In Beijing, it's often cheaper to have food delivered than to get it yourself - <AUTHOR> https://www.bloomberg.com/features/2019-meituan-china-delivery-empire/ <comment><USER2> One cost advantage to delivery is that you can prepare the food in conditions so horrifying that nobody would eat it if they saw it in person. Some of the Deliveroo-exclusive restaurants in London are like this, inside shipping containers.

<comment><USER3> Such as using Gutter Oil (not limited to delivery), a practice where cooking oil is retrieved/derived from random unsafe sources such as sewers, a practice thought to be common in parts of China:

[https://en.wikipedia.org/wiki/Gutter_oil](https://en.wikipedia.org/wiki/Gutter_oil) [https://www.youtube.com/watch?v=zrv78nG9R04](https://www.youtube.com/watch?v=zrv78nG9R04)

<comment><USER4> Honestly I had never even thought that this would be a thing. Shocking.

Whenever I have traveled, I always enjoy trying street food but this has put the fear in me... at least if I travel to China.

edit: slightly disappointed I can't express my feelings by using the vomiting emoji on HN...

</comment></comment></comment><comment><USER5> The reason this would work in Beijing or for that matter anywhere in Asia is how the delivery itself works. The delivery guys use scooters or motorcycles in a densely populated area which reduces the cost of delivery. Food delivery startups are not able to scale up in markets like US where delivery guys are expected to use their own cars, pay for gas and high insurance while delivering you $10 dollar food. How are these companies supposed to make profits?

<comment><USER6> Is there some reason that much of the US you couldn't deliver food by bicycle or a small motorcycle like a Honda Super Cub?

<comment><USER7> population density, speeds (in suburbs near the big metro areas, you are still going to be at a much higher speed) which mean not so safe riding speeds, weather (main reason why car is needed for delivery), lack of low cost 2-wheelers are the supporting infra (for maintenance or sales).

I think e-bikes + delivery can make a dent, but only in the super dense cities where ebikes/escooters are popular/available.

<comment><USER8> Isn't it also a factor that, in SF, small vehicles need extra time to secure or they'll be stolen?

<comment><USER7> I think that's true in many places in the US, not just SF. Mostly cities though.

</comment></comment></comment></comment></comment><comment><USER9> Just an anecdote on the price and quality of delivery in China -- I've lived in China for a total of 1.5 years on and off. I've yet, to date, cook a meal myself. 饿了么 and 美团 are so convenient that you can order just about any meal and have it delivered in 20 minutes. Unlike the massive fees and wait time in the US, you'll normally get the meal still hot for less than 5RMB (less than 1USD) for the delivery.

<comment><USER10> Reasons why these kind of stuff works in China

\- People prefer to stay indoors. Air pollution that reduces your lifespan exists in cities like Beijing and Hebei - even Shanghai (certain months during winter time). Extreme heatwaves during summer time that has the city cooking in 40-50C....it gets so hot that people sleep outdoors on sidewalks! (Shanghai will supposedly be unlivable in 30 years due to extreme heatwaves)

\- cheap(-ish) labor, although now labor costs matches that of Mexico

\- shitty food sanitary conditions, now with no storefront. Have fun figure out whether your cheap delivered food was cooked with gutter oil or not.

\- questionable food ingredient quality. tons of fake stuff abounds.

<comment><USER11> _it gets so hot that people sleep outdoors on sidewalks_

Off topic, but I find it funny how society has changed so much in so little time.

When I was growing up in New York, if it was hot, many people in the neighborhood would sleep outside — especially people in apartment buildings. You'd see dozens of them snoring away on fire escapes.

Now those same families probably can't imagine living without air conditioning, even though the city is so much safer today.

<comment><USER12> The norming of AC in so many places has been quite the shift. I live in an old house in Central-ish fairly rural Massachusetts and I sometimes get funny looks from people when I tell them I don't have AC. (I do have a small window unit I use for sleeping for a week or two in a typical summer when it gets uncomfortably hot to sleep.)

When I was an undergrad and spent a couple summers in the city in the Boston area, no AC at all.

<comment><USER13> I got many funny looks from hotel staff on a recent trip for asking how to switch off air conditioning, or asking them not to turn it on when they showed me to my room. Apparently most tourists prefer to sit in a fridge.

If I've been walking round outside at 32–35°C, there's no way I want to be in a room at 16–18°, let alone sleep in one. I usually set it to 28° and slept without any bedclothes.

<comment><USER14> I'm very much in the same boat as you. It's a pet peeve of mine that every building now seems to have a completely different climate to the outside world. I'll never get how people don't understand - or don't want to go through - the process of acclimatisation. If it's 30C outside, having the AC on at 20C all day is of course going to make 30C seem unbearably hot!

As a student I lived in the North of England in Newcastle, where temperatures averaged around 0C in the winter and because we couldn't afford heating the house was often around -2C. I would still walk around in t-shirt and shorts without problem. I later moved in with a group of girls who had the heating knocked up to 25C all year round, and within a week stepping out of the door felt like jumping into an ice bath. Rapid temperature change mess up so many of our bodily processes that I'm amazed it's discussed so little. If I don't sleep with a window wide open I know I'll struggle to get even a single cycle of REM sleep, and almost all of the people I've convinced to try sleeping with a window open and the heating off have told me their sleep improved ten-fold after a couple of weeks.

</comment></comment></comment></comment></comment></comment><comment><USER15> Meituan's head, Wang Xing, "calls Facebook Inc. a copycat for imitating other online services." But then the article goes through his past work:

1\. "...in 2003, he dropped out, inspired by Friendster, a Facebook precursor, to create a social network for China."

2\. "Their 2007 effort, a popular Twitter look-alike called Fanfou..."

3\. "In 2010 he created Meituan in the mold of Groupon..."

4\. "...he plans to introduce an Amazon Prime-like subscription service."

I myself don't care if you copy an idea. In fact it seems unavoidable, because "there is nothing new under the sun," "everything is a remix," and "ideas are just multipliers." What differentiates your business is your execution. Apple did not come up with new ideas. They took old ideas and did them really, really, really well. They didn't invent the graphical user interface. The iPod was not the first MP3 player. The iPhone was not the first smartphone. The iPad was not the first tablet computer.

<comment><USER16> Wang Xing holds the same opinions as you. He doesn't criticize Facebook.

</comment></comment><comment><USER17> How does this work? If the food costs 80% less on the app than at the register, either the restaurant is losing the lion share of its massive margins (unrealistic) or they're just subsidizing it with investor money. But that would seem to be impossibly high subsidizing. Is it simply that in China you can quadruple down on Amazons strategy of promising profitability later? The article doesn't explain this well and even goes to say that this guy is the conservative spender with founding money. If it is the latter... this feels like a terrible strategy.

<comment><USER18> Dark kitchens - the quality is shit, that's how. Plus slave work.

[https://www.sustainweb.org/jelliedeel/articles/dark_kitchens...](https://www.sustainweb.org/jelliedeel/articles/dark_kitchens/)

[https://www.theguardian.com/commentisfree/2018/oct/09/dark-k...](https://www.theguardian.com/commentisfree/2018/oct/09/dark- kitchens-satanic-mills-deliveroo)

<comment><USER19> I really don't get the whole negativity about "dark kitchens". There is nothing wrong in theory with a delivery-only restaurant, and there are clear cost savings that can be passed on to the consumer.

Articles such as the ones you cited talk about the stifling "windowless boxes" but restaurant kitchens have never been windowed comfortable places. At least in the UK these kitchens are subject to the same hygiene and labour laws as any other place where food is prepared. They seem to want to imply that "dark kitchens" flout these laws but I've yet to see any evidence.

<comment><USER20> In third countries with lax food safety regulation i feel they matter. When there are more layers of separation between you and your end customer i think its human nature that you will be little less vigiliant / anxious about seeing a cockroach or rat in your kitchen. At some point it isalmost anonymous like an internet crime.

</comment></comment></comment></comment><comment><USER21> Cooking for yourself is an underrated skill. Many young people can't cook an ordinary meal. Just think of how many dust bunnies and ass hairs are in the average take-out.

<comment><USER22> Cooking for yourself is a good skill but extremely wasteful in terms of lost time and generated waste products.

<comment><USER23> With good planning and recipe selection this doesn't have to be true. Soups, stews, pasta, beans, chili etc. can all be cooked in bulk and frozen with no waste. They can incorporate leftover ingredients from other cooking and can be quite cheap.

<comment><USER24> I think the point is that if you the median American and you value your non- working time at your hourly wage of $27/hr then you're better off not spending, say 4hr a week, cooking/meal-prepping since you can get a months worth of food for way less than $432.

You should really only cook your own meals if:

* You enjoy it.

* You value/need your money more than your time.

* It's difficult to meet your dietary goals with purchased food.

<comment><USER25> My costs are less than 200 a month cooking for myself and family (buy in bulk friends), also I spend time with my family, listen to podcasts and clean while cooking, so directly assigning my wage to the cost per hour of cooking does not tell the whole story.

Another factor is health. Maybe in a large city is there is healthy, cost effective take-out but where I live the options are pizza and Chinese food after 8pm.

</comment></comment></comment></comment></comment><comment><USER26> > Alibaba is betting it can undercut Meituan to death. Both companies are > spending billions in an escalating war of subsidies that might persuade even > Jeff Bezos to cut his losses.

To me, that's the major reason. Meituan is loosing HUGE each month due to subsidies. Don't forget the food delivery giants in Chinese markets with highly concentrated population with billions of subsidies. It only works in selective Chinese Megacities with very cheap human labor and relative cheap and convenient of electric vehicles. It won't work in anywhere else in the world (probably not even in India).

</comment><comment><USER27> It is the case in India too with a bunch of food-delivery startups that have mushroomed in the last few years. Lot of discounts, cash-backs and what not. This will not last long but a great time for consumers, for now.

<comment><USER28> A friend of mine in Indonesia started something similar. They had 3 people. Their food delivery business basically existed on instagram. Their menu and everything was on there, they took orders over the phone or through instagram, they cooked everything up at home and delivered it themselves by motorcycle. Apparently they were making decent money, but because of local customs regarding women working and such, were not able to continue.

<comment><AUTHOR> they had no issues with food regulations, food safety standards, in this model?

<comment><USER28> I'm guessing there were no such things. I asked about rules, my friend was just kind of confused why there would be rules like that. Apparently it was fairly common to sell food grown and cooked in your home to people, At least the town my friend lived in. There was another group of their friends they competed with that ran a similar business, apparently my friend's chicken was better though, at least she said so. Their food always looked delicious. She'd send pictures. It looked better than most takeout or delivery available to me.

<comment><USER29> While you can sell food cooked from your own kitchen, but you can't just do whatever you want, you will for example get in trouble if you sell something that make people sick.

</comment></comment></comment></comment></comment><comment><USER30> Food is cheap in China to begin with. The place in an underground garage nearby sells CNY 18 meals - a bow of rice + some stew. Downside? Completely full during lunch hours.

In a company I worked before, before the food delivery craze, we were regularly ordering fancy restaurant quality catering into office for like CNY 200 for 20 people. And that in Shanghai.

Nowadays, everybody just orders whatever they want themselves.

</comment><comment><USER31> Same thing is happening in India. But I have noticed that sometimes you will get cheaper food by calling the food joints.

One side affect of this whole food delivery is that we are eating more from restaurants compared to before when we used to go and eat maybe once in 15 days.

Add to it there are always deals going on from the delivery companies.

Zomato and Swiggy rule here.

</comment><comment><USER32> Not surprising. It's also cheaper than growing food for yourself. Specialization increases efficiency.

</comment><comment> La-ang Well, Meituan is still losing money according to this article. I am guessing they're still branding and building loyalty before they defer to increasing their costs and generating money through other ventures?

<comment><USER33> No need to guess. The article states this explicitly.

</comment></comment><comment><USER34> I'm curious why those shadow kitchen, or maybe cloud kitchen sound better.. haven't spun up in US.

Is it regulatory? Is it restaurateurs here are less quickly at responding to changing markets? not enough cost savings?

<comment><AUTHOR> do you mean something similar to UberEats' "Virtual Restaurants" \- [https://www.bloomberg.com/news/articles/2018-10-24/uber-s- se...](https://www.bloomberg.com/news/articles/2018-10-24/uber-s-secret- empire-of-virtual-restaurants) and an older article on "ghost restaurants" \- [https://www.fastcompany.com/3064075/hold-the-storefront- how-...](https://www.fastcompany.com/3064075/hold-the-storefront-how-delivery- only-ghost-restaurants-are-changing-take-out)?

</comment></comment><comment><USER35> I just want to say it is really hard to read an article with this horrible add flashing next to the text:

[https://www.bloomberg.com/bbg- gfx/video_loops/2019-meituan/m...](https://www.bloomberg.com/bbg- gfx/video_loops/2019-meituan/meituan_cover.gif)

<comment><USER36> For some reason these retro vaporware (aesthetic, not software) graphics are something Bloomberg thinks are good but are almost always just little vanity projects that provide no value and end up being distracting.

I really don't know who thought it was a good idea but I'm sure it's fun work for the artists.

<comment><USER37> Meh, I like these things. I could do without the bright white arch though.

<comment><USER35> Yeah I'm ok with the style but man that flashing from the white arch is annoying while trying to read.

</comment></comment></comment></comment><comment><USER38> I think that has been the promise of "cloud kitchens" everywhere.

</comment><comment><USER39> None of that is worth the suffering of having to live in Beijing.

</comment><comment><USER40> this is true in SF.

further stratification of eating out as a luxury into premium of being at the restaurant and cheaper version of getting it delivered

</comment><comment><USER41> If robotics matures to a point where food delivery could be fully automated, could we see similar price inversion in the US?

<comment><USER42> > A deliveryman who would give only his surname, Yang, says he generally > makes $15 to $30 a day, and as little as 75¢ for a short trip.

Honestly this makes me skeptical of an AI delivery person unless it starts in high cost of labor countries like the USA. It would be silly to try to beat the low human labor costs of China or Southeast Asia.

<comment><USER43> I wonder if this will be some small type of advantage for Western companies going forward.

Surely an AI delivery will eventually win in all markets, but who's going to risk trying to build it when the max theoretical benefit is a few dollars per day per worker replaced? In the US the benefit might be 20x that much [1], making the risk worth investing in.

[1] assuming a hypothetical hyper efficient drone deliverer costs $15 / day and a SE Asian delivery worker costs $20 / day, that's $5 / day potential. An American delivery worker that costs $100 / day leaves $85 / day potential, or almost 20x as much.

</comment></comment></comment><comment><USER44> Bloomberg discovered major secret: When labor is cheap, untaxed and abundant you can provide amazing services.

<comment><USER45> You mean VC spending here I think

<comment><USER46> It's traded publicly, so it's regular peoples money. ~20% insiders, ~20% institutions, 60% regular investors?.

</comment></comment></comment><comment><USER47> Off topic, sorry, but curious: Does China still consider itself communist?

<comment><USER48> Yes. More specifically, the Communist Party of China is very proud of its ideological roots going back to Marx, Lenin and Mao. They call their economic system socialism with chinese characteristics. But they don't see the current stage to be the full realization of socialism, but as being in the beginning stage of building socialism.

</comment></comment><comment> La-ang This article made me hungry :D</comment>


Why Can't We Build a Splash-Proof Toilet? - <AUTHOR> http://priceonomics.com/why-cant-we-build-a-splash-proof-toilet/ <comment><USER2> "It's why lounges play slow music that influences people to linger and buy more drinks, why experts don't recommend open office plans, and why elevator music developed as a way to make standing in a tiny, moving room seem more natural. Yet in restrooms, we're left in silence to listen to each other's bowel movements."

Sound is the least of the horrors I've experienced in the restrooms at places I've worked. People can be shockingly disgusting. Knowing you work with people that have no understanding of how to shit properly has you seriously questioning their ability to handle the complex tasks required of their employment.</comment>


Is Doug Engelbart a Crank ?  - <AUTHOR> http://www.youtube.com/watch?v=oBZXfCw7xIw&repost <comment><USER2> Well, he did think chording keyboards would take off :)

<comment><AUTHOR> hm. I wasn't aware of it.

Maybe we should try it ?

</comment></comment><comment><USER3> Not really. Google "the mother of all demos".

<comment><AUTHOR> apologies, I'm well aware of that, see:

<http://news.ycombinator.com/item?id=771049>

If there is one thing that I really regret from the life that I have lived so far then it is not having enough time to visit Doug Engelbarts lab at Logitech headquarters when visiting there some years ago.</comment></comment>


Two Factor Auth List - <AUTHOR> https://twofactorauth.org/ <comment><USER2> This site drives me insane

because it scrolls all over the place...

sometimes it does what you expect other times it just tosses you to the top of the page...

or does normal #id and then scrolls up a bit</comment>


Why Ikea Causes So Much Relationship Tension (2015) - <AUTHOR> https://www.theatlantic.com/business/archive/2015/09/ikea-furniture-fighting-couples-trust/406267/?single_page=true <comment><USER2> "Cause", I believe, is misused here based on what the article describes. It "causes" tension in the same way poorly written code produces bugs "caused" by improperly handling an input that should have been expected and coded for.

Edit: To clarify- figuring out decorating styles, putting items together after purchase... these are not "unanticipated inputs" in a relationship. If they're throwing errors, the only reason Ikea is involved here is because they instantiate the $homeFurnitureStore variable more often than other possible places.</comment>


Show HN: Textflix – A prototype using transfer learning for NLP - <AUTHOR> https://textflix.fastforwardlabs.com/ <comment><AUTHOR> Hi HN!

We recently released Textflix, a prototype app using transfer learning to apply sentiment analysis to old movie reviews. We wrote about it here: [https://experiments.fastforwardlabs.com/log/textflix- report/](https://experiments.fastforwardlabs.com/log/textflix-report/)

The baseline algorithm used is available as a scikit-learn class here: [https://github.com/fastforwardlabs/nbsvm](https://github.com/fastforwardlabs/nbsvm)

Hope this is useful or fun for someone!

Thanks, Chris @ Cloudera Fast Forward Labs</comment>


Angel Capital Association Critiques Proposed Regulations - <AUTHOR> http://www.angelcapitalassociation.org/resources/public-policy/federal-policy-issues/highlights/

<comment><AUTHOR>
        o Sec 412 (page 380) Adjusting the Accredited Investor
          Standard for Inflation
        o Sec 413 (page 381) GAO Study and Report on Accredited Investors
        o Sec 926 (pages 816-819) Authority of State Regulators
          Over Regulation D Offerings

"These 3 sections that threaten to reduce the number of accredited angel investors in the United States by about 75 percent and complicate the regulation of Regulation D offerings (which include angel investments) to increase the time needed for entrepreneurs to raise money and make it more difficult to get investors across state lines."</comment>


Deep learning for chatbots: Part 1: Introduction - <AUTHOR> http://www.wildml.com/2016/04/deep-learning-for-chatbots-part-1-introduction/ <comment><USER2> For those of us with poorer eyesight, how can I increase the contrast on sites like this? I'm finding more and more websites are using themes that to me just look like mush, and I've resorted on occasion to automating a screen capture and contrast adjustment on the image.

Is there something that can help me? Why is the world turning to grey-on-grey themes?</comment>


Germany ends spy pact with US and UK after Snowden - <AUTHOR> http://www.bbc.co.uk/news/world-europe-23553837

<comment><USER2> It seems that Germans are actually interested in privacy. I was really surprised to see a program on a very popular German TV channel last week where email/message encryption was explained using very simple diagrams, from the user's side. It wasn't a how-to - they didn't say "google gpg, click here, click there". But just seeing a 30+ minute report about public-key cryptography at a reasonable time (I think it was around 2100), on a national TV - that's a serious step in the right direction.

<comment><USER3> Yes. There is a really strong reason why the Germans remember that privacy is important. We should listen to them.

</comment></comment><comment><USER4> Big deal, it's not really in use. If you really want to stick it to the US refuse to allow the TSA access to your passenger data. Refuse to give the IRS financial information. Toss out the entire US military from their bases. Then maybe I will think there is real outrage.

<comment><USER5> Tossing out US troops would be the strongest statement. When the US tried to reduce troop numbers in Germany, they had a fit. All about the economic impact losing all the US military spending in that region would cause.

Turns out stationing 50,000+ troops in Germany is good for the local economy... if they tossed them out, it would be a massive demonstration of seriousness.

<comment><USER6> indeed. but merkel prefers bowing down, licking boots. like anybody else would do. looks like the thugs eisenhower tried to warn us about are wearing chocolate shoes.

</comment></comment></comment><comment><USER7> Hah. Remember when the Germans installed rootkits just a blink ago? [http://www.ccc.de/en/updates/2011/staatstrojaner](http://www.ccc.de/en/updates/2011/staatstrojaner)

<comment><USER8> Meanwhile, in Switzerland, the progress of the "fight" against trojans to be installed by the government couldn't even keep up with the speed of a snake:

[http://buepf.ch/](http://buepf.ch/)

(If you know people who live there, forward this petition!)

<comment><USER9> A snail perhaps? Snakes move pretty fast.

<comment><USER8> Yes, SNAIL, thanks!

</comment></comment></comment></comment><comment><USER10> I'm a little confused about this article. From the article

"Ending an agreement made in the pre-internet age gives the Germans a chance to show they're doing something, and at the same time the Americans know it's not going to hurt them."

It's completely a symbolic gesture. It seems to me like the Germans are just playing a political game, hoping that (somehow) the people don't notice. Any German natives able to give insight into the general feeling among the population (preferably the whole population, not just 20 something start-up guys)?

<comment><USER6> i am native german.

feeling among the population: "give us soccer, beer and low oil prices! nsa? yeah, shit happens. i don't really care as long as nobody intrudes the fence around my house."

of course, this is symbolic. i wouldn't even call it that. what our government is and has been doing since at least a decade is plain and simple treason.

but it doesn't matter to the generation of 68. as long as they can watch tv. people here even read 1948 and are like 'sure. like today.' and go on with their lives and all the important crap they're doing.

</comment></comment><comment><USER11> Ending a pact and stopping data sharing are different things apparently:

> "the decision would have no impact on current intelligence co-operation."

> "Given the good relations between the intelligence agencies, they'll get the > information they need anyway," ['A German official'] said.

</comment><comment><USER12> Well, spies should and do hide in the shadows. We will have to wait 10 years to see if this is the truth.

And then we still can't be sure, NSA/CIA/Stasi/KGB/FSB/BFST/PST ( the whole [http://en.wikipedia.org/wiki/List_of_intelligence_agencies](http://en.wikipedia.org/wiki/List_of_intelligence_agencies) list ) can have been better at preventing whistleblowers like Snowden so we never can know 100%.

Better make the necessary preparation today.

</comment><comment><USER8> Previous discussion: [https://news.ycombinator.com/item?id=6146770](https://news.ycombinator.com/item?id=6146770)

But it's always very interesting to compare how different news outlets/countries sell the story differently.</comment>


Show HN: Normail – un-fancy email with cal, contacts, and Nextcloud $50/year - <AUTHOR> https://normail.co <comment><USER2> I absolutely do not understand how you believe trusting an individual on the internet creating a fly-by-night service is better than trusting a company with 20-years in the industry, and GMail a product that has been around for 15-years.

You're hosting all of this on a single machine -- with no redundancy -- with no DDoS protection -- and it makes me seriously doubt your sysops and opsec skills to be able to deliver a secure and reliable product to your customer.

;; ADDITIONAL SECTION: box.normail.co. 3464 IN A 22.214.171.124 ns1.box.normail.co. 3430 IN A 18.104.22.168 ns2.box.normail.co. 3430 IN A 126.96.36.199

If you are wishing to achieve your objective of moving people off Google, you should be suggesting a provider that _does_ have the infrastructure to provide a reliable service, that is a reputable organization with a proven track record for good sysops and opsec, and is an alternative to Google.

The most important part about e-mail is longevity. It is making sure your emails can not be read by malicious actors. It is making sure your email is never down. For many people it is the absolute backbone of their business and maybe their life. I absolutely would never put this much trust in a service like this. It is preying on ignorant paranoid people with impaired risk analysis who (like you) believe Google is the devil.

<comment><AUTHOR> You believe something false. I created amazingly secure dns zone entries glue records that are hosted on a cloud backbone. The very fact you cant see past that firewall of dns glue is proving the point of exactly how secure they are and how trustworthy the service is. Please educate yourself fully and dont jump to a conclusion like this. You really think I am running this out of my basement on bare metal or something? Would love to pentest this service since it is so early. I would be dumb not to. I guess I can transparently share the results of load at lets say 100k concurrent connections?

<comment><USER2> Let's start dissecting this.

~ dig NS normail.co @ns1.cctld.co.

;; ADDITIONAL SECTION: ns1.box.normail.co. 3600 IN A 18.104.22.168 ns2.box.normail.co. 3600 IN A 126.96.36.199

ns1.cctld.co. is the registry server for the ".co" domain tld. Everyone has access to the glue records. It's how DNS works. They are not secure by any definition. You can also see for yourself at [https://www.ultratools.com/tools/dnsLookup](https://www.ultratools.com/tools/dnsLookup) (in the Trace tab after you lookup)

And your only MX record:

normail.co. 3600 IN MX 10 box.normail.co.

I'm honestly surprised you even have DNSSEC setup. That one hugely surprised me.

And the host of 184.108.40.206? A single Digital Ocean VPS in Amsterdam.

inetnum: 126.96.36.199 - 18.104.22.168 netname: DIGITALOCEAN-AMS-5 descr: DigitalOcean Amsterdam

I'll accept that you're unaware of how the internet or cybersecurity works besides a primitive level as an explanation for the incoherent technobabble in your comment.

I say this in the absolutely nicest way possible: please don't run a service where others rely on you when you know you are not capable of running a reliable service. There is a point where incompetency becomes malicious.

</comment></comment></comment><comment><USER3> This smells like Mail-in-a-box... A Free solution where a VPS is $5/month max.

You target people who want to go away from Google, yet you have even worse transparency on what you're running.

Edit: As a fact... it _is_ mail-in-a-box... This is worse than I thought. (Proof: [https://box.normail.co/admin](https://box.normail.co/admin))

Who in their right mind would give $50/year to someone they've never met, that has no real worth, and is peddling a _free_ software suite as the real deal to get away from Google.

<comment><USER4> > Who in their right mind would give $50/month to someone they've never met, > that has no real worth, and is peddling a free software suite as the real > deal to get away from Google.

Someone who doesn't know how to configure that free software. There is worth here for those people, but I do think $50/year is far too much considering that gets you a probably far better service with Fastmail.

<comment><AUTHOR> Exactly. 90% of just US market doesnt understand how to run their own domain let alone setup a linux mail-server. Appreciate the feedback on the $50/year. We will see what the market will bear. Does fastmail offer cloud storage included in the $50? I used to use them way back in 2013 but have been running my own mailserver for 6 years now, so I need to update the competitor landscape a bit. I garuntee with Fastmail you dont get the same level of one- on-one support you get with this ;)

<comment><USER4> > Does fastmail offer cloud storage included in the $50?

I don't use it, but yes. $50/year right now corresponds to the standard plan which gives you 10GB of file storage. That's detailed here:

[https://www.fastmail.com/help/account/limits.html](https://www.fastmail.com/help/account/limits.html)

> I garuntee with Fastmail you dont get the same level of one-on-one support > you get with this ;)

I had an issue once where I moved some 800 or so of the emails I had in my Inbox to separate folders in my computer's Maildir and when I synched it via IMAP (by using the MRA isync/mbsync) it caused the dates of all of them to change in their web-client to the moment I did the move. Moving emails and synching like I did is probably a very unusual thing for customers to do. Someone in customer support ran a script (and maybe wrote it too, considering this seems like an unusual problem) to fix the dates and explained what happened to me in enough technical detail for me to figure out how to avoid this happening again next time I do something like this with IMAP. It only took 2 days to resolve the issue. I consider their support to be pretty good. :)

</comment></comment></comment></comment><comment><AUTHOR> Got a few successful signups today, thanks everyone for the support! Im working hard to improve the service, always love the feedback good and bad. Thanks again!

</comment><comment><USER5> Does it have a way to integrate into iPhone mail?

<comment><AUTHOR> It actually provides the user with QR code to scan to open the link within that is your specific mobile profile to install on your iPhone that shows up as a Configuration Profile in settings with all of your information and mail account magically appearing in the mail app.

</comment></comment><comment><USER6> Do you support IMAP?

<comment><AUTHOR> Yes.</comment></comment>


Fotorama, a responsive JavaScript photo gallery - <AUTHOR> http://fotorama.io/ <comment><AUTHOR> The feature I like the most because it is usually missing from other galleries I encounter on the web is the ability to slide with your mouse to advance to the next picture.</comment>


Revere Security Appoints Whitfield Diffie as Chief Cryptographer - <AUTHOR> http://www.reveresecurity.com/public-key-encryption.html

<comment><USER2> New to me, but looks credible. Any comments on the claims of lower power/higher speed ?

<http://www.reveresecurity.com/technology.html>: "neither a block nor a stream cipher, but a rotor machine based on an important, novel rotor-stepping rule."

And that page ends with a link to this 34 slide presentation: <http://www.reveresecurity.com/pdfs/RevereIntroduction.pdf></comment>


Microsoft's Android Plan: Evil Genius Or Just Evil? - <AUTHOR> http://techcrunch.com/2011/07/13/scott-you-just-dont-get-it-do-ya/

<comment><USER4> The whole premise of the article is that the only acceptable reason for Microsoft to bid on the patents was out of fear that their existing licensing agreements would be invalidated. With thousands of patents in the portfolio, and a limited number of them licensed by Microsoft, that premise seems to need a bit of justification - something which the article lacks.

Furthermore, where is the explanation for Apple's participation? Is it also evil? What about Intel's failed bid? Evil too? RIM? Consistent attribution of the motives applied to Microsoft would have all Google's competitors as evil doers.

Finally, the article goes on to imply that the Nortel portfolio is somehow key to Microsoft's patent licensing program around Android which does not appear to be the case because those agreements are based on Microsoft's existing patent portfolio. (None of which is intended to argue for the merits of patent licensing.)

<comment><USER5> >Consistent attribution of the motives applied to Microsoft would have _all_ the competitors as evil doers.

Fixed that. You can apply the same reasoning to every single company that made a bid for the pool, including Google. They shouldn't be singled out as the lone "non-evil" party here.

Google was most likely licensing some of the 4G tech from Nortel as well. Getting the patents in their pool, even if Google wouldn't use the patents offensively, would save them a boatload of cash.

<comment><USER4> Of course Google shouldn't be singled out, they're just like any other company only more so. And of course there was no substantial evidence in the article that Google would refrain from using the patents offensively had they acquired them.

In the context of the article Google's motives for bidding were attributed to nobility of purpose, a disinterest in the offensive use of patents and purity of heart - o.k. maybe not purity of heart.

</comment></comment></comment><comment><USER6> Neither evil, nor genius, just business.

And let's not pretend that Google were trying to do any different. They didn't bid $3 billion with Intel for shits and giggles, they did it for exactly the same reasons Apple, Microsoft et al did they just lost.

<comment><USER7> > let's not pretend that Google were trying to do any different.

Let's not pretend that Google were trying to do something other than: buy a way to tax hardware makers who choose to run a competitor's OS?

Sometimes patents are defensive.

<comment><USER6> So they wouldn't have attempted to get patent fees out of Apple, RIM and anyone making Windows Phone devices? They'd have just spent $3bn on the patents to stop anyone else having them.

The whole Google are victims thing is getting pretty tired.

<comment><USER7> > So they wouldn't have attempted to get patent fees out of Apple, RIM and > anyone making Windows Phone devices?

I believe that's what I implied.

<http://www.bing.com/search?q=%22google+sues%22+patent>

Do you have some reason to think otherwise apart from that it would be bad business sense in your opinion?

<comment><USER6> From the first page of results on the comparative Google search (ironically): Google Sues Oregon Company Over Patents for Online Traffic Maps: [http://www.bloomberg.com/apps/news?pid=newsarchive&sid=a...](http://www.bloomberg.com/apps/news?pid=newsarchive&sid=aZoRwXzkr7dU)

In other legal protection (that is non-patent) they've sued everyone from the US Government (over their supposed favouring of Microsoft), Microsoft over the default search engine in IE 7, Froogle over trademark infringement as well as a whole bunch of counter suits.

If I go past the first five pages (which are dominated by Lodsys and Oracle limiting the space for other stories) who knows what else but I really don't have time.

Google are a big company, they have legal muscle and use it, please don't kid yourself it's otherwise.

<comment><USER8> Did you read that first link?

 _Google said it wants a court ruling that its Google Maps feature doesn't use inventions patented by closely held Traffic Information LLC. It's also challenging the validity of the patents._

They aren't using patents - they are asking for a patent that can be used to attack them to be invalidated.

<comment><USER6> Sorry, my bad.

But the reality is that they do use legal muscle where it works and there have been other companies who've stated that they only bought patents for defensive purposes who soon shifted. I honestly can't see Google holding that line - <USER2> may disagree but only time will tell who is right.

I'd also suggest that Google's lack of use of patents in this way so far is likely as much down to the fact that they have a notoriously weak patent portfolio (estimated to be one twenty fifth the size of Microsoft's - <USER3> a function of age rather than intent). Google suing another large company would be taking a knife to a gun fight.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> What would be an example of a Nortel patent that applies to Android? Just because they have 6000 patents doesn't mean they are useful? Anybody could get 6000 nonsense patents with enough money.

In fact I just wonder, has anybody ever tried to DoS the patent office? If one application costs 10000$, one billion dollars would buy you one million potential patents. Something like the "academic paper generator" could be used.

<comment><USER10> The patent office is already essentially under a DoS. The patent backlog is between 3-5 years.

</comment></comment><comment><USER11> Biggest OEM example of why this does not work:

In the US we have two big examples:

1\. CDAMA OEMs as they pay a patent fee to Qualcomm. 2\. The OEM Apple uses for GSM handsets as they pay a patent fee to Nokia via Apple. Did that OEM suddenly stop making iphones after Nokia won the case?</comment>


Show HN: Appointmind – Online Appointment Scheduling - <AUTHOR> http://www.appointmind.com/?tracking=hackernews

<comment><AUTHOR> Not exactly new but with new features all the time.</comment>


Google is still trying to convince everyone that web apps don't suck - <AUTHOR> https://www.theregister.co.uk/2018/11/13/google_web_apps/ <comment><USER2> In my perspective web apps are poison for the software ecosystem. As a whole they hurt both security and privacy. Complexity is the enemy of security and weakening the native/browser barrier is just that: more complexity. On top of that browsers already leak, close to, as much data about the client as possible. Lets build apps on top of that - fantastic idear.</comment>


Radiohead to let fans pick price for new album - <AUTHOR> http://www.boingboing.net/2007/09/30/radiohead-lets-fans.html

<comment><AUTHOR> The download is any price, including $0.00. The only other thing for sale is a double CD/double vinyl set for GBP40.

:)

With Radiohead giving away their album and Trent Reznor planning on selling his first record-label free album online for $4, we are definitely seeing the middle of the end of the era of the RIAA.</comment>


Two Factor Auth List of Websites - <AUTHOR> https://twofactorauth.org/ <comment><USER3> TradeKing definitely needs to be added to this list. They should be prominently featured at the top in a security hall of shame for their cartoonish security.

Edit, examples:

No 2 factor authentication

Displaying the answers to your security questions in multiple choice form (with a none of the above option, but usually including your answer).

Requiring your password to be entered with mouse clicks at an on-screen keyboard. Not kidding.

Those ridiculous "anti-phishing" pics.

TradeKing is the definition of security theatre.

Do not use TradeKing.

<comment><USER4> Please consider sending them a pull request: [https://github.com/2factorauth/twofactorauth/pulls](https://github.com/2factorauth/twofactorauth/pulls)

<comment><USER3> Yes. I am aware, thank you. I was planning to send a pull request to add tradeking if it isn't already there when I get home. I doubt they want a hall of shame pull request -- it seems to be a well structured list.

</comment></comment></comment><comment><USER5> I worked on an open source CMS called Airship and we decided to include 2FA in our v1.0 release. After a bit of research (mostly to conclusively rule out SMS-based 2FA), I found that it was actually very easy to implement.

I started working on a vendor-agnostic 2FA implementation for PHP projects.

[https://github.com/paragonie/multi_factor](https://github.com/paragonie/multi_factor)

It's far from complete, but hopefully it makes it easier for others to add 2FA to their projects.

If anyone's interested in the open source CMS I mentioned: [https://github.com/paragonie/airship](https://github.com/paragonie/airship)

<comment><USER6> FYI - the correct link is: [https://github.com/paragonie/multi_factor](https://github.com/paragonie/multi_factor)

<comment><USER5> Thanks! I'm not sure why I didn't copy/paste. :)

</comment></comment></comment><comment><USER7> I would argue that Namecheap shouldn't be on that list. They send out a 6 digit code and then immediately tell you what number it begins with, reducing the code to effectively 5 digits. Their continued refusal to support RFC 6238 shows they don't take this seriously in my opinion.

<comment><USER8> Does it matter whether it's 6 digits or five? Surely any rate limiting is going to make either effectively impossible to brute force before the code expires and a new one is generated.

</comment></comment><comment><USER9> It's great that this exists. Many typical users are still befuddled by multifactor authentication, and the one thing that helps is practice. Unfortunately, by having all these islands of identity, the frequency of interaction for many of them ends up being low, resulting in users forgetting they enabled MFA and the associated recovery costs.

There have been technologies to try to bridge the identity islands -- social login (which previously created trust issues through OAuth abuse - <USER2> resolved, but trust is hard to win back), Mozilla persona and others. But, at the end, the hostility of end user identity is still a problem that needs to be solved in such a way that end users have good authentication choices (no more bad security questions, for example) with good security attributes (low replay, discoverability and guessability, for example) with good usability. Ideally, an end user should be able to choose an identity provider, trust them, and then use that identity provider across multiple services. I know that some companies are working on this, but it still tends to be in islands, rather than an industry group, for example, dedicated to making it work. At this point, a de facto standard may be the best thing.

I've been in meetings with IAM architects at large banks who scoff at social login because they don't want to trust social login security, yet their own end user security is marginal. Some honest conversations need to happen in this space to help move things forward.

Better identity infrastructure for end users will help service providers.

<comment><USER4> Great points. I love TFA (e.g. Google Authenticator) but I recognize that ~95% of Internet users will never care as long as it is as hard to use as it currently is.

</comment></comment><comment><USER10> OT: Just in case webdevs reads this: you might want to markup clickable things as clickable (<a>). If you need a datapoint: I'm using Vimium for Chrome.

<comment><USER11> Also, I think there should be an option to show all of the websites. I don't want to keep clicking to see which websites I use, I just want to browse by scrolling.

<comment><USER12> Does something like [https://twofactorauth.org/data.json](https://twofactorauth.org/data.json) satisfy? It's not the most usable interface, but it should have all the data.

</comment></comment></comment><comment><USER13> There's a similar list for U2F (the USB / NFC dongles) support at [http://www.dongleauth.info/](http://www.dongleauth.info/) \- I'm not entirely sure how up to date it is

</comment><comment><USER14> I wish there was a service like this for IPv6. And I mean proper IPv6, and not the bullshit that for example Digital Ocean is peddling: 16 addresses per server my foot.

Also, proper HTTPS and HTTPS-only support. There are still way too many sites that offer HTTP as a valid option.

</comment><comment><USER15> It always wondered me why my bank can't offer my 2FA with SMS code, but Steam or Github can?

<comment><USER16> Why do you want the place that keeps all your money to support an unencrypted, unauthenticated, over-the-air token delivered by an insecure provider over an insecure protocol?

<comment><USER15> Because is still better than login + password?

</comment></comment></comment><comment><USER17> I see that Charles Schwab is listed as having 2-factor authentication via hardware token, and Citibank is listed as not having it. Both of these are only partially correct. For example, Charles Schwab allows it on their brokerage accounts, but if your company sets up your 401k with them, then it's not supported.

Citibank does support it, but only on their "Gold" accounts.

</comment><comment><USER18> I wonder about those banking sites.. my bank only lists hardware token. However, that internet bank is by default 2FA, because I need a password and code card which I possess and which they give out to every user. Not only for login I need some code from that card but also for each payment via internet bank.

<comment><USER12> If I'm understanding you correctly you're confused why only the hardware column is checked--is that right? That's, unfortunately, a common complaint. The columns _should_ correspond to only the second factor, with an assumption that username/password (a "knowledge" factor) is likely the first factor.

Some backstory on that decision: the site originally had columns for each 2fa company/product you could use; e.g., Google Authenticator, Authy, etc. Listing all the options was not scalable as the number of options grew, so twofactorauth.org went with a more abstract classification based on the second factor interaction. A few examples where that matters: * If you refuse to use an easily misplaced fob then you might avoid sites that only offer hardware 2fa. * Not everyone can receive SMS, but maybe they can download an app (software) or reuse their hardware token. * Some people prefer a voice call, so they might choose a bank that allows for 2fa-over-voice.

Hope this helps.

</comment></comment><comment><USER19> If you use Rails and want to integrate two factor auth into Devise, we built a gem / devise strategy for that: [https://github.com/tinfoil/devise-two- factor](https://github.com/tinfoil/devise-two-factor)

</comment><comment><USER20> 2FA is trivial to add.

[https://www.authy.com/](https://www.authy.com/)

Just do it.

<comment><USER21> Thanks for the reference. For end-users, they claim that their app will work on multiple devices whereas Google Authenticator only works on one. That would be a big advantage - I'm worried about losing my phone even with backup codes in my wallet. Worst case situation is that I'm robbed and have to hand over phone and wallet!

Also, I'm not aware of Google Authenticator being updated. Which makes me concerned that it's not a priority for Google and might be end-of-lifed.

<comment><USER22> Google Authenticator is a TOTP client. TOTP is an open spec.

If you use a different client, you can probably find one that will let you back up codes (I'm sure Authy supports TOTP). Also note that all you need for that backup is a "seed", which is a hash. IIRC Google Authenticator uses SQLite to store its data, I bet it's not hard to get the seeds out and back them up manually.

<comment><USER23> I wrote a program to extract the seeds out of the sqlite and back into QR codes for easy transfer. You are right it wasn't that hard: [https://github.com/solarkennedy/tfa_auth_dump](https://github.com/solarkennedy/tfa_auth_dump)

<comment><USER24> Do you need to root your phone in order to extract the sqlite database?

</comment></comment></comment></comment></comment><comment><USER25> Sticky table headers would be useful.

</comment><comment><USER26> Some interesting things:

1\. Banks and finance sites do not implement 2FA enough.

2\. All crypto sites have 2FA.

3\. No airline website has 2FA.

</comment><comment><USER27> The TOTP stuff will never be widly used. Its just a total pain to work with. SMS is also very suboptimal.

I have more hope for U2F as second factors go. That is at least easy to work with once you have bought the token. I find it a joy to use.

<comment><USER5> > The TOTP stuff will never be widly used. Its just a total pain to work with.

I'm not sure I agree with that.

Generating a code:

      <?php
      use ParagonIE\MuiltiFactor\Vendor\GoogleAuth;
      use ParagonIE\MultiFactor\OTP\TOTP;

      $seed = random_bytes(20);
      /** Then persist $seed into the database for a user **/

      $gauth = new GoogleAuth($seed, new TOTP());
      header("Content-Type: image/png");
      $gauth->makeQRCode();

Validating a code:

      <?php
      use ParagonIE\MuiltiFactor\Vendor\GoogleAuth;
      use ParagonIE\MultiFactor\OTP\TOTP;

      if (\password_verify($_POST['password'], $storedHash)) {
          $seed = /** Get seed from database for this user **/;
          $gauth = new GoogleAuth($seed, new TOTP());
          if ($gauth->validateCode($_POST['2facode'])) {
              // Login successful
          }
      }

Then you can just use the 2FA app of your choice (Authy, Google Authenticator, etc.), scan the QR code, and you're good to go.

<comment><USER27> I have implemented this before. I have it in production right now.

The fact is people hate typing stuff from their phone into their computer. Specially if you phone is not always within reaching distance. If you have to do it with tons of different logins you will be annoyed. As long as you have 1-2 accounts its fine, but if we really want to role it out everywhere, we need something better.

<comment><USER5> What are your thoughts about SQRL?

<comment><USER27> I don't know enougth about it. I have stumbled on it before, but I need to get into it.

</comment></comment></comment></comment></comment><comment><USER28> I think this really should also list which sites will let you download a series of tokens to use in case of mobile phone loss.

I recently forgot my phone at university and realized that I was potentially locked out of many websites.

</comment><comment><USER29> Still waiting on Amazon UK to enable two-factor authentication.

<comment><USER30> login on amazon.com, enable 2fa there. now 2fa is also active on amazon uk, and the option also appears in the settings.

stupid but works

<comment> gore90- Ah. I didn't know that. I just got it setup. Thanks.

</comment></comment></comment><comment><USER31> Thanks for posting this. Apparently some time in the last couple months (since the last time I checked) my bank added 2FA. Just went and activated it.

</comment><comment><USER32> Instagram does have 2FA...

<comment><USER33> Are you sure it's rolled out for everyone? I have been trying to find it (web & mobile app) for weeks and can't find it... I know there was a bunch of press about it in February 2016, but I don't see it in the UI.

<comment><USER32> I do have it since the beginning of 2016... I have 16k followers so it might explain the 1k+. It's in the options, right under "Posts You've Liked".

</comment></comment></comment><comment><USER34> Soon will be scraped/exported to a Google docs I hope

<comment><USER35> It's open source: [https://github.com/2factorauth/twofactorauth](https://github.com/2factorauth/twofactorauth)

</comment></comment><comment><USER36> JS required? For a list? Seems rather excessive.

<comment><USER37> Honestly! The nerve of that webmaster!

</comment></comment><comment><USER38> Your site works with neither Vimium, NoScript or adblockers, so I can't use it.

<comment><USER39>
      s/can't/won't

Not saying you don't have a valid complaint, but let's not forget what _can 't_ means.</comment></comment>


What every programmer should know about memory, Part 1 - <AUTHOR> http://lwn.net/SubscriberLink/250967/c21a2a4bd99e2a7d/

<comment><USER2> Good god. Not that it isn't interesting, but how is understanding capacitor timings supposed to make you a better programmer? Good article, poor title.

<comment><USER3> @dfranke: Does this Aaron Swartz post answer your question? <http://www.aaronsw.com/weblog/smartabstractions>

<comment><USER2> I agree with Aaron, but I don't think he'd go this far. Programmers concerned with performance need to understand caching and the cost of a cache miss. That's about on the same level as PB and his read heads. The level of detail in this article goes well beyond that and is unnecessary.

</comment></comment></comment><comment><USER4> Ulrich Drepper, you rule!

Really looking forward to the next 6 parts of this series.

</comment><comment><USER5> Hmm, that's a subscriber only article ?

<comment><USER6> No.</comment></comment>


Ask HN: Tools of the trade - <AUTHOR> I know, half the year is over already. But there was no "tools of the trade" thread yet. In the past I enjoyed those and I think it's also interesting in a historical context to have them once a year.
So I rolled up my sleeves and made an account to start one :)
What are the tools that you use nowadays? <comment><USER3> Mine:

      Windows Server
      ASP.NET
      Github Desktop
      SVN
      Visual Studio
      Brackets - awesome text editor with
        JavaScript syntax checking
        and undefined variable checking
      Jenkins
      Octopus Deploy
      Stripe.com
      Red Gate SQL Source Control
      Keen.io - not affiliated
        but wanted to plug since has been coolest thing recently
        awesome, easy analytics (paid but
        free plan has 50k events/mo and
        we've stayed under that so far)

</comment><comment><USER4> My tools changed quite a bit this year. I am using:

      emacs
      textmate2
      R
      python / pandas
      jupyter notebooks (python, R, julia kernels)
      c++
      Clojure
      Common Lisp

      linux on the server
      os x on my laptop
      ipad / prompt2 / pythonista / bluetooth keyboard

Almost all of my serious work is being done in either R or python right now, which is a big change from using more proprietary tools like SAS, Stata, and Matlab.

I think I might have been the last person on the planet to figure out that an iPad with a bluetooth keyboard in a coffee shop or library is a very productive work setup and that I do not need to lug my laptop everywhere.

We are living in a fantastic era and I just cannot believe the amazing free tools that are available for things like network analysis (NetworkX) and spatial visualization (ggmap).

</comment><comment><USER5> I am essentially using:

      *Development*:
      URxvt-unicode
      vim on Linux
      Sublime Text 3 on Windows
      Python (and a lot of libs, mainly, requests, Flask, AutobahnPython, Twisted)
      Rust (my new shiny tool)
      C/C++ (sometimes, but I try to avoid it)
      Frontend JavaScript (It has been a long time since I've written some ES5, I write only ES6 thanks to Babel)
      Node.js
      Webpack
      React.js
      Crossbar.io
      Git + GitHub
      Zsh (prezto framework)
      Fish (on servers sometimes)
      tmux (a.k.a the productivity booster)
      virtualenvwrapper (must-have for Python & virtualenv)
      nvm (must-have for Node.js & NPM)
      rvm (must-have for Ruby)
      fasd (when cd isn't enough, j somewhere)

      *Fonts*:
      Monoid whenever I can.
      Source Code Pro.
      Else, whatever can do the job.

      *OSes*:
      Debian on Server
      Archlinux, Debian, Windows 7 on laptop (1st, fallback on others...)
      I try to use the most appropriated OS for containers (Docker)

      *Services*:
      PostgreSQL OR RethinkDB whenever I can. SQLite when I can't.
      Redis
      Docker (+ dockercli)
      Docker-Compose
      nginx

      *SaaS*:
      Slack
      Inbox
      TweetDeck
      Asana
      Hacker News (the worst one :c)

</comment><comment><USER6> When my startup was <10 people, I used Vim and Git a whole heck of a lot.

Now that we're almost 140 people, I mostly use Gmail, Google Calendar, Sublime Text and Evernote, and Google Hangouts for engineering meetings. But, a lot of those people are using Vim and Git, so it's not all bad. :-)

Of course, we all use Anaconda Python.

Oh, and I read a whole lot less Hacker News.

</comment><comment><USER7> Some of mine:

      JetBrains' WebStorm
      Node.js
      MongoDB
      Redis
      MySQL
      MyCLI
      Git
      GitLab (Hosted and Self-Hosted)
      Gulp
      FireBug
      Trello
      Slack
      CircleCI or Travis, depending on the project
      WakaTime

I'm sure I'll find some more that I missed on my own list as well.

</comment><comment><USER8> I made a toolbox which includes tools from "Tools of the trade"/"Show HN". Glad to hear suggestions on how to make it (more) useful.

[http://www.hackertoolbox.com/](http://www.hackertoolbox.com/)

</comment><comment><AUTHOR> Ok, let me make a start. This is what I use:

        Debian
        Apache
        MySql
        PHP
        VIM
        99designs
        Upwork
        GitHub
        webpagetest.org
        Google PagespeedInsights
        Google Analytics

</comment><comment><USER9> Haskell for large things

Ruby for small things

Java to earn a living (with a bit of Ruby here and there)

(I'm currently evaluating Kotlin and Javascript as well)

.

OpenBSD on the server

Ubuntu for developing

.

Android Studio (IntelliJ) for Java

Atom with Vim Mode (and a thousand other plugins that turn it into an OS similar to how I imagine emacs) for everything else

.

Github

</comment><comment><USER10> Vim Perl Bash make Go vim-go plugin Chrome Developer Tools libsass uglifyjs homebrew redis postgresql Gimp Dropbox Google Docs Google Calendar Trello Slack bitbucket.org startssl

</comment><comment><USER11> I use:

      vim on Darwin.
      javascript es6.
      chrome canary
      chromestatus.com
      chrome apps apis.
      gae
      managed vm
      docker
      gce
      python
      brain

</comment><comment><USER12> Ubuntu VIM Git Chef / Mina Rails / Django React / jQuery Digital Ocean Freckle Asana

Various APIs including Twilio, Stripe, MusicBrainz, Amazon, Shopify.

That's most of my professional and/or serious side projects, and then I dabble in other stacks when I can. Clojure lately.

</comment><comment><USER13> Search HN for previous years' 'Tools of the Trade' gems:

[https://hn.algolia.com/?q=%22Tools+of+the+Trade%22](https://hn.algolia.com/?q=%22Tools+of+the+Trade%22)

</comment><comment><USER14> [https://github.com/cjbarber/ToolsOfTheTrade](https://github.com/cjbarber/ToolsOfTheTrade)

Last merge was 2 months ago but it has 32 outstanding PRs so maybe he abandoned it.

</comment><comment><USER15>
      Sublime Text
      LinqPad
      VS 2012
      SQLServer 2008
      SVN
      Windows 7

</comment><comment><USER16>
      terminator/iTerm
      vagrant
      travis
      tmux
      Twisted
      ELK

</comment><comment><USER17> I'm mainly focused on web apps so:

VS Online/Visual Studio, Adobe Brackets, Git

C#: IIS, ASP.NET, Node.js JavaScript: vanilla, jquery, Knockout.js

The modern browser matrix & related built-in "dev tools"

</comment><comment><USER18> Google Docs, OneNote, HipChat, Jira, TerminalOne, TapAnalytics

</comment><comment><USER19> Slate

Vim

Vimium w/ Chrome

IntelliJ

Docker

Redis

MySQL

Elasticsearch

Slack

GoTo Metting

Jira

Confluence

Git

GitHub

</comment><comment><USER20> Well, I guess I'll go from the ground up in each category.

\---

For development machines, I have a company-supplied Macbook Air for work and a variety of laptops and desktops that I use for personal things. The Macbook runs OS X Yosemite. My personal machines almost invariably run GNU/Linux (I've been especially fond of Slackware lately) or OpenBSD. My primary rig has a 122-key Unicomp Model M keyboard and a Logitech M570 trackball mouse, along with two monitors (one 1680x1050, one 1440x900); my desk at work has a 2560x1440 Thunderbolt display, connected to one USB port of which are a Logitech K570 solar-powered keyboard (Mac model) and a Logitech M570 trackball mouse (I really do love these trackball mice).

My primary editor as of late is Emacs. My workflow revolves heavily around fiplr for fuzzy-searching and Magit for git repo management (on Linux / OpenBSD, at least; on OS X I use GitX).

Git is currently my VCS of choice, though this is more out of necessity (since the vast majority of the projects I work on are hosted on GitHub, be they public or private repos; I use Bitbucket somewhat as well, so I've been looking a little bit into Mercurial lately, but I've yet to really use it for real work).

My dayjob revolves around Ruby on Rails programming. As a result, common Ruby- related tools (in addition to, of course, Ruby itself) - particularly RVM and globally-installed versions of Bundler, gemr, and Rails 4 (mostly for the various generators, though I don't really use those a whole lot) - <USER2> installed on most of my machines, including the Macbook. My job is more geared toward system administration and backend programming, so I've yet to explicitly install common frontend-development tools (like Node, bower, grunt, etc.) on very many of my machines, but I do have them installed on the Macbook as a precaution.

When it comes to building personal projects, my go-to languages have been Ruby (without Rails; I'm more a Sinatra/Padrino fan) and Elixir (recently with Sugar, which I find to be much friendlier to use than Phoenix). I maintain some private Erlang and Elixir Slackbuilds to that effect in order to track the latest versions of both on my Slackware machines (the Erlang on Slackbuilds.org tends to be slow to update, and AFAIK there's no Elixir Slackbuild at all yet); I've yet to publish them, but probably will in time. I've previously used a lot of Perl in my projects, but other than CPAN, I rarely use any Perl-specific tooling.

For databases, SQLite and PostgreSQL are my go-tos; I stay clear of NoSQL databases (except perhaps CouchDB or Mnesia), since I don't feel that they offer anything compelling over Postgres for my needs.

When it comes to the minimal frontend work I do, I generally steer clear of Javascript; when I do need to delve into JS, I've found Mootools to be nice for my uses. I've been using Yahoo's "Pure" CSS framework for things like menu bars and grids, and I've been quite happy with it so far.

\---

Going into servers, my software stack tends to stick to Slackware or OpenBSD. My mail server runs OpenBSD with OpenSMTPD and a mail pipeline that includes SpamAssassin, spamd, and ClamAV. Meanwhile, for web servers, I generally go with either Nginx or OpenBSD's httpd (depending on whether the server runs Slackware or OpenBSD), along with PostgreSQL and one or more language runtimes (usually Ruby, Elixir, or Perl, inclusively, as described above). I don't really use any sort of config management system (like Chef or Puppet) on my personal servers; I prefer to configure them individually, using Emacs' TRAMP to edit configuration files over SSH.

\---

I do some general electronics repair, too, on my free time. I thus carry around a physical toolbox in my truck with at least basic tools and parts (screwdrivers (particularly my really nice ratcheting screwdriver with a bunch of electronics-specific bits), spare USB/ethernet/power/SATA/etc. cables, wire strippers, soldering iron w/ solder, electrical tape, duct tape, crimpers, spare RJ-45 connectors, heatshrink tubing, zip ties for cable management, anti-static strap, multimeter, some spare PCI peripherals (including a spare dial-up modem card; you never know when you need to fix someone's dial-up), extra keyboards and mice, bag of spare jumpers, spare flashlight (in addition to the one in my glovebox), some sticks of DDR and DDR2 RAM, various AV cables, speaker wire, the works). I have a more thorough superset at home, and a thinner subset at work.

\---

... I think that about covers everything.</comment>


Three large coronal holes 31st July – first August - <AUTHOR> https://www.swpc.noaa.gov <comment><USER2> You can see liveish images of the surface of the sun at multiple wavelengths here [https://umbra.nascom.nasa.gov/images/](https://umbra.nascom.nasa.gov/images/).

<comment><USER3> Are those moving or is it illusory motion? It's driving me nuts.

<comment><USER4> Yes.

</comment></comment></comment><comment><USER5> Got a lot of calls today about phones being down, went to down detector and our phone provider (TDS) had a spike at around 10 AM, Verizon also had a spike. Could this solar activity have caused this?

<comment><USER6> Anecdote #1 - DSL went down for me at about the same time...local loop is fine, issue appears to be downstream somewhere.

<comment><USER7> I think that you would see a lot of fun and games in the electrical network if space weather were bad enough to kick over local loop dsl. I'd have bought into the idea of national scale copper transmission being susceptible, but now that's all long gone and just glass so we're talking a few km of fairly thin and mostly buried conductors. Power transmission - that's a different thing!

</comment></comment></comment><comment><USER8> Is this a prediction?</comment>


Belkin replies to Mechanical Turk shilling - <AUTHOR> http://www.crunchgear.com/2009/01/18/belkin-replies-to-mechanical-turk-shilling/

<comment><USER2> > Belkin's President: "So, it was with great surprise and dismay when we > discovered that one of our employees may have posted a number of queries on > the Amazon Mechanical Turk website inviting users to post positive reviews > of Belkin products in exchange for payment."

But how do I trust them enough to know that he's telling the truth?

<comment><USER3> You can't, but not everything is a big conspiracy. He very likely is embarrassed.

<comment><USER4> embarrassed to be found out maybe?

</comment></comment></comment><comment><USER5> What's missing from the response is that they took action to fire the person responsible.

I read the response: it's wrapped into a lot of nice, vague, non-specific, non-binding stuff. It's well written by a PR department and may fool the average joe.

<http://fairsoftware.net>: where geeks are their own boss

<comment><USER6> most likely the president was the person responsible. He's just publicly admitting guilt.</comment></comment>


Preventing mission creep in your (MVC) Views, or, ignorance is bliss - <AUTHOR> http://clipperhouse.com/blog/post/Preventing-mission-creep-in-your-Views-or-ignorance-is-bliss.aspx

<comment><USER2> It may be that I am working with a small sample size, but giving the full freedom of Java as in jsp's to view writers leads to horrible code. The logic is a tangle and the pages are nearly unreadable, due to the differing layout needs of Java and HTML. A more feature poor markup language that forces the developer to move business logic into the model will produce cleaner pages and cleaner logic. An added benefit, as the author notes, is that producing new views, like mobile, is a snap.</comment>


Ask HN: Why are SpaceX's smaller space missiles being launched? - <AUTHOR>

The Falcon costs ~3 times more than the Falcon Heavy per Kg of mass, so why not combine several Falcon launches to one Falcon Heavy? <comment><USER2> because the Falcon Heavy isn't out of development yet.

And because it relies on the Falcon for parts. So getting the Falcon running perfectly is first priority.

And because not every payload will make sense for a Falcon Heavy, there will probably still be a logistical need for a smaller rocket.

And last but not least, the Falcon price will probably come down once they get the re-landing legs working.

<comment><USER3> And finally, because it would require payloads that are all destined for roughly the same orbits.

<comment><AUTHOR> Ah, now this makes sense. Should have thought about that... Thanks :)</comment></comment></comment>


85,000-year-old Finger Bone Complicates Understanding of African Migration - <AUTHOR> https://www.smithsonianmag.com/science-nature/rare-85000-year-old-finger-bone-could-complicate-our-understanding-african-migration-180968720/?no-ist <comment><USER2> Not to be that guy, but I'm really starting to question the accuracy of dating techniques when they publish finds like this.

This finding is only significant because of the age, but have we ever verified our dating techniques over 5k years? 10k years? What's to say that the hot desert sun and strange weather patterns, radiation or whatever couldn't skew the dating and mean this bone is just some traveller from a mere 1-2k years ago.

It seems further unlikely that such a bone from, 85k y/ago as they say, would be so close to the surface.

Ftn In mechanical engineering we don't ever "trust" the calculations until they are thoroughly validated with ie strain gauges. And more often than not we discover our assumptions were wrong. So I suppose a similar thing applies here in dating science, except, it's impossible to validate for another thousand centuries. It seems backwards to hinge all our science on it when (AFAICT) it hasn't even been validated itself!

<comment><USER3> > but have we ever verified our dating techniques over 5k years? 10k years?

Yes.

> What's to say that the hot desert sun and strange weather patterns, > radiation or whatever couldn't skew the dating

Lots. For a start - only one of those would possibly affect the outcome of testing and would _also_ be detectable.

> It seems further unlikely that such a bone from, 85k y/ago as they say, > would be so close to the surface

Your incredulity doesn't affect the outcome one way or another and unless you want to dispute the fact that artifacts that are _much older_ are _often_ found on or close to the surface it's not based in any way to the real world.

> In mechanical engineering we don't ever "trust" the calculations until they > are thoroughly validated

And neither does the science around these dating techniques. In fact they're usually better supported than _any_ engineering is.

> It seems backwards to hinge all our science on it when (AFAICT) it hasn't > even been validated itself!

And here's the thing: You're incredibly misinformed and that's why it makes no sense to you.

<comment><USER4> > And neither does the science around these dating techniques. In fact they're > usually better supported than any engineering is.

Given that the results of most if not all engineering can be directly tested, this seems unlikely.

<comment><USER5> I believe his point is that these methods are contentious for various reasons (religious objection being an example) so they have been heavily scrutinized and where exceptions have been found so have explanations. While most engineering doesn't receive the same level of attention, even if it could.

</comment></comment></comment></comment><comment><USER6> Not to be excessively cynical or downright insulting, (also, my knowledge of archaeology is feeble) but is there any way to verify that they found the bones there in the desert?

> The discovery is "a dream come true, because it supports arguments that our > teams have been making for more than 10 years,"

Ten years of debate could be motive enough for some people to fabricate the finding.

EDIT: All that aside, assuming it is legitimate and we can trust the discovery, I definitely agree an absolutely phenomenal discovery

<comment><USER7> "Finding a human bone in the Nefud Desert—a windswept oval patch of sand dunes the size of Kentucky—is perhaps the world's most impressive example of an unlikely find"

I wonder how you can test that a fossil wasn't just discovered elsewhere and moved to a convenient place, if the ground composition is sufficiently similar

<comment><USER8> Can't they do destructive testing of a part of the fossil using some isotope with a longer half life than carbon 14? It's described as being in a field of bones sticking out of sand so it's the only possible way it could have been accurately dated - no surrounding sedimentary rock formation to do additional testing upon.

<comment><USER7> Does this address the problem of knowing if the bones were moved?

<comment><USER9> A nearby hippo bone was also tested. It seems rather unlikely that a human bone and a hippo bone of similar age would have been stumbled across somewhere else compared to this site which appears to be a dried up body of water.

</comment></comment></comment></comment></comment><comment><USER10> This seems likely as there are increasing findings of human activity that go much before 60,000 around the world. One that recently comes to mind is a sight in Cambodia where there are traces of human activity dated around 71,000 years ago. ([https://phnompenhpost.com/national-post-depth/peeling- back-l...](https://phnompenhpost.com/national-post-depth/peeling-back-layers- prehistory-battambang))

</comment><comment><USER11> What if the bone was left there? Say by a bird? Or another human. It's a single small hand bone. It feels fair to question how else it might have arrived at where it was found.

<comment><USER12> So much of paleontology is wild-ass guesses extrapolated out from miniscule, fragmentary evidence. In any other field, it'd be wildly irresponsible to generalize in such fashion on such slim evidence.

</comment></comment><comment><USER13> It's worrying to see research into land migration hypothesis is itself becoming extremely difficult to confirm; I wonder whether the southern exit hypothesis (crossing red sea) or other water-route migrations would see new facts soon.

</comment><comment><USER14> Could someone have moved it 45000 years ago as a joke like how Tesla launched a car for the aliens to scratch their heads in perpetuity?

<comment><USER15> They are not dating the bone, they are dating the mud around the bone. To be more precise, they are dating the last time the mud around the bone received sunlight. (And from the patterns in the mud they are sure that nobody dig a hole at midnight to put the bone there.)

<comment><USER9> They also dated the bone.

</comment></comment></comment><comment><USER16> or, "Remnants of Prehistoric Adam's Family Production Gives The Finger To Paleontologists"

</comment><comment><USER17> Where's the rest of the skeleton?</comment>


Ask HN: What to do with monthly Azure credits? - <AUTHOR>

Hi,
I have a MSDN Ultimate subscription that comes with ~€110 per month of Azure credits. Right now I don't have any projects yet that I can host on Azure, but I really love Azure and I'd love to put those resources to good use.
Does anyone have some good ideas for things that I can run? €110/month is enough for around 10 servers. <comment><USER2> If you want to try out SQL Server 2012 R2 or 2014 without having to install it, there are pre-built images to run, also Oracle database and Weblogic. Useful for testing support of an application on those dbs/servers.

</comment><comment><USER3> Some ideas:

\- Virtual currency mining

\- personal VPN/proxy

\- email/chat server

\- minecraft server (not sure about the performance)

</comment><comment><USER4> Run ownCloud.</comment>


KissInsights is now Qualaroo - <AUTHOR> http://qualaroo.com/ <comment><USER2> Probably because it is a bit too close in name to KissMetrics? KissInsights was sold to another company a year ago?

</comment><comment><USER3> Why?</comment>


Ask HN: B2B reward programs? - <AUTHOR>

Hi HN,
Pretty soon the fashion start-up I work at is going to have a bunch of retail leads available to us at an event we're hosting.
I want to make a retailer plus program with incentives for stocking our brand. Does anyone have any experience with this sort of things, or ideas? <comment><USER2> My co-founder has fashion marketing experience, I've emailed you an introduction as well as some other marketing ideas.</comment>


Mongoose OS – An Open Source Operating System for the Internet of Things - <AUTHOR> https://mongoose-os.com/ <comment><USER2> > Prototyping and Scripting Engine

> Micropython Moving to production (C/C++) or factoring out critical pieces to > C/C++ is not trivial

VS.

> mJS - JavaScript engine for prototyping and C/C++ for production

I don't know much about it, but from the surface it seems that the problem is exactly the same? What is the benefit of prototyping in JS instead of Python? In the end, either you refactor everything purely in C, or you use both in your production system.

I see mJS does FFI to interface with other C routines. Why introduce a second language to your project? This seems like a huge overhead for no benefit (you're still expected to write C at some point). The language is only a subset of JS, so "not JS", so no ecosystem and new assumptions you have to redefine before getting serious with it?

Is it just me who thinks it's a bad idea? Would someone be able to explain the advantage of going in this direction?

<comment><USER3> Speaking from experience, using MicroPython is trivial and often "good enough", as are implementing modules for MicroPython in C should they be needed (C isn't my first language by a long shot, but I managed to write a module for MicroPython with little problem).

Also, MicroPython has pretty much all the features of core Python whereas mJS appears to have pretty much all the useful features of JS removed. Why not just use C instead of mJS?

Finally, couching Mongoose in a way that criticises the efforts of others is a bit of a turn off for me. Give me positive reasons for using your product rather than bashing the people you believe are your competitors. The culture and community of a project is important - negativity such as this is a worrying signal.

<comment><USER4> > Why not just use C instead of mJS?

Perhaps mjs has a repl? Don't really know, but that would be the only real advantage imo.

</comment></comment></comment><comment><USER5> > GPLv2 license: FREE FOR NON-COMMERCIAL USE

This confuses me, the GPLv2 doesn't say anything about commercial use, it merely says that you need to redistribute the source code to anyone that you distribute your software to.

Have they placed additional restrictions on the GPL (which I believe you are prohibited from doing)? or are they just trying to highlight that they are dual-licensing it under a license that isn't copyleft if you pay them (since lots of companies have no-gpl policies)?

<comment><USER6> GPL does not allow static binaries from both GPLed code and commercial code.

A workaround is a plugin mechanism with dynamic loading of .dll or .so libraries. But that won't fly on a microcontroller.

<comment><USER7> .dll won't help with GPL, only with LGPL (IANAL)

<comment><USER8> I think you have it backwards, if I am interpreting your very brief statement fully correctly...

If you are building a library and you want it to be open source but also usable by products that are not open source, you can use LGPL. If you are building a proprietary library and you want to keep it proprietary, but link it into a GPL application, I _think_ there is nothing is stopping you from doing that.

You still have an open-source application, it just won't work without the proprietary library.

(This sounds like it should be against the letter of the GPL, but as a thought experiment, pretend someone else wrote the library. Say, Nvidia, and you are Linus. You have no control over how their library gets licensed, and there is no person or body which can stop you from releasing your own code as GPL, even if it may have branches that depend on proprietary code.)

Doing OSS this way is most certainly against the spirit of the GPL, but I think it is within the letter.

<comment><USER9> You read the previous statement backwards. OP meant: dynamic linking allows you to use LGPL libraries with proprietary applications; to use GPL libraries in your application you have to make your application free even if you are linking dynamically.

<comment><USER8> Yes, but neither one prevents you from linking proprietary libraries into your OSS application.

> .dll won't help with GPL, only with LGPL (IANAL)

Was pretty much totally ambiguous about what exactly was meant.

<comment><USER8> Am I wrong?

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> > FEATURED COMMUNITY PROJECTS

> Door bell - ESP32, AWS IoT

> Door sensor - ESP32, MC-38, AWS IoT/MQTT, SNS

> Smart heater on AWS IoT

> IoT doorbell that works via MQTT - generic MQTT server, AWS IoT, Google IoT, > etc

Why the hell would I want my door bell be controlled via MQTT on AWS?

<comment><USER11> It's not on AWS but runs on a local raspberry pi, but my doorbell signals via MQTT that someone ringed. This makes my security camera take a picture and sends a push notification to a custom made iOS app which shows who's in front of the door on my apple watch. If I'm logged in my home wifi, I can even open the door with a button directly from this notification. I would argue that I'm not the only one who finds that useful.

<comment><USER12> Is "signalizes" a word? Did you mean "signals"?

<comment><USER11> Thanks, I've corrected it.

</comment></comment></comment></comment><comment><USER13> You had me until the "Pricing" section.

The Old Way - Varies, depends on many factors. Requires ongoing investments, hiring developers or integrators

The New Way - GPLv2 license: FREE FOR NON-COMMERCIAL USE / Commercial License: CONTACT US

So with Mongoose OS, you don't have to invest, or hire developers? Am I being unfair by thinking that, while the other points make life easier, this is scraping the barrel a bit?

Why not just say "and the price which gets you all of these advantages is.." ?

<comment><USER14> Are you annoyed that they're selling commercial exceptions to the GPL or that they're not listing the price on the page?

<comment><USER15> The latter. Just give me an idea of the order of magnitude of the price. Is a commercial license closer to $1000 or $100,000?

</comment></comment></comment><comment><USER16> Bit of a confusing name, when there is already an extremely popular mongodb node.js framework called Mongoose

<comment><USER5> Also confusing as there is a small mammal that eats snakes called mongoose.

<comment> rena-anju Also confusing when there is a vehicle in the Halo series called Mongoose. Confusing, confusing...

</comment></comment></comment><comment><USER17> I really fail to see what this brings to the table.

In the section on their main page contrasting with arduino, they bascailly just say that they're more reliable, with nothing to really back that up.

Looking at their documentation, I don't really see how they can make that claim. The issues with Arduino's reliability stems, IMO, from the fact that Arduino code isn't an RTOS. Ie. there's no separation of real time priorities. This also seems to not really be an RTOS either, just a fancy bare metal environment.

What is this structurally bringing to the table beyond Arduino other than "we think we wrote the code better"?

<comment><USER18> I'm thinking about using Mongoose for a future project (as opposed to Arduino IDE or the ESP SDK directly) I think the advantages are:

Security: TLS 1.2, x509 certificates, ability to stop random people from flashing your board)

Remote management: OTA process doesn't seem that different from other methods, but they have some other nice things. For example they make it really easy to separate your code from your configuration.

<comment><USER17> > ability to stop random people from flashing your board

That part in particular seems like a really bold assumption.

<comment><USER18> I haven't read over their encryption code, but even if it's not enough to stop a determined hacker it's still better than nothing.

</comment></comment></comment></comment><comment><USER19> "The old way: Micropython" <\-- what? really? old, already? They're just getting warmed up, baby.

<comment><USER20> Damn right. Mid level python dev in my team builds Django views on one screen and programs the embedded micropython board that sits on the drill in the pit on the other, all while cajoling with his millennial tribesman in the chat app du jour. Can't beat that.

</comment></comment><comment><USER21> But why Javascript? Clearly another hype-driven project. Please, use reason not hype when deciding on technology. This is fast food

<comment><USER22> Is it not reasonable that any Joe Schmo can easily build both front end UI's and servers with one of the most adopted languages?

<comment><USER23> I'm reminded of earlier efforts using Firefox OS which sought to create a "Web of Things". I'd didn't get around to backing the Runcible project but watching Aubrey's video below, I hope it succeeds.

[http://janos.io/](http://janos.io/) [https://www.youtube.com/watch?v=0qgIObR6jGs](https://www.youtube.com/watch?v=0qgIObR6jGs) [http://mono.hm/](http://mono.hm/)

</comment></comment></comment><comment><USER24> If you're considering embedded OS options, please look at these two (completely free) projects from the Linux Foundation:

Yocto project creates a custom embedded distro based on your needs [https://www.yoctoproject.org/](https://www.yoctoproject.org/)

Zephyr supports hardware that can't easily run Linux [https://www.zephyrproject.org/](https://www.zephyrproject.org/)

<comment><USER25> Sure, try to run those on e.g. TI CC3200 microcontroller.

<comment><USER26> Yocto does not seem to support CC3200.

<comment><USER25> That's right, cause Linux cannot run on the large class of microcontrollers - particularly, those with less than 4M of RAM. Mongoose OS is targeting that category.

<comment><USER24> Zephyr is an open source OS that targets smaller microcontrollers.

</comment></comment></comment></comment></comment><comment><USER27> A recent tweet that I found funny - "Every time a conf organizer accepts a talk about #IoT using JavaScript ... somewhere in the world an IoT/embedded developer ... dies !"[1].

On a serious note though - Does anyone know a mass manufactured product (based on a uController) that actually uses anything other than C/C++?

Rust is a strong contender too, surprised to not see it mentioned here. See an older discussion about Rust on ARM Cortex M[2]

1\. [https://twitter.com/ppatierno/status/894575063562936321](https://twitter.com/ppatierno/status/894575063562936321) 2\. [https://news.ycombinator.com/item?id=14071282](https://news.ycombinator.com/item?id=14071282)

<comment><USER28> "On a serious note though - Does anyone know a mass manufactured product (based on a uController) that actually uses anything other than C/C++?"

None that I know of, but ESP8266 and similar MCUs are so widespread that probably there are lots of products using say nodemcu (ESP+Lua scripting) under the hood. [http://nodemcu.com/index_en.html](http://nodemcu.com/index_en.html)

Wifimcu is a similar product but uses a STM32F4 MCU. [http://www.wifimcu.com/](http://www.wifimcu.com/)

I would personally love to see more use of Nim in this field; it just seem the right tool for the job for being easy to learn, small, fast and powerful.

</comment></comment><comment><USER29> Does the world need another open source operating system for the internet of things? I wonder if creating a new one was really necessary or if they could have built on top of one that already exists.

While I can't say I know intimately all the problems that need to be solved for IoT to responsibly reach mass consumption, but I'm pretty sure having an operating system wasn't the problem. Maybe this is just an enterprise cash grab?

<comment><USER30> It's definitely not a cash grab as the project is open source. There are many problems in this space that cannot be served using current solution, especially in environments that are super resource constrained. For example, this is made to run on a very small footprint of RAM, even smaller than what an embedded Linux distro would use.

</comment></comment><comment><USER31> Written in C so we can continue enjoying IoT devices being exploited by buffer overflows.

</comment><comment><AUTHOR> If I wanted to make something that (say) reports sensor readings over MQTT to AWS IoT, what firmware options are there? NodeMCU looked great (Lua!) but doesn't seem to support X509 client certificates (which AWS needs). There's Arduino, Mongoose, Micropython - any others? What's the best way to go?

</comment><comment><USER32> It's sad that _security_ isn't one of the homepage sell points of this OS. It feels like IoT is severly in need of serious "security by design". OS level would be a good start.

<comment><USER30> Security is actually one of the most important pieces of this puzzle and the team is one of the team's top priorities. Agreed it would be good to talk more about that on the homepage and everything that is being done in that respect. Mongoose is actually one of the first embedded platforms that support AWS IOT and X509 across multiple architectures

<comment><USER33> I fail to see how when C is part of the tooling.

</comment></comment></comment><comment><USER34> Unfortunately the documentation is lacking and mJS (especially the ffi) is nowehere near production ready

</comment><comment><USER35> Why don't more people use FreeRTOS? I always find it to be a nice way to coordinate all the tasks you need to run in an embedded system, without having to manage a huge kernel like Linux. It's also free so there's that...

<comment><USER30> This is based off of freertos

<comment><USER35> Is it? I looked all over the site and don't see any mentions of "FreeRTOS", "RTOS", "real time", "tasks", or anything else that would indicate it's based off of FreeRTOS.

</comment></comment></comment><comment><USER30> Okay, so lots of comments on here and most of them are just plain wrong, FUD or stem from simple misunderstanding. Also, lots of people not groking the value proposition. Let me take a crack at clarifying some key points.

So first off, the project is GPLv2 whether you use it for commercial or non- commercial use. The team's first language is not English, they are actually Russian and based out of Ireland, so there is bound to be some confusion. What they were basically trying to say with that, is if you need the extra features and the backend, etc. Those are not GPLv2 but the project itself is--no matter how you use it--is. I mentioned it to them team and they already corrected the site.

Second, the value proposition behind this is tremendous. Remember the days before Unix and DOS/Windows ran on every machine in the world? Every machine had its own design, its own arch/cpu, its own OS, and its own interfaces. Computing was cool, but each machine was really an island. If you wanted to run your code on another machine then you had to port it over. Then Unix and CP/M-80/DOS came along and you could write something on one machine and it ran (almost) on anything with the same OS. Thats the name of the game here. This is groundbreaking for embedded/IOT development.

Real embedded development is hard enough as it is. If you're doing a one off project for something in your home, then its pretty straightforward. Now try and take that to a mass production-scale product and the level of complexity is increased 50x.

Imagine trying to bring a product to market, you need to pick a hardware platform/MCU to build with. Now imagine your suppliers hit a chip shortage and you can't use that chip, what do you? Sit back and wait for 6 months? What Mongoose OS allows you to do is write your code once and run it on multiple embedded platforms, you would just select another MCU, maybe make some minor modification to the pinouts, flash the firmware and BAM, you are back in business. Not to mention the fact that you have standard interfaces across all devices, MCUs, etc. It just makes development so much simpler.

Not only that, but you now have to manage potentially hundreds of thousands of devices (or millions if your product is really successful). What do you? How do you handle firmware updates? How do you track status of all those devices? How do you do customer support without a debug interface, well the enterprise offering (or something like AWS IOT) will help you manage that process and make your life a whole lot easier.

Now on the topic of why mJS vs. Python and a mix of C. You have to understand that embedded development is often _EXTREMELY_ resource constrained. mJS fits into ~25K of flash space and less than 1K of RAM. This is awesome. It affords you the smallest possible functionality with the greatest possible flexibility. Write your logic in js and then call C for anything more critical/performance.

I asked one of the team members and basically what he said was (I paraphrase) that mixing C with a scripting language is a pretty production ready solution. Obviously its preferable to write the critical pieces in C and then the higher level logic in the higher level language. It would be ideal if you could have type safety and compile-time checks in the high-level language. The ideal language to write logic in would be Go, and Go 2 promises to have a smaller runtime/footprint so hopefully one day that will be a possibility.

In terms of everyone else talking about how the project is positioning itself, well let's just say that marketing is a work in progress ;)

<comment><USER36> > mJS fits into ~25K of flash space and less than 1K of RAM. This is awesome. > It affords you the smallest possible functionality with the greatest > possible flexibility.

I agree, but having said that, I have been trying to use Mongoose on the CC3200 and it is very difficult with Mongoose and mJS. Mongoose with mJS occupies upwards of 225K of flash, and the CC3200 only has 256KB of RAM (and the program must be loaded into RAM to execute). Plus I believe you lose another 16K to the Mongoose bootloader.

But this is more of a problem with the CC3200, admittedly; 256KB of RAM isn't great for an internet-connected device.

<comment><USER30> yes the cc3200 is a difficult platform to deal with, but one that is very popular due to the proliferation of the boards, the excellent battery life capabilities and the number of inbuilt sensors. The support for it isn't totally baked yet, at last as far as my last go-round with it, but it is being actively worked on.

</comment></comment></comment><comment> m-p-3 Interesting, I'll have to look into it when I build some prototype (just a personal hobby-type of project) with my ESP8266.

</comment><comment><USER37> "Better. Cheaper^. Faster"

^ Contact us for pricing</comment>


Too Minty? - <AUTHOR> http://vukicevic.blogspot.com/2009/09/too-minty.html Intuit is taking a $170 Million gamble on Mint's greatest opportunity and greatest threat. <comment><USER2> From Mint's Privacy Policy:

 _Personal information may be transferred to a third party as a result of a sale, acquisition, merger, reorganization or other transfer (a "Transfer") involving Mint. Mint specifically reserves the right to transfer personal information to a third party in connection with a Transfer. Should such a Transfer occur, we will use our best efforts to require that the new combined entity follow this Privacy and Security Policy with respect to your personal information, as and to the extent required by applicable law and to require that you receive prior notice if your personal information could be used contrary to this Policy._

Looks like they left a loophole open...

<comment><AUTHOR> That's a scary loophole...</comment></comment>


Synthetic alcohol: booze without the hangover - <AUTHOR> http://followgen.com/content?src=http://www.wired.co.uk/magazine/archive/2013/01/start/alcohol-without-the-hangover

<comment><USER2> What is this followgen nonsense? It completely breaks Firefox: <http://i.imgur.com/ldWnsRn.jpg>

</comment><comment><USER3> It's a bit strange to be comparing any kind of recreative drug to alcohol.

What if I had a pill that had nothing to do with alcohol, but was super fun to take with friends and there was no detectable hangover ?

Would calling it a "synthetic alcohol" give it more chances of being legal in the context of the ridiculous War on Drugs ?</comment>