Heartbleed is about to get worse, and it will slow the Internet to a crawl - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2014/04/14/heartbleed-is-about-to-get-worse-and-it-will-slow-the-internet-to-a-crawl/?clsrd <comment><USER2> Nothing really new here - just the acknowledgement that the ability to steal private ssl keys requires a massive effort to replace those keys.

"If anything is compromised, assume everything is compromised."

Our keys have been updated (and the old certs revoked), our servers patched, our sessions expired, and passwords expired. Mitigation more or less complete. Helps we're running a very small site, for sure, but the steps were clear from the beginning.

<comment><USER3> But have you _revoked_ your old primary keys? Everybody that was vulnerable to Heartbleed should _revoke_ their old primary keys so that web browsers no longer trust those potentially stolen keys. If they are not revoked and a Bad Guy stole your primary key(s), they can create a fake web site that identifies itself as _your_ web site _and_ all web browsers would trust it as legitimate, complete with the little green "you can trust me" padlock.

The CloudFlare challenge proved that the primary keys _could_ be stolen.

There were millions of vulnerable sites (the internet is approaching a billion total web sites, and a significant number of them were vulnerable). The revocation list method used by browsers does not scale well with those kinds of numbers.

[1] [http://news.netcraft.com/archives/category/web-server- survey...](http://news.netcraft.com/archives/category/web-server-survey/)

<comment><USER4> Doesn't rekeying result in the old certificate based on the compromised private key being revoked?

<comment><USER5> No, presenting a certificate that has been rekeyed does not mean that the old certificate stopped being cryptographically valid.

In fact the old cert will always be cryptographically valid, which is why a separate revocation list has to be created as a positive acknowledgement that the old cert, though valid, should not be trusted.

<comment><USER6> Do the browsers actually use revocation checking?

<comment><USER2> Firefox does. Found that out in my development box which I hadn't updated with the new certs, the old certs showed up as revoked and Firefox wouldn't let me proceed.

</comment></comment></comment></comment></comment></comment><comment><USER7> Do CRLs even work? My understanding is that the only browser that hard-fails to load a page if OCSP is blocked is Chrome for certs in CRLSets. Everyone else is vulnerable to MITM if access to the CRL / OCSP servers is blocked.

I would love to be wrong. Does anyone know if anything has changed for the better since 2011?

[http://blog.spiderlabs.com/2011/04/certificate-revocation- be...](http://blog.spiderlabs.com/2011/04/certificate-revocation-behavior-in- modern-browsers.html) [http://dev.chromium.org/Home/chromium- security/crlsets](http://dev.chromium.org/Home/chromium-security/crlsets) [https://www.imperialviolet.org/2011/03/18/revocation.html](https://www.imperialviolet.org/2011/03/18/revocation.html)

</comment><comment><USER8> This sentence: "No examples have surfaced of anyone actually exploiting the vulnerability" is incorrect. The Canada Revenue Agency revealed that 900 SINs (canadian equivalent of SSNs, but nowhere near as totemically identifying) were stolen due to the heartbleed bug. [http://www.theglobeandmail.com/technology/mounties- chasing-v...](http://www.theglobeandmail.com/technology/mounties-chasing- viable-lead-in-cras-heartbleed-breach/article18002731/)

<comment><USER9> In order to know this they must have stored and subsequently analysed the ssl traffic. Something that I would think is quite unusual. So the true scope of data theft is probably much larger.

<comment><USER10> They might have turned on that logging when the bug was announced so that they'd have an idea of the threat they were under while updating.

</comment></comment></comment><comment><USER11> _According to Paul Mutton, a security consultant at the Web services company Netcraft. Checking a site's identity will take vastly longer.

"If a certificate authority has to revoke 10,000 certificates, that entry will have 10,000 certificates on it," Mutton said. "And if browsers have to download that . . . we're talking hundreds of megabytes."

It's roughly the equivalent of having to download 30 minutes' worth of standard-definition video just to view a single Web page._

> is this accurate?

<comment><USER12> Would it be possible to use a probabilistic data structure (e.g. Bloom filter) to create a privacy-enabled CRL as a service?

<comment><USER3> You could distrust any certificate that was signed before April 7 (or some slightly later date). It might be easier to do that and _whitelist_ the _good_ "pre-apocalypse" certificates. The nice thing about doing this is that your whitelist will inherently go to zero as certificates time out and get renewed (typically 1-3 years?).

The hard thing would be to generate an accurate whitelist.

<comment><USER13> We had certs that were only used and present on machines that were not vulnerable, and therefore did not replace or revoke them. Please don't do this.

<comment><USER14> Furthermore servers that weren't even using OpenSSL or the particular version(s) that were susceptible. What is the actual percentage of servers that needed to react to this?

</comment></comment></comment></comment></comment><comment><USER15> The situation would be much more manageable if browser vendors provided an online service that quickly allows individual certificates to be checked against the latest revocation list from all trusted CAs. There should be no need for each user to download the full revocation list, since most people will never visit 99.9% of the websites in that list.

Until now, revocation lists were small enough that this was not a problem. But it's probably time to fix that.

There are already third-party add-ons like Perspectives that check the certificates you see against those seen by other people. Chrome already knows which Google certs are valid or not. There's no reason why Mozilla, for example, shouldn't make something like this an official security feature of Firefox, too.

<comment><USER16> This is OCSP. Chrome removed their support for it, but I think Firefox might check it.

</comment></comment><comment><USER17> 1)

Lets just call a do-over, EVERYONE generate new private keys and request new certs. Any cert created before April 10 2014 will be considered suspect.

2)

Create a bloom filter for revoked certs. Have a remote cert revocation server/cache so I don't need to have a 50MB file of revocations.

<comment><USER18> False positives are a problem for a Bloom filter. You could conceivably create one for a given registrar, though, which could in theory create a Bloom filter, iterate through all the certs it has issued, and then list out the certs that the Bloom filter issues false positives for, but are still valid. However, it's too late to put that into play. Nobody ever expected to have to revoke this quantity of certs. (In hindsight, that was obviously wrong. Something like this was going to happen someday. But this is exactly the sort of thing that's very easy to argue away, because nobody _wants_ to be convinced that this amount of work will be necessary.)

</comment></comment><comment><USER9> Question: with a stolen private key don't you still have the problem that is has the host name in it? So to truly spoof a browser you need to compromise the domain and serve a site from within it?

<comment><USER5> It depends on what you're going after, but if you're just targeting a local subnet, that's what a "man-in-the-middle" attack is for.

What is probably easier is somehow redirecting the DNS entry for the target site to point to your malware-serving site, which has happened before as well.</comment></comment>


Tesla – Lithium-ion storage is ready to power the grid - <AUTHOR> https://www.bloomberg.com/news/articles/2017-01-30/tesla-s-battery-revolution-just-reached-critical-mass <comment><USER2> There's a missing parameter here: the number of recharge cycles a battery can have without losing large capacity , because over the long term - decades, like done in this business, that's what determines the cost per kwh charge stored and supplied, i.e. what end users pay for.

Without those numbers, it's not possibe to judge Tesla against the competition, for example Alevo, which claims more the 50,000 charge cycles, vs ,i believe, 5000 charge cycles for Tesla.

For Alevo, the final cost per store/supplied should be ~3cents/kwh, over 20 earss lifespan, which should make grid storage very economical.

<comment><USER3> I also wonder how it compares in cost to pumped storage hydroelectric.

You can use excess power to pump water uphill and then release it to generate hydro power when needed. Requires the right geography but it can essentially store huge amounts of power and it's apparently pretty cost effective.

California already has at least a couple that I can see:

\- Helms Pumped Storage Plant[1] - 1.2GW capacity

\- Castaic Power Plant[2] - 1.5GW capacity

That's like 60+ tesla plants each.

[1][https://en.wikipedia.org/wiki/Helms_Pumped_Storage_Plant](https://en.wikipedia.org/wiki/Helms_Pumped_Storage_Plant)

[2][https://en.wikipedia.org/wiki/Castaic_Power_Plant](https://en.wikipedia.org/wiki/Castaic_Power_Plant)

<comment><USER4> Pumped storage hydro is great, but it is limited to places that have the right terrain.

<comment><USER3> I wonder what the cost would be of pumped storage in just like a massive water tank on a hill, or a big manually dug out lake, rather than in somewhere that could actually be a natural lake.

<comment><USER5> Taum Sauk, an artificial pumped storage facility which famously failed, was rebuilt to 3600 MW·h for $490 million. So that was like $136 per kwh capacity, though I think they didn't have to do much for the lower reservoir (which was built in the 60s). Seems to be a lot better than batteries, though still requires appropriate terrain.

[https://en.wikipedia.org/wiki/Taum_Sauk_Hydroelectric_Power_...](https://en.wikipedia.org/wiki/Taum_Sauk_Hydroelectric_Power_Station)

</comment></comment></comment></comment></comment><comment><USER6> There seems to be some conflicting information in the article, I don't understand how these quotes line up:

"...prices for lithium-ion batteries have fallen fast — by almost half just since 2014." "But for the most part, according to a BNEF analysis, the costs of new projects would need to drop by half in order to be profitable on a wider scale in California, and that's not likely to happen for another decade."

The prices for the batteries dropped by half in 2 years, but it will take a decade for them to drop by the same amount again? What am I missing here?

Also the chart seems to indicate the cost was $273/kWh to build a plant in 2016, but then they say "While Tesla declined to provide its pricing data, the similarly sized Altagas project was expected to cost at least $40 million, or $500 per kilowatt hour." I guess the costs unrelated to the battery cells themselves added another ~$230/kWh in costs?

<comment><USER7> It says the cost of the project needs to drop by half not the cost of the batteries. It could be that the cost of batteries is only a small amount of the overall cost. That is what you see with solar, most of the cost comes from installation.

<comment><USER8> _the cost of the project needs to drop by half not the cost of the batteries_

Manufacture larger self-contained units the size of a standard shipping container?

<comment><USER9> that would be awesome, but would be one heavy shipping container..

<comment><USER10> Well, given we ship around semi-trucks full (ok not completely full due to the exact weight you describe) of lead-acid car batteries for recycling, it wouldn't be unthinkable. Li-on, I believe, is roughly 200% lighter for the same battery.

IE: [http://www.powertechsystems.eu/home/tech-corner/lithium- ion-...](http://www.powertechsystems.eu/home/tech-corner/lithium-ion-vs-lead- acid-battery/)

Not sure how that carries over to larger batteries as I've only really dealt with them for ATV type use.

<comment><USER11> Is 200% lighter half as heavy, or is it buoyant? Cause 100% lighter is weightless. So 200% would be a negative weight. I am just confused.

<comment><USER12> You are correct, the link to powertechsystems.eu has those erroneous percentage calculations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Statistics aside, this is wonderful. It makes a teenager like me optimistic about our energy future. Love the fast roll out too. In 50 years we will be thanking Elon Musk for saving all our asses.

</comment><comment><USER14> Can anyone explain the logic behind having lots of small batteries, rather than the power company buying a Big Battery and offering this as a service?

Two reasons occur to me:

1\. Situations off the grid or with unreliable power (eg blackouts) 2\. Transmission costs are high, so it's better to have the storage close to the source.

Even in the second case, it seems like the power company could distribute these. I wonder if they are just more regulated/slow moving/immune to marketing.

<comment><USER15> I am not any kind of battery engineer, but...

My understanding is a primary limitation for these batteries is cooling. Cooling ability is relative to the surface area of the battery. One giant battery has much lower surface area than a bunch of small ones.

Also having a large number of batteries lets you put different cells on different recharge cycles to maximize battery life. You can use a small number of worn out cells for brief minute-to-minute fluctuations while you keep fresher cells on longer cycle that optimizes lifetime. With one big battery you're just stuck with whatever wear characteristics the usage curve gives you.

</comment></comment><comment><USER16> I'm curious - if you take a normal Li-ion battery out of a phone (for example) and whack it with a hammer it'll put on a pretty decent and dangerous show. Can the same thing happen to a big battery?

I'd imagine they wouldn't be as 'flimsy' as the ones in a phone, and weight isn't really an issue so they could happily have some kind of extra insulation/shielding.

<comment><USER17> Why yes, there's engineering that goes into stopping a fire from spreading. Here's some info about a fire safety test done to a Tesla Powerpack:

[https://electrek.co/2016/12/19/tesla-fire-powerpack-test- saf...](https://electrek.co/2016/12/19/tesla-fire-powerpack-test-safety/)

<comment><USER16> Nice, thanks for the link, I was sort of hoping it would explode violently but probably good that it didn't.

</comment></comment></comment><comment><USER18> This is slightly OT since it deals with home batteries, not gigawatts, but here is a simulation of the Tesla Powerwall including putting power back on the grid: [https://forio.com/app/powersim/powerwall- simulation/](https://forio.com/app/powersim/powerwall-simulation/)

</comment><comment><USER19> It seems like once they get their costs nailed down leasing them, and basically taking the first X% profit, giving 'green' thinking people new tech to show off, leverageable during power events at a profit if done in concert with energy companies.

</comment><comment><USER20> for about $57,000 American you can get 370kwh centrifugal energy storage from Beacon Power excluding inverter, with a design life of 100 years bearing service every 20 years. that's about $154/kwh and 100 year life.

</comment><comment><USER21> "battery plants take up a much smaller footprint than gas-powered plants"

Im pretty confused by this. The energy density of LPG is 10x that of lithium- ion, so why isn't the footprint smaller?

<comment><USER22> just guessing, maybe they mean the whole facility.

<comment><USER23> Kinda like nuclear core vs nuclear plant ?

</comment></comment></comment><comment><USER24> Recent discussion: [https://news.ycombinator.com/item?id=13467572](https://news.ycombinator.com/item?id=13467572)

</comment><comment><USER25> Says Tesla who bet the farm on lithium-based batteries.

There are better processes and chemistries hitting the market in the next year - they just need to reach volume.

<comment><USER26> Curious, what kind of stuff is coming out that's better than Tesla?

I'd imagine there's all types of companies trying to solve this in different ways.

<comment><USER27> High energy density matters a lot for electric vehicles but very little for stationary grid-tied storage, so many more chemistries are potentially viable for grid tied storage. The really interesting question is whether one or more of them will reach sufficient volume to overcome the head start of lithium ion.

A lot of thin film solar PV companies were quite sure that their costs would be lower than the incumbent, crystalline silicon, once the manufacturing volume got high enough. Most went bankrupt because their manufacturing volume never grew fast enough for their designs' advantages to overcome the handicap of smaller scale production. Tesla's chemistry uses cobalt, which is expensive, but I don't know if low raw material costs alone are enough for (e.g.) sodium ion batteries to win over something like lithium iron phosphate batteries.

</comment></comment></comment><comment><USER28> It will be interesting to see the old v new businesses powerplay with technologies like these coming up so fast.

</comment><comment><USER29> Is there such a thing as "conflict free lithium"?

<comment><USER27> Conflict free lithium is just called lithium. None of the top producers have active conflicts.

[https://en.wikipedia.org/wiki/List_of_countries_by_lithium_p...](https://en.wikipedia.org/wiki/List_of_countries_by_lithium_production)

</comment></comment><comment><USER30> "But for the most part, according to a BNEF analysis, the costs of new projects would need to drop by half in order to be profitable on a wider scale in California, and that's not likely to happen for another decade"

The plunder continues...</comment>


The acceptance of bad scientific practice to the benefit of productivity - <AUTHOR> http://backreaction.blogspot.com/2018/09/science-has-problem-and-we-must-talk.html <comment><USER2> J.M. Ziman wrote in 1962: "It is typical of modern physicists that they will erect skyscrapers of theory upon the slender foundations of outrageously simplified models."

I guess it is only a matter of time before the proverbial skyscraper collapses. I have had first hand experience with publishing papers of decreasing relevance. It's almost always due to professors being unwilling to give up their mental model of reality. I had one professor tell me he would not let me publish my result because it contradicted a paper he wrote in the late 70s. It was the grossest violation of the spirit and purpose of science I've encountered, and it quickly turned me off from the whole institution. Egos in academia are often unchecked.

<comment><USER3> At least these physics models lead to testable predictions. You should see what goes on in economics.

<comment><USER4> Curious about why the parent comment is getting downvoted.

</comment></comment></comment><comment><USER5> "This problem cannot be solved by appointing non-experts to review panels – that merely creates incentives for research that's easy to comprehend."

That doesn't sound SO bad. Selection criteria seems like a major issue here, and the author only talks about the validity of the results.

Why do we care about physics? Or psychology? There are answers to these simple questions, but I don't think the answers inform the selection criteria. We don't care about physics because academic researchers need to publish papers or get funding.

Having any old non-expert on the panel could be problematic. Especially if they become political tools, and right now they'd definitely become political tools. But it would seem reasonable to me if there were adjacent experts. What do engineers or chemists want to see in physics? These aren't hostile interlopers. But if nobody outside a field cares about a line of research, or trusts a line of research, then maybe that's a bad line of research.

<comment><USER6> You're right. What we should also do is that all critical code that may significantly impact lives and people's wealth and security should be written in a manner that can be understood by laymen.

So functional programming is right out. Anything more complex than BASIC is probably not a solution. Probably only literate programming is allowed.

<comment><USER5> There was some short Ted Nelson video I watched a while ago (I'm afraid I'll never find it) where he made this claim: they needed SQL and a separation of concerns (i.e., DBA) to build up a financial system where it was hard to embezzle money. And it's not JUST ACID and transactions that you need (though you definitely need those things!) but also the ability to audit access to the database-of-record, which SQL gives you.

Maybe the corollary is that you should build up an appropriate domain DSL so that you can express your important claims or transactions in a comprehensible way. It's not to say that you can't misimplement the DSL to your advantage, but there's an implicit good-faith claim you are making that is different from raw vertically-integrated code.

</comment></comment></comment><comment><USER7> A graduating PhD student in theoretical physics from a Top 5 school said something similar to me last year. Roughly, he said it was very easy to slip into bullshitty fooling yourself when doing theoretical physics research, and it took vigilance _from within_ to do truly good research, because external bodies were unlikely to really punish you as long as the math worked out.

<comment><USER8> > it took vigilance from within to do truly good research

Well said. I've been mulling on the idea that a scientific mindset must include a deeply embedded skepticism that isn't afraid to analyze and question even the most pervasive and mundane aspects of one's own being.

Of course, one has to get through the day and take care of life, in a practical fashion. But I think too often we assume our actions to be much more intentional than they actually are.

</comment></comment><comment><USER7> I like that this article includes suggested changes:

> For starters, every scientist should know how being part of a group can > affect their opinion. Grants should not be awarded based on popularity. > Researchers who leave fields of declining promise need encouragement, not > punishment because their productivity may dwindle while they retrain. And we > should generally require scientists to name both advantages and shortcomings > of their hypotheses.

The first and last points look good to me. The middle two, not so much. They certainly sound reasonable, but what does a grant system not based on "popularity" mean? How is it different from what we have now, where we find some (putative) experts in the area, put it in front of them, and ask what they think? We need _some_ way of deciding what to fund and what not to fund, and who exactly is better equipped to make those decisions than existing researchers?

Similarly, I like the idea that people should be able to switch fields. But the implicit argument seems to be that the emphasis on publications makes this difficult, so publications should be de-emphasized in assessing researcher quality. But what is better? Asking a researcher's peers? Then it is a popularity contest again. Weighting publications differently, i.e. "what are your 5 best papers?" rather than "how many papers do you have?"? Then who judges the 5?

For all the criticism heaped upon bibliometrics: they get used because assessing the quality of most research is difficult, so even noisy filters like conferences (in CS) or journals are taken as a useful signal. It's not clear to me what better options exist, especially when trying to choose between many options. It's just not possible for one person or even a small group of people to truly familiarize themselves with the bodies of work of all 100 candidates for a faculty position/grant/fellowship/etc.

<comment><USER9> Agreed, and I would add that suggestions 1 and 4, although fine, will not be enough to make a substantive difference. To be honest, Sen. Paul's suggestion (if implemented properly, i.e. add experts from other fields rather than political hacks) sounds more likely to help.

</comment></comment><comment><USER10> I wholeheartedly agree with this assessment. I think the culture is extremely toxic, and it pushes out many promising students and researchers.

</comment><comment><USER11> I think this article is looking at the effect rather than the cause. Why might it be that so much of science has started to edge away from well... science. Today nearly 1 in 8 people have a masters degree or higher. And in one in 33 have a doctorate or professional degree. [1] And these numbers seem to be increasing. That's really insane if you think about it. We now have more people with postgraduate degrees than had any degree in 1970, and postgraduate education generally implies a necessity to publish. But discovering genuinely new and novel information is not easy. So what do people publish instead? Enter the current state of science and academia. I think the most informative paragraph in this article was:

" _Or look at Brian Wansink, the Cornell Professor with the bottomless soup bowl experiment. He recently drew unwanted attention to himself with a blogpost in which he advised a student to try harder getting results out of data because it "cost us a lot of time and our own money to collect." Had Wansink been aware that massaging data until it delivers is not sound statistical procedure, he'd probably not have blogged about it._ "

Physics is one of the least susceptible to this issue, but no field is immune. The issue is that 'science' has become more about publishing than actual discovery. The two should be synonymous, but they are not.

[1] - [https://en.wikipedia.org/wiki/Educational_attainment_in_the_...](https://en.wikipedia.org/wiki/Educational_attainment_in_the_United_States#General_attainment_of_degrees/diplomas)

<comment><USER12> The statistics about masters and professional degrees are mostly irrelevant; those aren't research degrees and, although there are some exceptions, people with those degrees don't publish science.

1.77% of the 25+ population has a doctorate degree. Even among those, a huge amount are not PhDs and are not really research-focused. E.g., go read the CV of the typical University of Phoenix doctorate holder.

Furthermore, it's worth noting that the world got a lot more complex since the mid-20th century. The entire field of Computer Science happened, for example.

<comment><USER11> Definitely great points. On the other hand, even when you really lowball the numbers - I do think the point remains. 1.77% is 3.5 million people with doctorates in the USA alone. Perhaps we can see this issue manifest is something more directly quantifiable. Postdoctoral researchers tend to be some of the most highly educated and ostensibly skilled individuals in our population. Yet an average postdoc [1] will tend to earn [much] less than a mailman [2]. It seems difficult to explain this outside of a severe oversupply. And should the rate of people pursuing doctorates be increasing, which seems to be the case, I think we can expect things to get even more silly both in terms of compensation as well as output quality.

[1] - [https://grants.nih.gov/grants/guide/notice-files/NOT- OD-15-0...](https://grants.nih.gov/grants/guide/notice-files/NOT- OD-15-048.html)

[2] - [https://www.bls.gov/oes/current/oes435052.htm](https://www.bls.gov/oes/current/oes435052.htm)

<comment><USER12> First, I'm generally skeptical that "the market" is accurately pricing the value of work produced by either postdocs _or_ federal mail carriers.

Second, a postdoc is still a training position. Medical residents are also not paid much better than mail carriers either.

Third, postdocs select for two types of people: those who want R1 professorships and those who need a position to stay in the country. Both of those groups drive down wages. I.e., it's sort of meaningless to compare a group of people who are working for the money to a group of people who are working for a shot at a seat in the upper tier of a tournament-style profession.

Fourth, both annual and lifetime earnings of PhD holders (at least in STEM) continue to outperform high school graduates (including mail carriers).

There's an oversupply of people interested in R1 faculty positions, but that doesn't mean there's a oversupply of phds per se. The labor market seems to absorb these people quite readily and at apparently high salaries as soon as they decide to quit academia.

<comment><USER11> The market is not created by some third party. It simply represents the meeting point between what people are willing to buy for and what people are willing to sell for. That postdocs are willing to work for scraps relative to their skill level is indicative that supply has gone way beyond demand. For instance software developers also face similar issues of what you're mentioning with lower wage foreign workers willing to accept much less thus driving wages down, yet nonetheless high demand keeps wages high.

This is not particularly controversial and some have even suggested that starting to increasingly restrict the number of graduate students admitted could be the right path forward, as mentioned in this article [1] from John Hopkins: _These and other suggestions for career preparation make one implicit assumption: that the nation needs the current number of biomedical scientists. A radically different approach to balancing the biomedical workforce equation would be to simply reduce the "supply" — that is, admit fewer students into science graduate programs._ The article ends on what was apparently supposed to be an up beat note suggesting that instead of such draconian measures, perhaps we can look to people who are doing things like aiming to go teach high school science, with a doctorate.

<comment><USER12> And on the other hand you see things like [https://cra.org/articles- addressing-shortage-of-cs-professor...](https://cra.org/articles-addressing- shortage-of-cs-professors-across-many-institutions/)

Just like there's a glut of wordpress plugin authors and a shortage of ML experts, different fields of academia have different levels of supply/demand.

Also, USPS really is _not_ a prototypical example of free labor market: those salaries/pensions/benefits will be a lot smaller if/when usps privatizes...

</comment></comment></comment></comment></comment></comment><comment><USER13> Is there any advice onto how one deals with research misconduct in the industry? That allows to avoid expensive pitfalls like Theranos? Is leaving the place the best option? Simply leaving the place doesn't seem optimal. It feels like, it just leaves an opening for a recent H1 from a poor country, with a different tolerance for dishonesty. And the end-result is continuing misconduct.

<comment><USER2> I think you should speak up with the expectation that whistleblowers don't do well, but with the knowledge that science corrects only if scientists correct it. It's unlikely a single person can take down the culture of an industry, but one person can certainly start a movement.

You're definitely well justified in feeling torn about this. I agree that leaving in silence is not the best idea, but I certainly wouldn't blame you if you did that. It's hard to take action.</comment></comment>


[PDF] LiveJournal's Backend: A history of scaling - <AUTHOR> http://danga.com/words/2005_oscon/oscon-2005.pdf <comment><USER2> Brad is definitely my biggest technical role model by far. A completely open source stack: Linux, Perl (Apache mod_perl), MySQL. Besides creating LiveJournal he created Memcached, Perlbal, MogileFS, and OpenID which power some of the biggest sites (even competitors which he is happy about). He probably holds the record for scaling on the cheap. He's also unbelievably steadfast in doing right by his users. He has lost a lot of control since selling to SixApart, but he's still working hard. His blog is super great reading for wanna-be's like me: http://brad.livejournal.com/ The way he tackles technical issues is inspiring as hell, he says "there should be X" and then hammers away non-stop until it exists.

</comment><comment><USER3> Does anyone have a link to a video of this presentation?</comment>


Equality of opportunity is dying, Dalio says - <AUTHOR> https://www.huffingtonpost.in/entry/ray-dalio-the-system-is-broken_in_5dca1ba3e4b0fcfb7f6bb629 <comment><USER2> It should be crystal clear that the issues being discussed in this article are not endemic to Capitalism. Markets can benefit from regulation and government intervention, sure. But when your interventions cause problems, don't point the finger at Capitalism. And certainly don't use the existence of ill- conceived interventions and their negative impacts as an excuse for a new round of novel interventions.

<comment><USER3> Interesting take. Whats your solution?</comment></comment>


Racket mode for GNU Emacs - <AUTHOR> https://github.com/greghendershott/racket-mode#racket-mode-for-gnu-emacs <comment><USER2> First off I want to commend the author for making this. Secondly, while I realise it says:

> If you've used other Lisps and Schemes before, you may prefer Geiser, which > is very sophisticated.

I'd like to ask if there are any reasons to use this over Geiser? It's my current choice for an emacs racket mode so I'd like to know if there are any features in this which geiser is lacking.

<comment><USER3> Racket-mode's author is Greg Henderschott, creator of Cakewalk. He's active under the Racket tag on StackOverflow. Based on his comments there, Racket- mode is primarily driven by his needs, and these aren't fully met by Geiser...I think he has also used it as a way to learn more about Racket.

[https://en.m.wikipedia.org/wiki/Cakewalk_(company)](https://en.m.wikipedia.org/wiki/Cakewalk_\(company\))

</comment></comment><comment><USER4> I see no mention of it in the readme, but one of the things I missed while learning Racket was the ability to use images and media the way that you can in DrRacket. It's a silly feature if you are actually experienced with either tool, but when you're learning (especially with the beginner guides on Racket's site) it sure would be nice if you could follow [almost] as you would with DrRacket.

<comment><USER5> iirc, geiser supports images in a racket repl inside emacs.

<comment><USER4> Looks to me like the repl will display images but you can't just embed an image in the source code as in DrRacket. Any ideas?

<comment><USER6> I wrote (part of) the patch that lets geiser display images in the REPL. It's only for interactive use: when a function returns a picture, Emacs displays it. It's not part of the file.

The way Racket embeds images into your source code is actually somewhat interesting. If a `.rkt` file includes a rich element (eg. image, table, GUI structure, etc.) then the result file format is not strictly human-readable anymore. Instead, the source code is stored in the homegrown 'WXME' format which, while text-based, is not actually human-parsable anymore. That makes source code diffs a pain.

Emacs could technically parse these files on load and write them on save, but that might be a bit tricky. The Racket library that reads and writes this format is documented at [http://docs.racket- lang.org/gui/WXME_Decoding.html?q=wxme](http://docs.racket- lang.org/gui/WXME_Decoding.html?q=wxme) .

<comment><USER7> Thanks to the head start provided by gcr, recently I added the equivalent of geiser's support for images in the REPL, to racket-mode.

As for supporting WXME format files: Although that sounds very cool, I don't think that's within the scope of what I want to attempt for racket-mode (or have time to do) now.

p.s. The video of my demo at RacketCon was posted recently: [https://www.youtube.com/watch?v=QWiteH8PARQ&list=LLoI3ip0MG_...](https://www.youtube.com/watch?v=QWiteH8PARQ&list=LLoI3ip0MG_BCk_KUpkxeejQ&index=1)

p.p.s. My "30 year old technology" comment was re the previous speaker. I am definitely not begin derogatory about Emacs. :)

</comment></comment></comment></comment></comment><comment><USER8> What a racket-mode for emacs could really use is support for images in Racket files and for parsing the binary format thar DrRacket reverts to when a file contains images.

</comment><comment><USER9> This looks like a great first attempt at writing two Emacs major mode packages. I am going to try it tomorrow.</comment>


Surprise in my logs (Or how I could use Google for proxying and SQL Injection) - <AUTHOR> http://ezra.c.com.mx/2013/10/surprise-in-my-logs-or-how-i-use-google.html

<comment><USER2> You should resend this to Google now it's published, they might think again about fixing it or changing behaviour.</comment>


Beer bubble: how price of a pint has risen twenty-fold - <AUTHOR> http://www.telegraph.co.uk/finance/personalfinance/10682032/Beer-bubble-how-price-of-a-pint-has-risen-twenty-fold.html

<comment><USER2> This article completely ignores that fact that incomes have risen as well. [http://www.theguardian.com/uk/2004/mar/05/health.drugsandalc...](http://www.theguardian.com/uk/2004/mar/05/health.drugsandalcohol)

From $32/week to $145/week, which by my calculation is a 15 fold increase. (but I'm not great at calculating)</comment>


Preprint Abstract:1061 COVID19 patients treated with Hydroxychloroquine+AZM [pdf] - <AUTHOR> https://www.mediterranee-infection.com/wp-content/uploads/2020/04/Abstract_Raoult_EarlyTrtCovid19_09042020_vD1v.pdf <comment><AUTHOR> There is also a table with more details here [https://www.mediterranee- infection.com/wp-content/uploads/20...](https://www.mediterranee- infection.com/wp- content/uploads/2020/04/Table_final_website_IHU_09_04_2020.pdf)

But it's still unpublished at this stage

There have been already many reactions to these new claims. Very quick to dismiss him again for the lack of any control group despite him comparing to other hospitals who do not treat with HCQ...

</comment><comment><USER2> From the Abstract: _...

Mortality was significantly lower in patients who had received 3 days of HCQ- AZ than in patients treated with other regimens both at IHU and in all Marseille public hospitals...

Interpretation

The HCQ-AZ combination, when started immediately after diagnosis, is a safe and efficient treatment for COVID-19, with a mortality rate of 0.5%, in elderly patients. It avoids worsening and clears virus persistence and contagiosity in most cases._</comment>


"My code is sort of similar to a dead body" - <AUTHOR> https://xkcd.com/2138/ <comment><USER2> How do folks view the alt text on mobile? With Firefox I can long press on the image and it'll show me _part_ of it, but to see the whole thing I have to use the "Page > view source" but that isn't available on Chrome, nor iOS Safari AFAIK

I much prefer SMBC's "red button" for accessibility, but xkcd is unlikely to change just for mobile users

<comment><USER3> If you long press the comic in safari you can see the alt text.</comment></comment>


Night-before-opsmas.txt - <AUTHOR> https://gist.github.com/anonymous/8109885

<comment><USER2> Happy holidays to you! I am still on ops duty right now :)

</comment><comment><USER3> That would be me right now, minus everything breaking (otherwise I wouldn't be on HN of course). Merry Christmas! :)

<comment><USER4> Here's to hoping you get some time off in the next day or so!

Cheers!</comment></comment>


It Is Not OK to Hate Me - <AUTHOR> http://bsiscovick.tumblr.com/post/51518921750/it-is-not-ok-to-hate-me

<comment><AUTHOR> Hating VCs is the cool thing to do these days. Its always valuable to see the other perspective.</comment>


Volkswagen Scandal Reaches All the Way to the Top, Lawsuits Say - <AUTHOR> http://www.nytimes.com/2016/07/20/business/international/volkswagen-ny-attorney-general-emissions-scandal.html <comment><AUTHOR> After the scandal originally broke last year VW tried to claim it was the fault of a rogue engineer... Lawsuits by New York, Massachusetts and Maryland argue differently:

> For the first time, the suits connected Volkswagen's chief executive, > Matthias Müller, to the scandal, saying he was aware of a 2006 decision to > not outfit Audi vehicles with equipment needed to meet American clean-air > standards.

This is notable because Müller was named CEO after the scandal broke.

> The New York complaint claims that more than two dozen Volkswagen engineers > and managers were involved in the deception, including Wolfgang Hatz, the > former head of engine and transmission development at Volkswagen and Audi; > Ulrich Hackenberg, former head of development for Audi; and Heinz-Jakob > Neusser, former head of development for the Volkswagen brand. While several > executives have been identified by the media, German prosecutors, because of > the country's strict privacy laws, have named only one suspect, Mr. > Winterkorn [CEO at time of scandal becoming public].

<comment><USER2> That would make sense if they wanted to make it look like "they are bringing a new CEO" but at the same time they also wanted someone to cover it up. If more employees knew he was involved as well, even more of a reason to fear speaking up about it, because as CEO he could fire them.</comment></comment>


Blue Apron Tumbles After Losing Customers in Second Quarter - <AUTHOR> https://www.bloomberg.com/news/articles/2017-08-10/blue-apron-beats-revenue-estimates-as-marketing-costs-decline <comment><USER2> I dropped them for two reasons after using them for nearly a year. First, these meals actually take longer to prepare and way longer to clean up after than what I normally make. The food is very good, but the instructions are written by someone who (a) seems to have a gourmet kitchen at their disposal and (b) doesn't do dishes after. No, I am not going to chop all six veggie ingredients into six separate bowls, just to combine them in the next step. Also, I'm not going to chop everything up front just to realize that the garlic goes in at the last step for 30 seconds before the dish is ready.

The second was an issue I had repeatedly with the meat and fish ingredients: I had several weeks where meat/fish packaging was open when I got the shipment and the contents went bad. I emailed them every time, but at some point I got tired of having to immediately go to the grocery store to find the right quantity of pork or cod or whatever to complete the meal.

Realistically, their 35 minute meals always took me closer to an hour once all was said and done. There almost never were any leftovers (yeah two medium sized sweet potatoes don't go too far for four people). Finally, the price was just a little too high.

I keep a few of the recipe cards and try to make those once in a while, but mostly I am just back to regular grocery shopping now.

<comment><USER3> I liked Matt Levine's opinion on Blue Apron yesterday:

>Here is my theory, though: Blue Apron is a tech company in the sense that its product is not meals, or ingredients, but simulacrum. What it delivers is the idea of creating a home-cooked meal from fresh ingredients, without the tedious shopping and chopping work that that would otherwise require. What Blue Apron delivers is not exactly convenience -- ordering takeout is a lot more convenient -- but the perception that you are doing something complicated and real and primal while you are actually, through the miracle of technology, doing something much easier. Blue Apron is a virtual-reality company.

[https://www.bloomberg.com/amp/view/articles/2017-08-09/yogur...](https://www.bloomberg.com/amp/view/articles/2017-08-09/yogurt- liquidity-and-listings)

<comment><USER4> These quotes make for a nice dramatic effect, but the reality is much simpler:

Cooking & cleaning is a much bigger time investment than shopping for ingredients. In 10 minutes in a grocery store I can buy enough food for 10-15 meals, which would take hours to cook (in aggregate). The comparison stands even when you include driving to the store (before any pedants try to be _contrarian_ )

Blue Apron is optimizing the smaller part of the time pie required for eating, but at a higher cost than delivery (that optimizes the larger part of the pie for less money, usually)

That's why takeout is a decades-proved business model and Blue Apron is a VC- subsidized non-business.

__________________________________________________________________

That being said, I do agree with it being a virtual reality company. And by that I mean a company that can't really exist in actual reality.

<comment><USER5> That analysis assumes that the service is only about time-saving.

I've never used it but I've heard people say how they like it because

\- they get to learn new recipes using less-common ingredients

\- have good quality meals (which take out often doesn't provide, if we are considering time saving)

\- they, sometimes at least, prefer eating at home.

<comment><USER4> Well, yes, of course it assumes that, because providing value to the customer should be somewhere in the business model.

If it's not, it'll eventually become a non-business.

1\. There's nothing that suggests the ingredients are less common. But if you're a Blue Apron user, feel free to list some of the ingredients you were not able to find at a grocery store.

1.5: you can learn new recipes 10 different ways already, without having to subscribe to any "X as a service".

2\. Nothing that suggests an average person can cook better or faster than takeout, which suggests the takeout provides value to the customer.

3\. Completely irrelevant to the points at hand.

<comment><USER5> My comment was saying that you're assuming time-saving is the only value, and was pointing out that's not true. I'm even willing to believe it might be the most important source of value by a long shot -- I wasn't arguing against your conclusion; I was pointing out an assumption made by the argument you stated.

Regarding 1. It's not that the ingredients are less common per se. It's that using BA means that people ended up using some less commonly _used_ ingredients. They were introduced to new things that they hadn't used before and wouldn't have sought out on their own. They liked that.

Regarding 1.5 - obviously, but the thing is there is greater convenience (that _some_ ppl prefer) with not having to select the recipes, get the ingredients, portion them out. For some people that different in convenience makes the difference between whether they do it or not. So treating this issue as if it was purely a matter of whether it was possible or not doesn't make sense.

Regarding 2, I have heard people say they have been able to make high quality meals that they wouldn't usually have made that are better than most takeaway.

3 is most definitely relevant, because it's an example of a non-speed-based kind of value it provides to some people - getting the kind of meal _they_ would only otherwise get at a restaurant but at home. Most takeaway can't do that.

<comment><USER6> There was previously a free website called notakeout.com, which has since gone under (there's currently something else on the domain that's completely unrelated).

What they did was provide daily dinner recipes for fancy-restaurant type meals, with instructions, wine pairing, and shopping list. If you're an omnivore, you could simply print the day's page, stop at the grocery store on the way home, and cook whatever it was.

It seems to me that this represents about 80% of the value of Blue Apron at no cost (I think they had a for-pay email service, or something?).

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Blue Apron needs to be a service offered by local grocery stores. You pick up (or sure, are delivered) one of many boxes that grocery stores assemble from their local inventory. There's 10 or so different options, always readily available, with a full meal of supplies and instructions inside.

The objective is to show you that, "hey, cooking great stuff is within your realm of capability! It's fun and empowering. You don't have to be like Waterluvian over there who walks past all the produce and butcher every time because he has no clue how to make something of it all." After meal 10 or whatever, that's it, there's no more, you've graduated the "Get a Taste of Cooking" program. Now you move on to more traditional grocery shopping with your new added confidence and practice that will ideally see you buying more produce and fewer frozen dishes.

<comment><USER8> Wait, does your local Safeway/King-Soopers/Albertsons/Publix not already do that? It's right next to the 'deli' section of mine, styrofoam packs (like what meats come in) and plastic wrapped, all the stuff inside. Yeah, they don't have the instructions, but it's not too hard to figure out what to do.

<comment><USER7> None of those companies exist in my country. But no, I haven't seen it done here. Though 80% of a product is 0% of a product, so just a box of ingredients isn't quite what I'm getting it. What I'm talking about is the whole shebang and the design to drive you towards being able to wield the full power of your grocery store.

That being said, I wish we _at least_ had what you describe :)

<comment><USER8> Oh, my bad, I didn't know. Hmm, maybe you could talk to the manager of your store and suggest it. It's not too hard for the folks there to just pack it all up like BlueApron or how we do it here. Plus, they could charge +10% or so to do that, essentially free money for them. I'd bet the manager would be pretty happy to do it. Then again, this a US perspective, so YMMV.

</comment></comment></comment></comment><comment><USER9> I joined for about six months and dropped them last week. Third shipment in a row with missing ingredients.

On the plus side, it put me in the regular habit of cooking together with my wife. We love many of the recipes, which are freely available on their website...we've already started "re-doing" many meals by picking up the ingredients on regular shopping trips.

EDIT: One other thought - the whole market seems a lot like the GroupOn craze in some ways. It's an idea that consumers are attracted to, but the economics and excess competition make the whole concept fragile.

<comment><USER10> > One other thought - the whole market seems a lot like the GroupOn craze in > some ways.

Yeah, Groupon is a great comparison IMO. Huge initial growth, but spending a bunch of money to acquire each customer doesn't work once a bunch of copy-cat competitors enter the market.

I also wonder how many folks drop off once they've learned some basic cooking skills from the recipes - chopping, searing, getting the right proportions, etc.

</comment></comment><comment><USER11> I live in the Bay Area and Blue Apron is on thin ice with us right now. Their quality control got really bad right around the time of their IPO. Now nearly every week we have missing ingredients and/or leaking containers. We had no problems for 2 years and now it's pretty much constant! They are always pretty responsive with a credit commensurate to what the damage to the meal is, but this is basically the worst possible time for them to be screwing up like this.

<comment><USER12> I've noticed the same in the NYC area: the last few weeks I've had ingredients crushed which has never happened before.

They've also been spamming me with discounts to the wine club only to tell me that they can't legally deliver in NY when I tried to sign up. Don't they know where I live?

I hope they can recover because I do truly like the product and I think they're the best right now (a margin better than Hello Fresh, leagues better than Plated)

<comment><USER13> I live in New York City, and we are entirely satisfied and impressed nightly with Sun Basket. It doesn't have nearly the reach or brand awareness as some of the bigger players, but it's everything I've ever wanted in one of these services. Worth checking out.

<comment><USER12> Thanks, just signed up to try it out.

</comment></comment></comment></comment><comment><USER14> My wife and I are currently back to using _none_ of these services for much the same reasons as everyone else (prep time, dirty dishes, small portion sizes) but I will say Blue Apron is by far the best of the lot. Their instructions made the most sense, didn't require us to scale them ourselves, the food tasted wonderful, and I learned new techniques. The rest of the services have a lot of catching up to do, so if even Blue Apron is in trouble, maybe this model isn't so sustainable at all.

</comment><comment><USER15> This company is not a tech company, so it shouldn't be valued as one. It's on par with a local restaurant.

Second, the company produces enormous amounts of plastic pollution from packaging. Why should we pollute our planet so the CEO can make $1 more on the stock market?

<comment><USER16> More plastic than a super market does? And can you not just recycle the plastic containers?

If the world switched to services like Blue Apron/Hello Fresh/etc. rather than shopping in super markets, I wonder if we would overall produce more or less pollution? Super markets use a lot of energy and have a lot of waste.

<comment><USER17> Super markets certainly have their problems, for reasons you've said. However, you can choose not to put your groceries in any plastic from the supermarket, if you wish. I have done exactly that for a while now and it's easily doable, you just have to be a little choosy about what you buy.

If people switched to shopping at local farmer's markets - so food wouldn't be shipped around at all - we would produce much less pollution and have much sustainable agriculture than either of those options.

<comment><USER18> Local agriculture usually costs a lot more energy and land than large scale agriculture or agriculture in a climate that is best suited for the plant. The transportation costs are a rounding error for many products. Organic products are particularly terrible in this respect.

</comment></comment></comment></comment><comment><USER19> I've only tried Blue Apron once. I was watching a friend's cat while he was out of town, and I grabbed his most recent order so it wouldn't go to waste.

I don't remember which recipe it was, except to say it was a chicken recipe - probably with quinoa. Six of the eight steps included "Salt and Pepper to taste". Fortunately, my wife and I both cook regularly, so we knew that would have been a terrible idea.

I only seasoned the chicken once, and nothing else, and the dinner came out great. My friend cooks often as well, so I assume he just skips the unnecessary steps if they show up as well. His wife is just learning, though, which is why they were using Blue Apron. I'd have to assume she may end up over-seasoning from time to time if that's how the recipes normally go.

As someone who already eats home-cooked meals almost daily, I couldn't imagine paying that price. But overall the idea makes a lot of sense, provided execution is perfect. It seems, reading the rest of this thread, that hasn't been the case of late.

<comment><USER20> That's actually a very normal technique and one of the reasons professionally cooked food tastes so much better than most home cooked food. Frequent salting at different points of cooking improves the overall flavour of the dish, and seasoning ingredients separately can help with coverage.

Additionally something seasoned at the start of cooking won't be "salty" like if you were to add salt directly on the food after its plated.

You don't add a crap ton of salt 5 times, just a pinch here and there and the outcome is great.

<comment><USER21> This is like the one cooking tip I don't stop blathering about in fact. Always season each ingredient individually. Both ensures that the salt is distributed well and makes it easier to get the desired amount in the end product.

</comment></comment></comment><comment><USER22> Better than these services would be a site that tells you how to shop for meals and prepare them in bulk -- sort of "make your own meal kits". It would be more efficient, healthier, and more educational.

<comment><USER23> Platejoy[1] does this. I did their trial a while back and they've got some great meal ideas. One thing I like about this, is that there's no potential waste compared to Blue Apron and the like. Also being able to specify dietary restrictions and stuff while getting a nice grocery list was pretty great (:

While yes, I can spend time researching things, picking things out, etc. all for free, sometimes I do just want the experience to be catered. Add on top of that an automated, weekly/bi-weekly grocery list was pretty damn cool. Otherwise, I typically end up making the same boring meals I already know.

I didn't continue with them because my boyfriend is a pretty amazing cook, so I just leave cooking to him instead haha

[1] [https://www.platejoy.com/](https://www.platejoy.com/)

<comment><USER24> We use it to try and burn through CSA veggies. Works well.

Though it needs a CSA mode so you can tell it I got way too much swiss chard and it needs to be cooked..

</comment></comment></comment><comment><USER25> The UK equivalent of this is Hello Fresh [1]. I've never tried them, but they were clearly spending a lot on marketing and sending people door to door. The thing is, for the price I could just buy the necessary ingredients at my local supermarket.

I was tempted just so I didn't have to think about what to cook, but I find Yummly [2] to be a great inspiration and helps me to try new dishes.

1\. [https://www.hellofresh.co.uk/](https://www.hellofresh.co.uk/) 2\. [https://www.yummly.co.uk/](https://www.yummly.co.uk/)

<comment><USER26> The real issue with these services is that it is unclear what value they actually provide. If you want to cook yourself and save money, you could just get the ingredients yourself (or have them delivered by a service like Amazon Fresh). If you want to save time, you either go out to eat or order take-out. In contrast, Blue Apron and their like combine the worst of both worlds: high prices and no time savings.

BTW, Hello Fresh is actually one of the companies funded by the infamous Samwer brothers and their Rocket Internet. They operate in several European countries, and they have been offering large discounts. I don't imagine they're not burning through a lot of cash because of that.

<comment><USER27> For me personally, the value proposition is not having to think about cooking _until I start cooking_.

I just come home to matching ingredients and can start cooking at any time (which I mostly enjoy doing and is relaxing). It also saves time that I would need to decide on recipes and make lists and go shopping (all of which I don't like and stresses me out).

Its not about saving the maximum amount of time, but getting rid of the unpleasant parts around cooking at home. And eating out is much more expensive (where I live, maybe except the junkiest of junkfood), so this is an acceptable compromise.

</comment></comment></comment><comment><USER28> How much would it cost to have a chef supply and prepare dinner 5 nights a week for a family of 4? I don't mean takeout from a restaurant. I mean "home cooked meals".

</comment><comment><USER29> I suspect that the unit economics of this business aren't profitable at the moment.

It's possible that the pro forma looked nice based on quotes from suppliers. I've tried several of these meal kit companies and they all suffer from basic logistics and quality problems. I suspect it's a hard business with hidden costs and lots of unknown unknowns.

This is why I and others[0] believe Amazon will use its purchase of Whole Foods to change the fundamentals of this business and provide the infrastructure companies like Blue Apron need to do this profitably. Before Amazon fulfillment existed ecommerce was a logistical mother fucker. I worked at a number of startups in the late 90's and early 00's that struggled with this. I think there are a lot of similarities here.

0: [https://stratechery.com/2017/amazons-new- customer/](https://stratechery.com/2017/amazons-new-customer/)

<comment><USER4> You might be right.

If there's one thing Amazon has going for them, it's figured out logistics at scale. The economics of a service like this start to look a lot better when your delivery rates are dirt cheap _and_ you can selectively serve zip codes with highest demand.

Serving sparse suburban or rural areas doesn't make sense with ingredient delivery.

</comment></comment><comment><USER30> I've been with them for 2+ years and am hooked. We use Green Chef as well for 6 meaks per week.

Everyone complains about the lack of convenience but it saves me mind capacity more than anything and I never have to go to the store. We also like variety in food. Recipes show up, I cook for 30 minutes and we have family meals.

$20/meal to feed three adults and a toddler is a bargain to me as well.

I prefer Blue Apron to others and cringe to think they might make it easier. Note, I could barely cook before and took twice as long. I just use a giant cutting board and a favorite spatula and knife and occasionally use more than one pan. I also overlap things like preheating the pans and chopping while things cook.

We recreate some of the meals but have a hard time getting the quantities to match up. It usually means I have to make a double batch for guests or have leftovers and need to stock the pantry with various sauces and vinegars.

</comment><comment><USER31> It's not clear they have a long term sustainable business model. They clearly have a problem with the cost of customer acquisition running up against the lifetime value of a customer. If they can't fix that then the model is dead.

Execution issues are just adding fuel to the fire.

</comment><comment><USER32> "Stop trying to make the meal-kit-by-mail business happen. It's not going to happen."

Meal kits are going to be a big business. But they're going to come from your grocery store, your office cafeteria, or Amazon. That's it.

</comment><comment><USER33> One other thing I forgot to mention, last week, Blue Apron offered me $30 to rejoin (I already had a $10 credit I threw away). I thought it was interesting and then I saw this HN post. Probably not a coincidence. :/

</comment><comment><USER34> The really negative news was the issues they are having bringing the new facility in Lindon online and at peak efficiency. This is causing issues with rolling out new products they see vital to their business. Because of this they will likely post a decline in revenues y/y for Q3.

In light of that news I can see why Matt Wadiak, their previous COO, recently "stepped down".

</comment><comment><USER35> It's been great to read this thread. I never understood the value. As someone who can cook and grocery shop decently, it's not cheaper and only marginally better than what I normally whip up. And there's no question about convenience when it's compared to delivery (although, I live in SF, so my delivery options are more than most).

</comment><comment><USER36> I tried it once. Having half of my ingredients arrive either opened or spoiled (and I started my entry into the world of jobs as an apprenticed oriental chef) immediately turned me off.

If I still worked as an AIB inspector I'd be going straight to their warehouses right now and running a top-to-bottom run-through.

</comment><comment><USER37> So why is Wayfair on that bar graph? Their stock has been doing just fine since the IPO.

<comment><USER38> That's a good point. looks like they took the lowest historical price vs the IPO, without regard for current situation. Far from "total return". Good catch.

</comment></comment><comment><USER39> i was one of the customers who dropped in q2 after using the service for about 6 months.

I really enjoyed the product, and never had an issue with quality.

for me cost was primary reason for cancelling. Buying ingredients saves me about $100 a month. Even with Blue Apron I had to go to the grocery store weekly for lunch and breakfast food, so it was a "nice to have luxury", not something that saved time or money.

I worry that Blue Apron is going to have a hard time making the economics of custom acquisition vs. life time value work if high churn is a permanent thing.

</comment><comment><USER40> It never seemed like a sustainable business model. After a year you build up enough skills that you no long need them. Also I can source ingredients locally more inexpensively and fresher.

</comment><comment><USER41> I subscribed to Green Chef for about a year but the hassle and time it took to make the meals wore me down.

Then I found freshly, which sends pre-made meals, and I love it.</comment>


Ask HN: How do I launch a side project through my employer? - <AUTHOR> I have been working on a "startup idea" for over a year, but started in a new job only four months ago.
This product fits neatly in my employers portfolio, but I don't want to simply "donate" it given the huge personal investment.  Nor can I afford to launch it on my own any time soon.
I'm sure many around here have faced similar situations.  How did you resolve it?
For what its worth, this is a profitable small-time shop made of nice people, my boss is aware of the project, but we haven't really discussed any details yet.  If successful, things will become very different around here. <comment><USER2> NOTE: DO NOT CONSIDER THIS LEGAL ADVICE.

I personally wouldn't even have mentioned it to anyone at the organization that you don't explicitly trust. Now that your boss is aware of your idea, he/she can steal it behind your back and implement it themselves.

> but they're nice people

They're nice because they want you to give them your IP for the lowest cost possible (free since they can order you to build it using company resources). I mean, if you just wanted to pad your resume, then this is a good idea. Otherwise, you just handed them your future business.

But again, these are just my ramblings. CONSULT A LAWYER.

</comment><comment><USER3> In my experience, getting involved with an employer to work on your side- project is not a wise decision unless you're 100% sure it won't go south. I've done it and regret it. I asked my employer if they would help me on the marketing side of things for an app I was building on the side, and allow me work on finishing the app on company time--fast forward 8 months and I was the only one putting any work into it, and they also owned over 50% of my app (yes, I know--I was super dumb, overly excited and way too generous!). I eventually burned out and moved on, and it sucked to leave behind a project that I liked due to my poor decision-making and bad co-founder fit.

</comment><comment><USER4> I'd advise you keep a decision diary and a log of all interactions on the subject you have with your boss and colleagues. Even if they are just casual discussions, don't force anything. It's just good to have an honest (no porkies, no revisionism) account of who said what when and a clear timeline.

If you have a good project and things move fast it can get muddled and messy, like a big pile of spaghetti. A lawyer should ask for this if you have it and they will find the situation easier to understand.

So yes, a lawyer would help.

</comment><comment><USER5> Your product likely already belongs exclusively to your employer. Review the terms of your employment contract; you almost certainly have an IP assignment clause in it, which may specify that anything done on company time, resources, or importantly, along _company business lines_ is automatically assigned to the company. You may be required to disclose this product to them and sign it over to them for free.

Consult an attorney.

</comment><comment><USER6> y, you're going to need a lawyer here.

I wouldn't mention anything else about it till your lawyer reviews your employee agreement and works with you to get things setup so you retain the IP until a time spelled out along with equity/revenue share.

Sounds like you have a great idea, good luck executing on it.

I don't envy the position you are in though so be careful. I just don't like the idea in general of collaborating with an employer on a startup.

Follow up in 6 months and let us know how it's going.

Good luck.

</comment><comment><USER7> Have you considered the IP agreement? I'd first make sure if your project is protected as your own work.

If that is secure, an equity plus revenue share deal in exchange for them acting as your business API to the world.

Disclaimer: this is not legal or business advice and I'm not liable for anything regarding this situation.

<comment><AUTHOR> Thank you very much for the response. I had indeed not considered an IP agreement and it looks like exactly what I need to secure the product before going into negotiations.

For the veterans around here, what would be considered a "normal" equity in a deal like this, if there is such a thing?

Thanks again for the very helpful reply!

<comment><USER8> I wouldn't launch _anything_ without talking to an IP lawyer first.

Did your new employer know you were working on this prior to starting the job?

What I'd be worried about, since this fits into their portfolio well, is them taking credit for work you'd done well before you got there.

In any case, lawyer lawyer LAWYER!!

Good luck! :)

</comment></comment></comment><comment><AUTHOR> Thanks everyone for your very valuable feedback.

I will definitely consult a lawyer before moving forward.</comment>


A scramble at Cisco exposes uncomfortable truths about U.S. cyber defense - <AUTHOR> http://www.reuters.com/article/us-usa-cyber-defense-idUSKBN17013U <comment><USER2> The U.S. government just doesn't care about your or me. Anyone who feels otherwise, and that becomes a part of the government, is quickly swallowed up by partisan relationships and government bureaucracy.

They prove it everyday, choosing special and corporate interests over the people, or in this case, choosing its own power over protecting our interests.

Man, it's sad.</comment>


So the internet didn't turn out the way we hoped - ajay-d https://www.nytimes.com/interactive/2019/11/14/magazine/internet-future-dream.html <comment><AUTHOR> One of my favorite hypothetical questions is "Would you take a deal where you could 10X your salary, but you'd have to live the rest of your days starting in 1979."

Imagine all the same tech is available at the same periods in time, but produced by different companies so you can't do the "Back to the Future Sports Almanac" thing.

Imagine you're 40 today. Would you rather have 10X as much money, but know you won't get Aol until your 55? No smartphones until you qualify for Social Security? Maybe 10X is worth it, but 5X? 2X? It helps put the value we get from the web in perspective.

Just once, I'd love to read a story about tech in a major pub from the perspective of someone 35-55-ish who remembers the pre-internet world — and can't stop raving about how much better everything is now.

I get that it might not be a majority position, but it's not insignificant, but it's almost entirely invisible in the NYT's tech coverage.

Moreover, I find it crazy how every misstep of American tech companies portends the end of democracy, but they have the gall to write: "In China, a whole new internet is flowering."

<comment><USER2> That's a great hypothetical, but not because it's a no-brainer. I'd have to think long and hard about that choice.

Sure, we have vast amounts of knowledge and entertainment at our fingertips, but the reality is that most of us are spending our days staring at Facestagram and binge watching Netflix.

Having enough money to be able to retire after a couple years and then spending the rest of my life traveling the world and reading every book I can doesn't sound so unenlightened in comparison.

<comment><AUTHOR> One of the nuances is thinking about all the advances in other parts of life that have been unlocked thanks to tech.

\+ FEA/FEM would make the airplanes you use to travel much safer.

\+ The drugs that might not have been developed as quickly might prolong that retirement dramatically.

It's hard to disentangle all the ways tech has improved our life!

FWIW, I'd take a 50% pay cut to stay in the modern era...

</comment></comment></comment><comment><USER3> It's exactly as we hoped, wtf. Not the Internet's fault most people are dumb as a brick.

It's still possible for anyone to run their own stuff. And it's still a massive repository of all human knowledge, if you take into account all sources, legal or illegal.

What do we do from here? Stop being dumb and trying to change into subscription TV, for starters.

Fringe believers need actual education, not more control over the sources of their misinformation.

<comment><USER4> I think we just need a few people to show how things ought to work and get that to be popular.

If we all hate ads enough and tracking, how about we invent a convenient way to pay for content across sites anonymously? I really like the design behind GNU Taler, which is a simple centralized cryptocurrency without the mining BS, so it can be used as a simple standin for currency, like PayPal. All we need to do is make a few popular content creation services use it, tipping small amounts for gratis content and larger amounts for access to pay restricted content. The only cookies that need to exist are proof of payment, cryptographically tied to the transaction.

I don't want to sign up for $10/month or whatever to access an article or view a video, I just want to access some given content. I _do_ want to subscribe to content that I consume consistently to get a bulk discount, and I'd rather pay a little bit than see ads. That being said, every payment system so far is more work than it's worth to send a dollar or less, and the fees on top remove a lot of the value. I'd rather put $X into an account each month and click a button to send a small part of that to the content creator with little to no fees involved (maybe a one time load fee if anything).

The internet is only broken because the current solutions are insufficient and we've turned to legislation instead of innovation to solve the problem.

</comment></comment><comment><USER5> 10 or 15 years ago, you'd click on a political link on Slashdot, early reddit/digg or whatever and the top comment would usually be pulling apart all the oversights and bullshit in excruciating detail.

It was good, the internet was a 'cold medium' in Marshal McLuhan terms. If the internet of that time replaced the 'hot medium' of television, things could only get better I thought.

I was a fool! I never conceived that outrageous bullshit like antivax or God Emporer memes could get so much traction.

<comment><USER6> Reminds me of the SMAC "Evil lurks in the datalinks as it lurked in the streets but it never was the streets that were evil."

The stupidity and evil is coming from humanity - merely destroying the current bridge it is crossing won't remove it and will hinder everyone else more.

</comment></comment><comment><USER7> Having a cookie policy popup take up half the screenspace while trying to read the article certainly makes for a compelling argument.

</comment><comment><USER8> Well, better luck next time, dear.

</comment><comment><USER9> I think I've acquired "New York Times fatigue". When reading a headline, I can always tell if it's from NYT before checking the source.

The headlines are usually clickbait and the subjects play with your fears and concerns. It's really tiring.

<comment><USER10> And needing to give them personal information to read their articles...

Why are independent blogs bad again?</comment></comment>


Skyping with the enemy: I went undercover as a jihadi girlfriend - <AUTHOR> http://www.theguardian.com/world/2015/may/26/french-journalist-poses-muslim-convert-isis-anna-erelle

<comment><USER2> That was intense. I'm not a parent but I imagine if a parent of a vulnerable teen girl (or boy) is reading this, it would be horrifying to them. What a messed up world we live in :(</comment>


Dasheroo is Closing for Business - <AUTHOR> https://www.dasheroo.com/closing-for-business <comment><USER2> Too bad :( What is the reason? Financing?

<comment><USER2> Damn. It's in the post on the page. Yep. Financing. Anyways, I'm sorry to read that.</comment></comment>


Top 5 Reads About Gamification - <AUTHOR> https://blog.captainup.com/top-5-reads-about-gamification-let-the-games-begin/

<comment><USER2> Anyone care to comment on the books?

I'm not a fan of gamification but, as an amateur game designer/developer, it's a subject that interests me.</comment>


Ask HN: Feeling "bored" by software engineering? - <AUTHOR> I've been programming for 15+ years now, and in industry for 7+ years. I've used all sorts of languages: web dev (HTML/CSS/JS/etc.), C/C++, Hypercard, BASIC, Python/Ruby/Perl, Lisp, Go, Java...etc. I've worked at a very large company, and also small companies, and on lots of side projects. Of course I still have things to learn, but I feel very comfortable with most of the coding tasks that come up at work.
I've enjoyed programming since pretty much the beginning (BASIC on ancient Apple II's in school :) but lately I've been feeling a bit "bored." Most of my day to day coding work is around domain specific business logic and data modeling. There isn't much that feel like inventing something new, or applying "computer science." In-so-far as there are "computer science" challenges, like "How do we handle X amount of requests per second?", those challenges are quickly and easily solved by using a pre-built DB/library.
I've been browsing job advertisements (South Bay Area), and nothing seems to catch my interest. Startups generally have product/market fit problems, not tech problems, and working at a big company (FaceGoog, etc.) doesn't really appeal to me.
I didn't always feel this way, as I mentioned before I've really enjoyed programming since the start. But I just can't find anything to get excited about.
Have you gone through a similar phase in your life/career? What did you do? Any suggestions? <comment><USER2> I think I've been in a similar situation. I'm not a fan of building simple I/O apps, and I'm actually not very good at it either (even though it has been done a million times by others). I do much better when people give me challenging problems, so I think we may be similar in that regard.

First I'd ask how long you feel you've been bored for? It could be that you're just in a lull of interesting things.

Do you have any of your own projects? Do you contribute to open-source? Have you considered work outside the 'regular' IT space?

I almost always have a project on the go, and often find some interesting challenges in there. What worries me most is when I don't have any side projects, but a new idea always eventually pops up.

When you talk about 'product-market-fit' being the big issue with most startups, that is what makes me think you're not looking at the start-ups that are doing the challenging work. It often isn't in web or typical software/service companies.

IoT security is something that constantly comes up as an area still in need of being addressed. Or have you played with BlockChain and distributed contracts.

There are lots of problems to be solved, maybe it's just finding the ones that interest you.

I think meetups can be a good source too, just don't go to the 'language' meetups, but maybe pick an industry meetup or two where you might be interested but wouldn't normally be in scope of what you're familiar with. Worse comes to worse, you can always leave.

Those are my thoughts, but I don't think you're alone.

</comment><comment><USER3> I don't know about the nature of your side projects. Have you done any in challenging computer science fields like computer vision, speech recognition or machine learning, or anything electronics related?

The fun thing about them is that there are no dearth of problems to solve, and if you really want to build an intuition in them to come up with new techniques, you have to brush up on or learn from scratch multiple math fields like statistics, linear algebra and calculus. For an autodidact like me, it's like a kid in a toy shop.

I felt the way you did some years ago. I was good at stringing up frameworks together in multiple languages and writing glue code to make some CRUD apps. It made me complacent that I was "good" at this and then I got "bored". Venturing out of my mental comfort zones to tougher fields has proven to be a great way to avoid that boredom. Haven't got bored in past 5 years!

</comment><comment><USER4> My two cents: get away from code awhile. Read a book on a mildy intriguing subject that seems completely orthogonal to your other work. Take up a new hobby for one week. Travel.

Looking for more "exciting" work is a recipe for monoculture, as you're likely to only find more of the same. "Interesting" and "exciting" are things you find in yourself and not in any particular problem.

Instead, expand your horizons and find something that motivates you to use and expand your existing skillset, or at least see known concepts in a new way. Replace "exciting" with "strange" or "curious" to help reorient your search.

I wish you success in escaping this momentary fit of ennui, and good luck in your next endeavor!</comment>


Ask HN: Do you up-vote to bookmark? - <AUTHOR>

Up-voting a submission results in it being saved automatically in your saved entries.  I don't always have time to read submitted articles/pages, so I find that I mainly use up-voting to bookmark interesting submissions for later.  In order to avoid "cluttering up" my saved submissions, I sometimes avoid up-voting submissions that I find interesting but have already read or don't plan on reading.  Do other users of HN experience this? <comment><USER2> No, I upvote mostly to indicate

a) that I learned something from the post, even if I disagree with it,

or

b) that the post should be informative to other participants, and I largely agree with it.

My downvotes similarly have a two-fold meaning, but they are more rare.

I upvote so much that I don't use my list of saved HN posts (it being too large to browse through), so if I want to find a previous post, I search for it directly, usually with a site-restricted Google search or Search YC

<http://searchyc.com/>

search. I do bookmark directly with my browser's bookmarking capabilities some HN discussion threads, and quite a few articles that I first learned of from HN submissions.

</comment><comment><USER3> I upvote to bookmark only. Unfortunately it means I don't upvote items that should be upvoted. I upvote comments though. I wish there was upvoting and stars for bookmarking.

</comment><comment><USER4> > Do you up-vote to bookmark?

Sort of. For me, an upvote means "I'm glad this was posted on HN". Sometimes I'll see a new submission with no comments yet, and I'm interested in what people might say about it, so I'll upvote to bookmark not just the article, but the HN post, for later comment viewing. However, this is not inconsistent, since I'm saying, "I'm glad this was posted to HN, because I'd like to see what people say about it."

> I sometimes avoid up-voting submissions that I find interesting but have > already read or don't plan on reading.

Me too, but I don't see any inconsistency. If I've already read something, then, usually, I don't especially want to see it on HN. So I'm generally not glad it was posted. Thus, no upvote.

</comment><comment><USER5> Yes, but only when I'm in a hurry.</comment>


Time Machine style backup with rsync in 540 lines of code - <AUTHOR> https://github.com/laurent22/rsync-time-backup <comment><USER2> The description sounds like this mirrors a lot of the functionality found in rsnapshot ([https://rsnapshot.org/](https://rsnapshot.org/)).

What are the advantages here vs. what rsnapshot already provides?

<comment><USER3> Or backintime ([https://github.com/bit- team/backintime](https://github.com/bit-team/backintime)).

The only thing I am missing is that it doesn't work for sshfs mounted devices. Which is not provided by any alternative tool which supports snapshots (probably because of problems with hard links, although I never had issues with those over sshfs).

</comment></comment><comment><USER4> To me, the fact that it doesn't provide a fancy GUI on MacOS is a pro not a con. I'd much prefer to browse the snapshots using a normal file browser.

The Time Machine GUI was cool at first. Now it's just obnoxious.

</comment><comment><AUTHOR> Also works on Windows via WSL. The repo is active, but urgently needs maintainers.</comment>


June's second-gen oven starts at $599 - <AUTHOR> https://techcrunch.com/2018/08/07/junes-second-gen-oven-starts-at-599/ <comment><USER2> You can broil a steak in an oven and it would be ok. A cowboy steak could cause a major fire in something like this. I'd never waste a decent steak in a toaster oven. This sort of thing is for the person who had a windfall and is now looking for the very bestest everist possible things including the worlds most expensive toaster oven.</comment>


Say Hello to the New WordPress Editor - <AUTHOR> https://wordpress.org/gutenberg/ <comment><USER2> I enjoy how the article is actually displayed using the editor. No better way of showing technology by showing it actually working!

</comment><comment><USER3> I'm really enjoying these minimal editors - Ghost has a great one too. It's so weird firing up something like Word (or Openoffice) and it's a shotgun blast of distracting icons. It seems like the old apps are more about editing and tweaking than creating. And I know they can never change since people get really angry when Word changes.</comment>


Caltech astronomers detect the farthest galaxy yet with Keck telescope - <AUTHOR> http://www.caltech.edu/news/farthest-galaxy-detected-47761

<comment><USER2> There's another good article on this at the Keck Observatory site [1] and it has a great graphic [2].

The site of the " _Astrophysical Journal Letters_ " journal (iop.org) has a public abstract/article for mentioned paper, " _Lyα EMISSION FROM A LUMINOUS z = 8.68 GALAXY: IMPLICATIONS FOR GALAXIES AS TRACERS OF COSMIC REIONIZATION_ " [3], but the paper itself seems to be paywalled [4].

[1] [http://www.keckobservatory.org/recent/entry/new_record_keck_...](http://www.keckobservatory.org/recent/entry/new_record_keck_observatory_confirms_most_distant_galaxy)

[2] [http://www.keckobservatory.org/images/press_images/Adi3.001....](http://www.keckobservatory.org/images/press_images/Adi3.001.jpg)

[3] [http://iopscience.iop.org/2041-8205/810/1/L12/article](http://iopscience.iop.org/2041-8205/810/1/L12/article)

[4] [http://iopscience.iop.org/2041-8205/810/1/L12/pdf/2041-8205_...](http://iopscience.iop.org/2041-8205/810/1/L12/pdf/2041-8205_810_1_L12.pdf)

<comment><USER3> > but the paper itself seems to be paywalled

antognini pointed out the preprint already, but I wanted to note that articles in the Astrophysical Journal Letters and The Astrophysical Journal become open-access after a year.</comment></comment>


Ask HN: Feeling lost, any advice for a aspiring entrepreneur and student? - <AUTHOR> Dear HN,<p>I'm feeling lost. I have lost my motivation to try and learn new things. In my mind I always wanted to be a entrepreneur. I am currently studying computer science after a long road all the way from the lowest educational level in my country. From the beginning of my 'academic' career I always had interest in building software and was enjoying building side projects. In the last few month however I have stopped enjoying trying out new things/learning new things. I also don't enjoy working on my side projects anymore. But when I try to start something new I feel guilty for not finishing the other projects.  Everything not related to school feels extremely tedious and the last few weeks the only thing I enjoy is playing games. I feel so useless but can't seems to reignite my 'entrepreneurial' self. How can I spark myself in these times? I really want to build something with a future but can't come up with ideas. <comment><USER2> I think everybody went through being kinda useless at some point in their life.

I had these feelings too. Too many ideas and projects I've started... I enjoy first phase the most of project lifecycle, idea to clunky prototype. That's probably why we starting new projects so often.

What kinda worked for me is writting down all projects what I've started and for each one asked simple question: "How much do I really care about it?" Put down to paper as much negative thoughts as possible. You'll feel relieved. And don't think that you have to finish everything. It is fine to try something and then let it be.

</comment><comment><USER3> On top of whatever difficulties you're having enjoying software entrepreneurship, you use language that is common in depression and anxiety sufferers.

School is not the best time for side projects. You only get one time in your life to be as selfish as you are as a student: your only goal is to learn, and you can learn whatever you want. Try to find the joy in this stage of your life rather than worrying about whether you're behind on the next one (you aren't!)

Also definitely take advantage of the counseling or therapy services available to you.

</comment><comment><USER4> You are burned the fuck out by school. Which is common. Concentrate on school and not school. Meaning carve out a little something that doesn't use the same part of your brain as school. See if you can honestly keep going, if not take a six month break.</comment>


Hacking iWin and Why it Wasn't Worth It - <AUTHOR> http://www.mattmazur.com/2010/01/hacking-iwin-and-why-it-wasnt-worth-it/ <comment><USER2> Left a comment there, but may as well copy-paste here:

A few years ago I was working on a competition with a grand prize of several new SUVs (part of a product launch for the vehicle). We did a very basic version of the "riddler.com" model (remember them about 12-15 years ago?) where our partner websites would put 'badges' for gamers to click on. Each badge was worth some number of points.

Some smart souls figured out that the badge numbers were somewhat sequenced (we had allocated up to 10 badges per partner, so we would start at '10′ for instance and work our way up). Scripts were written that would hit our server each day and collect the maximum number of points available.

The scripts weren't that smart though, and there were gaps in the rewarding badges. Our 'fix' for this was to create new badges in the gaps that were worth massively negative numbers of points. In one day, the most problematic players vanished.

</comment><comment><USER3> Anyone remember CDNow? They rewarded referral purchases with $5 gift certificates. But they awarded the gift certificates before the referral purchase cleared. At the time, you could also trivially acquire a "valid" unique Mastercard number using $0-balance "Web Certificates". Long story short, you could write a script that would generate an unbounded credit for yourself at CDNow. People raped them with it.

Problems like this were really common in the late '90s. They persist today, but are more subtle. We always test for $-1.00 input flaws, and they aren't frequent.

The people who are actively exploiting these can give you any number of rationalizations for how legal their actions are, but at the end of the day what's protecting them is that they're staying below the noise floor for civil and criminal attention. It's still just fraud.

</comment><comment><USER4> This is interesting:

 _At this point you might be wondering how iWin ever expected to make money off of their originally business model. I wondered that for a long time too.

Here's what I think: ... Most people probably quit long before they ever earned enough to get anything._

This is perfectly true from my knowledge of a sms quizzes where less than 1% of the people actually play the game (although 100% of them pay the subscriptions).

</comment><comment><USER5> Did you ever go after Pointclick:)? They folded not long after launching.

<comment><USER6> I did, and I got a Rio 500 out of it. I didn't hack it though, basically my method was this: during lunch my friends and I would go into the school computer lab when no one was there and turn on every computer. Then we'd open up as many instances of IE as I could, clicking on an ad and keeping the browser open for the requisite amount of time. After about 8 instances of IE were open the computer would crash, so we'd power cycle the computer and move onto the next one. By the time this computer was rebooted we'd have already gone through all the other computers, so there wouldn't be any loss of time.

The funny thing is that IIRC this wasn't even against the TOS until a few weeks before they went bankrupt. I was also fourteen at the time, same as the submitter. I don't really consider it unethical, or at least were weren't hurting Point Click, because they were basically in the business of scamming advertisers. And the advertisers didn't care because they were getting $800 million valuations because of all their hits. And the investors were happy to invest at these prices even though they knew what was happening, because they thought that the economics of business had changed forever and in just another two years they'd be insanely rich. And all of my friends and I, being fourteen, thought the investors were right.

So even now it's hard for me to feel bad about it. At the time it wasn't even clear that Point Click would go bankrupt or that there was a larger economic bubble, we all just thought the free stuff was somehow because of Moore's law. And because we did legitimately work pretty hard for those points, we just sort of assumed that whatever we were doing was somehow creating value.

<comment><USER5> Haha, all the fourteen year olds doing silly things unite! Indeed, I was 14 too when I was going after them. It was one of the first bots that I wrote in VB. Making the mouse move to simulate a real click automatically was tonnes of fun:)

I also wrote a NetZero ad remover. Of course, every other kid on the block was writing one too. Then there was allAdvantage. And the list goes on.</comment></comment></comment>


Amon - self-hosted server and web app monitoring toolkit - <AUTHOR> http://amon.cx/#intro

<comment><USER2> I think the pricing scheme is way too clumsy. The Amon and Amon Plus seem to map to two different kinds of web apps: hobby, and mission critical. There's a huge gap between the two plans. You're basically ignoring the users between the two levels by insisting that anyone who needs more than basic service get the super deluxe model.

The pricing scheme drastically needs a change. The free level is fine, but there needs to be at least onepaid intermediate levels: 2 apps, with features between free and plus. Why? If a developer is doing 1 hobby web app and wants to take it to the next level, a 2-app plan will both provide support for their current app and allow breathing room in case they want to go for a second.

As a web app developer myself, I would not pay for the Amon Plus plan. I have 1 web app running on AppFog. I don't need to pay for unlimited servers and unlimited apps. I would pay for basic support, but paid basic support is not available in the two tiers offered.

<comment><AUTHOR> There is a big difference between Amon Plus and services like AppFog. Amon Plus is self-hosted and you have to pay $24.95 once and then you own it forever. There are no monthly fees and no restrictions.

<comment><USER2> Eh, I'm an idiot. I was thinking so much about the pricing scheme I forgot it's a one-time buy, not a service.

</comment></comment></comment><comment><USER3> Bless you for making an installable product and not yet another pay-us-a- fiver-a-month service. If Mint's success is of any indication, there is a very substantial demand for productized analytics software.

[0] <http://haveamint.com>

</comment><comment><USER4> I said this when it first came out, I'm not going to curl down and run an arbitrary script from the web. Package it like everyone else does.

<comment><USER5> I totally agree. They looked professional until i saw this "curl install.amon.cx | bash"

Are they crazy? What if they loose this domain for some reason, and somebody puts different code there.

</comment></comment><comment><USER6> Demo (<http://demo-plus.amon.cx/>) seems to be down. No refunds?! What would Joel say?

<comment><AUTHOR> Sorry about that. There seems to be some DNS problem. The demo is at <http://22.214.171.124/>

<comment><USER7> Invalid login is all it's saying for me

<comment><AUTHOR> It's fixed now.

</comment></comment></comment></comment><comment><USER8> The install command is failing on OS X 10.8 Mountain Lion, I get the following error:

tar: Unrecognized archive format

seems like a regression: <https://github.com/martinrusev/amon/issues/27>

[edit] Update: Manual installation was successful, but nothing runs on localhost:2464

</comment><comment><USER9> "Amon supports only Rails 3." (<http://amon.cx/guide/clients/ruby>)

Is that the Ruby client Ramon or Amon itself?

<comment><AUTHOR> Sorry. It should be more clear. The Ruby client Ramon supports Rails 3

</comment></comment><comment><USER10> How does it compares to something like New Relic?

<comment><USER11> Amon Plus is great if you need quick & simple server/app monitoring. I've been using it for several months and have gotten steady metrics from the alerting, logging and graphs - all of which was fairly easy to set up. The creator is pretty quick to respond to any questions about the app, and is continually improving the project.

With that said, if you're looking for deep insight for performance, metrics, etc - then I'd still have to say that New Relic would be your best bet.

</comment></comment><comment><USER12> you know, newrelic actually does the same thing for free. (server monitoring is free w/ newrelic)

</comment><comment><USER13> Just fyi, this is using MonoDB.

<comment><USER14> Power to the worms. ;)</comment></comment>