MoreOnionsPorfavor: Onionize your website and take back the internet - <AUTHOR> https://blog.torproject.org/more-onions-porfavor <comment><USER2> So let's say I run a few websites and do support the idea. I read that article and think "I should setup an .onion version of my site and then point to that". The article points to [https://community.torproject.org/onion- services/setup/](https://community.torproject.org/onion-services/setup/) \- and I'm immediately lost. Setup a local webserver? Why would I need that? The documentation mentions that I have to configure the webserver correctly, but offers no details about that whatsoever. So that's not a good start.

[https://community.torproject.org/onion- services/advanced/oni...](https://community.torproject.org/onion- services/advanced/onion-location/) works better, it shows the configuration, but assumes there is already an .onion address and does not point to documentation how to set it up.

Hey, I know documentation is hard. But this could be improved a lot. By now I figured out that I'd have to install Tor on the server (not my machine, as the docs stated), find the torrc (the documentation has to mention where it is), point to the localhost port active of the webserver, the .onion address is autogenerated (so this will be an unreadable mess?) and can be taken from a file the tor software generates.

And this:

> _We 're not going to cover how to set up a web server here. If you get stuck > or want to do more, find a friend who can help you. We recommend you install > a new separate web server for your onion service._

Just cut it out. I'm actually lucky enough to have friends that could help me with this, but what if I hadn't? Cover in the documentation what needs to be done, or at the very least don't show an attitude about it.

<comment><USER3> Documentation and ease of setup have long been the biggest weaknesses of Tor. The browser is easy but setting up a server or any of the infrastructure isn't.

The first time you setup a server or a relay expect it to take half a day to a full weekend.

<comment><USER4> The Tor community improved a lot the Tor Relay Guide in the last two years. Actually now you can easily setup a relay following the instructions: [https://community.torproject.org/relay/setup/](https://community.torproject.org/relay/setup/)

And if you're an Ansible user, you will enjoy Nusenu's ansible-relayor: [https://github.com/nusenu/ansible-relayor](https://github.com/nusenu/ansible- relayor)

<comment><USER3> You're right, those docs are a lot better than the last time I looked.

I forgot why exactly I didn't use ansible-relayor last time I setup relays but I had a reason. I'll try to use it next time I deploy a batch of relays.

</comment></comment></comment></comment><comment><USER5> I tried this feature of Tor Browser, using the first example I saw in TFA (www.propublica.org)... and was surprised to see that the .onion equivalent of the www.propublica.com home page... tried to make requests to third-party non-.onion cross-site surveillance trackers.

google.com/recaptcha connect.facebook.net static.chartbeat.com ak.sail- horizon.com pi.pardot.com htlbid.com

A separate concern, besides this choice of example, is why ProPublica is _normally_ helping to leak the identities and intimate browsing behavior of people who visit their site, to some of the most powerful and invasive corporations, given this mission:

> _ProPublica is an independent, nonprofit newsroom that produces > investigative journalism with moral force. We dig deep into important > issues, shining a light on abuses of power and betrayals of public trust — > and we stick with those issues as long as it takes to hold power to > account._

<comment><USER6> To be safe one should disable JavaScript and most if not all third-party requests on .onion sites. Thats why TorBrowser always includes NoScript. Unfortunately in an unsafe default configuration that allows too much.

So overall, I guess this move isn't intended to protect the masses but provide more cover traffic mainly.

</comment></comment><comment><USER7> I'm not sure how relevant this is to running your website on the "darknet", but a potential warning for future Tor service operators: I ran a TOR relay for about a year, eventually even ordering a static IP for 5€/month. One random day, I was unable to log into my online banking, receiving some obscure error code. After digging around and finally contacting the bank, they referred me to some "IP protection service" in the UK, which had put me on a blacklist for unknown reasons (they don't tell you the reason for security reasons, but there was mention of something "proxy"). After submitting multiple requests to remove me from their blacklist (all automated online with no option to talk to a human), I finally caved in and shut down my relay. After doing that, combined with waiting a few days, while also continually resubmitting my removal request, they marked my IP as "clean", allowing me to login to my bank again. The whole process took about 6 weeks, and neither my bank nor the UK service provided any assistance along the way. Fun times.

I would love to run a TOR relay again but I'm a bit paranoid now.

<comment><USER8> Why on earth would you run a Tor node on an IP that you use for any personal transactions? This isn't surprising in the least.

<comment><USER9> I think you're confusing a relay and an exit node here. Pretty much everyone using Tor runs a node and for virtually everyone it's on IP also used for personal transactions. There are silly services which take every tor node as suspicious. They're wrong, but it doesn't matter if you get banned.

<comment><USER7> I also considered bringing up that point, but then I actually looked it up[0]:

> Tor relays are also referred to as "routers" or "nodes." They receive > traffic on the Tor network and pass it along. Check out the Tor website for > a more detailed explanation of how Tor works.

[0]: [https://www.eff.org/torchallenge/what-is- tor.html](https://www.eff.org/torchallenge/what-is-tor.html)

<comment> yjftsjthsd-h How does that change anything? The point is that a relay isn't an exit node, so there's no reasonable reason to block them.

<comment><USER10> You don't seem to understand what the terminology is... exit relays are relays.

> There are three kinds of relays that you can run in order to help the Tor > network: middle relays, exit relays, and bridges.

<comment><USER9> There's dictionary definition and there's typical usage. When people say relay node, they typically don't mean exit nodes. Not 100% correct, but the assumption is common.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> CloudFlare had a much more elegant solution: the Alt-Svc HTTP header [1]. It is entirely transparent to the user. Security is guaranteed because it uses the original SSL/TLS certificate for exchange (that is, on top of the usual safety guarantees provided by a Tor hidden service).

Sadly they stopped doing that a while ago [2]. If anyone has insider knowledge about the reason behind, I would be really interested to hear about it.

[1]: [https://blog.cloudflare.com/cloudflare-onion- service/](https://blog.cloudflare.com/cloudflare-onion-service/)

[2]: [https://community.cloudflare.com/t/tor-alt-svc-header-not- be...](https://community.cloudflare.com/t/tor-alt-svc-header-not-being- sent/113222)

<comment><USER12> Cloudflare is still using the Alt-Svc HTTP header. Use Ctrl+Shift+J to see the 'Browser Console' which contains logs in the form "Alternate Service Mapping found: [https://blog.cloudflare.com:-1](https://blog.cloudflare.com:-1) to [https://cflaresuje2rb7w2u3w43pn4luxdi6o7oatv6r2zrfb5xvsugj35...](https://cflaresuje2rb7w2u3w43pn4luxdi6o7oatv6r2zrfb5xvsugj35d2qd.onion:443").

Cloudflare only sends the header to clients it detects as Tor Browser. If you have tweaked your config or are running an older version, it may not detect correctly. Even if it had previously worked.

This technique is not "better than" the "Onion-Location" approach. They complement well. Use the 'Alt-Svc' header for all users with Tor Browser's user agent and send "Onion-Location" to all users. If a user decides to opt for the .onion address, they can. But they don't have to.

</comment></comment><comment><USER13> I'm pro decentralizing the internet, but these movements really need some marketing chops. ".onion" TLD? (Yes I know it has been around for awhile) Think of how a normal person will view a ".onion" domain name. It's nonsensical to the uninitiated.

<comment><USER14> Last century "network" and "web" were metaphors that meant nothing to the uninitiated -- I feel that ".onion" has a shot.

<comment><USER15> "Web" definitely meant something to people as a metaphore, for long before the internet (ex. "web of lies").

"The 'internet' is like a spider's web, but each point in the web is a different computer."

vs

"Tor is like an onion, where each layer of the onion represents a computer acting like a relay, in a giant network of computers, which your traffic is routed through....."

<comment><USER16> There is a scene in Shrek where he compares himself to an onion because he was emotional layers.

<comment><USER17> Shrek is an old meme and onions are stinky. Do you think that's a recipe for this to catch on by the next generation? It's a miracle .com worked at all, and I wouldn't hold my breath for a second miracle.

<comment><USER18> > Shrek is an old meme and onions are stinky. Do you think that's a recipe for > this to catch on by the next generation?

Yes, older members of Gen Z have already been enjoying Shrek "post-ironically" for years. Younger members of the generation are editing together clips of teenagers from the 00s as though it were some bygone halcyon era. Whether we like it or not the trends of reference and farce seem to be accelerating.

</comment></comment></comment></comment></comment></comment><comment><USER19> I am tempted to onionize my site for political (if that is the correct word) reasons.

I am almost done reading The Surveillance Economy and it feels like almost an obligation to push back. (Using ProtonMail, use a large leased server in Germany at Hetzner for my routine work and writing, and using private browsing tabs when I must use Twitter or Reddit.)

It looks like Onion domain hosting services are $5-$8/month, but going through their checklist and making one of my VPSs approved would be educational.

<comment><USER20> > It looks like Onion domain hosting services are $5-$8/month

You don't need a special host. You just need to run Tor and connect to the network.

<comment><USER21> Running an Tor Hidden Service doesn't require a specific host. As far as I know the traffic it generates will not be malicious. You only need to worry about malicious traffic and Tor-friendly ISPs if you plan to run an exit node (and at this point you need to consider the legal implications as well).

Furthermore if you are not hosting any illegal/objectionable content and don't need to hide from law enforcement or state-sponsored attackers, a lot of the security concerns around anonymizing the server no longer apply either.

</comment></comment></comment><comment><USER22> In this context OnionShare ([https://onionshare.org/](https://onionshare.org/)) is an excellent program that even non-technical people can use to either share files or even complete static websites over Onion routing. The main advantage is you don't need to grub around with Nginx, Apache and the Tor daemon manually setting everything up.

<comment><USER23> OnionShare rocks: Tor hidden services are excellent for that purpose and provide a decentralized alternative for cloud based apps.

What I love about them is also that it works in in tricky NAT situations where WebRTC struggles.

My file manager "cryo" also uses Tor hidden services for signaling without a central server to initiate peer-to-peer connections. [https://cryonet.io](https://cryonet.io)

</comment></comment><comment><USER24> I operate a few websites that host static content only. Is there any benefit to setting up onion services for these sites? Or are onion services more valuable for providing interactivity/logins?

<comment><USER25> If the data might be subject to censorship or spying, yes - using an onion service protects users from having info like "you read about STI treatment" sold to their insurers.

</comment></comment><comment><USER26> Why haven't we seen a pay-for-use version of Tor yet? The network won't scale unless exit and relay nodes are incentivized with value beyond warm-fuzzies.

<comment> yjftsjthsd-h How would that work without killing the privacy angle?

<comment><USER27> Monero/zcash

</comment></comment></comment><comment><USER28> I have (a few) static sites on places like Github Pages/netlify. How do I put them under a .onion?

</comment><comment><USER29> Majority of the ISP's provide dynamic IP these days and getting static ip costs significantly more money. If you have a low compute device like raspberry pi running 24/7 which controls all the home network, then connecting(ssh) to it over internet requires static ip. The other alternative which does not cost money is setting up tor(which is pretty simple) and ssh socks proxy on the client machines. This use case is pretty common which does not involve privacy but very useful.

</comment><comment><USER30> I want a short HOWTO linked from this article.

<comment><USER31> I would love to do this for my personal site. Not sure if I am willing to spend 4 hours on figuring it out though.

<comment><USER32> I did it for my personal site, and it wasn't too hard, I personally didn't have as much experience with nginx and stuff back then but if I were to set one up now I feel I'd be done in under 30m complete with a vanity url.

</comment></comment></comment><comment><USER33> I remember, in 2014, Facebook started to be available on Tor, and people speculated that there will be a wave of popular websites being offered on Torspace.

Nothing came of this "wave", if I'm not wrong, right.

[https://en.wikipedia.org/wiki/Facebookcorewwwi.onion](https://en.wikipedia.org/wiki/Facebookcorewwwi.onion)

edit: and it seems down to me right now.

edit2: it works... but slower, than just going to regual HTTPS version with Tor. Which makes sense, because it needs to hop more.

edit3: .... but it doesn't let me log in, as I am logging from "suspicious location".

<comment><USER7> I still use Facebook via Tor quite often, even though it's barely usable - loading anything takes between 3 and infinite seconds (i.e. never loads, requiring multiple refreshes). I use it to let them know that people still use it, with the hopes that they don't even remove it. I don't have this problem with other Tor sites, so it leads me to believe they want to be able to advertise it as "we offer this because we care" while making it nearly unusable to the point that nobody will use it. It's very similar to the secure chat feature, which they continually move deeper and deeper into menus, each move progressively more difficult to find. They just yesterday enabled the new "layout", and I can't even find the secure chat feature anymore, they either buried it so deep or removed it entirely?

</comment></comment><comment><USER34> What's the advantage of accessing an onion service (as opposed to accessing a normal https website over tor)?

<comment><USER35> I am not an expert but as far as I understand it's harder to do correlation attacks when you're able to monitor network traffic when communication stays inside the Tor network. Additionally, you're replacing (or extending) CAs with Tor's public key cryptography for authentication and encryption.

Computerphile did an interesting video series on this!

<comment><USER36> > replacing (or extending) CAs with Tor's public key cryptography

Which is good because CAs are useless; they're complete overhead. Back when EV certificates meant something, they were marginally useful, but at this point, we might as well just switch to a TXT record that validates domain ownership. (Obviously, that doesn't protect against DNS MITM attacks, but that's a separate issue.)

<comment><USER35> Oh you mean storing some data to cryptographically verify that a particular server is associated with a domain? If I'm not mistaken, that's what .onion addresses are.

I wonder if anyone has tried putting .onion addresses into DNS and have clients treat them like address records...

</comment></comment></comment></comment><comment><USER37> I'm in charge of a security for a reasonable sized company. I generally support the Tor project and the goals of having a surveillance free internet.

However - if an employee would install tor browser or use tor on a company device, or a device attached to the company network, they would be fired immediately. I would then refer them to law enforcement after conducting a forensic audit.

Should you make your site only available via onion routing, or primarily available on onion routing, all workplaces will immediately block access and look at anyone who accesses with great incredulity

<comment><USER38> I wasn't as active on the Internet during the initial rise of HTTPS, but I wonder how many companies, schools, and public stores threw the exact same fits back then when they realized there might be a world where they could no longer MITM every web request that went across their routers.

I do remember the "kids who use Linux are hackers" arguments from schools; arguments that still occasionally pop up on rare occasions. And even more recently, I see the pushback from administrators and ISPs over encrypted DNS.

My instinct in this situation is that the "only criminals need privacy" argument is probably evergreen, and that Tor probably isn't in a unique position.

Of course, companies can choose what to install on their own devices, and they can choose what software they'll allow to connect to their networks. The Tor project changes nothing about employers' rights to control and monitor the hardware that they issue. It's normal for workplace networks to have more restrictions than ordinary networks.

Nevertheless, if (beyond those policies) your instinct is that anyone you see using Tor is probably a criminal, then I'm not sure you can honestly claim that you "generally support the Tor project and the goals of having a surveillance free internet." A casual observer would be forgiven for thinking that maybe the opposite is true, and you're terrified of a world where the Internet can't be monitored -- particularly the ordinary, everyday Internet as accessed by regular nontechnical people on their regular, everyday smartphones and laptops.

<comment><USER37> There is no legitimate use for it in this context, and as such, every single instance of it has been associated with a crime, mostly CSAM.

<comment><USER38> > There is no legitimate use for it in this context

There's no legitimate usage for World of Warcraft on a work computer, and I'd happily ban that from work computers. But I also wouldn't hop onto an unrelated article for new players and imply that all of them were criminals. The linked article never mentions work computers, it's talking to website operators.

If your objection here is that you think Tor is inappropriate at this moment in one specific work setting, then fine, but that's not really adding anything to the conversation about whether or not general websites should be made available over Tor. It's just unrelated FUD.

I want to be clear, the goal of Tor proponents is for everyone to be running Tor (or something similar), and for most websites to be available over Tor by default. People should be running Tor on their smartphones, on their home laptops. Tor should be the default way that people share files with each other, and the default way that people set up technical blogs, or even just quick websites that show off pictures of their cat. The vision of the Tor project is a world where Tor is normal and ubiquitous for regular, non- technical people.

So unless your work policy bans all personal devices from your network, creating an expectation that any smartphone that joins and boots up a Tor browser automatically belongs to a criminal is contrary to the goals of the privacy movement. Our goal is that every device and every website should be private by default. Your network should be the exception, and it should only have company-owned devices on it.

And of course it's fine if you disagree with that, you don't have to be a privacy proponent. Lots of smart, reasonable people disagree with us about what the balance is between security and privacy. But demonizing Tor users in ordinary, everyday contexts is anti-Tor.

> or primarily available on onion routing, all workplaces will immediately > block access and look at anyone who accesses with great incredulity

To go a step farther and suggest that making a website available over Tor should automatically mean that people who visit it are suspicious -- that is also anti-Tor and (I would argue) anti-privacy in general.

If I went into an interview for any company in any field offhandedly mentioning that I ran a Tor website, and then had to field a bunch of questions about whether or not I was a criminal, that would be a _major_ red flag to me to avoid that company.

<comment><USER37> I'm adding my thought that hosting a website on Tor primarily, will make it totally unavailable from many workplaces. Currently, Tor is not the place for a site that doesn't _require_ an extremely high level of anonymity of access.

The network policy does ban all personal devices, in order to control what connections originate from inside the network.

To be clear, I'm not demonizing Tor or Tor users. I like what the Tor project wants to do, and I support it, but believing it will be allowed in many corporate settings, in July 2020, is extremely naive. As I already mentioned, there's no legitimate use case to allow this in a corporate setting.</comment></comment></comment></comment></comment>


Microsoft on mounting ISOs - Resolved - Won't Fix - <AUTHOR> http://connect.microsoft.com/WindowsServerFeedback/feedback/details/351231/mount-iso-files

<comment><USER2> Just to clarify, this is WontFix on _Server 2008_. This is in no way a statement that MS will not do this in upcoming operating systems (nor is _this message_ a confirmation).

<comment><USER3> Thank you.

Headlines like this always cause me to read the comments first just because it looks too much like bait.

</comment></comment><comment><USER4> What I don't understand is that Microsoft provides their software in ISO form, but then doesn't provide a way to access the ISO. It always necessities installing a third-party program to either extract files from the ISO or create a virtual CD-ROM to mount the image.

Linux and MacOS both support mounting images out of the box.

<comment><USER5> Linux and Mac also have a perceived software deficit. If not to consumers, definitely to businesses. The more software is on Windows, the more people go to Windows, ... etc.

One could _choose_ to view that forcing MS users to use 3rd party software to a common problem is actually 'supporting the ecosystem'. Someone in Microsoft could be saying that they aren't forcing users, but giving them the choice.

So what happens? The implement ISO mounting for the most part but either have compatibility bugs or they extend the functionality to benefit its own ecosystem better. People complain about that too. Think carriage returns (\n\r) and Internet Explorer. People hate Microsoft for these reasons.

So really, they piss someone off either way. So doing what costs the least amount of money (nothing) is often best.

That said, asking "How does server administration on Server 2008 and related products compare to other platforms?" answers a larger and more important question than "how do I mount ISOs on Windows?"

</comment></comment><comment><USER6> From some recently leaked images of Win8, it appears that it will support mounting ISOs out of the box.

</comment><comment><USER7> I usually just put the isos on a Linux box, share them, and then mount the share as a drive in Windows. Isn't that the easiest way? :)

</comment><comment><USER8> Doesn't Microsoft still distribute large fixes, service packs, MSDN, TechNet, and the like as downloadable .iso images? Do they seriously expect people to waste hours burning piles of physical DVDs for that sort of thing?

Sneakernet is apparently still an essential part of their network stack. Good luck if your server is mounted in some data center you don't have easy access to. Remember this next time you hear them say they're "betting the company" on cloud computing. They just don't get it.

</comment><comment><USER9> Seems to be their filosophy that one can do almost nothing with out-of-the-box Windows. No basic tools integrated, eg. ssh client or pdf-viewer (when I last checked).

</comment><comment><USER10> For anyone curious, on Windows:

\- 7-zip is free and will open ISO files as archives and let you extract the contents.

\- Virtual CloneDrive is a free utility which appears as a drive letter and mounts ISOs.

\- Folder2ISO is a simple GUI-on-top-of-mkisofs which takes a folder and produces an ISO from it.

\- DeepBurner is a freeware CD/DVD burner which can burn ISOs.

I think that covers most of what I do with ISOs on Windows using freeware which I use often, works well and hasn't bitten me.</comment>


Are all the good ideas taken? - <AUTHOR>

I've been considering ideas for a new software project. I have modest expectations, and I thought a few good ideas. But every time I research an idea, it seems someone is already way ahead in that area.<p>I've never seen so many new ideas on the ground at the same time. With the success of incubators in recent years there seems to be few green pastures left in the internet space. Does anybody else feel this way? <comment><USER2> 1\. Make telecommuting work. Multiple screens, cameras, great software. 2\. Make a computer/operating system that cannot get malware; only originally installed software is trusted, any downloads are fully sandboxed. 3\. Put QR codes on garments (use Zazzle), take a photo, site compares your dating requirements with target's, if yes, sends message to target. 4\. add fake location data to mobile device. 5\. Send lots of messages and phone calls to random instances of the app (which appears to respond). 6\. destroy mobile advertising.</comment>


Ask HN: Good Reading/Immersion in Mathematics - <AUTHOR>

I'm interested in getting a good solid basis for study of mathematics. Right now, I am interested in a broad and not necessarily too deep to start with; instead, I want to be acquainted with all of the different fields beyond what I've done in my mathematics classrooms.
What books and web pages do you recommend I read, as well as what blogs and podcasts are good to follow to learn more on a constant basis.
Thanks! <comment><USER2> Pick up a discreet mathematics book. Learn logic, set theory, and writing mathematical proofs (induction, etc.)

I really wish they'd put a class like that right after basic symbolic algebra in normal school curriculum - it's far more useful in the modern world than trigonometry.

<comment><USER3> I can't believe no one has mentioned Concrete Mathematics by Knuth & friends yet.

It's incredibly well-written. Very challenging, yet totally approachable and accessible to someone with even just a rather basic (even foggy) understanding of "high-school" math.

<comment><USER4> What is the prerequisite for reading this book. Can I read this book effectively with basic knowledge of high school algebra and some calculus?

<comment><USER3> Yes. I did. It will be _very_ challenging.

I, quite a few times, spent more than four hours with a pencil and paper making my way through 2-4 pages of material, as since my background was lacking, there were parts where I had to figure out how they got from A to B. IIRC, I spent multiple days on a few paragraphs at one point.

That said, it is written how I think math books should be written, is considered part of the start of Discrete Mathematics, and is conversational, illuminating, well-layed-out, and approachable despite it's level of difficulty.

I can't recommend it enough.

Don't view it as something where if you're not making progress you're failing. Take the time to ensure you understand every bit of what you read before moving on, and do all the exercises you can muster.

<comment><USER4> thanks a lot.

</comment></comment></comment></comment></comment><comment><USER5> Potentially related threads :

Math for hackers : <http://news.ycombinator.com/item?id=672067>

Good books on mathematics for somebody who's only taken high school math? : <http://news.ycombinator.com/item?id=299687>

Recommendation for (re)learning Math Skills : <http://news.ycombinator.com/item?id=1449799>

</comment><comment><USER6> This is hard to answer without knowing something about your current mathematical background and more about what you want to get out of learning some mathematics.

Assuming that you want to learn some 'university-level mathematics', then you'll really need to be prepared to study and work through problems rather than just read. Mathematics is an area where it's hard to get breadth of knowledge without also having at least some depth because things build very much on each other.

If you really do just want an overview of areas of different areas of mathematics to whet your appetite, there are books by people like Ian Stewart, Marcus du Sautoy and Keith Devlin, all worth reading. Just be aware that reading these is a bit like reading about different programming languages without ever having written a computer program.

If instead you just want to keep your brain engaged mathematically without learning more serious mathematics, there are also plenty of recreational mathematics books out there - Martin Gardner being the name that instantly springs to mind. On a similar vein, you may also enjoy the books of Raymond Smullyan which are more focused on logic.

The only really nice non-textbook taster of university-level mathematics that I have found in Alice in Numberland by Baylis and Haggarty. However it's out of print so you might have problems getting hold of a copy. It is a lovely book though if you can get your hands on it.

Otherwise you are looking at textbooks. I'd recommend maybe 'Introductory Mathematics: Algebra and Analysis' by Geoff Smith as a gentle but rigorous intro to the basics that I'd expect every maths student to learn at the start of their degree course. There are lots of alternatives out there too though. I taught myself lots from Herstein before going to university but that's pretty heavy going and there are better books out there these days. If you look at other books, I'd probably suggest getting one on abstract algebra maybe, covering things like sets/functions and group theory rather than say analysis or linear algebra to start off with, as it's easier to get into the right mathematical mindset if you're not distracted by content which you already have intuitions about.

</comment><comment><USER7> "want to be acquainted with all of the different fields" may actually be quite hard - you can't do complex analysis, differential equations in multiple dimensions etc. without having a very firm grip on standard analysis (including all the proofs and definitions that they normally skip in high school).

If you want to build up your math muscles (as a good preparation for actually studying maths), you should have a look at some discrete mathematics books (the one I had was "Discrete Mathematics" by Norman Biggs) as they teach you to think in terms of proofs.

If you want to get a thorough foundation for non-discrete maths, you should start with a good (university math) analysis textbook (No idea what's a good one in English).

Another approach you could take is to take a math book that is targeted at physicists and EE people - those usually skimp on the proofs and don't contain enough detail to understand the fundamentals behind it all, but bring you to the interesting (to physicists and EE people) stuff much quicker than a real math course would.

Oh, and if you hang out on Youtube, be sure to watch the catsters - this is category theory, presented by actual working mathematicians, at an accessible level (and with a cute UK accent too).

<comment><USER8> Is there dependency graph of mathematical fields somewhere? That would be useful.

<comment><USER9> i'm not able to dig it up right away - but just a couple of days back there was a blog post by someone who gave a long, very comprehensive listing of topics that take you all the way from basic to postgraduate level math.

It was organized in a dependency graph kind of way.

</comment></comment></comment><comment><USER10> You may find this useful: <http://math-blog.com/mathematics-books/> (DISCLAIMER: It's my site.)

<comment><USER11> I like this list; thank you for taking the time to compile and annotate it.

</comment></comment><comment><USER12> It may be helpful if you state your mathematical background, though I'm guessing that, if you had taken any proof-based math course, you wouldn't be asking this.

I recommend The Art of Problem Solving I and II. On the one hand, they're intended for (mathletic) middle and high-schoolers. On the other hand, some of their problems are quite challenging, and much of the material therein is what my school teaches in its intro discrete math courses since very few students learned it in middle and high school.

<http://www.artofproblemsolving.com/Store/contests.php>

<comment><AUTHOR> I'm currently a junior in high school. I am doing some summer work in math and considering doing it as a degree in college, but so far I have only taken basic Algebra, Geometry, Trigonometry, and currently in Statistics (as well as in a math-focused Computer Science track). I'm looking at Calculus I next year.

</comment></comment><comment><USER13> I love Calculus Made Easy by Silvanus Thompson (updated by Martin Gardner).

<comment><USER14> This is an absolute must. You can get it free (the original version) here : <http://www.gutenberg.org/ebooks/33283>

</comment></comment><comment><USER15> Here's my list:

Basic

1\. Chapter Zero (Carol Schumacher) 2\. Naive Set Theory (Paul Halmos)

Linear Algebra

1\. Finite-Dimensional Vector Space (Paul Halmos) 2\. Linear Algebra Done Right (Steven Axler)

Real Analysis

1\. Real Mathematical Analysis (Charles Pugh) 2\. Introduction to Analysis (Maxwell Rosenlicht)

Algebra

1\. A first course in abstract algebra (John Fraleigh)

These books are better for self-directed reading compared to some of the classics like Rudin or Herstein. These should keep you busy for a while.

</comment><comment><USER16> Related to this, I've found most text books aren't the best way to learn the material since they don't actually provide answers to solutions. You get the theory but little followup practice to apply your understanding of that theory.

Are there any good texts that are more problem workbook style? One example that comes to mind is "Exercises in Probability", or some of the 3000 Problems books as published by Schaum.

</comment><comment><USER17> I'm working through Calculus by Michael Spivak. If you want a thorough knowledge of calculus(who doesn't?) then I wholeheartedly recommend it. While it's more deep than broad, it will surely help you learn to start thinking more like a mathematician.

<http://www.amazon.com/Calculus-Michael-Spivak/dp/0914098896>

</comment><comment><USER18> In my view, the best place to start for a good grounding in rigorous mathematics is Velleman's 'How to Prove It'

As for a good broad overview of many areas, the title that springs to mind is 'the nature of mathematical modelling' by Gershenfeld, though you'd better have some decent maths experience before tackling that one - it can be tough- going, but is refreshing in its breadth and clarity.

</comment><comment><USER19> If youre looking to learn mathematics as a tool rather than an end goal the list above seems far too abstract. A good foundation in analysis is probably as abstract as you'll need for a majority of applied fields. For computational science and learning you need to know (albeit very well):

linear algebra (strang, trefethen, golub and van loan) optimization (nocedal, bertsekas) probability (rice, casella & berger, grimmett) statistical learning (tibshirani, bishop)

A good free online book was recently an HN topic: <http://news.ycombinator.com/item?id=1738670>

</comment><comment><USER20> Check out The Unapologetic Mathematician "blath":

<http://unapologetic.wordpress.com/>

</comment><comment><USER21> You might want to have a look at the "Princeton Companion to Mathematics". It's goals seem close to your "broad but not too deep" objective.

</comment><comment><USER22> Linear Algebra Done Right, Axler. Don't learn Linear Algebra without it.

</comment><comment><USER23> [http://topics.nytimes.com/top/opinion/series/steven_strogatz...](http://topics.nytimes.com/top/opinion/series/steven_strogatz_on_the_elements_of_math/index.html)

</comment><comment><USER24> I really like this one: <http://academicearth.org/subjects/mathematics>

</comment><comment><USER25> I'd definitely recommend Godel, Escher, Bach by Doug Hofstadter. Not just about mathematics, but fascinating.

Also, anything by Martin Gardner.

<comment><USER12> GEB is excellent as a pop-science/pop-philosophy book, but (like most pop-sci books) it's terrible for actually learning any subject. You need more than one proof every 200 pages.

<comment><USER3> Yup. It gave me a nice intro to formal systems / number theory iirc. Intro only though, and it was only a small part of the book.</comment></comment></comment>


Angular 2 Style Guide - <AUTHOR> https://angular.io/styleguide <comment><USER2> Any tips for a mere mortal who looks at Angular and finds it incomprehensible? React? Vue.js? Or just stick to good ole Rails/Python for now?

<comment><USER3> One way to think about Angular is like this: Different modules on your page are broken down into components, which are like "regular" HTML tags except that they have JavaScript functionality attached to them. Your app is a tree of components.

React is great as well, but if you find Angular incomprehensible it's not clear you'll find React much easier.

One major difference between React and Angular is that the Angular community _tends_ to separate their templates from their "controller" code, whereas the React community _tends_ to intermix their templates with code ("PHP" style).

The result is that in Angular you have a few funny characters in your HTML to learn (e.g. `*ngFor="let foo in bar"` for looping) whereas in React you'll use JSX and use JavaScript for loops.

It's pretty clear to me that component-based webapps are here for the long haul. Even if WebComponents ends up being the future, the concepts you learn in using either Angular or React will be more-or-less transferrable.

It seems to me that Angular and React are becoming more similar over time. For typing, Angular uses TypeScript and React uses Flow. For data architecture, both communities are gravitating towards some sort of Flux (redux / ngrx). You can even use JSX in Angular if you want to.

Shameless plug: I've written a book on Angular 2 which talks through, step-by- step, how to understand Angular. The first chapter walks you through your first app and you can get it (for free) here: [https://www.ng- book.com/2/](https://www.ng-book.com/2/)

<comment><USER4> Why use Angular 2 when you can use web components?

<comment><USER5> [http://caniuse.com/#search=components](http://caniuse.com/#search=components)

Because you can't practically use web components. Only Chrome and Opera support them. Angular2 has support down to IE 9.

<comment><USER6> The web components polyfills have support down to IE 10: [https://github.com/webcomponents/webcomponentsjs](https://github.com/webcomponents/webcomponentsjs)

<comment><USER7> Start with this: [https://github.com/webcomponents/webcomponentsjs/issues/212](https://github.com/webcomponents/webcomponentsjs/issues/212)

Which is why I stopped messing around with polymer. Basically adding the webcomponents polyfill to your DOM tree (because it touches so many things) breaks contenteditable in some weird ways. Which can be limiting to people who use rich text editors (many still decorate contenteditable divs) although iframe-wrapping the editor fixes the contenteditable breakage (at the expense of introducing other problems with extending your editor - try adding custom (say) atmention autocompletes to something in its own execution context).

Also, webcomponents have had some pretty major syntax changes over time, especially when it comes to shadow-piercing styling vs other styling selectors.

Ultimately, I'm looking forward to webcomponents. I can't wait to have proper namespaces and all that. In the short run, though, I've tried the webcomponents polyfill (I wrote a lot of polymer 0.X code for a webapp that I eventually ported to angular 1.x instead when the polymer 1.x syntax meant I'd have to rewrite a lot anyway), and it's not Enough.

</comment></comment></comment></comment></comment></comment><comment><USER8> "Write Angular 2 with style"

> Request javascript version

"This chapter is not yet available in JavaScript. We recommend reading the TypeScript version."

LOL

<comment><USER9> Same with their tutorials on angular.io .

Angular2 is a framework build for Typescript and Dart, barely for Javascript and certainly not for ES5.

<comment><USER5> TypeScript is fantastic. Maybe it will be the undoing of Angular2 but I doubt it. The Angular2 team chose TypeScript because writing large applications using the limitations of ES5 is extremely difficult. TypeScript makes the task manageable and compiles back into ES5 (or whatever you want). The tooling is lightweight and freely available. Give it a try!

<comment><USER9> Typescript isn't Javascript. I gave it a try already,for 2 years, and I used Angular 1 in production, I'm moving to something else like React or Vue.js, both supporting actual Javascript (even JSX isn't necessary). Good luck with your non standard syntax like decorators... Angular 1, despite its internal complexity, was just one file dropped in an html page and you're ready to go. There was nothing that mandated a complete rewrite with breaking APIs at first place. I complained to Igor 3 years ago about it. Well let's see how it goes.

<comment><USER10> Typescript is ES with totally optional type information, which protects you from a whole lot of bugs and for javascript bad API design (i.e. horrors like APIs which return different types with different input).

I can understand that it feels strange, especially to someone who has had little exposure to languages outside of Javascript. However it is very much worth investing the time in learning it.

15 years ago I was making the same argument to Visual Basic developers about C#..

<comment><USER11> I'm sorry but I will _never_ use Angular 2.0 unless it can be used with straight JavaScript. I am a backend developer that, for personal projects, needs to do small amounts of front-end work. Anything that potentially increases complexity or involves a redundant learning curve (learning yet another _imperative_ language that compiles into JavaScript anyway) is not something I am going to invest time in.

It's a shame too, I was a pretty big Angular fan. I used Angular, Ember, and even React and for several reasons I ended up settling on Angular as my favorite SPA framework (back in 2014 and 2015). Back when they announced Angular 2.0 would be TypeScript based, I felt like it was a mistake and that feeling has only gotten stronger as TypeScript has continued to fall behind EMCAScript ([http://kangax.github.io/compat- table/es6/](http://kangax.github.io/compat-table/es6/)).

If TypeScript adopts compilation down to WebAssembly, that would be a reason to learn it/give Angular 2.0 a chance for me, but until then I will stick to Angular 1.0 or move towards React for my next project...which is a shame because I really don't like Reacts focus on the V of MVC. Maybe I will go back and check on Ember, but I wasn't a fan of it's tight binding of Models to Views (sometimes I just need a VC or a V and not a full MVC)...but maybe it has changed.

<comment> squeaky-clean > I'm sorry but I will never use Angular 2.0 unless it can be used with > straight JavaScript.

It can. Typescript is just optional information added to your Javascript. All Javascript is 100% compatible TypeScript. You can use TS extensions anywhere you like, your whole codebase, only certain function APIs, or nowhere at all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> People have brought it up but I feel the need to drive it home: while Typescript is amazing and, when used correctly, can allow more expressive and bug-free code then es5, adoption will suffer greatly and has the potential to detract from the overall success of Angular 2.0.

<comment><USER13> Typescript is _the_ feature of Angular 2.0 for me

There are plenty of ES5 frameworks out there - the biggest value proposition Angular 2 brings for me is that it's built with typescript from the start and it leverages all of it's features (ie. modern OO tooling that comes with languages like C# and a language that feels familiar to C#/Java devs) and builds a GUI framework on top of it that works in the browser.

Without being native TS Angular 2 would have very low appeal to me.

<comment><USER14> You know, there are some of us who _like_ the fact that Javascript is a dynamic language that supports functional programming (FP) style.

For us, "being like Java" is not a plus. My IDE already does a pretty good job at type inference while I am editing, as well as displaying the comments about each symbol as I click on it.

</comment></comment></comment><comment><USER15> You could also run the Codelyzer (A set of tslint rules for static code analysis of Angular 2 TypeScript projects) with the recommended configuration to match this style guide.

[https://github.com/mgechev/codelyzer](https://github.com/mgechev/codelyzer)

</comment><comment><USER16> I don't much care for Angular, but this is some seriously beautiful documentation.

</comment><comment><USER17> Happy to see the pace at which the angular team is updating their support docs now that they are in beta.

<comment><AUTHOR> You mean now that they are in release candidate! ;)

</comment></comment><comment><USER18> So Angular is all TypeScript now?! With a recommendation for Microsoft's editor at the end of the article.

Anyways - it seems like a set of reasonable conventions; Java/C# programmers should feel right at home.

The only thing that sticks out is the file name convention. If you only have one thing pr. class then why not use name as it is directly in the file name? (HeroComponent.ts instead of hero.component.ts)

</comment><comment><USER19> I'm really excited to see there will be an official style guide that was truly lacking in v1.x

Having worked on various teams (now we follow [https://github.com/johnpapa/angular- styleguide](https://github.com/johnpapa/angular-styleguide)), its truly a maintenance nightmare without a verbose Angular style guide for reference.

<comment><AUTHOR> Lacking how? John Papa's style guide has been around for some time, and it's endorsed by the Angular team.

He is in charge of the Angular 2 style guide too. I bet he will do a good job with this one too.

<comment><USER20> Just to follow up. John Papa's original style guide was create after he had experience with building Angular 1 apps and got feedback from other developers. An Angular 2 style guide can't be fully formed right now because no one really knows what all of the best practices are yet. As all of us get more experience using Angular 2, the style guide will get better.

</comment></comment></comment><comment><USER21> From: [https://angular.io/styleguide#!#style-03-03](https://angular.io/styleguide#!#style-03-03)

> Consider naming an interface without an I prefix.

They give the same recommendation in the Typescript style guide, but I still don't understand why.

<comment><USER15> This is a common discussion I see on the internet[0][1][2][3]. Paraphrased below

You shouldn't need to know whether the client is using an interface or an implementation class. List represents a list, and a User represents a user - not an IUser. Another problem with using I, is that (oddly) we use it to communication the implementation decision of using an interface. Usually we don't want implementation decisions expressed so loudly, because that makes them hard to change.

[0][http://programmers.stackexchange.com/questions/117348/should...](http://programmers.stackexchange.com/questions/117348/should- interface-names-begin-with-an-i-prefix)

[1][http://stackoverflow.com/questions/541912/interface- naming-i...](http://stackoverflow.com/questions/541912/interface-naming-in- java)

[2][http://stackoverflow.com/questions/5816951/prefixing- interfa...](http://stackoverflow.com/questions/5816951/prefixing-interfaces- with-i)

[3][https://blogs.msdn.microsoft.com/brada/2004/02/03/why-do- int...](https://blogs.msdn.microsoft.com/brada/2004/02/03/why-do-interface- names-begin-with-i/)

<comment><USER21> Excellent reply, thank you.

To me, it still seems more about people's gripe over the very existence of interfaces.

If anything, using IUser in lieu of User is a pretty clear signal to, say, an uninitiated developer, that you shouldn't be attempting to create an instance of "IUser."

</comment></comment></comment><comment><USER22> In the first suggestion they suggest breaking up a component into its own folder. That quickly becomes a completely mess imo. Better to prefix the filename with the component (hero.service.js) and leave everything in the same directory.

<comment><USER23> If each component have 3 files, how can 10 folders (with 3 files inside) be a more mess than list of 30 files with prefixes?

</comment></comment><comment><USER24> does angular2 support preloading data/setting initial-state, such as by server-side templating?

if not, can i run angular2 in, say, nashorn to generate view data?

<comment><USER25> Yes, it's called 'angular universal'. Here's a talk of ng-conf: [https://www.youtube.com/watch?v=TCj_oC3m6_U&index=5&list=PLO...](https://www.youtube.com/watch?v=TCj_oC3m6_U&index=5&list=PLOETEcp3DkCq788xapkP_OU-78jhTf68j)

</comment></comment><comment><USER14> How many symbols are all of those .ts files going to put into the global namespace?

<comment><USER26> The .ts files will be compiled to AMD modules, so none of the declarations will be in the global scope.

<comment><USER14> Thanks, I had not seen that before. Interesting trick: Call a "registration" function with a string array (of dependencies) and an anonymous function (IIFE) with parameters for each dependency which the registration function injects. Thus, the dependencies are accessed as closures over the outermost func's params, rather than as globals.

E.g. -

        define( [ 'jQuery' ], function ( $ ) { ... return { ... } } )

where the 1st elipses are all the private/setup code, and the second elipses are whatever methods/properties the module exports. (this dummy only wants jQuery, but the list can be longer)

</comment></comment></comment><comment><USER27> Looking forward to forced indentation + javascript.

<comment><USER28> It already is forced -- see: ESLint.

</comment></comment><comment><USER29> Anyone getting along with angular forms?</comment>


Create A Clean and Stylish CSS3 Contact Form - <AUTHOR> http://www.vooshthemes.com/blog/design-tutorial/create-a-clean-and-stylish-css3-contact-form/ <comment><USER2> There's lots wrong here: no labels, incorrect input types for things, no required attributes even though they should be required, no vendor prefixes for newer CSS properties.

If you are writing a tutorial, remember many people will just copy and paste your code without getting it to production level.

<comment><USER3> That's hardly the fault of the tutorial writer. It's incumbent on the user of the code to understand it, not anyone else.

<comment><USER4> That's hardly the fault of the arms dealer. It's incumbent on the buyer of the faulty landmines to understand the consequences, not anyone else.

</comment></comment></comment><comment><USER5> It would be a huge improvement to the accessibility and semantics if the p tags were changed to label tags with for attributes.

<comment><USER6> I opt for a P around both the label and the field, gives greater CSS hooks and encapsulates each form area nicely.

<comment><USER4> Fact: you can wrap input elements in a label element. No extra for attributes required, either.

<comment><USER6> Yes but if you want to float the label and have it cleared in the next "row", that's where the separation of elements comes in handy.

</comment></comment></comment></comment><comment><USER7> It looks nice, but I agree with wbond. Not only should the p tags be labels, but the divs could be fieldsets to make it more semantic.

</comment><comment><USER8> This is a nice little starter intro to CSS for forms. To be really useful, it'd have to demo some of the harder elements to style, the hardest being inputs for uploading files. I haven't seen a technique yet that doesn't require some javascript to compensate for browser quirks:

[http://www.shauninman.com/archive/2007/09/10/styling_file_in...](http://www.shauninman.com/archive/2007/09/10/styling_file_inputs_with_css_and_the_dom)

</comment><comment><USER9> Why not include the non-prefixed versions of these properties in the stylesheet?

It always bothers me when I see tutorials and such doing this.

</comment><comment><USER10> Have you heard about Sencha? Looks promising on highly-interactive CSS features for iPad and Android.

</comment><comment><USER11> To add to the pile-on, the highlight should follow focus, not mouse over.</comment>


The f8 Preview: How Facebook Plans to Take Over the Web - <AUTHOR> http://gigaom.com/2010/04/20/facebook-takes-over-the-web

<comment><AUTHOR> This could be exciting -- I'm interested to see how well and how many external sites start hooking back into Facebook.

</comment><comment><USER2> I'm in the middle of implementing some of the F8 features for launch tomorrow. Some of the features are pretty nifty like the Activity/Recommendations feature.</comment>


Learn Python by visualizing code execution - <AUTHOR> http://pythontutor.com/visualize.html

<comment><USER2> I love using this visualization tool with students who are new to programming. You can create code snippets, and share them through a url.

Here is a quick example demonstrating why you need to use a slice to copy a list:

[http://pythontutor.com/visualize.html#code=my_foods+%3D+%5B'...](http://pythontutor.com/visualize.html#code=my_foods+%3D+%5B'pizza',+'beer',+'steak+fries'%5D%0A%0A%23+Want+to+start+with+a+copy+of+my+list%3F%0A%23++Wrong+way%3A%0Ayour_foods+%3D+my_foods%0A%0A%23+Proof+that+it's+the+wrong+way%3A%0Ayour_foods.append\('ice+cream'\)%0A%0A%0Amy_foods.remove\('ice+cream'\)%0A%23+Proper+way+to+copy+my+list%3A%0Ayour_foods+%3D+my_foods%5B%3A%5D%0A%0A%23+Proof+that+we+have+separate+lists%3A%0Ayour_foods.append\('ice_cream'\)&mode=display&cumulative=false&heapPrimitives=false&drawParentPointers=false&textReferences=false&showOnlyOutputs=false&py=3&curInstr=0)</comment>


Are RethinkDB and Horizon abandoned? - <AUTHOR> https://discuss.horizon.io/t/are-rethink-and-horizon-dead-abandoned/619 <comment><USER2> Slava @ RethinkDB here. I am not able to get into details yet, but the short version is that the commercial entity behind RethinkDB is shutting down. We're working on continuity for the open-source project. Full announcement (and details) coming in a day or two.

<comment><USER3> Slava: As the commercial strategy is over, please release everything under a very liberal open source license rather than AGPL (the current RethinkDB license). Please. I have invested so much in building on RethinkDB, and you can't just will a genuine open source community into existence without giving them the power that comes with a liberal license. Honestly, right now I'm evaluating how I can rewrite everything I've built to not use RethinkDB, which will take me months of fulltime work...

<comment><USER4> I really, really, hope that's why they've gone quiet, that they're minimising disruptions while they're re-licensing to a more liberal license while transferring ownership to a foundation.

</comment></comment></comment><comment><USER5> This thread seems actively being burried by HN. Now it's flagged as dupe and the previous thread from yesterday also quickly disappeared from the front page after gaining traction.

Why are threads that get tons of upvotes and have active commenting going on getting kicked off the frontpage? YCombinator invested in RethinkDB and HN is a YCombinator platform so they have an interest in suppressing speculation or bad news but I think manipulation here goes a bit too far.

HN mods: what happened here?

<comment><USER6> The previous discussion was buried too. I'd also like to know why a link with +250 points is modded away. Obviously they are trying to keep it on the dl, but we really need some transparency when HN the news site conflicts with YC the fund.

Edit: Here's a semi-buried sctb response: [https://news.ycombinator.com/item?id=12631225](https://news.ycombinator.com/item?id=12631225)

</comment></comment><comment><USER7> And people wonder why enterprises are risk averse and nervous of open source and new innovations from startups.

Are there any circumstances where a company can reasonably go dark for a week?

If it is an acquisition it's pretty disrepectful of people investing in their solution.

<comment><USER8> On the contrary, I would say that enterprises should take the risk and use such projects. They likely have enough capital to hire the correct people (e.g. one of the core devs) when a problem shows up.

Startups can't afford that. Therefore they should use older technology until they grow big enough to tank the damage.

<comment><USER9> That's not how enterprises work.

<comment><USER10> Ack. Sadly, enterprise procurement is all about avoiding blame in case something goes wrong. Another issue is contributing to open source projects. I know a case where a customer's in house developer had to wait two months to contribute a few lines patch to a open source project because legal objected. They never dealt with that situation before.

<comment><USER11> Enterprise procurement is all about avoiding things going wrong, avoiding blame is a distant second. When every hour of downtime costs hundreds of thousands, the ridiculously expensive, 24/7 SLA supported enterprise solutions don't seem so overpriced anymore.

</comment></comment></comment></comment></comment><comment><USER12> It looks like RethinkDB is relying solely on revenue from training and support. Is that even feasible for a product like theirs?

I've never used their product, I've only looked at their website and was extremely impressed. I remember their bullet points were around clean architecture, testing, performance, etc, all the stuff that engineers/devops folks care the most about, so they can avoid getting paged in the middle of the night to rolling reboot every node in their ${name-of-distributed-database with-scaling-issues} cluster.

But, unfortunately, it seems like if you depend on revenue that derives solely from training and support, you're best bet is to make a product that has:

* Awful documentation (hence the need for people to pay for training)

* Full of bugs and performance issues (hence the need for people to pay for support)

Since from the looks of it, RethinkDB was pretty much the polar opposite of this, it seems like they were essentially a victim of their own perfection.

I wonder if any RethinkDB users out there paid for support just to try to keep RethinkDB alive?

Also, I wonder why RethinkDB doesn't change their revenue model if it's not working for them?

<comment><USER3> They were trying to pivot to at least two additional revenue models during he last year, but it seems to have simply took too long (1. Custom closed code for enterprise customers, 2. Hosted Horizon). I have paid RethinkDB for support by the way, just to support them.

</comment></comment><comment><USER13> I think now is not a good time for open source. There is just too much advertising in the tech industry.

The advantage of open source used to be that it could help you to grow the user base of a product very quickly for free through only word of mouth. Open source is a low-margin, high volume industry.

These days, tech industry advertising is so strong/competitive that traditional 'word-of-mouth' marketing has become ineffective. I think open source products have a hard time reaching the kinds of volumes that they need to become profitable.

On the other hand, show me any open source project and I can quickly find a proprietary alternative which is not as good, costs a fortune but which thrives in this economy because they have received a ton of funding and are just spamming the internet with their ads.

</comment><comment><USER14> Why has this been marked dupe? What is it a dupe of - I don't see any other story on the front page about this?

<comment><USER15> [https://news.ycombinator.com/item?id=12630682](https://news.ycombinator.com/item?id=12630682)

</comment></comment><comment><USER16> There was another discussion on this, but it's dead for some reason...

[https://news.ycombinator.com/item?id=12630682](https://news.ycombinator.com/item?id=12630682)

TL;DR a lot of people think there's a secrete acquisition going on and they are doing code evaluation

</comment><comment><USER17> RethinkDB kicked (at least) 2 people from their Github organization involved in Horizon development. This tells me they plan to continue the organization in some way--probably under another company and not with Horizon at all.

Considering who these 2 people were and their contributions, it wouldn't make any sense for them to hurriedly remove them. (One was also a RethinkDB developer). That is, if the "continuity plan" were just gifting it to the community.

It's all speculation but I think it paints a clear picture. I have been doing a pulse check on RethinkDB / Horizon for a while so I've been watching this pretty closely.

<comment><USER18> So what are you saying?

</comment></comment><comment><USER19> Oh no! Hope everything ends up OK. RethinkDB is so fun to use. Would it be normal for development to slow when an acquisition is happening?

<comment><USER20> Yes, that would be normal. During an acquisition the future is unknown so you don't have a reliable roadmap you can use to set or update development goals. Other activities that take away from development could be developers working on capability demonstration or participating in technical due diligence.

(I don't know anything about the rethinkdb situation, I'm just speaking generally here)

</comment></comment><comment><USER21> Founder of a (non YC) database company here.

Founding companies are hard, databases are really hard, and we're in the middle of a shakeout in the database industry. At Aerospike, we really, really focused on paying customers early. We gathered a huge number of the "big boys" in advertising ( who need ridiculous speed & uptime in a key-value system ) and have leveraged that into lots of enterprise use cases ( telecom, payment fraud, transaction processing ), which has kept us of interest to the investment community and allows us to fund all that we do.

The database problem is a _big problem_ requiring a lot of investment. I heard that very explictly from some VCs when I was first raising ( you're a fool if you think you need a $5 seed round, and we don't fund fools, essentially :-) ), and the drip-by-drip VC cycle then requires extraordinarily disciplined product / feature analysis. I get a lot of requests for more types of indexes, more types of notification, and we need to pick and choose the priority carefully. We want to - and hopefully will - get a chance to build everything eventually, but also need to answer the question "why should I use this instead of a familiar tech like Mongo or MySQL or Postgres", and "follow the leader" product planning is a classic fail.

Open source of course has to be part of the equation. Aerospike went open source late, about 2014, and I still wonder what would have happened if we open sourced earlier. Our core big customers need a supported product, but we've lagged, and I know Rethink's better DBEngines ranking comes from both more features and earlier open source. Open source is also driving prices down across the board - a $250M / year oracle deal, converted to EnterpriseDB or MariaDB, turns into a $2.5M deal. Further - for instructure, open source is the only escrow you can trust. The business model question is complex, and creates mistakes if you think the opportunity size is 100x the true size.

Anyway - I'm sad to hear of this change at Rethink, I remember when they were on Dana St and we were on Castro around the corner, both focused on and coding for Flash and building the best databases in the world. My best wishes to the team, and anyone who is interested can reach out to me directly.

</comment><comment><USER22> This discussion has no duplicate, so why is it marked as dupe??

</comment><comment><USER23> Pick two:

1\. Valuable product maintained by professionals 2\. Is free 3\. Will be around for a long time

Yes, I know there are exceptions.

<comment><USER24> Huh. Apache, nginx, php, js, python, Linux, chromium, asterisk, openvpn... list is very very long. Actually I doubt there is more proprietary software that is widely accepted and reliable, than open-source (or even free) software with same achievements.

<comment><USER25> "Valuable product maintained by professionals" doesn't equal "proprietary". _All_ those products you list have people paid to work on them.

Open Source doesn't work in the long term without sponsorship of some sort.

<comment><USER24> You want to say these products are not valuable or not maintaned by professionals? They are making money around their projects same as RethinkDB did, so I don't understand what difference you want to underline.

</comment></comment></comment></comment><comment><USER13> I hope that RethinkDB (the company) gets acquired. I think the main hurdle for them is that their product is open source.

Unfortunately a lot of large old-school software companies believe that there is no IP (no sense of ownership) when it comes to open source - This is not true however. Open source companies still 'own' the code repos, the documentation website, the team, the chat boards, the domain names, the package manager registries, Docker registries, etc... What is more valuable; the source code or everything else?

</comment><comment><USER26> Well, at least it's open source, right guys ?

<comment><USER3> Yes and the source (that I've looked at) is high quality. That said, it's a very complicated program with no room for mistakes, and it is written in C++ so plenty of opportunities for memory/pointer issues. RethinkDB is very stable these days, unlike a year ago, and I think it could work well as a full open source project at this point (given the good code quality and docs). Absolutely critical to that would be relicensing everything under a much more liberal license than AGPL!!

</comment></comment><comment><USER27> Shit! We just started using RethinkDB. This is pretty scary.

<comment><USER28> We made the choice to use RethinkDB with my team exactly 1 hour ago, crazy.

<comment><USER29> cmon. thats just.....I don't know what to say

</comment></comment></comment><comment><USER30> Don't want to be accused of being a shill (I'm not, I'm just a fan), but if you're looking for potential alternatives to RethinkDB, Couchbase (the company that was formed when the MemcacheD and CouchDB folks joined forces) offer a totally open source realtime-sync API/SDK (cross-platform: mobile, web, you name it).

Link: [http://www.couchbase.com/nosql-databases/couchbase- mobile](http://www.couchbase.com/nosql-databases/couchbase-mobile)

<comment><USER31> The deal-breaker for me with couchbase is that the community edition lags (in terms of bug fixes, security updates, etc) 8-10 months behind their commercially licensed offering.

<comment><USER32> Arun from Couchbase, few points ...

1 - Unabashedly, our #1 commitment is to our customers who are relying on Couchbase for their mission critical applications. That's why the Couchbase Enterprise Edition gets the bulk of our attention and testing.

2 - History can show that's it's actually more like 3-6 months of delay rather that 8-10 and corresponds more to our release cycles than to an artificially imposed delay.

3 - Couchbase major releases has always had CE and EE in sync.

4 - Couchbase CE is provided as a service to the community. Users who want to rely upon their own expertise to run a database in production have a responsibility to themselves and their organization to have the appropriate level of skills to do so. That should mean being able to debug and fix bugs themselves. In fact, our open source code base does not lag AT ALL and anyone is welcome to build off of that themselves and get all of the latest and greatest features (and bugs of course). If they're not willing to do this, they should be paying us to.

<comment><USER33> 3 is not quite true. tried deploying CE at scale at my last company, ran into a gnarly limit on concurrent connections the db cluster would handle. It was a hard coded, undocumented limit on the CE version.

not sure if this still exists. but it took some digging into the source, and monkey patching to fix.

<comment><USER34> Hod @ Couchbase here. EE would have had the same limits. If this is the limit I'm thinking of, it's there for a reason (defensive against malfunctioning implementations, and very rarely something that should be exceeded). It was increased at some point (not sure when). But CE is not crippled relative to EE.

</comment></comment></comment></comment></comment><comment><USER35> I had just been evaluating Horizon for a new project using React. It looked very promising but we decided to use Firebase instead, in spite of Firebase being closed source and subject to vendor lock in. We simply couldn't justify forgoing the built in deployment and additional features of Firebase when we are on such a tight time and money budget.

I hope there is a good outcome for Horizon and RethinkDB, they both seemed excellent technologies and it'd be sad to see them languish.

</comment><comment><USER36> Previous discussion [https://news.ycombinator.com/item?id=12630682](https://news.ycombinator.com/item?id=12630682)

</comment><comment><USER37> "Slava @ Rethink here. Unfortunately I cannot comment yet (I really wish I could), but your intuition is right. We're working hard to be able to give a full account ASAP (matter of days). Please stay tuned."

[https://discuss.horizon.io/t/are-rethink-and-horizon-dead- ab...](https://discuss.horizon.io/t/are-rethink-and-horizon-dead- abandoned/619/7)

That doesn't sound promising :/

</comment><comment><USER38> This is the sort of thing that needs to live in a bigger company that wants a quality database product to round out its product offering.

</comment><comment><USER39> Really why popular opensource from companies controlled by that company is a bad idea if noone is really interested in carrying it forward.

How many frameworks/languages/tools would survive if their parent company disappeared?

I know IO.js was successful when diverging from nodejs (even if they ended up merging again).

</comment><comment><USER40> I'd be pretty sad if they abandon it. I have used and use it in many projects.

</comment><comment><USER33> perhaps [https://www.pipelinedb.com/](https://www.pipelinedb.com/) can be an alternative as well.

It's not that we are super set on using RethinkDB, but love ReQL! Going back to SQL just seems a huge step back at this point.

</comment><comment><USER41> So what alternatives are there to Rethink? Not excited about Mongo.

Or is mongo no longer crap for consistency?

</comment><comment><USER42> RethinkDB was closest thing I knew to SecDB. I used to love SecDB when I was using it.

[http://www.wsj.com/articles/understanding-secdb-goldman- sach...](http://www.wsj.com/articles/understanding-secdb-goldman-sachss-most- valued-trading-weapon-1473242401)

</comment><comment><USER43> IBM's compose supports rethinkDB. Will they continue to support?</comment>


9 European Countries to Build North Sea "Supergrid" for Offshore Wind Power - <AUTHOR> http://www.treehugger.com/files/2009/12/north-sea-supergrid-offshore-wind-power-europe.php

<comment><USER2> From your link (Mapleoin); _Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting NEW phenomenon._

The green energy topic is 100% political and it is not a NEW phenomenon. It is a push point for the Democratic Party in the United States and the opposing party is actively campaigning against it every day for months on end. It is one of the main contention points between the parties.

It seems as off topic to me as if someone were continually posting articles about how Sarah Palins choice of handbag and dresses affect her media coverage and saying it is posted because it might satisfy _someone's intellectual curiosity_.

A single post by a poster on a non IT topic in the forum might be viewed as possibly satisfying one's intellectual curiosity, but if you look at the posters history you will see a distinct pattern focusing on this one political hot button issue. So since it is political and is not a NEW phenomenon it seems it falls under an Off-Topic Political post.

If it were an article regarding the code to do whatever for the wind power station, or IT hiring patterns in the green industry that would seem on topic.

</comment><comment><USER2> To the Moderator: I am simply stating a fact. The facts are what they are down voting me to zero is not going to change the fact that the post is off topic. If you want to allow green posts in the forum then change the Off-Topic rule to include the following: _except green energy topics_.

Personally I do not care one way or the other if the green energy topics are in the forum, but according to the rules, it is Off-Topic.

I would suggest to save both of our times you might want to make an adjustment to the wording of the Off-Topic paragraph to read; Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting NEW phenomenon _or green energy topics_.

Having one standard in writing and another in practice by down voting me to zero leads to a pointless waste of time on both of our parts.

</comment><comment><USER3> Headline: "Pledge to Build" Actual language: "examine the construction of"

It's not as momentous as the article makes it out to be.

</comment><comment><USER2> Mike, why so many posts about wind power and green energy in an IT forum? I have looked over your post history and you post some good IT stuff so I know it's not a spam effort. We are an IT forum, it is just off topic here, and I was wondering. That's all.

<comment><USER4> HackerNews isn't an IT forum, read more here: <http://ycombinator.com/newsguidelines.html>

</comment></comment><comment><USER5> Lets not destroy the sea bed for minimal cost & energy gains. Especially in one of the most fertile and last remaining wildlife areas of Europe. Plenty of studies point out the negative effects the vibration of wind turbines has on fish.

<comment><USER6> "Plenty of studies point out the negative effects the vibration of wind turbines has on fish."

URL? I live in an area where they are considering sea-going wind turbines and the 'anti-wind' group has mostly consisted of wealthy waterfront property owners with well funded 'studies' that don't hold up to scrutiny. Would love to see legit evidence for either side.</comment></comment>


Guy strips at PDX airport, court rules not guilty, TSA still wants to punish him - <AUTHOR> http://www.kgw.com/news/Naked-fliers-attorneys-ask-for-acquittal-162908166.html

<comment><USER2> >But things aren't over for Brennan yet. The TSA is also investigating him to see if he possibly interfered with the screening process. If found guilty, he could be forced to pay an $11,000 fine _and be put on the no-fly list._ [italic mine]

Wow. What a country.</comment>


Snow Reports: One app written. Deployed to iPhone, Android, webOS - <AUTHOR> http://ajaxian.com/archives/snow-reports-one-app-written-deployed-to-iphone-android-webos

<comment><USER2> This may be a goof thread to discuss phonegap.

So I compiled and installed the Snow Reports on my iPhone 2g. Few things immediately noticeable:

1\. There are no animations transitioning from one screen to next. Jarring.

2\. The back button is in non-standard place

3\. When a button is pressed only part of its face becomes dark. The result is that the button looks torn.

4\. There is about 1.1 second lag when pressing "Weather" button.

5\. There is an occasional ~200ms lag when pressing any button, but it's not always there.

6\. The inertial scrolling is slower than the native one, so the initial screen feel sluggish.

In light of this I would like to raise a question - will phonegap/webkit ever rise to the level of smoothness of native apps? Inquiring minds want to know!</comment>


High Sierra's 'Secure Kernel Extension Loading' Is Broken - <AUTHOR> https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/ <comment><USER2> _> Of course if Apple's ultimate goal is simply to continue to wrestle control of the system away from it users, under the guise of 'security', I'm not sure any of this even matters_

I disagree with this conclusion. All of these features are turnoffable by booting into the recovery system which is available on all macs.

So people who want or need to constantly run unsigned code and load unsigned kernel extensions, they certainly can.

But people who can live with the system protected binaries in the state the Apple shipped them (which is probably the majority of the users) can relax, knowing that (minus issues like the one reported here) malware will have a much harder time to run, much less hide itself.

As long as I can right-click and "open" any binary and as long as I know that I can load unsigned kexts if I really need do, I really don't see a huge issue with this.

<comment><USER3> That the user can turn off these features by booting into safe mode is beside the point...users can't be expected to do that when installing an app.

Imagine the drop-off rate in your funnel if one of your steps was "boot into safe mode and run these special commands to turn off SIP". Apps that need kernel extensions are rare, but the ones that do aren't just niche developer apps. The office worker running VMWare Fusion to run an old Windows program or any Dropbox user with the Smart Sync feature are all semi-technical audiences that need kernel extensions for their programs to work.

IMHO, the end game for this is that Apple will continue to lock down what apps can do until they have the same level of control on Mac that they do on iOS.

<comment><USER4> The much more plausible hypothesis is that Apple doesn't care about the Mac app store because they realize it's failed.

The users that can't be expected to boot into recovery mode are the users who shouldn't be loading kernel extensions. Making the system relatively safe by default, with obnoxious ways of subverting those protections for people who (unlike me) want the option of a foot-gun seems like a good balancing act.

<comment><USER5> I prefer to get all my software, and games, from the Mac App Store if possible. Every time I use a new Mac I'm always glad for the immense convenience; just go into my Purchased items list and click Install on each of the apps I want there, knowing they'll be fully updated and relatively secure compared to downloading from the app's website (see the Transmission ransomware fiasco.)

I just wish Apple brought it into feature-parity with the iOS App Store.

</comment></comment></comment></comment><comment><USER6> So glad I read to the end of an overly wordy post just to find:

> can't release technical details at this time

Then what was the point of the very long post? To grandstand?

<comment><USER7> I assume he'll publish the details after Apple has fixed it.

<comment><USER6> If I understand the situation right, we are no less secure than before High Sierra, just not "more secure" as Apple intended. As such, the obscurity doesn't buy anything imho.

</comment></comment></comment><comment><USER8> The post was from 16 days ago right? Did Apple fix it?

</comment><comment><AUTHOR> Possibly related to this?: [https://news.ycombinator.com/item?id=15329527#15330589](https://news.ycombinator.com/item?id=15329527#15330589)</comment>


Is it possible to distribute a database publicly? - <AUTHOR> As a pastime project, I have decided to work on practical way to verify the authenticity of digital data (derived from https://www.anf.es/pdf/Haber_Stornetta.pdf). I have decided to use git(http://blog.sysbase.org/the-blockchain-question/) as a mean for keeping all records up to date. However, I still have doubts about git's feasibility.
Is there a way to distribute an SQL database--for example--publicly and yet keep all versions up to date(asynchronously), similar to blockchain yet different?
I am aware of the existence of mirroring and replication, but it will require authorization. That wont do it, especially if my goal is to give access to anyone who wants it. <comment><USER2> Look into SQLite ([https://www.sqlite.org/](https://www.sqlite.org/)). It is an SQL database in a single file.

The single file is easy to distribute publicly.

You will, however, have to layer your own method of keeping all copies up to date on top of SQLite. It does not have that capability built in.

<comment><AUTHOR> Thanks, I'll look into it.

</comment></comment><comment><USER3> You probably could publish the logs used to make all changes, then anybody could download them and apply them to their copy of the database. Combine this with regular published snapshots (so that people that start new only have to apply all logs that came later).</comment>


Crowd Sourcing Sucked, So I Put Instagram API to Work Instead - <AUTHOR> http://shaharsol.com/2012/09/27/crowd-sourcing-sucked-so-i-put-instagram-api-to-work-instead/ <comment><USER2> It could also be that surfers don't want to share the great conditions with others so they can enjoy them without the congestion?

</comment><comment><USER3> I'm glad to see someone trying this. I very (very) casually explored this same idea recently by just browsing the search features of Instagram and Flickr. The results weren't very promising so I concluded it probably wasn't worth investing further effort in the API. Looking at the Huntington Beach results for this morning on the swellphone website, I don't see a lot that would interest surfers:

[http://swellphone.com/spot/surf- spot/usa/california/huntingt...](http://swellphone.com/spot/surf- spot/usa/california/huntington-beach)

And I would expect that to be one of the more popular spots.

When I was in school at UCSD years ago, I found scraping NOAA buoy data and loosely correlating it with personal experience was a good enough predictor as to whether it was worth the walk down to Blacks. But this is what surfline.com does at scale.

Incidentally, anyone know what happened to the site surfshot.com? I believe their model was just to send a couple photographers down the San Diego coast each morning and post pictures. Site has been around for years and worked well enough, I thought, but it hasn't updated since July.

</comment><comment><USER4> Your story proves that sometimes you have to find a bigger crowd and/or a different approach, not that crowd sourcing sucks.

Either way, nice work!

</comment><comment><USER5> Very cool usage. What is your next step? As you said, most but not all pictures have pictures of the water. Have you thought about using CV to detect water in the background as the next possible iteration to remove pictures that do not show conditions.

<comment><AUTHOR> I thought about it, however it will make things more complicated. Currently I get the pics unfiltered from Instagram. If I need further processing, I need to process each image and cache the results, then compare the feed per spot for the next request for the same spot etc. It's not that it's not doable though.

</comment></comment><comment><USER6> I hate to say it, but this "solution" doesn't work. It was a good idea worth testing, but it's just not useful.

I'm not a surfer, but if surfers are dying for this kind of info, wouldn't they be willing to pay a subscription fee for access to an up-to-date surf report?

These days with TaskRabbit.com, you can hire someone to go take pictures at multiple times throughout the day. Let's say you can get your costs down to $25/day, which is about $750/month per surf "spot".

You would need to get 38 surfers paying $19.95 per month to break even. How many surfers do you think would be interested in this per location?

<comment><USER7> Why take just a picture? Have the guy take a video panning the entire ocean for 15? 30? seconds and then allow surfers to view video. Capture some random images of the video for people who don't want to look at video.

<comment><AUTHOR> I agree that video is a better way to communicate the surfing conditions. This is why I added Youtube videos as well to the SwellPhone feed. However, Youtube seems to have far less geo tagged UGC media than Instagram.

</comment></comment></comment><comment><USER8> I started surfing about a year ago and I initially thought of the crowd sourced conditions app but I realized that people hate giving that info away and that friends form SMS based surf checking networks that serve the same purpose.

I really like this approach and could see it working at popular, touristy spots, clever idea.

</comment><comment><USER9> Not sure I am a fan of the geo targeted default. Wish I could see my default to Hawaii North shore. Also would be nice if I could click on the images and link to the instragram post. Dig the concept and the site. Well executed.

<comment><AUTHOR> In the mobile app version there's an "Add to Favorites" functionality and a "Favorites" tab. You can add Pipeline and other North Shore as favorites and easily follow them. That's missing from the website though.

</comment></comment><comment><USER10> Nice creative solution. I looked through the website and found a couple spots with no photos - it might be worth putting a note saying 'no photos found', I reloaded the page because it just looked like it hadn't loaded an element.

</comment><comment><USER11> Why isn't Singapore[1] in the list of countries on swellphone.com?

[1]<http://en.wikipedia.org/wiki/Singapore>

</comment><comment><USER12> Very cool. I tried to do something similar with FB checkins but for Snow Reports. Same problem. Using instagram to source the reports is an smart detour.

</comment><comment><USER13> That's a really clever solution! A side benefit is you also get to leave the reporting method and report hosting to Instagram

</comment><comment><USER14> Might want to fix the spelling mistake on the first line on your site. Otherwise, cool out-of-the-box idea.

<comment><AUTHOR> Fixed! Thanks!

</comment></comment><comment><USER15> Congrats on coming up with a really clever way to approach crowdsourcing!</comment>


Ask HN: What best practices for in-house Docker Registry? - <AUTHOR> Hello,
I am using Gitlab EE at work and have noticed recently that we had some issues with our registry validation process.
I was specifically wondering how to handle the history associated with any given tag. I realize that in our Gitlab registry, we have4 tags which have specificity. However we don't have the source branches for these, hence we don't exactly know what these specificities are.
Are there any best practices in this particular area? What is your experience with such issues? <comment><USER2> At Kiwi.com what we do is we add tons of labels when building the images:

        --label build-date=`date -Iseconds`
        --label vcs-url=$CI_PROJECT_URL
        --label version=git-$CI_COMMIT_SHA
        --label com.kiwi.gitlab.ci.builder=$GITLAB_USER_EMAIL
        --label com.kiwi.gitlab.ci.pipeline=$CI_PROJECT_URL/pipelines/$CI_PIPELINE_ID
        --label com.kiwi.gitlab.ci.ref=$CI_COMMIT_REF_NAME
        --label com.kiwi.gitlab.ci.build=$CI_PROJECT_URL/builds/$CI_JOB_ID

Also, all images that get to prod are commit hash tagged, but for development we also tag them with the branch name:

        --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
        --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG

<comment><USER3> This is a great idea! We put a BUILDINFO.txt in the the container that carries all this information(and more).

This is a history thing, we have stuff in production not in docker, and we use this approach with all the non-docker stuff and just carried it into docker. But I'm going to go add the data as labels to the image now as well!

<comment><USER2> What's really great about these labels is that they show up in Rancher's web UI, too, so when managing stacks, all the URLs and information are right there.

</comment></comment></comment><comment><USER4> What I've done before is use branch-buildID (develop-009) for tags, and then add detailed information like the git commit sha, git version tags, as labels. All of these labels were passed in as build args to Docker from the CI/CD system. One other important thing to consider is if you have docker tags that can be overwritten, which is the default in most repos, in the docker file it is useful to specify FROM sha256 checksum instead of labels for reproducible builds.</comment>


Goodbye from Linux Action News - <AUTHOR> https://linuxactionnews.com/153 <comment><AUTHOR> One of my favorite podcasts just gone like that. Anyone knows the backstory with acloudguru?</comment>


Ask HN: Why don't all websites allow sign-ins with temp code sent to mobile - <AUTHOR> <comment><USER2> I agree with the other commenter that noted that SMS isn't secure, but passwordless login is a growing trend, I think.

[https://auth0.com/docs/connections/passwordless/faq](https://auth0.com/docs/connections/passwordless/faq)

[https://www.okta.com/security-blog/2018/04/is- passwordless-a...](https://www.okta.com/security-blog/2018/04/is-passwordless- authentication-actually-secure/)

Granted those companies might be a bit biased (they both sell a passwordless plug-and-play solution), but considering that the password reset flow does have the same vulnerabilities I think they have a valid point, regardless of bias.

</comment><comment><USER3> If you mean SMS, it's not secure.</comment>


Reed Hastings Responds to Whitney Tilson: Cover Your Short Position. Now. - <AUTHOR> http://news.google.com/news/url?sa=t&ct2=us%2F0_2_g_2_0_t&bvm=section&usg=AFQjCNHJKb2WEAsY5RERqnr3-9M28cloLg&sig2=PG8CMV6cfPSaJ7AAuBQHEg&cid=8797632662365&ei=zyAUTbDpK4jK9AShzdWNAw&rt=HOMEPAGE&vm=STANDARD&url=http%3A%2F%2Fseekingalpha.com%2Farticle%2F242653-netflix-ceo-reed-hastings-responds-to-whitney-tilson-cover-your-short-position-now

<comment><AUTHOR> An incredibly in-depth analysis of Netflix from the man himself... this is what a top CEO thinks like.</comment>


The state of debugging microservices on Kubernetes - <AUTHOR> https://radu-matei.com/blog/state-of-debugging-microservices-on-k8s/ <comment> radu-matei Hello, everyone, I am the author of the article and I'd be happy to discuss about it. Here'some context:

During KubeCon EU I discussed with as many developers as possible, trying to understand how people debug their applications on Kubernetes.

As expected, most responses varied from: "I iterate on my application locally, then deploy it again in the cluster" to "I add a bunch of print statements, re-deploy it, then make changes, then re-deploy again".

The article takes a look at the current way debugging is done, some popular open-source technologies for debugging microservices and peeks at an early preview on how the VS Code Kubernetes extension performs remote debugging.

Then, the article examines the really awesome features coming to Kubernetes 1.10 and 1.11 that will significantly simplify the setup needed to debug apps (specifically shared PID namespace and debug containers).

How do you debug Kubernetes apps, what tools do you use and what would you like to see in a tool developed for debugging microservices?

Thanks for reading, and feedback is always welcome :)</comment>


How a Norwegian comment section turned chaos into order–with a simple quiz - <AUTHOR> https://arstechnica.com/gaming/2018/03/how-a-norwegian-comment-section-turned-chaos-into-order-with-a-simple-quiz/ <comment><USER2> From the comment section to the article:

"The whole point of this is increasing the barrier to entry. For legit readers, the barrier is low: it's asking questions about the article they just read. For trolls, the barrier is much higher, they have to go back and read the article. So, while not perfect, is a pretty clever solution to making it much harder for the undesirables than it is for your regular readers."

</comment><comment><USER3> TL;DR Comment permission is granted after solving a quiz about article content.

The statement related to how NRKbeta isn't sure how ad-hoc quiz questions are best constructed, was vague.</comment>


France Open-Sources Its Income Tax Levy Sofware - <AUTHOR> https://github.com/GouvernementFR/calculette-impots-m-source-code <comment><USER2> more details here [https://www.etalab.gouv.fr/codeimpot-un-hackathon-autour- de-...](https://www.etalab.gouv.fr/codeimpot-un-hackathon-autour-de- louverture-du-code-source-du-calculateur-impots) and [http://www.modernisation.gouv.fr/ladministration-change- avec...](http://www.modernisation.gouv.fr/ladministration-change-avec-le- numerique/par-louverture-des-donnees-dans-les-administrations/openfisca- moteur-micro-simulation-fiscale-sociale)

The M language can be converted to Python via code from OpenFisca [https://forum.openfisca.fr/t/acceder-au-code-source-de-la- ca...](https://forum.openfisca.fr/t/acceder-au-code-source-de-la-calculette- impots/37)

</comment><comment><USER3> Which programming language are they using?

<comment><USER2> Language M, DSL from the French Tax Office you have a parser (in python) here [https://git.framasoft.org/openfisca/calculette-impots-m- lang...](https://git.framasoft.org/openfisca/calculette-impots-m-language- parser)</comment></comment>