Ask HN: How do you version control a Database? - <AUTHOR> Hello All,<p>I am working on a project with 2 others and we have a PostgreSQL database that links to our project. We are trying to figure out the best way to share the layout of the database as it is edited. Currently we email each other when we change the table layout but this takes a lot of time and feels very backwards from regular Git commits. Does anyone have any advice to version controlling a database layout? We could care less about the actual data at this point because we are still developing the system. <comment><USER2> If one of the many schema migration solutions out there doesn't work for you, hacking one together is simple enough:

* Put your schema/data migrations into .sql files as raw SQL

* Number the files from 0001 on

* Write a script to apply each migration file to the DB in order, recording the file name to a log table after successful application. Only apply migrations not found in the log table.

* Commit your .sql migration files along with the code it is tied to.

<comment><USER3> That's a good approach - I've used it in a legacy system, although I named the files in the format "TIMESTAMP_migration_description", which is a bit more descriptive.

</comment></comment><comment><USER4> Not sure if this is helpful, but you can use a database migration framework. Check update scripts into your version control, then the others can just run them when they pull your changes. We use alembic ([http://alembic.readthedocs.org/en/rel_0_7/](http://alembic.readthedocs.org/en/rel_0_7/)) but something else may be a better fit for you depending on what software you use.

</comment><comment><USER5> So there are solutions to this issue as others have pointed out. Full products are made around it.

There are a few ways to do it quickly and more down and dirty though. 1, do what lastofus suggested, it works and is simple.

2, and the way I have used with small groups when there is limited data for testing and we are using localhost databases for dev. First, check in drop/create scripts for ever element in the database. Second, create a sql script that inserts all the test data, users etc. Third, create a shell script that you can run that gets the latest DB scripts and insert script and runs it all. It won't scale for a long time, but it works for longer than people think. Then whoever is making a new change is responsible for updating the insert script to make sure it stays 100% operational. And personally, we always tied the db script checkin to the same code set checkin that had the breaking change if there was one. Otherwise if it wasn't a breaking change which was our goal usually it could go separate.

Of course, a migration framework is superior, but sometimes the weight of it just isn't what you need yet.

<comment><USER6> Migration frameworks superior? No way.

Migration frameworks work on diffing dev with a copy of the deployment target. This is _inferior_. If you rename a table it may drop the table losing all data, then create a new one. It has no way of knowing a rename from 2 unrelated tables. It includes junk/testing objects that should never pollute proudction.

Hope your bank is not using one of these migration frameworks.

Nubmered scripts are the way to go. With a strict policy to never update a script, only create new ones. You're modifying state, so you must capture ordered steps that moved you from state 1 -> 2\. This will avoid a host of subtle issues. After a release you can create a backup as a baseline for the next set of scripts to run against.

<comment><USER5> Migration/comparison frameworks/tools can be used poorly just like any tool, but they don't have to be. When you have the funds and a moderately sized team, especially in dev, I think the migration tools/frameworks can be invaluable time savers and are superior. Also, the OP isn't in production, but once in Production I would expect schema changes would be less regular and generally less breaking except for occasionally. So having a tool now is more advantageous in many ways but may not fit into their budget or learning curve window, and it isn't needed, just can be nice.

No tool mitigates the responsibility for reviewing the updates before applying them in production, that would just be irresponsible IMO. But then again to me, there is no such thing as a SQL database schema change that doesn't require a person monitoring deployment. I know for my teams over the years many times we have tested a script in dev and stage, only to find out in production some set of records or other change that wasn't reflected in the dev/stage environments causes an issue. That is also why we started using migration frameworks to do diffs for us between environments to help minimize the chance we would run into these issues. It also let us do comparisons of the scripts marked for deployment to make sure there weren't conflicting changes, again something that occasionally happens on larger or fast moving teams.

It isn't that numbered files don't work, but just like my other suggestion, they only scale and go so far, then you really need a tool to help you keep things straight and help compare your perception to reality. For the OP, either numbered scripts or my other suggestion works for now, but I wouldn't rule out migration/comparison tools as they can really be helpful.

And actually the bank point isn't really a good one, many of the financial clients I have worked for use SQL migration tools to manage their deployments, along with their DBA's playing overwatch. This allowed them to configure rules within those tools that would prevent errors from happening.

<comment><USER6> I think diff is OK as a verification check after a deployment. But diff is not OK to generate the change script itself.

It's not about abusing the diff. It's about diff being fundamentally the wrong technique to transition from state (C)urrent -> (T)arget.

A diff cannot always bring you to the desired T. The diff only factors in 2 states (C and T) and not X,Y,Z which you may have an import from and which may need to occur during a transitional state before T is reached.

It doesn't factor the desired state T may not even exist to diff against if developers move forward adding objects not for this release. It makes things easier on web developers at the expense of deployments.

Which "scales" better? Migration tools scale better at letting web-devs free wheel in the DB.

For bullet proof deployments migration tools don't scale. They excel at the simple cases but hit a hard limit.

BTW any details on what kind of data in production broke a deployment? Heads up to avoid it myself.

<comment><USER5> I agree you may have a few transitional states to go through before dev becomes production. And in general, we didn't let the migration tools write our scripts for us, we used them to automate the testing and deployment of our scripts, maybe that is the key difference in how we used them. Which is maybe why I have never experienced what you are saying, when we added the tools in place, properly set things up and used them consistently we had less issues, and smoother deployments (not perfect, but smoother). But again, they were larger teams all working in the same data sets so we had to have coordination etc. Plus we had DBA's that were gate keepers for the database systems, and we never allowed developers write access to production, that is just asking for issues.

As for some of the issues I have seen with teams moving fast or that are larger. In one case we had around 40 commonly used databases, hundreds of tables in most of them, millions of data rows, multiple servers etc. Not saying the DB architecture was ideal, but it was not uncommon for larger systems at mid+ sized Enterprises I have seen as a consultant. Many times it is when an organization is between rapid growth still and getting discipline that you see a lot more of these types of issues (larger teams, fast moving still with a lack of BTDT leadership). The issues we saw between dev, stage and production were 1. the datasets were too large to replicate from Production to each environment, 2. security concerns over too many people having access to some of the data, 3. multiple teams split functionally instead of per sprint.

So how did these cause issues.

1\. We would not see all the data in each environment and while we would test across a wide swipe of data and also run queries trying to validate our alter and update scripts it wasn't uncommon every couple of deployments to have DB scripts fail to run because of some data we couldn't test against. The toolset helped us a little here, because the DBA's set it up to auto test changes against the production data before it would let the script run. And every time a script would fail they would add new test cases if it warranted it.

2\. Since not everyone could have access to all the data they couldn't predict every outcome, see #1. So the toolset helped us automate what they couldn't see so we could prevent some issues. This is very common when dealing with financial or PII in health care settings. Also, this SHOULD and could have been mostly resolved by not splitting teams functionally #3.

3\. Teams were split by their function instead of sprint. We had a data team, analytics team and development, each working mostly independent of each other. Meaning it wasn't rare for the data team to release a script to production in the morning which didn't get applied to dev/staging and then development comes along a few hours later tests and gets sign off on their changes in staging. Then development deploys to production and has scripts fail to run in production or causing some data havoc (or vice versa between the teams). Had the teams been integrated better this would have been less likely but still not impossible. And I hear all the purist saying well the problem was someone skipped stage etc. Yep, it sure is a core problem, but frankly in every environment I have worked I have seen it happen and so to dismiss it as it shouldn't happen is naive. Like saying well I am not testing for any errors in my code because there shouldn't be any, uh huh. So when we used the toolset it would tell us hey, something has changed here, and the DDL looks different than what you said it should look like, abort.

Also, most places I have seen need to routinely do production to stage and dev refreshes to help prevent a lot of these types of issues, which right there tells you that shit happens and it is nearly impossible to plan for all outcomes when it comes to complex systems. So tools are the right thing to help you.

Last point, when we did have major deployments and a lot of DB scripts were going out, the toolset also would run through all the scripts and warn us of conflicts. It would give us false positives sometimes, and miss some things, but it really saved our asses more than once.

Sorry for the length, just wanted to share. FWIW, we agree the simple methods work, its just that tools and frameworks, implemented properly really do mitigate some of the human and process failures we all have from time to time.

<comment><USER6> Ty for the share.

</comment></comment></comment></comment></comment></comment><comment><USER7> > Currently we email each other when we change the table layout but this takes > a lot of time and feels very backwards from regular Git commits. Does anyone > have any advice to version controlling a database layout?

One method is to use pg_dump to produce the script to recreate the database, and keep that in version control with source. It may not be the best method, but its probably the one that requires the least changes to existing workflow of modifying the database and still gives something like what you want.

</comment><comment><USER8> [http://sqitch.org/](http://sqitch.org/) \+ git

</comment><comment><USER9> A simple framework for database migration that has worked for my team:

[https://github.com/guilhermechapiewski/simple-db- migrate](https://github.com/guilhermechapiewski/simple-db-migrate)

</comment><comment><USER10> Flyway is a Java based migration framework. It's pretty good. It's simple and straightforward. [http://flywaydb.org/](http://flywaydb.org/)

</comment><comment><USER10> Flyway is pretty good. It's Java-based. [http://flywaydb.org/](http://flywaydb.org/)

</comment><comment><USER11> My team is using Red Gate</comment>


Everything Dot NYC - <AUTHOR> http://www.gothamgazette.com/index.php/government/5036-everything-dot-nyc

<comment><AUTHOR> "Landrush" period runs from Aug 4th to Oct 31st. If there are multiple parties who want a name, auctions will be held after Oct 31. Is that only for non- trademarked names?

[http://www.ownit.nyc](http://www.ownit.nyc)</comment>


Interactive story books on Google play. provide feedback please - <AUTHOR> https://play.google.com/store/apps/details?id=com.mangoreader

<comment><USER2> This looks fantastic!

Unfortunately, the app is not compatible with my HTC Evo on Sprint. :(</comment>


Shareable Web Links that Open iOS Deep Links - <AUTHOR> http://benroesch.com/2013/05/23/shareable-web-links-that-open-ios-deep-links/

<comment><USER2> If the ffprophets:// link is opened on a device that doesn't have the app installed, the user will have a broken experience. You can work around this using a technique like the one described here: [http://stackoverflow.com/questions/13044805/how-to-check- if-...](http://stackoverflow.com/questions/13044805/how-to-check-if-an-app-is- installed-from-a-web-page-on-an-iphone)

<comment><AUTHOR> Good call. Admittedly, I put this together very quickly yesterday when we ran into the issue of wanting to share a link. Would be nice if you could somehow avoid rendering a whole page, but I can't think of anything off the top of my head that would allow you to do that.

<comment><USER3> Instead, you can redirect to a web page with an iOS Smart Banner at the top. If the app is installed, the user must tap the open button. If the app is not installed, the user can tap the install button and the app will then install and open to the same designated in-app URL.

An alternative hacky method to avoid the web page is to redirect the browser to a JavaScript URL. However, this results in a momentary error popup, though it's automatically dismissed. And the user is still navigated to the backup URL when Safari returns to the foreground in the future.

For example: javascript:window.location = 'app-schema://'; window.setTimeout(function() { window.location = '<http://app-url>; }, 10);

EDIT: After thinking about it, since timers are suspended when Safari enters the background, you can probably use setInterval and check how long it's been to decide whether the browser should navigate to the backup URL. The error popup remains a problem, however.

</comment></comment></comment><comment><USER4> I went to the website of the app mentioned and couldn't see what it is for/about. All I could see was the tagline:

Fake money won is better than fake money earned.</comment>


China About to Start $35B of Silk Road Plan in Pakistan - <AUTHOR> https://www.bloomberg.com/news/articles/2016-11-24/china-about-to-start-35-billion-of-silk-road-plan-in-pakistan <comment><USER2> Another traditional US ally re-aligning itself between the two major spheres of influence. The balance will tip further in China's favor as the USA recedes further from global development.

What's interesting is if you look at the parallel international institutions that China are developing that will compete with the IMF et al, many of the partners are traditional and very close allies of the United States.

For ex. with the Asia Infrastructure Investment Bank, six of the top ten participants are all traditional very close allies of the United States - including Australia, France, the UK and South Korea[0]

Long before Trump, Obama lobbied the leaders of these nations and advised against joining the AIIB, to no avail[1] All that post-war development and planning of building up the US sphere of influence slowly and steadily fading away.

[0] [https://en.wikipedia.org/wiki/Asian_Infrastructure_Investmen...](https://en.wikipedia.org/wiki/Asian_Infrastructure_Investment_Bank)

[1] [http://www.reuters.com/article/us-europe-asia-bank- idUSKBN0M...](http://www.reuters.com/article/us-europe-asia-bank- idUSKBN0MD0B320150317)

<comment><USER3> While your analysis is true, it only describes the effects which have lead to today's situation.

Here are a few causes:

* In late 80's US empire has definitely thrown international law above the board by organizing color revolutions, destabilizing other countries and waging wars

* US empire and its vassals (other NATO members) leave a trail of blood where ever they show up

* Officially, US military - despite its huge budget, infrastructure and human power - still has not (15 years later!) defeated "the terrorists"

* US empire has definitely destroyed its financial reputation in 1971 by unilaterally canceling the "gold standard" and, since then, the masks are off and US dollar is being printed/created in the computer at the speed of light, without anything but military might to back it

* World Bank and IMF - two institutions majorly influenced by the US - wreak havoc in South America, Africa, South Asia and South Europe

* Russia is getting back on feet after 2000 and US empire has no means to counter it

* US empire and its media have done something remarkable in the 26 years since the fall of the Berlin wall: In 1990 USA was a country with a great image, in 2016 USA is arguably the most hated country in the world

The world outside of the empire sees all this. And runs away from the bully who has ("long before Trump") made himself weaker by seeking refuge in those who show at least some respect.

<comment><USER4> > America's overall image around the world remains largely positive. Across > the nations surveyed (excluding the U.S.), a median of 69% hold a favorable > opinion of the U.S., while just 24% express an unfavorable view. However, > there is significant variation among regions and countries.[0]

I think we can agree the US often acts like a douchebag and that it has a lot of passionate haters, but the fact is that there are not that many great countries in the world.

It's true that the US is not number #1 in a lot areas and I really believe that's a good thing. The whole world should improve, not just the US. Inequality is at the root of a lot of evil in this world.

[0] [http://www.pewglobal.org/2015/06/23/1-americas-global- image/](http://www.pewglobal.org/2015/06/23/1-americas-global-image/)

<comment><USER5> The US is probably the nicest and most responsible super power ever.

A super power like the Roman empire would have won the Afghanistan war for sure. But in a different way.

<comment><USER6> Even the nicest mass murderer is still a mass murderer.

<comment><USER5> I don't think the US did mass murder in Afghanistan. This was part of the problem. The Romans would have just made a population reduction of XX% per year and things would have been fine. I think you should put your judgement into perspective.

<comment><USER7> Decimation in the original sense of the word?

<comment><USER5> Yes. But decimation, as far as I know, was something the Romans did to their own divisions for "unsatisfactory" services. But regarding Afghanistan, if you crucify a few thousand men, women and children every day for the smallest offence, resistance breaks fast.

<comment><USER8> "...if you crucify a few thousand men, women and children every day for the smallest offence, resistance breaks fast."

You would know this, how? Look at the butchery in Syria and tell me how people respond to genocidal despots.

<comment><USER5> Ou dear. The looses in Syria a minimal.

By the way, the losses of the US in the Vietnam war were minimal too. They lost 60.000 People. In the 10 years or what, I assume they lost more people in traffic accidents and suicides. Just to put numbers a little bit into perspective.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm in West Africa now, and it's staggering to drive out of a tiny jungle track onto a highway equal in size and quality to anywhere in the world. It's also staggering to catch up to the road crew and see they are all Chinese.

Same goes for the hydo plants, railways, etc.

Of course, almost all of the roads and railways are to extract resources, not to help locals in any way.

<comment><USER10> Could be a win-win situation for both the Chinese and the local.

<comment><USER9> China stripping all the resources at a fraction of the international price, raping the environment, hiring zero locals, and building roads and railways that go from some place useless to another place useless.

No, It's really not helping locals.

<comment><USER11> Yep, I forgot about the masses of Chinese workers currently there (e.g. Ghana). One can only hope rising Chinese standards and wages will eventually convince them to hire local instead.

</comment></comment></comment></comment><comment><USER12> The Karakoram Highway, between Pakistan and China, is an amazing engineering achievement.

The cartoonist and author Ted Rall has visited Central Asia many times.

[http://rall.com/2009/06/04/the-karakoram- highway](http://rall.com/2009/06/04/the-karakoram-highway)

<comment><USER13> That's a great article - it'd be interesting to know if the KKH has changed much in the intervening 17 years.

<comment><USER14> Apparently there are still bad sections, but more of the highway has been upgraded.[1] China is providing most of the money. In 2010, a major earthquake caused landslides which created a new lake, taking out part of the highway. It took until 2015 to build a new route with 5Km of tunnels.

Here's a partial list of projects being funded in Pakistan by China.[2] China's government seems determined to get a land linkup to Europe. Yet this isn't the main "New Silk Road" route - that's further north, through Iran and Iraq.[3] With all the wars in that area, China apparently sees a need to have multiple alternate routes for trade. Good thinking in Beijing.

[1] [https://en.wikipedia.org/wiki/Reconstruction_of_the_Karakora...](https://en.wikipedia.org/wiki/Reconstruction_of_the_Karakoram_Highway) [2] [http://boi.gov.pk/userfiles1/file/List%20of%20MoUs.docx](http://boi.gov.pk/userfiles1/file/List%20of%20MoUs.docx) [3] [http://www.xinhuanet.com/silkroad/english/index.htm](http://www.xinhuanet.com/silkroad/english/index.htm)

<comment><USER15> China is also extremely interested in economically developing its inner regions, as they've lagged economic development which has come to coastal regions due to high cost of logistics. Anything bought in Islamabad that's 'made in China' was likely manufactured on China's east cost, and arrived via ship.

If it would be economically viable to have the same thing manufactured in Xinjiang or Qinghai, and shipped by road, it would be a huge boost for those areas. Especially if linked through Pakistan's road network to sea ports, bringing easy access to Middle East, Europe, Africa as ships would no longer have to navigate via Singapore.

An in reverse, it would be a huge diversification of import routes for commodities could come in via another route. Not oil specifically, but all kinds of bulk. Bulk carries of commodities are far less efficient than oil ships, the largest with a capacity of 100,000 tons but 30-60k capacity more common (far less than the capacity of a supertanker). So commodities needed to develop the west of China now have a simpler, more efficient route.

</comment></comment></comment></comment><comment><USER16> I am from Pakistan and I really wish it was the US. I wish they had spent 1/10th of the money on development they spent on the war. This could have been something that brought stability and more US influence in the region. I think China will reap all the benefits now.

<comment><USER17> Where in the world has the US brought stability with its international politics?

<comment><USER18> Europe for a couple of decades following WW2.

<comment><USER19> Why just couple of decades? Its still quite peaceful here.

<comment><USER20> Yes, but not significantly due to recent US policy or actions.

The Taiwan policy has been pretty good over the last many decades, and there have been other interludes of excellence, such as that offer to Marcos ("you can live in the US and enjoy the spoils of your crimes in peace if you move NOW and PEACEFULLY"). I'm sure there are more.

</comment></comment></comment></comment></comment><comment><USER21> The one thing the article doesn't mention is that some of the projects under this plan passes through the Pok (Pakistan Occupied Kashmir), which creates a precarious situation between India, Pakistan and China over Kashmir.

<comment><USER22> None of this goes through POK ([https://en.wikipedia.org/wiki/Azad_Kashmir](https://en.wikipedia.org/wiki/Azad_Kashmir)), could you reference any? If you are thinking of Gilgit-Baltistan ([https://en.wikipedia.org/wiki/Gilgit- Baltistan](https://en.wikipedia.org/wiki/Gilgit-Baltistan)), it got independence from Dogra Raj in 1948 after a short war, then the tug-of-war b/w Pakistan and India and rest is history.

<comment><USER23> The princely state of Jammu and Kashmir was comprised of Jammu region, Kashmir Valley, Ladakh, Gilgit, Baltistan and a bit of Aksai Chin.[1] So, India have Jammu, Ladakh and a part of Kashmir. Pakistan have POK (Azad Kashmir + Gilgit- Baltistan). And, China have Aksai Chin.

[1] [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(princely_st...](https://en.wikipedia.org/wiki/Jammu_and_Kashmir_\(princely_state\))

<comment><USER22> You are right upto 1948, when we fought for our independence to get rid-off Dogra Raj, and became independent and affiliated with Pakistan. So Pakistan did not occupy us. Each side (both India and Pakistan) narrate this story for her benefit :)

</comment></comment></comment></comment><comment><USER24> When this goes live, China will gain access to an Indian ocean port in Gwadar. This project runs through Gilgit-Baltistan and Kashmir; these are contested/disputed territory between India and Pakistan. China and India already have boundary disputes in Kashmir and in Arunachal/Tibet

More than an Indian ocean port (which could be blockaded by India in case of a war with either of Pakistan or China), this will connect China by road with Middle East Asia and other Central Asian states; China hopes this connectivity will boost trade in the future.

This project is undertaken with the intent to engage the excess capacity of the engineering firms that have grown and matured over the years with China's economic surge in the last three decades. These companies have the expertise, technology and project management expertise—to build roads, dams, bridges, tunnels, rails, trains, engines, steel, cement and myriad other things—but doesn't have any takers as they had earlier because of the economic slowdown in China.

Another reading is that China has lots of Capital which it can invest abroad but not at home. With the overheated economy at home it is wiser to redeploy it in countries with friendly disposition to Chinese investments.

If all goes well China can get a new avenue for its products. Even if none of it works it is not too bad, as China will get the host governments indebted. Sri Lanka[1], with its Hambantota port project, can be considered as an example.

[1]: [http://www.forbes.com/sites/wadeshepard/2016/11/17/sri- lanka...](http://www.forbes.com/sites/wadeshepard/2016/11/17/sri-lanka-claims- it-didnt-really-sell-key-national-infrastructure-to-china/)

</comment><comment><USER25> In (somehow) related news, Morocco is enlisting the help of China for building a new City.

[http://qz.com/841803/morocco-wants-to-build-a-new-city- from-...](http://qz.com/841803/morocco-wants-to-build-a-new-city-from-scratch- with-china│)

They just finished building a Huge bridge near the city of Rabat.

[http://www.thearabweekly.com/Economy/5954/Rabat%E2%80%99s-ca...](http://www.thearabweekly.com/Economy/5954/Rabat%E2%80%99s-cable- stayed-bridge-to-have-big-effect-on-Morocco)

</comment><comment><USER26> I'm not sure why the bottom comment is marked "dead", but it seems prescient to me. Isolationism is exactly what China wants the US to do.

<comment><USER27> Being off topic probably had more to do with it. Personally, I'm happy to see that the first comment is related to the story and not the predictable China bashing.

<comment><USER26> I suppose you have a point, as it is just speculation. But if we are being consistent, we should probably admonish the US-bashing as well, since it is perhaps even more irrelevant.

</comment></comment></comment><comment><USER28> Ah. One hears a lot of complaining from Pakistan and it's citizens against the US and it's apparently damaging policies.

It's unlikely for one to hear such complaints against China, as China will nip any dissent in the bud, with an iron fist. The great Chinese censor and censure machinery will soon hold a tight grip around the citizens, media and politics of Pakistan. Happy 2017 and beyond!

</comment><comment><USER29> Related article regarding China's investment in Srilanka.

[http://thediplomat.com/2016/11/china-and-sri-lanka- between-a...](http://thediplomat.com/2016/11/china-and-sri-lanka-between-a- dream-and-a-nightmare/)

</comment><comment><USER30> With most of industrial China on the eastern side, I wonder how beneficial will this trade route be, to China.

<comment><USER31> This creates more roads/rail from the ports (Gwadar/Karachi etc) to the inland (Islamabad etc), so it will help Chinese trade goods, which almost exclusively arrive by ship to the ports.

(Of course, facilitating trade is of secondary importance to the geopolitical aim of gaining influence in Pakistan by making it more dependent on Chinese money and less dependent on western capital markets or western multilateral organisations.)

<comment><USER32> Anything that makes Pakistan more prosperous and economically stable is a good thing for the west, the rest of the world and Pakistan.

Anything that gets China more positively engaged with the rest of the world is good, because it makes China more interested in international stability, property rights and the rule of law. Eventually I think China will come to realize that, as a major investor and driver of economic development around the world, their interests align very closely with those of the west.

<comment><USER33> >more prosperous and economically stable is a good thing for

This is such a crucial point. No one in the world needs an unstable, angsty nuclear-armed state.

>think China will come to realize that, as a major investor and driver of economic development around the world, their interests align

I think China realized long ago that being prosperous while having hungry neighbors on its doorstep is not really conducive to regional peace. They actually prop up NK exactly for this reason I believe.</comment></comment></comment></comment>


Critical Vulnerabilities in JSON Web Token Libraries - <AUTHOR> https://www.timmclean.net/2015/03/31/jwt-algorithm-confusion.html <comment><USER2> [https://news.ycombinator.com/item?id=9301054](https://news.ycombinator.com/item?id=9301054)

        Critical Vulnerabilities in JSON Web Token Libraries (auth0.com)
        147 points by pr0zac 58 days ago | cached | share | flag | 52 comments

</comment><comment><USER3> This is one instance where a naive approach may be better than a library... the two times I've written/used JWT one time I used JWE (encrypted tokens) with a private key... the other, I only supported public/private signing (no HS256).

In practice, I tend to treat specifications as guidelines, more than absolute. I wrote a simple SCORM implementation for an eLearning software that was mainly for testing content being developed. This became the LMS for a _VERY_ large aerospace company for about 9 years, not to mention evolving and being included as a base for several products since (over the past 12-13 years). I didn't implement the entire spec, only what was most needed for my own use. It went over 11 years before a missing piece of the spec was requested to be added.

I guess the point is, when you have something that is as relatively easy to implement as JWT, it makes sense to do it yourself, and only implement those pieces that you need.

</comment><comment><USER4> IMHO the proposed API fix is also risky. I can see someone trying to be clever and simply extracting "alg" from the header themselves, feeding it to verify(), and then thinking "Jeez, why isn't this library smart enough to do this for me?". Someone copying and pasting the snippet to Stack Overflow to do just that would be inevitable. A better fix might be to make like /etc/shadow and stick the algorithm type on to the front of the encoded secret key.

[Rant] Optionally use a statically typed language that supports overloading of the original, nice simple, function instead of doing crypto on malleable data formats in dynamically typed languages and expecting good results... if you go to the JWT homepage[0] you'll see all the statically-typed languages are unaffected by this vulnerability. Coincidence?

[0] [http://jwt.io/](http://jwt.io/)

<comment><USER3> that's only half the suggested fix, the other half is to remove alg from the header altogether... In practice, I've always ignored the alg header, and just used the expected alg for my implementations.

</comment></comment><comment><USER5> having worked with JWT token in places where it is used for monetary transactions, I have been witnessing a creepy discrepancy between the required level of knowledge to use them and the actual level of developers.

In one place, I was sacked for saying too loud that JWT are base64URL encoded and not base64 encoded.

The JWT token being passed in get, it made the auth system fail 40% of the time. And nobody understood the bug...

I sent the bug report internally to the security department, and they saw nothing wrong.

I discussed with a lot of other coders, they saw nothing wrong.

My experience is JWT token are too complex to use.

An authenticated session HAS to be statefull, the web is stateless. That's the point.

PS it looks a lot like a logjam attack

</comment><comment><USER6> Issues like this aside, why couldn't they just design it using AES-GCM or whatever authenticated encryption scheme instead of AES + MAC?

There is literally no reason to use encrypt + MAC when there are authenticated encryption schemes available.

<comment><USER3> I think the original intent of the spec was to allow some flexibility... in practice supporting this flexibility lead to some vulnerabilities.

In this case, when you're expecting tokens using public/private pairs for signing tokens and a client library also supports a different signing method, you can forge a token targetting a specific client.

The purpose of having a signature method was to have a _fast_ system in place for being able to verify a token per request... fully encrypted tokens have slightly more overhead when there will be a lot of small requests... though you can also use an in-memory, or simething like redis to have a cache of pre- hashed tokens on the same system, which would reduce at least some overhead for the validation.

As I mentioned in my own post, JWT is easy enough to implement an expected methodology, when you are only supporting a single authority, that I hadn't even considered the problem mentioned in the article, I'd actually ignored the header part for my own use.

<comment><USER7> _I think the original intent of the spec was to allow some flexibility... in practice supporting this flexibility lead to some vulnerabilities._

I think less than a week ago (weakdh) tptacek was mentioning on twitter that security schemes should be versioned but not extensible exactly due to these kind of errors.

<comment><USER5> This was predicted [http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road- to-h...](http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/)

Oauth 2.0 is so much of a flexible framework it almost boils down to "roll your own crypto with very complex tools and a lot of moving parts"

I am gonna watch the world burn safely eating my popcorn with my old fashions AAA system (radius, LDAP, ssh..) expecting more vulnerabilities to be uncovered and waiting for employers and architects to require my now valuable knowledge.

Mouhahahahahahha

</comment></comment></comment></comment><comment><USER8> It's worth noting that this article is from March.</comment>


TypeORM - <AUTHOR> https://github.com/typeorm/typeorm <comment><AUTHOR> Wanted to share this out there. Was looking around for some TypeScript-native projects recently and came across this and nest. Looks to have had a ton of work put into it.</comment>


It Isn't Easy to Figure Out Which Foods Contain Sugar - <AUTHOR> http://www.nytimes.com/2016/05/22/upshot/it-isnt-easy-to-figure-out-which-foods-contain-sugar.html <comment><USER2> If it looks like it is more than one degree separated from being alive then it contains added sugar.</comment>


Streaming Music Showdown: Spotify vs. Beats - <AUTHOR> http://time.com/3727640/spotify-beats/

<comment><USER2> As a consumer and long time Spotify users, it really comes down to:

      * Price
      * Music library
      * User experience
      * Availability (web, desktop, mobile)

Although I think the Beats deal was/is stupid, I'll go with whichever streaming service meets all four the best.

<comment><USER3> Ever tried Google Music? I've been very impressed both with their ability to take stuff offline seamlessly, size of the catalog, and the ability to upload one's own tracks for inclusion.

$10/mo, 90 day free trial if you own a chromecast.</comment></comment>


How a Perl 5 Program Works - <AUTHOR> http://www.modernperlbooks.com/mt/2009/08/how-a-perl-5-program-works.html <comment><USER3> From the "questions" section at the bottom of the article:

> _Wait, so Perl 5 doesn't interpret every statement as it parses it?_

I'm sorry, was anyone seriously suggesting this? Don't most production-grade interpreters still parse the program before executing it?

The article seems to be premised on a very strange definition of compilation. It's suggesting that building a parse tree and then executing it is compilation. Maybe I missed something, but compilation as an activity generally has a _translation_ flavour about it. This really doesn't. There is no "target" language. There is a data structure that stores a representation of the source code, and then some program transformations (within the same source language semantics). It then executes the _original program_ using the representation stored in this data structure. Sure, it's not like it's executing as it is parsing, but there is no "code generation" here. If you dumped out the data structure storing what is essentially a parse tree, you would basically get the original source program (+/- some syntax).

We're _still_ in the same source language. No "compilation" has happened. Am I missing something? Is there a reason the author is claiming that there are distinct "compile" and "execute" phases when he appears to be describing a fairly run-of-the-mill interpreter implementation?

<comment><USER4> How is the transformation into bytecode before execution not a translation? Yes, the bytecode format is perl-specific, but you can't easily get at the real original source code again.

<comment><USER3> It's not bytecode! There is no bytecode involved at all. It's just a representation of the source program text.

For example (in some pseudo-code):

a = x + 10

Perl 5 builds a tree from this (e.g. Assign(a, Add(x, 10))) and then executes it. Even the traversal of the tree proceeds according to the results of executing the program up to that point.

If we were to take the tree I generated above, we could get the exact same program out of it. I agree that this would be difficult with Perl - <USER2> because the parse tree is substantially different from the program text, but rather because it is _ambiguous_.

We could also target some arbitrary language. This is not the case in Perl, because it _can't_. The tree has absolutely no meaning other than that given to it through execution. It's not even an abstract syntax tree - it's just a parse tree! The semantics of the tree are exactly the same as the Perl code from which the tree was derived. And I don't mean "semantically equivalent", I mean, "identical by definition", because the source only has meaning because the tree is executed.

In a compiler setting, we can take an arbitrary (valid) program and give its meaning in terms of the target language. An _abstract syntax tree_ has its own semantics, into which the original program text (or parse tree) is translated. The AST is given a semantics by a code generator, which translates constructs in the AST into constructs in the target language (which has yet another set of semantics).

<comment><USER4> I'm sorry if I was unclear, but I still don't see any problem with this being called a compilation of one format into another.

<comment><USER5> Words mean what they mean. You could call any interpreter a compiler if you twisted it, and you'd sort of be right, but you'd be a lot more wrong. Same in this instance. Its an interpreter! And yes, it sort of does a job close enough to compilation that you wouldn't _really_ be incorrect calling it a compiler, but its not a compiler dammit!!

<comment><USER4> I agree that perl is not a compiler, but an interpreter. I disagree however if you say it doesn't perform compilation of the source.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> See also HN discussion on original PerlMonks post that started all this: <http://news.ycombinator.com/item?id=761103>

</comment><comment><AUTHOR> Also see Stackoverflow question on this topic: [http://stackoverflow.com/questions/1280594/can-perl-be- stati...](http://stackoverflow.com/questions/1280594/can-perl-be-statically- parsed)

</comment><comment><USER6> I love Perl.

<comment><USER7> Read that article and you wouldn't love it as much. Of all the high-level languages whose compilation and evaluation model I am familiar with, Perl5's has got to be the worst. I can't even classify it; the intermediate representation and evalution is not stack based or register based, it's not threaded interpretation, not metacircular, it's not graph reduction or term rewriting, not even "string" based (a la the weird 3rd implementation of Scheme in Kent Dybvig's PhD thesis.) So what on bloody earth is Perl5? At least Basic has the decency is to be stupid, both in essence and appearance.

Think of _any_ language family and you could classify them in some fashion. They fit some sort of a theoretical model you could reason about. Perl5 is .. well, whatever Larry knew how to do. However, it does a good job of not sucking for Unix administration; whenever I need it, about once every 6 months, Perl saves me from the trouble of launching splitvt and reading the manuals of several unix utilities. It's like a John Waters or a Roger Corman* movie, so bad it's good.

\--

* not to be confused with Richard Waters and the other Roger Corman, both fine Lispers ;-)

<comment><USER3> It's building a parse tree, and then attempting to use the unambiguous bits _like_ an abstract syntax tree, presumably to side-step the statically unresolvable ambiguity mentioned in the previous article.

And yes, that _is_ as bizarre as it seems.

I think this article is pretty disingenuous. It's trying to pretend that there is something really complicated going on here (e.g. "That's one way in which Perl 5 differs from other language implementations; it manages the artifacts of compilation itself"), when really, it's actually just poor design layered upon poor design.

> _Perl 5's execution model isn't quite the same as a traditional compiler > (whatever that means) and it's definitely not the same as the traditional > notion of an interpreter. There are two distinct phases of execution of a > Perl 5 program: compile time and runtime. You must understand the difference > to take full advantage of Perl 5._

This is true, but only if you don't really understand what a traditional compiler or a traditional interpreter might entail, given that Perl is basically doing what Python, Ruby, Matlab and any number of other language implementations do, it's just doing it in such a way that it has to account for flaws in the design of the language.

<comment><USER8> The much paraded statically unresolvable ambiguity _does not apply_ when the Perl 5 parser parses Perl 5 code for reasons explained in the article. The parse tree produced is unambiguous.

Grammar modifications in BEGIN blocks make the parsing process a little different from many other languages with which I believe readers are familiar.

<comment><USER3> Sure, the generation of a _parse tree_ is unambiguous, but the traversal order of that tree is not statically determinable.

I'm not even saying there is anything wrong with this, I'm just arguing that the way you have described the "compilation" process in Perl is basically a textbook description of an interpreter that relies on some runtime information in order to execute the program.</comment></comment></comment></comment></comment>


Mark Zuckerberg on Facebook's fake news: We're working on it - <AUTHOR> http://arstechnica.com/tech-policy/2016/11/mark-zuckerberg-on-facebooks-fake-news-were-working-on-it/ <comment><USER2> Fake news is a big problem.

If your media outlets were caught colluding with certain corporate favored candidates or told you that it was illegal to read Wikileaks, you might be watching fake news.

Mainstream media's credibility and ability to impact large groups of people is at an all time low. So rather than re-examine their coverage to see how they can better serve people and earn trust...the establishment is doubling down on the propaganda and trying to label the non-corporate controlled news as fake.

It's so transparent and it's such a joke that I can't believe how anybody is fooled by this.</comment>


Samsung Galaxy S9 and S9+ - <AUTHOR> http://www.samsung.com/in/smartphones/galaxy-s9/ <comment><USER2> I few weeks ago, after a long history of purchasing Samsung phones (S4, S6, s7 edge plus) because of the good hardware, I got an S8+ after my S7e+ abandoned me. This was the turning point where I decided I could no longer accept such awful software experience. Now there is even a physical button for their garbage assistant. The Android notifications are broken in favor of small things that do not allow you to read the message from Whatsapp or Telegram or whatever, and so forth. I returned the S8+ and switched to a Google Pixel 2 XL and it is _the best phone_ I've ever had. Samsung needs to get its shit together and understand that even if in their fantasy world where the management live they want to compete on services, it is totally impossible and actually they are just destroying the Android experience. If it was not for the software approach Samsung takes, I bet we could have far less Apple iPhone users.

<comment><USER3> Think the Pixel 2 XL is good... just wait until you upgrade to an iPhone!

<comment><USER4> I have experience of both, having to use IPhone for work. Android phones are infinitely better. I was actually surprised to find so many stupid bugs in IPhone. I'n my imagination they were solid phones for MAC users. Turns out, as they are the only option, they don't exactly focus on quality.

<comment><USER5> I've been an iPhone user since the 1st generation 8GB model. (Very 1st was 4GB.) The overall quality of software has gone down. I remember the first time an iOS update caused issues in some fairly foundational code. (Involving UIImage.) Before that, I thought Apple's iOS team infallible.

Today, I have moments when I'm just disgusted with Apple, as well as with 3rd party apps on iOS from well funded companies who should be doing better. Though to be fair, most of the time, things do work. It's just that I run into the odd place where...WAT!?

<comment><USER4> For me is just annoying small issues like when I listen to music and get a notification from another app suddenly the volume doesn't go up as high anymore and stays low until you reboot the phone. Or that when I'm on Bluetooth it will mess with the wifi and you need to disconnect and reconnect to make it work.

I also really dislike (maybe this is just me) that I can't deal with files as files on an iPhone. I can't just move an mp3 or an ebook to the memory, find it via an app and open it. It feels so locked it.

</comment></comment></comment></comment></comment><comment><USER6> [https://www.samsung.com/us/smartphones/galaxy-s9/](https://www.samsung.com/us/smartphones/galaxy-s9/) for US site.

Small question: Do people still buy $800 phones, and why? If you care about security, these probably won't receive security upgrades for more than a few years (S3 went from ICS to Kitkat. S4 went from Jelly-Bean to Lollipop, S5 went from KitKat to Marshmallow, S6 went from Lollipop to Nougat, so I don't expect this to make it past Android Q[1] (which should come out in two and a half years)), and unlike older models, custom ROM support is quite bad for modern Samsung models (S6 Lineageos just came out. S8 isn't supported yet).

Wouldn't it make more sense to get a slightly worse quality phone, but upgrade it every two years or so?

[1]. Unless Treble will make it so much easier to port to S9.

<comment><USER7> Anecdotally, the kind of person who spends 800 - 1000 on a phone also upgrades it every year or two. It's a status symbol as much as anything. Plus there's always the fact that you will have the latest and greatest camera, and for many people that's important.

Personally, I'm with you. Recently bought a Moto G5 plus for a couple of hundred euro and its fine. However, I do confess if I had a higher income I'd probably be another happy consumer of the super high end phones.

Worth noting that in Europe at least they have a very high resale value, so you will make much of the cost back if selling in a year or so in good condition.

<comment><USER8> "the kind of person who spends 800 - 1000 on a phone also upgrades it every year or two"

Nope, I don't mind how much my phone costs since I use it daily, but I will use it until some component fails in a terminal way. I had a Note 3, swapped its display module once, but it finally died. It lasted maybe three or four years.

<comment><USER9> > but I will use it until some component fails in a terminal way

This is what I told myself too, but I also upgraded after 3-4 years after being annoyed at just how slow my phone was (or to put it another way, just how much CPU power apps demanded now). The phone still works perfectly fine, it just slows down to a crawl right when you're in the biggest hurry. (e.g. at one point Google Maps took multiple _minutes_ to refresh the screen right when I was driving and trying to figure out the right directions, and I still haven't been able to reproduce it, but I sure as heck don't want to live through that experience again.)

</comment></comment></comment></comment><comment><USER10> Oh FFS. I don't need a fancier camera. I don't need animated emojis. I need a battery that lasts all day without having to keep the phone in low-power mode all the time. And I want it removable so when it wears out I can replace it myself. Samsung is jumping the shark.

<comment><USER11> If you don't mind having a bit bulkier phone, I can highly recommend getting one from the Moto Z family + a battery moto mod.

I have a Play Z 1st gen and together with the mod, the battery lasts 4-5 days. It's pretty affordable, and while it's pretty bulky that is easily outweighed by not having to worry about running out of power anymore.

<comment><USER12> FWIW I'm very happy with my new Moto Z series phone so far. I haven't sprung for any mods yet but the phone itself is good. Battery life isn't great without the battery moto mod, but seems typical. For $350 unlocked I'll take this any day over an $800 phone.

</comment></comment></comment><comment><USER13> I can understand that Samsung's target market doesn't consist of users who may install Lineage or other ROMs, but what's their motivation for selling a phone with a locked bootloader? Samsung sells excellent hardware, and as an S8 owner I've found their version of Android is acceptable. But why not allow users to unlock the bootloader: what's the risk to Samsung by allowing this?

<comment><USER14> from what i've read it's not Samsung but the carriers that require it to be locked. outside the states you can get an unlockable bootloader on both Snapdragon and Exynos variants.

it pisses me off because my wife purchased a Sprint flavor S8 (full price, no contract) because its radios are better for Sprint's bands but i cannot unlock it to install Lineage or TWRP >:(

EDIT: i might be wrong, _all_ Snapdragon variants are locked. the best that's been achieved is root with a bunch of caveats:

[https://forum.xda- developers.com/galaxy-s8+/development/root...](https://forum.xda- developers.com/galaxy-s8+/development/root-g955u-g955u1-snapdragon- sampwnd-t3658911)

<comment><USER15> Carriers don't seem to have an issue with any of Google's phones being unlocked, I don't see why they would only require it on other manufacturers. They might prefer locked bootloaders, but Samsung has enough sales volume that I imagine they could do whatever they wanted.

<comment><USER16> Carriers don't tend to sell Google's phone. Verizon seems to be the only carrier selling Google's Pixel, and they have a locked bootloader on that version.

</comment></comment></comment></comment><comment><USER17> Nice device, horrible software. If Samsung did another Google Play edition like they did with the S3, I'd buy one.

I've been looking for an upgrade to my current Android phone for a little minute. I just want vanilla Android and an aesthetic device. I don't care about the camera, bigsby, or face/touch unlock.

The Pixel 2 feels great, with it's super stock Android, but it's design is very lackluster. If I am spending a thousand dollars (Australia), then I don't want to make any compromises.

As a consumer, I'm feeling let down by the selection of phones. Honestly, the iPhone has never looked better to me.

<comment><USER18> I was in this very boat recently. My LG backup phone got bricked by an OTA. So I was left with a flip phone while waiting.

My requirements were less than 300, stock android realistically two years out of the device. 4.5" to 5", smaller preferable, and a headphone jack. There was almost nothing like this.

I ended up on the google pixel. However, it was difficult as I kept getting Verizon bootloader locked revisions. Despite them being listed as international or gsm unlocked. I finally found one in my upper bracket at 450, 128GB version. Its official support ends in October of this year. I've also read about a ton of hardware issues so I'm hopeful it'll hold out.

Android phones are to me a shit show, to put it mildly. They're good, but not long term. I'm also leary of buying higher ended phones. I've had far to many times where my phone was knocked out of my hand at a bus stop. Then broken screen.

The closest I've seen right now is oneplus or get a last gen pixel.

<comment><USER17> Between my last post and this one, I literally bought a Pixel 2.

I'm salty and aware that this will last me 2 years.

</comment></comment></comment><comment><USER19> "Add music. Make GIFs. Get likes"

Captures the very purpose of a smartphone, doesn't it?!

<comment><USER20> Don't forget the emojis!

Definitely shows their target demographic.

Does it have a removable battery? MicroSD? How about the CPU, RAM, and other specs? That's what power users want to know, and it's conspicuously missing from that page (the word "battery" doesn't even appear, not even once!)

<comment><USER21> > How about the CPU, RAM, and other specs?

For things like smartphones that each run their own operating system variation, aren't these just vanity specs?

What good is comparing the RAM on an Samsung Galaxy to an iPhone?

</comment></comment></comment><comment><USER22> Interesting, if there is one thing I hope Apple takes away from this, it is the adjustable aperture. But time will tell whether a moving part will last long on a smartphone.

Though I fear that, like with Google's dual CMOS, they are too committed to the multiple cameras and removing one may come off as a downgrade to consumers whether or not a single one can satisfy all the same functions.

<comment><USER23> One thing I'm not understanding here; don't most lenses (and by extension cameras) have adjustable apertures? What is so special about having a F1.4 vs. F2.4 apertures available to the camera? Is it because they can both fire at the same time and compose the two exposures?

<comment><USER24> MKBHD has a good explanation (starts at 2:43): [https://www.youtube.com/watch?v=J83sZrz9XTc](https://www.youtube.com/watch?v=J83sZrz9XTc)

Basically this is the first(?) camera phone with adjustable aperture, albeit it only has 2 presets.

PS: Might be useful(?) [https://photographylife.com/what-is-aperture-in- photography](https://photographylife.com/what-is-aperture-in-photography)

<comment><USER25> Not the first: [https://www.engadget.com/2017/12/01/samsung-w2018-flip- phone...](https://www.engadget.com/2017/12/01/samsung-w2018-flip-phone- variable-aperture-china/)

Buuuut probably the first flagshippy camera with a variable aperture.

</comment></comment></comment></comment><comment><USER26> The s8 is slippery as hell and very fragile. My screen cracked after just a month. Replacement is crazy expensive. Unless s9 changes that, don't buy it!

<comment><USER27> Yeah the s8 is insanely slippery. I put a concrete dbrand on the back of mine just so I could pull it out of my pocket and not toss it half way across the room. I'll never understand the all glass trend.

<comment><USER28> > I'll never understand the all glass trend.

I think Samsung and other manufacturers can't win there. People complained about the perceived build quality when their flagships had a plastic body. Unless you use harder and thicker polycarbonate (like the Lumias or the iPhone 5c) it's hard to have something that truly lasts. You're left with aluminum, which brings tons of problems (it's easy to bend, scratch, the anodization will fade, it feels cold and it's also slippery, and you need to make way for antennas), or glass.

</comment></comment></comment><comment><USER29> Unfortunately comes with Samsung's crapware that cannot be removed, and even a non remappable button to trigger it. I will be patiently waiting for an exploit to be found in the bootloader so we can reflash this with a ROM without Samsung anything. At that point in time, it will probably be a good contender for second best Android phone. After the pixel

<comment><USER30> You'll be waiting for a while; I bought an S8 with the intention of putting LineageOS on it. Sadly to this day there are things not working which are essential, like making calls or using LTE data... or wifi.. or the camera.

I thought I could deal with the Samsung crapware anyway, coming from iPhone and having used a OnePlus One with Cyanogen and later lineage... Boy, I was wrong, beautiful hardware for sure but the OS is utter garbage.

By garbage I mean: Bixby is unwanted and disabled, but it still pops up nearly constantly.. essential features of the phone require a samsung account, in an attempt not to sign up for it I get notified weekly that I _must_ have one.. samsung programs will randomly notify me about random things that I have no interest in knowing about. Especially samsung pay- I DO NOT WANT AN OFFER ON COFFEE JUST LET ME USE YOU TO BUY THINGS. Upday has a pre-loaded list of the worst british newspapers, and insists on telling me about "breaking news" regarding a nice young american lady who is marrying one of our princes...

I miss my phone being in my control, and that's what everyone who was selling me on android was telling me was compelling about the platform.. But I had much more control of my phone when I was with Apple.

(And yes, I donated heavily to the LineageOS+S8 effort)

<comment><USER29> Luckily since this phone ships with Android Oreo, it is required to comply with project treble, which makes this a whole lot easier. By definition, a phone with project treble has to boot and pass all tests in the Android compatibility test Suite with an unmodified AOSP image.

You can already see some benefits of this on the XDA website, where some people are successfully replacing system images on no name phones with barely any audience and not even a kernel source published

<comment><USER6> >By definition, a phone with project treble has to boot and pass all tests in the Android compatibility test Suite with an unmodified AOSP image.

But it won't help if the bootloader's locked

<comment><USER29> Correct. Hence my statement that I would buy one if and only if a bootloader exploit is found

</comment></comment></comment></comment></comment><comment><USER31> Having been with Samsung since the S3, my current S7 will be my last. It is THE most fragile phone I have ever owned - replaced 3x already, at $150/pop even with the insurance. I've never had to get a case for any other Samsung before, but this is unacceptable. My next phone will be a Purism.

<comment><USER32> I have an S2, S3 and S7.

The S2 and S3 have both been banged, dropped, thrown, splashed and sat on and they're still going strong.

The S7 slid off a low couch and fell about 30cm onto a wooden floor. It had a protective case on it, but the screen is wrecked.

Unless Samsung start manufacturing their S-range phones out of synthetic diamond I won't be buying another.

<comment><USER20> That's because the S2 and S3 were made from impact-absorbing plastic, which is a perfectly good material if it weren't for the designers and Apple's screaming about "premium materials" (i.e. breakable glass and rigid metal that transmits the impact force.)

Perhaps people need to get used to the fact that a "plasticky" phone which creaks and bends slightly, is also one that is far less likely to shatter if dropped. That flexibility absorbs and dissipates the impact force, which is the reason why plenty of other handheld devices (remote controls, etc.) are made of it instead of metal and glass.

"Bezel-less" screens make no sense to me either --- besides protecting the display itself from impacts, they are places fingers can be put to hold onto the phone without activating the touchscreen.

</comment></comment></comment><comment><USER33> Of all the things you would want to make a "me too" product out of, the iPhone X sure isn't one I would pick. It's sad that AR emojis and face recognition made the key new features list. Those two sounded like a gimmick when they were announced, and after actually using the iPhone X I can't say my opinion has changed.

The sooner Samsung either steps up their software game or quits it altogether, the better off their users will be.

<comment><USER34> FaceID is far more than a gimmick.

It is admittedly very much like TouchID version 1 i.e. it will need several revisions to be perfect. But you can really see why Apple went with it.

Because when your phone authenticates e.g. banking app without you even realising it you then appreciate that it is a better solution than a fingerprint reader.

<comment><USER35> But if I'm dealing with security, I DON'T want things being done without even realizing it.

I WANT my phone to only unlock or perform an action when I want it to do so. FaceID is the opposite of what I want.

<comment><USER36> The last 20 years have taught us to be super vigilant, but that is because the bad guys were (are) always at our heels (if not occasionally pulling ahead), but _surely_ the gold standard for security is that which is just there and works, but which you never have to see or think about.

Of course, _actions_ should only be taken when actually asked for, but a banking app that will show you (and _only_ you) your balance without a separate authentication step seems like a great thing. It can also add security to other apps that might perhaps be slightly under-protected due to the current hurdle of clearing auth: perhaps your messaging apps will only show the content of messages when it's you looking?

</comment></comment></comment></comment><comment><USER37> So why do all the images on that site look like shit? :D

Seems like they forgot to crank down the optimisation on image size.

<comment><USER38> They seem to be using real photos from their new low light camera which is commendable. Its unfortunate that their low light photos still look like crap.

<comment><USER39> They do look bad, but without knowing how low the light actually is I don't know how to judge them.

</comment></comment></comment><comment><USER40> This would be very nice. IFF they just allowed me to throw out their bloated software, put Lineage on the thing and still be able to use any of the non- standard hardware features. Frankly, the "biometrics" stuff in these phones is such an anti-feature IMHO...

</comment><comment><USER41> Did features plateau? I don't see things in this marketing that are new or exciting.

<comment><USER42> But but but isn't making an animated emoji the absolute _top_ of your priorities? How else will you get likes on social media???

/s

I do wish phones hadn't been reduced to this, but here we are.

</comment></comment><comment><USER43> Wow, the camera is f1.5 and the results look very nice. Blurring the background is neat and the results look good. Not perfect (check out the wisps of hair on the model disappear) but its so much better than the average photo i see shared on facebook. Bokeh filters are a bit of fun, but i can't imagine anyone i know will notice them or care about them.

Draw password with your eyes? Weird.

</comment><comment><USER44> I was hoping to hear something about the imminent Gear watch (S4?). I guess Apple is the only company that bundles their various releases into a single event?

<comment><USER45> Apple have several releases throughout the year.

</comment></comment><comment><USER46> How did Samsung it was a good idea to round the glass edges of a screen to the point that it warps displays colour & creates glare from indirect light?

It looks to be as big of a problem as on their 8 which I've observed people experience frustration with.

<comment><USER47> I have a S8+ and have never been annoyed by the round edges, never experienced any distorted colors or been annoyed by indirect light.

</comment></comment><comment><USER48> those emojis look creepy to me

</comment><comment><USER49> Glad to see they haven't removed useful stuff like the others. Considering upgrading my 2 year old S7e. But the prices are too high!

</comment><comment><USER50> They don't mention if it is splash proof and whether it is toast if you ever drop it, but it looks nice. :-)

EDIT: I see from the Verge video that they did retain the splash resistance.

<comment><USER51> Reports [1] say it is splash proof and, more importantly from my perspective, has a headphone jack.

[1] [https://www.theverge.com/2018/2/25/17044990/samsung- galaxy-s...](https://www.theverge.com/2018/2/25/17044990/samsung- galaxy-s9-plus-price-release-date-phone-camera-specs-mwc)

</comment></comment><comment><USER52> Does this record 10bit HDR video?

</comment><comment><USER53> Useless website. Couldn't find specifications anywhere.

</comment><comment><USER54> No analog headphone jack - no thanks.

<comment><USER55> I would have agreed last year. But I recently got some really nice Bluetooth headphones and am really digging not having a wire...

<comment><USER56> Good for you (not sarcastically, I'm really happy for you), but some people (including me) are not happy with the audio quality.

</comment></comment></comment><comment><USER57> I just don't see where Samsung is going with this. To me, iPhone and Pixel really beautifully fill the market for as phone of this price range.

<comment><USER58> Sorry, but even though I don't like Samsung phones, I really _despise_ this kind of comment. Imagine if someone said "we don't need more smart phones, iPhones ready beautifully fill the smartphone market". How shirt sighted do you have to be to turn your nose up at the very idea of competition in a market? Even if you stick with the original product in a particular market, competition almost always makes the original product better by keeping the creator on its toes.

I'm not a huge fan of this new Samsung release. But it's not because there's already phones in the market. Adding another phone to a particular market is a positive, not a negative.</comment></comment>


Qumulo and Chef Layoffs-are you affected? - <AUTHOR> Geekwire announces layoffs at Seattle-based Qumulo and Chef http://bit.ly/23yOPBI. If you were affected, Cloudera is hiring.Please check our openings here http://bit.ly/ClouderaJobs. Good luck folks! <comment><USER2> Capital One is hiring</comment>


Startup mistakes: Lessons from failed startups - <AUTHOR> https://www.failory.com/blog/startup-mistakes <comment><USER2> Are these really "mistakes" or are they just the random process of value discovery, which naturally involves a lot of failures. Finding product-market fit is not something you can engineer with perfect foresight. You raise money, you build something, and then you have a limited time to see whether your hypothesis about the market was correct. Often, if not most of the time, you fail to get the fit you need in order to succeed.

There are definitely execution failures, but in my experience spanning 20 years, I have seen far more failures that are really just failed experiments rather than execution failures. A half-decent team can get product-market fit; once you're there, attracting the people who won't fuck up the next phase is relatively easy. If you don't have product-market fit, no amount of genius will save your company.

<comment><USER3> > You raise money, you build something, and then you have a limited time to > see whether your hypothesis about the market was correct.

Or, you get to know an industry, see a need, design a solution, bounce your ideas off people in the industry, do some mock-ups to get some initial acceptance of the idea, ask if they'd pay for it, and if/when all that comes together, then start to build. If you cannot build it with your available resources, maybe look for some funding.

<comment><USER4> Works well if your startup is filling in a niche within an existing industry. Does not work well if your startup is creating a new industry. There is a reason why the failure rate for the latter situation is abysmal. But that is also the reason why the returns are so large and sought-after for that situation.

<comment><USER5> Why doesn't this work for new industries?

<comment><USER4> It's hard to "get to know an industry, see a need, design a solution, bounce your ideas off people in the industry" if the industry doesn't exist yet.

</comment></comment></comment></comment></comment><comment><USER6> "By far the most common reason for shutdown was lack of product-market-fit which constituted more than half of the marketing mistakes"

During the dotcom boom of the late 90's the issues in the Valley were often attributed to a lack of engineering talent. However, after the bust many founders and execs realized that their failures were not due to a lack of product and engineering talent, but that there were too many engineers putting out products that the market did not want or need.

This study seems to validate that idea. Without a clear understanding of the market and how to reach your potential customers, your idea is likely not worth the time. Spend more time on understanding the market, and how to reach it, and you will have a much better chance at success.

</comment><comment><USER7> I really hate those kind of content. Would you listen to someone who built a wall which collapsed ? nope

But you will tell me, if I can prevent the mistakes other made I will go further than them. Well I'm not so sure, for any mistake that someone thought they made there will be another person who identify this mistake as something which made them succeed.

These kind of articles are just porn for people who are not putting enough hours in working toward their ideas. (And top x things that made us successful is as stupid)

<comment><USER8> Sure the first 65% is work hard. But guess what? The last 35% is a much different ask that just does not succumb to that same hammer.

As the immediate parent implies, wall building is not all or nothing. Even in statistically controlled manufacturing processes there is std deviation. Not learning from mistakes is itself a kind of arrogance. In fact the preferred model is neither arrogant rejection or passive adoption. To use an a sort of Bhuddist analogy, we listen carefully and extract the gold from the gold+useless ore in the wisdom we hear and refashion it into our own art. This requires decent teachers (suppliers of know how) but also decent students who are interested in real learning not passive regurgitation. Making our own art is demonstration of mastery and of appropriate internalization. It avoids the silly extremes of man as an island and man as an empty if pious vessel to be filled with rhetoric that we can grandstand on.

Those of us in profitable and large organizations will see the same truths about market acceptance and customer approval in a modified way: often our organizations are too sterile and inward looking. Losing the customer starts slow but in that last quarter or two accelerates fast often with a profound finality to it.

</comment></comment><comment><USER9> These retrospective analyses, while intriguing to read, should be taken as more descriptive than prescriptive.

When you talk to someone who actually succeeded at something, they'll talk about platitudes like working hard, product market fit, iterating, listening to customers, raising a lot of money or not raising too much money, and so on. Many people go so far as to try to emulate the behaviors of their "hero" (Jobs, Gates, Page/Brin, Zuck, ...), but that's a fools errand.

In a similar way, these types of postmortems should not be taken as prescriptive. They too are full of platitudes.

<comment><USER10> I have worked for some companies that were total failures and some that were global successes. Having been through the failures first, I was excited to see how the magic worked at a massively successful company, but to be honest the differences are more subtle than anyone would believe. The big successes were happy to do things that had been disastrous at other companies in my experience, and did not pay much attention to the things that the popular press considered the secrets of their success.

As disappointing as it is to think this way, it's much like explaining the weather or the stock market. I think people need a story, but both inside and outside the company we are just guessing why a company fails or succeeds.

<comment><USER11> Andy Rachleff, known for his articulation of product/market fit, says a company with a lock on product/market fit can do almost everything else wrong and still succeed.

Google firing all of its managers early on in its existence is a great example of this.

<comment><USER12> It's like Scott G says, better to be a mediocre company in a great market, than a superbly-managed company in a bad market.

</comment></comment></comment></comment><comment><USER13> Good read with some really interesting information, but I don't know that I agree with the way it implies that there's a single, defining reason for failure. All of these things are intertwined - you can't get raise money if you don't have product market fit, and you can't bootstrap things if you aren't bringing in money. Team problems are tied into everything happening in the company. Tech problems are very much related to product market fit.

Like I said - good information, but I guess it's really the pie chart that made me feel like they were oversimplifying things.

<comment><USER14> Yeah, it's sampling from a distribution where every company has problems in every one of those spheres they are mentioning, except only one of these issues will be the last one to finally finish the startup.

So it's more about sampling from what kind of issues are more prevalent in a startup rather than what kind of mistakes they will be making.

</comment></comment><comment><USER15> My experience consulting for many startups is that what is called "Value add" is a real problem at more than 2 or 3% of startups. The momentum of the status quo is really strong and only gets stronger the larger your target company. For example, getting a 5 person company with 4 engineers to try your new Dev tool is an order of magnitude easier than a company 10x that size which is an order of magnitude easier than a company 2x THAT size.

</comment><comment><USER16> I remember digging into the source material used in this article, and contacting the founder, not Nico, but the other gentleman, can't remember his name, an amicable friendly chap. Anyway, I said to him, that a lot of the founders, although I respect their transparency and willingness to talk about unfortunately failing, they appear blinkered to the reasons for their failure. I won't mention the founders reply.

Looking at PMF in terms of:

1\. The definition of PMF

2\. How PMF is drummed into founders

3\. The proposed criteria to evaluate PMF

4\. The actual things to measure within the criteria

I won't pull a number out of my backside to state to what degree PMF wasn't the issue, but I will say PMF was not the problem in some of the startups mentioned in the source material. In some cases PMF was not something they should have even been looking for at the stage they were at.

Another reason that cropped up quite a few times. Bad Marketing. Putting growth over retention, automation and efficiency over learning and personally figuring out how to sell in person isn't bad marketing to me. That's a bad decision.

<comment><USER17> Really confused by the last paragraph, what's a bad decision? Are you saying

1\. focus on growth, automation and selling in person

Or

2\. focus on retention, learning, and automating sales

Both of which seem inconsistent?

<comment><USER16> Hello Matt.

I am saying, and I will elaborate:

1\. Focusing on growth instead of retention in the early stages and certainly before PMF or at least strong indications of PMF, is a bad decision.

2\. Focusing on automation and attempts at operational efficiencies when it comes to marketing and sales, again before PMF or at least strong indications of PMF is a bad decision.

When it comes to growth, automation and attempts at operational efficiencies, you do that when there are strong signals. You don't cut out selling in person, till you have an acceptable closing rate. Even then, I would still recommend frequent selling in person to learn more until there are diminishing returns.

Instead, you'll find an inordinate number of founders attempting to attain double-digit growth while there is triple digit churn. Automation of certain things like scraping lead lists, when the lists are nothing more than dump lists.

Hacking things out, when what they should learn is discarded because the process towards the end-goal cuts out what they need to learn, take on-board and become intrinsic.

Throwing up websites that are clones of well established competitors. Parroting without any deep understanding of why those things are on the site, of why those things need to be said. Oblivious to why they themselves are not in a position to say those things.

I would really like to say more on this. I would call it a pet-peeve, but I got a zoo full of them. If you want to carry on the discussion in private, happy to do so, but for now, I got work to do.

Cheers, Ace.

</comment></comment></comment><comment><USER18> Where should the primary responsibility for product market fit lie within a startup? E.g. product owner, CTO, CEO, .. ?

<comment><USER4> Founders. If you're using CxO titles before you have product market fit you're doing something wrong.

<comment><USER6> This. So many founders are enamored with their titles and their ideas more than actually building a real company. IMHO its the most obvious way to spot a future failure along with the amount of fluff PR and "thought leading" blogging...

</comment></comment></comment><comment><USER19> Hey HN. Founder of Failory here. Thanks so much for the positive & constructive feedback on the post.

We aim to keep publishing more of these researches in order to make it possible to learn from other startups' failures.

If you have any comments or feedback, you can drop me an email at nico[at]failory.com.

<comment><USER20> Do you have a breakdown of "Common Reasons For Startup Failure" by total funding amount bracket? Is there a trend?

<comment><USER19> We didn't find any significant correlation between funding and cause of failure. I guess, however, that this is because our data set was quite limited.

</comment></comment></comment><comment><USER21> This was a surprisingly good read and data-driven.

I found it surprising that the top reason for failure was product-market fit followed by team. I would have thought finance (#3) and tech (#4) would rank higher.

<comment><USER22> Amazon is littered with awesome tech that took 2-3 years to build and launch but failed because there was no market for it. I worked on one such product, a micro payments web service.

It took me a while to realize that that's just how Amazon operates. Carry out experiments all the time, most fail, but the ones who click take off spectacularly. As Bezos says, don't take Hail Mary bet. Take smaller bets all the time.

<comment><USER23> The thing that just continues to strike me since I left Amazon is how many start-up ideas are buried within that company. Coming from logistics, there is basically no internal tool or process that couldn't be turned into a start-up. Quite funny actually.

</comment></comment></comment><comment><USER24> I think tech problems are under-represented.

The thing about tech problems is that they don't show up as tech problems unless they are _really_ bad. They usually show up in lack of product-market fit, lack of adoption, high turnover, and difficulty with sales and marketing.

For example if you chose Electron for your app and put no effort whatsoever into slimming down what you are running inside, users might decide they don't want to use your app because it uses too much CPU and RAM. If you use a slow database as your SaaS app/site's backend, your site will be slow and users might bounce during trial. If you pick an unwieldy, bug-prone, or weird (a.k.a. hard to hire) technology you might experience a slow development cycle and find it hard to build enough features or fix enough problems.

Most of the time people won't tell you these things. They'll just move on. Some of them are subconscious, like performance issues. The app just doesn't "feel" good, it's not a pleasure to use, etc.

If you are trying to sell shit on a stick, your problem may not be marketing... but you can always blame it on marketing! If your stack makes your development cycle slow, maybe you're not finding product-market fit because you're hiking through the woods with an elephant strapped to your back.

Good tech choices are fundament. They enable everything else to work well. You need everything else of course... good tech alone won't cut it. But the rest of your company's operations are going to flounder if they are not properly equipped or if the product sucks.

</comment><comment><USER25> Are there any products that people really did want, for people who had the willingness and ability to pay for them, which are not in the market because of startup blunders? Put another way, other than being illegal, is there a problem that growth has not solved?

<comment><USER26> Not having concrete examples, but the book 'crossing the chasm' claims, that the majority wont buy from you whatever you have and they need unless they know 2 other companies (succesfully) using your product. Supposedly the step from a few sales to fully tapping the market is hard even if you have great products.

</comment></comment><comment><USER27> One of the big issues I always find with "Closed Lost Reasons"[1] like this is that it rarely captures the truth accurately. It misses the truth in a couple of ways:

       1. Deliberate obfuscation by main actors who want to protect their jobs ("It is difficult to get a person to understand something, when their salary depends on their not understanding it.")

       2. Continental drift- the farther you get from the action (or, more likely, the set of actions) that precipitated the event, the more you rely on memory and hearsay

       3. "The Rage to Conclude"- humans LOVE denouement, to "know", to have things wrapped up and make sense. But rarely is the world so simple. We try to boil a set of reasons down into one über-reason

So on the factory floor, the people doing the labeling are incentivized to shift the blame and obfuscate their role in the loss. And then the manager is trying to sort through all the noise to identify which _set_ of reasons is the most likely for this loss. There's a lot lost in translation from the "truth" of how the deal was actually lost.

\</comment><comment></comment><comment></comment><comment>

With this particular article, I categorize it in "content marketing babble": advice that is generalized to the point that it is not useful to me. The __Common Lessons __section leaves me with general advice but no tractable ways to understand what that looks like in the real world with real constraints and stresses.

IMO, the __Lean: validation __section could be extremely valuable IFF they supplied hard examples from the failed startup dataset that fueled this article. Like "Here are links to the case studies where the team behind [Closed Company A] felt that they could have spent more time validating before building. This is the featureset that they built prematurely, and here they ponder on ways they might have tested it cheaply"

\</comment><comment></comment><comment></comment><comment>

All that aside:

I've actually been quite an avid reader of Failory for a couple of months now. I check in every so often to go over new interviews. I think the interviews ([https://www.failory.com/interview- failure](https://www.failory.com/interview-failure)) are a lot more useful: the format allows for more nuance, more context over the conditions of the business, and more reflection.

I often find myself wanting to ask more questions in-line to the interviewee, kind of like a hyperspecific, morbid Quora question.

[1] I'm co-opting this term from Sales/Marketing lingo. I originally wrote Root Cause Analysis, but I know that RCA has a very specific software definition and set of rituals, so I wanted to

<comment><USER8> >Deliberate obfuscation by main actors who want to protect their jobs

Sure. There is mal-adaptive behavior, and it's not consequence free.

>rarely captures the truth accurately

Accurately? There's nothing going on in your reply to suggest you have distinguished insight to anything. Throwing out three more modalities of problems amounts to what-aboutism. You have attempted to re-contextualize the original write-up as disingenuous something we see a lot of pointless political wrangling.

The salient question is what we can agree on as to common failure modes, rather than that argue without intersection. No accounting can be complete, and beyond some level of specificity more detail is useless. We're looking for 20% of the causes that explain 80% of the bad outcomes. Think Chaos Report that had a good run in the 1990s.

</comment></comment><comment><USER28> TLDR: Buy a copy of the Lean Startup, read it, action it.

<comment><USER4> Note that following the lean startup method does not itself guarantee success. I know at least a half dozen founders who have followed the Lean Startup method (several of whom were actually _in Steve Blank 's class at Berkeley_), and in all cases the result of their 100 interviews was "Welp, nobody wants that product." Which I guess is preferable to investing 3 years and $15M in venture capital into it, but it also doesn't get you any closer to a successful startup. (When I followed the Lean Startup method myself, it was actually worse - our 100 interviews said "Yes, we definitely want it", we built it, and then nobody used it. At least I took every engineering shortcut possible to build & validate it quickly and didn't waste time making it bulletproof before people tried it out.)

Also interestingly, a large number of gigantic corporations today did _not_ follow the Lean Startup method, and arguably weren't trying to found a startup at all. Apple, Google, Facebook, E-bay, Dropbox, AirBnB - they were founded because their founders were curious and trying to scratch their own itch, and it turned out lots of other people had that itch too.

If I had to distill lessons learned from about a decade in startups (7.5 years founding ones of my own and 2.5 years working for other people), it'd be "Trust my emotions more, be curious, and quit trying to found a damn startup." The problem is that you need to judge new ideas emotionally rather than rationally, but when you have the "I'm going to build something awesome and get totally rich" mentality, it distorts all your emotions. Better to get rich by working in finance or for a FAANG, reserve some time on the side to explore, and only set out on your own when there's something incredibly exciting on the table.

</comment></comment><comment><USER29> Great article

</comment><comment><USER30> My initial thoughts:

> _First hand lessons_

> _over eighty failed startups_

I dunno... if you've got _first hand_ experience in 80 startups then maybe their failures are because you didn't spend enough time in any single one of them.

Then I read the article:

> _We 've analyzed why +80 startups have failed_

If you've analyzed the startups then I really don't think that counts as "first hand".

<comment><USER31> first hand means you got the info from the first or original source.

<comment><USER32> That's an unusual definition of first hand...

Here's Merriam-Webster's:

> obtained by, coming from, or being direct personal observation or experience

These lessons are not from the OP's direct personal observation or experience.

</comment></comment></comment><comment><USER33> weird usage of the term "Marketing" to mean business related(product market fit, competition etc).

<comment><USER34> Event "product market fit" feels like a sugar-coated way to say that no one is interested in purchasing your product.

I don't have a startup, but if I did I would view every single step in the process of creating one, both technical and non-technical, as an opportunity to test the market viability of your product.

I'm honestly surprised at the abundance of non-product-viability issues that were cited as determining factors. Maybe this reality is hard to face?

<comment><USER35> You can't even say that a product failed because nobody wanted it. All you can say is that nobody you asked was willing to pay what you were asking. I've seen plenty of promising products die because the company wants to only offer it as a service with ridiculous licensing requirements presumably out of fear that some customer is going to build a billion dollar business out of it and not give them a cut of the gross.

It has to be really frustrating for startup CEOs to fold and then see a bad copy of their idea appear as free software and explode in popularity.</comment></comment></comment>


Ask HN: Is building software a bad route for entrepreneurship? - <AUTHOR> I've only tried to develop 1 app in my lifetime (a yelp for coding bootcamps). I had to brainstorm for weeks, if not months, for that idea. Building the site was no problem, but the real one was getting reviews (using various techniques, my partner and I only got a half dozen.) In the end, I spent a couple hundred bucks and several months down the drain.
Contrast that with what I'm doing now: niche sites. Just build content and get links. Much simpler. There are half a dozen excellent podcasts on the topics, and dozen more blogs with tutorials and how tos.
There's also FBA/dropshipping/ecommerce...
Of course, developing your own app is a lot more satisfying. But I think it's way way more difficult. I think it's better to bat for singles then aim for home runs. Not to mention that some people are making 7 figures off niche sites with no employees and an awesome software project could end up making $200/mo. <comment><USER2> There are many roads to Rome. If what you're doing works for you, then do it. But as to the question of whether or not "building software a bad route for entrepreneurship?" is a true statement in any universal sense, I think the answer is obviously "no". An awful lot of people have done amazingly well as entrepreneurs by building software, so it's pretty clear that it works for some people.

<comment><AUTHOR> If you want to use the roads to Rome example, I'm sure there are some roads that have lots of pot holes. I guess you technically still get there, but there are easier roads that are quicker and safer.

<comment><USER2> It's not a perfect metaphor, obviously. But I still stand by the position that the simple, straightforward answer to the question as posed is "No". It is not the case that "building software is a bad route for entrepreneurs" in any universal sense. And we know this, because we've seen plenty of "existence proofs" where it has proven to be an incredibly good route.

But what is good for one person may not be good for another, for any number of possible reasons: skill, risk tolerance, desired outcome, geography, age, health, support from family and friends, blah, blah, etc. etc.

In the end, all I can say, is that if you consider building software to be a bad route for _you_ , then don't do it. _shrug_

</comment></comment></comment><comment><USER3> What are some earnings and profit examples of these sites?</comment>


How to Rock an Algorithms Interview - <AUTHOR> http://blog.palantirtech.com/2011/09/26/how-to-rock-an-algorithms-interview/ <comment><USER2> If you like this, you might be interested in reading the considerable discussion (over 160 comments) from when this was submitted just under a week ago:

<http://news.ycombinator.com/item?id=3039873></comment>


[video] Building a Performant HTML5 Mobile App  LinkedIn  - <AUTHOR> https://www.youtube.com/watch?v=ft9R72R7TlI

<comment><AUTHOR> This is the recording of the "Building a Performant HTML5 Mobile App" session from LinkedIn at the #sfwebperf meetup. The talk was given last month, but the recording was just recently posted. This was one of the best talk I got to attend this year. The speakers had a lot of excellent tips to share from their experience building an HTML5 app on iPad.</comment>


Show HN: SfEDI: a simple way to write EDI documents in dotnet core - <AUTHOR> https://github.com/AGollapalli/sfEDI <comment><USER2> Not seeing a whole lot of value of SfEDI over just writing a StringBuilder if you want to treat EDI like a CSV file. [http://www.X12.org](http://www.X12.org) (once their servers are back online) provide XSD schemas that you can generate ([http://www.liquid- technologies.com/online-xsd-to-cs-generato...](http://www.liquid- technologies.com/online-xsd-to-cs-generator)) classes from that would provide full validation of an EDI document. Those classes would then allow you to serialize/deserialize from POCO to XML which most EDI providers ([http://www.spscommerce.com](http://www.spscommerce.com)) support. The validation piece of that is key to making sure your documents are valid for the EDI translators that will be checking your documents prior to them getting to the supplier/customer.

<comment><AUTHOR> Thanks, I was unaware that X12 provided those. Have you used them with success?

Truth be told, sfEDI is as much an example of how EDI could be done simply as anything else. (I probably should have provided an example file generating a full document to show that). The main value that sfEDI has is in the validation performed by the Element class, which I suppose could be done just as well using string utils, since that's basically what it is.

The other advantage to treating your document like lists of segments and segments like lists of elements is that you can use things like LINQ to read, modify and update them. Obviously sfEDI is a work in progress, but I think that has some value. Again nothing you couldn't easily implement yourself, but that's sort of the point.

We weren't able to use an EDI provider like SPS and most of the libraries that we tried that went directly from C# to EDI had issues that we couldn't rectify, which is what led to this solution.

</comment></comment><comment><USER3> What is EDI?

<comment><AUTHOR> Electronic Document Interchange. It was one of the early ways of communicating different documents electronically. Things like invoices, orders, health documents, shipping manifests, etc. It's pretty important for coordinating supply chains still.

For instance take a look at these example files:[https://secure.edidev.net/edidev- ca/help/Sample_Files/Sample...](https://secure.edidev.net/edidev- ca/help/Sample_Files/SampleX12EdiFiles.htm)

I think for new development, it's been largely superseded by things like JSON, but for many applications, it's still kind of the thing.</comment></comment>


Where to Go After Product-Market Fit: An Interview with Marc Andreessen - <AUTHOR> https://a16z.com/2018/07/20/after-product-market-fit-marc-andreessen-elad-gil/ <comment><AUTHOR> "The general model for successful tech companies, contrary to myth and legend, is that they become distribution-centric rather than product-centric. They become a distribution channel, so they can get to the world. And then they put many new products through that distribution channel. One of the things that's most frustrating for a startup is that it will sometimes have a better product but get beaten by a company that has a better distribution channel..."

<comment><USER2> I didn't think that was unknown. pretty much the definition of a platform.</comment></comment>