Microsoft ecosystem valued at $580 billion per year - <AUTHOR> http://www.webjives.org/microsoft-ecosystem-valued-at-580-billion

<comment><USER2> Pause for a moment to consider how much money that really is. How many people in our industry have put bread on their table with their piece of that massive pie.

That is, for example:

* About 19.33x bigger than the global music industry

* About 21.48x bigger than the global movie industry

* About 13.80x bigger than the global video game industry

* Nearly $100 from every man, woman and child alive today.

* About as big as the US Auto Industry (New Sales and Used Sales combined).

<comment><USER3> Just for reference, the IT industry revenues in 2010 were $1.5 trillion.

</comment></comment><comment><USER4> Most of these jobs and companies would still exist without Microsoft. They would just be using and/or building around someone else's software and/or platform.

<comment><USER5> Not necessarily. I say this because Microsoft and their ecosystem are exceedingly good at making money from selling software. If Microsoft didn't exist, the ecosystem might be built around many more fragmented platforms. They make $8.70 for every $1 that Microsoft makes; they might be making $100 dollars for every $1 in some parallel universe, and still making far less money (because their platforms will be making far less than Microsoft does in ours). And maybe people in that parallel universe don't pay for software; they only pay for support ;)

<comment><USER6> OTOH, paying less for software would allow that parallel universe to be even more efficient in their use of computers than we are on ours, spending less money and getting more done with it.

Plus, by not having "Wintel" they would be less constrained to innovate in hardware and software.

</comment></comment></comment><comment><USER7> Shouldn't the _valuation_ be some solid multiplier of the _annual revenue_ of $580 billion?

<comment><USER8> The title should be:

 _Microsoft ecosystem valued at $580 billion per year_

</comment></comment><comment><USER6> Are they counting the spam zombie and phishing botnet industries into this number? Microsoft made them possible... A malware industry would have a hard time exploiting a diverse ecosystem like the one that existed prior to Microsoft's dominance. No single computing platform had the 90%+ share Microsoft has and writing multi-platform malware is hard. In fact, no single platform had more than 50%.

Apart from that, this is not even blogspam (submitted by a bot, or a very loyal, bordering obsessive, reader <http://news.ycombinator.com/submitted?id=dsdirect>) - the post itself is so small as to qualify it as a tweet. A tweet linking to a white paper sponsored by Microsoft that appears not to even be mentioned on IDC's website.

But you can download it from Microsoft Presspass, of course.

[http://www.microsoft.com/Presspass/press/2011/mar11/03-24IDC...](http://www.microsoft.com/Presspass/press/2011/mar11/03-24IDCPartnerEcosystemPR.mspx)

edit: to all who say criticizing Microsoft brings good karma, this post serves as a warning. Burn, karma, burn.

<comment><USER9> I sure did not get what you were trying to convey here :(

<comment><USER6> > Are they counting the spam zombie and phishing botnet industries into this > number? Microsoft made them possible...

Various malware infection modes were impossible (not really - it was just that nobody had been that stupid) before Microsoft invented ActiveX or started passing e-mail through script-enabled browser rendering engines. I remember making lots of e-mail virus jokes before Microsoft launched that Outlook 97 add-on (IIRC).

> A malware industry would have a hard time exploiting a diverse ecosystem > like the one that existed prior to Microsoft's dominance. No single > computing platform had the 90%+ share Microsoft has and writing multi- > platform malware is hard. In fact, no single platform had more than 50%.

Malware economics are similar to off-the-shelf software - you target the largest base. Without a base large enough to provide for quick and constant reinfection, botnets would die quickly as its nodes are taken down or recovered. To survive in a fragmented ecosystem, malware would have to be cross platform and much more contagious and, therefore, harder to develop. If you make malware development too costly, malware developers will find some other criminal activity to do.

> Apart from that, this is not even blogspam (submitted by a bot, or a very > loyal, bordering obsessive, reader > <http://news.ycombinator.com/submitted?id=dsdirect>) - the post itself is so > small as to qualify it as a tweet. A tweet linking to a white paper > sponsored by Microsoft that appears not to even be mentioned on IDC's > website.

The article is a single paragraph pointing to a PDF of a white paper sponsored by Microsoft downloaded from Microsoft's site that, surprisingly, shows Microsoft as the great benefactor of the market.

> But you can download it from Microsoft Presspass, of course.

> > [http://www.microsoft.com/Presspass/press/2011/mar11/03-24IDC...](http://www.microsoft.com/Presspass/press/2011/mar11/03-24IDC..).

These are self-explanatory.

> edit: to all who say criticizing Microsoft brings good karma, this post > serves as a warning. Burn, karma, burn.

And so is this.

</comment></comment></comment><comment><USER10> Whilst the figure is without doubt impressive, I can't help but wonder how much of this figure is money lost by the poor customers that bought costly, overly complex and hard to customise money-sinks that require specialists to beat into shape...

* cough *

SharePoint

</comment><comment><USER11> Interesting. Has anyone seen similar results for other big companies (Apple & Google would be great). A quick google search didn't turn up anything.

<comment><USER12> Can't imagine either would be nearly as large, especially since Apple is relativity closed to other and I can't even think of companies that could be deemed as partners with Google.

Amazing how a company can be so interdependent with others all across the world.

<comment><USER13> I don't think Apple is as close as you may think initially. Steve Jobs announced during the iPad2 keynote that devs have earned over $2b from selling their apps on the App Store. Add to that all the artists and bands that succeed by selling their music on iTunes. Plus all the podcasters that wouldn't have been discovered if it wasn't for iTunes. Plus all the authors selling books on the iBookstore. Plus the hundreds of small and large companies making accessories, cases, adapters, covers, etc for iGadgets. Plus all the big brands like Bose creating iPod compatible hi-fi equipment. All the vehicles adding iPod dock support. Added up together, I'm not sure if it matches Microsoft's ecosystem, but Apple's is probably in the tens of billions of dollars.

</comment></comment></comment><comment><USER14> Am I the only one who is a little tired of the term "ecosystem" in the context of technology?

<comment><USER15> Portability and standards are difficult things to build, and they cost resources to develop, like anything else. Users don't understand the need for them and would happily jump in IE6, Windows, iPads or a similar 'ecosystems' until something bad happens and they see the open light (Firefox/Linux/Android). But sometimes no alternative exists (open systems are harder to monetize, and with fewer resources, they take longer to be built). So we're left with a lot of ecosystems where things just work and nothing 'bad' happened yet.

It's a difficult issue and I don't see it going away by itself anytime soon.

<comment><USER16> Android open? Like honeycomb?

<comment><USER6> If Google decides, next week, they will stop releasing any of their own source code (or whatever they borrowed from more-liberal-than-GPL licenses) you can always just fork whatever they already released. You the user - even if you also wrote the original code they based their product on - have no right to demand the release of what they built. They release _if_ they want to.

Free Software is about that: it's about _your_ freedom.</comment></comment></comment></comment>


TSA Randomizer jsfiddle - <AUTHOR> https://jsfiddle.net/8b6kyjwv/1/ <comment><USER2> You could use window.crypto.getRandomValues. [https://developer.mozilla.org/en- US/docs/Web/API/RandomSourc...](https://developer.mozilla.org/en- US/docs/Web/API/RandomSource/getRandomValues) Like this possibly: [https://jsfiddle.net/8b6kyjwv/6/](https://jsfiddle.net/8b6kyjwv/6/)

I am not sure how random it is to just generate 1 at a time like I did in that fiddle instead of an array at a time.

Here's the article on mdn about the getRandomValues. [https://developer.mozilla.org/en- US/docs/Web/API/RandomSourc...](https://developer.mozilla.org/en- US/docs/Web/API/RandomSource/getRandomValues)

> The RandomSource.getRandomValues() method lets you get cryptographically > random values. The array given as the parameter is filled with random > numbers (random in its cryptographic meaning).

> To guarantee enough performance, implementations are not using a truly > random number generator, but they are using a pseudo-random number generator > seeded with a value with enough entropy. The PRNG used differs from one > implementation to the other but is suitable for cryptographic usages. > Implementations are also required to use a seed with enough entropy, like a > system-level entropy source.

</comment><comment><USER3> Feature request :

\- "Randomize" with the help of short helper gesture, or hidden button press ( even better put the human "randomizer" in a separate location, and put the fallback one in case of staff incapacity to attend )

\- Write a more "enterprise" code, at least 3 singletons and 5 class factories

\- Make the application randomly crash and go slower over time so we could sell some support and yearly upgrade</comment>


Elon Musk on working 120 hours a week: You'll go 'bonkers' - <AUTHOR> https://www.cnbc.com/2018/11/05/elon-musk-on-working-120-hours-a-week-youll-go-bonkers.html <comment><USER2> > Musk said while "80 is pretty sustainable," the increase in suffering when > you work more than that is dramatic. "The pain level for hours increases > exponentially. It's like nonlinear above 80," Musk said

Sounds about right. Below 80 you can still set aside a few hours or maybe most of day on the weekend for yourself. Above 80 starts to get interesting. Weekends are no long yours and days bleed into each other.

</comment><comment><USER3> Not really news to anyone who has sustained 80+ hour work weeks long term. It borders on abuse even at 80.</comment>


A Mini-Guide to Google Golang and Why It's Perfect for DevOps - <AUTHOR> https://blog.bluematador.com/posts/mini-guide-google-golang-why-its-perfect-for-devops/ <comment><USER2> the thing i hate most about golang: no generics. the thing i love most about golang: super fast.

Just yesterday, I discovered their date parsing, which uses example based formats. It's pretty cool. Instead of the typical yyyy-mm-dd format nightmare, you would do 2006-01-02. The reference date is the key.

[https://golang.org/pkg/time/#pkg-constants](https://golang.org/pkg/time/#pkg- constants)

<comment><USER3> Generics have their use cases, but in general they are overrated. Especially in (but not limited to) the DevOps area, I bet that 99% of the code needs no generics at all.

Having said that, I would not complain if the concept of Ply ([https://github.com/lukechampine/ply](https://github.com/lukechampine/ply)) becomes part of standard Go.

<comment><AUTHOR> You're right. Although a lot of people have written about this limitation in the language. Applied Go has a tutorial on how to use arrays, slices, or maps as a workaround for many generics need cases, much like it looks like Ply does. [https://appliedgo.net/generics/](https://appliedgo.net/generics/)</comment></comment></comment>


NS Basic App Studio is not fit for purpose - <AUTHOR>

I have been working with NS Basic App Studio for two years, since launch.
My thoughts are this:-
If you plan to do any kind of development which you want to look professional then forget App Studio.  NS Basic App Studio has some major failings, number one on the list being documentation.  The documentation supplied with App Studio is truly appalling, covering basic commands and functions only, and even then, not fully.  The moment you want to dig deeper there is no help for you and even the writers of App Studio say "Search the Internet for answers".  This makes App Studio a 'development' system for amateurs.
If your intention is to develop anything that remotely resembles a professional application then I am very sorry to say you will have to use something else.
I speak as a professional developer of 30 years experience, having developed on all sorts of platforms.  We recently completed a project (not the way we wanted to due to the limitations) using NS Basic App Studio and it took a whole year to make.  The equivalent in almost any other environment would have taken a matter of weeks.  There were times when my team and I wanted to blow our brains out in frustration, mainly with the woeful documentation and zero support offered by NS Basic.
NS Basic bill App Studio as a Visual Basic-like environment.  Do you remember the days when IBM clone-makers were saying that their machines were compatible to the IBM PC and it turned out they meant they both use a 5amp fuse in the plug?  Well that is how App Studio is to Visual Basic.  Whilst App Studio uses the BASIC language, it is so far removed from VB when you start wanting to do anything interesting that it makes the comment "Visua Basic-like" a mockery at best and misleading at worst. <comment><USER3> Odd sort of rant. There is an old proverb about workmen blaming their tools.

You don't say what your target platform is/was and why you did not pick the relevant "mainstream" tool to do your "professional" development task.

NS Basic was a brilliant tool for writing Palm apps back in the day - <USER2> productive. The version targeting early Windows CE devices was a bit "me to" and failed to match the standard of the free tools supplied by Microsoft. I lost touch after that but still give all credit to the developer for the original.

Edit: OK - I have now checked out the web site for NS Basic. Looks like a process that (sort of) generates an HTML/ CSS/ JavaScript (read standard) web app that is then wrapped as a "native" app using PhoneGap.

Given that, why get NS Basic involved at all - just write the app in HTML and add the JavaScript required for functionality. jQuery Mobile would help if the screens are pretty steady. As far as I can see you ended up adding a huge layer of complication to no net advantage. I suppose the lesson is (as always) use the simplest tool set that gets the job done.</comment>


C Program that prints out its source code - <AUTHOR> https://gist.github.com/4686643

<comment><USER2> Actually this source code was asked as a midterm exam question. I tought there was nothing interesting and I still do.</comment>


Ask dang: How many HN comments per day do you read? - <AUTHOR> <comment><USER2> While we're at it - thanks, Dang. You do a lot of hard work keeping HN a place worth visiting. I even appreciated the time or two you corrected me personally.

The comments sections of most online forums are about useless and I know that places like HN don't stay this way by accident.

<comment><USER3> The quality of the comments here is so high that I often preface my Google searches with "site:news.ycombinator.com" when I'm researching technical stuff.

</comment></comment><comment><USER4> I'm not sure. Probably a few hundred.

<comment><USER5> Do you feel reading that many random comments has an impact on you? Hopefully we keep the experience net positive.

<comment><USER4> Yes, because the comments I read are not random: they're disproportionately problematic. That skews my view in an unfortunate direction.

<comment><USER5> Understandable; that was unfortunately my experience with volunteer community moderating.

You should add a script that gives you a random highly-voted comment with positive language to your toolbox. In the interest of balance and sanity.

PS: Thank you for all you do for this community. You encourage our aspirations to be more civil humans.

</comment></comment></comment></comment><comment><USER6> I sometimes read only the comments and not the article. I think that's a bad thing :-(

<comment><USER7> I do that too at times.

Sometimes I'm more interested in the tech scene's opinion on an article than the actual article itself.

Other times, if an article is excessively long, or is a video, I look for someone that summarised the gist.

On that note - am I the only one who would prefer to read transcripts of videos than watch videos themselves? Specifically news sites that only have the video report and not any accompanying text.

<comment><USER8> I would like this too - I can read way faster than I can listen. Listening is awful.

</comment></comment></comment><comment><USER9> also: do you use any special tools to help monitor comments, or just [https://news.ycombinator.com/newcomments](https://news.ycombinator.com/newcomments) ?

<comment><USER4> Lots of special tools. I'm working on revising them so we can open-source the parts that are useful for general reading.

Right now it's a Chrome extension, but I'd love to serve it as plain JS. Anybody know if you can give a web app privileges to open and close tabs without making it a browser extension?

(Don't worry, btw; if we ever publish this it will be entirely opt-in.)

<comment><USER10> You can open tabs using `var w = window.open()`, and close them using `w.close()`

Only thing is users must disable popup blocking for HN, in the unlikely case that you want to open more than 2 links at once, or open links when the user doesn't click something (like onload).

<comment><USER4> That sounds promising. Is it possible to send messages between the tabs? My Chrome extension does that like crazy.

Forgive me for hijacking this thread into technical support territory, but I've found documentation on this stuff hard to come by.

<comment><USER11> >Is it possible to send messages between the tabs?

Save objects to local storage:

localStorage.name = "dang";

alert(localStorage.name);

<comment><USER12> yes, the localstorage is the way to go

You save stuff to localstorage in one tab, and in other tab you listen to "storage" event:

        window.addEventListener('storage', function() {..})

[0] [https://developer.mozilla.org/en- US/docs/Web/API/Web_Storage...](https://developer.mozilla.org/en- US/docs/Web/API/Web_Storage_API/Using_the_Web_Storage_API)

[1] [https://developer.mozilla.org/en- US/docs/Web/Events/storage](https://developer.mozilla.org/en- US/docs/Web/Events/storage)

Another option is shared web workers, though I never used it.

[2] [http://stackoverflow.com/questions/12107424/communication- be...](http://stackoverflow.com/questions/12107424/communication-between- browser-tab)

[3] [https://developer.mozilla.org/en- US/docs/Web/API/SharedWorke...](https://developer.mozilla.org/en- US/docs/Web/API/SharedWorker)

I confused things in my other comment (I deleted it)

</comment></comment></comment></comment></comment></comment><comment><USER13> A _lot_.

I actually optimize for the comments, heh. I open HN links in new tabs and then wait a day or two for the discussion to complete before reading through them. So I don't end up refreshing for new comments or re-reading the same ones.

There are a couple downsides to this though: One, I generally miss the window for participation. Two, my browser is perpetually filled with dozens of HN tabs.

<comment><USER14> Good comment but I think you missed an important part of the question. Unless you're dang's alt account.

<comment><USER15> I don't know who dang is, and I don't go on HN enough for it to really matter to me. I'm not really part of the HN culture, I just come here for the occasional new software that might be of interest to me. It's likely there's a lot of people in the same boat including the person you responded to.

<comment><USER16> Not sure why your comment's light grey, but dang is... a/the moderator or the guy who runs HN or? I know it's something like that, and I just tried to look it up so I could tell you definitively, but I can't seem to find it stated explicitly anywhere here. Seems fair that a casual site user wouldn't know, if I'm not even entirely certain, and I'm on here every day.

edit: OK, I found [https://blog.ycombinator.com/meet-the-people-taking-over- hac...](https://blog.ycombinator.com/meet-the-people-taking-over-hacker-news) which says he's "in charge of the HN community". (I kind of wish I didn't have to turn to a 2 year old blog post to see that stated.)

</comment></comment></comment></comment><comment><USER17> I often read the comments first, and then read the article. I love comments sections in general (Gawker, Gothamist, NYT come to mind in terms of decent commenters), but I've never learned as much as in the HN comments section.

I probably read ~500 comments a day on HN.

</comment><comment><USER18> Depends if anything controversial has been posted that day. Some topics I read get hundreds of comments, some get about 3. So I guess it depends on whether there's a political war going on or some giant controversy in internet land, or whether anyone's staying reasonable for a few days or so.

</comment><comment><USER19> O(n)

</comment><comment><USER20> Depends on my mood ... probably about 10 per day

</comment><comment><USER21> Millions, or so it feels that way.

</comment><comment><USER22> He reads only one HN comment per day, but it is always the correct one.

<comment><USER4> A 'best of the day' feature has been on our minds for a long time. We really need a way to collect the amazing stuff this community produces.

<comment><USER23> This is something (perhaps the _only_ thing) I miss here which reddit has: /r/bestof. Comments, no matter how good, never end up on /news and so anyone who isn't reading the rest of the discussion in question will never see them.

Come to think of it, is there any _technical_ limitation on having comments submitted as stories? Maybe it's just a cultural issue (i.e., there is no culture of submitting comments as stories here).

<comment> s-phi-nl I trust you are aware of [http://news.ycombinator.com/bestcomments](http://news.ycombinator.com/bestcomments) ?

<comment><USER24> Is it possible to implement features similar to the above without being a ycombinator insider? Since upvotes aren't visible on comments, other than comments you made yourself, how could you calculate it? (Are the upvotes on comments available through an API for example?)

</comment></comment></comment></comment></comment><comment><USER25> From the guidelines:

>Please don't post on HN to ask or tell us something (e.g. to ask us questions about Y Combinator, or to ask or complain about moderation). If you want to say something to us, please send it to firstname.lastname@example.com.

This may not specifically fall in that category, but you may still want to email if you don't get your answer here.

<comment><USER4> Come now, let's not punish smeyer for a good-faith comment, even if people did turn out to like this thread.

<comment><USER26> Is it good faith? It comes off as either pedantic or trolling to my eyes.

<comment><USER27> See why is this downvoted? This is what causes self-censorship guys. It's a valid opinion.

</comment></comment></comment></comment><comment><USER28> Less and less.

Too often comment chains devolve into nitpicking, pedantry, and into off-topic discussion where two people fight tooth and nail for Internet Points.

From a technical perspective I get little or nothing from them, and from a discussion standpoint there's little reason for me to spend my time watching people nitpick each other over things that nobody in the community cares about.

<comment><USER29> I get the distinct feeling we're getting more and more of reddit's overflow. If anyone knows any other websites like, HN, I'd love to hear about them.

<comment><USER30> I'm here for almost 4 years now, and I see this comment probably once a month. For such large and diverse community as HN, it is doing exceptionally well.</comment></comment></comment>


The first 100W equivalent LED bulb. - <AUTHOR> http://eon.businesswire.com/news/eon/20110517005723/en/Lighting/LED-bulb/LIGHTFAIR

<comment><USER2> How much power does it draw?

What's the price?

When will I be able to buy it down my local Wilkinsons?</comment>


A Start-Up's Camera Lets You Take Shots First and Focus Later - <AUTHOR> http://www.nytimes.com/2011/06/22/technology/22camera.html

<comment><USER2> Website: <http://www.lytro.com/cameras>

</comment><comment><USER3> Dupe of <http://news.ycombinator.com/item?id=2681554>.

<comment><USER3> (Not sure why this is downvoted; I know it's a different article but it's about the same company's technology and the other article has 70+ comments, so it's useful to refer to its comments.)</comment></comment>


Evolved for sushi - <AUTHOR> http://blogs.discovermagazine.com/notrocketscience/2010/04/07/gut-bacteria-in-japanese-people-borrowed-sushi-digesting-genes-from-ocean-bacteria/

<comment><AUTHOR> Credit to Carl Zimmer for the snappy headline ([http://blogs.discovermagazine.com/loom/2010/04/07/evolved- fo...](http://blogs.discovermagazine.com/loom/2010/04/07/evolved-for-sushi/))</comment>


An Indispensable Guide to Early American Murder - <AUTHOR> http://www.newyorker.com/books/page-turner/the-indispensable-guide-to-early-american-murder <comment><USER2> > "The importance of motive in murder is vastly overrated," he reflects. "What > would move one person to kill another might cause a second only to laugh."

That's food for thought

<comment><USER3> That reminds me of the section on the changing standard of "reasonable" for insanity defenses in the Illustrated Guide to Law: [http://lawcomic.net/guide/?p=603](http://lawcomic.net/guide/?p=603)</comment></comment>


Simple Domains and Value Atomicity - <AUTHOR> http://www.dbdebunk.com/2017/02/simple-domains-and-value-atomicity.html <comment><USER2> Heh. You don't often see articles on data design and normalization that start to edge into epistemology.</comment>


Ask HN:Who's Looking For a Cofounder? (October 2010 Edition) - <AUTHOR> We get a lot of "Who's hiring" threads on HN, but I bet many people are looking to join an early stage startup as a cofounder. In your comment, you should probably mention where you're located, what stage your startup/idea is at, who you're looking for, what you can bring to the table, and your contact info.
I'm posting this because I'm working on a startup solo, and I think finding a good cofounder is harder than it needs to be.
I'll start:
I'm working on a SaaS product to automate buying advertising online, everything from keyword/competitor research to optimization, and I'm looking for a technical cofounder in San Francisco. Think easy to use enterprise-class PPC management for small businesses. I've built a prototype MVP which got very positive early feedback from potential customers. I can code if I have to, but my strengths are in marketing, optimizing, and the business side. I'm currently bootstrapping the startup, and plan to continue to do so until ramen profitability is reached. If you're excited about making sense of massive datasets using technology like MongoDB and node.js, designing the architecture and technical vision of the company, and building the startup from the ground up, I want to talk to you. Python hackers who are amazing with regular expressions preferred.
Email me at ilya [at] unviral.com. <comment><USER2> The biggest problem with finding a co-founder is that there is often some sort of reputation or comradere already existing between the individuals and often never begins on the premise of building a business together.

A common interest like programming, design, technology, some specific market will bring the two together, find a common problem and resolve to work toward solving that problem knowing _already_ what sort of working relationship there will be beforehand.

Co-founders will need a fantastic amount of trust and loyalty to work well together in the long term. This formula is difficult to satisfy with this method. Not trying to crap, but I'm currently fighting down this road myself and have resolved to let the process work organically rather than trying to find serendipitous luck (semi) anonymously on HN.

<comment><USER3> +1. However it's not easy for all of us to make "co-founder potential" relationships organically. In fact, most of my friends are not tech savvy or entrepreneur minded.

<comment><USER2> I have the exact same problem. While my friends all have fantastic minds, none are particularly interested in the "risk" of starting a business when they are just getting on their feet. I try to involve myself in local societies and organizations which have the sort of individuals I want to work with.

Alternatively, there are other online forums which add a nice structure to the process of finding a co-founder. Tristan Kromer has put together <http://startupsquare.com> which he has made promising progress in. I've also put in an application with the (fairly new) <http://cofoundersnetwork.com>. There's an entire section of questions based around this here: <http://www.quora.com/Finding-Co-Founders/>

And while the option isn't available for everyone, sometimes going to the mountain instead of waiting for the mountain to come to you feels more productive. I intend to move to Boulder, CO where these crowds are much more abundant than where I am and do some schmoozing there to grow my network. And if schmoozing is hard, I hear Toastmasters is a fantastic experience everyone should try.

Hope this helps.

</comment></comment></comment><comment><USER4> Chicago, IL (willing to work with someone virtually as well)

GeekStack is an online trading card game where players become the heroes of science and technology. It's also a platform that can host any trading card game.

I've been working on it nights and weekends for a year and change. I have a working game engine and I'm coding the web server and front end now. Bootstrapped, incorporated, etc. Looking to launch this fall.

My ideal cofounder would be someone with illustration, graphic design, and creative direction skills. A web programmer (I'm using Ruby on Rails/Heroku/EventMachine/PubNub) with some sysadmin skills would also be great. Love gaming and education, of course.

If interested, email email@example.com

<http://geekstack.com>

</comment><comment><USER5> Looking for a biz dev/marketing/sales co-founder in Boston or San Francisco.

Short term, I've got a profitable iPhone app that has over half a million downloads and will be working on converting free users to paid subscriptions.

Long term, I am looking to disrupt the Dell/HP model of selling physical computers by selling virtual computers.

Disrupt the web by freeing developers to use any technology to develop applications that can be accessed instantly.

Disrupt the social by making users control their own content and run services on their virtual computers to manage their social graph.

<comment><USER6> You live in Boston or SF? Interested in talking to you more but couldnt find your email on AlwaysOn. Shoot me an email: leo at groupie dot mobi

</comment></comment><comment><USER7> I am looking for a technical co-founder. Someone who shares the entrepreneurial passion, is ready to work hard and do whatever it takes to build a successful startup, is open to ideas, has a sense of humor and an appetite for the early stage, pre-funded startup roller-coaster ride.

The idea is of a consumer app that leverages our social network and social graph. It's been validated by potential users and few senior executives. A basic initial version of the app is almost ready and will be launched privately in a month.

I have a business background. Have worked with startups. Besides, I started 2 small ventures during my teens. Doing whatever it takes to make things happen, is something I consider as my strength. I believe in a fair and open work culture - and communication is very imp. I am extremely passionate about consumer apps that are fun + useful. I am currently based in Bay Area - US, and plan to relocate to India in November (due to visa constraints). The startup is incorporated in US, and I do intend on coming back to bay area, once we raise some funding.

So, if solving challenging problems excites you, and you are entrepreneurial and have always wanted to build/start something of your own, but got busy with 9-to-5 and life in general.. and you've been looking for the right idea / opportunity / time... and you are super-duper hungry ( <http://gapingvoid.com/2009/05/11/welcome-to-the-hunger/> ) ....then, drop me a note! Share a bit about your background, and why you are interested. Email: mnnmsemail at gmail dot com

<comment><USER8> i am not able to see you contact info... Mine is singh.mahesh [at] gmail.com

<comment><USER7> My email: mnnmsemail at gmail dot com

I saw your linkedin profile, looks like you started your own venture early this year. Why are you looking at another one right now?

</comment></comment></comment><comment><USER9> I'm looking for European cofounders or partners that would like to be part of a startup involved in one or more of the following:

Making a commercial version RepRap machine and selling it. There are numerous ideas and designs floating around for bootstrapped 3D printers, begging for a company to put them together in a nice retail package.

Running a coworking office for startups and freelancers.

Running a hackerspace with lots of cool tools such as 3D printers, open to both paid members and the public.

Running a small fab-lab for on-demand rapid prototyping and fabrication services.

\---

I'm still at the research phase, so I don't have much existing work to show you. I've started wikifying some of my research notes which you can find here: <http://punkmanufacturing.com/> . I've also found two plastics companies that might be interested in supplying base printing materials for us to resell. There is also the possibility of developing new printing materials or tweaking existing ones.

I'm looking for someone who is passionate about any of the above subjects. Qualifications, background, etc don't matter as long as you have some skills applicable to this hypothetical startup. You must be able to work in the EU, so European citizens preferred. Personally, I'm willing, and able, to relocated almost anywhere in the EU to work on this.

Contact me at <http://disattention.com/contact/> or point me to your contact info.

</comment><comment><USER10> What should I wear? I find myself asking that question all the time. First date? What should I wear? Job interview? What should I wear? Friday night out? What should I wear? Wouldn't it be cool if 500-1000 of your peers could make sure you look as good as possible before you leave your house?

So I created <http://www.TonightsOutfit.com> \- a website that attempts to answer that question using peer review.

I've got a business plan/financial statement, I'm incorporated, the design is complete, the front end code is complete. I have money for marketing/hosting and any other expense that may occur. I've got beta testers too.

I have everything needed for a v1 launch except the backend.

I am interested in someone who can build the backend, bonus points if you are able to do design/front end.

I could talk forever and ever about the project, if you are interested in knowing more I'm available @ Nick [at] tonightsoutfit.com

I'm located in Seattle.

References available on request.

<http://www.tonightsoutfit.com>

</comment><comment><USER11> I'm working on building an open-source social learning platform on Drupal. I'm moving to the bay area in the next ~6 months but am in Utah for now. If you're passionate about making quality educational technology available the world over, please send me an email. email@example.com

<comment><USER12> In what way are you planning on distinguishing yourself from the rest of the learning platforms? What type of learning will your platform be geared towards?

<comment><USER11> A few reasons: * It's open source so cheaper + no vendor-lockin + it can be built for a wide variety of purposes vs. a monolithic single purpose app. * It's extensible. You'll be able to download a wide variety of Eduglu- compatible apps built either by me or other people/companies.

It's geared toward social learning. Where we learn by observing and talking to fellow-learners.

</comment></comment></comment><comment><USER13> I'm working on building a next-generation statistical computing environment. The ideal cofounder would be a PhD candidate focusing on machine learning, statistics, or quantitative methods, and be well-versed in Bayesian statistics.

Based in Cambridge, MA. Web: www.statsia.com Email: firstname.lastname@example.com

</comment><comment><USER14> I'm working on something inspired by RFS2:

<http://ycombinator.com/rfs2.html>

My email's in my profile for anyone interested working on this with me. I'd like to think I have a decent grasp of the business side whilst I know I need technical help.

</comment><comment><USER15> I am. I'm in SF (working out of my apartment in the Haight).

I'm building Quirk ( <http://www.getaquirk.com/> ) and I've got a related side project, a QR/URL-shortener - <http://qrk.co/>

Quirk is Rails on Heroku. qrk.co is Sinatra on Heroku.

Cofounders could come in a few forms. I'm a developer, but somewhat new to web dev. So someone with a deep technical background for web development with prior startup experience would work. Alternatively, someone with a really strong UX/design vision and some skills to drive the frontend would be great, too. I've been learning the necessary skills as I go.

There's contact info in my profile.

</comment><comment><USER16> Wouldn't it have been great (in terms of equity, leverage etc.) if you were at Google (search) in 2001-03 or Foursquare (location) in 2008?

What we are trying to solve:

\- Given relevant experience, find and apply for a job in a field that's soon (within a few months to a year) going to be "hot."

\- Given somewhat relevant experience, find and apply for a job in a field that will act as an intermediary to a future "hot" field.

.

LinkedIn, Indeed/SimplyHired etc. haven't concentrated on this problem space yet.

We (one tech, one design co-founder + advisor) are working on solving many such hard problems that involve everything from trending, forecasting to decision analysis. Email me if you're interested in being a tech co-founder: email@example.com

</comment><comment><USER17> I'm building a unique content site based around live video. I've done a good deal of the backend, but I need an awesome UI/UX partner to breathe some personality into the site.

You should know Jquery, CSS, and have a great design sense.

devjones100 [at] gmail.com

</comment><comment><USER18> Working on a SaaS product for data analytics. Looking for a business/sales/marketing co-founder who knows a bit of tech. If they know a bit of frontend/design that would be awesome. The backend is already written but is still evolving.

The tech stack is Pylons/Python, SQLAlchemy, Redis, and a very small piece of node.js.

Feel free to check my HN profile for my e-mail (or just chat me up on gchat if you are interested). I am in San Francisco.

</comment><comment><USER19> In Waterloo, Canada: <http://mycampus.cyphontech.com/>

We're building mobile technology for universities and colleges in North America. The company is completely bootstrapped and consists of a group of close friends. We are motivated, have a working demo we're pitching already, and looking for a talented Java/PHP/browser programmer to join us!

Contact: firstname.lastname@example.com

</comment><comment><USER20> I am. I've begun development and have working prototypes for #1 & #2 of the 3 ideas. I'm looking for rockstar marketing/sales talent and rockstar graphic design talent.

The three startups:

1) Automated UI testing (can't say more) 2) HTML5 canvas to create a handful of small web products. (can't say more) 3) Beer oriented (can't say more).

#1 & #2 can be bootstrapped. #3 I want to develop a little further then pitch to a YC or a Techstars.

jeff.a.bail {at} gmail.com

</comment><comment><USER21> I'm working on a very scalable idea for consumer financial services - a bit similar to Mint but in a different category. I'm a marketing/biz dev type with a technical background, but I'm looking for a pure tech partner who can help with the build. Already shown the idea to a few angels - have strong interest, now need to build a team.

I'm in Boston - hit me at droskill at g mail dot com if you have any interest.

</comment><comment><USER6> New York, NY

My partner and I founded Scriblink.com (the number one online whiteboard) and Groupie (a social network currently on the iPhone).

We are looking for a long-term technical partner who shares our ambition, discipline, ability to execute and work ethic (you dont have to be as intense as us). In essence, we're two projects into what will be a life time of serial entrepreneurship.

Hit me up if you want to talk more or meet for coffee.

leo at groupie dot mobi

</comment><comment><USER22> I would like to work on social application, either game, educational, or productivity related.

Right now I am working on some exciting stuff for UCSF and Harvard.

I have a few ideas around augmented reality, vr, music, games, social calendars, openid and a language learning app i am working on.

I would like to pick a cofounder before settling on something, until then. I am just hacking around and writing code that is fun.

you can find me on twitter @jdavid

</comment><comment><USER23> I'm working on a SaaS product to improve brokers' experiences on craigslist - providing rich analytics and lead qualification. We are currently in closed beta and are looking to expand our current offering. Based in both San Francisco and New York, we are looking for a third co-founder, preferably technical (python hacker) and familiar with the real estate space. See profile for email.

</comment><comment><USER24> If you're looking for something a little different, I'm working on low-power high performance computing for military and intelligence applications.

Place: Washington, DC (but virtual may be possible at first)

More details available to anyone who wants them.

bryan.t.burke [at] gmail.com <http://www.linkedin.com/in/bryanburke1>

</comment><comment><USER25> I'm looking for someone focused on marketing with an interest in family and social networks. The startup is a family sharing/storage app called Genevine <http://genevine.com> \-- almost 100% built and on 2.0 but need a marketing- focused co-founder. email@example.com

</comment><comment><USER26> Building a web application for table-top-style gaming, badly in need of another developer and/or a designer (esp. the latter). Nothing to offer but sweat equity and a fun problem space, but getting close to MVP. - luke |at| lukifer.net

Stack: jquery/codeigniter/mongodb/nodejs

Location: Denver CO & Ventura CA (remote ok)

</comment><comment><USER27> Denver, CO

I'm looking for someone to join me in the creation of small, indy games for any platform of interest. I am a programmer with a lot of experience writing games in C++, Java, Objective-C and C#. I am on the verge of releasing an iPad game (beta tests start next week).

</comment><comment><USER28> I'm looking to join as a co-founder in a biz develop / marketing / sales role. Currently submitted to YCombo for 2011 but willing to drop for an already established YCombo funded startup.

Contact info in my profile.

</comment><comment><USER29> I am looking for someone to work on an online electronic design automation platform. A background in electrical engineering would be helpful.

</comment><comment><USER30> Coding up www.getsetapp.com and possibly entertaining the idea of bringing on a more technically skilled co-founder. Contact info in profile.

</comment><comment><USER31> I'm working on a utility that will convert legacy business systems to SaaS apps. Big + for Pittsburgh. See my profile for contact info.

<comment><USER32> I never knew you were around here. Small world.</comment></comment>


The new study suggesting sitting will kill you is kind of a raging dumpster fire - <AUTHOR> https://arstechnica.com/science/2017/09/the-new-study-suggesting-sitting-will-kill-you-is-kind-of-a-raging-dumpster-fire/ <comment><USER2> Honestly, ars technica is "kind of a raging dumpster fire." Over the past few years I've watched them transform from producing measured, interesting, informative articles to producing politics-laden "reactionary youth" idiocy, akin to Vox or Mic. Another one bites the dust, I guess.

<comment><USER3> I think that's the destiny of every platform as it becomes more popular, at least HN is still probably the best there is (if not please do link =D)

</comment></comment><comment><USER4> This is one of the most unprofessionally written science journalism pieces I've ever read; it was unbearable and I couldn't make it past the first third.

</comment><comment><USER5> For those that are interested, the full original journal article is available here: [http://sci-hub.io/10.7326/M17-0212](http://sci-hub.io/10.7326/M17-0212)

</comment><comment><USER6> Just leave out the words, "sitting will kill you," and now you have a broadly applicable statement for most of the soft "sciences" today.

</comment><comment><USER7> Does the author think people usually stand to drink soda?

<comment><USER8> The author claims that Coca Cola funds studies that diverts public health agenda to other topics, so they won't discuss the harmfulness of sugary beverages.

<comment><USER9> The cynical view would say that it's in Coca Colas best interest to reduce any other harmful behavior since if people who drink coke live longer they'll drink more coke.

Philip Morris ironically is also a huge fundraiser for cancer research.</comment></comment></comment>


Bitcoin in India: Drivers and Barriers to Adoption - <AUTHOR> http://thegenesisblock.com/bitcoin-in-india-drivers-and-barriers-to-adoption/

<comment><USER2> I don't think the gov of India will ever understand the fundamental idea or the potential of Bitcoin. PayPal had issues with the regulatory bodies until very recently. Considering the red tape an average Indian has to face to open a bank account and the sheer number of ID cards issues by the gov (PAN, Aadhaar, UID etc), the financial regulatory system is a huge cluster#$@*, which I don't see changing anytime soon. Bottom line, I will be very surprised if some high court in India or the Financial ministry doesn't make it illegal in the next few years.

<comment><USER3> One thing you can do is buy Okpay locally in India and then use that to buy/sell bit coins on BTC-e exchange.

</comment></comment><comment><USER3> To transfer money out of India through a bank you need an invoice, proof of income and basically gov permission.

<comment><USER4> It's very easy if you join the Congress party. You won't need anyone's permission and no one will ever try to investigate you.

</comment></comment><comment><USER5> As an Indian, I feel offended by the first illustration. Taj Mahal is our national pride and photoshopping a bitcoin on top of Taj Mahal is the most insensitive thing the author could have done.

<comment><USER6> I'm an Indian. I don't give a crap about photoshop. What you should really feel offended by is the _actual_ harms being done to the monument.

<comment><USER7> As a non-Indian, I'm somewhat offended by the technical deficiency of the photoshop (they couldn't even be bothered to take care of the reflecting pool?) and the (imho) subpar analysis in the article itself.</comment></comment></comment>


Greek Artist Takis, Who Used Magnets to Create Pioneering Kinetic Art, Has Died - <AUTHOR> https://news.artnet.com/art-world/kinetic-artist-takis-died-1621450 <comment><USER2> If you are in or plan to visit London please pay a visit to this exhibition of his works:

[https://www.tate.org.uk/whats-on/tate- modern/exhibition/taki...](https://www.tate.org.uk/whats-on/tate- modern/exhibition/takis)

While all us techies have probably spent a lot of time studying (electro)magnetism, seeing seemly heavy objects suspended in mid-air is still a magical experience.

</comment><comment><USER3> Here's a video: [https://www.youtube.com/watch?v=Q5ktkR- xSoM](https://www.youtube.com/watch?v=Q5ktkR-xSoM)

</comment><comment><USER4> Is this serious?:

      After a moment, she started weeping. I think she was just so tired. Then a guard tapped me on my shoulder and just said 'the performance is now over, sir.' I think she needed to reset. She didn't cry for everyone, though. I got a cry.

<comment><USER5> Why wouldn't it be? The performance was called "The Artist is Present". It was all about actually having an encounter between the artist and members of the public. Abramovic does a lot of performances that are physically demanding; this one was emotionally demanding as well. I suppose the line "I got a cry" is meant in a wry sense, but it's not a misrepresentation of what the performance was about.</comment></comment>


How to Screw With People Who Try to Steal Your Wireless  - <AUTHOR> http://www.ex-parrot.com/pete/upside-down-ternet.html

<comment><USER2> Why would I want to? I share my network and my neighbors share theirs. I get to help provide the kind of ubiquitus wifi I want everywhere and get connection redundancy while I'm at it. "steal?" that's just paranoid propaganda.</comment>


How To Set Up Your Linode For Maximum Awesomeness - <AUTHOR> http://feross.org/how-to-setup-your-linode/ <comment><USER2> Some random selections from my notes on building Linode web servers:

\- Set up reverse DNS in the Linode manager: select the Linode, click on "Remote Access", click on "Reverse DNS" (under "Public IPs")

\- Linodes don't offer very much disk space; use localepurge to keep the filesystem on a diet: # apt-get install localepurge

\- After installing and setting up MySQL, don't forget: # mysql_secure_installation

\- After installing Apache, change the following in httpd.conf: ServerToken -> Prod, ServerSignature -> Off, KeepAlive -> Off

\- After installing PHP, edit php.ini to make it shut up: expose_php -> Off

There's a bunch of other fiddly stuff to do, and a seemingly endless combination of packages and strategies depending on what you're trying to accomplish. For instance, I currently run a stack with Postfix for MTA, awstats+jawstats for beautiful server-side site statistics, mod_deflate, mem_cache, fcgid/suexec to make it harder to break the server if a site is compromised, PureFTPd for really easy managed-by-MySQL FTP access, and a pile of other little minor tweaks and knobs turned.

MOST IMPORTANTLY: Backups, backups, backups. If you don't already have your own in-house backup service for your server (and I bet you don't!), then please take advantage of Linode's backup services: <http://www.linode.com/backups/>

<comment><USER3> Two other suggestions would be:

1\. Test how your VPS comes back after a reboot. When you make big changes and at least every 6 months due to all the upgrading that ubuntu does by default it can break the bootup process and you won't know until that emergency unscheduled reboot at 3AM.

2\. As long as you're customizing the firewall you should block pings entirely.

* Really, since the distributions are very compatible I would urge you to consider a distro that has selinux enabled by default. Fedora Core is a great place to start. It also has better tools to manage security and gives you good resume skills.

<comment><USER4> >> 2\. As long as you're customizing the firewall you should block pings entirely.

Why?

I've never seen a threat model where filtering icmp doesn't end up being more trouble then it's worth. Then there is even the maintenance headache when basic but powerful tools like ping and traceroute are rendered useless.

It's the same BS as with fail2ban, thankfully the OP wasn't spreading the gonorrhea of port knocking/single packet auth. Lock down your sshd like everything else: Disable root, disable tunneled cleartext passwords, enforce proper key usage, use AllowGroups/AllowUsers.

EDIT: The BS with fail2ban is moving the ssh port around. I understand this being a problem, but surely iptables has something similar to OpenBSD pf's:

block in quick from <brutes>

pass in log on $if_ext proto tcp from any to ($if_ext:0) port ssh keep state \ (max-src-conn 3, max-src-conn-rate 4/32, overload <brutes> flush global)

<comment><USER5> Mind explaining your issue with single packet auth? Port knocking by definition is an extra layer of security through obscurity, in that gaining access requiring hitting the sequence of ports to "knock". Depending on the implementation, this either is very vulnerable to MITM/sniffing attacks (static knock sequence) or quickly gets really complicated (fully dynamic knock sequence).

SPA, by contrast, uses actual crypto to securely authenticate the user with the server. I'm a fan of fwknop, which uses GPG to sign a request packet which is read and understood by the server. It protects against 0 day attacks on OpenSSH, lets me drop 22 inbound to eliminate all those pesky attackers, and allows me to securely authenticate with the fwknopd.

<comment><USER4> Sure.

> "Port knocking by definition is an extra layer of security through > obscurity"

Security through obscurity is not security, it's at best theater.

> "It protects against 0 day attacks on OpenSSH"

You substitute one problem for another, 0 day attacks on the SPA. Your model isn't safer, it's just different.

And personally, I trust the OpenSSH guys way more then any SPA vendor simply because they have a very good track record.

<comment><USER6> You're making no sense. Moving the SSH port is a trivial way to reduce your attack surface (undirected bulk scans go for 22).

<comment><USER4> If undirected bulk scans are a serious threat to your security, something is up.

Properly configured (AllowUsers, Disable root, no clear text passwords only keys etc), I'd say that the undirected bulk scans pose no security risk at all, they are only a nuisance in terms of spamming your logs, which is easy enough to deal with.

What I'm really trying to say is that each "trivial way to reduce your attack surface" has both cost and benefits.

I'm contending that moving the ssh port around gives you the benefit of less log spam with no security gain, and costs in terms of documentation and maintenance.

When I do this Cost/Benefit analysis, I conclude that moving the port around has more costs then it does benefits, so I don't bother.

<comment><USER6> _undirected bulk scans pose no security risk at all_

A future bulk-scan may leverage a new SSH-exploit before you know it exists.

To put it explicitly: You should disable passwords and change the SSH-port. That's the two measures that make sense, to reduce surface and prevent password brute-force.

The rest of your recommendations is security theatre. An attacker dedicated enough to find your SSH-port and be set back by !AllowRoot will just brute- force an allowed username - if that's even a prerequisite for the given ssh- exploit.

<comment><USER4> > A future bulk-scan may leverage a new SSH-exploit before you know it exists.

Sure, this is true. I consider this a "minor" issue, truth be told (I didn't want muddle up the conversation) I don't tend to run sshd faced towards the 'public' internet and in the cases where I do, ssh access is restricted to certain hosts/networks, and is enforced by a firewall.

> The rest of your recommendations is security theatre

Can you state why? I think they all provide measurable/real benefit, if this isn't the case I'd welcome some education.

Hm. I will give you that AllowUsers,AllowGroups is not a very good benefit in this case, I mainly enforce the usage of those directives to protect against problems such as bogus user account creations (exploit created or something simple as a admin mistake).

>An attacker dedicated enough to find your SSH-port

And Now for Something Completely Different.

Protecting against a dedicated attacker is a totally different ball game then protecting against drive-by's.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is great SEO.

The author's website ranks first for "Linode Hosting Review".

He'll receive a commission for sales generated through his site, and being that his strategy is so targeted, it should convert well and deliver value to both him and Linode.

And he does it without ever having to resort to spam, the very opposite in fact; he does it through high quality content.

Good work feross!

<comment><USER8> Good for him for generating the content and getting the rankings. I don't think it's that competitive though. I launched my site last week and I am on page 2 for the same term.

</comment></comment><comment><USER9> The bulk of this article has been copied directly from:

<http://library.linode.com/getting-started> <http://library.linode.com/securing-your-server>

<comment><AUTHOR> "I originally compiled this guide as a .txt file of notes for myself, but decided to share it in case anyone finds it useful. If you're looking for something straight from the horse's mouth, Linode [offers guides](<http://library.linode.com/>) that cover how to set up a new server, but some of the info is out of date."

</comment></comment><comment><USER10> Huh, I never realized that "maximum awesomness" was synonymous with "basic functionality".

<comment><USER11> Veterans of Hacker News - why am I not allowed to down vote?

<comment><USER12> There's a karma threshold before you're allowed to downvote.

<comment><USER11> Could you tell me what that number is?

<comment><USER13> It goes up over time. Right now it's around 500.

<comment><USER14> For comments or posts?

<comment><USER13> Comments. I believe the threshold for flagging submissions is 1000, but I'm not sure; I didn't notice when I hit it. You cannot downvote submissions.

<comment><USER15> Flagging is considerably lower, this account can flag comments and submissions so I think ~20 karma is required to flag.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Or even easier use one of many StackScripts[1].

But what I would really like to see is a decent introduction to Salt, Puppet or Chef. This way people that are going to deploy their first server could easily build and rebuild the instance and don't end up retyping shell commands from a blog article.

Also a note on the default Apache setup. There are several "flavors" of the server. If you are going to host Python sites with mod_wsgi then the apache2-mpm-worker package is a lot beter choice than the traditional prefork model.

[1] <http://www.linode.com/stackscripts/>

</comment><comment><USER17> Pro tip: instead of changing ssh default port, setting up fail2ban and messing with iptables rules manually, just use ufw. You're welcome.

<comment><USER18> Is that a Ubuntu only tool? I'd be hesitant to commit myself to anything that runs in a single distribution if I can help it. Fail2Ban would work if I decided to migrate to Centos later down the line. <https://help.ubuntu.com/community/UFW>

<comment><USER19> It's an Ubuntu only tool in the same way that aptitude and dpkg-reconfigure are Ubuntu only tools.

The guide is not claiming to be generic, it's totally fair game to use specific tools imho - especially if they simplify things.

<comment><USER20> >the same way that aptitude and dpkg-reconfigure are Ubuntu only tools.

No. ufw can run on other distros, its just a frontend to iptables. A quick googling makes it look like its there in Arch repos, you have to compile yourself on CentOS. I don't know about all distros YMMV.

Even if ufw was Ubuntu specific, it would not be Ubuntu-specific in the _way_ that aptitude and dpkg-reconfigure are. Those tools are Ubuntu specific because they're specific to that package manager.

And in actuality those tools aren't Ubuntu-only either. apt is the debian package manager and the tools should be present on any debian-based distro.

<comment><USER21> I'm pretty sure you completely misread that post.

"X is Y the same way that (false statement)" -> X is not Y

<comment><USER20> The number of completely wrong generalizations about distributions I hear by people being sincere prevents me from reading that as anything but one. People saying "only Ubuntu X" when they really mean "only debian-based X" is one of the most common mistakes I hear.

If I did misread it, that's an even worse thing to say. If a person is in the position of asking if ufw will work on CentOS, it is downright _mean_ to give an answer that requires them understand esoteric particulars of the debian bloodline.

<comment><USER21> I don't know if I would call the package management system of debian esoteric in a conversation comparing distros. I will agree that the wording was a bad choice.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Might I make one suggestion:

Make sure your SSH port is below 1024 (but still not 22). Reason being if your Linode is ever compromised a bad user may be able to crash sshd and run their own rogue sshd as a non root user since your original port is configured >1024.

<comment><USER23> thanks for this tip I never realized this. More in the link if interested

[http://unix.stackexchange.com/questions/16564/why-are-the- fi...](http://unix.stackexchange.com/questions/16564/why-are-the- first-1024-ports-restricted-to-the-root-user-only)

</comment></comment><comment><USER24> Thanks for the advice on the out of memory reboot. I probably have Apache misconfigured, or my app is slowly leaking memory, but I've run into random downtime and an unresponsive server as apache runs out of memory.

One of the most annoying things I'm running into with Linode and other VPS services is dealing with my drive running out of space. I've been moving all my database stuff to Heroku and I'm much happier (plus the automatic backups are a dream).

</comment><comment><USER25> I find my Linode really useful for x11 forwarding to use Firefox in public places, or to get around web filters. Might be worth a mention of how to do this.

<comment><USER26> Write a blog post.

<comment><USER25> Though it is late, and I've been out at bars with friends, I made this for you:

<http://dzoba.com/?p=182>

<comment><USER27> What is the advantage you see of tunnelling X like that over just tunnelling the network connections with ssh -D?

<comment><USER28> Not all of the web browser traffic goes through the tunnel when you set a proxy in the browser. DNS queries for example do not. Flash programs such as video players also connect directly to the remote website and do not use the proxy. If you don't know those two facts you might be leaking way more information than you want on the local network!

<comment><USER29> Firefox defaults to not proxying DNS, but if you set "network.proxy.socks_remote_dns" to true in about:config, it will happily do so for SOCKS proxies. If you use FoxyProxy (which is pretty damn useful if you proxy over an SSH tunnel regularly), it has a checkbox that enables or disables it per-proxy.

</comment></comment></comment></comment></comment></comment><comment><USER30> It is so easy and dangerous to mess up setting the firewall from scratch, why mess with it.

Use the free, awesome CSF (configserver firewall) instead.

<http://www.configserver.com/cp/csf.html>

</comment><comment><USER31>
        echo /etc/hostname

really?

<comment><USER32> People make mistakes like this all the time. Obviously he meant to type cat /etc/hostname

<comment><USER33> It should be to run the `hostname` command, nothing more.

<comment><AUTHOR> Nice. Didn't know about this.

<comment><USER33> Ironically that command is used to set the hostname but not read it.

Next you'll tell me you don't even know what `uname` does!

<comment><USER34> Everyone is learning something here, no need to insult someone because they might not know something you know. I bet you don't know something he knows.

<comment><USER33> No room for a bit of sarcasm or smarmy, now is there?

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> "On Windows, you'll want to use putty [...] criminals often try to guess the root password using automated attacks that try many thousands of passwords in a very short time. This is a common attack that nearly all servers will face."

yet another tutorial I wonder who's the target audience. if somebody doesn't know the term brute-force or how to open a terminal app and connect with ssh, IMO they are not supposed to set up their own servery by themselves.

<comment><AUTHOR> "they are not supposed to set up their own server..."

What about people setting up a server for the first time? How else are they supposed to learn?

I built my first site when I was 14 and moved to a VPS when I was 17. Until I moved to Linode, I never had a reason to open Terminal.

<comment><USER35> > What about people setting up a server for the first time? How else are they > supposed to learn?

oh wow. well, I'm kind of old fashioned, but maybe they could start with learning basics of how the internet works, what is ssh, what the hell is linux, and by then somebody will know why you need to open that wierd terminal where there is only text and no cute rounded cornered buttons.

I don't get why[1] some tutorials try to cover everything almost from 'first, turn on your computer' to 'deploy your scalable social dynamic api-driven mumbo jumbo architecture web app', and there have been a few around here. there is a place for basic education and there certainly is a place to help somebody kickstart in a particular tech when he's got the basics covered - what's the point of mixing the two?

[1] actually I do. clickity click.

<comment><USER11> I'll ask again, Hacker News. I've been on this site for three years. I've derived an incredible amount of knowledge from just being here and reading. Lately though, I'm enjoying it a lot less.

I'm not sure if my tolerance for snarky, dipshit comments like this has gone down lately, or if there are a lot more snarky dipshits on this site now. The only thing I know is that for some reason I am unable to down vote these comments - my only active recourse.

Is this a bug or is there some magic karma threshold that I still haven't hit?

<comment><USER12> Well, since you already know about the karma threshold, which is apparently 500 right now (it has risen over time), and you're getting downvoted for asking about it, let me tell you that downvoting other people isn't all it's cracked up to be...

Meanwhile, I'll steal this from a real HN veteran... I know there's been a lot of talk about the quality of comments or about the increased negativity, but I still really subscribe to this theory, which I take no credit for.

              Quality of Hacker News Comments Over Time

       |                   . .
       |                  .   .
      q| . .             .     .
      u|    .           .       .               . . .
      a|     .         .          .           .       .
      l|      .       .              .      .           .
      i|       .     .                  . .               .
      t|        . . .                       you are here -->. .
      y|                                      (that's all)
       |________________________________________________________
        J A S O N D J F M A M J J A S O N D J F M A M J J A S O

<http://news.ycombinator.com/item?id=4365778>

<comment><USER36> Is there some sort of source on this graph or is it a prove-a-point type thing. Just wondering, because if there was some way to measure quality of posts over time (up/down vote ratio?) that would be a really neat metric.

<comment><USER37> It's a reference to the notion of Eternal September, from usenet lore. To summarize from memory perhaps incorrectly, usenet used to be great but get worse qualitatively when school would start in September. Its quality would increase throughout the year as people learned to communicate appropriately. One year, however, it just never got better...

<comment><USER38> ... when AOL started offering access to Usenet.

(In reality, Usenet was pretty great through most of the '90s; warez killed Usenet, not newcomers).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> My only gripe with linode is that they are unable to handle DoS attacks. If you're subjected to an attack, your linode will be shut off (null routed) for 24 hours. After that time, they'll check to see if it's still being attacked.

I really think they could do a lot better than that. Apart from that gripe, they're a great VPS host.

<comment><USER40> What is your suggestion?

sounds like they have a clear policy in place; most places it's a vague judgment call. But most places will kick any user that gets hit with a DoS attack that is large enough to disrupt service to other customers.

I mean, I agree that 'finishing the job' and letting the attacker win by null- routing the target is... a suboptimal way to deal with the problem, but with pipe-filling attacks? if the attacker can send more bytes than your pipe can handle, there is really no other realistic way to handle the problem. (I mean, you can try to trace down the source and call up the ISPs the packets are coming from, but BCP38 is still not widely implemented, so good luck tracing a spoofed source more than one or two hops up, and meanwhile, as you are calling people up and trying to get through to someone skillful enough to figure out where a spoofed packet is coming from, you are down.)

There are 'clean pipe' services, where someone with a very large pipe says they will programatically detect and block DoS traffic, then pass along the good traffic to your (much smaller) pipe, and yes, those services can work /if/ the service provider has a larger pipe than the attacker. Of course, buying such a service from a service provider with a sufficiently large pipe is, as you can imagine, quite expensive. Buying such a service from someone that has less available bandwidth than your attackers are able to throw at the problem, of course, is completely useless.

So yeah, uh, assuming you can't afford to be on a 'clean pipe' that is backed by a huge network, you are much better off with an ISP that proactively shuts down DoS targets than one that doesn't. Unless, of course, you are a DoS target.

I mean, the economics of pipe-filling denial of service attacks, right now, are heavily tilted in favour of the attacker. It is a problem that needs to be solved, but I don't know how to solve it.

<comment><USER39> Other services, for example Amazon ec2, just deal with a DoS, and charge you for the traffic.

Also, null-routing for 24 hours regardless of if the attack only lasted 2 minutes, is a little silly.

<comment><USER40> in the case where the attack is larger than your provider's pipe, they can't "just deal with it" - I mean, without blackholing the target IP address. If your transit ports are full, you are dropping packets. Undoubtedly, this is an advantage that larger providers (like amazon) have. On the other hand, most VPS customers would not want to pay $0.13 per gigabyte for DoS traffic.

>Also, null-routing for 24 hours regardless of if the attack only lasted 2 minutes, is a little silly.

It is a rather big deal for a hosting provider to lose connectivity for two minutes.

</comment></comment></comment></comment><comment><USER41> If anybody needs it, [http://webcache.googleusercontent.com/search?q=cache:feross....](http://webcache.googleusercontent.com/search?q=cache:feross.org/how- to-setup-your-linode/)

</comment><comment><USER42> ssh-copy-id could be used to copy the SSH key

<comment><AUTHOR> FYI, ssh-copy-id isn't available on OS X by default. So, it's easiest to just do it by hand.

</comment></comment><comment><USER43> Remind me again why anybody is still using Linode ?

Poor uptime and a disgraceful attitude towards security. ANY service provider that hides the facts behind major security incidents from their customers should never be used.

I guess their new customers will soon realise how crappy it feels to find out from Reddit that your VPS is potentially hacked.

<comment><USER44> Who would you suggest then instead of Linode? I was thinking of renting their smallest one to have something to fart around with.

<comment><USER45> Prgrmr.com

<comment><USER46> Is this a joke? Looks like a malware site.

<comment><USER47> That does look like a malware site. It was a typo. Here's the correct URL:

<http://prgmr.com/>

<comment><USER48> That one looks quite good, I like the Ascii art design and the "the 64M option is an 'advanced option' - we don't have any distros setup that work well in 64 megabytes. You can strip down most distros to the point where they will work well, we just have yet to do so. If you still want to order it, use 'view source' to find the commented out link. "</comment></comment></comment></comment></comment></comment>


30th anniversary of the Macintosh SE/30 - <AUTHOR> https://twitter.com/nickpunt/status/1086572946481500161 <comment><USER2> Fun fact: If Apple had stuck to it's prior product naming conventions, this model would have been called the Macintosh SEx.

The Macintosh SE was the name of the first compact Mac with an internal expansion slot (at the time the SE was said to stand for system expansion), and that internal expansion slot was carried over to the SE/30.

Previous Macs using Motorola's 68030 CPU had been given the X suffix in their product name, like the Mac IIx.

</comment><comment><USER3> i wonder if kids today share the same excitement regarding technology as we did in those times. Everytime my dad brang a new computer home , i was literally dreaming of it afterward. Every new generation of computer were letting you do things so obviously different, it was incredible.

I remember up to this day a dream i had when « my » mac (the one with the portrait format monitor) suddenly turned into a color monitor.

<comment><USER4> > I remember up to this day a dream i had when « my » mac (the one with the > portrait format monitor) suddenly turned into a color monitor.

I had this dream too! Waking up to 4 color grayscale was a total bummer.

</comment></comment><comment><USER5> Macs seemed quite cool at the time, but I never looked at the price. Considering Amigas and Acorn Archimedes were available for a lot less, I now just can't see what made people buy Macs then. The SE/30 was over US$4,000.00!

<comment><AUTHOR> Yeah they were super expensive at MSRP. They did get heavily discounted after launch though, unlike today's Apple products. And the software available for Macs was really what allowed them to price the way they did.

<comment><USER6> I suspect most of them were being bought by businesses. At the time I was selling QMS PostScript printers (for £5000+ each) into publishers and marketing agencies. They were all running Pagemaker and Illustrator.

</comment></comment></comment><comment><USER7> In grad school I called mine "snot on a doorknob" \- it was that "slick" / fast. The internal HD felt almost magic after slamming so many floppies.</comment>


Why should I have to install an app to figure out subway times? - <AUTHOR> http://stefanweitz.wordpress.com/2011/01/16/deep-plane-thoughts-the-appocalypse/

<comment><USER2> Because search still sucks. No-one does context very well or very consistently. Even with hints. Google can't do it. Wolfram can't do it. UDDI sure doesn't/can't/won't do it.

Further, a huge part of the drive to apps is because people prefer more- responsive and dependable apps that are geared for the mobile use-case of the query they need at that instant. e.g. an interface that's not only finger- friendly, but one-thumb friendly and/or low contrast-friendly.

Even in a magical UDDI future, no generic interface group is going to churn out something that displays subway maps as well as a dedicated UX group that's _only_ worried about subway maps.

Lastly, you only search for an app once. And most people never search randomly at all: their friend recommends an app and they search for that specific app by name. You may recognize this behavior as: the way most people use the internet. The worst the 'appocalypse' could ever get, is as horribly unusable as the current internet. And we certainly have enough history on _that_ to see whether people will ignore it because it can be difficult to find things [1].

That the author _totally_ skips the UX concerns and shamefully overhypes the search process strikes me as somewhere between 'just not getting it' and 'intentionally disingenuous'.

[1] So we're clear: It really _is_ still too difficult to search for most things online. My point is that state of affairs just doesn't matter. Maybe you could get _more_ use from _more_ people with better search. It remains to be seen whether people would rather search for themselves or whether they truly prefer to get their information through third party curators and aggregators. But clearly apps won't run into a roadblock _because of search_ any time soon.

<comment><USER3> _the author totally skips the UX concerns_

I don't get your point. People do UX design on the web. Instead of opening your NYCSubway app, you just type "NYCSubway" into Google, touch the first link, and now you're on nycsubway.com, whose UX has been meticulously crafted just like the NYCSubway app.

The point is that downloading apps is an unnecessary step.

<comment><USER4> It seems the article is talking about having some search interface call some data providers, then display the data returned by the providers. I imagine what your parent was trying to say was that the search interface cannot generify the display and interaction with the data provider's data.

<comment><USER2> Pretty much.

The author's identified 'problem' is: I can't find a subway map when I need it because it's too difficult to find and install 'an app for that'.

My reply was working from the assumption that the author was proposing a solution that was designed to address that.

If the context-sensitive search site is merely identifying that I'm looking for a subway map, and then forwarding me on to one of 10,000 disparate subway map web services as erikpukinskis seems to be suggesting, users will inevitably bookmark the web service interface they like best and query it directly in the future. Leading to the same use scenario as with apps. The only differences being trivial technical ones (from the standpoint of the user).

</comment></comment></comment></comment><comment><USER5> > When I query for Rockefeller Plaza and I'm sitting at the Thompson LES, a > logical intent is travel to/from Rockefeller.

For you, this may be a logical intent; but it would be a bad idea to try and generalize to a whole population of users from your own anecdotal experience.

<comment><USER6> "Hello it looks like you're trying to take the subway, would you like help"

<comment><USER7> That better not be clippy saying that :)

</comment></comment></comment><comment><USER8> The obvious reason in because you have no internet connectivity in the subway stations.

But that doesn't affect the arguments, just that one example.

On a recent visit to New York, Google guided me all around Manhattan with great efficiency, but I had to keep an app for when I was underground.

<comment><USER9> Google Maps works great as a default without having to install a new application. Further, the free NYC Mate official app is great for offline (underground) access. Both include time schedules.

</comment></comment><comment><USER10> Well, UDDI was an architecture astronaut's fantasy back then... and it still is today. This might be a theoretically better way to deliver the service, but it needs too many bits and pieces to fall into place (particularly bits that require the concurrent agreement of thousands of businesses and governmental organisations with conflicting aims) in order to become a reality...

</comment><comment><USER11> Get your transport company to submit their dataset to Google Transit. Not all transport companies want to do that, they believe it's proprietary data.

<comment><USER12> I did a lot of transit-related software development [1] in 2010, so I've experienced this first-hand.

For those who don't know, Google maintains a specification called GTFS that captures transit agency timetable and route information.

Unfortunately, as parent mentioned, a lot of transit agencies illogically believe that they need to protect their data. Most agencies are at least partially publicly funded, so there is no reason keep data behind closed doors. Of the 800 or so transit agencies in the US, only about 150 provide their data publicly today. (Many more provide their data to Google, but not to the general public -- a strange state of affairs.)

The community has organically developed a three-pronged assault:

1\. Use carrots to encourage agencies to provide their data.

Google Maps is a good carrot, as it gets agencies to use the common GTFS format. Unfortunately, Google is willing to take data from agencies that won't make their data otherwise publicly available, so it doesn't fix the entire problem.

Walk Score's Transit API [1] is another carrot. If agencies make their data public, it will immediately be available through this API. The Transit API makes it very easy for third-party developers to do great things with transit data, and it takes care of all the difficult issues: finding the data, keeping it current, and dealing with real-world bugs in the data. (Transit data headaches were my life for many months last year!)

2\. Use sticks to encourage agencies to provide their data.

I helped build City Go Round [2] to shed light on the innovation that happens when agencies open their data. You can also see quite clearly what agencies in a given locale haven't yet ponied up their data. (Search in San Francisco, for example.)

3\. Create a public clearinghouse so there is high visibility.

The GTFS Data Exchange, or GTFSDE [3], is where public GTFS data goes to live. It's a great resource for transit developers and, along with the GTFSDE mailing list, is the focal point for the community at the moment.

-Dave

[1] <http://www.walkscore.com/services/public-transit-api.php>

[2] [http://www.citygoround.org/apps/nearby/?q=san%20francisco,%2...](http://www.citygoround.org/apps/nearby/?q=san%20francisco,%20ca)

[3] <http://www.gtfs-data-exchange.com/>

<comment><USER3> Neat. I saw the list you have on the front page of <http://www.citygoround.org> and immediately thought "Cool, a list of cities I never want to live in!"

But then I saw Phoenix on the list, which is where I am currently living, and I'm confused. Google Transit works great in Phoenix, but you've got Valley Metro listed as not providing their data. What's going on there?

<comment><USER13> They can submit their schedule data to Google but not let anyone else see it. AC Transit is another agency that is in Google Transit but does not give the general public access to their GTFS schedule data.

<comment><USER12> Yes, that's it exactly. It's a frustrating middle ground where data available to Google is not available to the general public, even though many of these are public agencies to begin with.

</comment></comment></comment></comment></comment><comment><USER14> I'm the developer of Routesy (routesy.com), a public transit app for SF Muni/BART/Caltrain/AC Transit. My app has been around since the first day of the app store, and I get asked this question all the time.

The short answer is that Apple gives me two important things:

1\. A decent development platform with UI controls that provide a good, familiar user experience 2\. A marketplace that lets my app make money so I can afford to continue developing it

I've done some offline app development using HTML5 as well, and these apps just don't "feel" the same. Had I taken the HTML5 route, it would have been far easier for me to port my app to Android (which I haven't done yet), but my experience has been (at least for productivity and utility apps) that the more native an application feels, the better it sells.

</comment><comment><USER15> The nice side effect of those apps: Every developer is actually building webservices to drive them. So the big UDDI vision might yet come to pass.

</comment><comment><USER16> Apps provide a thick-client experience (richer UI, off-line storage etc) and people when they want to do a specific task know what to use. It seems obvious why until the web can be all things to all people we will always have apps. 10B to be precise! Clearly a lot of people like them.

Until native UI features are available using a web based driver there will likely always be some advantage to a slightly thick-client. Exposing UI features is a battle, look at the past for details of hard this is, ActiveX for example. In theory this would have made all Windows UI components available to the web browser, until someone figured out that a security model would be necessary that handicapped things so much it led to Flash. Now we are a decade and a half further on and technologies like jquerymobile will likely see many web solutions be more app like.

Once Apple figure out a better way to save a web 'page' to the home-screen that's intuitive and provides for local storage we will see apps.

</comment><comment><USER17> Apps vs the Web isn't a new debate.

Some thing apps are merely a stepping stone and the Web will be everything in the future. A bit like how 5-10 years ago, Flash was the only way to do "rich" Web apps whereas now _most_ things Flash can do, HTML/JS can now do.

The problem with apps isn't really about payment though. I have a paid NYC subway app and quite happily paid for it. I'd prefer to do that than have some micropayments system where really I had no idea how much it was going to cost.

It's a bit like how phone calls from land lines, unless they're international, aren't charged on a per-call or per-minute basis (in the US, YMMV elsewhere). The situation is analagous to micropayments IMHO.

People generally prefer flat cost models for simplicity, even when it means they pay more than they would had they paid for each call. But that's a function of risk. You pay insurance on your house even though the expected value of all your insurance payments is you're worse off than had you self- insured: you're transferring that risk to a third party.

Also, micro-payments (and this includes charging per phone call) has another cost: the cost of billing actually becomes significant. So the phone provider prefer a flat rate rather than keeping track of and billing you for all those calls.

Anyway, back to apps.

Some people don't like apps because they're balkanized. If you write an app you need to write an iOS version, a version for Android, a version for Blackberry and so on. It's a valid point but one I think will sort itself out in time as such platforms inevitably become commoditized.

What you have to remember is that most people aren't tech-savvy. So give a person and tell them you click on this icon and it gives you a subway map and the times and they understand that. Tell them to go to a Web page and it's a whole lot harder.

Yes you can bookmark a page on the home screen but that experience isn't yet as good. Web apps _generally_ don't work offline (which is a bit of a problem in our subway example). Web pages vary greatly in their mobile user experience, both in terms of display/layout and in terms of remembering what the user was doing as you switch apps (which is an issue on mobile but not on a laptop/desktop).

Lastly, games I see as being apps for a very long time to come. Sure computing power is increasing but power on mobile is an issue so the pressure will simply be to reduce power consumption rather than increasing CPU power, making the viability of HTML/JS for something like Angry Birds just that much further in the future.

The fact is though you don't _need_ to buy apps for pretty much anything. There are lots of free apps and free Web pages. I can navigate around NYC using Google Maps if I want to but I like my paid NYC subway map.

<comment><USER18>
      > It's a bit like how phone calls from land lines, unless
      > they're international, aren't charged on a per-call or
      > per-minute basis (in the US, YMMV elsewhere).

It's somewhat off-topic to your main point, but I'm from the US, and I don't think this is true. While there are flat-rate calling plans, these are new and more commonly associated with VOIP lines. I think that most people in the US still have plans with very complex rates based on destination and time-of-day. For example:

\---

What are AT&T basic rates? What is the AT&T basic rate plan?

They are the standard long distance rates charged to customers who are not enrolled in an AT&T Long Distance calling plan. There is a $4.95 monthly recurring charge associated with the state to state direct dialed basic rate plan (sometimes referred to as the basic rate plan), which applies each month whether or not a customer makes a call. The current per minute state-to-state basic rates are as follows: 42¢ Peak (7 AM - 6:59 PM, M - F), 36.5¢ Off Peak (12 AM - 6:59 AM and 7 PM - 11:59 PM, M - F) and 15¢ on Weekends. In-state basic rates vary by state.

[https://www.customerservice.att.com/assistance/faq/qa.jsp?fa...](https://www.customerservice.att.com/assistance/faq/qa.jsp?faqCategoryId=ld_shop_faq)

\---

Incredibly, due to federal telecommunications regulations, the in-state rates have historically been higher than the state-to-state rates. What you say is true about local calls though, where "local" is a complex term of the art rather than something simple. And times are changing --- for all I know, no one buy my family members are still on the traditional plans.

With regard to apps, I think I see it opposite to the way you do. Previously, most small apps would be directly accessed as free websites with no metering. Now, more of these micro-services are moving to becoming paid apps, free- loading on top of the public web sites. Would you be comfortable with the NYC metro deciding not to put up a public information site at all, and offering only a paid app? I worry this the direction things are headed.

<comment><USER17> Ok, thanks for that.

Perhaps my perception is clouded in this regard. I've only lived in the US for a few months (in NYC). I'm from Australia. Whenever I've seen phone plans they're part of cable plans (eg Time Warner) and the package options are either without phone or with ($30/month, unlimited nationwide).

I was also in the US in the 90s and saw the same thing then.

In Australia the move has been to cap plans, particularly for mobile. So you'll pay, say, $49/month for your phone and can use $400/month of credit on voice, SMS and data (actually a lot don't include data). Voice might be $0.50/minute, SMS 10c, data $100/GB, which may sound a lot but remember you're paying $49 for that notional $400.

Why do they do this? Because customers like knowing that most of the time they pay $49/month and because if you go over your bill can quickly go up. So it's really a tax on the stupid. My nephew for example has had bills of hundreds in a month when in fact a $150 cap would be more than anyone could ever really use.

</comment></comment></comment><comment><USER19> There are two good rebuttals to this article:

1\. Apps are useful in an offline market, like when you are in the subway with no data service.

2\. People don't like micropayments. They are willing to put up with ads instead. Why do people keep flogging micropayments and ignoring actual customer behavior? On-search-result ads will get you some slight income without the hassle of trying to get your customer base to adopt some wacky and ill-supported payments mechanism.

I feel that the dismissal of apps in favor of a major shift in customer behavior is at best a sign of detachment from what the end user wants. (And I would tend to go further into "boil the ocean" and "architecture astronaut" thinking but that is not likely to be productive here, so let's leave well enough alone.)

</comment><comment><USER20> This sounds like a combination of Wolfram Alpha-esque search experience with APIs.

But I think this fellow is discounting how much value a good UI/UX is a part of what makes an application valuable. Every transit system out there had some crappy trip planner for a long time before Google Transit came along & replaced them. Star charts get a lot more useful with window-to-the-sky UI in new apps.

Does the NYC subway even have a fixed schedule during most times of the day? It's usually just "go in the station and a train will show up in a couple of minutes."

<comment><USER21> * Does the NYC subway even have a fixed schedule during most times of the day? *

They do, headways (intervals between trains) vary at specific times of the days (large headways late at night/early morning, small headways during peak transit hours, mid-size headways during the day) and you can use those to compute the schedule. In NYCT's case, they run enough trains that in Manhattan a train comes pretty much every few minutes but in the other boroughs they may run infrequently enough that you'll want to plan ahead.

</comment></comment><comment><USER22> Remember the first iPhone? You weren't supposed to need to install any apps because you could just make a web page to do the same thing.

Apple has served up 10B apps to date.. so developers will be making money from selling "useless apps" through app stores for at least the next few years.

I can see this changing if wireless phone data networks can speed up network latency. The web is too laggy on phone data networks at this point IMO.

<comment><USER23> This was my frustration with Google Voice and Google Wave homescreen bookmark "apps". Both of them were extremely laggy and took minutes to fully load. Definitely not the experience I desired.

</comment></comment><comment><USER24> Nota bene, the author is a PM at Microsoft on Bing. (Not meant as a 'gotcha', just a bit of possibly interesting context.)

</comment><comment><USER25> Also worth noting that non-app solutions do exist. [NextBus](<http://www.nextbus.com/>), for instance, includes both a web interface and an SMS-based query centered around texting it your stop number.

<comment><USER26> i wrote <http://metra.jcs.org/> to provide train schedules for the metra rail lines in the chicago area after metra spent $3.9M on a new website that wasn't even usable on an iphone. they finally have a mobile version now but i find the interface difficult to use compared to mine.

aside from word of mouth, or searching google for "metra iphone", i have no way of directing traffic to it like i would if it were a dedicated app in the app store/android market. i've often thought about just taping up flyers at each metra stop to advertise for the site.

</comment></comment><comment><USER27> This sort of reminds me of Dave Winer's RSS Cloud stuff, but maybe exactly the opposite.

</comment><comment><USER28> Heh - apropos....

I am working on this very thing. But for a specific vertical.</comment>


Ask HN: What type of service/SaaS would you pay for if someone was to create it? - <AUTHOR> <comment><USER2> Someone who could test different marketing channels and tell me which ones worked and which ones didn't. Would be more of a productized service. Once you found a good channel I would pay you a ongoing monthly fee to keep it maintained and re-test other channels.

<comment><USER3> Heard about this service [0]. Check them out as it could be something close to your needs. No affiliation and experience with them but someone mentioned them to me once

[0] [http://gridplay.com/](http://gridplay.com/)

</comment></comment><comment><USER4> [https://news.ycombinator.com/item?id=12670731](https://news.ycombinator.com/item?id=12670731)</comment>


Ask HN: What is the best and easiest way to implement end to end encryption? - <AUTHOR> We are working on some enterprise tools which have communication modules in it. We are planning to add end to end encryption to it.<p>So can anyone guide which is the best way to do it? <comment><USER2> Open Whisper Systems, a non-profit, publishes open-source tools that do exactly what you need. WhatsApp and Open Whisper's own products use them.

More info:

[https://en.wikipedia.org/wiki/Open_Whisper_Systems](https://en.wikipedia.org/wiki/Open_Whisper_Systems)

[https://www.whatsapp.com/security/WhatsApp-Security- Whitepap...](https://www.whatsapp.com/security/WhatsApp-Security- Whitepaper.pdf)

<comment><AUTHOR> Thanks for sharing it. Let me check it out.</comment></comment>