Reality of budget VPS services - <AUTHOR> http://www.justkez.com/reality-of-budget-vps/

<comment><USER2> I've actually had a pretty good luck with my $5 (base price $6) VPS I found on lowendbox. It has 512MB of RAM

Part of it is expectations. I know I'm not paying anything for this box, so I don't expect 100.0% uptime and the ability to run a high traffic service of which I really care about the availability.

I just need a place that can run cron scripts, regardless of whether my computer is on/online. And run screen so that it can download something that takes a few hours. And I do have a webserver on there, host some very unimportant things on there (like static versions of showoff slides from presentations I've given ... I'm guessing they get hit by humans once a month, though I guess I could check the logs), and occasionally I'll scp a big file into the web directory for someone to download.

The uptime isn't great. Pingdom sends me emails about it being down basically every month, but usually it's like 30 minutes. Uptime hovers right around the 99.9% that they guarantee. Sometimes pingdom monthly reports say it's a little less. I haven't bothered to try to invoke the SLA to get my month's $5 back, or whatever. For what I use it for, it works just fine.

If I were running a real website that I was invested in having people visit, I'd go for Linode/Slicehost/AWS/etc for sure. But this is the cheapest way to fullfil my needs for this box.

</comment><comment><USER3> Good article. I disagree with a few remarks.

While there is certainly a huge amount of fanboyism surrounding buyvm, most of it comes from the stock scarcity.

I personally run 3 vps' with them (first three plans) and the performance has always been far more than acceptable. I run an adult tube site that has exploded in popularity due to a fun domain name and being one of the first to post a leaked sex tape for a latin american actress. It can reach around 200 to 300 thousand uniques per month. Never had a load issue.

Of course, your mileage may vary. I could have ended up in a lousy node. Many people outright abuse their service for portscanning, spam sending and what not. Also, many people won't do this intentionally; they get infected through ancient wordpress installations.

My experience has been worse with Burst. Their IO is acceptable but their network is dismal. Ping times from aroud the world tend to confirm this.

Notes to take home:

ALWAYS make backups! If a provider goes deadool on you all of the sudden, you should always have fresh backups in a remote site. Honestly, there's no excuse these days. You can always get your money back if you file a dispute on Paypal. I wasn't affected by the collossal Hostrail crash, but many people were.

Lastly, always choose Xen over Openvz.

Edit: Forgot to add something very important: Avoid Hurricane Electric (he.net) like the plague. They are an absolute fuck up of a datacenter.

<comment><USER4> I agree. I wouldn't completely write off those smaller servers and I think it serves as a very good entry point for learning Linux and server administration. If you're just starting out with Node or Rails its great.

I would recommend someone a Low End Box over a free Amazon Micro Instance any day, just because the CPU they limit you at is just bad. You start Apache or Nginx on those things or do a big yum install/apt-get and the terminal slows to a crawl.

Running a Production server off any low end box is definitely risky depending on who you're hosting with, but that goes without saying. I'd second BuyVM and Xen, I had a VPS with nordic and my cluster just died one day and was unrecoverable. They gave me a free small instance for half a year, but I opted to just switch instead.

My other recommendation is definitely Rackspace. Their low end service is only around 10 dollars a month, their chat support service is pretty good, and its fast and easy to scale. Database transactions on the cloud are still shit however. :( Really want a dedicated server if you're a larger or badly optimized site.

<comment><USER5> I agree with you, but would point out that CmdrTaco hosts his new site (that got front page on HN a few times) on a Micro on AWS.

He does a serious amount of caching (obviously) and offloaded all assets to S3, but it looks like it is still possible.

FWIW, I am still skeptical given the amount of complaints you see about the Micros on the EC2 forums regularly. He could have just gotten lucky I suppose (as far as his neighbors on the host).

<comment><USER4> Yeah, I'd believe it. In full disclosure I run my personal blog off an Amazon Micro instance. Its a Fedora instance running passenger, nginx, and rails. In production mode with assets cached it absolutely serves requests at a decent speed. Absolutely painful to run an integration test or development mode though. Probably just my fault for using Fedora and not the default "Amazon Linux". However, I setup a client with a small instance running RedHat and never experienced any latency.

</comment></comment></comment></comment><comment><USER6> VPS hosting is the new shared hosting; so many applications and platforms exist that it's easy for anyone to get started operating a VPS hosting company. I could rent a dedicated server now for $200, install SolusVM and be a fully functional VPS host within a couple of hours and the majority of "budget" vps hosts are these. They don't have the funds to build a real business (like Linode), they just install some widely used software and off they go. They are limited by the software they use (whereas a company like Linode is limited by its engineers) so when things start to go wrong their response is to penalise the customers not make the engineers work harder and achieve more.

</comment><comment><USER5> Does anyone have a good recommendation for a host with a nicely spread out global presence?

I am aware of the big players (AWS, Linode, Softlayer, RimuHosting) but they all seem to have shortcomings that don't make anyone particularly ideal and I'd love to avoid a combination of all if I could.

I am looking to minimize network latency and maximize disk space with memory and CPU being secondary concerns. More or less think CDN edge location requirements.

For example:

      AWS - Speed to China and AUS/NZ from the Singapore region
      is subpar. Speed to Japan from Singapore is much worse
      compared to the Tokyo region directly. Managing many
      images in many regions across the AWS stack can be time
      consuming.

      Linode - Their CA datacenter (hosted by HE) has a terrible
      reputation and uptime. I love that they normalize their
      bandwidth pricing across all data centers though. Disk
      space is an issue for us (media distribution).

      Softlayer - Looks solid, nothing for the AUS crowd or
      Japan/Chinese users.

      Voxel - Not cheap, again nothing for AUS/NZ crowd.

      RimuHosting - Doesn't buy enough in EU/AUS to offer budget
      bandwidth pricing, the London bandwidth is horrifically
      expensive.

      JoyentCloud - Single data center at this time.

These are all nit-picks, each of these services are great and I've hosted with them at different times and been very happy (other services like SliceHost and VPS.NET have been bad/very-bad - respectively) but I am curious if I am missing a single host that could meet most of these requirements that I just don't know about yet?

For example, I had never heard of BurstNET or BHost or A Small Orange until reading this thread... so I'm hoping I might be missing some fantastic host somewhere with medium/large VPSs or small/medium dedicated solutions.

<comment><USER7> Since you seem concerned (as I am) about AUS/NZ performance, it's worth repeating the unconfirmed gossip that Amazon have a closed tender out for a pair of Sydney data centers.

Ninefold are also in Sydney and doing a good marketing job, and I know several first-class engineers that have been involved in their setup and have made only positive remarks on their potential (with the usual caveats around Australian market scale being an issue).

<comment><USER8> I'm cautiously hopeful about Ninefold, but keep in mind they had some serious (multiple day) downtime a month or so back. I'm sure they'll get on top of their operations soon enough, hopefully before Amazon becomes the local gorilla-in-the-corner in the local market...

</comment></comment></comment><comment><USER9> We are very satisfied with dedicated systems from [http://www.hetzner.de/en/hosting/produktmatrix/rootserver- pr...](http://www.hetzner.de/en/hosting/produktmatrix/rootserver- produktmatrix-ex) and <http://ovh.co.uk>

That said we run kvm on every box and run all customer and own apps in different VM managed (all managed by chef). So we're kind of running our own inhouse VPS-hosting-service.

We can achieve ultra-low-per costs per VM (as regular VPS providers would charce) but in the position to be the "root" customer of the box. We can decide which virtualization stack we want to use etc.

</comment><comment><USER10> The ultimate budget VPS is an Amazon instance. You can be relatively sure that it is not going to go under. You can run one free micro instance (<http://aws.amazon.com/free/>). You can scale as needed easily, both in terms of file system and CPU by simply rebooting your EBS to another instance type. You can have reliable, incremental snapshots. And finally, you have a great ecosystem of vendors providing AMIs for nearly all OS versions and popular web apps (like my own, <http://bitnami.org/stacks>)

<comment><USER11> Amazon isn't really budget. The free tier is nice, and the tiny instances are priced ok, but beyond that they're quite expensive for a VPs. The nice thing with AWS is the scaling and the supporting infrastructure, but you do pay for that compared to more basic VPS offerings.

<comment><USER5> Just a reminder to everyone that prices out the flat On-Demand rates of Amazon, a 3-year reserved instance price is 48% cheaper than OnDemand.

So if you know what your deployment needs are, take the On-Demand price and roughly divide it in half for your real cost-per-month (with a majority paid up front).

If you don't know what kind of deployment you need, then yes, running everything on-demand can be pricey compared to alternatives.

<comment><USER12> Is that a fixed price for the next 3 years then? I would expect normal prices to at least be cut in half 3 years from now as hardware gets cheaper.

<comment><USER10> You pay a fixed price for the reservation and then per-usage fees. Usage fees will drop as Amazon reduces them, but the reservation is a one-time deal

</comment></comment></comment></comment></comment><comment><USER13> Interesting that the author had trouble with BuyVM - my instance seems to be working out pretty well and i've recommended them to some friends. $15/year is incredible, i've had no trouble with support, and they just quietly sit there hosting rtorrent and nginx.

There has of course been some limited downtime.

EDIT: Uptime statistics hit 99.99% this month. <http://buyvmstatus.com/info/34> On top of that, the Frantech Announcements feed is pretty good at explaining the state of their datacenter, maintenance, node migrations etc

</comment><comment><USER14> Can anyone else comment on experiences with Linode (and equivalent alternatives)? I'm considering moving a group of servers off expensive dedicated hosting ($400/server) to a VPS service. I've looked at Amazon EC2 but they don't seem to have a sweet spot for my needs.

<comment><USER15> Are you sure that's the right move to make? Do you no longer need the resources of even a single dedicated server? At even 2-4GB RAM requirement, you would not be saving money buying a VPS over renting a server.

A Linode 4096, where you're sharing CPU and disk IO with all the other users on the physical server, is $159.95/mo.

For $159/mo you could rent a Xeon 3230 quad core, 4GB RAM, 2x250GB HD server from Softlayer with more than 4x the bandwidth allotment and a better data center with a larger support staff.

<comment><USER14> We deliver video content. We have a CDN that properly encodes and serves our content. All I need is to handle the HTTP requests for the "directory" of videos. A shared environment would probably be fine. All the 4GB servers seem to have most of their RAM dedicated to caching when I check what free -m gives me. Our physical disk space requirements are low. As I shift more of our content to the CDN, our bandwidth needs are decreasing as well (from 12TB/mo to 7TB/mo since I started optimizing).

I inherited this setup, so to me it looks like the servers are overpowered. Also, the customer service is terrible, which is the primary reason for wanting to leave them. I want a service where I can easily requisition and kit out new servers quickly in an "a la carte" fashion.

I have 3 servers running on EC2 already using micro instances. They're mostly to handle minor services (email list subscription/requeuing for all the web properties, payment processing postback handling, etc.) They've been up for nearly a year without any problem.

I've been leaning toward EC2, but I wanted to hear what else is out there.

<comment><USER16> _All I need is to handle the HTTP requests for the "directory" of videos._

Have you considered just using Amazon S3, especially now they offer full 'httpd'-like functionality (no more bucket XML listings if you try to visit the root of the domain).

[http://aws.typepad.com/aws/2011/02/host-your-static- website-...](http://aws.typepad.com/aws/2011/02/host-your-static-website-on- amazon-s3.html)

If you are running a CDN in front to stream the content, this sounds like the best solution to me. You could probably get away with Reduced Redundancy Storage too if you have backups.

</comment></comment></comment></comment><comment><USER17> Anyone care to follow this up with a brief article on the more expensive VPS providers? (such as A Small Orange) Are those of us on Linode, Rackspace Cloud, and Slicehost missing out at all?

<comment><USER18> Well as someone who has used quite a few VPS servers over the years from a plethora of providers I must say at this point in time Linode is probably the best bang for your buck with all the utilities and uptime it provides. The only thing about Linode is you must not order from the fremont datacenter and you have to subscribe to the status updates to realize what's going on.

The only thing that a more expensive provider will give you that linode does not is server management which can be useful but I don't really mind sysadmin at this point in time so I can't really review that.

<comment><USER19> +1 to linode - in the past I opted for cheap options, and suffered, but after experiencing the management tools and infrastructure linode has in place, I'll stick with them at the more premium price.

</comment></comment></comment><comment><USER20> After lots of downtime across three of my VPS' at VPS.net i'm opting to migrate all of them to one box on the Rackspace Cloud. I'm not a server admin, nor do i want to be, so the attraction of the new 'Managed Cloud' is all that much stronger.

I have used Voxel.net in the past, and their technical support team are absolutely amazing. Always willing to go that extra mile. Uptime was also very good.

</comment><comment><USER21> I had a very poor experience on the past with a cheap hosting provider. Actually it really does not matter if it is shared hosting or a VPS -- at the end of the day you get the service you paid for. Currently we use Rackspacecloud with very good results. Their control panel has a few glitches but my support experience was out of this world.

</comment><comment><USER22> SolarVPS has servers in New Jersey and Los Angeles for $5-40 that I've been using for a years. Like Rackspace (4 cores), these small boxes also have up to 16 cores. Great for mysql replication, code repos, distributed data nodes.

</comment><comment><USER23> I have been using a 15$ vps from www.tektonic.net since 2004 and have been happy. I run a few personal sites and sometimes test code. They have been down 1 to 2 times a year which IMHO is fine for the price.

</comment><comment><USER24> Heh, the performance comparison linked to in that article is kinda worthless since it leaves out RapidXen, one of the largest bare bones VPS providers.

<comment><USER25> Rapidxen is more expensive than Linode when you get to 512mb ram... that can't be budget :)

<comment><USER24> Yes, but Linode oversells their machines more. You get what you pay for.</comment></comment></comment>


Expanded state hacking powers make a stealthy return to German agenda - <AUTHOR> http://www.zdnet.com/article/expanded-state-hacking-powers-make-a-stealthy-return-to-german-agenda/ <comment><AUTHOR> German politics & media at its best: Creating (again) new laws to monitor its own citizens without them even knowing about it. The "free journalism" simply does not report about that kind of actions plus the decisions made by the government mostly happens at night so most of the public does not recognize it... The interesting part is that the executives are able to monitor your devices if you ever had anything to do with law no matter what kind of.

Is it normal that "progressive countries" nowadays give a sh*t about their citizens and their rights? What about innocence presumption?

<comment><USER2> There is no decision made yet and no passed law. Let's wait until the government actually proposes a law to parliament before getting out the pitchforks? The law has been in the works for years and there were a few reports in the press from the beginning. It's part of the coalition agreement. It feels like the interior minister mentions the idea in every second speech. Even this Zdnet article says "It has long been known". Almost no law gets much attention at that stage and many ideas never get proposed to parliament at all.

The federal government plans to propose an amendment to a law parliament currently works on. This is well known and the members of parliament already used that in their debate. Whoever claims this is a "secret proposal through the back door" either:

\- knows nothing about usual parliamentary procedure and hasn't followed that topic before at all, or

\- tries to use dishonest arguments directed at people in the former group. Netzpolitik.org (that leaked the current draft) falls into this category. Their editor-in-chief debated this "oh so secret law without public debate" on public stage with the interior minister just last week

> The interesting part is that the executives are able to monitor your devices > if you ever had anything to do with law no matter what kind of.

This is not true. The (leaked but still unofficial) proposal allows judges to authorize hacking devices to monitor communication in the cases where they currently could authorize tapping your analogue phone.

If that law is passed judges can also authorize to hack devices to access stored content in cases where they currently can authorize installing a bugging device in your home.

Both only apply for a specific list of crimes. While I still personally think that this proposal goes to far, it's nowhere near applying "if you ever had anything to do with law no matter what kind of".</comment></comment>


Ask HN: Securely exposing host just to webhooks? - <AUTHOR> Background: I wish to listen for github webhooks on a Jenkins instance sitting in a private network. There are no public endpoints on the network, it's for internal services.
Easy enough to add an endpoint that forwards to Jenkins, but
I'm not a web dev person and have no experience securing public endpoints so this is a terrifying prospect to me. I could easily introduce a huge backdoor without realizing.
What's best practice to accomplish this? Is there a tool that is user-friendly enough so as to prevent me from doing stupid things?
Or should I just forget about it and poll from inside more frequently?
I guess I'm really asking is security still a full time job? Because the gain relative to just polling more frequently is very small here, and the risk is enormous. So unless things are absolutely rock solid and fool proof I'm better off just not. <comment><USER2> Refer to the guidance suggested by Github themselves: [https://developer.github.com/v3/guides/best-practices-for- in...](https://developer.github.com/v3/guides/best-practices-for- integrators/#secure-payloads-delivered-from-github)

That is, 1) put an SSL certificate on your endpoint and 2) only permit connections to 443/TCP from Github's IP address ranges.

<comment><USER3> Suggested practice #3 is equally as important:

> Provide a secret token to ensure payloads are definitely coming from GitHub. > By enforcing a secret token, you're ensuring that any data received by your > server is absolutely coming from GitHub

</comment></comment><comment><USER4> A few things you can do: 1) place Nginx in front of the webhooks service (it will allow you to filter traffic by IP, request headers, etc - a bit less efficient than a proper firewall IP filter). 2) listen for webhooks on a port other than 443 (GitHub allows this). 3) use a unique URL for webhooks, with a unique/random/long token as part of the URL (this way only someone who knows the exact URL will be able to reach it). 4) of course, use a valid TLS certificate 5) validate __all __headers sent by GitHub (user-agent, x-github- delivery, etc). 5) provide a unique /random/long shared "secret", different from the URL token, for validating the sha1 signature of the request. 6) only accept a valid JSON payload and application/json content-type. 7) only accept specific events from the x-github-event header (ex: push, ping). 8) reject EVERYTHING ELSE with a 404. 9) validate the actual content of the JSON payload (does it contain the proper key/value pairs you need? discard the rest). 10) enable audit-logging of requests, so you can see any attempts at people trying to "hack" your webhooks service.

I recommend running the webhooks (external service) as an entirely different application from your internal services. If it's a nodejs app, and your main internal app is nodejs, then you'll need to run 2 nodejs processes (and not as root).

Also if you can, try running the webhooks service on an entirely different machine (vm?) - and have it talk to Jenkins through the network (ex: as others have suggested with a message queue or API call).

If you're filtering by IP (might be troublesome if GitHub's IP range changes), most of the above will be overkill.

Edit: to answer your last question: security is a process, whether it's full- time or not depends on how much you care. Edit 2: fix typo

</comment><comment><USER5> One way, like you say, is to set up a listener on a public network and have it spawn a different event, which gets handed down to your private server through a specificly-punched hole. But there's a lot of things to pay attention to: the public listener is fully public and will probably attract all manner of hostile traffic -- DDOS attempts, scans, canned exploit attempts -- which you have to be resilient to, and filter out. And even if you receive a properly authenticated payload from your webhook, you're going to want proper input validation (e.g. whitelisting expected values and discarding anything else, so that your lower program isn't directly executing unvetted output from the outside).

There is tooling that makes some facets easier (e.g. API proxies, which handle in-software rate limiting, authn/z), but the inherent complexity of the problem remains.

An alternative that comes with much less exposure and much less runaway complexity is to poll from the inside.

<comment><USER6> > An alternative that comes with much less exposure and much less runaway > complexity is to poll from the inside.

How exactly is it much less exposure when you are presumably handling the exact same information?

<comment><USER7> I would guess the OPs concern is inadvertently providing access to entities other than Github. If you polled from the inside then you could be sure that the only thing you would need to worry about is how the data that is pulled down from Github is parsed because you are not providing access to anyone at all, including github.

<comment><USER6> > I would guess the OPs concern is inadvertently providing access to entities > other than Github.

Well, yeah, sure.

> If you polled from the inside then you could be sure that the only thing you > would need to worry about is how the data that is pulled down from Github is > parsed because you are not providing access to anyone at all, including > github.

That's a highly confused way of looking at things.

Whether you consider a process "pulling data" or "receiving pushed data" is ultimately entirely arbitrary. You can view any "push" as a "pull" and any "pull" as a push if you shift perspective slightly.

For some reason you decide to use a push configuration. How do you do that? You create some address where data can be delivered to. And then you inform the potential source of the data about that address, so it can _push_ the data to you. So, really, you are just sending a request to send you the data, i.e., you are obviously _pulling_ , right?

OK, say you don't like a push setup, so, let's say you send an HTTP request to a server in order to _pull_ some data? Well, yeah, sure you do. But then, really, you are just creating a multiplexing identifier that allows you to receive data and you inform the HTTP server about that address, namely a TCP four-tuple plus sequence numbers, which the server can use to subsequently _push_ the object to you.

Mind you, I am not just playing with semantics here: Anyone who knows the address that you submit to the "pushing" side can send you data, in both cases. Well, not quite as easily with the TCP connection state, as you have to fake IP addresses for that, but that's not really a huge barrier. The underlying layers give you no guarantee at all that the data you receive on an outgoing connection comes from the entity that you intended to connect to, that's just an illusion.

So, what do you do? You authenticate. You use TLS, you use SSH, you use keys and certificates, to cryptographically authenticate that the data that you receive is indeed coming from the entity that you want to accept it from, and anything that isn't authenticated successfully, you drop on the floor. Whether you do that on an inbound or on an outbound connection is irrelevant. And if you fail to do it in either case, you have a security risk.

Essentially, the idea that you aren't "providing access to anyone" is an illusion. When you can receive data from someone, you are "providing access" on some level, and when you pull data via HTTP from github, they obviously can send you data in response--and, as we have seen, others can as well, so you can't even be sure you are getting the response from github. That is, unless you authenticate cryptographically that it indeed does come from github--but then, there is no reason you couldn't do the same on an inbound connection.

Pull and push only have a useful meaning in terms of scheduling, but that has nothing to do with security: A pull is when the requested data is pushed as an immediate response to the request, while a push is when the requested data is pushed in response to an event external to the established link. See also HTTP long polling (outbound connection used for "push" from the server) or SMTP TURN (inbound connection used for "pull" from server).

</comment></comment></comment></comment><comment><USER8> You can use a message queue, to which you add the webhook payload. Then your Jenkins server can listen on this queue.

<comment><USER7> Can you explain more about how this would address security concerns?

</comment></comment><comment><USER9> ngrok

</comment><comment><USER6> > Because the gain relative to just polling more frequently is very small > here, and the risk is enormous.

What is that enormous risk that you see?!

There is nothing inherently more risky in handling "inbound" connections vs. "outbound" connections. Either you are doing stupid things with untrusted data (i.e., anything not from your own trusted systems) or you aren't. How the data comes into your system is completely irrelevant. If you have too little clue to know how to build a secure listener, chances are you shouldn't be building a poller either.</comment>


The Lost Art of C Structure Packing - <AUTHOR> http://www.catb.org/esr/structure-packing/

<comment><USER2> For those interested, there were 113 comments about it last week, at [https://news.ycombinator.com/item?id=9069031](https://news.ycombinator.com/item?id=9069031) and a further 146 last year at [https://news.ycombinator.com/item?id=6995568](https://news.ycombinator.com/item?id=6995568) .</comment>


Boy Scout's Entrepreneurship Merit Badge - <AUTHOR> http://www.scouting.org/scoutsource/BoyScouts/AdvancementandAwards/MeritBadges/mb-ENTR.aspx <comment><USER2> As a life long "scouter" (so far) I have to say scout badges are pretty hit and miss. It depends on your troop and on the badge whether you learn much on it.

(example; this would be useless in my local scout troop who's focus is generally on water sports [canoing] and hiking/camping - i.e. the physical stuff.

They would probably award it based on little effort (and yes, I did use this "hack" to amass a huge quantity of badges in my time :))

Not that I'm dissing it :) just seems unusual for a Scout badge.

</comment><comment><USER3> Not bad. 3c and 3d are more than a lot of startups do.

</comment><comment><USER4> I think a properly run Eagle Scout project is 10x more beneficial than this merit badge, but I appreciate the idea behind it.

<comment><USER5> I earned Eagle Scout in 2000, one month shy of turning 18. I agree with your comment 100%. Earning merit badges is akin to preparing for standardized tests; it's simply regurgitating ideas and concepts to fulfill a list of requirements. It was the non-merit badge activities that I gained and learned the most from, where there was less structure involved. Running an Eagle Scout project introduced me to budget constraints, solving problems creatively and managing a team. I don't know much about the Girl Scouts, but if they are similar in spirit to the BSA I'll definitely encourage my daughter to participate.

<comment><USER6> Without a doubt, Wilderness Survival was my favorite merit badge of all time. I don't think it was Eagle required, but boy was it fun and I learned a ton.

But you're right, having to do my Eagle project taught me the most. Organizing some 150 volunteers on New Years Eve was no small feat, but I felt a great deal of accomplishment when it was done.

</comment></comment></comment><comment><USER7> I love it. I think people involved in boy scouts are more inclined to make their own path and explore entrepreneurship. Many of the leaders involved with my specific troop had interesting backgrounds in business and would have been valuable assets for anybody interested in working toward this badge.

</comment><comment><USER8> The merit badge sounds like a neat idea, but the BSA exclude gays, atheists and agnostics, and to me, that taints everything else they do (girl scout are much better about this).

 _Since 1991, openly gay individuals have been officially prohibited from leadership positions in the Boy Scouts of America. A 1991 Position Statement states: "We believe that homosexual conduct is inconsistent with the requirement in the Scout Oath that a Scout be morally straight and in the Scout Law that a Scout be clean in word and deed, and that homosexuals do not provide a desirable role model for Scouts." The BSA thus "believes that a known or avowed homosexual is not an appropriate role model of the Scout Oath and Law."_

<comment><USER9> As a business decision, if you run an organization with males from 6 to 18 and you have someone who prefers sexual contact with males it might not be a good idea to send all of those people to the woods alone together... without baby oil and Niel Diamond songs.

The Boy Scouts have enough problems with people who don't disclose that they prefer males, hence an 18.5 million dollar lawsuit that the Boy Scouts just lost. Further, imagine trying to get parents to have there kids join a group with a gay leader or that might have a gay leader.

The religion part is very open, for example the Spaghetti Monster religion would qualify so does believing in "Mother Earth" for whatever that means. I was a Den leader for several years for Cub Scouts, an atheist dad and son joined, it wasn't a big deal but I qualified them first by making sure they didn't mind all of the "Duty to God" type sayings.

</comment></comment><comment><USER10> Glad to see they've finally updated the merit badge pamphlets--maybe I'm getting up there, but I seem to remember that in the late nineties when I was pretty active, most of the content seemed to be 10-15 years out of date.

I never got this one, but I wish I did (considering I got such gems as coin- collecting and basketry).

</comment><comment><USER11> I've always thought about starting an organization which was just about entrepreneurship for kids. I went through all the scouting levels, and I think there's a lot of good things in there, I also think there's a lot of cruft left over from when it was a thinly disguised military preparedness course. Salutes, khaki uniforms, ranks, etc : all a bit much for me back then, and I wouldn't put my own kids in it now. Of course it has probably modernised quite a bit but I suspect a lot of it is still the same.

What I'd like to do is keep the good things about scouts : personal responsibility, teamwork, goal setting and acheiving, respect for adults etc and tie it in with an entrepreneurial focus : team building, idea generation, production, marketing, distribution, legal understanding. The idea would be to work on mini-projects a bit like they do on 'the apprentice', with the goal of generating funding for both the club/group/whatever and of returning funds to charity. There would also be aspects of social and environmental responsibility tied in with the work. The projects would be fun for kids, whether it is commissioning a line of t-shirts, selling flowers or doing an e-bay drive.

My reasoning for this is that I think within the space of a couple of generations, people have gone from usually-self employed to usually-corporate employed, and as such get very little control over their lives. It's the entrepreneurs that grow economies and improve lives, and yet it gets virtually no attention throughout school.

</comment><comment><AUTHOR> As a person that came from a technical background, I followed the 'built it and they will come' heuristic.

It's certainly effective for getting something done and out there. However, I considered nothing about market or even who I thought my users are, or more importantly, where to find them.

In this list, I probably would have benefited from the talk to customers bit. Too bad there's no iteration of the business idea in the list.

Any of you out there ever get this badge?</comment>


If you leave hydrogen alone for long enough,it start to wonder how it got there - <AUTHOR> https://www.reddit.com/r/Showerthoughts/comments/4aurye/if_you_leave_hydrogen_alone_for_long_enough_it/ <comment><USER2> A friend from years ago was an astronomy student at Boulder. He was explaining something they were developing to improve ground based telescope observations (holes in disks).

I got this sudden understanding that we, _I_ , were the universe, observing itself. _Ourself_. Myself.

A full appreciation of reality can really turn your mind inside out.

No substances were consumed that night.</comment>


I worked in a video store for 25 yrs – what I learned  as the industry died - <AUTHOR> http://www.vox.com/2015/11/20/9757186/netflix-video-rental-store <comment><USER2> It seems like there would be some sort of hipster twist you could add to a video store to keep it going. Maybe the video store component becomes sort of a background prop, but it would be something that few other places could duplicate.

My most memorable moment in a video store was walking half through the swinging doors of a section which immediately electrified the senses of a 11 year old boy. Video boxes floor to ceiling covering 4 walls showing mostly naked people. I got a split second view before I got a tug on my collar followed by a reverse warp out of this fascinating world.

<comment><USER3> My town has two successful DVD rental places. Their "hipster twist" is basically: quality movies, and an owner that can find something for you. They aim at students and established inteligentia. At its core, the service they provide is discovery.

(the town also has a surprisingly thriving arthouse cinema scene, so it's certainly a welcoming environment.)

As for the wall of nekkid: "Confessions of a porn store clerk" ([http://www.amazon.com/Confessions-Of-Porn-Store-Clerk- ebook/...](http://www.amazon.com/Confessions-Of-Porn-Store-Clerk- ebook/dp/B007ZL0IHM)) is a fabulous read. It's available for free, too, but I found it worth the dime.

</comment></comment><comment><USER4> I find it interesting that the author never even mentions people that torrent movies.

He complains that Netflix and Hulu don't have such a large collection as some video stores, especially rare movies. But I have never not been able to find a very rare movie via a torrent.

And it is rather unusual that this large contributing factor to the downfall of his industry is never mentioned.

<comment><USER5> Funny you and I had the opposite thoughts about torrents. My thought was, "Ya know, the really good indie movie rental places are special; they have films I can't even find [seeded] between TehConnection and Karagarga". Maybe I should look at other trackers...

<comment> ryan-allen The pay per view rental model like iTunes often has a lot of harder to find movies.

A few times for me it's the last port of call when I can't find a title anywhere digitally, at at least then you're getting the best quality sound and picture!

<comment><USER6> As a non-American I'm really frustrated that what you don't get is translations. Disney movies for the kids have been translated into 100 or so languages, yet buying one on iTunes gets you English and -maybe- Spanish.

And then when you get to Europe, they suddenly have English-French languages on the same page.

It'd be really nice if when I bought a movie that they're selling the translated version for would be accessible everywhere.

Same problem on Amazon, Google play, iTunes, even Netflix.

<comment><USER7> Then you should definitely try bittorrent. Not only can you play those files (or transcode those files to play) on literally anything, but fans themselves do subs in roughly all the languages. If any of those services you mentioned above would allow user submitted subtitles, it would remove a large reason to torrent instead of buy.

</comment></comment></comment></comment></comment><comment> ryan-allen I would pay someone like this for a quick chat on a Friday evening to help me choose a movie.

I'm old enough to remember going in to a video store and having a chat about what I should watch next.

The engaged staff quite often would send me on my way looking forward to watching the movie, and I wouldn't stop watching half way through either, I'd commit to it because it was a real recommendation by someone I talked to.

The part in the article where it was said we don't pick something to watch, we settle for something on the streaming services hits close to home for me.

<comment><USER8> Movie Recommendation as a Service (MRaas)? Or curation - if it isn't out there yet it will come.

Something with humans, since it would be easy to imagine algorithms getting stuck in a very narrow genre (like when you give a Pandora channel too many songs and it ends up with the same 20 tracks or covers thereof). Plus giving you that commitment to see the movie through.

Or just head to reddit[1] or equivalent communities.

[1] [https://www.reddit.com/r/MovieSuggestions](https://www.reddit.com/r/MovieSuggestions)

<comment><USER9> >>> Movie Recommendation as a Service (MRaas)? Or curation - if it isn't out there yet it will come.

I think it's not the same, if you are talking about an online service. It's all about the physical interactions, anticipation. Getting out of home, browsing the DVDs, bringing it back home, etc. It's the same with, e.g. books. Browsing the local bookstore compared to going through the lists in Amazon (I live in a country where it's a bit tricky to get English books and miss going to bookstores in England a lot, I can totally relate to people the author is talking about). Like the author said, it's half of the pleasure.

Humans are social animals. Not everything can be done online in an equally enjoyable manner.

<comment><USER10> I'm not sure we're social enough though.

Content industries have killed themselves by selling content as objects-you- own (or rent briefly.) Even Netflix etc work on this model. And torrents are just objects-you-steal.

If the content industries had done more to sell content as an element in a social network - share with friends/family, meet strangers, enjoy relationships of all kinds - they wouldn't be so threatened by P2P. The breakout franchises - Star Trek, Harry Potter, Star Wars - all have this personal and social element. Direct-to-DVD crap movies totally lack it.

Ironically - or maybe not - P2P provides more of that social element. People make requests, comment on uploads, build reputations, and sometimes organise private sharing clubs.

I'm sure torrenting wouldn't have become as popular without that social sharing element.

<comment><USER9> That's an interesting point. But virtually social (I just made it up, not sure if it's correct but you get the idea), I believe, is very different form physically social.

I think in case of video stores, it's quite similar to coffee shops.

I have some good quality coffee beans, a decent machine, so I can totally make coffee that's good enough to compete with most of the coffee shops for a fraction of price and time that has to be spent. That's similar to Netflix. Quick, convenient, often good enough.

But still, I like to go to a coffee shop from time to time (which is similar to going to a video store). It takes much more time, it's not as convenient (can't just go straight from bed in my underwear), but there's something rewarding about the whole thing. Dressing up, getting out of home, all these things makes this as a sort of ritual.

</comment></comment></comment></comment></comment><comment><USER11> Initially video stores have cut into the profits of movie theaters. However, it is interesting that currently theaters (while still struggling quite a bit) seem to be coping better than the video stores.

<comment><USER12> That's because the fundamental differentiation has already happened there: "going to the cinema" vs "watching at home" has been a choice for 30+ years now. Who had to die because of that, died already. Despite Hollywood's lamentation, it's unlikely that cinema numbers will ever get significantly worse than they are at the moment, unless someone (Oculus?) manages to somehow replicate the big-screen experience at home in full -- and even then, groups of teenagers will probably still choose to escape their parents' abode every now and then.

<comment> saiya-jin it's already a worse experience (noisy, annoying kids, ringing cell phones, too loud for some, not ideal placement of most seats etc.), but it's a social experience. 3D might be an exception, for now, and it's still a rather niche market.

same as people buying shots at bars vs drinking same alcohol at home for 20% of the price.

<comment><USER13> 3D niche? I can't go to any movie anymore cause they are all f __ __g 3D and I hate it. My head hurts horribly after onw of those.

</comment></comment></comment></comment><comment><USER14> I would pay for his service, not a lot, but I would pay. Every now and then I find a good movie (last one being "Swingers"), but it's completely random. I can't find a website with a constant flow of good recommendations. I get very frustrated every time I try to get something out of one of those "the 100 best movies of..." lists.

</comment><comment><USER15> Interesting read. Reminds me of another article I read here about a store closing down whose link I can't find.

I dislike that my children will never experience the video store like I.

Streaming just isn't there. The quality isn't good enough and the cost is, in my opinion, too high.

<comment><USER16> I absolutely loved my local video store and owe a large part of my viewing tastes to it.

Had it not been for that store I wouldn't have the appreciation that I do for foreign films, trash cinema, exploitation films and direct-to-video.

I outgrew my local rental's small collection quickly and was an early adopter when it came to torrenting and streaming. I still miss the store - the process of discovering a movie was at least half the experience.

The best I can do to get close to it is browse the IMDB release list every 6 months and then get every movie that sparks my interest. Binge watching 40-50 movies is cool, but not the same.

</comment></comment><comment><USER17> Great article. Independent video stores were/are interesting places to visit, it's a shame they're struggling to survive.

I also feel the same about music shops and games arcades. The human element is a big part of what makes the experience compelling. I especially miss games arcades, they gave me some of my fondest childhood memories.

</comment><comment><USER18> Where I live the video rental places gouged their customers with late fees. A minute after 48 hours you were stiffed with another 48 hours. I and my wife are very busy. Most of our subscription went on late fees. Just for that greed I'm not sorry they closed.

<comment> martin-adams The irony is this very thing was the trigger that started Netflix. Their own practices that consumers hated helped create the very thing that killed them.

<comment><USER19> The free market at work. Lets see what else can come along and disrupt things, because it pays attention to what customers hate...

</comment></comment></comment><comment><USER20> There was a really big video store across the road from me. They made most of their money via porn I heard. Normal movies were 1 buck per day. It was very busy up to a year ago.

Then it moved down the road, a bit far for me to walk when I felt like being on the couch. So I stopped going.

It's still very busy though.

It also has a good website where you can look stuff up online. It was also convienient to grab a bottle of wine/beer and popcorn etc at normal prices (not insane cinema style prices). They have stuff which the big online video distributors have and it is more convenient in many ways.

But then again, this is Berlin... and there are still plenty of vinyl stores and such like. In a lot of ways it's the city time forgot.

</comment><comment><USER21> While vinyl records have made a resurgence from near extinction. It's unlikely the same will happen for the video stores as music seems more timeless and collectible than movies.

<comment><USER22> Moreover, I think you will be hard-pressed to find someone who will argue that VHS or DVD provided better quality than Netflix et al.

Obviously, Blu-Ray provides better quality than today's streaming services, but the format never really took off in a big way among the general population.

It's a bit of a shame, since with Blu-Ray, you at least own something. It'll still work when somebody pulls the plug on some service.

<comment><USER23> I have a feeling that the idea of owning things is going to become a crazy old-people's complaint. Perhaps younger generations will be happy with their remote-wipeable phone apps, viewed-then-gone movies, hired rides in someone else's car, etc. Maybe these things are becoming so numerous and cheap compared to our income and other costs (housing) that people won't care anymore.

<comment><USER22> I agree that it will probably become a old-people's complaint. The latter part (numerous and cheap) does assume a perfect market though. In reality, many of the resources may end up in the hands of a monopoly or oligopoly and then they change the rules or charges at any time.

</comment></comment></comment></comment><comment><USER24> That was just such a great read, many thanks to the OP.

Nothing beats depth of experience and passion, to give you an insiders view.

</comment><comment><USER25> Hulu and Netflix are all you need, entertainment-wise. Haven't watched traditional TV in ages and it has for sure had a positive psychological impact on me. Not related to the article (like I'd know, I commented first before reading), but I did want to take this opportunity to preach.

<comment><USER26> And for those outside the US, bittorrent is all you need.

Seriously, I really don't understand - Hollywood is losing a ton by not allowing Hulu and Netflix to screen internationally. They end up pirated anyway - why the US-only restriction? I'm in India and would gladly pay Netflix the $10 fee - but I can't.

<comment><USER27> How do you propose the studios which owns the movies satisfy all the laws in India? It may not be possible to get a censor board certificate for each of the movies in the collection of Netflix.

The cost of opening up them to vandalism (if they have offices in India) or lawsuits alleging "hurting the sentiments of the people" is too high.

One reason I use torrents (even though I am willing to pay for good content) is to defeat censorship.

<comment><USER26> I don't think they need to "operate" in India or anywhere else in the world. They just need to allow people to sign up for their service irrespective of where they're from and access content, just like, you know, how the rest of the internet works.

My guess is that they're being held back more by Hollywood's licensing conditions rather than individual countries' laws.

<comment><USER28> Unfortunately, distribution networks and related contracts are _very_ complicated legally, not even going into local laws and other legalities. Netflix itself has a few good sized teams of developers dedicated just to creating tooling to help navigate the legal nightmares regarding distribution agreements and their streaming services.

I'm pretty sure the studios would _much_ rather be able to have a very few global release channels than the network remnants they currently have.

<comment><USER26> Sorry, I don't get it. Are you saying that the studios are forced into this situation because of earlier contracts they've signed with cable networks? Aren't contracts signed separately for each new movie that they create?

<comment><USER28> There are distribution deals with studios for all distribution to a given location and/or media within different regions. There is some content that is negotiated individually, others en-mass. It is often per-movie, but this only makes things more complicated, not less.</comment></comment></comment></comment></comment></comment></comment>


Ask PG: Syntax highlighting on HN - <AUTHOR>

Title is self explanatory.. but a simple syntax highlighting format in comments would make code discussion so much better. <comment><USER2> There are many things that HN needs before syntax highlighting. I don't think there's any interest in implementing real improvements to HN, except in a limited fashion.

<comment><USER3> On the other hand, of all the things to implement syntax highlighting could be very easy with a library like [http://google-code- prettify.googlecode.com/svn/trunk/README....](http://google-code- prettify.googlecode.com/svn/trunk/README.html)

</comment></comment><comment><USER4> That's the territory of extensions normally, but I haven't seen any Chrome extensions worth keeping yet.</comment>


Running the entire business from an iPad - <AUTHOR> http://www.numbersforstartups.com/blog/2011/10/31/running-the-entire-business-from-an-ipad/

<comment><USER2> I recently got an ASUS Transformer and I was pretty happy that I could use something like ConnectBot [1] to ssh into a virtual machine I was running on my main laptop. I was coding in django/python, and I could test the website using Firefox Mobile- I could actually use this for work!

... 30 minutes worth of typing on that keyboard and bad support for alt- tabbing between apps and the tiny screen, I was back at my comfy ThinkPad. Even for other types of work, such as when doing research, I find it cumbersome to swap between my browser and note taking application. The selection of apps (compared against mac, windows or linux) is just not powerful enough. It gets tiring after a while. A good ultraportable (say the MBA or x220) offers much better value for me. I find tablets are good for reading, surfing etc, with some nice apps to let you get work done if needed. But certainly not something that you'll want to be using for a while.

[1] A small footnote on how good the user experience is when the software that you use is open source. It didn't support some of the keys on the Asus transformer (for e.g. using the back key for 'esc' in vi). I was able to fork and fix that pretty quickly and was on my way.

<comment><AUTHOR> There's always promise for the future in minimalist mobile device setups like this, but always pain in the present too.

I'm sure our kids will find exercises like this with our early tablets to be laughable.

I'm jealous you got django/python on the tablet! Even if the keyboard proved unworkable.

I'd love to be able to write even a little Objective-C from the iPad. Also, I would find a certain humorous irony to have the xCode IDE simulating an iPhone on my iPad. Oh well.

</comment></comment><comment><USER3> I was hoping this article would have a little more substance. I'm not very creative and even I thought of bluetooth keyboard + $$$ for apps to recreate the same experience as a laptop.

To me, it'd be cool to market custom business dashboards for businesses. "Running the business" could mean doing scheduling (with draggable pictures of people!), glancing at inventory, checking daily|weekly|monthly financial stats, perhaps even taking credit card purchases. That sort of thing . The kind of thing you see in Star Trek.

Intelligent interfaces for consuming and directing, not necessarily producing, would be rather inventive but I'd love to hear from small business owners about the viability of such an idea.

</comment><comment><USER4> It seems counterintuitive but I can focus better as well on a tablet (or even on my iphone) than on my MBA. The limitations definitely come with advantages :)

sorry to be OT, but how many Ultimate packages do you sell or have you sold?

<comment><AUTHOR> I try to limit my personal consulting to 2-3 clients per month. The majority of my time goes to working on my own projects. I usually love the work, but have to restrict it a bit to stay on track with my main goals.

Also, the "Ultimate" package usually serves as a starting point for the conversation which eventually makes the deal. Still, you've got to market something for people to know it's available.

I also try to help out earlier/younger startups pro-bono from time to time. Gotta keep your karma up somehow...</comment></comment>


Show HN: BundlePhobia – The cost of adding new npm packages - <AUTHOR> https://bundlephobia.com <comment><USER2> I am not an npm user. I do use pip and I do use maven so I get the idea.

There is way too much whitespace on the front page, there ought to be some signaling about what the user will get if he searches, also some saved example searches that work, unlike the search for "rules" that wound up, after a long grinding giving the message:

"InstallError Installing the packaged failed."

+1 for having visual indication that something is happening while you wait.</comment>


What would a EvE online Internet look like? - <AUTHOR> https://blog.benjojo.co.uk/post/eve-online-bgp-internet <comment><USER2> I love reading about EvE once in a while. It's almost as if there were a completely different space world out there with unlimited freedom and unlimited possibilities. I always feel the urge to join this world and explore it -- but then I come to the realization that it probably needs an exuberant amount of time and dedication to partake in these news worthy event and that most of the time it's probably a grind.

<comment><USER3> Hi,

Eve is really hard to play alone, it's mesmerizing and it's a great experience to try.

But once you get addicted to some feeling it creates, I urge to join a corporation with well experienced and active people which will be able to let you earn more in a shorter and more social way.

My Eve reality is that I mostly tchat on Discord with my friends while killing some stuff to buy ships / licence / whatever and watch to fight for other people.

There are plenty of activity to do and it's a very unique and awesome piece of experience I never was able to really leave for good.

<comment><USER4> > I urge to join a corporation with well experienced and active people

Absolutely this ^^^

After a couple of months learning the basics I joined a mostly UK based corp who's members had been around since the inception of Eve back in the early 2000's. This was around the time Eve introduced the faction war update (Empyrean Age - 2008) and these guys wanted to encourage new players to do PVP but in safer non-null sec space, which the faction warfare update was sort of intended to do.

Being in my early 40's at the time I wasn't a hugely "social gamer", however it turns out many committed Eve players are in that older demographic (30's or older I'd reckon) and many of us had the same interests and senses of humour.

To cut a long story short, I had an absolute whale of a time with these folks (Dark Rising - who're still around operating back out in null-sec again) for a year or so. I don't think I've laughed so hard such as at the times we had spies...on TeamSpeak...in opposing faction corps and they had no clue we'd infiltrated them. The game really took over my life for a while and was amazing fun, and the way to have that kinda fun is to join a corp.

</comment></comment></comment><comment><USER5> This is why I read Hacker News. Awesome pet project! Well done!

</comment><comment><USER6> My networking knowledge ends slightly before BGP gets involved, but that article was fascinating.

I love that sort of thing, looking at one domain and saying "what if we treated it like this domain?" and then actually doing it!

Really awesome stuff.

<comment><USER4> Grab yourself a copy of Sam Halabi's "Internet Routing Architectures" (2nd Edition).

[https://www.amazon.co.uk/dp/157870233X/](https://www.amazon.co.uk/dp/157870233X/)

It's likely a bit out of date these days, but it's one of the best books on BGP I'd read back in the day when I was involved with building an internet exchange point circa 1999.

<comment><USER6> Thank you, I will add that to my wishlist, plus let my spouse know to look for that in 2nd hand form when she hits various booksellers.

<comment><USER4> You're very welcome :)

</comment></comment></comment></comment><comment><USER7> Years ago I looked into treating pathfinding in EVE as a graph problem because I was annoyed by losing money in the collapse of the Mt. Gox scam and read that its owner had solved the same problem. I thought I'd show him up by showing how easy it is to blow his terrible PHP code out of the water. :)

You can find the writeup and a link to the code on my blog:

[https://briangordon.github.io/2014/03/better- pathfinding.htm...](https://briangordon.github.io/2014/03/better- pathfinding.html)

<comment><USER8> Just a note, unless you have negative edges, running V Dijkstra's is likely to perform better than Floyd Warshall. Dijkstra's gives you distance from a single node to all other nodes in V log E time. If you run it V times, you'll get V^2 log E, a substantial improvement upon V^3.

It also seems to me like it's likely to be easier parallelized, considering that the V runs of Dijkstra are completely independent.

<comment><USER7> Hmm, wouldn't Dijkstra's be V E + V^2 log V? I take your point though. I suspect that I was dazzled by the cache locality advantages of dynamic programming and skeptical that messing about with a bunch of heap nodes would be faster, but looking at it now I bet you're right that knocking one of those Vs down to a log V would help. Thanks for the feedback!

</comment></comment></comment><comment><USER9> Can the BGP diagrams be generated with avg latency taken into configuration? It would be interesting to see the tube map's diagram if that was the case.

Also I'm interested as to how the author generated the original TfL map JSON, as it would be nice to expand it to perhaps the TfL's Tube/Rail map.

> Meaning every router/station on the network knows it's time to get to every > station through every route:

I am confused by this - does it mean each station knows the latency to it's neighbour and BGP can figure out the fastest route based on that? Or does it mean we have to pre-calculate the combined time to every other node based on the shortest per-stop route (which seems less cool)?

</comment><comment><USER10> Amazing project! An interesting followup would be a converter script from the GTFS to the json input as a generalized format of this.

I wonder if BGP could be applied in this way to highlight "good enough" routes for public transit planning?

</comment><comment><USER11> In a better universe _this_ is how research papers would look like. Amazing work.

</comment><comment><USER12> it would look like this:

[https://docs.google.com/spreadsheets/](https://docs.google.com/spreadsheets/)

:)

</comment><comment><USER13> "It would be slow and boring."</comment>


Microsoft May Rename Live Search 'Bing': Massive Ad Campaign Planned - <AUTHOR> http://www.pcworld.com/article/165462/microsoft_may_rename_live_search_bing_massive_ad_campaign_planned.html

<comment><USER2> Quick word association test:

Google? search

Microsoft? Windows and Office

Bing? ah, the microwave's done

</comment><comment><USER3> Someone has been watching way too much Friends,

</comment><comment><USER4> Does 'Bing' contain Powerset's technology?</comment>


Svelte – The magical disappearing UI framework - <AUTHOR> https://svelte.technology/ <comment><USER2> I'm confused by the anti-runtime argument.

The file size problem is about unused code, right? If we tree-shook the runtime and shipped the minimal version that our app needs, wouldn't that be even _better_ for most apps than inlining the framework? I'd expect that, the moment you use a feature even _twice_ , the runtime approach yields a smaller bundle.

Or is Svelte accepting a file size penalty to avoid the performance overhead of function calls? If so, it'd be nice to see that tradeoff discussed more explicitly: in every app, there are probably features worth inlining and features worth keeping as function calls.

Really, it sounds like Svelte is trying to solve a very general compilers problem with a very specific sledgehammer solution. Sure, tree-shaking and thoughtful inlining are difficult to do well, especially in Javascript, so this makes sense as a first draft for certain use cases. I just wish it were touted as a first draft, rather than a new beautiful finished paradigm.

<comment><USER3> > If we tree-shook the runtime and shipped the minimal version that our app > needs

I've heard this sentiment a lot. The reality is that UI libraries are inherently difficult to tree-shake. You can't run a library that can be used to produce an infinite range of outcomes and expect a tool like Rollup to whittle it down to just the bits you need (source: I'm the creator of Rollup).

Code _is_ reused. While the compiler will output 'standalone' modules by default, it can also generate modules that share code between components — the zero-runtime part is about generating abstraction-free DOM manipulation code rather than having a complex virtual DOM reconciliation or data-binding process.

> rather than a new beautiful finished paradigm

Nowhere does it claim to be finished. If anything, it's the _start_ of a new approach to building UIs.

<comment><USER2> Oh! I think I'm fundamentally misunderstanding the pitch here. Here's my new guess: Svelte analyzes my component tree to discover the graph of data dependencies… and then throws out the component tree entirely, instead outputting code that directly implements my data flow graph.

Is that correct? If so, it's a very cool idea! (I'd been tossing this idea around for a few months last year, but had trouble designing a non-awful API xP)

I wish there were a way to make the messaging around this idea clearer. I know that audiences are different, and this wouldn't work for everyone. But if the introductory blog post had illustrated the transformation from component tree to data graph, I would've _immediately_ understood the performance implications and how this represents a _huge_ paradigm shift in application compilation.

Instead, though, I thought the pitch was "ew, separate runtime library? let's inline it and then it'll be smaller", which seemed misguided. I had to reverse-engineer Svelte's motivation from your comment—and even now I'm still not _sure_ I got it right. (Maybe this entire comment is wrong? Could be wrong. No idea :/)

Are y'all planning a blog post about how Svelte works under the hood? That would go a long way toward clarifying the pitch, I think.

<comment><USER3> Sort of, yeah. The previous wave of declarative UI libraries essentially followed one of two models — there's the 're-render the entire app then apply a diffing algorithm' approach (React and its many imitators), and there's the data-binding approach (Knockout, Rivets, Ractive and later Vue) whereby different nodes in your model/state/data graph (whatever you want to call it) are linked to the DOM, usually via various levels of indirection.

Both are solid ideas. (As the creator of Ractive I'm biased towards data- binding, but React's success speaks for itself.) But either way, the library has to do a lot of work to essentially just translate state changes into `element.setAttribute('foo', 'whatever')` and so on. Svelte was born out of a realisation that if you can understand the shape of your component graph at build time, you can eliminate those runtime abstractions — and with it, both the bytes and the computational cost associated with them.

> Are y'all planning a blog post about how Svelte works under the hood?

Yes, we have a lot of blog posts we need to write! Hopefully soon.

<comment><USER4> Please correct me if I'm off base here, but isn't a big part of the whole virtual-dom abstraction performance?

Direct DOM updates are slow (rerender), diffing and smart patching much faster. There must be a reason for virtual doms becoming so popular, even for frameworks that don't have a 'functional' approach like React.

<comment><USER5> Agreed with Rich, it's a misconception that virtual-dom is faster, web browsers have made significant improvement to DOM. There must be a reason why vanilla Javascript is fastest than most virtual-dom.

Inferno-1.1.0 have an error at runtime, could not test JS Framework right now. Sveltejs works.

<comment><USER6> What issue did you have with Inferno, would mind reporting it please so we can fix it? :)

<comment><USER5> Inferno in JS framework replies use beta, I guess that broken.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Previous discussion [1]

        Svelte – A UI framework that compiles into tiny standalone JavaScript modules (svelte.technology)
        533 points by bpierre 38 days ago | 228 comments

[1] [https://news.ycombinator.com/item?id=13069841](https://news.ycombinator.com/item?id=13069841)

</comment><comment><USER8> Looks to have connectivity with gulp, browserify, webpack, system.js, a lot of stuff. That's rad! I wish it had easier samples to show what the code you write looks like.

I have a couple questions just off the homepage that I didn't quite really get answered:

\- Can I use webpack? Can I add this into my current webpack flow?

\- Can I use TypeScript?

\- How does this compare to preact? Note that their homepage has a lot more info than this one: [https://preactjs.com/](https://preactjs.com/)

<comment><USER9> \- Yes: [https://github.com/sveltejs/svelte- loader](https://github.com/sveltejs/svelte-loader)

\- Unsure

\- Preact is essentially a lightweight implementation of React. As such, it requires a runtime, albeit an incredibly small one, to dynamically render HTML from JSX (Edit: Well, compiled JSX. Essentially hyperscript function calls.).

Svelte components compile _at buildtime_ to pure es5, so you can just run it directly on the client without a runtime.

There are benefits and drawbacks to each method, but that's the gist of their main differences.

<comment><USER8> Sorry if I'm just not getting it. is it compiling some nice language I write into some JS that runs compile time? Or is this a static website generator?

If I use Svelte to make my site, is the expectation that the data is being loaded in the cacheable HTTP call or is it a SPA?

<comment><USER10> Check the REPL and compare the input to the output: [https://svelte.technology/repl](https://svelte.technology/repl)

</comment></comment></comment></comment><comment><USER11> Has anyone done further testing on the growth rate of the compiled code for larger projects? From the discussion when this launched it seems like the difference will be mostly felt by smaller apps. That aside, being able to write 'universal' components that work independently of a framework is still a great thing to have.

<comment><USER3> Since launch we've added the ability to generate code that reuses functions between components. If you use the CLI it will create 'standalone' modules, but if you use something like [https://github.com/rollup/rollup-plugin- svelte](https://github.com/rollup/rollup-plugin-svelte) then code will automatically be reused.

</comment></comment><comment><USER12> Been hoping this would get some more traction. Blog post is a good starting point for those interested... [https://svelte.technology/blog/frameworks- without-the-framew...](https://svelte.technology/blog/frameworks-without-the- framework/)

</comment><comment><USER13> So the core idea is similar to [https://github.com/purifycss/purifycss](https://github.com/purifycss/purifycss) but for JS code.

Then why does Svelte wants to be yet another framework? Do a real good one to the world and be something that you can plug into Gulp or a Makefile...

<comment><USER3> Not really similar at all. It's a compiler, not just a code removal tool.

> Do a real good one to the world and be something that you can plug into Gulp > or a Makefile...

You can easily use Svelte in Gulp tasks or Makefiles. Maybe do a _tiny_ amount of research before criticizing something. God the HN crowd is tedious sometimes

<comment><USER14> Ha!

</comment></comment></comment><comment><USER15> I think with advent of Inferno, 9KB for a view layer runtime, which has overhead of just 4% above vanilla JS is acceptable for me to compiled view layer that repeats code everywhere.

</comment><comment><USER16> Interesting that Rich Harris is also behind rollup and that Svelte appears to use CommonJS instead of ES modules still.

<comment><USER3> It's built out of ES modules (and is bundled by Rollup) but it can compile components to ESM, AMD, CJS, UMD or a browser global, so it can be made to work with just about any setup.

</comment></comment><comment><USER17> "In Svelte, an application is composed from one or more components. A component is a reusable self-contained block of code that encapsulates markup, styles and behaviours that belong together."

So, the idea is to be kind of like Web components? Even after reading the comments in this thread and the website it is hard for me to grasp where Svelte's place is. Is it for people who need the performance without giving up the work flows of the regular frameworks they are so used to? If it is for encapsulation I would say webcomponents is the better choice here? Although you could argue Web components isn't ready yet either for the big masses.

<comment><USER3> Very much like web components, except a) they work everywhere without polyfills, and b) they're nicer to build, because they have a friendlier API and templates are more declarative (with web components you still have to do a lot of grubby manual DOM manipulation) and you don't have to learn a bunch of confusing new shadow DOM stuff just to encapsulate styles.

Also, with Svelte you can do server-side rendering, which is a bit of an oxymoron with web components.

<comment><USER17> a) is a bit of a weak argument as polyfills are a temporary solution until browser support is available everywhere. Also, Web components are (indirectly) part of the W3C spec so browser support will follow.

B) OK. Though subjective.

C) Active support for this is a nice thing to have.

Guess it ain't enough for me to use hut I see its use for others. Still, YAJF as far as I'm concerned.

<comment><USER3> > polyfills are a temporary solution until browser support is available > everywhere

Well, you might be waiting a while! Web components are actually four separate specs. While templates are widely supported, the future for custom elements, shadow DOM and HTML imports is less clear (well it's very clear for HTML imports — it ain't gonna happen). Edge is 'considering' whether to implement shadow DOM and custom elements, Firefox says they're 'in development' but from the outside it looks like that development has stalled.

Even if web components had major advantages that outweighed their disadvantages, _personally_ I'd be very hesitant to use them until browser vendors make their intent to support them much clearer.

<comment><USER17> I agree, hence the last line in my original reply. Web components are not yet ready for (most) production work. Too be honest I'm happy the only work I do in the Web area is an SDK. We chose to use vanilla javascript and typescript over a framework as any framework should be able to pick us up. I worked with a couple of frameworks the past 2-3 years and didn't like any of them. Of course Web is relative new and it takes time to mature. For now, I'll take a pass on this one but keep an eye. They are closest to anything I could use, but let's see what a little maturity brings it.

</comment></comment></comment></comment></comment><comment><USER18> It's funny that everyone on here is pretty critical of this. To the maker, don't pay any attention, your users will give you much better feedback.

<comment><USER3> Thanks! Don't worry, this ain't my first rodeo :-D Just glad for the opportunity to help clear up any misconceptions people have, it's always useful to get feedback about how we can better communicate the ideas.

</comment></comment><comment><USER19> How does this compare with Marko.js, which also compiles (and renders!) JavaScript on the server before sending to the client?

</comment><comment><USER20> I think [http://aurelia.io](http://aurelia.io) is much cleaner.

<comment><USER5> Cleaner as in? Aurelia is on the same idea as Angular 1 by the same inventor.

</comment></comment><comment><USER21> How does anyone even begin to start learning how to make Web 2.0 webpages with a new JS framework every week?

<comment><USER22> If you can't afford to be on the cutting-edge, you use battle-tested technologies, and let the people who can afford it do their thing to shake out which products are worth keeping around. That's sort of the right approach for any software development, yeah?

<comment><USER23> Yeah, but most other technologies don't have new libraries and frameworks coming out every other day. For example, with Ruby, the community has stuck with Rails and Sinatra for more than a decade now. With Python, most developers go with Django or Flask. With Elixir, Phoenix or Plug. With Javascript/Node, however, you have Hapi.js, Sails.js, Mean.js, Koa, Socket.io, Mojito, Express.js, Meteor, Mithril.js, Derby, and others, not to mention the front-end options, like Angular, React, Svelte, etc., Some of these frameworks are even written by the same developers to accomplish largely the same thing (e.g. Express vs. Koa).

This doesn't seem like a great strategy for long-term success. It got to the point with me that I didn't want to invest any more time in Javascript technologies, simply because their lifespans seemed to be quite short, compared to other options. In the Javascript community, framework feel disposable. I don't mind learning, but there has to be time for implementation and mastery, and there has to be some level of long-term career payoff for the time invested in learning. For example, I can still get any number of Rails jobs after 11 or 12 years of using the framework. Can the same be said of the original Express.js? I know it isn't a comprehensive, scientific study, but a quick search on local job boards in my area turns up 15 Rails jobs, and no Express.js jobs. No Hapi.js jobs. No Metor jobs. No Mithril.js jobs. No Derby jobs.

I don't mean to take away from the successes the Javascript community has had over the years. Javascript is certainly in a better state than it was a decade ago. However, having so many libraries and frameworks come and go so quickly isn't a good thing, in my opinion. I think the community could benefit a lot by embracing more cohesion and focus, but that's just my opinion, based on my experience with other languages and communities.

<comment><USER24> I find it kinda funny because we finally have decent cross browser consistency on the front-end, which back in the day, was the main frustration point of front-end dev. Now the problem is finding a framework that you can depend on and invest in long term. Makes me wonder if the browser wars turned front-end devs into masochists and now the only way to satisfy that urge for pain is to reinvent their frameworks on a regular basis. /s

<comment><USER25> Angular isn't going away, even 1.x will probably see updates for another 3-5 years. React also isn't going anywhere with the heavy hitters behind it... although there may be some migration to react-alikes that use jsx etc, but the techniques in the apps are largely the same.

Vue.js is probably here for a while, though a little uncertain, there's definitely some desire there. I'm not sure about Polymer and web-components, I think there will definitely be more web-component packages to work from in the future, but for now, just kind of holding off myself.

I'm pretty actively following the JS world, and tbh in 2012 I felt so in over my head as npm was growing... It's gotten easier. In general, your best bet is to stay a little behind the bleeding edge and look at what the heavy hitters are investing time/money in, and beyond that what you like.

I'm pretty heavy in the React camp (including Preact, Inferno, etc)... Most of the look-alikes are compatible enough to work, or have a similar enough workflow. I happen to like the component structure, and am a fan of Redux as well. Others have hunkered down for Angular2+.

<comment><USER24> I totally agree that those things are not going to simply disappear. It just seems that every new framework supposedly has some distinct advantage that previous frameworks lack and the urge of most front-end devs is to move on to the next shiny thing. If you don't move onto the next shiny thing you are considered to be some sort of luddite or ignorant to the amazing new thing a new framework has.

So while I can pick a framework like the ones you mentioned and stick with it convincing team mates or colleagues to do the same becomes difficult.

<comment><USER26> Then the problem seems to be the colleagues rather than the creation of frameworks. I'm happily following all this framework turnover while totally ignoring it for actual work.

To be fair, I have had colleagues want to switch to some new framework for $reasons, but I guess I have enough sway (and we're time-constrained enough) to not do just that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Code generation, the frontend craze must have arrived at the Java enterprise deadends.

Time to mount the JET emitters and blast out that code.

</comment><comment><USER28> Whenever and wherever I read "rock solid" I stop reading... I hate that expression so much!

<comment><USER29> Why?

<comment><USER30> Because it expresses the authors confidence but doesn't give anything informative. Show me metrics, features, idioms and working examples.

<comment><USER5> Meanwhile, you can download and try the sample code. [https://github.com/sveltejs](https://github.com/sveltejs)

I spent a few days testing and it was an eye opener, compare to the numbers of >100 outstanding issues filed in React, Angular, etc which may probably never fix it for some reason and complexity.

<comment><USER25> Something tells me, should svelt get to the number of stars that React and Angular have, you'll see a similar number of issues.

<comment><USER31> At a minimum, it's a bad comparison metric. It's like with any software rewrite: the first 80% is the easy part. It's when you get down to the fine details of handling specific edge cases that things get really complicated. (Seeing this in a rewrite I've been working on myself.)

Semi-similarly, there's three reasons why React (and other libs) have that many issues: they've been around for a while, they're very popular, and the wide variety of usages has led to a number of edge cases being found. Svelte, being new, hasn't run into any of those things yet. Things like style of development can also affect things - some communities might file more issues than others.

</comment></comment></comment></comment></comment></comment><comment><USER32> Should I feel happy that my js crap compiles into the other js crap?

<comment><USER33> You don't get it: Your js crap compiles to other js crap, yes, but this time your other js crap is BETTER than other peoples js crap who don't use Svelte because apparently downloading an executing 70 kb vue.min.js gzipped to 26 kb is just too much for the toasters people allegedly use to execute your TodoMVC application.

<comment><USER25> Depends on what you're targeting.. a lot of the media stick interfaces, and cheap android phones are pretty under powered. Of course, it also depends on application complexity and types of interaction, animation, etc.

I've found React proper does a pretty decent job of running everywhere I've needed, though I have used preact for smaller extensions, and bits that are adding to an existing app, where I want to add new React-style code, to keep the size down.

</comment></comment></comment><comment><USER34> Can I say something shallow?

I talked to a couple of programmers about the project, and they laughed at me because of the name, dismissing the project and not even wanting to hear about it.

Everyone keeps saying that the name is not important, citing examples like Yahoo, Google etc., but it _is_.

I was reading about how execs didn't want to replace Android with Cyogenmod, and I bet part of the reason is the name. It's hard to pronounce, it contains "mod" in it, and it sounds like a tool for hackers instead of a reputable operating system that corporate would be ok having on all their phones.

"Svelte" sounds like a name for a dish washer brand.

<comment><USER3> 'Svelte' means 'slender and elegant', 'urbane', 'attractively thin, graceful, and stylish', or 'lithe', depending on which dictionary you consult. It comes from the Italian _svelto_ meaning 'quick'. Those are all excellent connotations!

But yes, it seems that a lot of people, at least here in the US, aren't familiar with the word.

It doesn't matter though. I build tools for my job because the existing ones don't meet my needs, and then I share them because there's no good reason not to. I couldn't care less whether or not people use them as long as the ideas get out there. So if someone decides not to use Svelte because they don't like the name, all I do is shrug.

<comment><USER34> I'm from Italy and so were 2 of my programmer friends. We're used to English, though. The other guy is from Sweden. I wonder if it sounds better to people whose first language is English.

It doesn't seem like you care (I guess rightfully), just a note.</comment></comment></comment>


Show HN: s0rce - A New Approach to News - <AUTHOR>

s0rce is a new kind of news site - one that focuses on factual information and data, breaks out of the standard article format, and seeks to better integrate users in the creation of content. We recommend starting with one of our more complete issue/event pages:
http://s0rce.com/issue-event/republican-primary
A more detailed introduction to s0rce can be found here: http://s0rce.com/blog/post/fixing-the-news
We're a two person team, so some aspects of the site and content are incomplete - news is a lot of work. Feedback and contributions are welcome (try clicking the [!] links). <comment><USER2> Clickable links: <http://s0rce.com> <http://s0rce.com/issue-event/republican- primary> <http://s0rce.com/blog/post/fixing-the-news>

</comment><comment><USER3> Dude Adrian this website's the shit. Yo, and if you're looking for really cool ways of presenting data, look up this guy [http://www.amazon.com/Beautiful- Evidence-Edward-R-Tufte/dp/0...](http://www.amazon.com/Beautiful-Evidence- Edward-R-Tufte/dp/0961392177/ref=pd_sim_b_6)

</comment><comment><USER4> Recent news says "Something here" and "Another headline." I'm assuming that'll be something similar to a recent news feed related to your Issues and Events page? Or is that for more general news?

</comment><comment><USER5> There is no Visual Data for "Copyright and Piracy Legislation."

<comment><AUTHOR> Finding reliable data for that one has been a lot of trouble; there's a variety of ideas as far as what constitutes music sales, and many of the useful numbers are behind RIAA and IFPI paywalls.</comment></comment>


Show HN: Disk.frame, a larger-than-RAM data manipulation package - <AUTHOR> http://diskframe.com/ <comment><USER2> Is this any different than Parquet ([https://parquet.apache.org/](https://parquet.apache.org/) \-- index, columnar data split across files), Feather ([https://github.com/wesm/feather](https://github.com/wesm/feather) \-- which has first class R support or FST ([https://www.fstpackage.org/](https://www.fstpackage.org/) \-- Also first class R support)?

<comment><AUTHOR> Those are file formats. Disk.frame is for manipulating the data. It actually uses fst as the storage format</comment></comment>


Ranking Programming Languages by GitHub Users - <AUTHOR> http://www.benfrederickson.com/ranking-programming-languages-by-github-users/ <comment><USER2> Author here - happy to answer any questions anyone has.

<comment><USER3> A user can interact with more than one repo in a month, and hence more than one language, so we shouldn't expect the percentages in the table to sum to 100. In fact they sum to about 106, which is pretty close. Does this mean few people use more than one language?

Probably many users do nothing in a typical month. How do the results change looking at yearly active users instead?

Edit: Similarly, the "Percentage of MAU" in the charts isn't percentage of active users each month, but rather the percentage of all registered users, correct?

<comment><USER2> I just saw your question on proggit, and I lazily cut-and-paste the answer for here =):

For your first question - yes this means few people use more than one language in a month. There is also a power law distribution happening with user activity each month, so most users only have a handful of events each month (which happen to be mostly in a single language). I'm trying to measure how broad support it so this was mostly done on purpose. I was finding counting total events was getting biased by things that I most have been automatic activity (I was seeing single accounts with 10K commits a day for instance).

Percent of MAU in the charts is the total percentage of unique users who were active that month. I haven't tried out with yearly active users =(

</comment></comment></comment><comment><USER4> Very insightful, thanks.

<comment><USER2> Thanks! It was fun to put together.</comment></comment>


How to get input from a flashplayer game to make a bot? (No visual input) - <AUTHOR> Hey guys,
Recently, I made a bot which can play the game "Snake", with only visual inputs.
this game: -->> http://www.speeleiland.nl/snake.htm
But the problem is, sometimes it's kind of laggy .
The visual input, a sort of stream of printscreens of a certain part of my screen (the game) is too heavy.
I was wondering if there is a way to get the location of the head of the snake during the game, leaked out of the webbased game. So I can write a bot with that live information, which is constantly up-to-date.
I probably would write the code in Python, so can I extract that information (location of head of snake) out of the flash player and use it in Python code ? <comment><USER2> [http://stackoverflow.com/](http://stackoverflow.com/)</comment>