Business networking for nerds (2017) - <AUTHOR> http://benjaminreinhardt.com/networking-for-nerds/ <comment><USER2> I've recently returned to professional programming after working in another profession for 10 years. My former profession (let's call it "medical transcription" for the sake of my anonymity) is a dying profession, and is being replaced by a combination of technology and global outsourcing.

Now, with relatively few exceptions, the only people who can actually make a good living at medical transcription are the master networkers and salespeople. And even though they present themselves as being "successful" at making a good living at medical transcription, what they really are making money doing is selling courses and books to people who want to get into the (dying) profession. Of course, they never mention to those people that it's increasingly difficult to make a decent living at medical transcription.

This isn't the first time I've watched social butterfly networkers and salespeople take advantage of people and engage in ethically dubious conduct, so I have a bad taste in my mouth regarding networking. I'm also an introvert, so I'm naturally very bad at networking.

That said, I also realize that I could be doing much better financially and professionally if I had a strong network of friends and colleagues, particularly as I'm starting at a new profession in my 40s.

It's frustrating.

EDIT: Changed a few sentences to make it clearer that the dying profession I'm referring to isn't programming.

<comment><USER3> I have not had the same experience as you have. Maybe it depends on the city? In the Bay Area hardcore engineering is still in enormous demand. I had expected automation and the cloud to reduce the demand for engineers, but it's actually increased the demand for engineers familiar with cloud technologies.

<comment><USER2> I was unclear. The profession I'm talking about is not related to engineering. However, I don't want to be more specific because the profession in question is fairly unusual and I don't wish to identify myself.

</comment></comment></comment><comment><USER4> Think of how much society is set back because people who have no interest or ability with "networking" aren't given the opportunities that they should have had. Instead, we end up with the most socially aggressive / self promoting running practically everything (badly).

<comment><USER5> If you call it 'networking' it sounds bad.

If you call it 'getting out there and speaking to people, listening to what their problems, hopes, opinions are, and sharing the same yourself and making a connection to see if you can mutually help each other' then it suddenly sounds like a better thing, doesn't it?

<comment><USER6> Networking isn't talking to people about important things. It's talking to people with the specific goal of moving your career forward. That's what makes chronic networkers insufferable, and those people give networking a bad rap.

<comment><USER7> I network _all the damn time_. I talk to people. I get lunch with new people who I don't know (there's a standing invite in my HN profile for a reason). I don't have some Specific Goal of Moving My Career Forward. I like people, I like meeting people, I like learning about them, and in the future maybe I'll do them a solid or they'll do me one.

It pays off, though. And it's fun.

But I have never started a conversation (at least, not with somebody I didn't already know well, like my boss) with the Specific Goal of Moving My Career Forward.

If that's what you think networking is, you're missing out.

<comment><USER8> Small note on that one: you probably want to include an e-mail in your about field.

I have and don't receive much spam.

<comment><USER7> No? Good to know. I'll do that. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER9> Maybe I've been going to the wrong events, but I've never gone to a networking event where I made a contact with whom I ever had contact for a third time. Extremely rarely would I have contact for a second time. Well... no, sometimes I'd see them at additional networking events.

I've stopped going to networking events to network. Usually, I won't go if the sole focus is networking. If there's another purpose that's the primary purpose, I might go, depending on what that is.

</comment><comment><USER10> Edison, EINSTEIN, and Musk?? You think that "general relativity project" would never have gotten off the ground without some solid networking skills by Al? Or developing quantum theory from a Swiss patent office? Maybe go with Edison Jobs and Musk instead.

<comment><USER11> Actually Einstein was great at reaching out to others in the field and discussing ideas with them. He also voraciously applied to various programs to find great places to work.

He's no Edison in terms of networking, but it is interesting that even a cononical super-nerd creating theories in their basement (or patent-office) still gets value out of it.

<comment><USER12> This. The entire progress of science happened because illuminaries and savants started sharing their discoveries and discussing them in groups. There was an enormous amount of individual work involved as well, of course, which was the main element, but without the networking part to vet and discuss the result science would really not have happened.

</comment></comment></comment><comment><USER13> Misread as 'Networking for Hackers' and thought finally going to learn more about networking.

<comment><USER14> Me too. I know I'm a nerd now...

</comment></comment><comment><USER15> I'm one of those people who hug their glass of water, finds a cozy (i.e. devoid of people) corner, and pretends something is very important in their phone. The few contacts I had from those events were never helpful, and I'm not a kind of person to keep an Excel and reach out to people on schedule pretending I care. (I understand there are people who do care, I'm just not this type.)

I found the best way for me to meet new people is... smoking a pipe. It's a greatly enjoyable hobby by itself, and it always draws people at least to comment on the smell or ask me something like "hey, where do you get this stuff?" (I'm in China and naked tobacco is illegal here... go figure). Once the ice is broken, I feel much better about having a conversation. It also helps that most people who are interested in the pipe are somewhat relatable.

</comment><comment><USER16> I've found the biggest issue for me to be finding places _to_ network. I'm currently an educator (want to shift careers) and don't live in a city, which means my options are limited. I love going out and meeting new people and learning about them, though, so I wish I could find a place to do this.

</comment><comment><USER17> This was very reasonable and well written.

'Keep it short and sweet' or 'minimize friction' if I were to summarize it.

I don't know that there are excellent ideas with solid execution that go to the graveyard, because nerds just couldn't network their way to the top however.

There has never been a better time for intelligent, hard working people to see their ideas come to fruition. There is all sorts of infrastructure in place to help you - schools, loans, accelerator programs like Y Combinator, the internet!

While I don't want to minimize the value of having social skills for your relationships with your loved ones if nothing else - it is important to know who are and bet on your strengths, there's plenty of infrastructure to fill in the gaps.

</comment><comment><USER18> I'm not sure how I feel about networking but I really like the part about meeting arrangement (Pre-Meeting Motions). It's amazing how drawn-out meeting scheduling can get if you are not proactively concrete about it. I don't usually do calendar invites, though, and that is actually a good idea. I had it happen when we agreed on a date and time, but then they thought it was a different day of the week for some reason.

</comment><comment><USER19> Although I know many people hate the book, but Keith Ferrazzi's "Never Eat Alone" is well worth reading - both for the practical tips, but also for the _attitude_ one should adopt while networking (the more you care about others, the more they are likely to help you).

</comment><comment><USER20> Are there any other sites/blogs that talk about professional communication like this? I found this very clear and helpful, while a lot of other sites I've read are either overly generic or focus on what not to do.

</comment><comment><USER21> When meeting someone at at an event or conference, what is the best way to exchange details? Does one need a business card, or do we just give a Twitter/Facebook id, or a email address or phone number etc?

</comment><comment><USER22> The article seems to miss the key way to succeed at networking: help as many people as you can before asking for help.

</comment><comment><USER23> I liked the "projection" thing. Seems very true and effective.

</comment><comment><USER24> "Do I need to bring a table or just my computer?"

She stared. "What?"

"I have a 21 inch monitor and I can bring a folding table," I said.

Still clearly confused, she asked, "Why would you bring a computer?"

Oh, that kind of networking party. "Never mind."

\- a true story from university

<comment><USER25> This hurts how relatable this is.

<comment><USER26> Yeah I was really hoping computer networking when I opened this and was sorely disappointed.

</comment></comment></comment><comment><USER27> Am I the only person who clicked the link hoping to read about the OSI 7 layer model?

<comment><USER28> This is the common sentiment in this thread lol, is there a canonical reference for the other type of Networking(osi) for Nerds HN?

<comment><USER27> The Wikipedia articles are very good in terms of detail, but I didn't find them accessible. I thought about writing some more accessible ones for non- tech people after a request from a colleague for something even a manager could understand!

</comment></comment></comment><comment><USER29> OOT but funny:

During uni time, a friend invited me and my other friend to a "networking event". Being computer science students, the two of us thought it's "computer networking". Heck, we just had Network 101 class the day before.

We asked the inviter, and he did confirm it (but smiled). When we reached there, I didn't see any computer stuff, but I saw grandparents, uncles and aunties (basically, people I wouldn't relate with computer). I thought, "Wow, this organizer really good at convincing computer illiterate people to learn about computer networks."

The first speaker showed up, enthusiastically greeting us out loud, "Good morning everyone!" (it was noon) and started talking about fulfilling your dreams and Ferraris.

My friend tricked us to a MLM event (we knew what MLM was, and not with a good reputation).

Cut story short, the inviter is no longer my friend.

</comment><comment><USER30> I can attest to to his point about having a "story"; I have many skillsets (across several fields) and I went in to pitch for a position I could do in my sleep, and did not get the job. The last comment made by the owner of the company was "what job would we put you in?" and I replied, "it doesn't matter I can do every job in your organization." (having done every job prior in a similar organization, and demonstrated as such!).

They literally didn't hire me, because they couldn't figure out where I fit in their organization. Never mind the qualifications; never mind the ability, or the direct experience. They simply boggled, at where they could put me.

And its been repeated over and over. They aren't hiring people, they are hiring cogs. People like me, break their tiny worldviews, and they simply can't handle it. Its fucking retarded.

I had one guy I emailed, reply back "Sorry we're picking someone more qualified; 20 minutes into the work day", to which I replied "be fucking serious. I used to do this in the first 10 minutes of my day. whats the real reason?" He replied back "we don't think we could keep you." i.e. cog for 20 years needed.

When I started my career, I got fired from three temp jobs, for suggesting ways I could automate their entire process, and instead of it taking months, I could do it in under a week.

The whole employment racket, is bloody retarded.

<comment><USER31> Not every place seeks the jack-of-all-trades types of people. It isn't necessarily because of any dehumanizing train of thought, but more likely because of a more pragmatic one: they might not have the company structure to support people with those profiles and give them room to grow, to contribute in ways that are both nourishing for the company's and the employee's goals.

I find myself often drained by the type of situation you mention encountering (although I seem tot lack the self-confidence you are pushing there), but a recent experience has allowed me to see that some structures might theoretically want my profile but practically not be ready to embrace it. In a way, the interviews you encountered might be at places that are more realistic with their own skills and needs.

I do wish you the best in trying to find the right fit.

<comment><USER32> What kind of job would you and the parent poster recommend jack-of-all-trades people who just want to get things done apply to? Sales in some environments is ideal for this but for introverts?

<comment><USER31> I've found that the umbrella term "DevOps" carries a lot more than what most people might realize, creating an interesting space to solve problems that are about logistics, technicalities, human behaviour, communication, planning and execution of projects, etc.

YMMV, but I find that any "good" engineer can learn to excel where the need is, provided the structure is there to support and encourage such behaviour (which is easier said than done, and most often what you will get to judge when interviewing).

</comment></comment></comment></comment><comment><USER33> Everything about networking is shady and discriminatory. Networking should be made illegal.

<comment><USER34> you will not pry my cisco switches from my cold dead hands

<comment><USER35> Juniper switches are the only ones for me

</comment></comment></comment><comment><USER36> Bad advice. Networking is a high cost low value activity. It's a pre-internet strategy for building trust in the absence of information about competency. Today anyone can find anyone they're looking for. Today on the internet there are many businesses and people who make money by amplifying others with new or novel things, or some value.

Just build things you care about and share your work online. Give it to the amplifiers and let them amplify. Good will come. In the internet age "networking" is for losers.

<comment><USER37> >Give it to the amplifiers ...

How are you supposed to meet these amplifiers then and get them to care about your work?

<comment><USER36> Email them. If it's interesting they'll amplify it. These people make their living be being "in the know" on all the great new stuff.</comment></comment></comment>


Hide My Ass VPN: It's Fun Until You Discover the Leaking - <AUTHOR> https://www.vpntesting.com/reviews/hidemyass/ <comment><USER2> From personal experience, HMA absolutely does not care about actual user privacy. They log events tied to your actual IP address, keep the logs indefinitely, and are perfectly happy to hand those logs over to other parties. This is pretty much the exact opposite of what a consumer VPN should do and I recommend everyone stay away from them. I'm now using PIA and have had mostly good experiences aside from the occasional server slowdown require a reconnect elsewhere.

<comment><AUTHOR> Totally agree.. PIA's speed is one of the worst!

However...

PIA has another problem. Test the setup file with VirusTotal and let me know what you will find :) Trust me, it's something you didn't want to know.

How long have you used it?

<comment><USER2> You're probably referring to this [1]. I've checked all the runtimes and never found any actual malware. Started using it years ago when I was traveling internationally and needed to get around various region blocks and restrictions.

[1] [https://www.privateinternetaccess.com/forum/discussion/25268...](https://www.privateinternetaccess.com/forum/discussion/25268/so- i-scanned-pia-manager-exe-with-virustotal-and-it-came-up-with-12-viruses)

<comment><AUTHOR> Yes, this one. the "false-positive".

I was a subscriber as well. For about 6 months. Even though it's incredibly cheap, I changed it due to a combination of all small defects like speed, 5 eyes location, engine problem and lack of double-hop. Although the last one would probably make the speed two times worse.

It also depends on how often you use it. If you say traveling, I guess it's not switched ON 24/7 , so the small things won't bother you as much.</comment></comment></comment></comment>


Ask HN: Is 1336 the vote limit for submissions? - <AUTHOR>

I noticed the 2 variations of the Hello Chrome<FF>, it's FF<Chrome> calling submission both had 1336 points. That it's 1 point less than 1337 makes me think it's no coincidence. <comment><USER2> Nope.

see this thread -- more than 4k points <http://news.ycombinator.com/item?id=3078128></comment>


Batsh – A language that compiles to Bash and Windows Batch - <AUTHOR> https://github.com/BYVoid/Batsh

<comment><USER2> What's the use of this project? A shell language bears the main purpose of enabling user to interact with the system including it, and thus the shell is platform specific at it's nature. A language may well be compiled to both Windows and POSIX shell languages, but what will happen when a feature or a program endemic to one of these systems is invoked within a shell script? Is there a complement in Windows land for, say, sed(1), awk(1), ls(1), cp(1)? If so, are these programs synonymous. What will happen when I invoke ls in my program, will it get translated to dir for windows?

Shell languages' primary purpose is invoking programs. Most important programs for shells are endemic to one platform or another, and thus translating only the shell language does not mean anything.</comment>


Fake Reservations Are Just an OpenTable Appetizer - <AUTHOR> https://medium.com/@nickkokonas/fake-reservations-are-just-an-ot-appetizer-e5b143fb751a <comment><USER2> Discussion of the related article on fake reservations: [https://news.ycombinator.com/item?id=16526749](https://news.ycombinator.com/item?id=16526749)</comment>


JS Paint has a new domain, jspaint.app - <AUTHOR> https://jspaint.app <comment><USER2> Oh, it even has the 10x zoom level easter egg (triggered by clicking one pixel below the 8x!).

What's not to like?

<comment><USER3> The implementation is fantastic.

Spoiler: It even comes with it's own "vaporwave" easter egg, triggered by the Konami code

<comment><USER4> the easter egg was amazing

</comment></comment></comment><comment><USER5> Is it just me, or does .app look great in the address bar? Feels more official and communicable than .io or .ai in my opinion.

<comment><USER6> Are you a Mac user? You might be used to seeing the ".app" suffix on your filesystem

</comment></comment><comment><USER7> Small problem: it doesn't show the shape of eraser on cursor.

</comment><comment><AUTHOR> More information at the old domain: [https://jspaint.ml](https://jspaint.ml)

</comment><comment><USER8> I'm still not sure if I'm sold on the .app tld. Maybe it's a non-issue though

[https://news.ycombinator.com/item?id=16967865](https://news.ycombinator.com/item?id=16967865)

</comment><comment><USER9> I wanted to share in Facebook Messenger and got this:

      The content you're trying to share includes a link that our security systems detected to be unsafe:
      jspaint.app

Is this a mistake?

<comment><AUTHOR> Definitely a mistake, and incredibly unlikely any human judgement was involved; jspaint is completely safe.

</comment></comment><comment><USER10> Dragging the tool box makes it into a window, but if I release it immediately, the title bar gets interleaved with the menubar buttons and I can't drag it anymore.

<comment><AUTHOR> Yup, it's a known issue: [https://github.com/1j01/jspaint/issues/113](https://github.com/1j01/jspaint/issues/113)

</comment></comment><comment><USER11> That is an excellent implementation; even on my mobile it seems to work perfectly. Great job!</comment>


How Virgin America Onboards New Users - <AUTHOR> http://www.useronboard.com/how-virginamerica-onboards-new-users/ <comment><USER2> Hi all! I'm the person who made this. If you have anything to say about it, or any questions perhaps for me, I will be checking this thread and responding.

</comment><comment><USER2> @RKoutnik Thank you for posting this!</comment>


Pragmatic physically based rendering: Intro - <AUTHOR> http://marcinignac.com/blog/pragmatic-pbr-intro/

<comment><USER2> For those like me who want to learn more in 10 minutes, this link appears to be decent: [https://www.marmoset.co/toolbag/learn/pbr- theory](https://www.marmoset.co/toolbag/learn/pbr-theory)

<comment><USER3> Marmoset's articles are a great intro. Probably the most accessible I've found.

If anyone wants to read a lot more, here's a collection of possibly a majority of the non-academic material to be found online: [https://interplayoflight.wordpress.com/2013/12/30/readings-o...](https://interplayoflight.wordpress.com/2013/12/30/readings- on-physically-based-rendering/)

</comment></comment><comment><USER4> If you're interested in this topic, you may want to check out the "Physically Based Rendering" book[1]. It's basically a college text book (and priced accordingly) but it walks through the steps to build a fully functional (and fairly performant) ray tracing engine in C++. As a bonus, the code is BSD licensed, and up on github[2].

It's been great to go through it so far; I'm re-writing the renderer in a different language to help with the learning, I can't recommend it enough.

[1][http://www.amazon.com/Physically-Based-Rendering-Second- Impl...](http://www.amazon.com/Physically-Based-Rendering-Second- Implementation/dp/0123750792/) [2] [https://github.com/mmp/pbrt-v2](https://github.com/mmp/pbrt-v2)

</comment><comment> bmir-alum-007 IIRC from reimplenting 1/2 of the OpenGL pipeline in C for a CS course, the early Phong and Gouraud shadings inevitably looked either plastic, matte or dull. Hair and skin were hard but have been mostly solved fairly okay at great computational expense. And there's lots of hacks for things like oranges (bump mapping -> surface normal tweaks) and then they're shader languages. Each surface material (wood (especially chatoyance), textured marble, dull cloth, broken cement, butterfly wings (structural color/schemochromes), conchoidal broken glass, irregular dirt, dead leaves, pearlescent automotive paint, oil slicks (thin-film interference), on and on) needs slightly and/or completely different hacks to pull off the "Hollywood" real-time smoke-and-mirrors, least CPU/GPU/memory intensive fakery to render a believable scene whereas actual Hollywood can throw massive resources offline, at their leisure to render a scene frame-by-frame.

Metal is extremely difficult to model because light travels oddly along crystalline and micro-fissure structures.

</comment><comment><USER5> John Carmack's "The Physics of Light and Rendering" goes over physically-based rendering and lots more: [https://www.youtube.com/watch?v=MG4QuTe8aUw](https://www.youtube.com/watch?v=MG4QuTe8aUw)

</comment><comment><USER6> This is really nice. I like the lighting model but also the attention to detail, e.g. scratches on the Chrome material. One thing, that might be specific to my renderer implementation - the specular reflection seems to be point sampled. Is this to do with a float texture limitation?</comment>


Ask HN: Google's cache of my website points to app7.storify.com, why? - <AUTHOR>

I had a website didtheyread.com which is currently down. For fun I checked google cache and it points to app7.storify.com, the top bar says this is google's cache of app7.storify.com -  http://webcache.googleusercontent.com/search?q=cache:efOOFqEZIA4J:didtheyread.com/+&cd=1&hl=en&ct=clnk&client=firefox-nightly<p>However, the original search link points correctly.
Info, hosted on linode, and uses cloudfare CDN. <comment><USER2> checking the domain didtheyread.com I get the cloudflare 404, saying the site is offline (the Linode site? If you're hosting there, can you access your hosting control panel?)

going to the live site link at the bottom of that page, gets the same page.

Earlier in March, Linode was compromised. There's a few articles around about the incident.

[http://www.theinquirer.net/inquirer/news/2156823/linode- comp...](http://www.theinquirer.net/inquirer/news/2156823/linode-compromised- bitcoins)

Good luck.

Did you build your site using storify.com ?

<comment><AUTHOR> My linode wasn't troubled then. And I didn't use storify anywhere. I was wondering whether cloudfare stored the cached version of my site somewhere with storify.</comment></comment>


Documentator - <AUTHOR> https://documentator.io <comment><AUTHOR> With Documentator, you'll never have to worry about assembling a document again. That's because Documentator helps you through the process from start to finish.</comment>


Launch HN: Xkit (YC S18) – OAuth infrastructure as a service - <AUTHOR> Hey HN,
I'm Trey, the founder of Xkit (https://xkit.co). Xkit helps developers build and maintain native integrations by turning OAuth for 25 of the most popular SaaS apps into a single API call that always returns fresh access tokens.
I went through YC two years ago in S18 (and some of you may have seen our launch) with Sparkswap, a trust-minimized bitcoin exchange. After a year and half of building that product and building up a small but loyal following, I made the hard decision to shut it down. The audience for a trust-minimized service like Sparkswap was too niche and the regulatory costs were too high. It felt like the only way to stay in that business would be to compromise on some of our core principles (e.g. go after gambling behavior, play regulatory games), so I decided to stop working in crypto and move to FinTech more broadly.
While doing customer discovery for a more traditional FinTech service, I encountered a pretty common request: integrations to the SaaS products my prospective customers were already using. As I was implementing OAuth with a slight variation for the 5th time, I realized I was re-writing code that thousands of other developers (probably including a bunch of people here) have already written (and debugged, and maintained).
So I stopped working on that FinTech service (for those keeping score at home, yes that's two pivots) and started building a tool to let you outsource the pain of authorizing 3rd party apps with a particular focus on OAuth. From my perspective, for an integration to really be native, it will probably be faster and easier to just write some code instead of fighting against a GUI. But my goal was to make sure that nearly every line of code you write is actually for your integration, not authorization boilerplate.
Two years and two pivots after I went through YC, I'm excited to share Xkit: the tool I wanted when I was building native integrations.
Xkit is really two things: 1) An end-user experience for viewing and connecting 3rd party apps, and 2) An API for retrieving always-fresh access tokens.
To make the first work, we establish a session with your user by piggy-backing on your existing authentication method (e.g. you send us their current JWT, and we validate it). From there, we can handle the OAuth dance: CSRF/state tokens, scope handling, callbacks, etc. For the end-user UI, we have a pre-built integration catalog to give your users an interface to browse your integrations, connect new ones, and repair broken ones. In fact, our integrations page (https://xkit.co/integrations) is just our pre-built catalog rendered directly on our Webflow site. If you want more control over the experience you can do that too: our xkit.js library has all the tools for you to quickly build your own catalog without having to dig into OAuth.
For the API, just call it with the ID of the user and the name of the service, and we return a non-expired access token. You can call it from any backend process: a cloud function/lambda, a microservice, or a monolithic server. This makes your integration code a lot simpler: one API call using one API key rather than storing, encrypting, and refreshing tokens. You can even get access tokens on the front-end if you have a valid user session, so if you're building a front-end only app you no longer have to even think about whether a specific provider implements PKCE (looking at you, Atlassian).
We already work with over 25 of the most popular SaaS apps (Intercom and Zendesk added just last week!) and setting each one up typically just involves plugging in your OAuth credentials.
Imagine you had a team at your company that were experts in all the weird (sometimes undocumented) ways that various providers extend the OAuth spec, and they built an internal service that does all that stuff The Right Way™, lets you move it out of your core applications, and still gives PM and Design flexibility on the integration experience. That's Xkit.
You can get a free dev account (up to 10 users) to try it out here: https://app.xkit.co/sign-up, and if you send me an email (trey@) telling me that you came from this post, I'll give you 50% off your first year of the Startup or Pro plans. Thanks for making it through the wall of text. Would love to hear what you think!
Trey <comment><USER3> I've been looking for this for a while -- love it.

a) is SalesForce integration in the queue? Our primary use case is syncing customer records

b) i presume since you store the tokens, there's massive vendor lock-in right? just wondering how we might be at the mercy of your team (e.g., if you got acquired, raised prices, etc)

I think you're onto something big! At first I thought this was Auth0-like, so I suppose something more obvious in the landing page copy might help (e.g., "Build integrations into your SaaS apps in minutes")

<comment><USER4> Pricing is an issue though. There is no tier for unfunded projects or the unfunded stage

<comment><AUTHOR> We have a Developer plan that's free up to 10 users. Our Startup tier ($50/month) is intended for early stage projects without significant funding.

If you have a project that can't afford our Startup tier for some reason, shoot me a note (trey@) and I'll see what I can do.

</comment></comment></comment><comment><USER5> So I have to trust your company with valid access tokens for all of my users. No thanks.

<comment><AUTHOR> That's an understandable position to take - these are sensitive pieces of information that provide a high degree of access.

We take the security side of this equation very seriously. All the tokens and credentials are encrypted (both at the database level and the field level) and access to keys and production systems themselves are tightly controlled. Our APIs are designed to prevent inadvertent leaking of credentials (e.g. it's impossible to retrieve client secrets from the front-end) and we have in place best practices to prevent things like XSS and CSRF.

But like many cloud providers, yes you have to trust us.

In the near future we'll work on some more public things (like a SOC 2) to make our specific policies easier to trust.

<comment><USER6> Please consider some sort of access log for all activity around the secrets you're managing, exposed to users in their account. Also consider a way to revoke all secrets/tokens at once with a privileged (MFA authorized) user action.

Best of luck, I think this product has a lot of value ahead based on the pain points addressed.

EDIT: This might also be of use before your SOC 2: [https://latacora.singles/2020/03/12/the-soc- starting.html](https://latacora.singles/2020/03/12/the-soc-starting.html)

<comment><AUTHOR> The access log is a great idea, we'll build that.

<comment><USER7> [Shameless plug] Happy to help you with that with WorkOS :)

Here's our HN launch: [https://news.ycombinator.com/item?id=22607402](https://news.ycombinator.com/item?id=22607402)

And some more info on the Audit Trail feature: [https://workos.com/features/audit-trail](https://workos.com/features/audit- trail)

</comment></comment></comment></comment></comment><comment><USER8> Maybe its just me but all I can see with your company is the tumblr extension xkit. [https://chrome.google.com/webstore/detail/new- xkit/inobicegh...](https://chrome.google.com/webstore/detail/new- xkit/inobiceghmpkaklcknpniboilbjmlald) But i'm sure you've already discovered this :p

<comment><AUTHOR> Yeah, Xkit is unfortunately also the name of a defunct Tumblr extension. We thought it was worth the (minor) collision.

Our github is [https://github.com/xkit-co](https://github.com/xkit-co)

<comment><USER9> Xkit is still actively maintained, albeit by a new team [1]. When I saw this, my first thought was "since when was Xkit a YC company," so definitely an unfortunate name collision.

[1]: [https://new-xkit-extension.tumblr.com](https://new-xkit- extension.tumblr.com)

</comment></comment></comment><comment><USER10> Congratulations on the launch! I'll probably end up being a customer as our product will integrate with multiple external services (Salesforce, Intercom, Calendly).

Now an off topic question: how did you stay motivated as a solo founder through 2 years and 2 pivots? Was it always just you, or did you have other co-founders that ended up leaving?

<comment><AUTHOR> That's great! We support Intercom, Salesforce is coming soon, and I can look into adding Calendly too.

Re: staying motivated.

I was always a solo founder.

I think for me it starts with experience. I co-founded a startup when I was just out of college, and the ups and downs and challenges with staying motivated were by far the most important thing that I learned. Since then, I worked at two different startups and different stages and saw them go through good times (acquisition) and bad times (layoffs). So I think those experiences helped me keep myself level.

I also have a good professional and personal network of mentors, colleagues, fellow startup founders, family, and friends. My support system has been really important in keeping me going. YC has helped tremendously with this part.

And finally, I personally feel a lot of responsibility to spend my investors' money wisely. A lot of people believed in me and took a chance on me, so I feel I need to uphold my end of the bargain.

Long answer, and the full answer would probably require an hourlong therapy session, but that's off the top of my head :)

</comment></comment><comment><USER11> I'd love to have some competition for Auth0 so this is good.

But, what I'd __love __is an Auth service that does what you do for Office365 accounts. For some reason, nobody does this and, at least in Auth0, you have to manually set up O365 as a custom OIDC provider.

<comment><AUTHOR> We don't exactly compete with Auth0. Their focus is on how you authenticate users, where we're trying to make it easy to add integrations to extend your product with data or functionality from other products.

There is some significant overlap, for example with OAuth tokens, but I'd say they work together more than they compete.

As for Office365: that's one of the integrations that's coming up soon for us. There are a lot of Microsoft Graph integrations that we'd like to add.

<comment><USER12> How would the access token sharing will work between Auth0 and XKit ?

<comment><AUTHOR> We have docs for it here: [https://docs.xkit.co/docs/auth0-authentication](https://docs.xkit.co/docs/auth0-authentication)

You can create a separate token specifically for Xkit or re-use an existing one.

</comment></comment></comment></comment><comment><USER13> If I'm not mistaken, OAuth 2 does not support multiple clients, but in this case the token authorized by a user ends up being known by 2 clients: Xkit, and Xkit's customer. What exactly is being shown in the consent screen the user accepts? Are users aware that they grant scopes to 2 distinct parties? Couldn't this be considered abuse by the SaaS Apps themselves?

<comment><AUTHOR> Xkit acts purely as an agent for our customers, we don't make use of the access granted ourselves (and as mentioned in another comment, we're happy to sign contracts to that effect). As a result, the consent screen and what users are aware of is the identity of the party they're granting access to - <USER2> Xkit customer, not Xkit itself.

As a side note, OAuth2 explicitly supports multiple clients and in fact recommends it if you are using the clients in different contexts. Google implements this pretty effectively imo.

</comment></comment><comment><USER14> great stuff. you do have a security problem, which you've acknowledged. so you won't get customers that actually are invested in security. fortunately, that's a scant few. you shouldn't waste efforts chasing them. just do the right [security] things, which will satisfy the 99% that aren't complaining. you will never ever be able to address the actual security conscious because, well, you can't.

<comment><USER15> Why wouldn't they? If some companies are that invested in keeping their data off the cloud (on which I agree that those are few and far in between) I could easily this as an on-prem instance.

<comment><USER14> there goes the business model, including the velocity. do you even startup, bro? sorry for that. a cheeky way to say, growth rate is critical in a funded business like this. an on-prem product is hard enough, an on-prem security critical product, whose entire reason for on-prem is the _security_ aspect? it would kill them.

on-prem doesn't even make sense for the 99% that aren't concerned about the security of it, as long as someone _else_ is responsible for it.

lastly, the rate of implementation and tweaks to integrations for such a thing is going to be very, very high. there is just no sensible way to deploy this on-prem. (selling and supporting an on-prem product is very different from developing your own in-house solution.)

</comment></comment></comment><comment><USER16> I build a lot of integrations, so this looks useful. Would this allow you to do something like build the My Apps / My Connections screen found in Zapier?

<comment><AUTHOR> Yes, the integration catalog experience for a logged in user would be very similar to the My Apps screen in Zapier. (by default the styling is a bit different, but you can customize that e.g. if you prefer the list vs grid view)

</comment></comment><comment><USER17> Congrats on the launch. Are there plans for SDKs in various languages or is this going to be JS only for now?

Why I ask is that I like the simplicity of Firebase as a back-end and attempted to use Google Auth for a desktop app (in C++). It was a pain to setup and still doesn't work well.

It would save us a great deal of dev effort if there was a layer which could talk to Google and handle this for me.

P.S. The part about trusting a 'startup' with auth tokens may be worth addressing in some way on your website.

<comment><AUTHOR> We've had a handful of requests for native app support, so it's definitely something we'd like to do eventually, although we're more likely to start with Electron since it will be easier to port from our existing SDK.

That's good feedback on addressing the trust issue head-on, we'll work on that.

<comment><USER18> Maybe anecdata here but I read this post, had a need for your service, and moved on because it wasn't native. You may not be getting requests because people like me won't even bother looking past the fact it's JavaScript and will either roll our own or stick with the cloud vendors C++ SDKs.

If you do go native, please expose it through a C API and not C++ or Rust.

<comment><AUTHOR> That's good feedback. We'll have to examine the native use-case a little more closely.

</comment></comment></comment></comment><comment><USER19> I think there's a huge, growing need for this and your sdk/api's seem very well-thought!

As for the design of your site, it definitely leaves me assuming it's just an auth service. I'd focus more on showing psuedo example interfaces / flows that your service powers. For instance, show an example client app on the left, your sdk drops in, on the right your integrations UX showing all the apps you can now integrate with.

I'm reminded of the copy & explanatory / storytelling on this site: [https://www.freshpaint.io/](https://www.freshpaint.io/)

Instead of "Codelessly connect your site to your stack" they could've said "Enterprise-grade analytics with less configuration." But they went with a phrase that does more to highlight how their offering is new and brings a new form of value.

Maybe a/b test your one-liner? Some ideas:

"Add 25+ SaaS integrations to your app. We take care of the authentication."

"The first low-code, secure way to add SaaS integrations FAST."

"A new, low-code way to add 25+ SaaS integrations to your app."

"Less time re-implementing auth, more time building features."

"A faster, more secure approach to integrations."

Good luck!

<comment><AUTHOR> Thanks for the kind words.

I agree we need to re-think our home page a bit. We initially focused on "OAuth" to really get specific about what we do, but it's had the unfortunate side effect of making us seem like an auth provider.

I like the idea of specific examples, and your headline ideas are great!

</comment></comment><comment><USER20> Not trying to be critical or anything but the design really reminds me of those domain-name parking pages - like this: [https://bit.ly/2DRc04H](https://bit.ly/2DRc04H)

<comment><AUTHOR> Hmm, there is an unfortunate resemblance there. Thanks for the feedback.

<comment><USER21> The problem is that the box asking you to enter your email is the most prominent feature on the page before you scroll, which is reminiscent of those sites that try to get you to sign up for their newsletter before you can read the article.

Personally I'd be annoyed having to enter my email to check out a demo; I don't want to receive emails about something until I have a better idea whether it would be useful.

<comment><AUTHOR> You can create an account and set everything up without ever talking to us if you prefer (that's the "Create a free account" link above the fold, [https://app.xkit.co/sign-up](https://app.xkit.co/sign-up)).

</comment></comment></comment></comment><comment><USER22> Their terms:

THESE SERVICES ARE PROVIDED BY COMPANY ON AN "AS IS" AND "AS AVAILABLE" BASIS. COMPANY MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE OPERATION OF THEIR SERVICES, OR THE INFORMATION, CONTENT OR MATERIALS INCLUDED THEREIN. YOU EXPRESSLY AGREE THAT YOUR USE OF THESE SERVICES, THEIR CONTENT, AND ANY SERVICES OR ITEMS OBTAINED FROM US IS AT YOUR SOLE RISK.

NEITHER COMPANY NOR ANY PERSON ASSOCIATED WITH COMPANY MAKES ANY WARRANTY OR REPRESENTATION WITH RESPECT TO THE COMPLETENESS, SECURITY, RELIABILITY, QUALITY, ACCURACY, OR AVAILABILITY OF THE SERVICES. WITHOUT LIMITING THE FOREGOING, NEITHER COMPANY NOR ANYONE ASSOCIATED WITH COMPANY REPRESENTS OR WARRANTS THAT THE SERVICES, THEIR CONTENT, OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE SERVICES WILL BE ACCURATE, RELIABLE, ERROR-FREE, OR UNINTERRUPTED, THAT DEFECTS WILL BE CORRECTED, THAT THE SERVICES OR THE SERVER THAT MAKES IT AVAILABLE ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS OR THAT THE SERVICES OR ANY SERVICES OR ITEMS OBTAINED THROUGH THE SERVICES WILL OTHERWISE MEET YOUR NEEDS OR EXPECTATIONS.

COMPANY HEREBY DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR PARTICULAR PURPOSE.

THE FOREGOING DOES NOT AFFECT ANY WARRANTIES WHICH CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW.

EXCEPT AS PROHIBITED BY LAW, YOU WILL HOLD US AND OUR OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS HARMLESS FOR ANY INDIRECT, PUNITIVE, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGE, HOWEVER IT ARISES (INCLUDING ATTORNEYS' FEES AND ALL RELATED COSTS AND EXPENSES OF LITIGATION AND ARBITRATION, OR AT TRIAL OR ON APPEAL, IF ANY, WHETHER OR NOT LITIGATION OR ARBITRATION IS INSTITUTED), WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE, OR OTHER TORTIOUS ACTION, OR ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, INCLUDING WITHOUT LIMITATION ANY CLAIM FOR PERSONAL INJURY OR PROPERTY DAMAGE, ARISING FROM THIS AGREEMENT AND ANY VIOLATION BY YOU OF ANY FEDERAL, STATE, OR LOCAL LAWS, STATUTES, RULES, OR REGULATIONS, EVEN IF COMPANY HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. EXCEPT AS PROHIBITED BY LAW, IF THERE IS LIABILITY FOUND ON THE PART OF COMPANY, IT WILL BE LIMITED TO THE AMOUNT PAID FOR THE PRODUCTS AND/OR SERVICES, AND UNDER NO CIRCUMSTANCES WILL THERE BE CONSEQUENTIAL OR PUNITIVE DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE PRIOR LIMITATION OR EXCLUSION MAY NOT APPLY TO YOU.

<comment><USER23> Could you write a one sentence summary on why I should care?

<comment><USER24> > Use at your own risk.

> "SECURITY, RELIABILITY, QUALITY, ACCURACY" is not guaranteed.

Not something you want for a paid IaaS that deals with OAuth. I hope this is boilerplate that someone copypasta'd

<comment><USER23> Is this a significant departure from the boilerplate of other similar products?

<comment><USER22> In IT outsourcing, yes. See this article from CIO magazine.[1] Key items:

 _" An indemnification clause is an important provision in which the service provider agrees to indemnify the customer company for any breaches of its warranties. Indemnification means that the provider will have to pay the customer for any third-party litigation costs resulting from its breach of the warranties. If you use a standard SLA provided by the service provider, it is likely this provision will be absent; ask your in-house counsel to draft a simple provision to include it, although the service provider may want further negotiation of this point."_

In other words, many vendors like to find suckers who will sign their standard one-sided agreement, but there's usually room for negotiation.

[1] [https://www.cio.com/article/2438284/outsourcing-sla- definiti...](https://www.cio.com/article/2438284/outsourcing-sla-definitions- and-solutions.html)

</comment></comment></comment></comment></comment><comment><USER25> First, congrats! Launching anything is hard, let alone after two pivots. I had a couple of questions and comments:

* Are you looking to explicitly support other auth providers (I for one would love to have you support [https://fusionauth.io/](https://fusionauth.io/) \-- full disclosure I work for them)? Or is the best path forward there to just use the Custom Token Issuer instructions?

* There's a typo here where it looks like the markdown hasn't been correctly processed: [https://docs.xkit.co/docs/custom-catalog](https://docs.xkit.co/docs/custom-catalog):

> If you want full control over how users interact with the Integration > Catalog beyond what's available in [Self-hosting(doc:self-hosted-catalog), > you can use our libraries or APIs to fully customize the experience.

* I'm trying to understand why someone would create their own catalog. Is that because they have their own suite of applications currently using OAuth for auth? So kind of a AWS Service Catalog play? Or is it more "I'll take care of adding this fiddly integration to XYZ service once so that all my developers can use this integration in the varied apps they are building"?

* What is the difference between using xkit and a tool like Zapier to handle SaaS integration? It looks like with xkit you have more control, including over the integration process. Why would I want to use something lower level like xkit?

Again, congrats on the launch!

<comment><AUTHOR> Thanks for the note on the typo, I've fixed it.

I'm happy to add other auth providers to our docs. Shoot me a note (trey@) with the instructions and I'll add it in.

Many developers want to have their integration catalog match the look and feel of the rest of their application, or they have additional configuration for their integrations outside of what Xkit provides. In these cases, building their own custom catalog using xkit.js makes the most sense.

Zapier is a tool focused on the user of SaaS products (e.g. I want to connect my Google Sheets account to my Mailchimp account). Xkit is made for developers (e.g. I want the users of my brand new CRM tool to be able to pull in data from Google Sheets).

Many developers start out by just adding a Zapier integration and telling their customers to hook up to other tools themselves. However, many companies find that having those integrations be native (rather than going through Zapier) is helpful with both sales and activation, not to mention the increased level of control you have. We're helping developers build those types of integrations.

<comment><USER25> Awesome, thanks!

</comment></comment></comment><comment><USER26> Trey - congrats on the launch! Love what you are doing and cant wait to see how you evolve it. Integrations are definitely a PITA and Oauth2 is a great starting point! Best wishes!

</comment><comment><USER27> When are you getting a SOC2 audit? Can I deploy to my own private cloud?

<comment><AUTHOR> Shoot me an email for more details on the SOC2 (trey@).

We're unlikely to support private cloud in the near term.</comment></comment>


If programming languages were religions... - <AUTHOR> http://www.itu.dk/courses/BPRD/E2010/religion.txt <comment><USER2> Haskell should be listed as Confucianism.

It is an orderly society built on a tight system of rules which delineate the role of each thing and its respective place in the cosmos. People think that the rules are confusing and legalistic, but great societies can be built atop it and it's foundations.

<comment><USER3> And it only allows for certain specific types of changes in social status.

<comment><USER4> Most of the time _correct types_ of changes.

</comment></comment></comment><comment><USER5> Actionscript / Adobe would be jehovas witnesses. Its annoying, but prevalent and always at your door 'would you like to talk about updates? I have this great Flash video...'

</comment><comment><USER6> See

<http://news.ycombinator.com/item?id=399699>

and

<http://news.ycombinator.com/item?id=1944876>

</comment><comment><USER2> Ruby's wrong too. The description of Ruby says nothing about either it's society or it's strengths (or weaknesses) as a language. Being popular isn't a language or cultural feature.

I'm not sure where to place it still. Ruby's been called SmallTalk for the Unix VM. But then i'm not sure where to put SmallTalk either. Ruby's a language about aestheticism and ease of development. SmallTalk is a language about robust minimal APIs accomplished through message passing and tracking the state of the universe. Given that every smalltalk program is a VM unto itself, there's something about multiverse semantics there somewhere. Which is akin to Mahayana Buddhism.

Actually that's it.

Lisp should be Taoism. It's about the raw expressive power of the universe as it flows around us. It's also very confusing to non-believers, and even to believers, there's a lot of infighting and disagreement. Lispers seem very happy when alone.

Then, Smalltalk is mainline Mahayana Buddhism. All adherents are promised that they will become the Buddha of their own personal domain upon reaching Enlightenment. Experience is the only thing that is real, and the true nature of the universe is ephemeral and ever changing (via duck typing, monkey patching and message passing). Those who get lost in samsara are doomed to keep repeating their mistakes (MONKEY PATCH WITH CARE).

Ruby is Zen Buddhism. Ruby holds all the same tenets as Smalltalk, but is much more considerate of aesthetics and formalization by a rigorous, perhaps rigid society. It made its way to the US and is understood as something totally different in North America, with different leaders and and focus. It is wildly popular among Californians.

</comment><comment><USER7> Not sure about the jab at Microsoft, C# is just an implementation of an ECMA standard ([http://www.ecma- international.org/publications/standards/Ecm...](http://www.ecma- international.org/publications/standards/Ecma-334.htm)) and as if Java isn't unduly influenced by The Red Menace these days.

Perl is spot on though :)

</comment><comment><USER8> Lisp and Haskell programmers would both worship the lambda. Instead of making the sign of the cross they would draw the sign of the lambda across their chest to show reverence..

</comment><comment><USER9> If? Programming languages are one of the most religious prone components of the geek ecosystem.

</comment><comment><USER10> Logo is what little kids make up for themselves when nobody tells them anything different.

</comment><comment><USER11> VB is not a religion, it is an atheism: no strict rules, nothing to be afraid of, it is very forgiving. Anyone who is lazy enough to be a follower of an organized structural system, can claim to be an expert in VB.

</comment><comment><USER12> It was good until I realized it was just a drawn out rip on VB...</comment>


19-year-old girl in Egypt invents a spacecraft propulsion device - <AUTHOR> http://thenextweb.com/africa/2012/05/18/19-year-old-girl-in-egypt-invents-a-spacecraft-propulsion-device/

<comment><USER2> The article is not very clear, and has no technical details, and has not a reference to a peer review journal article. So it is very difficult to know if this theoretical device really works.

I'm not sure, but it even looks like a perpetual motion example. (But it could be a problem with the press report.)

And the article says that is a variation of the "Differential sail", but the most clear reference in Wikipedia ( [http://en.wikipedia.org/wiki/Breakthrough_Propulsion_Physics...](http://en.wikipedia.org/wiki/Breakthrough_Propulsion_Physics_Program) ) has many proposed devices that are very controversial and probably violates some physics laws.</comment>


Don't show me the money: Why eliminating cash may be the secret to prosperity - <AUTHOR> http://www.washingtonpost.com/blogs/innovations/post/dont-show-me-the-money-why-eliminating-cash-may-be-the-secret-to-prosperity/2010/12/20/gIQAOkT1bS_blog.html

<comment><USER2> _A cashless society is also a society where there is no longer any anonymity_

This is what concerns me the most. I think most of what this article proposes is great, but knowing that absolutely everything I buy can be traced back to me makes me uncomfortable.

<comment><USER3> Whatever one may think of systems like ecash or bitcoin, it's disappointing to see a journalist writing as if nothing like that has even been conceived.

<comment><USER4> As has been said many times before, Bitcoin is not anonymous either. It is at best weakly pseudonymous.

Where Bitcoin _does_ improve over the centralised system described is that you cannot arbitrarily lock someone out of Bitcoin.

</comment></comment></comment><comment><USER5> "resulting in over $8 billion in transactions that _never would have occurred otherwise_."

Yeah, sure! Am I the only one who thinks this article feels a little like pro- fiat PR for an era where central banks are "printing" ad-infinitum to indebt future generations to address the current political expediency? Something real to back your wealth? Bah! Promises to repay stored in a computer system is _the only way_.

Someone should post this on zerohedge and see what kind of responses you get!

<comment><USER6> Consider the scale of the money supply as managed by a central bank using fiat money. Consider the fraction that's not already electronic, paper currency. Do you really think that turning that to electrons will make a difference?

For reference, in the US, [http://www.federalreserve.gov/releases/h6/current/default.ht...](http://www.federalreserve.gov/releases/h6/current/default.htm) (That's ~$1028 billion in currency, of ~$9755 billion in M2, to say nothing of other assets.)

And when you get down to it, all that makes assets like "gold" (and other commodities) valuable as currency is the promise of being able to exchange it for something in the future. (Unless you were planning to do something useful with the commodity itself, which seems mostly unlikely.) Whether this promise is actually more credible than your favorite fiat currency is a _discussable_ matter, but not perfectly clear.

<comment><USER5> What about reliability and security? How do you buy food when the computer system has crashed. (Or the banks have collapsed?) Even paper fiat allows you some robustness to this. Precious metals even more so.

</comment></comment></comment><comment><USER7> People could just use other currencies (like USD) for their cash transactions then. I imagine this could be made illegal too, which only gets more alarming.

Is there no value in a government that knows less than everything about their citizens?

<comment><USER8> [http://www.theatlantic.com/business/archive/2012/03/why- are-...](http://www.theatlantic.com/business/archive/2012/03/why-are- criminals-stealing-tide-detergent-and-using-it-for-money/254631/)

</comment></comment><comment><USER9> A technological solution to a social / economic problem? I don't think so.

It's like the people talking about how micronations like Sealand will solve social problems. Nup, you can go to a country with fewer laws now (Somalia?) if you want to live in an anarchy. Guess what - there's still people, and all the problems people tend to make for themselves.

You can buy foreign currency from many banks. You can even create your own pseudo-currency (though it may be illegal). Good luck using it.

Micro-payment proponents haven't yet found a cure for stinginess.

Crime is a factor. A lot of criminals will just find other payment methods, like the online payment rings that already exist (how else do spammers get paid?). It will cut the theft of cash, and probably cause more theft of mobiles / identity theft. If your mobile phone _is_ your wallet, that won't stop a pickpocket from taking it.

As for all the "fiat capital" arguments .. no-one is seriously going to think it changes everything. All major currencies these days are fiat, and online ones will be no different. They can be effectively backed by gold and / or oil (just like current ones are / are not depending on whose cool-aid you're drinking), but I wouldn't bet on them being any different.

It will be nice to be able to order a coffee using a mobile phone at somewhere other than Starbucks. It won't be a revolution.

</comment><comment><USER10> Cashless or cash is not a distinction about technology, but a property of money.

If something is cashless, that mean it is under the custody of third parties. When something is cash, it means that the control belongs to you.

This marks the distinction between bitcoin in your wallet versus bitcoin on a wallet controlled by a bank. Or having paper bills versus having money in paypal.

</comment><comment><USER11> No, no. We all know that printing money is the secret to prosperity. OTOH, going completely cashless will make it a lot easier to do just that, so maybe it will help.

Oh, I didn't mention _for whom_ it is the secret to prosperity, did I?

Details, details.

</comment><comment><USER12> Don't forget that human beings treat abstractions of money differently the more levels of abstractions there are layered on top.

More likely to steal it, spend it and a bunch of other things. If you want more fraud, more waste, and people more likely to spend it on a whim then this is the direction to go I suppose.

<comment> UK-AL On the other hand tech could be used to make things more visible. Imagine your phone warning you that your cutting it a little close on your eating out budget this month.

<comment><USER12> Yeah, there are definitely some upsides. Especially with reminders and graphs and planning and all the stuff applications are good for.

The downside is, if the neuroscience research is correct, more of a disconnect between actual value and the money system. Where more people will steal or embezzle and risk assessment abilities get even worse than they already are.

Combine that with the surveillance opportunities, which is the more obvious concern, and it just seems like something to be careful of. One reason I'm glad the bitcoin experiment is going on now. An alternative to giving all my financial information to google and cell phone companies (because everyone loves how ethical their business practices are) deserves more people working on the problem.

</comment></comment></comment><comment><USER13> Lets just make cell phone battery reliable more reliable before replacing cash with cell phones.

<comment><USER14> Why is this being downvoted? Besides the "reliable" typo geezer makes a good point. Cash doesn't require electricity, or run out of batteries, or require an Internet connection, nor can it be cracked/hacked/etc. From a pure usability standpoint, cash would seem to be the more convenient option.

(I'd rather be robbed of my wallet than forced to make large transactions out of my Networked bank account.)

</comment></comment><comment><USER15> Agree with the concerns about privacy, but I also wonder what happens if I visit such a country as a tourist. Do I have to buy a pre-loaded device on arrival, or do I use my existing phone and pay whatever fees my operator sets?

</comment><comment><USER16> No way I would be ok with this in my country. I'm not going to break any laws soon, but I don't want to be obliged to leave a paper trail.

</comment><comment><USER17> Here's a counter-point. A cashless society enables dominant private parties and government to _introduce_ friction when and where they chose.

"Your payment cannot be processed."

We saw this recently with the Wikileaks contributions embargo. We've seen it codified in legislation such as (but not solely) SOPA.

So... it may be very convenient to swipe, bump, (grind?), whatever... until it isn't.

I'm certainly not the only person to think of this, In any number of otherwise insightful science fiction stories, cash lives on -- sometimes as a black- market economy, but not only for nefarious activities.</comment>


Rust: Zero-Cost Abstraction in Action - <AUTHOR> https://idursun.com/posts/rust_zero_cost_abstractions_in_action/ <comment><USER2> These are not about abstractions but compile time optimizations. These are also not implemented in the Rust compiler but LLVM. So any any language frontend in front of LLVM would yield the same optimizations. According to Wikipedia the list is:

> [...] variety of front ends: languages with compilers that use LLVM include > ActionScript, Ada, C#, Common Lisp, Crystal, CUDA, D, Delphi, Dylan, > Fortran, Graphical G Programming Language,Halide, Haskell, Java bytecode, > Julia, Kotlin, Lua, Objective-C, OpenGL Shading Language, Ruby, Rust, Scala, > Swift, Xojo, and Zig.

Sometimes I think mention of Rust in the title just gets upvotes without even reading the article, here.

<comment><USER3> The C# compiler uses LLVM? Is that for something like Xamarin or something? I was under the impression that it was self-contained. Anyone knows the details of this?

<comment><USER2> Anyone can build a frontend. "Java bytecode" is in that list too. It doesn't mean defacto compilers of these languages rely on LLVM.

<comment><USER4> In this case it is Azul Zing, a very serious product. It's one of the four major VM Jit compilers (OpenJ9, C2, Graal are the others in my opinion)

[1] [https://www.azul.com/products/zing/](https://www.azul.com/products/zing/)

<comment><USER5> There are also PTC, Aicas, Virtenio, Ricoh and Gemalto all targeted to embededded deployments, of which, PTC and Aicas are the most well known ones.

Sadly Excelsior is no more. I imagine that regular JIT compilers making AOT/JIT caches available, is what killed them.

</comment></comment></comment></comment></comment><comment><USER6> This isn't really talking about Rust, it's actually talking about the optimization capabilities of LLVM (the compiler backend, which quite a lot of languages use, such as Clang for C++, Rust, Swift, Julia, Zig, ...) These languages all have similar chances of performing those same optimizations, at least in those simple cases.

What I'm interested is how the IL code for the compiler frontends for each of those languages are more well-optimizable for LLVM (in practical situations, not just a few lines of simple numerical code.) I've heard that you need to be careful about encoding IL code in the right way such that LLVM does not generate needless memcpy's or something but I'm not that much of a compiler expert...

<comment><USER7> rustc does indeed deliberately seek to emit LLVM IR that resembles what Clang would emit, in order to benefit from the same sorts of optimizations that default LLVM is tuned for.

</comment></comment><comment><USER8> There is nothing about zero const abstractions in this article, just basic compiler optimizations.

<comment><USER7> The OP doesn't explicitly demonstrate any zero cost abstractions, however these "basic compiler optimizations" are only feasible to achieve statically (i.e. without a JIT) in the presence of sufficiently transparent abstractions, which takes a good deal of language design effort to enable.

</comment></comment><comment><USER9> For anyone interested in reading more about this, I would recommend Zero Cost Abstractions[1] by withoutboats, who is a contributor to Rust.

1: [https://boats.gitlab.io/blog/post/zero-cost- abstractions/](https://boats.gitlab.io/blog/post/zero-cost-abstractions/)

</comment><comment><USER10> This is not Rust specific, this is a compiler thing, both LLVM and GCC can detect sums and generate closed form formulas instead. There are other fun algorithm detections - e.g. if you try to do bitcounts yourself, LLVM will use popcnt instead.

Compilers are awesome, check out Matt Godbolt's talk on this very topic: [https://www.youtube.com/watch?v=nAbCKa0FzjQ](https://www.youtube.com/watch?v=nAbCKa0FzjQ)

</comment><comment><USER11> I assume it's doing `(N-2)(N-3)/2 + 2N - 3` instead of `N(N-1)/2` due to overflow concerns? But couldn't `(N-2)(N-3)` also possibly overflow, just supporting a larger range of `N`?

<comment><USER12> In this assembly code it cannot overflow because N is a 32-bit integer and the multiplication gives a 64-bit result, which is converted to 32-bit only after shifting.

I can't figure out why it doesn't use the simpler formula (other than the optimizer being bad).

</comment></comment><comment><USER13> The earlier transformations are actually more impressive. Constant folding is almost always has a good RoI, so lots of compilers do it, and it's simple because, well, it's a constant there is no variables or partial eval needed. The others require lots of inlining before the final rule fires, and so are more ambitious.

Seeing what

      pub fn sum3(n: i32) -> i32 {
         (1..n).sum() + (1..2*n).sum() + (1..(n + 2)).sum()
      }

does would be more interesting to me.

Also, while all the inline is rustc, I assume the "triangle number trick" is LLVM.

<comment><USER14> Godbolt supports Rust, and can show the LLVM IR: [https://godbolt.org/z/GsccW3](https://godbolt.org/z/GsccW3)

<comment><USER5> A bit offtopic, I love how Godbolt grew out of C++ community to embrace as much AOT toolchains as possible, kudos to Matt and everyone involved into making it happen.

</comment></comment></comment><comment><USER15> I wonder if the const syntax introduced in ES6 will ever result in const folding, or any JIT optimizations for code running in JS runtimes. Apparently, from what I've read, const is being ignored as far as optimiztions go and is only used as a way to prevent the developer from ever reassigning certain variables.

</comment><comment><USER16> The ocaml compiler does constant folding too, and I consistently look at the (usually javascript because of Bucklescript) output in amazement when it finds shit like that. Unrolling all my tail recursion is great too.

<comment><USER5> For anyone that wants to learn about optimizations in AOT compiled ML languages, have a look at:

"The Implementation of Functional Programming Languages"

"Compiling with Continuations"

"Modern Compiler Implementation in ..." (C, Java and ML variants)

Although oriented towards Lisp, "Lisp in small pieces" is a classical book as well, with many optimizations like inlining of lambda calls across multiple call levels.

</comment></comment><comment><USER17> Are compiler optimizations like summing a series done on an ad-hoc basis? Certainly the compiler couldn't have discovered or inferred (not sure what term to use) that formula, no?

Just generally curious.

<comment><USER7> Those optimizations are happening on LLVM's end (though the higher-level language will have to expose sufficiently transparent abstractions to make these optimizations possible). I'd love to read a book on the optimization techniques that are implemented in LLVM/GCC to make transformations like this possible.

<comment><USER17> Gotcha. Thanks. So presumably Clang would have done the same for C?

<comment><USER18> Yes, and it's mentioned in the post that the C code was also brought into parity.

<comment><USER17> Yeah I saw that, but just wasn't sure how using intrinsics played a role.

</comment></comment></comment></comment></comment><comment><USER19> There is nothing impressive about this. [https://godbolt.org/z/S2tDDh](https://godbolt.org/z/S2tDDh)

</comment><comment><USER20> _> he was very disappointed because Rust version was twice as fast than the C version which was hand-optimised by pulling off all the tricks he knew to make it perform well._

Why disappointed? It just highlights the quality of Rust's approach.

<comment><USER21> Evidently the tricks were what made it slow.

This happens all too often: once the code changes enough that the optimizer doesn't recognize the pattern anymore, it throws up its hands, and you're on your own. Some people call this optimizer roulette.

It's not just compilers, either. CPUs have their own peephole optimizers, and patterns they recognize, or don't, and it can easily make a 2x difference in your run time depending on if it cottons to what you're trying, or doesn't.

<comment><USER5> With CPUs it gets even worse, because that clever optimized Assembly code can stop being so in another CPU or after a firmware update.

The days of Z80, 6502 and similar are long gone.

</comment></comment></comment><comment><USER22> This is neat but there is still cost in compile time

<comment><USER23> Usually in Rust community zero cost means zero runtime cost. Obviously, there are many other costs you could define.</comment></comment>


Get Ready for Your Digital Model - <AUTHOR> http://www.wsj.com/articles/get-ready-for-your-digital-model-1447351480?mod=e2fb <comment><USER2> Just finished reading Pedro Domingos' book The Master Algorithm, which also features these ideas. I was way more fascinated by his so-called 'data unions' also mentioned in this book: companies empowering individuals to take charge of their digital footprint. Taking on the data-collecting walled gardens that are currently rising up. Much like labor unions represent workers that suffer from a power imbalance, only for the digital native. Lots of food for thought.

</comment><comment><USER3> Can you imagine? An automated echo chamber built just for yourself? How terrifying.

</comment><comment><USER4> Anyone know of any companies working this as a primary/singular focus?

</comment><comment><USER5> =/ "To Read the Full Story, Subscribe or Sign In"

<comment><USER6> Click on the "web" link above.</comment></comment>


An Analysis of OpenSSL's Random Number Generator - <AUTHOR> https://eprint.iacr.org/2016/367 <comment><USER2> Reminds me of one of my favorite commit logs from the LibreSSL project:

"Do not feed RSA private key information to the random subsystem as entropy. It might be fed to a pluggable random subsystem…. What were they thinking?!"

[http://opensslrampage.org/post/83007010531/well-even-if- time...](http://opensslrampage.org/post/83007010531/well-even-if-time-isnt- random-your-rsa)

<comment><USER3> that sounds unsafe

<comment><USER4> A hash of the private key isn't actually bad to use for entropy. It's what's done in deterministic EC signatures, deriving the k value from the private key + message.

<comment><USER4> As long as the hash function is strong, why exactly would this be weak? Downvoting me implies you believe these people are wrong too;

[https://tools.ietf.org/html/rfc6979](https://tools.ietf.org/html/rfc6979)

> It is possible to turn DSA and ECDSA into deterministic schemes by using a > deterministic process for generating the "random" value k. That process must > fulfill some cryptographic characteristics in order to maintain the > properties of verifiability and unforgeability expected from signature > schemes; namely, for whoever does not know the signature private key, the > mapping from input messages to the corresponding k values must be > computationally indistinguishable from what a randomly and uniformly chosen > function (from the set of messages to the set of possible k values) would > return.

> d. Set: > K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1))

> where '||' denotes concatenation. In other words, we compute HMAC with key > K, over the concatenation of the following, in order: the current value of > V, a sequence of eight bits of value 0, the encoding of the (EC)DSA private > key x, and the hashed message (possibly truncated and extended as specified > by the bits2octets transform). The HMAC result is the new value of K. Note > that the private key x is in the [1, q-1] range, hence a proper input for > int2octets, yielding rlen bits of output, i.e., an integral number of octets > (rlen is a multiple of 8).

</comment></comment></comment></comment><comment><USER5> I can't understand Why OpenSSL continues to use it's own PRNG implimentation when we have /dev/urandom and CryptGenRandom which are known to be good. This is basically what BoringSSL does (although if you have rdrand then it will get filtered through a ChaCha20 instance).

I'm pretty sure OpenSSL doesn't even reseed its PRNG on Windows unless the calling application does it so I'm not sure how that's safe either. If you look at applications using OpenSSL like OpenVPN I don't see any calls to the PRNG init function to ensure it has enough entropy. I'm not sure of the security impact of this.

<comment><USER6> _" /dev/urandom and CryptGenRandom which are known to be good"_

Check out _" A good idea with bad usage: /dev/urandom"_:

[http://insanecoding.blogspot.com/2014/05/a-good-idea-with- ba...](http://insanecoding.blogspot.com/2014/05/a-good-idea-with-bad-usage- devurandom.html)

Just stumbled onto it in the new submissions queue:

[https://news.ycombinator.com/item?id=11485876](https://news.ycombinator.com/item?id=11485876)

<comment><USER7> ... I'm not sure I can take an article seriously that suggests "but what if the attacker can modify files in /dev?".

In any case, the meaningful concerns from that article have been addressed with the getrandom syscall on Linux, introduced a few months after this article was written: [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)

Perhaps we should start saying "getrandom" / "getentropy" instead of "/dev/urandom", but they're the same underlying CSPRNG (although getrandom has the distinct advantage of allowing you to tell if the urandom pool has been initialized, which /dev/urandom doesn't let you do), so I can understand being sloppy with usage. I would sort of assume anyone in a position to patch OpenSSL's RNG either upstream or in a distro is aware of getrandom and why it exists, but maybe that's a bad assumption.

<comment><USER5> I forgot about the new getrandom syscall but yes that would be preferred if supported.

</comment></comment></comment></comment><comment><USER8> Are any OpenSSL fork vulnerable in the same way?

<comment><USER9> No. Both BoringSSL and LibreSSL use substantially different (and safer) systems for their CSPRNG.

[https://boringssl.googlesource.com/boringssl.git/+/refs/head...](https://boringssl.googlesource.com/boringssl.git/+/refs/heads/master/crypto/rand/rand.c)

[https://github.com/libressl- portable/openbsd/blob/master/src...](https://github.com/libressl- portable/openbsd/blob/master/src/lib/libc/crypt/arc4random.3)

</comment></comment><comment><USER10> I actually have several TB of OpenSSL PRNG output (256 bit len) that I've been analyzing. A fairly modest sample size, but I've come across some interesting patterns at the bit level. It's kind of a pain in the ass to write efficient analytics for a binary 256 bit pattern as a matter of fact.

<comment><USER11> That's numerology, you just have many outputs of SHA1 with different inputs.</comment></comment>


Ask HN: Workarounds for selling apps from unsupported countries? - <AUTHOR>

Any workarounds for selling apps on Apple Appstore and Google Play store from unsupported countries? i.e. countries in which you can't create a merchant account.<p>Thanks! <comment><USER2> The easiest thing would probably be to use a relative's or a friend's bank account that is living/studying in a supported country. You would have to create and transfer your apps to a new Google Play developer account with the same country as the bank account.

You could also try to open an offshore bank account in one of the supported countries but most banks have balance limitations (the lowest I found was 5000GBP) and/or monthly fees.

</comment><comment><AUTHOR> It is frustrating that most people here don't care about this...

</comment><comment><USER3> poop</comment>


Ask HN: I need bug reporting/feedback for my web app.  Suggestions? - <AUTHOR>

I'm about to launch a SaaS application and need a bug tracker.  The basic requirement is pretty simple: allow users to raise bugs and submit feedback easily from within the app or via email.  Easy tracking and workflow processing and possibly some sort of user forum.<p>In addition - and this is where my research has come a cropper - I'd really like users to have the option of filing a screenshot to their bug report by simply checking a box or clicking a button.  Does anything like this exist?  If not, what are you thoughts on the existing players (Zendesk, Uservoice, Kampyle, Tender etc) and what they're like to use on a day-to-day basis? <comment><USER2> You should also consider <http://SnapABug.com> Also has a nice chat feature (you can see what page the person is on)

<comment><AUTHOR> Looks good, thanks!

</comment></comment><comment><USER3> FogBugz does the screenshot thing you are asking for. I have used FogBugz at my day job for years now. While it has it's quirks it is pretty nice.

<comment><AUTHOR> Thanks for the tip - I'll check it out.

UPDATE: OK, I can only find the screenshot tool [1] which is a downloadable desktop application as opposed to something I can integrate into my web application unfortunately.

[1] [http://www.fogcreek.com/FogBugz/docs/70/topics/basics/Captur...](http://www.fogcreek.com/FogBugz/docs/70/topics/basics/Capturescreenshots.html)

</comment></comment><comment><USER4> I am not sure I understand the question. Do you mean you are just looking for a bug reporting system that handles binary attachments, or are you asking for the system to somehow grab the screenshot for them?

If it's the former, bugzilla will do it, albeit you will need to customise it a bit. No ideas on the second.

<comment><AUTHOR> It's the latter, I want the system to take and attach the screenshot at the user's request.</comment></comment>


Management/Success/Leadership: Mostly Bullshit - <AUTHOR> http://dilbert.com/blog/entry/managementsuccessleadership_mostly_bullshit/

<comment><AUTHOR> I can also relate to the "success=charisma hypothesis." In my comfort zone, I feel (and therefore act) a lot more confident than when I'm in an unfamiliar situation. It can affect tone of voice, posture, body language, eye contact - all sorts of charismatic gestures.

I once walked past Bill Clinton having lunch in an NYC restaurant, and from 100 feet away I could almost feel the charismatic aura around him. It was impressive, and has stuck with me. But perhaps it was as related to the several hundred people around with their eyes glued to him, as it was to any charismatic qualities he may have been born with.</comment>


It's time to fix the AWS free tier - <AUTHOR> https://www.lastweekinaws.com/blog/its-time-to-rethink-the-aws-free-tier/ <comment><USER2> I have to agree, I prefer google cloud billing. Particularly for api rate limited billing, even in the free tier I can see exactly how much each request is costing, by type, key, api, immediately after making the call.

It makes it very easy to test out a use case and determine how much it would actually cost (pricing charts can be a pretty rough estimate when use cases grow more complex).

And the hard stop, $300 free credit is exactly what I want when kicking tires / MVPing.

I imagine a lot of free tier usage fits into the developer testing / tire kicking. Going one step further than the docs, and making sure the api / SDK do as described.</comment>