at their embassies?</comment></comment></comment></comment></comment></comment>


The Quest to Build a Truly Free Version of Android - <AUTHOR> http://www.wired.com/wiredenterprise/2013/10/replicant/ <comment><USER2> I can't see this being a pleasurable user-experience. Ever.

I think this highlights the fact that it would be much easier to start with open _hardware_ and install something intended to be fully open like Ubuntu Touch on it. Unless you do that, you're going to need to reverse engineer every device driver for every piece of phone hardware – you'll never finish and the user will always be cut off from some percent of their phones features and the rest might not work correctly.

I guess that a pleasurable user-experience might not be the end-goal and maybe this is fun because hacking.

<comment><USER3> Freedom and convenience are virtually always antagonists.

<comment><USER4> That isn't true, and it's dangerous to say it is.

<comment><USER3> Slavery always requires less thinking.

<comment><USER5> The road to slavery requires less thinking. Once you get there you need all of your wits just to survive.

</comment></comment></comment></comment></comment><comment><USER6> I help people make things using the Android OS - things that are not phones and that do not include the Google ecosystem. I have also been involved with using code from AOSP to create Android compatibility for non-Android OSs and in convincing OEMs of non-Android system to use it. In my experience I have traced the boundaries of what Google allows people in general to do, and their OEM partners to do with Android.

This is roughly how it goes: If you want to use AOSP for anything, including competing with Google, go for it. Google won't sue you, and won't even FUD you the way Sun did and Oracle continues to do if you want to use an open source Java implementation.

If you make Android devices that use Google's logo and proprietary code and ecosystem, you can stuff Android full of crapware that your carrier partners want, and that your product managers delude themselves into thinking gives you "differentiation," even though Google really does not want that to happen. What you can't do is compete with Google, or take a cafeteria approach to using Google's apps and ecosystem. You are in or out. No in-between.

AOSP is Apache licensed and Google adheres to the letter and spirit of that license. Both B&N and Amazon compete with Google using AOSP code and there has never been a hint of FUD aimed at them for doing so.

Many China-market phones with China-based ecosystems are based on Android. Here is where the lines blur a bit: China-based Lenovo gets away with making AOSP-based products for the China market with non-Google ecosystems and they make Google-logo Android phones. Somewhat famously, Taiwan-based ASUS was slapped down by Google for trying to do, as far as I can tell, exactly the same thing. There are also Google OEMs who make OPhone handsets. So Google hasn't been 100% consistent regarding OEMs with one foot in the mainland China market and one foot in the Google ecosystem.

It also appears that OEMs licensing other OSs, notablely Windows Phone, get no retaliation from Google.

I also dealt with Sun, trying to get a license to use Java in a VoIP-oriented OS. They were utterly opaque bastards about the licensing process, cost, etc. and about their position regarding Java patents and open source implementations. to the point where we concluded they could go to hell and we would use an open source Java implementation. Using AOSP is by contrast FUD- free.

<comment><USER7> It wasn't ASUS that got slapped down, it was Acer. ASUS, Samsung, Huawei (and probably others beyond Lenovo) have had no trouble distributing AOSP-based products without Google services. Acer's situation was different for two reasons:

1\. Aliyun (Acer's partner in this) was distributed pirated apps via their app store, including pirated Google apps: [http://www.androidpolice.com/2012/09/15/aliyun-app-store- con...](http://www.androidpolice.com/2012/09/15/aliyun-app-store-confirmed-to- be-distributing-pirated-android-apps-many-from-another-pirate-site/)

2\. Google claimed that the Android-based OS that Acer and Aliyun had built did not pass the standard Android compatibility tests, in violation of Acer's agreements with the Open Handset Alliance (a prerequisite for their license for the various Google apps). I'm not sure if a third-party verified this claim before the project was killed, but it's plausible. And we do know that most of the non-Google products OHA members distribute in China should pass those same tests. They're usually the same as products the member is selling outside China with Google services, with the exception of China-specific radios.

<comment><USER6> Yeah I was wondering if I got the two confused. You are correct, it was Acer. The other points you bring up are also correct. But there is more:

If Aliyun does not pass CTS, it's good enough to run those stolen apps. Also, as I pointed out, other OEMs get away with having both Google logo phones and Aliyun phones. (Aliyun was the Alibaba OS, and has been "spun out" though it's hard to tell if that is a meaningful separation.)

Aliyun is certainly not the only app store selling apps that were never submitted by the developer for distribution. It's a commonplace form of sleaze.

<comment><USER7> > If Aliyun does not pass CTS, it's good enough to run those stolen apps.

I don't think we know that. Just because APKs were listed in a store doesn't mean they did anything useful when installed. I don't recall any evidence one way or the other about how well the various pirated apps actually ran on an Aliyun device. If you know of any, I'd appreciate a pointer.

Separately, I agree that Aliyun's sleaze is relatively common, but so what? I'm not suggesting Google should (or even can) proactively police every app store out there. I'm just saying Google is well within their rights to come down hard on one of their partners working with a store that pirates Google apps, wherever it happens to be. Honestly, I'm still puzzled about why Google leaned so much on compatibility in their response. I'd have thought that the issues with unauthorized distribution of Google apps were simpler and more clear-cut.

<comment><USER6> I have seen Aliyun handsets. Like other China-market AOSP-derived systems, Aliyun is Android without Google's ecosystem. It will run any Android app up to the API level used in Aluyun you put on it. The claim that it's not CTS compliant is, at best, splitting hairs. No specific incompatibility has ever been claimed, and no set of apps have been shown to fail.

Google is free to allow or deny anyone access to their proprietary app suite for Google-logo Android handsets whether they are consistent or arbitrary about it. I'm merely pointing out that that some OEMs, like Huawei and Haier, get away with building both Google-logo Android handsets AND Aliyun handsets, while others do not.

Like many Linux-based products in China, there are other things that are wrong with Aliyun in addition to dubious app market practices. It doesn't observe open source licenses, for one thing. But Aliyun being "bad" isn't the point.

I am just pointing out that Google is usually, _but not always,_ consistent about enforcing a policy that Android OEMs can't participate in AOSP-based products that compete with the Google ecosystem. In some cases the OEM relationship appears to be more important than a consistent policy, or perhaps licensing regulations differ in the PRC.

</comment></comment></comment></comment></comment><comment><USER8> One of the things I love about Android is that you _can_ do this with it, if you so wish.

You can't build a Truly Free Version of Windows Phone. You can't build a Truly Free Version of iPhone.

But if Android doesn't do what you want, then you can fork it, tweak it, and turn it into something that does!

<comment><USER9> If it happens that the music player, dialer, home screen, messaging app are all closed source Google apps (just like now, or will be in a while), then what? You can create a non-google experience aosp build (meh..) or tweak the filesystem caching parameters or something like that at best.

I think Google is doing what's best for Android, but Android is not open source anymore.

Firefox OS might be a better choice for open source comminity to spend time on. I haven't been following latest development, how's the hardware situation on FF OS?

<comment><USER10> The music player, the messaging app, the home screen ... these are not part of the operating system and are easily replaceable.

I actually have an older phone (a first-gen Galaxy S) on which I installed Cyanogenmod without Google's services, which is basically stock Android. In spite of opinions to the contrary, the phone is quite usable without any of Google's services on it.

I've got Firefox for web browsing, OsmAnd for maps, Apollo for playing music. All 3 are open-source apps. At some point I even installed Amazon's App Store on it, to be able to get some proprietary apps, like Facebook, installed. But then I realized I don't need all that bloatware, as the web versions work fine.

You should try out this experiment if you've got an extra Android lying around. After you find apps suitable for whatever it is you want to do, it really is OK. The level of polish is not the same as with the Google-enabled Android, but it's still much, much better than the experience you get on low- budget non-Android smartphones.

People forget that Amazon already forked Android and that without Android they wouldn't have been able to deliver Kindle Fire. That's the power of open- source, even if you choose to deny it.

<comment><USER11> Looking at this strictly from a user (not developer) POV, I searched for some of the apps you mentioned. OsmAnd looks positively terrible from a UI/UX perspective, and seems borderline unreadable[0].

I'm actually curious as to why F/OSS applications that aren't extremely high profile or commercially backed (Firefox) seemingly tend to have UI/X as what is probably the last possible priority ever.

[0] [http://osmand.net/en/screenshots- menu.html](http://osmand.net/en/screenshots-menu.html)

<comment><USER12> _OsmAnd looks positively terrible from a UI /UX perspective, and seems borderline unreadable_

Yes, the renderer needs some work both in terms of prettiness and speed. It's not as polished as Google Maps, but it's definitely usable. That the map data is from OSM is a feature by itself, OSM maps are often more detailed than what you get from Google, and you can download all data, which is great for traveling. It even supports navigation.

</comment></comment></comment></comment></comment><comment><USER13> Radio (cellular) drivers are notoriously closed source and proprietary. Looks like they're reverse engineering the existing radio drivers and re- implementing them as open source[1]! Thats very interesting.

They don't describe how they're doing the reverse-engineering though.

[1] [http://redmine.replicant.us/projects/replicant/wiki/Libsamsu...](http://redmine.replicant.us/projects/replicant/wiki/Libsamsung- ipc)

</comment><comment><USER14> Unfortunately Replicant does not run on my phone. When time comes to purchase a new one, I will probably get a compatible one. Most of the apps I use already come from the F-Droid repository [https://f-droid.org/repository/browse/](https://f-droid.org/repository/browse/) as there is a lot of fantastic software available there.

I don't like it when threads end up as list of lists but some recommendations that might not be well known:

 _Aard_ is a offline wiki(pedia and others) reader. _AFWall+_ is a firewall to give/revoke internet access to apps. It is a fork of DroidWall which went inactive. _Document Viewer_ is the best PDF reader I know and it's free software, hooray. It can automatically cut off white margins, you can set your own touch controls etc. _Gibberbot_ is a great XMPP client. I tested many but this one did not randomly stop receiving messages like all the others did. _GnuCash_ for keeping track of finances. _Mirakel_ is a Todo app which I switched from Astrid to. Astrid is free software too but relies on several non-free libraries from what I know. Mirakel seems more concerned with privacy. _OsmAnd_ for offline maps. And of course you can get APG, AdAway, ConnectBot, FBReader, K-9 Mail, ScummVM, Terminal Emulator etc. from F-Droid.

<comment><USER15> With the Nexus 5 out, the 4 might drop in price and make for a good "play with Ubuntu phone" phone :)

[https://wiki.ubuntu.com/Touch/Install](https://wiki.ubuntu.com/Touch/Install)

<comment><USER16> Really BAD: has too much proprietary things and the hardware is bad for freedom: modem transport is over HSIC (high speed USB), but it controls the GPS (included in the modem chip), audio and perhaps NAND too

[http://redmine.replicant.us/projects/replicant/wiki/TargetsE...](http://redmine.replicant.us/projects/replicant/wiki/TargetsEvaluation)

<comment><USER17> Looks like you want a Galaxy Nexus or a Samsung SOC S1-S3.

</comment></comment></comment></comment><comment><USER18> There is one more dimension: surveillance and security. Closed source phone could have spyware. It also does not get security updates just 6 months after release.

I simply want some basic privacy and phone which lasts more than 2 years. Commercial vendors failed here, perhaps OSS will deliver.

<comment><USER19> Will OSS also deliver cell towers? Otherwise the talk about privacy does not make much sense.

<comment><USER10> OSS can deliver good encryption solutions and can greatly enhance security.

No solution is perfect, but if you read the trail of Snowden-branded leaks and the opinions of security experts, the greatest weapon that the NSA possess are the vulnerabilities and backdoors planted on people's own devices. Plus, NSA is not the only enemy, or the enemy most of us should fear, but rather organized crime syndicates or business competitors, which for many of us are much more immediate threats.

You're making the mistake of thinking that just because all security solutions are imperfect, they are somehow equal. You're wrong!

</comment></comment></comment><comment><USER20> The critical path for free software runs through open sourced hardware specifications. Otherwise, a.project like replicant can never hit enough of the moving target to gain the critical mass needed to take off.

<comment><USER21> If the few pieces of hardware drivers, that still remain proprietary, are reverse engineered, then everything will be fine for a sustained prominence of Replicant/Free Android.

<comment><USER22> Sustained only for as long as hardware it is running on can be bought. In practice, it will be replaced with new hardware with new proprietary drivers really soon, making additional reverse engineering necessary.

</comment></comment></comment><comment><USER23> Replicant's maintainers have a real attitude problem imho [http://redmine.replicant.us/issues/669](http://redmine.replicant.us/issues/669)

</comment><comment><USER24> I wish this would become become big. Something I wonder about the closed hardware drivers.. I am sorry, no hardware hacker, but what I always wonder is whether or not something like ReNouveau for Nvidia Graphics Cards would also be helpful to such projects. They did a really great job at reverse engineering and writing nice drivers. I think there would be lots of people running something like that, even when they don't use Replicant, but would love to support them.

<comment><USER10> About Nouveau, on a 2 years old laptop I have with an Nvidia card, I always had problems with Ubuntu and Nvidia's proprietary drivers, up to the point that I got so sick of it as to buy a new laptop without an Nvidia card on it. But then I tried out the Nouveau drivers and oh my, the problems vanished. The Nouveau drivers are right now better than the official drivers for some Nvidia cards. And they'll never vanish, even if Nvidia decides to drop support for older GeForce cards.

<comment><USER25> On my 2-3yr old laptop w/ a 8600GT, I agree that for 2D only X11 apps, Nouveau drivers seem to have less issues with tearing and drawing than the proprietary drivers. But once you want to need power management to run on battery, play games, or watch HD videos, the Nouveau are buggy, glitchy, and useless.

I have an extensive Steam library and while most of the Linux games work fine with proprietary, they are unplayable with Nouveau. I really hope Valve's commitment to Linux motivates Nvidia to put some resources into their open source drivers like AMD and Intel have done. If Nouveau was my only option under Linux, I'd switch to Windows.

Even for non-gammers, how can you seriously recommend laptop drivers that don't offer critical features like power management and video out?

</comment></comment></comment><comment><USER26> > But CyanogenMOD gets around the restrictions placed on redistributing > Google's apps and other proprietary code by backing up the original copies > from a user's phone before installing the replacement operating system.

Do they?

My understanding was, that they come with some stuff that's released by google as closed source + the gapps package.

<comment><USER27> That used to be the case but Google got their lawyers to send a Cease and Desist to CyanogenMod: [http://www.androidcentral.com/google-sends-cease- desist-orde...](http://www.androidcentral.com/google-sends-cease-desist-order- cyanogenmod)

<comment><USER26> No, I'm talking about "backing up the original copies from a user's phone".

<comment><USER28> That, actually, was where it started, and where, philosophically it still rests today. In practise, people now just blow away their original gapps and download a separately created gapps package from some free download service and flash it. But in theory, they could have (legally) extracted all the apps from their own phone, saved them, then flashed them back on again themselves. This theoretical possibility is what keeps people using gapps with custom ROMs (just barely) on the legal side of the thin line dividing fair use and outright copyright infringement.

</comment></comment></comment></comment><comment><USER29> What I'd rather see is more work put into Meego/Sailfish or Firefox OS. Maybe introduce a native app layer for Firefox OS, that would be pretty sweet. I'd add Ubuntu Phone here too, except it runs like shit and is pretty much useless at the moment. Firefox OS is already way more polished...

As for Android, I don't think the chip vendors are too interesting in opening up their drivers, and it's not like Google will ever open up their services (and why would they?). Pretty much everything in Android that doesn't hook up directly to Google is already open anyway...

</comment><comment><USER30> This project is dead on arrival. You cannot build solid structures on moving ground. We need open hardware/parts/DIY kits easily accessible first.

<comment><USER31> Linux (and other open OS's) have had to fight this from the very beginning. It may seem DOA now, but then Linux did too for a lot of people.

And while we still need the occasional closed source firmware blob or driver, there are now also systems where we can replace every little bit from the BIOS upwards with open alternatives.

In the mobile space, RockChip has released sufficient source to allow Ubuntu to be ported to the RK3188 CPU's (quad core Cortex A9), so there's movement. Given that RockChip is one of 3 CPU providers dominating the Chinese Android devices, if this helps their market share you can expect MTK and AllWinner (the two other main CPU providers) to be more open too.

That does not mean these systems are open - a lot of pieces still will be locked down often because they license GPU's etc. and don't have the rights to open up everything, but several of the Chinese/Taiwanese manufacturers in fact do seem to want to make custom builds available (not least because a _lot_ of these devices ship as XBMC devices - many distributors now ship with XBMC by default, and at least one offers to flash their Android sticks with plain Linux + Linux version of XBMC instead of Android)

</comment></comment><comment><USER32> I feel like history, and unfortunately mistakes, are repeating themselves. I love *nix'ed based OSes but the developers on those platforms are all self serving. This includes the developers that claim to make a version that is going to be "Truly Open/Free". These developers are coming in with pure intentions but once they hit roadblocks, their sentiment will change.

With current Linux distros, you have 3 major roots: Debian, Slackware and Redhat. From those, 100's of children have spawned which fragments the community, creates factions, divides, conquers and creates this "crab in a bucket" mentality. Meanwhile Microsoft or Apple come along with one vision and just clean up the market. What I want to see, and what I think would work, is Google championing this effort in trying to make a truly free version of Android.

</comment><comment><USER33> I'd love to use something like this. But so far that's not going to happen (and it seems it won't ever be possible).

Ignoring the fact that most devices I'd like to put this on (I have some old handsets, I'd like to put this on my wife's phone etc.) aren't supported - that's fixable - I'm unable to accept a mobile OS without Wifi support.

And I have a hard time thinking of a solution to this problem. I'd love to hear something different, would be grateful if someone could prove me wrong, but I'm really pessimistic that this will change..

All the other tradeoffs are fine. Camera, GPS - not an issue. But data connectivity and Wifi are the basic requirements to use my devices.

</comment><comment><USER29> Another thing that needs to be said, is that the existence of proprietary software on Android doesn't make Android any less 'free'. Just like the existence of proprietary software like Chrome, Flash, Steam, etc... doesn't make my openSUSE system any less free...

</comment><comment><USER34> So if I want to run this today and get the best experience, what phone should I buy?

</comment><comment><USER35> I wish the talented team behind Replicant would choose to put their energy toward something that will actually be useful, because as it stands right now, Replicant is guaranteed to never go anywhere.

The main problem with Replicant is that it's solving a problem that users don't have. Ask any phone user (any, not just Android) if they care whether their phone is running on free software and either they will have no idea what you're talking about or they will tell you "Not really, I just want my phone to work".

The Replicant team (like the FSF) is trying to solve a problem that only they have.

Naïveté about how the world works is only cute for so long.

</comment><comment><USER36> Great! That should keep Ubuntu/Mark Shuttleworth honest, in the mobile space.

</comment><comment><USER37> A standardized open android just means easier rooting by hardware. No, you don't want to write to that location, mr. software, how about I link you a dialog about violating your EULA instead?</comment>


The Rise of the "Second Internet" and What It Means: Tech News and Analysis « - <AUTHOR> http://gigaom.com/2011/03/31/the-rise-of-the-second-internet-and-what-it-means/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+OmMalik+%28GigaOM%3A+Tech%29 <comment><USER2> The "Second Internet" sounds suspiciously like "Web 2.0".</comment>


89,094% Traffic Increase: Data on the Slashdot / Digg Effect - <AUTHOR> http://themetricsystem.rjmetrics.com/2008/11/12/89094-traffic-increase-data-on-the-slashdot-digg-effect/ <comment><USER2> Two things that I wouldn't mention _except_ that the source is a metrics company, and so these fine distinctions may be worth considering...

() when reporting an 890x rise in traffic, precision to the percentile ("89,09_ _4_ _%") is a bit silly. Hell, I'd just round up to 900x.

() the very idea of reporting the increase as a percentage or multiple is suspect; the peak traffic is not a function of the earlier traffic. Rather, it's an absolute spike based on keen interest in the article topic, and the arbitrary multiple tells us more about how small the pre-spike traffic was than the size of the slashdot/digg effect. The real number of interest is the absolute value: ~110K page views over the peak 3 days.

</comment><comment><USER3> Yep, that matches up with my experience when my blog got slashdotted and dugg and all that.

The thing they don't know yet is they'll get a good 2-800 daily hits from the residual effects of being linked by so many other sites, many months in the future.

</comment><comment><USER4> Traffic sharkfins aren't something to be proud of, really.

<comment><USER5> explain. It's better than a sharp stick in the eye, right?

<comment><AUTHOR> Agreed. I think it's unrealistic to hope that level of traffic from the first 2 days of being on slashdot and digg would continue. And it's clearly a good thing that our new company blog got lots of exposure. So I'd greatly prefer a sharkfin to a flatline. Especially since, as swombat suggested, we have been getting residual traffic as well.</comment></comment></comment>


Cold fusion reactor verified by third-party researchers (2014) - <AUTHOR> http://www.extremetech.com/extreme/191754-cold-fusion-reactor-verified-by-third-party-researchers-seems-to-have-1-million-times-the-energy-density-of-gasoline <comment><USER2> I will be as happy as anyone if this works, but the E-Cat seems to break a lot of physical laws. Specifically, the Coulomb barrier to the nickel-hydrogen fusion reaction is so high that it barely occurs even in the center of the Sun. Also, a successful fusion reaction should have produced measurable gamma rays, which have not been observed AFAIK.

[http://scienceblogs.com/startswithabang/2011/12/05/the- nucle...](http://scienceblogs.com/startswithabang/2011/12/05/the-nuclear- physics-of-why-we/)

</comment><comment><USER3> Great news! Now reproduce it again, independently, in more labs.

Sidenote re: the photo: would one expect the device here to be in some sort of insulated box? Or are the cameras sufficient to do all the accounting?

</comment><comment><USER4> can we please stop hoping for rossi? he'll never deliver

Mr Rossi theme tune: [https://www.youtube.com/watch?v=fw26fLW_gg4](https://www.youtube.com/watch?v=fw26fLW_gg4)

just read the guys history: [https://en.wikipedia.org/wiki/Andrea_Rossi_(entrepreneur)](https://en.wikipedia.org/wiki/Andrea_Rossi_\(entrepreneur\))

</comment><comment><USER5> Please label [2014].</comment>


Recession Wipes Out Hardware Upstarts - <AUTHOR> http://bits.blogs.nytimes.com/2009/06/01/recession-wipes-out-hardware-upstarts/

<comment><USER2> Not so for my son's start up Caustic. :-) I guess it helps to think small.

<comment><USER3> <http://www.caustic.com/> ?

<comment><USER2> That's the one. He was one of the founders.</comment></comment></comment>


GinzaMetrics Gets Major Update, LaunchRock Co-Founder Sean McCullough In As CTO - <AUTHOR> http://techcrunch.com/2013/06/05/enterprise-seo-platform-ginzametrics-launches-major-update/

<comment><USER2> Love it. Awesome for Ray to get some extra support in the form of a CTO.</comment>


Will Industrial Automation Truly Take Our Jobs? [Good Read] - <AUTHOR> https://www.technewsinc.com/will-industrial-automation-take-jobs-230508/ <comment><USER2> "A thorough revision of the current education system is the only way to ride this tide."

Not really convinced by this. Sure education is a bit slow but it's never been easier to fill in the gaps yourself.</comment>


The British Perfected the Art of Brewing Tea Inside an Armored Vehicle - <AUTHOR> https://medium.com/war-is-boring/the-british-perfected-the-art-of-brewing-tea-inside-an-armored-vehicle-1cc012f3ee54 <comment><USER2> By the sounds of things, this isn't just for hot beverages. It's also used to heat ration packs. Having a proper, warm meal must help morale.

</comment><comment><USER3> Boiling water is a good way to make it safe to drink in dirty environments. If you have boiled water you might as well make tea.

<comment> bro-stick Exactly. As humans, we can our food and beverages because we are able to make them mostly safer by killing many potential pathogens.

A millenia ago, wine was one of the most popular beverages because it also fairly sterile... but you wouldn't want to use that in combat.

</comment></comment><comment><USER4> They have their priorities in order:

 _But tea-break culture posed a big problem for the generals in charge of Britain's armored formations. Tank crewmen had to stop and climb out of their vehicle in order to have a brew, making it difficult to safely sustain an armored advance._

<comment><USER5> It seems kind of ridiculous that it took that long to realize getting out of the armor left them open to attack. Did everyone have to take a break at the and time? 37% of casualties from soldiers outside of their armor. Really Brits? Really?

<comment><USER6> Tanks of the time where cramped and crews often had to be outside for other tasks, if you think about it it makes senses that casualties would be higher outside armoured vehicles since small arms fire would be effective, this wasn't just a British problem as the article implies.

<comment><USER7> As I understand it, they were a lot like early subs- spending most of the time cruising with all the hatches open, crew hanging out on top, only clambering inside, closing hatches, and diving when the enemy was spotted. Neither early subs nor early tanks could be lived in sealed up all day, and visibility was poor from inside to boot so scouting happened with hatches open..

<comment><USER6> Exactly that, they also carried supplies and fuel externally as their simply wasn't space internally.

They where much smaller than modern tanks and didn't have autoloaders so they where incredibly cramped.

Modern armoured warfare is largely a battle of logistics as keeping a tank in the field requires a huge amount of resources and manpower.

Comparison to submarines of the era is a good one, submarines have been one of my enduring fascinations especially WW1 and WW2.

<comment><USER7> One has only to look at tanks like the M3 Stuart with people around them:

[http://afvdb.50megs.com/usa/pics/m3stuart.jpg](http://afvdb.50megs.com/usa/pics/m3stuart.jpg)

It has a crew of 4. I believe you can see the driver & codriver through the viewports under the turret.

Then compare to an M1:

[http://www.cybermodeler.com/armor/m1/images/m1_002.jpg](http://www.cybermodeler.com/armor/m1/images/m1_002.jpg)

I wish I could find a photo of them side by side

<comment><USER6> Yup not to mention the modern stuff is climate controlled and has better ride quality all important for endurance especially when sealed up or in a NBC situation</comment></comment></comment></comment></comment></comment></comment>


Awesome Hacker News – A collection of awesome HN apps - <AUTHOR> https://github.com/cheeaun/awesome-hacker-news

<comment><USER2> No browser extensions for firefox?</comment>


Letter to Santa Kube - <AUTHOR> https://jpetazzo.github.io/2017/12/06/letter-to-santa-kube/ <comment><USER4> Somewhat off-topic, but as someone interested in k8s, why is it seemingly such a pain to set up in non-"cloud" environments? I know that Rancher exists - <USER2> I'm waiting for 2.0 to drop before migrating to Rancher-managed k8s - <USER3> beyond that the whole "ecosystem" of k8s seems pretty unfriendly to get started in without using AWS/GCE/Azure/etc (to the point of not being able to set up a cluster on bare metal at all!). Am I missing something here?

<comment><USER5> Depending on what you're looking for, if it's just an environment to play around with, minikube is a good option: [https://github.com/kubernetes/minikube](https://github.com/kubernetes/minikube)

And as another poster stated, kubeadm is a good way to get started on a VM or local system by following this guide: [https://kubernetes.io/docs/setup/independent/install- kubeadm...](https://kubernetes.io/docs/setup/independent/install-kubeadm/)

And last, possibly not what you're looking for but worth mentioning, there are commercial options available such as gravitational telekube which includes among other features a way to consistently install kubernetes amongst different environments and providers [https://gravitational.com/telekube/](https://gravitational.com/telekube/). *Please be aware though that I'm affiliated with gravitational and work on telekube

<comment><USER4> I use minikube locally for developing on, but so far I've not been able to get a production k8s cluster up. As I replied to the other poster, the last time I tried kubeadm, I was completely unable to get past setting up a cluster network, at best. This was some time ago, so I do want to spend time to try again soon, but so far my experience has been pretty negative.

telekube looks pretty interesting, but sadly I don't have the money for any commercial offerings; side-projects can be a pain like that.

<comment><USER6> I had some trouble setting up networking the first time, IMHO weave should be higher up in the suggested CNI plugins.

Since I started using weave-net, I have never had to think about it again. An example of one of those really great tools that just gets out of your way and does exactly what it's supposed to do.

My cluster is one node only but it was bootstrapped with kubeadm, and has served me well since 1.5.2. I've never heard of anyone having trouble with the Weave networking. I use my (production kube instance) as a Jenkins server with my own chart that is derived from the Jenkins helm chart, with kubernetes- plugin for slave scheduling.

</comment></comment></comment></comment><comment><USER7> As a relatively new Kubernetes user, the big thing on my wishlist is templates (for example so I can share YAML between my production and staging environments). Unfortunately the k8s team have already said "no" to that, and point to a list of alternatives. But without a simple solution that lots of people use, it's hard to know which one to pick and it doesn't look like any are particularly good. I took a quick look at a bunch of them and they seem to be either half-baked solutions that someone put up on GitHub, or tools that introduce way more complexity than I need right now (like Helm).

<comment><USER8> Helm is a lot simpler than it looks, and it's awesome.

I also had this exact perspective, not wanting to introduce more complexity and therefore held off on Helm for a long time. But then I got comfortable enough with Kubertnes and also my project got complex enough that I needed templating and then Helm was great to pick up.

I just use one chart that I wrote for my application and I don't mess around with repositories. I render the chart locally with helm template[0] to build my containers on Google Cloud container builder[1]. Then I deploy with helm upgrade. It's a great flow!

[0][https://github.com/technosophos/helm- template](https://github.com/technosophos/helm-template)

[1][https://github.com/dminkovsky/kube-cloud- build](https://github.com/dminkovsky/kube-cloud-build)

<comment><USER9> I've really confused by Helm. From their github repo Helm bills itself as:

"The Kubernetes package manager."

Then it goes on to state:

"Helm is a tool for managing Kubernetes charts."

Then reading further I see:

"Charts are packages of pre-configured Kubernetes resources."

I find this extremely confusing. Also its my understanding that unit of deploy in K8 is a pod which is built on Docker containers. Isn't installing packages into running containers considered an anti-pattern?

Could someone give a better explanation of Helm/Charts and when someone might use it?

<comment><USER8> Yeah it's not the best docs. But the tool is great.

Helm just renders a bunch of templates of kubernetes manifests against a values file. It then takes the resulting manifests, compares them to what's running on your cluster and makes sure nothing less or more is running. That's it. What's nice about it is that you can then change the manifest templates or values files, and when you install the updated result, you have a single concrete new state that your entire application is in. Which makes it easy to version your entire application, whether you changed just one env var in one manifest or made many changes thoughout.

There's a package manager component but you can skip that completely and imo it's just confusing that they lead front and center with that component.

The essential commands are helm ls and helm upgrade. And helm rollback is nice too.

<comment><USER9> Thank you for this. This is helpful.

So its kind of like configuration management for your manifests then? Would that also be an accurate analogy?

<comment><USER10> Similar. The reason they say "package manager" rather than "configuration management" for your manifests is because it's actually much more about packaging than it is config management.

The chart packaging format and template language don't allow you to easily encapsulate or abstract away your dependent charts, it's really just a simple package which you can use as-is, but not really possible "tweak" or "extend" charts without forking them. Contrasted this to a CM system which typically make it possible to build new modules/cookbooks/recipes/whatever on top of others, with the possibility to hide away the details of the underlying module/recipe/etc.

It's really just tarballs with yaml templates and a way to specify values for the templates.

<comment><USER8> I have yet to appreciate with the whole tarball/package thing.

My application is 5-6 deployments, a 3 statefulset and a cron job. I have it all in one chart that I keep unpackaged on in a directory. The workflow is (i) update the templates/values, (ii) ensure necessary containers live on GCR, `helm upgrade` my application. And that's it.

I've yet to find a need for breaking this single chart into multiple charts with dependencies. Maybe once it gets much, much bigger? I also don't like the idea of pulling in third party charts as dependencies, even if they're public from github. This last point is probably irrational and me-specific, but something about it is less appealing than just copy/pasting the manifests I want into my project. So much more direct.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> To tail logs, you can use my tool, ktail: [https://github.com/atombender/ktail](https://github.com/atombender/ktail)

It's designed to be user friendly. For example, you can type "ktail foo", and it will match any pod containing the string "foo". (If you don't give it any filters, it will tail absolutely everything!)

Homebrew:

        brew tap atombender/ktail && \
        brew install atombender/ktail/ktail

</comment><comment><USER12> Regarding logs, I found this quite useful: [https://github.com/johanhaleby/kubetail](https://github.com/johanhaleby/kubetail)

</comment><comment><USER8> I've always assumed there must be some really solid reason you can't natively stream logs from multiple pods at the same time. Does anyone know what that is?

<comment><USER13> There isn't one, it's just not built in.

I added it as a feature to my package kubert[0] but that needs a little love/work I haven't had time or motivation to do recently, and there's upstream work in Kubeclient needed to make it work with GKE (when I started work was doing kube on AWS but since moved to GKE, and helm instead of ky for templating/deploy). But I really wish there was a fairly cnanonical tool a bit like this but working with helm and more or less adaptable or most kube deployments, maybe via a few adapters or something. If anyone knows of one, or wants to help to turn kubert into that, let me know.

[0] [https://github.com/stellaservice/kubert](https://github.com/stellaservice/kubert)</comment></comment>


Fighting Cargo Cult – An Incomplete SSL/TLS Bookmark Collection - <AUTHOR> https://daniel.molkentin.net/2014/04/21/fighting-cargo-cult-the-incomplete-ssltls-bookmark-collection/ <comment><USER2> With the rise of the cloud, now everybody manages a server. I am curious about how many of the admins actually know what are they doing. If I have to speak for myself, I set up my first ssl by following a guide that seemed to written by reasonably well informed stranger. It was my first exposure to the topic so I could not tell what I am doing until I break things and start reading deeper materials so that I can debug the problems by understanding what's going on. Turns out that the stranger who wrote the tutorial I followed was not well informed at all.

<comment><AUTHOR> Yes, that's the exact problem that made me write this. What's particularly amazing is the amount of magical cipher suite strings shared throughout the web, most of which do not take in account PFS, or still prioritize RC4. All of that was acceptable at some point in time. Other cipher lists just don't make any sense at all, e.g. first removing a cipher (-RC4), then killing it (!RC4), all in one string with no benefit at all.

<comment><USER3> Thanks for writing this post, I've bookmarked it for reading later as it has plenty of links and I can see I have a lot more reading to do.

If you edit or update your post, I hope you will Mozilla's excellent "Security/Server Side TLS" page at [https://wiki.mozilla.org/Security/Server_Side_TLS](https://wiki.mozilla.org/Security/Server_Side_TLS). This helped me get up to speed quickly and provided clear examples.

As proof of how good the Mozilla docs are, I tested my personal website using the Qualys test you mention and received an A+ rating!

This beat the A- rating for your site (though I freely admit I'm a total noob in this area - I'm copy/pasting and don't understand much about SSL). I guess this reinforces your point that good documentation is critical, and I hope more people find it at the Mozilla site.

[https://www.ssllabs.com/ssltest/analyze.html?d=tombrossman.c...](https://www.ssllabs.com/ssltest/analyze.html?d=tombrossman.com)

[https://www.ssllabs.com/ssltest/analyze.html?d=daniel.molken...](https://www.ssllabs.com/ssltest/analyze.html?d=daniel.molkentin.net)

<comment><USER4> Author of the Mozilla's Server Side TLS here. Glad that you found it helpful. Anything else that you think we should add to it?

<comment><AUTHOR> Second-to-best solutions with older Distributions (Ubuntu 12.04, Debian 7, RHEL 6).

</comment></comment></comment></comment></comment><comment><USER5> Okay, I understand what he means about cargo culting, and that to really make your server secure you have to actually know what you're doing.

But okay, let's be realistic here. Let s look at the real thing that just happened to me.

I went and used the awesome tester at ssllabs.com that OP recommends.

It told me that my server doesn't support newer cipher protocols that it should support, and that it doesn't support forward secrecy.

So, okay, I start googling on how to fix this. It looks like supporting forward secrecy is also an issue of cipher protocols, if I support the proper cipher protocols I'll support forward secrecy.

Okay, how am I going to figure out which cipher protocols to configure as supported in apache? I'm to google and copy and paste someone elses apache configuration. That is, I'm going to cargo cult it.

What else is possibly realistic for me to do? How many hours would it take for me to actually understand myself which ciphers are secure, which are preferred, and why? Not just how many hours would it take now, but how many _continual_ hours to keep up with developments?

We all can't be experts at this level in this area -- that level of expertise in security is pretty much a role all by itself. And we can't all even have such experts on staff. We've _got_ to rely on external experts, anything else is unrealistic.

Call that 'cargo culting' all you want, but what I need is an expert to tell me what my apache config should be -- sure I'm going to read up to get enough background to basically understand what they're talking about, but there's no way I'm going to become enough of an expert to make this determination on my own.

No?

Many use apache httpd. Seems to me apache httpd should ship with proper SSL configuration, and apache httpd team should provide notification channels for people to change configuration on their already-installed apache when best practices change. Figuring this out can't be a task for each individual 'customer', for basic use cases and routine needs, it should be the task of the 'vendor', no?

<comment><USER6> This is yet another manifestation of the dark side of open source movement: the expectation that the generosity of the few must always support the comfort of the many. More than once I have commented that the only missing feature of GPL is that all free software must be distributed in source code, and compiled/build from scratch in every system it is to be deployed. Binary distribution requires a parallel form of licensing with appropriate fees/royalties.

Your case would be easily be solved if you were willing to pay an expert provider for their know how in implementing this types of solution. This solves reasonably well the problem of reliability (customer is unable to tell a lemon from the real thing, but is at least able to demand a refund or sue in case of breach of contract from the part of the provider).

This does not have to be expensive either. For a couple USD$100's you could have access to standard configurations, designed to meet the common needs of most customers. Or you can pay premium (a.k.a. consulting) fees to have a tailor made solution made for your particular needs.

<comment><USER5> Well, I don't need to pay $200, I can also Google around for standard configurations designed to meet the common needs of most customers -- plenty of people are more than happy to share all sorts of info on proper SSL configuration for free. As for instance, the OP.

But if I just find a configuration online and use it, am I 'cargo culting' as the OP warns me against? But then, am I doing the same thing if I pay someone for it instead of finding it online for free, am I still just 'cargo culting'? $200 or not, I'm still just taking what someone else gives me and plugging it in. I guess in either case it depends on who I get it from, and how I am deciding their reliability.

I don't think it's the 'dark side of open source' to suggest that apache would be doing a service to it's users by providing out-of-the-box config that's actually secure. I realize they don't 'owe' it to me, as they 'owe' me nothing at all, including continuing to provide httpd at all. But let's say httpd was completely _unstable_ out of the box, crashing all the time, unless you used expert knowledge to configure it to be stable, possibly by paying an expert $200. Would it be the 'dark side of open source' to suggest that made it less high-quality software than it could be, that to be quality software it needs to be stable for most common use cases out of the box?

In 2014, I think expecting software that supports SSL to be actually secure out of the box for, as you say, 'common needs of most customers', is just the same as expecting it to be reasonably stable. Doesn't mean it will be, doesn't mean the open source developers 'owe' us anything, but users making their expectations and priorities clear is part of what influences developer priorities too.

But you know what, yeah, I'm going to go there, if in 2014 you are supplying software to users (whether open source or not, whether free-as-in-beer or not) that supports TLS/SSL, or any other crypo, then you _do_ have some responsibility to supply actually secure software, or you are doing a disservice to your users (whether or not they are paying you) and to the internet at large. I don't think this is actually a very controversial statement. Nobody has to supply crypto software, open source or proprietary, for free or for $. But if you are, then, yeah, you have some responsibilities to do it right. We can certainly disagree on what 'do it right' means, but few would disagree with the basic sentiment.

</comment></comment></comment><comment><USER7> I don't think this article is really helpful at all. The author attacks blog posts that state the current best-practices, but then goes on to recommend several books that are even more out of date than the blog posts. (Some of the books are 'theory' books and so presumably remain 'current' for longer, but not all of them).

Second, instead of allowing sysadmins to find and follow simple, well- researched best-practices, the author instead wants each person to thoroughly research the annals of cryptography in order to then come to their 'own' conclusion. Most sysadmins won't do this. Or they will miss something or make rookie mistakes (this why you're always told not to roll your own cryptography). To put it another way: "you should not roll your own choices about which cryptography to use".

So for the other 99% who just need to get it right and move on: find the __current __best practices from a reputable source (like Qualys) and use those.

<comment><AUTHOR> >The author attacks blog posts that state the current best-practices

No, I'm attacking the fact that people blingly follow blog posts that have been, at some point, what their author believed were best practices.

> But then goes on to recommend several books that are even more out of date > than the blog posts.</cite>

Which is fine, as long as they are read for what they are supposed to be: Either introductions or specializing on a specific topic. I wouldn't have chosen them otherwise.

> Second, instead of allowing sysadmins to find and follow simple, well- > researched best-practices, the author instead wants each person to > thoroughly research the annals of cryptography in order to then come to > their 'own' conclusion

It is up to your own self-conception as a sysadmin as to how deep you want to dive. When interviewing (non-junior grade) sysadmins, I challenge them on security knowledge just as much as other skills. And I know I'm not alone with that. A certain degree of security awareness is not a "nice to have" typoe additional skill. It's vital for everyone that has machines connected to the internet. How far he/she can dive is solely limited by the economics and time constrains. Which is why sensible defaults are needed from vendors and distros (see my other response).

> Most sysadmins won't do this.

Which is a real problem, and again, there should be some effort remedying this, but currently there isn't. That's why I plea to sit down and at least learn about the basics. What "the basics" are obviously depends greatly on your educational background, but if AES, RC4 and PFS do not ring a bell, and you are a professional sysadmin who runs SSL-secured web servers, you are not worth your money.

> (this why you're always told not to roll your own cryptography)

Nobody said anything about rolling your own cryptography. But if you at least have read one of Ivan's books, you can at least make a /qualified decision/ on how credible a config proposed in a "random blog post" is, without having to come up with the complete solution by yourself.

> find the current best practices from a reputable source (like Qualys) and > use those.

Which is ok -- if you run a small setup and you at least use SSLLabs to verify your setup. The more responsibility you have, and the more security is required, the more you should dive in and have a qualified opinion on how your SSL/TLS setup should look like.

</comment></comment><comment><USER8> Following incorrect guidelines is "cargo cult" now? Or are the guidelines themselves cargo cult? I'm confused.

<comment><USER9> All "cargo cult" means is that you're doing something associated with an outcome that you want, rather than understanding the mechanism by which what you're doing would lead to the desired outcome.

A common example: towns that have a lot of tourists have a lot of parking. Therefore if we tear down buildings to make more parking lots, we'll increase tourism!

I'm pretty sure that what 99.9% of developers (including me) are doing with SSL is cargo cult.

</comment></comment><comment><USER10> TLS 1.0 was created in 1999, and has approximately 97.7% website support worldwide. The only modern browser that doesn't support TLS 1.0 is IE6. Please, do the public a favor and remove the name "SSL" from your list.

Also, I get that you probably just found out what a cargo cult is, but there's really no purpose in telling people about the phrase; it doesn't help them stay more secure, and it's basically just pop psychology applied to technology. "Current guides for securing your TLS servers" would make a more accurate title.

<comment><AUTHOR> About the Cargo Cult thing: Fair enough. I'm not a native speaker myself, but thought that it may be a well-enough-known idiom.

Anyway, SSL is still what people know it under (plus, according to Wikipedia, TLS support was only added in Java 7, and there are still many Java 6 setups around which have to put up with SSL 3). So I'll stick with SSL/TLS for the time being.

<comment><USER11> Re: "Cargo Cult" as a well-enough-known idiom:

It's basically a shibboleth for "Are you a fan of Richard Feynman". I doubt very many people have actually heard of it directly, but his "Cargo Cult Science" commencement address ([http://neurotheory.columbia.edu/~ken/cargo_cult.html](http://neurotheory.columbia.edu/~ken/cargo_cult.html)) is moderately famous.

</comment></comment></comment><comment><USER12> I have no idea what I am doing. Is my Digital Ocean - Default Ubuntu based server safe? I know I login via the shell using ssh from my OS-X and DO does not administrate the droplet I guess. Any advice on where I can educate myself?

<comment><USER13> We have a couple of resources to help you with that in our community:

[https://www.digitalocean.com/community/questions/how-do- you-...](https://www.digitalocean.com/community/questions/how-do-you-secure- your-new-server)

[https://digitalocean.com/community/tags/security](https://digitalocean.com/community/tags/security)

Thanks! Moisey Cofounder DigitalOcean</comment></comment>


Ask HN: Steps for securing and configuring a new VPS? - <AUTHOR>

I have been reading a lot about the necessary steps to take to prepare a secure and comfortable VPS LAMP site hosting environment from linode or digitalocean.
Google is full of articles and posts with recommended checklists but wondering if HN had a list or a resource a majority would agree on...
Some of the initial findings were the following:
1) Set up login with SSH keys for convenience
2) Update everything with sudo apt-get update
3) Change SSH port to 4437 or something like that
4) Install HTOP instead of TOP
5) Configure PHP to run as CGI with CGIWRAP (for security)
-- I am sure there are a dozen more steps we all take after provisioning a server - anybody have further suggestions or posts with good lists?
(EDIT: for markup) <comment><USER2> thread: [https://news.ycombinator.com/item?id=4618808](https://news.ycombinator.com/item?id=4618808)</comment>


Why Python uses 0-based indexing. It's because of slices  - <AUTHOR> https://plus.google.com/115212051037621986145/posts/YTUxbXYZyfi <comment><USER2> As Guido says, 1-based indexes basically force closed ranges, so that [1, length] is the full array.

One thing that annoys me about closed ranges (and it's not much talked about) is that it is impossible to express the empty range: in python [i:i] is an empty range, while closed ranges always contain at least one element. That makes closed ranges _strictly_ less expressive than half-open ranges, making often necessary to write special cases for zero-length.

For example when you want to split an array or a string at a given position i, the partitions will always be a[:i] and a[i:] _even if one of the two is empty_.

The other big issue, as many comment, is that the arithmetic to index multi- dimensional arrays is cumbersome with 1-based indexing: for example if I is a 2d image in row-major, the element (x, y) is at position I[(y - 1) * width + x] instead of I[y * width + x]. It's very easy to do off-by-one errors this way.

EDIT: adding this just to try some ASCII art :)

I think that the preference about 0-based and 1-based indexing boils down to how you reason about indexes.

I (0-indexing) think of them as the following:

          |-|-|-|...|-|
          ^           ^
        first   past-the-end
       position

that is, the index is _where the element begins_. This way there is a special endpoint, the "past-the-end", where the an appended element would begin. In particular, an empty array has both first and last endpoint equal to 0.

I believe that people who favor 1-based indexing think like this

          |-|-|-|...|-|
           ^         ^
        first      last
       element    element

that is, in the _ordinal_ way, i is the i-th element.

<comment><USER3> Indeed, you hit the nail on the head. Or more to the point, on the infinitely thin edges _between_ the nailheads.

The first time I saw this explained clearly was in the original Inside Macintosh, describing the QuickDraw coordinate plane. Some excerpts (with emphasis added to a few key concepts):

# # #

The Coordinate Plane

All information about location or movement is given to QuickDraw in terms of coordinates on a plane. The coordinate plane is a two-dimensional grid, as illustrated in Figure 2.

Note the following features of the QuickDraw coordinate plane:

• All grid coordinates are integers (in the range -32767 to 32767).

• _All grid lines are infinitely thin._

These concepts are important. First, they mean that the QuickDraw plane is finite, not infinite (although it's very large). Second, they mean that all elements represented on the coordinate plane are mathematically pure. Mathematical calculations using integer arithmetic will produce intuitively correct results. _If you keep in mind that grid lines are infinitely thin, you 'll never have "endpoint paranoia"—the confusion that results from not knowing whether that last dot is included in the line._

Points

There are 4,294,836,224 unique points on the coordinate plane. Each point is at the intersection of a horizontal grid line and a vertical grid line. _As the grid lines are infinitely thin, so a point is infinitely small._

Figure 3 shows the relationship between points, grid lines, and. pixels, the physical dots on the screen. ( _Pixels correspond to bits in memory_ , as described in the next section.)

Rectangles

Any two points can define the top left and bottom right corners of a rectangle. As these points are infinitely small, _the borders of the rectangle are infinitely thin_ (see Figure 4).

# # #

The full PDF is available here (or via a search for "Inside Macintosh"), and it's better with the illustrations:

[http://www.pagetable.com/?p=50](http://www.pagetable.com/?p=50)

The description of the QuickDraw coordinate plane is on pages 148-151 (I-138 to I-141).

Figure 3 is especially good. It shows how grid lines and points are infinitely thin/small, but _pixels occupy the space between the gridlines_.

Disclaimer and shameless plug: My friend Caroline Rose wrote Inside Macintosh, and she still writes. If you want someone who understands technical concepts and can explain them clearly, look her up.

<comment><USER4>
                    │        │
      grid lines ─→ │        │
             ╲      │  point │
              ↘     │↙       │
             ───────┼────────┼───────
                    │░░░░░░░░│
                    │░░░░░░░░│
                    │░░░░░───┼── pixel
                    │░░░░░░░░│
                    │░░░░░░░░│
             ───────┼────────┼───────
                    │        │
                    │        │
                    │        │
                    │        │
                    │        │

           Figure 3.  Points and Pixels

</comment></comment></comment><comment><USER5> There's a short article from Dijkstra on this reasoning:

[http://www.cs.utexas.edu/users/EWD/ewd08xx/EWD831.PDF](http://www.cs.utexas.edu/users/EWD/ewd08xx/EWD831.PDF)

He enumerates the four possible ways one could use, and goes on the pros and cos of each.

<comment><USER6> His handwriting should be a font

<comment><USER7> [http://www.fonts101.com/fonts/view/Uncategorized/34398/Dijks...](http://www.fonts101.com/fonts/view/Uncategorized/34398/Dijkstra.aspx)

<comment><USER8> I don't trust sites that ask you to download an .EXE downloader. If you go here you can download it as a .TTF file

[http://www.fontpalace.com/font- download/Dijkstra/](http://www.fontpalace.com/font-download/Dijkstra/)

<comment><USER9> The '1' in that font clearly differs from the one in [http://www.cs.utexas.edu/users/EWD/ewd08xx/EWD831.PDF](http://www.cs.utexas.edu/users/EWD/ewd08xx/EWD831.PDF)

<comment><USER10> The "w" as well.

</comment></comment></comment></comment></comment></comment><comment><USER11> The article linked from this plus page ([http://exple.tive.org/blarg/2013/10/22/citation- needed/](http://exple.tive.org/blarg/2013/10/22/citation-needed/)) poses the question "why do programmers start counting at zero?" and then shows contempt towards anyone who thinks they know the answer (while dismissing Dijkstra as "incoherent", without argument).

To the author, the correct way to answer this question is by investigating the history of how things happened to end up the way they are, which (apparently) no one besides him has ever done.

While history is interesting, I think the much more important question is: why _ought_ we to count from zero (or not)? And the answer to that question has nothing to do with history.

In addition to Dijkstra's argument, mentioned elsewhere in this thread, 0-based addressing is more efficient (since it can be used directly as an offset, without having to bias it first).

As much as I like Lua, its 1-based indexing is not my favorite part of that language. In particular, the numeric for loop is confusing, because the loop:

      for i=x,y do
        -- stuff
      end

...will execute (y-x+1) times, not (y-x) as it would in most languages, like Python:

      for i in range(x,y):
        # stuff

Off-by-one errors are some of the most annoying bugs. 0-based indexing and half-open ranges help avoid them in my experience.

<comment><USER12> There's another reason that I haven't see anyone bring up. If your native unsigned integer type is the same size as a word (which is common), and a word defines the limits of your address space, and if you have a byte pointer initialized to 0, then 0-based indexing allows you to index into every byte in your address space, whereas 1-based indexing prevents you from indexing the final byte in your address space.

Additionally, assuming an unsigned integer type is used for indexing, 0-based makes every index valid and meaningful, whereas 1-based leaves one index value (0) as invalid.

<comment><USER13> Having a null value that's invalid is a _good_ thing. Thanks for the novel argument in favor of 1-based indexing!

<comment><USER14> Erk, no it isn't. If your semantics require an optional value, then encode it that way explicitly. Don't inflict special cases and bugs on everyone else.

</comment></comment></comment></comment><comment><USER15> I've spent a lot of time in both domains, and the Python-style half-open interval is the clear winner, because it produces the fewest "+1" and "-1", _each and every one_ of which is _begging_ to be a bug. I disagree with Dijkstra on some other counts, but in this case he is correct, both in theory and in practice.

It's easier today than it used to be 1 indexed, though, because there are more languages that support some form of

        for element in collection: ...

instead of the _incredibly_ error-prone

        for (int i = 0; i < something; i++) { ... }

Or, was it

        for (int i = 0; i <= something; i++) { ... }

Or was it

        for (int i = 1; i <= something + 1; i++) { ...}

You have fewer places to make fencepost errors when you use the first style, so the costs of 1-based indexing are fewer. They're still higher than Python- style, though, because in Python you have both the correct for loop and still have the correct intervals.

<comment><USER16> When I started programming I quickly found that 0-based indexing was generally simpler. A lot of the time, it makes no difference one way or the other (because you're only using indexes to get at each item in turn, so you just memorize the boilerplate for whichever language you're using), but the moment you introduce ranges, or try to convert dimensionality - particularly with random access - or do some wraparound, or try to implement something like a ring buffer, it's all too easy to come a cropper. Either you put "1+" on every array access, which is error-prone, or you try to manage two different "spaces" (the 0-based one that's the ideal representation and the 1-based one used for indexing) and carefully convert between them... which is error-prone too.

Alternatively, you could just decide to start indexing at zero.

...or you could stick with 1-based indexing, it's up to you. The right thing to do doesn't become wrong just because you don't do it ;)

</comment></comment><comment><USER17> This is not meant to be tongue-in-cheek - I thought this argument was settled ages ago. Are there any respected languages that use 1 based indexing? This is an honest question - every single one I've ever used (C, C++, Java, Scala, Python, JS, Objective-C, a bunch of academic ones) have been zero based. It's quite clear that it's the right solution, since the first element of an array is zero distance away from the beginning of the array.

<comment><USER18> Matlab does (or at least it did when I used it for a class a few years ago). I was trying to iterate through some array for a project and kept hitting an error, and was totally stumped until some EE major came over and fixed it. "Haha did you forget how to count? You're starting the index at 0, that's the problem."

<comment><USER19> I had to use matlab the other day. It still starts at one. The first time I used it, that confused me too.

<comment><USER20> I've just started using Octave (for the coursera machine learning course) and it also starts at 1. Takes a few exercises to reaclimatise. More annoying is that it doesn't auto broadcast matrix operations like numpy does (and the slicing doesn't feel as powerful either).

</comment></comment></comment></comment><comment><USER21> Ah yes, but don't forget this is all changing in Python 4 :) -- remember the "List Revolution" thread when Guido finally agreed to switch to 1-based indexing...

      On Fri, Sep 9, 2011 at 2:12 PM, Christopher King <g.nius.ck at gmail.com> wrote:
      > The first element in a list is element zero, the second is one, the third it
      > two, and so on. This some times confuses newbies to the language or
      > programming in general. This system was invited when single bits where
      > precious. It's time to update. Keep in mind this is something for version 4,
      > since its not reverse compatible. I say we make the first element 1, second
      > 2, third 3, and so on. Other languages would follow. We are python, made for
      > easiness and readability, and we are in the age where you can't even get
      > something as small as a kilobyte USB. We must make first one, second 2, and
      > third 3, like it is supposed to be. I give this:
      > +1

      Consider it done.

      --
      --Guido van Rossum (python.org/~guido)

Source: [https://mail.python.org/pipermail/python- ideas/2011-Septembe...](https://mail.python.org/pipermail/python- ideas/2011-September/011448.html)

<comment><USER22> Funny thread, but just in case somebody takes it seriously:

        (And to those taking the thread seriously: this is all
        in jest. We won't change the indexing base. The idea
        is so preposterous that the only kind of response
        possible is to laugh with it.)

        --Guido

[https://mail.python.org/pipermail/python- ideas/2011-Septembe...](https://mail.python.org/pipermail/python- ideas/2011-September/011462.html)

</comment></comment><comment><USER23> I think ruby has it nailed better.

        a[1..10] # elements from 1 to 10, including 10
        a[1...10] # elements from 1 to 9; k...n is a half open range notation
        a[3, 5] # 5 elements, starting from position 3

Arrays are still zero based, but I feel this is more a homage to for- and while- loops from older languages.

(for (i = 0; i < n; i++) is just a very nice notation, and so is while (i < n))

<comment><USER24> From the perspective of someone who doesn't know Ruby, the fact that a[1..10] is _longer_ than a[1...10] is pretty counterintuitive.

<comment><USER23> p..q is a fairly common math notation synonymous with [p,q].

Although, p...q is not very obvious, indeed.

<comment><USER25> Well, they aren't synonymous in Ruby. It's [p,q] operator is also not intuitive for me.

But then, "not intuitive" just means I'll spend a few minutes more learning the language because of it (except in C++, where it means many hours).

</comment></comment></comment></comment><comment><USER26> The post he mentions is a really good read. [http://exple.tive.org/blarg/2013/10/22/citation- needed/](http://exple.tive.org/blarg/2013/10/22/citation-needed/)

It was submitted here yesterday but got no love. [https://news.ycombinator.com/item?id=6595521](https://news.ycombinator.com/item?id=6595521)

edit: fixed link

</comment><comment><USER27> I never have off by one errors in Python, but have always experienced it in previous languages and their libraries. Guido chose very well.

(The one exception is a function in the random module.)

<comment><USER28> I frequently have off-by-ones with range. len(range(1, 100)) == 99

<comment><USER20> Simplify it:

        len(range(100)) == 100

Though - I've written a lot of python code and I never use range. The beauty of python is that all collections are iterable so you seldom need to specify ranges.

</comment></comment></comment><comment><USER29> Using zero reminds you that black is 0, 0, 0 in 24bit integer rgb, while white is 255, 255, 255, not 256, since you only have 8 bits and 2^8 - 1 = 255, not 256, and calling black 1, 1, 1 makes no intuitive sense. Using zero indexes saves a tremendous numbers of errors by habituating on what is more natural for digital memory and the representation capability of intrinsics while creating a nice correspondence between hex zero, decimal zero, binary zero.

The only time this leads to bugs in Python is when using my_list[len(my_list)] instead of my_list[len(my_list) - 1], where the difference between the magnitude of indexing vs counting can lead to intuitive error. However, it's easier to just write list[-1], knowing that zero is the first element, so counting backwards has to start at a different value. Of course you can do something silly like my_list[-len(my_list)] to just be silly.

Indexing is about having some value to get some position out of an array. Zero is a unique number, so it makes sense to use it as an index. If you start counting with your fingers by holding up none and call it zero, suddenly life makes intuitive sense. If you count the numbers that you count on the way to ten fingers, you get eleven unique numbers for those ten fingers. The difference between array length and array indexing. Magic.

<comment><USER30> 1,1,1 is black, also

<comment><USER31> 0,0,0 is a slightly darker black.

</comment></comment></comment><comment><USER32> While we're at it, the 0 key on a keyboard should be before the 1 key, not after the 9 key :-)

</comment><comment><USER33> Why is it zero indexed? Tradition. Why did that tradition start? The best explanation I can think of is because array access is a convenient short hand for pointer math:

array[i] translates perfectly into array_memory_start + i*element size. Thus the tradition was most likely born.

<comment><USER34> > was most likely born I take it you just posted this comment for fun and > didn't RTFA? That was the whole point; the author answered the question of > how the tradition was born, down to the person and year.

<comment><USER33> I did read it. And all he says is that C was zero based but doesn't say why that happened. Unless it was in the comment thread or one of the several second order articles which I'll freely admit I didn't read.

</comment></comment></comment><comment><USER35> I don't think it is intuitive for

my_list[0:3]

to be the first three elements of the list.

Go from position 0 to position 3 should be 0, 1, 2, 3

<comment><USER36> It's nice that my_list[0:3] + my_list[3:6] == my_list[0:6]

It's nice that 3-0 = 3 elements.

It's nice that an index counts the number of elements before it.

It's nice that my_list[0:length] is the whole list, with no extra arithmetic needed.

So many nicer things about this way of doing things.

<comment><USER37> I think it is just personal preference.

I switched from Matlab to Pyhthon and I am totally happy that Python starts counting at 0 (which is very important if you do image processing). But even after four years of working Python with the open interval notation of the last element it seems wrong to me. I think it is related to the fact that the Matlab version is more direct. a[1:3] means: give me the elements 1, 2, 3. That is very clear and obvious. In python a[1:3] means: give me the element 1 and 2. This is not that obvious and even after four years of python sometimes I have to stop and think about it.

<comment><USER36> I envision the array on a continuous axis, and place markers at 1 and 3 (the exact positions, not the range of whole numbers). The range on the axis between them is the right range. With this intuition, everything is very simple and makes perfect sense.

<comment><USER37> Yes, it makes perfect sense, but it still feels wrong for me. I guess it is just related to the fact that I grew up with Matlab and not Python. I was kind of hoping I will get used to it but even after several years of writing image processing stuff in Python I am still not a 100% convinced.

</comment></comment></comment></comment></comment><comment><USER38> > My compromise of .5 was rejected without, I thought, proper consideration.

</comment><comment><USER39> Humans use 0-based indexing. You're not born one year old.

</comment><comment><USER40> I've been teaching Python to my kids (both in middle school), and had to explain zero based arrays. Fortunately, all explanations automatically translate into "yet another stupid thing that grown-ups do." ;-)

Being somewhat of an old timer, I understand the justification of zero based arrays based on making the hardware simpler and maintaining a tight coupling between the representation of a program in source code and its implementation in hardware. Zero is special because all of the bits are the same. Arrays are zero based because the physical location of the first element is the same as the memory location assigned to the array itself, plus zero.

For the last element, I just remember the mnemonic "up to but not including."

<comment><USER41> Drag out a ruler and ask them about distances.

It's a simple way of addressing the difference: 0-indexed "points to" the start of each element. 1-indexed represents the ordinal position.

So to relate to the ruler, the first cm/inch interval is, well, the 1st. But the distance to the start of the first is 0. So if you want to emphasise which numbered interval it is, 1-indexed makes most sense. If you want to emphasise where it starts, or the distance from origin, 0-indexed makes more sense.

</comment></comment><comment><USER42> 1-based counting would make binary very uncomfortable. b0 would be d1 and b1 would be d2. You would have the strange situation of needing more than 1 bit to represent 0. Doesn't seem very intuitive to me, but that's due to familiarity more than anything I suppose.

</comment><comment><USER43> It doesn't matter how cool the slice notation is when people have trouble accessing single elements!

1 based is better for human counting and 0 is better for certain mathematical expressions, usually when thinking about offset from the start rather then list position.

Clearly it is a judgement call, but I personally think counting is more important for the same reason PI is wrong. We are confusing ourselves because easy things aren't intuitive.

Imagine you have:

var list = ['first','second', 'third']

`list[2]` should clearly be the second element (not third), just as PI / 2 should mean half a circle (not 1/4).

We wonder why there aren't as many computer science / math grads. Well in every intro class in the world people are getting confused by this.

<comment><USER31> Depends on how you read `list[2]` "Start at the beginning and move two elements along" works perfectly well.

</comment></comment><comment><USER44> This was nice to read. I only wish itertools count was available by default, in the same manner as range.

</comment><comment><USER45> I like 0-based indexing because it makes mathematical sense. By the ordinal construction of the natural numbers, e.g. 5 ~= {0, 1, 2, 3, 4}. So an array of length 5 has indexes corresponding to the five set-theoretic elements of 5.</comment>


Distributed Locks with Consul and Golang - <AUTHOR> https://medium.com/@mthenw/distributed-locks-with-consul-and-golang-c4eccc217dd5 <comment><USER2> Great read. Did you look at etcd[0][1] when considering a distributed kv store/locking mechanism? If so, what were the pros/cons of each and what lead you to consul?

[0] [https://github.com/coreos/etcd](https://github.com/coreos/etcd) [1] [https://github.com/coreos/etcd/tree/master/client](https://github.com/coreos/etcd/tree/master/client)

<comment><AUTHOR> Thanks!

I was using Consul because we had that already deployed. After quick research looks like etcd client doesn't provide nice abstraction for creating dist locks. I found [1] and [2] though. Definitely it's doable with etcd.

[1] [https://github.com/datawisesystems/etcd- lock](https://github.com/datawisesystems/etcd-lock) [2] [https://github.com/ORBAT/node-etcd-lock](https://github.com/ORBAT/node-etcd- lock)</comment></comment>


Ask HN: Advice from Hardware hackers - <AUTHOR>

Hey! So I have not worked much with hardware - I have an Arduino but have not done too much with it, yet. But that is my extent :p
However, over the weekend I thought of a project that I would like to work on that would involve hardware and software. I think it could be an interesting project for Kickstarter (I am Canadian so that wouldn't work though). I think it might be something others would be interested in as well, and I don't think overly complicated to make.
But what I am wondering is, what is the best way to get into hardware and get funding for it (or find partners). And the process from going from prototype to completed product, what kind of tools / advice etc are useful. I don't know a lot of people in my city (fairly small) that would be able to help, but I could probably track down some electronics engineers. But how do you even start to make hardware projects that look as good as ones like: http://www.kickstarter.com/projects/martinkallstrom/memoto-lifelogging-camera?ref=category.
I have no doubt that I could hack something together that does something like I want but I would not know how to produce something that looks good, nor do I have the connections right now to find people that could.
So if you have any advice I would like to hear from you. If you are more familiar than me and have made some cool hardware projects in the past and have some free time and want to discuss and maybe team up I would love to talk! It involves a rotating camera, internet, some recognition, and fun times.
Please feel free to message me at firstname.lastname@example.com or tweet: @Jonovono <comment><USER2> I was somewhat involved in two projects, one which was a physical object (but no electronics) that failed on Kickstarter, the other had electronics but was abandoned before even reaching Kickstarter.

So while I can't comment on how to succeed, at least I could offer some insights on how to fail ;)

First of all - it's hard. I'm not saying software is easy, but it's harder to pull off a HW project with just a couple of hours on the weekends. It's also much more expensive. The two projects I was referring to failed because the team just couldn't allocate enough time to really push it forward. By the time the Kickstarter campaign launched, everyone was already exhausted, and just didn't have enough "juice" left to push the marketing portion.

But enough about failures, let's talk hardware development.

Note on the Memoto page how their working prototype looks. It's a whole bunch of different boards linked together with cables. That's a good way to start - you can find many "evaluation boards" for pretty much any component you could think of. In this case, they have a camera board, a GPS board, a processor board and an antenna all hobbled together.

Evaluation boards cost much more than the actual component (could be ~$100 for a EVB of a component that costs just pennies), but it's still much much cheaper than developing a custom pcb.

So you order what you need, and make it work. Than, it's just a matter of shrinking it down, and cost reduction. You either hire some freelance engineer who will take all the schematics of all the EVB's you're using, and redesign just the portions you need (normally you'll just be using a small subset of each EVB), or (depending on the overall size, etc.) you could find a couple of tiny modules you just need to connect with a smaller custom pcb. It's always a good idea to browse alibaba.com, and many of the vendors there will even modify their products to you if the order is large enough.

After you have the working prototype, but before you start spending money on shrinking it down, you may want to get an industrial designer to do a mockup of how the product will look. When you have a working prototype and a mockup, you can get funding (Kickstarter, for example).

Note, that investors (via Kickstarter or not) will want to know exactly how much it will cost to manufacture, so you have to do all the design and manufacture "leg work", just to get the numbers right. This is rather tedious, but a necessity.

<comment><AUTHOR> Awesome! Thanks a lot. This was helpful.

I had not heard of some of that for sure.

</comment></comment><comment><USER3> \- I think the best way to get into hardware, is to work on DIY/Electronic Projects (like you plan on doing).

\- To go from prototype to completed product, requires alot of patience and resilience. Do you plan on using PCBs as well? If you do, do you know about OrCad or Eagle?

\- I'll like to work with you, (if you don't mind).

<comment><AUTHOR> Thanks. For the prototype I would probably just use an Arduino or something similar. But I am thinking it may go the PCB route eventually if the idea goes beyond that. I want the device to be fairly small. And no have not heard about those. I will keep those bookmarked!

I would like that. I am always trying to meet people to work on things with. Shoot me an email email@example.com. I am just about to graduate university so am looking for things to do (and to get out of the city).

</comment></comment><comment><USER4> Build it and they _might_ come. With hardware, the best way to convince someone to buy or fund your gizmo is to have them play with it.</comment>


Mobile Browser Cache Limits: Android, iOS, and webOS - <AUTHOR> http://www.yuiblog.com/blog/2010/06/28/mobile-browser-cache-limits/

<comment><USER2> Why do browsers have such ridiculously low default cache limits? Desktop browsers do the same thing; Firefox's default cache size is 50 MB. That's 0.01% of my available storage. I'd be more than happy to devote a whole 1% of my storage to speeding up web browsing, which is after all the primary activity most people perform on a computer these days. That would give a cache size of ~150 MB on an iPhone and 5 GB on my desktop.

</comment><comment><USER3> Would love to see the tests re-run on real data that can be gzipped. You mention that your Sinatra-based tool: _"generates a response consisting of a requested number of pseudorandom alphanumeric and whitespace bytes."_ Then you say that _"gzip had no effect on cacheability on any device."_ I believe that your conclusion that gzip doesn't work is because it's hard to compress random (or pseudorandom) text.

<comment><AUTHOR> Actually, the reason is that the browser uncompresses components before caching them, so compression has no effect on cacheability.

The generated data are actually a series of newline-delimited MD5 hashes of pseudorandom numbers, which makes them fairly compressible. For example, 32KB of data gzips down to about 18.9KB, which seems to me like a pretty reasonable representation of typical web content.

I didn't conclude that gzip "doesn't work", just that it has no effect on cacheability. Gzip is certainly good for reducing the number of bytes on the wire, though.

</comment></comment><comment><USER4> Worth noting the Dolphin browser on Android can use your SD card for caching.

</comment><comment><USER5> I might be wrong, but doesn't HTTP require the Expires header to be set a date less than or equal to one year in the future? If so, the test might have hit undefined behavior.

<comment><AUTHOR> It doesn't require it, but it recommends it:

"To mark a response as 'never expires,' an origin server sends an Expires date approximately one year from the time the response is sent. HTTP/1.1 servers SHOULD NOT send Expires dates more than one year in the future." -- <http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html>

In practice, far-future expiration headers used by Yahoo!, Google, and others are often well over a year in the future, and all browsers support this just fine.

I did do some sanity checks using various dates in the headers, and I saw no difference between dates of less than a year and dates over a year in the future. I decided to run the canonical tests using the far-future dates since that's what the majority of websites use these days.

</comment></comment><comment><USER6> Nice work, Ryan! Have you checked out browserscope? I keep meaning to write a few test suites for it.

<comment><AUTHOR> Thanks! Yes, I'd love to add some cache tests (and more mobile tests in general) to Browserscope. Looks perfect for it.</comment></comment>


Show HN: Napkn – Building the world's best new app idea, every week, for free - <AUTHOR> http://www.napkn.io/

<comment><USER2> Hey all, here's the explanation we posted over on Product Hunt for why we're starting Napkn ([http://www.producthunt.com/tech/napkn- io](http://www.producthunt.com/tech/napkn-io)):

\</comment><comment></comment><comment></comment><comment>-

Napkn gets the best developers/designers to spend a week of their time creating someone's awesome idea for free. The app is put on the App Store for free. And no one makes any money… wait… really? What's the point?

We're in this to make ourselves better developers. Real developers solve real problems. Awesome developers are selfless and want to use their super magical developer skills to give back. New developers need a chance to work really hard and prove themselves worthy.

For all these reasons we're starting Napkn. The best idea from anywhere in the world will be built each week. Have an awesome app idea? Have friends that are always telling you their awesome app idea? Want to spend a week bringing someone else's awesome idea to life? Napkn was made for you!

\</comment><comment></comment><comment></comment><comment>-

If you have any thoughts or question would love to discuss!</comment>