Ask HN: What visa should entrepreneurs apply for YC - <AUTHOR>

If a foreign entrepreneur is applying for YC, What type of visa, should He/She apply with the consulate?
If the founders are called for an interview, can they use tourist visa, or is it considered as a business trip?
If founders are accepted into the program, what type of visa should they get, for the 3 month period in the valley?
Founders who had been through, this process, please tell your experiences.
Thanks. <comment><USER2> You can try for an h1b if you're incorporated in the US and have a board. This is pretty new so ask an immigration attorney for help, more here: <http://murthy.com/news/n_entre1.html> <http://murthy.com/news/n_entre2.html>

<comment><AUTHOR> Thank you. A New Hope. I'm thinking of incorporating in the US, for other reasons as well, merchant account processes and payment gateways sucks here.

</comment></comment><comment><USER3> I think it would be best to come on a Visa Waiver or maybe even a B visa.

You could go for the E2 with about $100,000 in investment.

So Waiver the YC and then E2 when you get investment. Or B visa and change status once you have funding.

Best talking to a lawyer though I think.

Best of luck!!!

<comment><AUTHOR> I'm frm India, so Visa Waiver Program is not an option for me.

I read here: <http://www.workpermit.com/us/employer_b1_b2.htm>

/start quote

The following activities require a working visa, and may not be carried out by business visitors:

Running a business. "Gainful employment", Payment by an organization within the US, Participating as a professional in entertainment or sporting events,

/end quote

Wouldn't a startup count as Running a business?

I've read, A foreign national can easily start a business in US. But, B1 Visas doesn't seem to allow running a business. :Confused:

<comment><USER4> I think for YC you can just come on the visa waiver program. You're not going to do any productive work on your startup really, right? all you will do is have meetings and listen to talks?

you can incorporate in the US, and from what I understand, once you have the corp you have more options to apply for visas, such as the H1B, O, E, ... visas .. you will still need a US person to be involved with the corp such that they can sign for you (that is what I've been told).

but the best thing to do here is talk to a lawyer - I'm not a lawyer, and I can't give any legal advice ...

</comment></comment></comment><comment><USER5> This looks like a useful information.</comment>


Building Large Flask Apps in the Real World - <AUTHOR> https://etscrivner.github.io/posts/2014/10/building-large-flask-apps-in-the-real-world/ <comment><USER3> > In the end you should be aiming to design your application to depend on > Flask as little as possible.

I'm 3 years in to a project where I've taken the approach of having my "app" as its own package. Flask is then a thin wrapper that instantiates the app and then exposes the views to talk to it. I handle validation / sessions / config etc within Flask.

It's extremely flexible. I have some stuff that runs off as worker processes. No problem - the core is the same, the wrapper around it is different. I also have a boot.py that I can call so I'm working directly with the app in ipython (again, it's a wrapper that starts the app).

I'm currently reworking the structure for capacity planning, which is mostly just a matter of splitting the Flask app into 2 apps for handling different parts of the work.

Because my core app is decoupled from the web app it's all really easy to do.

<comment><USER4> "Flask is then a thin wrapper that instantiates the app and then exposes the views to talk to it."

Why did you decide to go this way? Is it because the user-facing parts of the app (the bits where Flask helps) are only a small part?

I mean, if I'm developing a CRUD app with small amounts of supporting non- interactive code, I can't see a reason not to use Django (and put the other stuff in manage.py commands).

On the other hand, if I were to write something like an analytics system, which had a web UI for users to inspect and play with results, I can see that I'd feel constrained by Django when writing the non-web parts.

As someone who loved getting started with Flask, but then switched to Django after getting stuck without a good structure, I'd really like to understand whether the choice of Django vs. Flask should be made based on individual preferences (comfort of an imposed structure vs. freedom without it) or based on the type of project (mainly web, or mainly non-web)?

<comment><USER3> Django is fine. And honestly, when I'm starting out I just have a single file with Flask, a connection to the db and a few routes. If that's all you need, why complicate your life?

I love SQLAlchemy. Maybe things have changed (I'm a jaded Django 0.96 refugee), but as soon as you take away the Django ORM, you lose the admin and then all your advantages just sort of fall away. But really, that's my personal preference with a lot of bias from being there in the early Django days. I think the Django Rest Framework is absolutely awesome, and it almost pulled me back to Django but it just took my first morning of screwing around with some config to remind me of why I prefer the simple frameworks.

And actually, I could already feel with feature creep there. I wanted to have a remote filestore, so there's a Django plugin for doing it. But a) why is my framework in charge of how I store the files for my application (that means I need Django loaded in ipython!) and b) it didn't work quite how I needed and I could see storm clouds brewing.

In terms of general structure, if you know you're building something bigger, I'd suggest at least splitting the web bit and everything else as soon as possible. For me, leaving the web app to handling routing / validation / marshalling / sessions / templating etc feels like the right abstraction.

I look back on any apps I've built / worked on that a) started off as a CRUD system and b) are still going and most of them are a mess. Even if they're clean, the core business logic is mixed up with the standard framework structure. If you really work at it you can separate things out in the code, but my feeling is that by starting with an app that doesn't know about the web, you'll make it much easier to discover where that abstraction lies.

TLDR; use Django if it works for you. Whatever you choose, try to keep the framework out of your application.

<comment><USER4> Thanks. Your comments (and whalesalad's) helped make this clearer for me.

A simple (and I think common) situation may illustrate what I took away from your comments:

\- You create a CRUD app in Django with two types of users: staff (who use the admin interface to modify anything) and regular (can create/modify their own data, but only read other people's data)

\- The staff make a mess via the admin interface, so you decide to add some type of undo thing. You look around for an existing addon that does model versioning, but people still spend time reverting changes back.

\- You decide you need some business logic (changes going through some review/approval process) and are scratching your head about how to do that in Django.

I can see then why "I look back on any apps I've built / worked on that a) started off as a CRUD system and b) are still going and most of them are a mess."

</comment></comment></comment></comment><comment><USER5> Here's why I use Flask for every web project:

\- It is both 'out of my way' _and_ flexible enough to scale up. I.e. you can start with a 5 LOC hello world, but it still handles a large app with lots of components well (Blueprints).

\- It doesn't force a data model / DB onto me - I can just plug in whatever I have (unlike Django).

\- It doesn't even force a templating engine onto me - I always use mustache instead of jinja2 (it's extremely tiny, tidy and portable to any language, so it's much easier to port code to other devices / platforms).

\- wanna just get started? `sudo pip install Flask && python ./hello.py` --> served on localhost:5000. I recently started a project[1] while in a meeting with someone complaining about some complex app we had - built a prototype with him together that could replace the entire thing _and_ solves problems we had in 2h. Having a foolproof starting point without any configuration and then being able to build up from there is essential.

[1] [https://github.com/muellermichel/guetzli](https://github.com/muellermichel/guetzli)

<comment><USER6> I like Flask a lot, but I take issue with:

> It doesn't force a data model / DB onto me - I can just plug in whatever I > have (unlike Django).

Django doesn't force a data model onto you anymore than Flask does - nobody is forcing you to use the Django ORM. Any database code you write for a Flask app could be re-used in a Django app.

What the Django ORM does do is allow you to write portable apps and extensions. For example, suppose someone writes an extension for Flask that uses SQLAlchemy. If I'm writing a Flask app and only have a Mongo database available, I can't use that extension. On the other hand, if someone uses the Django ORM to write that extension, as long as I have a Django backend for my database, I can use their extension. It abstracts away the underlying datastore. Besides just which database you are using, you can also write a variety of code that works with Django models. Now granted, this abstraction can be severely leaky and flawed at times, but it's still quite powerful overall. Django provides a conventional, standard way to address the issue of interacting with data in a general way. Again, nobody is forcing you to use it, because you can just bypass the ORM and write your database code directly. It's just a powerful paradigm if you do embrace it.

<comment><USER5> I agree that you can use Django without the ORM, but IMO it makes it kind of pointless - what advantage would you get over something more lightweight? The reason why I'd use Django over Flask is if I want to use at least a few out- of-the box solutions or extensions, say a standard Admin interface. However, I'm just the type who prefers building this stuff either myself or using standard components that are decoupled from everything else as much as possible. If an underlying framework allows me to build stuff in a tidy and quick way, that's what I'm going to use. So it's not just about what you _can_ do, it's about how the ecosystem around that tool works.

<comment><USER6> It's obviously to a large degree personal preference, opinionated frameworks vs microframeworks. The reason why I would still use Django even if I wasn't using the ORM is because

1) I'm still probably using the ORM. I was just noting that for any data that the ORM doesn't fit well, you don't have to use it.

2) Why is Flask "lighter weight" than Django? From my perspective, as soon as you start writing a real app, you end up reinventing all these basic things like file layout using your own conventions, instead of a standard one that people are familiar with. The mental burden of figuring out your special snowflake conventions makes it 'heavier' weight to me. But again, personal preference :) Flask is obviously much better for really simple stuff, and does provide a great framework for extensions, even if I still lean towards Django.

<comment><USER7> I think is a myth than Flask is lighter than Django, in my experience I had a Django app and a Flask app we started with Flask because we believed that myth, in the end we had an application like 10 times bigger in code, we refactored in less than a week and the performance was even better for Django than Flask app. I know this is not a Flask vs Django post, but I woudln't use something than is almost 3 years ago from the last release and they're promising a new release from almost a year.

<comment><USER8> Correct. I'm working with a flask app now and the tendency was to have a few files with thousands of lines of code - this encapsulates about 25-30 api endpoints along with all the necessary imports, etc at the top. Including sql and the usual suspects.

I think flask is great, like sinatra, for small apps. But I would never consider it for 'big' apps that represented more than half a dozen api endpoints and some sort of in-depth feature set.

Above that size, unless it's super simple, you'll pay the price in tech debt. While our api has worked up until this point, we're gonna scrap it for a Rails api-only app because we need convention + orm + other things to scale not just the app, but the team. There probably is a way to do this in flask, but 95% of our team are Rails guys, so it just makes more sense to go with q company wide maintainable system vs. what's there now.

For small/single devs working on small projects, flask (and sinatra) are great.

<comment><USER5> I have to wonder - did you try the Flask Blueprint facility? Furthermore you don't have to use the decorator approach to define the endpoints, there is a class based initialization (add_url_rule) to which you can just pass a View class. These are AFAIK the main two ways to modularize Flask code.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Flask is just awesome, I've never messed with a framework that's made things so simple yet doesn't take away from functionality if you're looking to build more complex apps.

Anyone looking to get into webscripting/webapps should definitely take a look at flask, its python based, good for prototyping or production apps and has tons of useful documentation.

<comment><USER10> best tutorial starting points?

<comment><USER11> the bible: [http://blog.miguelgrinberg.com/post/the-flask-mega- tutorial-...](http://blog.miguelgrinberg.com/post/the-flask-mega-tutorial- part-i-hello-world)

<comment><USER12> Seconded — Miguel's blog is terrific! Major chunks of my (very simple) website's code bear a suspicious resemblance to his examples.

<comment><USER9> I think many people's flask personal projects resemble his examples in some way ;) He covers just about everything a modern web app needs

</comment></comment></comment></comment></comment><comment><USER13> > Scaling in terms concurrent users also has little to do with the web > framework and more to do with your understanding of load-balancing, caching, > databases, etc.

This is what it always come down to for me. I know that when we can get our app running efficiently with reasonable memory requirements on a single core, then scaling it is really just about launching processes and load balancing them. Scaling out boxes is always easier than scaling out code -- for better or worse.

I'm not talking about load balancing servers mind you, but applications on any given host. Two layers of load balancing. When I'm comfortable with the resource requirements I launch as little or as many of the app in a predictable manner across any number of nodes. It's comforting to know that given X, Y core and ram, I can run N services.

</comment><comment><USER14> I think Flask is like Ruby Sinatra and Perl Dancer.

I've used Dancer quite a bit. Some for larger apps (30+ pages)

This is how I typically lay out a Dancer app. Starting with a top level directory of application name, say "MyApp", I put the routes in different directories instead of jumble them all up in one file. As an example, lets use an app that handles and tracks customers and orders. So something like this:

      MyApp/
      └── Routes
        ├── API
        │   ├── Component
        │   │   ├── Customer.pm
        │   │   └── Order.pm
        │   ├── Customer.pm
        │   └── Order.pm
        ├── API.pm
        ├── Customer.pm
        └── Order.pm

(templates should have a similar layout in a separate 'Views' directory)

Routes/Customer.pm would handle basic requests like GET /Customer/list and POST or GET Customer/1

While routes handling json/ajax only requests (from jquery ect) would be in Routes/API/Customer.pm. Routes/API.pm would be an api for stuff that doesn't directly involve a Customer or Order object (perhaps returning json from an inventory table or something)

And if you get tired of requesting json just to convert it into html with javascript and you want the power of a template (without a SPA); I fetch that stuff with jquery .load() using the 'Component' routes (dynamic parts of a webpage). For example, perhaps when making a new quote, you select a specific customer and you want open orders to be displayed in a popup or inline div somewhere. Using jquery .load(), you would just easily fetch /API/Component/Customer/Open-Orders/<cust id#>, ect and then just inline the returned html. If you stick to a rule of "components can only return html and not cause a page refresh", you will keep from getting too big of mess with them.

This is just sorta a method I made from various best practices from other frameworks. Perhaps its barftastic, but I haven't been complaining about it.

<comment><USER15> This is reminding me strangely of the original, non-single-entry-point style of writing PHP.

I'm actually kind of surprised that we haven't seen a return to that style, with more modern sensibilities: each route directly mapping to a file containing the route's procedure body + any view templates for that route; a single "common" file at the project root containing dependency-imports and model declarations, etc.

In the end, it wouldn't actually work like old PHP—you'd still actually have a single entry-point and all the code would be preloaded rather than loaded into an ephemeral request context—but you'd be able to _code_ as if the opposite was true.

Reminds me a bit of the "oldschool sensibilities" of coding with something like Löve2D, actually.

<comment><USER16> Erf, mapping URLs to filesystem path is cute but you lose control.

</comment></comment></comment><comment><USER17> I've used Flask for several dozen projects, mostly in the data science space. I combined the reusable bits to create [http://flask- diamond.org](http://flask-diamond.org) \- and I've written lots documentation to help people get work done using it.

Flask-Diamond establishes some common practices so that you are not starting from scratch for each and every new Flask app. In a research context, I might scaffold multiple new apps per month, so this has been a huge time saver for me. This has also made Flask teamwork much easier.

</comment><comment><USER18> The post mentions Falcon at the end. At Cronitor, I rebuilt our ping tracking endpoint (peaks over 100r/s) with Falcon, breaking it out of Django, and I wrote a blog post about it: [https://blog.cronitor.io/scaling-django-breaking- out-not-bre...](https://blog.cronitor.io/scaling-django-breaking-out-not- breaking-up-c48b4a9e4a96)

Here's a tldr:

      Logging requests to a flat file on a t2.small instance:
      Django:  519.93 trans/sec
      Falcon: 2083.19 trans/sec

<comment><USER19> I'm confused when you say requests are logged to a flat file, but also requests are sent to SQS (presumably to be processed and eventually hit a centralized log?)

<comment><USER20> I think perhaps just to remove SQS as a bottleneck for benchmarking purposes?

<comment><USER18> Correct, but this could probably be more clear.

</comment></comment></comment></comment><comment><USER21> Flask is awesome! Here are some must-use libraries along with any Flask app:

[https://gist.github.com/alanhamlett/ecb3656a1d1bfb3feb31](https://gist.github.com/alanhamlett/ecb3656a1d1bfb3feb31) (requirements.txt)

Flask is great for small projects, and also scales to large apps like [https://wakatime.com](https://wakatime.com)

</comment><comment><USER22> Falcon ([http://falconframework.org/](http://falconframework.org/) mentioned at the bottom of the article) does look interesting.

I've also had good experiences with bottle ([http://bottlepy.org/docs/dev/index.html](http://bottlepy.org/docs/dev/index.html)) for building internal apps for companies. The limited amount of users means I don't have to worry much about scaling and bottle with Paste server works pretty nicely. Jinja2 templates can also be used with bottle which is a plus. It's also pretty easy to compile this setup into an executable so it can run off someone's Windows machine and no need for a separate server. This setup makes a really convenient internal-use app which is easy to send to end users for deployment.

<comment><USER4> If you are bundling as a windows exe, where are you storing persistent state/data?

(EDIT: fixed autocorrect exe->exercise)

<comment><USER22> Either interact with an external database... (an existing company db for instance...this is just a front end) or else use a sqlite file on the local machine for smaller stuff.

</comment></comment></comment><comment><USER23> A bit off topic, but does anybody know why development looks stopped since 2013? [http://flask.pocoo.org/docs/0.10/changelog/](http://flask.pocoo.org/docs/0.10/changelog/)

I'm in the process of writing my first webapp, and thses days it's a bit strange seeing a popular framework not being updated (even if it's just for bugfixing) a few times a year.

<comment><USER24> It's important to understand that Flask is really, really, really tiny. Most of the meaningful code about handling requests etc etc etc is in Werkzeug. Flask is really a small layer adding some convenience functions and tying into templating.

<comment><USER25> This is very true. I can't count the number of times that I've had to dive into werkzeug code while trying to figure out how Flask was doing something.

</comment></comment></comment><comment><USER26> While flask is a nice framework, it has some problems. I worked with numerous python web frameworks, mainly webapp2 and flask. So some things i don"t like about flask:

Disclaimer: You can architect beautiful apps in apps, its just easy todo it wrong.

GLOBALS: Flask has a lot of globals (from flask import g, request, current_user, etc.) A better web handler function looks like this handle(request) -> response. Any other web framework that I know does it like this. Much better. Flask promotes touching the 'request' object everywhere. Example: [https://github.com/lepture/flask- wtf/blob/master/flask_wtf/f...](https://github.com/lepture/flask- wtf/blob/master/flask_wtf/form.py). Flask is not functional, its inherently statefull with globals.

MIDDLEWARE: Flask promotes writing middleware as decorators functions, while it looks nice, it not really useable anywhere else, and its not really a standard. At least you can still use WSGI middleware.

BLUEPRINT are nice, but have issues: When you create a blueprint, for a sub app, you cant set error handlers. They only work on app level. Also (small issue) You cant add blueprint specific middleware.

Better way to create 'sub apps': Use a new WSGI App. Or use a sitemap where you bind functions to paths.

SITEMAP @route has disadvantages For big apps, its nice to have a single routes.py file where you can see all urls the app supports, and which methods to handle those. The @route is nice to use initially, but imho for big apps it becomes messy. Also it promotes circular imports:

      view.py:
      from init import blueprint #circular import!
      blueprint.route('/test/')
      def f(): pass

      init.py:
      blueprint = new Blueprint
      from . import view
      assert view # ensure the handlers are initiallized

<comment><USER27> Haven't used flask in some time now, but most of your objections are missing the mark.

> GLOBALS: Flask has a lot of globals (from flask import g, request, > current_user, etc.) A better web handler function looks like this > handle(request) -> response. Any other web framework that I know does it > like this.

Flask's request is not global. I have had this discussion with someone else before:

[https://news.ycombinator.com/item?id=6662623](https://news.ycombinator.com/item?id=6662623)

FWIW, flask's "from flask import request" never had been a blocker for me, whereas django's injected request variable had made me write middleware to preseve requests as thread locals so that I can access it elsewhere. Werkzeug does the same thing, except it does it more robustly.

> MIDDLEWARE: Flask promotes writing middleware as decorators functions, while > it looks nice, it not really useable anywhere else, and its not really a > standard. At least you can still use WSGI middleware.

I don't see an issue. If you can solve it using simple python(decorators), solve it using Python.

> BLUEPRINT are nice, but have issues: When you create a blueprint, for a sub > app, you cant set error handlers. They only work on app level. Also (small > issue) You cant add blueprint specific middleware.

Rather than calling app.before_request, you can call blueprint.before_request and it will work only for that blueprint.

> SITEMAP @route has disadvantages For big apps, its nice to have a single > routes.py file where you can see all urls the app supports, and which > methods

Then don't use the decorator. Have a routes.py and call app.add_url_rule

I have had a template with all of this from some time back

[https://github.com/rahulkmr/flask-bigapp- template](https://github.com/rahulkmr/flask-bigapp-template)

</comment></comment><comment><USER28> I spend the last 3 years on the microframework bandwagon, and now I am quite pleased to be back writing Django code.

In my experience, any sufficiently large Flask project contains an ad hoc, bug-ridden, slow implementation of half of Django.

</comment><comment><USER29> So what's a good (clean) way to create the frontend for Flask apps? I have a decent sized Flask app and I've created a mess with all the templates, static CSS/JS now.

What JS framework do you tie it to, if you use Flask to just create an API/manage sessions?

<comment><USER30> I host my Flask API on one server and serve a single page app (Angular) on another.

The trick with that is having to host them from separate domains and deal with CORS, however it also allows you to distribute your SPA via CDN instead of using Flask app servers to serve up that static content. This is what we do at my full-time gig, but same holds for Flask.

<comment><USER31> I'm just starting out in Javascript development and have been struggling with build system - how do you achieve cache busting hashes, etc which are necessary to use for a CDN?

We are using webpack and it seems hard to do it.

<comment><USER30> I highly recommend surge.sh for easy static hosting--their cache-busting strategy is explained here:

[https://surge.sh/help/using-lucid-caching- automatically](https://surge.sh/help/using-lucid-caching-automatically)

<comment><USER31> we use cloudfront and nginx for most of our infrastructure - kinda hard to move to surge right now.

ETags is not viable for this kind of a setup - it pretty much means triggering a nginx reload which is what a cache-busting signature avoids.

</comment></comment></comment></comment></comment><comment><USER32> How do you load balance a Flask application since it's single threaded? For optimal performance shouldn't there be a single Flask instance (process?) for each request being processed? What kind of load balancers are usually used with Flask and how do they decide to spawn new Flask instances?

And why should Flask be used instead of asynchronous Tornado or Node.js?

<comment><USER33> I've built with Flask, Tornado, and with Node/Express.

Flask/Python blows Node out of the water where performance is concerned. That shouldn't be a surprise to anyone.

Flask has a significantly faster ramp up time than Tornado as it is designed to be simple.

As far as load balancing/performance, you front end it with something like NginX.

You can process things out of band easily enough with Flask, but I wouldn't evangelize it so much to say that it's the best solution for every problem.

Personally, I like to keep things as simple and as logically separated as possible until it's absolutely necessary to change. Flask is one of those frameworks that doesn't present a lot of mystery.

My biggest problem with node isn't performance - for that it's fine for most use cases that I deal with. It's that you can get perl-level convoluted and sloppy very quickly and easily.

<comment><USER34> > Flask/Python blows Node out of the water where performance is concerned. > That shouldn't be a surprise to anyone.

I'm a huge fan of Flask and Python in general, and despise server-side Javascript (or Javascript anything, really). But I'm curious how you can make this claim. CPython lacks JIT, and gunicorn + Flask is going to run a process pool by default, with each process being single threaded and under GIL.

What's your set up then? PyPy and gevent gunicorn workers? Otherwise I don't see how CPython+Flask+gunicorn could beat Node performance wise out of the box. At best PyPy + gevent would approximate NodeJS performance, unless you can tell me otherwise.

<comment><USER35> In my experience, large nodejs apps suffer from linear degradation.

Nodejs performs very well in synthetic benchmarks. In the real world, slow clients and large queries just kill that initial performance.

<comment><USER36> What do you mean by linear degradation?

</comment></comment></comment></comment></comment><comment><USER37> Shamelss plug: We are using flask-resty [1] for our microservices and it's awesome. it uses sqlalchemy and marshmallow and the resulting code is very terse and declarative.

[1] [https://github.com/4Catalyzer/flask- resty](https://github.com/4Catalyzer/flask-resty)

</comment><comment><USER38> If your interested in websockets for flask, Miguel Grinberg has a straightforward implementation:

[http://blog.miguelgrinberg.com/post/easy-websockets-with- fla...](http://blog.miguelgrinberg.com/post/easy-websockets-with-flask-and- gevent)

</comment><comment><USER39> I do not use flask for large applications, I reach for Pyramid instead.

<comment><USER40> Can you share some advantages you perceive?

<comment><USER41> Pyramid avoids globals wherever it can, so this leads to cleaner and better architecture. has an event system that you can plug in, and customizable auth system. You also have powerful pluggable configuration system where you can easly add new functionalities to your app as extensions, like provide pluggable service layer, or auto add new views from external package for your application that handle some specific functionality.

It was also among first python frameworks that supported py3.

</comment></comment></comment><comment><USER42> I have been working with flask over the last 6 months and the deeper I dive the more I feel like there are 100 ways to do each task.

Can anyone provide a few good open source flask projects worth reading?

</comment><comment><USER43> This was a good general list of things to consider for scaling any web applications. What I've noticed though is that all my flask apps, after adding in all of the standard components, eventually converge on a Django-esque setup anyway. So now I just use Django, and if I don't want to use a particular component (ie: orm, templates, whatever) I don't, or I swap it out. On the other hand, if I do want to use those components, they are right there.

<comment><USER15> Do you ever write "apps" that only expose an API, without rendering any HTML? I find Flask (or Ruby's Sinatra) to be ideal for that case.

Given hexagonal architecture (i.e. your model + business rules existing as a "service component" library project, that your webapp consumes as a dependency), if all you need is to expose that service with an API, Flask and/or Sinatra lets you do so with nothing more than a flat file of 3–6-line controller stanzas. It's really quite lovely; gets to the core of what it means for something to be a "microservice."

<comment><USER43> I suppose if you already have an existing service component that encapsulates authentication, authorization, business logic, notifications, and all that other jazz, then use flask is an excellent way to wrap that to produce an http api.

</comment></comment></comment><comment><USER44> Bottle and Flask are similiar and a great place to learn and start your journey with Python web _application_ development. It is pseudo-minimalist though, so either you must almost immediately start reinventing the wheel to build basic stuff that you will need (as a novice developer I started by writing my own sessions and cookie handler).

The next realisation you'll come to is that all that stuff has already been written by someone else as addons. So you try that but eventually you'll find you are in so much pain from problems with integrating addons that you will realise that you would be best off with something that has all the basic functionality "batteries included". So then you'll try to find projects on github that have already baked together Flask plus all the plugins into a boilerplate project. Then you'll find that there's many ways to bake all that stuff together and start to wonder if maybe you're now using a framework. But the boilerplate Flask with addons integration doesn't feel like it has a really well thought out consistent overarching model.

So you'll then look at full featured integrated frameworks like Django where it's all integrated according to an architectural vision (perfect or otherwise is a matter of opinion) and although you might mot like some of the components, at least its all built in. Flask still carries of cruft and mental model though, because it is from earlier days of web development when you built the front end in the back end using things like Jinja templates.

And then one day you'll need to build just a simple REST API without all the bells and whistles needed in a web application. So you can then look at Falcon which is extremely minimalist for developer who know they don't want any extra web application stuff at all including things like back end UI generation with templates. It's a sharp knife because there's almost nothing in it, and never attempted to provide the features needed to build user oriented web applications, so it has a very small mental model to grasp.

TLDR:

 __Bottle and Flask are great for finding your feet in web development without being forced to learn too many concepts all at the same time.

 __Django or Pyramid or something full featured for web application development

 __Falcon for REST API development

If you are willing to take on the cognitive load of going straight to your destination, I would recommend beginners start with Django or Pyramid or Falcon. If (and this is entirely reasonable) you need to get going in Python web development without being overwhelmed by the concepts, go to Bottle or Flask but move on as soon as you can.

If you love Flask and have the skills and competence to craft your own architecture and carefully selected from a menu of addons that suit you and know how to whittle out unneeded functionality, then Flask is the right choice for you.

<comment><USER45> This is the first I've heard of Falcon. Have you used it for a "real" project? It'd be interesting to know the tradeoffs when considering it against something like Django Rest Framework. Looking at the benchmark figures on the Falcon site, it's sad that Python 3 underperforms Python 2. I wish Python 3 had the slightest performance win, it'd be an easier sell. Hate to shift the topic to Python 2/3 talks, but I've wanted to switch for a while now, and it's still not the simplest sell.

<comment><USER44> Yes I have used Falcon extensively and I like it alot.

Lies, damn lies and benchmarks - I'm not saying the benchmarks are made up but you know - the benchmark thing.

Falcon for REST API development. Django/Pyramid for full featured web application development.

And regarding speed, well how does its Python 3 performance compare to the Python 2 performance of other Python web servers? And any does speed matter that much? In many cases "fast enough is good enough" and the bottle necks are more likely to be other parts of your system and if speed matter that much then you should be horizontally scaling.

And if I may raise the ugly topic - who cares about Python 2 under any circumstances? For me - and I know many people do not think this way - <USER2> 2 is dead so who gives a rats arse anything about it. Python 3 is the future and I'm not looking back for any gripes or grumbles about it.

Don't get me wrong, I think ruby-rails-slow is a bad thing, but Falcon fast should be good enough.

And if speed _really_ matters to you then you shouldn't be using Python for web application development.

<comment><USER3> I looked into Falcon a while back - looked interesting but it wasn't immediately obvious what I would get over Flask (if nothing else, there's a tonne of Flask docs out there these days).

In all my research over the years Pyramid is the framework that looks the most interesting. The docs are amazing (I more or less read them cover to cover, even though I haven't tried the framework) and the whole thing seems very well thought out.

I'd love any insights from people who have worked with it.

<comment><USER46> I've worked on one project with Pyramid extensively, and I've been relatively pleased. It gives you a lot of flexibility, which can be good and bad. There is useful code that helps you unit test your app, and it is not a particularly opinionated framework. That being said, the number of options that pyramids allows can be a little overwhelming -- it gets a grade 'C-" when held up to the zen of python's line: "There should be one-- and preferably only one --obvious way to do it." When held up to "Although practicality beats purity.", as well as most of the rest of the pythonic ideals, Pyramids gets a solid A.

Personally, I'm excited to explore flask more, since it seems to put the ball entirely in your court. I like the concept behind flask a lot -- for some projects I'm willing to sacrifice additional framework features in exchange for a more careful understanding of everything I am adding to my app.

<comment><USER47> Yeah I mean it's hard to digest comments like "it's not a particularly opinionated framework" against things like "put the ball entirely in your court". They seem to be saying the same thing except you have a different perception of each when you say it.

The problem as I see it is that Pyramid has a lot of extra interfaces and support for things in the core by default (and some concepts that are completely missing from most frameworks like context). So much is there that it's easy to lose sight of how little is actually required. Fundamentally you can write Pyramid apps in 10 lines of code exactly as you would with Flask but that's less interesting for bigger apps and so the docs focus on all the extra features.

I mean if you take the example at the top of [http://docs.pylonsproject.org/projects/pyramid/en/latest/](http://docs.pylonsproject.org/projects/pyramid/en/latest/) and add in the pyramid_jinja2 library via config.include('pyramid_jinja2') then you basically have views and jinja2 rendering fully baked.

As in the previous example if you get right down to it Pyramid doesn't even have a templating engine! Flask comes with jinja2 built-in! So scaling DOWN to APIs where this is not necessary is an interesting thing..

<comment><USER48> You could always just use Werkzeug directly if you're just building an API.

<comment><USER47> "just building an API" does not mean you need something more lightweight. It means you have different requirements from a standard full stack web application. You are not dealing with cookies, forms or template rendering but you are still dealing with lots of other problems including authentication, authorization, headers, etc. Pyramid is the ONLY framework I've ever seen that comes with builtin support for dispatching to a view function based on more than just a request method (GET vs POST). In Pyramid GET vs POST is equivalent to any other request property including accept headers, cookies, query strings, etc. Any of these can dictate a different callable. See [http://blog.delaguardia.com.mx/pyramid-view-configuration- le...](http://blog.delaguardia.com.mx/pyramid-view-configuration-let-me-count- the-ways.html) for some examples.

<comment><USER44> That's really useful.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Is it really best practice to initialize the logger in each python file? Seems strange to me, I've always just initialized in the main routine(s) and the logger that you set up like this is available from everywhere as a singleton (`import logging ; logging.info("hello world")`).

<comment><USER25> > `import logging ; logging.info("hello world")`

I don't think that this is doing what you think it is doing (assuming that 'import logging' is importing the Python logging package, and not relying on broken Python 2 package name resolution quirks to import a local module).

The `logging.{LEVEL}` functions always log in the root logger. The loggers that you initialize have a tree structure. There is a nice package for inspecting that here:

[https://pypi.python.org/pypi/logging_tree](https://pypi.python.org/pypi/logging_tree)

Several different 3rd party libraries that you might be using will all have their own loggers that are initialized at their level. By separating things out like this, you can set different log levels for different loggers. For example, you might not want Component A logging at DEBUG level, while you want Component B logging at DEBUG level. This is why one would initialize things per package like this:

      import logging
      logger = logging.getLogger(__name__)

That logger's log level inherits from it's parent, and the structure mirrors the structure of your package/module hierarchy, so you can set the log level for an entire package, or just an individual module. Granted, you may not require such granularity, but doing this as a standard practice does give you the flexibility.

<comment><USER5> Well yes, but with basic_config I'm telling the root logger in a central fashion what it's supposed to do - at least that's how I understand it. So far I've never had the urge to initialize separate child loggers for every component. Do people do that mainly so you can have fine grained control over log levels?

<comment><USER49> Yes, otherwise you can get messages from noisy libraries bubbling up to the user that may not be relevant in the app context. If the logging is just going to a file to look at later it matters less, still sometimes it is nice to shut them up.

<comment><USER25> Examples of libraries that can be noisy:

* Flask-CORS: When I first started using this it's default logging level was really noisy.

* factory (aka Factory Boy): You can turn in DEBUG level to get a _deluge_ of information about what is happening with your test data.

* SQLAlchemy: The 'echo' option to create_engine isn't the only way that you can control logging. E.g.:

      import logging
      logging.basicConfig()
      logging.getLogger('sqlalchemy.engine').setLevel(logging.INFO)

Using logging_tree will give you a good idea of the loggers that have been initialized on the libraries that you're using.

</comment></comment></comment></comment></comment><comment><USER50> +1 flask-classy -- feels a bit like the old pylons which was a very simple and powerful framework

<comment><USER51> The original flask-classy extension hasn't seen updates in two years.

This fork is currently active: [https://github.com/teracyhq/flask- classy](https://github.com/teracyhq/flask-classy)

</comment></comment><comment><USER52> The "Architecture The Lost Years" talk is a real gem

</comment><comment><USER53> Another one that I have used in multiple of my projects: [https://github.com/mattupstate/overholt](https://github.com/mattupstate/overholt)

</comment><comment><USER54> What do you guys think of webapp2 framework? How does it compare to flask?

<comment><USER48> Assuming this [1] is the main source repository for webapp2, it hasn't had any serious development since early 2012 and there's probably no reason to use it.

[1] [https://code.google.com/archive/p/webapp- improved/source/def...](https://code.google.com/archive/p/webapp- improved/source/default/commits)

<comment><USER54> Yes that is the framework. Well, Google App Engine still suggests using it in all of their code snippets and is the goto python framework suggested for GAE apps.

I also probably didn't formulate my question well. I didn't ask whether to use it or not, but how it compares to Flask - .

</comment></comment></comment><comment><USER55> in addition to the flask documentation

[http://flask.pocoo.org/docs/0.10/](http://flask.pocoo.org/docs/0.10/)

the snippets page is really helpful

[http://flask.pocoo.org/snippets/](http://flask.pocoo.org/snippets/)

also, I've some boilerplate

[https://github.com/ransomw/catalog-flask](https://github.com/ransomw/catalog- flask)

even though it hasn't gotten attn in a while

</comment><comment><USER56> Don't be fooled by the "micro-framework" line. My experience of building SaaS on top of Flask is that you are going to have to reinvent the wheels for a lot of things.

Flask is plagued with abandoned plugins from a cesspool of weekend contributors which you rely on for basic things such as authentication and ORM. Tough enough as it is with all the outdated documentation for _each_ of the plugins you need.

So my recommendation based on 2 years of working with Flask is don't fucking do it, unless your product doesn't extend beyond couple of HTTP endpoints served over uwsgi + nginx for your internal applications.

I really wish I'd spent all that time I spent on Flask on Node.js, python was the wrong medium to distance myself from PHP frameworks.

All in all, 4 years have passed since my search of alternatives to LAMP. And finally, it wasn't some open source framework or asynchronous javascript to save the day, it was Amazon Lambda + API Gateway.

Gone are the need to spin up Vagrant, docker, mysql/postgresql. I just upload the specific script I want and bam. Npm modules and pip modules too.

I've in the process of migrating to AWS and leaving Flask. Great initiative, ruined by abandonware plugins and modules, certainly not attractive to entice developers to build their own wheels.

The biggest mistake you could do is basing speed and agility as basis for going with Flask. It is the complete opposite. I think using Laravel or even CodeIgniter will significantly cut development time.

Regardless, I'm done with the whole server/client frameworks and have migrated to AWS without any servers to maintain or setup. There's even frameworks for "Serverless" architecture now which makes me shake my head.

<comment><USER57> Why not try Django? It's documentation is top notch, plenty of maintained plugins for everything you could need.

Jumping on the lambda bandwagon seems pretty risky, and in any case how does it protect you against abandonware? To me it's a bit like saying "I don't like outdated python packages, so I'll switch to nginx instead of Apache!".

<comment><USER58> > Why not try Django?

They blame Python for issues they perceived with Flask, I doubt they're going to be too open to Django.

<comment><USER56> that wasn't what I meant, I meant specifically the microframework nature of Flask means you have to fill in a lot of what other framework gives you fro free.

I really did wish I was using django and it's a great framework, however, I would still choose a php based framework over django, my whole point of using Flask was buying into the "microframework" experience, it hasn't been stellar nor worth the extra effort.

I do have to say that I rather liked doing things in Flask until it came time to do the less fun plumbing code that Flask conveniently leaves out for you to implement and rely on other Flask plugin contributors....it's literally npm world but far far fewer in volume....I really did not expect using Flask would become a minefield

About Lambda, yes there is a platform risk, but I don't think it's a huge one because the code you write on Lambda are largely self sufficient on their own. At most if AWS Lambda shut down, you'd moving them to a queue based architecture with EC2 workers chewing away at the queue.

All in all I don't think AWS Lambda is a hugely different than any other webhosting...I'm more worried that digitalocean is going to sell out and I'm stuck with dozen of snapshot images that won't work anywhere else.</comment></comment></comment></comment>


Ask HN: Are we in a bubble? - <AUTHOR> I remember back in 2012-2015 there was all this talk that the tech sector is in a bubble. Lots of speculation. Nasdaq at that time was 3000-5000
Now Nasdaq is sitting around 7400. Many people have already left the market last year thinking assets are over priced. But we are still going higher.
Chart: https://imgur.com/a/tNVwc
So... Are we in a real bubble? Is everyone adamant to that fact? Isn't this bubble getting huge, scary and could possibly wreck fortunes and companies? <comment><USER2> Let's start by defining "bubble".

A financial bubble isn't just "asset prices are going up". Asset prices can go up because the fundamentals for the asset are good. For example, stocks can go up because earnings are good. They can also go up because bond interest rates are low, and so 4% return on stocks is now a good return.

Then next stage comes when people start buying an asset _because the asset are going up_ , rather than because the fundamentals are good. That's the start of a bubble. It's not yet a _dangerous_ bubble, but it's becoming a bubble. (It's dangerous to those who invest in it, but it's not dangerous to the economy as a whole.) And of course, people buying into the asset cause the price to rise further. So _more_ people see that the price keeps going up, and buy in because they want to make money. So the price goes up some more. That's a bubble - the price is rising because people are buying, and people are buying because the price is rising.

The dangerous stage comes when people start buying the asset _with borrowed money_. This is dangerous because, when the bubble pops (and it always does eventually), people will lose money that they don't have. This can destroy banks, not just individuals. When it destroys banks, it can threaten the economy as a whole (think 2008, or, worse, 1929).

So: _Are_ we in a bubble? I'm not sure that we are in the Nasdaq, _given current interest rates_. I'm not sure that the price is totally disconnected from the fundamentals. We could be in a bubble, though.

One metric I'd be interested it, but don't know how to get my hands on: How much borrowed money is invested in the Nasdaq (or S&P 500, or the Dow)? How does that compare to historic values?

</comment><comment><USER3> By comparison, here's the NASDAQ from 1989-1996, when it went from 400 to 1000 over just 5 years:

[https://finance.google.com/finance?chdnp=1&chdd=1&chds=1&chd...](https://finance.google.com/finance?chdnp=1&chdd=1&chds=1&chdv=1&chvs=maximized&chdeh=0&chfdeh=0&chdet=828133200000&chddm=671760&chls=IntervalBasedLine&q=INDEXNASDAQ:.IXIC&ntsp=0&ei=5O1mWpCbEYHVjAGewLHIBA)

And then over the next 5 years, from 1996-2000, when it went from 1000 to 4000:

[https://finance.google.com/finance?chdnp=1&chdd=1&chds=1&chd...](https://finance.google.com/finance?chdnp=1&chdd=1&chds=1&chdv=1&chvs=maximized&chdeh=0&chfdeh=0&chdet=949093200000&chddm=485826&chls=IntervalBasedLine&q=INDEXNASDAQ:.IXIC&ntsp=0&ei=5O1mWpCbEYHVjAGewLHIBA)

The short answer to your question is yes, we are in a bubble. We are _always_ in a bubble, somewhere. You can usually tell where it is by looking at whatever people are really excited about, and it lasts as long as they continue to be excited, which inevitably is not forever. You can't usually tell when people are going to cease to be excited, which is why timing the tops of bubbles is a fool's errand. It's up to you how much risk you want to take - because _everything_ is a bubble, you can't actually opt out of the game, but you can choose to protect yourself by investing in things that people are unlikely to get significantly more or less excited by. You miss out on the vast majority of gains across the overall market by doing this, though.

It's sort of a metaphor for life: we're born, we grow rapidly, at some point we get boring, and then eventually, with 100% certainty, we die.

<comment><USER4> Those links just point to real-time NASDAQ :(

</comment></comment><comment><USER5> Frankly I don't care, I make money on the way up and on the way down (using stock trading robots), the only years I am losing money are at the bottom (before going up again), so since we are on the way up, I am confident I'll be making money this and maybe next year for sure...</comment>


A Rebuttal: The Lifestyle of the Professional Magic: The Gathering Player - <AUTHOR> https://www.reddit.com/r/magicTCG/comments/58slc5/a_rebuttal_the_lifestyle_of_the_professional/ <comment><AUTHOR> Original (satirical) article which this is referencing: [http://sperlinggrove.blogspot.com/2016/10/the-lifestyle- of-p...](http://sperlinggrove.blogspot.com/2016/10/the-lifestyle-of- professional-magic.html)</comment>


Show HN: Hls-endless – create local HLS streams from the command line - <AUTHOR> https://github.com/dayvson/hls-endless

<comment><USER2> trying...

</comment><comment><USER3> nice. it helps testing without a real server available.</comment>


Why I'm thankful Moz didn't move to the Bay Area - <AUTHOR> http://www.geekwire.com/2013/thankful-moz-move-bay-area/

<comment><USER2> Moz is one of many companies in Seattle making some noise while doing it with the transparency; we don't traditionally see in startups. Rand is a heck of a thought leader on Inbound/SEO/Speaking and they are poised to do some big things. Thanks for staying.</comment>


Microsoft is breaking your site in IE9 - <AUTHOR> http://ie9cvlist.ie.microsoft.com/ie9CompatViewList.xml

<comment><USER2> Flamebait title, please do not do that.

What are we looking at?

<comment><AUTHOR> This is not a flamebait title. It explicitly declares what Microsoft is doing. They have a list of sites where IE9 is specifically being told to render in a different compatibility mode than what the owners of those sites have indicated.

</comment></comment><comment><USER3> This isn't really Microsoft- or IE-specific. Opera does this too:

<http://www.opera.com/docs/browserjs/>

Chrome also added special handling to work around poor browser sniffing in Hotmail, which is ironic because Opera had to do the same for Google Docs. Opera claims that most of what they have to deal with is actually improper browser sniffing on sites that didn't work in a previous version of Opera but work fine now. Looking at Microsoft's list of sites, it seems to be a similar story, many sites have IE-specific code that isn't necessary in IE9.

</comment><comment><USER4> I like how they finish strong with zune.net

</comment><comment><USER5> For people who want more information about what particular elements/attributes mean, there's [http://msdn.microsoft.com/en- us/library/gg699485(v=vs.85).as...](http://msdn.microsoft.com/en- us/library/gg699485\(v=vs.85\).aspx)

There are also steps on that page for getting your site off of the compatibility list.

<comment><USER6> They should try and get live.com out of there too :)

</comment></comment><comment><USER7> Well Microsoft is not necessarily breaking, people have special casing in their sites for older browsers that they might want to evaluate based on what browser mix is hitting them.

The list looks quite small though. I was expecting it to be gigantic list in thousands.</comment>


Gwyneth Paltrow is now in the poorly regulated online vitamin business - <AUTHOR> https://scifeeds.com/blog/gwyneth-paltrow-is-now-in-the-poorly-regulated-often-scammy-online-vitamin-business-what-could-go-wrong/ <comment><USER2> Tim Caulfield, a health policy professor at the University of Alberta, wrote a book titled "Is Gwyneth Paltrow Wrong About Everything?" You may be surprised to learn that the answer is "Yes." [https://thinkprogress.org/is-gwyneth- paltrow-wrong-about-eve...](https://thinkprogress.org/is-gwyneth-paltrow- wrong-about-everything-this-researcher-thinks-so-d949c7341f63#.h6izbhdgi)

<comment><USER3> Doesn't that violate Betteridge's Law?

</comment></comment><comment><USER4> Fun fact: her cousin founded wework.</comment>


White-beaked dolphins trapped in the ice and eaten by polar bears - <AUTHOR> http://www.polarresearch.net/index.php/polar/article/view/26612 <comment><USER2> How is it fucking possible, with human made warming and melting polar ice caps!?!?!

<comment><USER3> Changing ice distribution is actually discussed in the article...</comment></comment>


SurveyMonkey Raises $800 Million in Debt and Equity - <AUTHOR> http://allthingsd.com/20130116/exclusive-surveymonkey-raises-850-million-in-debt-and-equity-for-tender-offer-including-new-investment-from-googles-new-late-stage-unit/

<comment><AUTHOR> $1.3B valuation. All one can do is remember 1999 and insanity back then.

</comment><comment><USER2> meritocracy my @ss, it's good to be the husband of sheryl sandberg</comment>


Agate: A Data Analysis Library for Journalists - <AUTHOR> https://source.opennews.org/en-US/articles/introducing-agate/ <comment><USER2> maybe i'm missing the point, but i can't see the advantage of using this over pandas</comment>


Tricks every C programmer should know - <AUTHOR> https://medium.com/@kahlonel/tricks-every-c-programmer-should-know-f5f8cf2d8d1#.img3g6v41 <comment><USER2> > The libraries are searched in the binary's current directory first.

Huh?

<comment><AUTHOR> That was an error. I meant GCC looks in the current directory first for the needed libraries. Thanks for pointing out.

<comment><USER2> This doesn't sound right either.</comment></comment></comment>


Microsoft is building a new browser - <AUTHOR> http://gizmodo.com/report-microsoft-could-ditch-ie-for-a-new-browser-name-1676038757

<comment><USER2> While having options and competition is good, I have to wonder if all of these companies (Microsoft, Google, Apple, etc) building every type of product in their own flavor is in vain. I would rather Microsoft focus on making the next iteration of Windows more developer friendly and attractive as a technical platform.</comment>


The YC Effect: Charting How YC Makes Your Company Better - <AUTHOR> http://themacro.com/articles/2016/11/the-yc-effect/ <comment><USER2> Curious what are typical _results_ that come from all those meetings? 100 hours/week is _a lot_ of time to spend in meetings & e-mails. How many new customers typically result from that? What sort of growth rate? What's the conversion rate for a typical YC company, and how much does it increase over the length of the program?

</comment><comment><USER3> I read the article and don't think the premise was answered at all. Anyone get any value from it?

<comment><USER4> Maybe the title could have been "Charting How We Managed Our Time in YC"

I get your point, but I still found the article informative.

</comment></comment><comment><USER5> I'm not sure I understand how the time spent communicating is a valuable metric of how that made your company better.

Somebody here can hopefully help me with the quote, something along the lines of ~ it takes twice as long to write a brief letter as a long one.

The quality, not quantity of your communication is what's valuable. Does YC help with training you to better communicate? How is that shown?

Where is the time working on product accounted for? Or are you only working on communication (I understand People.ai only measures communication - but I doubt all you are doing at YC is communications).

</comment><comment><USER6> The main selling point of YC _is_ its network. I've always wondered how effective it is. We're always reading blog posts about the need for warm intros and getting help with press. With such a large number of hours spent on external e-mails, presumably you're exploiting that network? But you say in the post that is _not_ the main benefit. Can you elaborate because I'm confused.

</comment><comment><USER7> Pretty cool read. I'll agree with others that the title didn't make much sense to me, but the people.ai software sounds interesting.

Something like that for personal use could be neat to try. I'm not a sales role, but I would like to have something like this for engineering tasks.

</comment><comment><USER8> Mark Twain or Shakespeare I'm sure has some quote about the inversely proportional relationship between self-proclaimed worth vs. externally validated worth, but I've noticed an increase in the amount of YC promotion as the value of the YC brand begins to ebb (airbnb trolling by NYC, zenefits and whatnot).

<comment><USER9> I don't think YC's brand has been criticized much more than it has in the past. I think the Thiel drama is the worst they've had to deal with in the past year or two.

Where have you seen more YC promotion?

</comment></comment><comment><USER4> Great read. Thanks for sharing. After going through Techstars I can certainly relate to this post as I get the same questions. Overall it's really about how much you put in that determines how much you get out.</comment>


Smartphone Security: You'll Never Guess Who Just Messaged You - <AUTHOR> http://jordansmith.io/address-book-contact-security/ <comment><USER2> I really don't get the security model for smartphones. It seems horribly brittle. I mean, the fundamental protection is using apps from trusted sources, basically Google or Apple. Anything not trusted can't install, unless you've rooted the phone. And so old-school Windows-style malware is blocked.

However, when trusted apps are installed, they often demand all sorts of privileged access. And if they're malicious, there's no way to protect against them. Except that they get reported to Google/Apple and become unavailable. But that doesn't help people who already got pwned.

What am I missing?

<comment><USER3> A variant of the 'single non-root user' problem on Unix systems.

A non-root user (hopefully) can't root the system or rm -rf /root.

But everything interesting is stored in that user's home folder with implicit RW permissions anyway.

On Android apps just request everything. I imagine (without explicit knowledge) that an app given permissions could rewrite, erase, or pull down over the network contacts / photos / etc in the background.

<comment><USER4> I remember learning Unix on my school's big Unix system. Lots of talk about how important root was. I understood it from a system standpoint sure.

Yet I was confused, because as a user all I cared about was my stuff that was ... right there in a non root account.

As you say all the stuff I was concerned about was right there, but nobody talked about how important that was.

<comment><USER5> On a large multi user system there's a big difference between "your stuff" and "everyone's stuff" on a single user system like a phone - not so much.

<comment><USER6> The point is that your trust envelope extends to the authors of software, which are frequently _not_ acting in the best interests of the user, and have their own goals and incentives (including competing goals with other software authors).

On my Linux systems, particularly under Debian, there's _some_ assurance provided through the Debian Project, its guiding documents (social contract, constitution, policy), and debian developers. _The project explicitly serves the users._ This doesn't prevent bugs and occasional malice, but tends to tremendously reduce incentives for it.

Smartphones ... are a mess, and Android rather particularly so. I've suggested entirely rethinking how app development is performed, particularly for basic utilities, closer to the Debian model. I have little hope of this occurring.

</comment></comment></comment></comment></comment><comment><USER7> I feel like this is a really common problem for both mobile AND OAuth authorization frameworks. The scopes and permissions are not quite fine- grained enough - it's generally a read and WRITE for all of what they ask for, instead of being read (most common use case).

<comment><USER8> I can imagine how this evolved -- somewhere at Apple HQ, a whiteboarding session about classes of information and capabilities that the OS will gatekeep, which got us to Contacts, Photos, Camera, Microphone, Location. Presumably apps would be extensively curated, keeping out the scummiest of the lot, and apps were envisioned as asking for permissions directly relevant to their utility so having separate read/write permissions would be overkill.

When Android cloned the same model, they got much more granular with permissions [1][2], but then completely undermined it by making it occur only once at app install. As someone put it [3], they're not permissions because you can't turn them off -- they're warnings about what the app does. Then they further mucked this up, by eventually grouping them together into broad categories within which apps could automagically gain all other permissions without your approval [4].

Then, the following year, in 2015, they finally introduced iOS-style runtime- granted permissions, if your device was lucky enough to be up-to-date and your apps were gracious enough to target the new API level; otherwise you missed out on this change.

In fairness, by this point, hoover-style request-everything permission requests were extremely common among mainstream apps like Facebook, Messenger, Snapchat... so reigning in on contact-harvesting flashlight apps was a bit of a lost cause.

[1] [https://developer.android.com/reference/android/Manifest.per...](https://developer.android.com/reference/android/Manifest.permission.html#READ_CONTACTS) [2] [https://developer.android.com/reference/android/Manifest.per...](https://developer.android.com/reference/android/Manifest.permission.html#WRITE_CONTACTS) [3] [https://news.ycombinator.com/item?id=7959925](https://news.ycombinator.com/item?id=7959925) [4] [https://news.ycombinator.com/item?id=7959660](https://news.ycombinator.com/item?id=7959660)

</comment></comment><comment><USER9> This is scary. I always assumed that the "access contacts" permission was read-only, but I guess it's not.

Just another thing to be paranoid about in modern life.

</comment><comment><USER10> Maemo maintains separate histories and conversation windows for separate phone numbers/IM accounts and highlights the currently used one when you check the contact details. I should be immune :P

<comment><USER11> Bring back Maemo/Meego/Tizen/Mer/Sailfish!

I wish I had more time and patience for smart phone development and that the heroic efforts of those unlocking these devices, writing OS drivers for proprietary (and adversarial) hardware and making alternative operating systems possible were more widely acknowledged. It just feels hopeless out of the box.

</comment></comment><comment><USER12> I just checked on iPhone (Settings-Privacy-Contacts): Threema, Google Voice, Hangouts, WhatsApp, Telegram. Google Voice and Hangouts have my contacts anyway since I'm on gmail. There is a few other apps where I denied contacts access, like Uber, Skype, Twitter. There isn't really much more here.

So for me that's a non-story.

While I agree that access to contacts should be read-only, and write access should be a special permission, for me it appears to be not a problem. While I have a few other apps installed, most didn't ask for contacts permission (i.e. all games), and from those that did ask, I denied in some cases where it didn't make much sense (why should twitter access my contacts? to find my friends on twitter? I don't need that.)

I actually like the way iOS handling the permissions. The privacy overview in the settings is very easy to understand and maintain. Permissions are only asked once when access to them is actually required in that moment (like when you tap on "take photo" in some app). Permission is not asked for while the app is launching (aside of push notifications and location).

So on iOS usually what happens is this:

        - I install some app, lets say WhatsApp
        - I launch it, it asks for push notifications and contacts permission
        - i use the app
        - if i dont share my location, i'll never get asked for the permission to GPS
        - if i use "send photo" - it will ask for access to photos, but not to the camera
        - sometimes, months or years after usage, it will ask me for a permission, i.e. microphone, because I have never used that feature before and only now want to use it
        - etc.

</comment><comment><USER13> Android is extremely broken and is designed to leak information like a sieve. Not surprising given the incentives of Google.

Don't expect goodwill or good behavior when the fundamental incentives are surveillance and hoovering user data. The multi billion dollar ad economy is based on this.

A system designed with user privacy would be designed to lock down hard on contacts, sms, location, and other personally identifying information access. But the android permission system for instance is so involved it's not surprising lay people are not able to understand the implications, read between the lines of actual motivations and take proper actions.

Facebook does not need your location, contact or sms information. Neither does Google. Yet Google insists on creepily telling you your location on every Google search. This itself is sinister and attempts to normalize stalking behavior.

Uber and others don't strictly need location access, you can type it in, and if required it should be used for the convenience it offers - you are paying for the service - without the possibility of Uber and others collecting historical location and ride information to build invasive files on their users.

<comment><USER14> Location is useful if you're searching for things like restaurants though.

But Google is stupid, yesterday I read this commentary about a movie about a plane hijacking in the 70's that landed the plane in Entebbe, Uganda:

[https://www.theguardian.com/commentisfree/2018/apr/07/entebb...](https://www.theguardian.com/commentisfree/2018/apr/07/entebbe- film-annoy-left-and-right-thank-heavens)

Being interested in the historical context, I googled the name of the city. Later on Google showed me as one of its results "Flights to Entebbe". Gee, how clever.

</comment></comment><comment><USER15> I've previously seen this done with SMS gateways, which allow you to specify/spoof the sender number (it's how you get a text addressed from 'COMCAST' for instance). Your phone will trust that the spoofed number is genuine, so if I send you a message with Bob's details, your phone will tell you it's from Bob.

Unlike the OP, the attacker can't receive replies from the recipient.

<comment><USER16> That also wouldn't work over iMessage.

I'd like to know if this is actually being done in the wild. Certainly once caught would be banned from the App Store and possibly a lawsuit or two filed.

The author didn't note that a new thread would have started on iOS, which would provide some visual feedback that something was different. You could click for further info and see the different number. I know it would foil most but it's something.

<comment><USER17> > once caught would be banned from the App Store

But the issue is that it's impossible to detect. An app could've added the extra number months ago, and you've deleted the app since then. There is no way to find out which app did it.

<comment><USER18> Apple's security team can always collaboratively filter on reports and find out what is the intersection app.

<comment><USER17> Assuming this is used widely for there to be enough reports. I expect this to only be used sparingly so I'd be surprised if there is even a single report of this; as the targeted people will mostly have no idea this is even possible.

<comment><USER16> So you're telling me that someone went to all the trouble of building an app, getting people to download it, and then only used its main purpose (phishing/malware) for a couple people?

</comment></comment></comment></comment></comment></comment><comment><USER19> _For even greater effect, the app could apply heuristics when selecting target contacts, preferring names such as 'Dad' and 'Mom', or contacts that have nicknames._

The best heuristic would probably be the contact that has messaged you {first|second|third} most frequently in the last week.

<comment><USER20> The malicious app may not have a way to get these statistics.

<comment><USER21> An app could look in the "favorites" list to get the same info, which probably is available.

</comment></comment></comment><comment><USER22> How about the OS log all the actions taken by an app with respect to contacts and other system data, and allow you to reverse them?

And make an indicator in the status bar similar to how an app recently checked your location.

They might even highlight (in red) new changes in the Contacts app. Or when you get such a message from a new user, the Messages app would do the highlight the first time.

Seems that would mitigate this particular thing.

</comment><comment><USER23> The current Android approach of granting all permissions the app need at installation time leads to a lot of abuse like this. Just ask for everything because the user just wants to install it and does not read the permission dialog anyway.

The current Apple system is slightly better: when the app asks to use one capability (camera, smartphone, contacts) the user is prompted to Grant permission the first time this capability is requeated by the app.

This approach should be further developed with prompt dialogs to continue allowing the app to use the requested capabilities.

Examples:

The App XYZ is requesting read and write access to your contacts. It was granted access on {date} and has read 224 phone numbers, 121 names and 56 addresses and modified two contacts.

Continue allow access? Disallow? Report?

App XYZ is requesting access to microphone. In the last month it accessed and recorded 342 hours of microphone.

Continue allow access?Disallow? Report?

App XYZ is accessing your geolocation in the background. Permission was granted on XXX. During the last month it accessed to your geolocation approximately 461 times every day.

Continue allow access?Disallow? Report?

Apple Goole and others don't have to get on the way of every users all the time with these prompts. They can identify at which time to show this prompt based on analytics (how many users already reported this app etc). They can also identify users who are more privacy aware and that will be glad to read carefully these dialogs and report wrongdoing, and send more prompts to these users.

<comment><USER24> Android no longer always grants all permissions upon install and in fact offers something more like the Apple model. This is as of Android 6 and I believe it is more or less required nowadays for new apps to use certain permissions.

[https://developer.android.com/training/permissions/requestin...](https://developer.android.com/training/permissions/requesting.html)

<comment><USER25> I remember recently reading somewhere, that apparently if you build an app targeting an old enough version of Android, you get the old behavior as a "backwards compatibility" feature — reportedly kept even in the newest versions of Android. I don't have time to search for the link to the article now however, sorry.

<comment><USER26> Targeting very old versions is soon going to be banned from the play store.

</comment></comment></comment></comment><comment><USER27> I just checked my contacts privacy settings and none of the apps have access to my contacts. really why should they have access to my contacts anyways? I would pass that convenience.

<comment><USER28> I just checked my contacts privacy settings and 10 apps have permission while 29 do not.

Contacts, Mail, Agenda, Messages legitimately want contacts.

All google apps ask for contacts (Photos, Keyboard, Maps, Docs, Keep, Play Store...), all (undeactivable) samsung doppelgangers also (Browser, Gallery, AppStore, Music), as well as all (deactivated) microsoft apps (Powerpoint, Onenote, Excel)...

</comment></comment><comment><USER29> Wow ! This is simple and a very powerful technique. Thanks for sharing

<comment><USER30> > This is simple and a very powerful technique.

I do hope you don't mean that you're going to be using it in your own software…

</comment></comment><comment><USER31> Hopefully it has been fixed, but last time I used iOS, the phone/messages app seemed to mix up contact info from identical numbers with different area codes. So if I had 206-555-5555 in my address book, and got a call or message from 503-555-5555, it would show the contact info from the 206 entry.</comment>


Screenshots of Yahoo Buzz, a Digg competitor - <AUTHOR> http://valleywag.com/357006/screenshots-of-yahoo-buzz-a-digg-competitor <comment><USER2> Seriously boring.Why even try if it ain't different or better?

</comment><comment><USER3> Tired.</comment>


Show HN: Forward audio from Android device to computer - <AUTHOR> https://github.com/Genymobile/scrcpy/issues/14#issuecomment-375103051 <comment><AUTHOR> We recently published an open source application to display and control Android devices: [https://news.ycombinator.com/item?id=16544977](https://news.ycombinator.com/item?id=16544977)

But the audio was not forwarded.

I investigated, and implemented something experimental, which works for me. That way, the Android device is totally "duplicated" on the computer.

Checkout the "audio" branch ([https://github.com/Genymobile/scrcpy/commits/audio](https://github.com/Genymobile/scrcpy/commits/audio)), build, and execute: scrcpy --forward-audio

I would appreciate some feedbacks on several devices :)

For now, the audio forwarding feature only works on Linux.

If you're interested, I have problems to make it work:

\- on Windows: [https://github.com/Genymobile/scrcpy/issues/14#issuecomment-...](https://github.com/Genymobile/scrcpy/issues/14#issuecomment-375593393)

\- on MacOS: [https://github.com/Genymobile/scrcpy/issues/14#issuecomment-...](https://github.com/Genymobile/scrcpy/issues/14#issuecomment-376125131)

Thank you for your time ;)</comment>


Canada's Competition Bureau Fines Facebook Millions over Privacy - <AUTHOR> https://sensorstechforum.com/canada-competition-bureau-fines-facebook/ <comment><USER2> A better headline would be "Competition Bureau Fines Facebook Nothing Over Privacy".</comment>


You Can't Do Software Estimates at All - <AUTHOR> http://chrismm.com/blog/software-estimations-are-impossible/ <comment><USER2> The one I love is being asked for an estimate cold on some feature/requirment I've never heard mentioned before.

"How long will it take to add a feature to frobulate the fribbers?"

"What's a fribber, and what, exactly, does it mean to frobulate them?"

 _Handwave_ "How long? We need to schedule this."

"Can I do some research about frobulating fribbers and how one goes about doing that?"

"No, we need an estimate"

"Ok, five minutes? Six weeks? Six years? Who the hell knows? What do you want me to say?"

</comment><comment><USER3> Guessing this won't be a popular response, but all the hand-wringing about how management is unreasonable to ask for estimates (cost or time) just isn't helpful.

Anything a business is going to invest in needs some kind of justification, and a metric to prioritize against other things the funds could be spent on.

I think it's fair to push back with suggestions that might make a realistic estimate possible (reduce scope, proof of concept, etc). However, just suggesting you can't provide any kind of reasonable time and cost estimate doesn't help anyone.

<comment><USER4> I agree that businesses need estimates, but the problem is the form they take. It's always "2 weeks", or maybe at a better place it'll be "2-3 weeks" both of which are basically lies because they imply high confidence. What it really ought to be is "2 to 3 weeks with X% confidence" because there's an absolutely massive difference between "2 to 3 weeks at 90% confidence" and "2 to 3 weeks at 10% confidence and at every place I've ever worked they both get treated the same. The 10% confidence one might be roughly equivalent to "2 weeks to 6 months" with an implied high confidence but good luck giving an estimate with that kind of range.

<comment><USER3> That seems completely reasonable, and provides what a business would want...metrics to make decisions on where to spend money.

The tack of the article was "Estimates can't be done". Which is silly. It presents this analogy: "would it really have made sense to ask Einstein how long he would take to find a unified theory of physics?"

I'm sure there's some small amount of software work that might fit in that space. I would also guess that the vast majority of it doesn't.

</comment></comment></comment><comment><USER5> Trying to prove the impossibility of something that is never going to go away as a requirement isn't very useful.

An alternative would be to describe potential break-points and conditionals in the planning process. For instance, if a third party library can help you with some core functionality, it takes a few hours to investigate and an hour to implement.

But if it's not going to work for whatever reason, then you know you have to make your own, and the initial implementation could range from 4-6 weeks.

If you say "this will take either 4 hours or 4-6 weeks", that's far more useful and acceptable to management than saying "this will take somewhere between 4 hours and 6 weeks.

No one sane is asking for exact estimates, and no one smart is promising a hard deadline based on the assumption that nothing goes wrong. A good engineer will pad their estimate slightly for the same reason that airplanes carry more fuel than the exact amount they need to reach their destination. It's not a deceptive or inefficient practice, it's managing uncertainty.

<comment><USER6> _No one sane is asking for exact estimates … It 's not a deceptive or inefficient practice, it's managing uncertainty._

Part of the issue is that the asking for estimates ends up getting turned into exacting time requirements as an attempt to control and manage uncertainty. And often, many of the people who turn estimates into requirements are, arguably, insane, because they are trying to manage the uncertainty in the wrong way.

<comment><USER7> I've taken to just telling my boss whether I think something is 'just work', 'tricky' or 'hard'. And about howm much of that he's asking for,

Just Work: Means are the pieces are there to do whats wanted. Tricky: Means I need to create something from scratch or modify two or more modules. Hard: Anything to do with timing, interrupts, or that involves re-organizing swaths of unrelated code. Hard2: I have to learn a new language, frame-work, microprocessor, etc.

</comment></comment></comment><comment><USER8> Companies have budgets so estimates are necessary. Volunteer or work in open source if you don't like it. Those asking - business types usually - know (and often care) little about the craft, so they can't be expected to be much help.

The best you can do is be experienced enough to be able to get it somewhat close. Nothing wrong with padding. How much.. is an art form. But remember technical people nine times out of ten, will under-estimate.

</comment><comment><USER9> some thoughts:

1) it seems that the accuracy of an estimate is inversely proportional the length of time for which it applies. In my experience engineers aren't too bad at estimating if a task can plausibly fit into a two week sprint

2) I think the boss should be taking an active part in the estimation process, not just asking "how many hours/days".

When I estimate with my teams I try to say "given x,y,z and the current state and that A,B,C blocks are not quite understood can this item reasonably be completed within our sprint"

..then we play poker / vote / comment etc. If the item isn't plausible for a sprint I'm (likeaboss) going back to the drawing board on that item to define it better and get it into more manageable pieces (consulting the team as needed)

We're striving to make sure work items are defined well enough to be fairly confident they can be done in a short amount of time.

</comment><comment><USER10> Still, some projects will take longer than others, and it's possible to distinguish a 2-week project from a 2-quarter project, even if they actually end up taking 3 weeks and 3 quarters.

I feel like comparative sizing is the most important part of software estimates, so that you can make reasonable tradeoffs, e.g. "if we take on this project, we can't do these other 2 smaller projects". This is still a valuable exercise, even if all of the estimates are each individually quite inaccurate.

<comment><USER11> I agree completely. It's the only way I've found that works. Start the estimate by saying "these rolled-up, roughly estimated tasks come to about a year in total."

Now we know it's closer to a year than to two months. Once we start, we can continuously refine the estimate. "Sorry, there's a bunch of stuff we didn't see. We can give you X functionality in a year, or all of it if you can wait 18 months"

Lather, rinse, repeat. With experience and good time tracking of tasks, you learn how long things take: "every database we set up in the last year took about 10 days to get right." Now you know your estimate to configure a database and get it online is 10 days, not the optimistic "I can do it in an afternoon" that everyone claims.

The key to good estimating is good historical data. Problem is devs hate tracking their time and reporting accurately.

</comment></comment><comment><USER12> Well, maybe not if you're jumping to a new platform, API, framework, language, or library each time you start a project.

<comment><USER11> How long did it take to jump to the last new platform? How long for the last new API, last new language, framework, library?

If you had historical data on how things went the last time you did these things, you'd be better positioned to estimate how long it will take this time.

<comment><USER12> Maybe if you're not making anything with any kind of novelty.

<comment><USER11> At some point, everything is similar to something you've done before. The difficulty is relating what you're doing now to what you did before.

If you go into it assuming that your work is some special snowflake that is completely novel in all respects, you'll get nothing out of it. Find parallels with what you've done before and you can actually make an estimate that's an improvement over a SWAG.</comment></comment></comment></comment>


Dev is own by Google - <AUTHOR> http://nic.dev <comment><AUTHOR> And ruined my local setup.</comment>


Uber Is Doomed - <AUTHOR> http://jalopnik.com/uber-is-doomed-1792634203 <comment><USER2> this story has been submitted before [1] and it appears to be killed or shadow-killed each time (although I could be wrong). I can see why. It's a sensationalist news piece with many unfounded assertions and general mischaracterizations. For example, UberX is lumped in with flying cars as an example of the founder's supposed lack of focus. UberX was a huge part of what made Uber successful. Likewise, autonomy is widely considered the next phase in rides on demand, so it is hardly "scatterbrainedness" in action. There is an attempt to cover Susan Fowler's allegations, but sloppily, it leaves it implied that the manager has only solicited female engineers for sex once (whereas her claims are that he has done this many times, both before and after her own incident). It's a super low-quality article, but attention- grabbing enough to have half a million pageviews already.

[1]: [https://hn.algolia.com/?query=uber%20is%20doomed%20&sort=byP...](https://hn.algolia.com/?query=uber%20is%20doomed%20&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

<comment><USER3> Thanks for the link to past submissions. Why do you think it was killed when it was submitted before? I suspect it just didn't catch interest, like so many other submissions.

<comment><USER2> Because when you submit the same story again, it instead counts as a vote for that article and redirects you there.

<comment><USER3> As I understand it (and have observed), that only occurs within a certain time period. Submissions can be resubmitted. If a submission is flagged, it (often?) doesn't show up in hn.angolia.com at all.

</comment></comment></comment></comment><comment><USER4> Does Uber pays its drivers more than it collects in fairs? Am I missing something. I thought Uber kept 30% of fairs.

<comment><USER2> My understanding is that the 40% figure quoted in the article, and which was reported elsewhere, was based on a gross misunderstanding of the figures involved; however, I don't really know.</comment></comment>


Infrastructure is beautiful - <AUTHOR> https://medium.freecodecamp.com/infrastructure-is-beautiful-cb0daa1aa76b <comment><USER2> I really like your essays Quincy. The other one, about facebook, was great. Keep doing this blog posts! This graphical representation for infrastructure is awesome I wish I could see something like that for my country, Brazil.

</comment><comment><USER3> Gee, North Dakota seems to have a lot of places where the download speed is at least 1 megabit download speed, and almost all of the state has a choice on broadband providers.</comment>


Time lapse of all nuclear exlosions from 1945 - 1998 - <AUTHOR> http://memolition.com/2013/10/16/time-lapse-map-of-every-nuclear-explosion-ever-on-earth/ <comment><USER2> Estimated world nuclear stockpile: 5000 megatons total yield [1]

Estimated total yield of tests up to 1980: 510 megatons (418 atmospheric) [2]

It's hard to find good numbers on the total yield of all nuclear tests to date, but the ballpark figure is 10% of current stockpiles. This is actually somewhat comforting. We've all heard scary stories saying that we have enough nuclear weapons to destroy the world dozens of times over, but the truth is we've detonated 10% of the total current stockpile in the course of weapon testing with barely any noticeable impact. Yes, it will indeed suck much worse if nuclear bombs ever target populated areas, but the planet will likely recover and live on.

[1] [http://www.nuclearfiles.org/menu/key-issues/nuclear- weapons/...](http://www.nuclearfiles.org/menu/key-issues/nuclear- weapons/basics/nuclear-stockpiles.htm)

[2][http://www.nuclearfiles.org/menu/key-issues/nuclear- weapons/...](http://www.nuclearfiles.org/menu/key-issues/nuclear- weapons/basics/nuclear-stockpiles.htm)

<comment><USER3> serious question: does nuclear radiation scale linearly with explosive yield?

That question aside, the destructive power of a explosive does not scale linearly with yield [1]

> This relation arises from the fact that the destructive power of a bomb does > not vary linearly with the yield. The volume the weapon's energy spreads > into varies as the cube of the distance, but the destroyed area varies at > the square of the distance.

The destructive effects of one big 5000-megaton bomb is very different than 10,000 half-megaton bombs. Or even worse, 40,000 125-kiloton bombs.

[1] [http://www.atomicarchive.com/Effects/effects1.shtml](http://www.atomicarchive.com/Effects/effects1.shtml)

<comment><USER4> We also, historically, tend to test in ways that limit damage. We doubtless have enough weapons to eliminate 95% + of the global population if that were the intent.

<comment><USER5> Actually, only underground tests truly limit damage. There are three destructive effects from a bomb. The explosion itself, the fission products from the bomb, and the radioisotopes bred from high neutron flux impacting surrounding materials.

Tests are conducted away from civilization, which lowers the impact of all forms of damage. However, the above ground tests were conducted generally on the surface with only a few exceptions, which would have increased the amount of radioactive fallout due to neutron activation. In contrast, actual use of a nuclear weapon would be in air bursts which would generate very little activated fallout.

Also, the total number and yield of nuclear weapons now in all arsenals would probably not be sufficient to kill even 50% of the world's population. Much of the world lives in high density areas, but much does not. The total area that the world's population lives on is extremely large and only a small percentage of it could be destroyed through nuclear weapons. Though the industrial and economic collapse would lead to massive starvation which would cause even more delayed deaths, but it's difficult to estimate such things.

</comment></comment></comment></comment><comment><USER6> Blogspam, original video here: [https://www.youtube.com/watch?v=cjAqR1zICA0](https://www.youtube.com/watch?v=cjAqR1zICA0)

</comment><comment><USER7> It doesn't have the Aum Shinrikyo Australia event. So it's good that they're not including speculation.

[http://www.nytimes.com/1997/01/21/science/seismic-mystery- in...](http://www.nytimes.com/1997/01/21/science/seismic-mystery-in-australia- quake-meteor-or-nuclear-blast.html)

> LATE on the evening of May 28, 1993, something shattered the calm of the > Australian outback and radiated shock waves outward across hundreds of miles > of scrub and desert. Around the same time, truck drivers crossing the region > and gold prospectors camping nearby saw the dark sky illuminated by bright > flashes, and they and other people heard the distant rumble of loud > explosions.

[...]

> The evidence was ominous. Investigators discovered that the cult, Aum > Shinrikyo, had tried to buy Russian nuclear warheads and had set up an > advanced laboratory on a 500,000-acre ranch in Australia near the puzzling > upheaval. At the ranch, investigators found that the sect had been mining > uranium, a main material for making atomic bombs.

<comment><USER8> That was far more likely to be a meteorite impact: [http://www.straightdope.com/columns/read/2285/did-the-aum- sh...](http://www.straightdope.com/columns/read/2285/did-the-aum-shinrikyo- cult-detonate-an-atom-bomb-in-australia)

</comment></comment><comment><USER9> Note: due to the ratification of the Partial Test Ban treaty in 1963, every test after that year has been conducted underground. (With the notable exception of China, which isn't a signatory, and has detonated a couple nuclear weapons in the atmosphere post-1963.)

[https://en.wikipedia.org/wiki/Partial_Test_Ban_Treaty](https://en.wikipedia.org/wiki/Partial_Test_Ban_Treaty)

EDIT: China.

<comment><USER10> The vast majority, but not all, I don't think?

Wikipedia states that the most recent atmospheric test detonation was carried out by China in 1980, although the reference link appears to be broken:

[https://en.wikipedia.org/wiki/List_of_nuclear_weapons_tests#...](https://en.wikipedia.org/wiki/List_of_nuclear_weapons_tests#China)

<comment><USER9> This was news to me, but apparently China is not a signatory of the PNTBT.

</comment></comment></comment><comment><USER11> Eerie feeling: what a weird war, "won" by detonation bombs over one's _own_ territories.

</comment><comment><USER12> It's revealing to me that the US is far ahead of the Soviets in nuclear explosions. Somehow, given all the "evil Ruskies" outcry, I thought it to be the opposite.

</comment><comment><USER13> For anyone who hadn't read it yet, there is a relevant very short story by Isaac Asimov called Hell-Fire: [http://www.tep- online.info/short/hell.htm](http://www.tep-online.info/short/hell.htm)

 _"That these bombs are man's death sentence. We don't seem to be able to learn that."_

These must have been incredibly scary times. The first time in our modern history that we came close to our own extinction.

</comment><comment><USER14> How about Israel and South African Republic?

<comment><USER15> I guess the Vela Incident didn't make the cut...

</comment></comment><comment><USER16> Looks like the cold war ended around 1991 with the collapse of the Soviet Union and no more tests

</comment><comment><USER17> What did the US learn from the 1032nd nuke, that the previous 1031 didn't teach us?

<comment><USER18> Refined models of the dynamics of a nuclear explosion, and better analysis of the reliability of warheads as they age in stockpiles

</comment></comment><comment><USER19> They should overlay UFO sightings during this timeframe.

</comment><comment><USER20> Could this be related to all those cancers popping up?

<comment><USER18> Citation needed.

Improved diagnostics and improvements in fighting other diseases will lead to higher (diagnosed) cancer rates.

If you live long enough, you will get cancer. Every time a cell copies its DNA, you roll the dice to see if it becomes cancerous. You can do things to bias the dice toward or away from cancer, but it's still always a roll of the dice. As the number of dice rolls approaches infinity, the probability of them coming up snake eyes at least once approaches certainty.

<comment><USER20> I understand your point, and I understand that cancer can and will pop up in safe environments.

However, that much radioactivity cannot be good. I understand that those were mostly detonated in safe environnements and in safe ways, but that is a lot of detonations right there. I'm not sure I can trust that _all_ of those denotations released nothing bad in the atmosphere.

I would be curious to overlay a map of cancer rates over a map of detonations, taking wind into account.

</comment></comment></comment><comment><USER21> Typo in title...

</comment><comment><USER22> Fascinating read about this topic: [http://www.amazon.com/Command-Control- Damascus-Accident-Illu...](http://www.amazon.com/Command-Control-Damascus- Accident- Illusion/dp/1594202273/?_encoding=UTF8&camp=1789&creative=9325&keywords=nuclear%20explosions&linkCode=ur2&qid=1384507624&sr=8-2&tag=produc05-20)

Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety

</comment><comment><USER23> It's very sad to see a spam blog submission like this on HN. Create a page with a short description of a 3 year old video, embed the video, welcome to the front page.

Please flag this crap.</comment>