Gnome's Web Browser Ditches Google For DuckDuckGo - <AUTHOR> https://people.gnome.org/~csaavedra/news-2013-08.html#D27 <comment><USER3> The filter bubble thing is overstated. There are times when you _want_ a filter bubble, when you found a piece of information and want to dig deeper on related subjects, a "conversational" interface that has at least short term memory offers big benefits. Do you really want to ask questions to an entity which acts like it has anterograde amnesia? Can you imagine Captain Picard having to continue to remind the computer of the enterprise about context?

Google's 'long term memory' offers lots of benefits too, and 90% of the time, the filter bubble is the correct answer. Like when I search for a particular business on the desktop, and then later I search on my mobile device in Google Maps, and the very first auto-suggest after typing 1-2 characters it the business I searched for yesterday. This is _awesome_ given how irritating it is to enter stuff on mobile devices, especially when in motion, the fewer characters typed the better.

Most of the privacy issues can be solved just by opening up an incognito window. You can choose with 1 stroke whether you want a bubble or not.

<comment><USER4> Personally, I prefer this: [DuckDuckGo Privacy]([https://duckduckgo.com/privacy](https://duckduckgo.com/privacy))

To this: [Incognito mode (browse in private) - <USER2> Help]([https://support.google.com/chrome/answer/95464?hl=en](https://support.google.com/chrome/answer/95464?hl=en))

Sometimes it's better to pay the price of a few extra characters to retain some control.

<comment><USER5> > Personally, I prefer this: [DuckDuckGo > Privacy]([https://duckduckgo.com/privacy](https://duckduckgo.com/privacy))

Ahh, but if the NSA got a secret court order commanding DDG to start collecting data quietly, would users know? Do you think DDG would go the way of Lavabit and shut down voluntarily?

<comment><USER4> That's a really good question. My impression is that Gabriel Weinberg and team are building something on the side of privacy and users. I don't know with any certainty what Mr. Weinberg would do in such a face-off, but at this moment in time, I personally feel more comfortable with DDG than Google. My feelings are simply mine and based upon what I've observed so far with DDG and Google. Google just won't close shop - DDG might close shop. I trust DDG more.

</comment></comment></comment></comment><comment><USER6> I've switched from Google and Chrome to DDG and Firefox. Very happy with the switch. I've started recommending to my non-techie relatives to switch as well.

We've seen this sort of thing before. I've gone from no search engines, to Webcrawler, to Lycos, to AltaVista, to Google, and now DuckDuckGo. No biggie.

<comment><USER7> Firefox must make it easier to switch the default Google search engine for the address bar.

<comment><USER8> They've changed the behaviour of that in the address bar now. Perhaps I have done something wrong, but it appears that what you type in the address bar searches by the search bar's choice. So if I have Wikipedia selected, it searches on Wikipedia from the address bar. This behaviour was initially very confusing.

At first I thought I had done something strange to my Firefox (on Linux), but then I noticed both on my workstation (Windows) at work, and on my laptop (Linux and Windows). I hope someone else can confirm this.

<comment><USER9> [https://bugzilla.mozilla.org/show_bug.cgi?id=873734#c2](https://bugzilla.mozilla.org/show_bug.cgi?id=873734#c2)

</comment></comment></comment></comment><comment><USER10> Don't get me wrong, I'm all for keeping my private stuff - well, private. But, really, will this matter? I mean, how many people used Gnome's browser in the first place? and how many people, after trying DDG won't simply switch back to Google?

Had Gnome's browser been no.1 or no.2 in the browser arena, the gesture may have had some impact (albeit just symbollicaly). But right now... do they think Google would even care/notice?

<comment><AUTHOR> I think they are aware of what you're suggesting they wrote:

"Then again, knowing the humble size of our userbase, we should let neither our expectations nor our imagination run wild on this front."

Still it is the first browser which chooses DDG as its default search engine that I am aware of. This is quite a thing for such a small company like DDG. Now others can follow (or not) when they see that it worked (or not) for Gnome. And even if on Linux more people are aware of the fact that they can change their search engine in the browser, still there is a fair amount who just use what is there. It is therefore browsers nowadays are developed, do sell the default search engine position.

I remember the days when IE had 98% of the market share.

<comment><USER11> I remember the days when Netscape Navigator had all the market share.

Get off my lawn. :)

<comment><USER12> But then you consider that in the mid 90s, the raw number of devices regularly running Netscape Navigator was probably on par with todays usage statistics of Opera.

<comment><USER13> Out by half. Opera claim an active 300m users per month[1]; it doesn't look like Netscape ever exceeded 130m (combination of [2] and [3]).

[1] [http://business.opera.com/press/faq](http://business.opera.com/press/faq)

[2] [http://www.allaboutmarketresearch.com/internet.htm](http://www.allaboutmarketresearch.com/internet.htm)

[3] [http://commons.wikimedia.org/wiki/File:Netscape-navigator- us...](http://commons.wikimedia.org/wiki/File:Netscape-navigator-usage- data.svg)

</comment></comment></comment></comment></comment><comment><USER14> I've been using DuckDuckGo for months now and over the past few weeks it's results have gotten considerably better. I wonder if this is because a massive amount of new users are consistently using it overall improving it's results?

Overall I think this is a great change though!

<comment><USER15> Honest question: if DuckDuckGo doesn't track the users, how can it improve when more users are using it?

<comment><USER16> Working for a company that takes privacy very seriously, I can say that it can be a PITA. Worth doing, but still a PITA. We had to resort to some clever trickery just to count monthly active users without any sort of unique identifier. I bet DDG faces similar challenges.

<comment> grey-area Out of curiosity, what solution did you hit upon?

Google uses a cookie to tie visits to a certain user for analytics.

The other solution I've come up with is to use a hash of IP + other identifying info, so not recording the IP or anytihng to tie it to a person, but still recording a relatively unique ID. What sort of techniques are you using?

<comment><USER16> Well, we have daily update requests (it's not a web app), so we knew the number of daily users already. But we really wanted to know the monthly users, gives a way better idea of the actual user numbers. What we ended up doing is to transmit the timestamp of the last update check with each update check, that way we can see which requests are the first over an arbitrary period.

Granted, the situation is probably not that similar to what DDG faces, but it was just one issue that came up. What we use for web analytics is based on awstats, which operates on access logs with anonymised IPs. Not as good as Google Analytics, but as useful as it gets without JS/tracking, I guess.

<comment> grey-area Thanks

</comment></comment></comment></comment></comment></comment><comment><USER17> Very welcome step. User privacy should be of utmost importance for all GNU/Linux distros. Unfortunately, users of Ubuntu are subjected to privacy intruding malware (that sends their queries to Amazon). Its about time the distros followed GNOME's step and override Firefox's default search engine to DDG as well.

<comment><USER18> I'm a new Ubuntu user who's not super savvy but am considerinng moving to another distro due to these malware issues. Which distro would you recommend I move to? Mint?

<comment><USER19> I highly, highly recommend Linux Mint (with Cinnamon) to those looking for an Ubuntu alternative. Cinnamon is a great desktop environment and Mint, in many ways, is Ubuntu without the privacy issues.

<comment><USER20> As far as I have understood, the default way to upgrade the distro in Mint is to reinstall the whole OS? Feels a bit primitive to me.

You're fine for a year or so, but when a new version of Mint comes, if you want to upgrade, you'd need to reinstall everything.

<comment><USER19> I'm not entirely sure how the upgrade process works in Mint. I think of it as a "transition" distro in many ways. Most of the people I've recommended it to moved on to Crunchbang or similar after a few months of use.

</comment></comment></comment></comment></comment><comment><USER21> I immediately feel "freer" just reading this.

I have heard of DDG intermittently, but never remember to try it out with any consistency. I generally have my default browser page set to about:blank, but I just updated it to DDG. Maybe that will prompt me to try it for a while.

But, here's the thing: As an avid Android user (phones and tablets), it feels a little "insufficient" to just switch over my search engine in the name of privacy. After all, I use the big G for nav, contacts, and other stuff. Of course, it is easy to use their sevices by default, and I don't know what a viable alternative stack woukd look like. I disabled Verizon's Navigator because its click agreement seemed at least as onerous as what I have seen from G.

So, even in trying to find alternatives, it does bring up the questions: to whom am I willing to provide my info, how much am I willing to provide, and in exchange for what?

<comment><USER22> It is relatively easy to run your own contacts/calendar server. Just buy a Raspberry Pi, set up DynDNS, and hit apt-get install owncloud. This is really the way to go here.

Also, there are plenty of email providers out there that are not Google (but it is often unclear whether they are any better privacy-wise. Also, arguably, no one is providing as slick a web interface for email as Google). I am not living in the US, so it makes sense for me to choose an email provider in my own country.

Mapping is more difficult. Tomtom etc. have great navigation apps. But if you just want to look at a map, GMaps is still far superior to most OSM based map apps. Skobbler has a few great ones.

<comment><USER23> Depends on where you live. In my city and its surroundings, OSM data is far better than GMaps. And on my Android I paid for both OsmAnd and Skobbler. These aren't as polished as Gmaps, but at least they work offline.

</comment></comment></comment><comment><USER24> The newsworthy thing to me is that this hadn't happened already.

</comment><comment><USER25> This is trading imagined harm for a real harm. You trade off a loss of privacy that has zero practical implications currently for almost everyone (a few terrorist suspects might have to worry) against lost time due to inferior search result quality.

I don't follow the logic. It seems like idealism for the sake of idealism to me.

<comment><USER16> > This is trading imagined harm for a real harm. You trade off a loss of > privacy that has zero practical implications currently for almost everyone > (a few terrorist suspects might have to worry) against lost time due to > inferior search result quality.

So you argue that slightly inferior search results are "real harm" and mass surveillance is "imagined harm"? I'm afraid we don't agree on the definition of the word "harm".

Nothing to hide, nothing to fear, eh?

<comment><USER26> Mass surveillance is watching everything and fishing for illegal activity. That is not the same as filing subpoenas for data on persons of interest.

If you think everything that generates records the government can eventually access is "real harm," what exactly are you doing on HN?

<comment><USER16> > Mass surveillance is watching everything and fishing for illegal activity. > That is not the same as filing subpoenas for data on persons of interest.

There are several cases of exactly that, fishing people's online movement profiles for illegal activity, e.g.:

[http://www.digitaltrends.com/lifestyle/googling-how-to- murde...](http://www.digitaltrends.com/lifestyle/googling-how-to-murder/)

> If you think everything that generates records the government can eventually > access is "real harm," what exactly are you doing on HN?

I post my comments knowing full well that anyone can read them. I do not think my web browsing and searching behaviour is quite the same thing. I cannot decide what to share and what not.

To come up with a stupid analogy, it's like saying: "If you don't like being watched, why do you go to the supermarket?" It's not the same as being watched in my bedroom.

</comment></comment></comment></comment><comment><USER27> This might be workable for some people, I tried DDG and results aren't on the same level. DDG is getting better every day, until then my temporary solution is using "Google proxy" (anonymised Google search) like [https://startpage.com/](https://startpage.com/).

</comment><comment><USER28> I think the NSA have proven if a particular data provider (in this case Google) doesn't agree or can't provide the info the NSA wants, the NSA have the capabilities to sniff the traffic on a multitude of levels. Privacy is an illusion, but I can attest to the fact DuckDuckGo is the more secure option.

<comment><USER29> ...how?

</comment></comment><comment><USER30> Time to stop using the Gnome browser then.

</comment><comment><USER31> DuckDuckGo is nothing but a bing front-end. I do not see an upside with this switch, so basically, you are making M$ more stronger on Web. I am not being snarky, I am concerned.Google is evil sure, but is M$ better?

<comment><USER31> No seriously, tell me[with citation] that it is not bing front-end. I am all for it.

<comment><USER32> I think they may have gotten their data from bing in the past but these days it looks like that isn't the case.

[https://dukgo.com/help/en_US/results/sources](https://dukgo.com/help/en_US/results/sources)

</comment></comment></comment><comment><USER33> Why the hell does Gnome even have a webbrowser? Projects that are _dedicated_ to working on webbrowsers fuck it up often enough...

Whatever, good for them I guess. I wonder if would have noticed if not for this article.

<comment><USER34> A built-in browser is the best way to download the browser of your choice.

<comment><USER35> No, the package management system on just about every distribution running gnome is the best way. A web browser is a good way to get info on why the package manage is broken though.

</comment></comment></comment><comment><USER36> DuckDuckGo is great. I always end up after a while using Google though as I find Google generally has better results and I enjoy the 'sort in the last...' functions for example that DDG lacks.

</comment><comment><USER37> Gnome is not a popular browser, but every little bit matters.

<comment><USER38> This is stupid. Someone downvoted you just because you called it not a popular browser. Man. HN is becoming shit.

<comment><USER39> It's more likely because Gnome != a web browser.

<comment><USER38> That's playing word Nazi.

<comment><USER39> No it's not because it's bleeding obvious. You could have known by just looking at the title.

</comment></comment></comment></comment></comment><comment><USER40> Kudos to DDG :)

</comment><comment><USER41> I have nothing against the entities involved but reading the comments here I get the impression that many simply ignored the "cooperation" bit i.e:

 _Cooperation: It 's been some time now since we were first contacted by DuckDuckGo regarding the possibility to partner with them in order to share a percentage of the revenue that they make from the traffic originated on their search engine links ..._

So DDG made a deal they could afford and got their partner to hold water for them and link to one of their PR websites, they've been ramping up their marketing efforts to try and capitalize on certain fears, which I suppose is logical.

Generally speaking I think ddg went with the "we don't store data" route because it's the niche they were left with and that ultimately means their search won't improve beyond a certain point.

<comment><USER42> "Generally speaking I think ddg went with the "we don't store data" route because it's the niche they were left with and that ultimately means that their search won't improve beyond a certain point."

As they will all be too busy not storing peoples data, or how does this line of reasoning work?

<comment><USER43> Search is based upon machine learning algorithms that use stored data as signals. Google is not only REALLY good at what they do BECAUSE of the amount of data they have on the individual doing the searching, but the benefits of machine learning are that they will get even BETTER as more and more data is incorporated and stored.

Without proper machine learning on the individual level, DDG will never improve beyond a point. They're already kind of shitty, and even if they get millions of more queries they won't be able to improve at the rate that Google does.

It's a trade-off ('privacy' vs. 'quality') that 95% of the world doesn't give a shit about. Therefore I see this sort of move to DDG as just short-sighted and unreasonable overall.

<comment><USER44> This pretty much captures it. Google knows a lot about you, and it knows a lot about the people you hang out with and the kinds of things you read and the kinds of things you don't read. In knowing all of that stuff they can ascertain that you are part of a community (well a cohort at least) with certain preferences and proclivities, and as soon as a new user identifies as also part of that cohort they can tweak the user experience to "improve" it.

And don't get me wrong, it does improve. I'm glad that I'm not bombarded with ads for TJMax on Google properties but think Digikey could back off a bit.

From a feedback perspective though it gets weird. And you can see that when you search without any identifying information enabled. I found the whole 'Don't Bubble Me' campaign quite creative.

The challenge for search engines though is that being the reference librarian's favorite tool for objectiveness doesn't woo the mass market. And search is a game of numbers if nothing else.

<comment><USER45> Google is a great search engine because what it knows _about the web_.

Google is a great advertising business because of what it knows _about you_.

<comment><USER46> No. Google is a great search engine because of what it knows about you. Trivial example: search on DDG for "ramen": useless generic information about ramen. Search on Google for "ramen": general information on the right, TEN laser-accurate local results for ramen shops. Search on DDG for "tires": ten results for sites that sell tires. Search on Google for "tires": shopping links for tires for _my motorcycle_. Nice.

<comment><USER45> Geolocated search results are hardly what it knows about you.

However knowing your motorcycle is interesting. How do you think it got that information?

<comment><USER47> Google Now indexes things like your mailbox, calendar, contacts. If you have a local motorcycle shop or something in your contacts or whatever, [.......]

<comment><USER45> Presumably all available when the NSA wants it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER48> Bad move. It creates an extra step in the installation process. It forces users to then reset it back to Google search, which most everyone will do. Just like when you reset Bing in IE to Google.</comment>


Ask HN: Why is the Internet being weird today? - <AUTHOR>

<comment><USER2> The internet is a massive thing. Chances are, any problem with the internet will only be experienced in a small region. Thus, given that HN users come from all over the world, statistically speaking it's just you.

<comment><AUTHOR> Sometimes I feel like I can actually, like, _feel_ the data moving around. It's very strange.

</comment></comment><comment><AUTHOR> Or is it just me?

</comment><comment><USER3> its that time of the month ..</comment>


For Mass-Market Cars, Forget L3-L5 Autonomy - <AUTHOR> https://www.eetimes.com/author.asp?section_id=36&doc_id=1334845# <comment><USER2> What is the point being made about crashes being due to driver error vs human error here? The article implies there is some huge distinction that I'm missing.</comment>


Show HN: Geeki – a Reddit alternative in HN and Twitter style - <AUTHOR> https://www.geeki.org/ <comment><AUTHOR> Like Reddit, anyone can create forums, post links, text, photos, comment and vote. Difference is that there are only forum-level profile pages. No /u/username. Only /forum1/u/username, or /forum2/u/username, etc. This design is to prevent others from easily spying you by watching what forums you have joined and what posts you have made on other forums.

Like HN, Forum menu is made of "hot","new","comments","ask". There seem to be a common problem in many Reddit forums: Photo/video submissions are more likely to be upvoted and as a result the "hot" pages were filled with media posts. Many valuable discussions are hard to see. Thanks to HN I found a solution to solve this problem. It is to simply add a "Ask" tab on the top menu to show all discussion posts. All posts start with "Ask:" go to that tab. We didn't use "discussion" tab because we think the line between a media post and an "ask" is more clear than a "discussion".

Like Twitter, post listing is in News Feed style, showing more details when we browsing. We want to allow low-effort content, means you can post status, memes, etc, as long as they are on-topic in the forums.

Geeki is now launching beta. Any advice and suggestions will be greatly appreciated!

</comment><comment><USER2> Ok, it may seem a good idea to mix everything and create a new product. Maybe it is. The problem is the network effect, how to overcome it? How to get people into a site without any people? Very hard.

I don't like the idea, however.

</comment><comment><USER3> I was never too much into Reddit. But I liked Geeki. I'd prefer to fine-tune categories and I can imagine way more programming and IT pro categories myself.</comment>


KeePassXC 2.6.0 Released - <AUTHOR> https://keepassxc.org/blog/2020-07-07-2.6.0-released/ <comment><USER2> I've been using KeePassXC ever since switching from OSX to Debian Linux. On OSX, I used 1Password and have been an advocate for years.

However, after being forced to upgrade (and pay again) multiple times due to API changes, and the integration stopped working with various browsers, I wasn't a happy customer anymore. KeePassXC works just as good, if not better. I'm using it on Debian, with browser extensions and on iOS (and sometimes even on my old Macbook Pro on OSX). Being FOSS, I'm not afraid anymore that stuff will stop working at some point, because some proprietary API is deprecated.

<comment><USER3> You might want to checkout BitWarden. A FOSS server exists (even on in Rust, iirc) and there are opensource clients as well (browser plugins maintained by BitWarden). This system is "zero knowledge", the server does not get to see the passwords in normal operation (it does in case of imports, which I think is a huge security flaw one can mitigate by not importing).

Another thing: Keepass(XC) became a snap package on recent Ubuntus. If there's one piece of software I dont want to be a snap package it is this tool. It get slow, ugly and hard to find (in a process tree). This is the last piece of software I want to run in snap.

<comment><USER4> > Another thing: Keepass(XC) became a snap package on recent Ubuntus.

"became" is misleading. It's available as a snap if you want to use it. It [also] remains available from the apt repository maintained in the traditional way.

Of course if you want keepassxc on Ubuntu 20.04 from apt/deb, you'll get 2.4.3, because that is the traditional way. The snap available is 2.6, because consuming the latest directly from upstream is how snaps work. You can choose with methodology you prefer.

<comment><USER3> Dit not know that, but after "just installing it", it was suuuper slow and ugly (very not matching my other apps) and I could not find the process it was running as at first (snap obfuscates that). Also it could not read a file I put in /tmp.

I want to use a tool to protect my privacy, please not package that in some security-unproven test-bed of a packaging/execution method please.

(Also found the calc app was in snap, and thus verrrry slow to start, then I dumped Ubuntu altogether)

</comment></comment></comment></comment><comment><USER5> KeePassXC + Nextcloud has surplanted any other password manager for me for the last two years. The OTP integration is great as well.

<comment><USER6> For me the winning combo is KeePassXC + Syncthing.

<comment><USER7> Yes, the best feature about KeePassXC is this ability to do your own syncing. I work at a Fortune 500 where they block every syncing service except OneDrive, so that's what I have to use.

<comment><USER8> You might be able to get Syncthing to work if you use a relay server listening on port 443, it would depend on their firewall.

</comment></comment></comment></comment><comment><USER9> I've been using the original KeePass for a long time. I'm an architect, not a coder/software developer. So my question is a bit naive on this forum, but why is KeePass 10mb installed and KeePassXC 108mb if they do the same thing? I like that KeePass has plugins that I can tailor to my needs. Does KeePassXC make the same security software changes as KeePass? I forgot one more question, can I use KeePass2Android if I switched?

<comment><USER10> Hi there, I have a genuine question about your comment and I apologize if this comes across as attacking, that is not my intent at all.

> why is KeePass 10mb installed and KeePassXC 108mb

Why does the file size matter? Are the devices you use so short on storage that an extra 100 mb is an issue? Obviously if it was something like 50 GB then yes, that makes sense but in general most HDD's and devices have GB's of empty space.

<comment><USER11> > Why does the file size matter? Are the devices you use so short on storage > that an extra 100 mb is an issue?

No, but just about any aspect of computing benefits from smaller file sizes, or smaller data size in general, starting with CPU caches, RAM caching of files, file transfers, including syncing things over the network, backing things up. The more free space a SSD has, the smarter it can be about wear leveling (I _think_ , though I have no idea how much this matters in practice).

I mean sure, if the data just sits there, and you don't do anything else with the machine but run a password so manager, it really doesn't matter, but we tend to run dozens programs actively with even more running in the background, all of this adds up quick even on one machine. And then there are billions of people using even more devices.

In this case, I like using KeePassXC portable, so if the size is the result of having less outside dependencies, I'm fine with it, don't get me wrong. But generally, this attitude of just throwing hardware at software is a problem, which by now it has reached gigantic proportions IMO, and you made the argument generally.

Imagine some kind of character encoding that is exactly Unicode, but every character gets repeated 10 times... not for any useful reason, just so people can show they can afford beefy hardware and waste it. Would you use it?

We cannot even begin to imagine what our current hardware would be capable of, if we only allowed ourselves the time to use it well. Consider that this runs on hardware from 1981: [https://www.pouet.net/prod.php?which=65371](https://www.pouet.net/prod.php?which=65371)

The same achieved with less is always better, I'll just claim that. The whole universe in all it's infinite wealth cannot change that, and we live on a planet that's about to get ruined real hard because of our consumption of materials and energy. Storage may very well become so big and cheap as to be practically infinite, but CPU will always cost energy.

For one-off things with limited use, knock yourself out, of course, but if you package something for distribution, it may stay around "forever" and get handled countless times, by servers and end-users, so if it can be made smaller without making it worse and without extreme hassle, make it smaller.

</comment></comment></comment><comment> Paul-ish If you like KeePassXC you should consider donating. I donate $5 a month because it's worth paying for good software.

[https://keepassxc.org/donate/](https://keepassxc.org/donate/)

</comment><comment><USER12> I am assuming there are ways to turn off health checks to " Have I Been Pwned". I never want my local password manager to do outcalls for any reason...

<comment><USER13> You manually run the audit, and it makes it very clear that it's about to do an online activity:

[https://github.com/keepassxreboot/keepassxc/pull/4438](https://github.com/keepassxreboot/keepassxc/pull/4438)

</comment></comment><comment><USER14> Another option you should consider: [https://www.passwordstore.org/](https://www.passwordstore.org/)

It's just a bash script that used gpg and git. I find it the most KISS solution. Not available on phones but I don't trust my phone with my secrets anyway.

<comment><USER15> I use "Pass - Password Store" [1] for iOS and it works a charm for me.

You have to import your GPG key to it and set up your git connection to your server and you're all set.

It also supports OTP generation which is really nice.

[1]: [https://apps.apple.com/us/app/pass-password- store/id12058205...](https://apps.apple.com/us/app/pass-password- store/id1205820573)

<comment><USER16> How is it compared to keepassxc.

</comment></comment></comment><comment><USER17> How trusted are the iOS/Android app compared to the "mainstream" desktop clients like KeepassXC ? I'm a bit wary of downloading a "random client" from the App Store. Are those audited/trusted as much ?

<comment><USER18> I've been using Keepass2Android [0] for a few years now (synced with the desktop client) and haven't had any issues. I'm not aware if any audits on it, but I'm not sure the risk of a developer pushing malicious binaries is that much higher on the play store than the arch/debian/snap/brew repositories.

[0] [https://github.com/PhilippC/keepass2android](https://github.com/PhilippC/keepass2android)

<comment><USER17> I imagine those on iOS/Android are "complete" re-implementation of the client. Isn't that the case ?

<comment><USER18> I've never contributed to it, but my understanding is KeepassXC is both a library and desktop client (and cli client, which I've never used) and that the app uses the library to manipulate the database. This piece of documentation seems to confirm this.

[https://github.com/PhilippC/keepass2android/blob/master/docs...](https://github.com/PhilippC/keepass2android/blob/master/docs/Keepass2Android- Apk.md)

</comment></comment></comment></comment><comment><USER19> Does anyone know if the browser integration is similar to/better than Lastpass or Bitwarden? Does it even have browser integration?

<comment><USER20> I use the browser extension all the time (Chrome).

When it works, it works great. You can tell the extension to auto-fill and auto-submit, so that it feels like you had been logged in from the very beginning.

The problem is, it works (in my experience) around 80% of the time. I'm guessing it's not on them since it requieres websites to follow certain standards in order to have autodetectable login form fields, but it's a pain nonetheless.

Try it, it takes a couple mins to set up. The best feature IMO is the keyboard shortcuts to fill in details.

<comment><AUTHOR> Many non-standard fields may cause problems with the extension. You can always try to set Custom Login fields for a certain page which allows you to override input fields for username and password use.

</comment></comment></comment><comment><USER21> Word of warning: Don't use KeePassXC when your co-workers use KeePass2 using a network drive. KeePassXC doesn't support KP2's sync protocol. You'll clobber other people's changes when you save using XC. It took us a few weeks before we noticed that many passwords were missing.

<comment><USER22> But that sounds like the wrong thing to do. Why are you all pointing all your apps at a shared "database" file? And how about locking issues?

<comment><USER23> This seems to be a supported feature of KeePass 2:

"When invoking the 'Save' command, KeePass checks whether the file on disk/server has been modified while you were editing it. If it has been modified, KeePass prompts whether you want to overwrite or synchronize with the file."

[https://keepass.info/help/v2/sync.html](https://keepass.info/help/v2/sync.html)

KeePassXC, on the other hand, does not seem to have been designed for shared synchronization:

"Cloud synchronization ... can be easily accomplished by simply storing your KeePassXC database inside your shared cloud folder and letting your desktop synchronization client do the rest. We prefer this approach, because it is simple, not tied to a specific cloud provider and keeps the complexity of our code low."

[https://keepassxc.org/docs/#faq-cloudsync](https://keepassxc.org/docs/#faq- cloudsync)

<comment><USER24> The synchronization feature is what's keeping me on KeePass 2 (running on Mono in Linux) , despite the fact that the interface looks completely out of place in my KDE system.

</comment></comment></comment></comment><comment><USER25> Also a user. Works well in general, although I continue to be sad to see the arrogance during argumenting in an issue that is a valid and necessary usecase for many people using online banking. [https://github.com/keepassxreboot/keepassxc/issues/725](https://github.com/keepassxreboot/keepassxc/issues/725)

<comment><USER26> Surely that sort of individual character checking of passwords implies plaintext password storage.

Seems reasonable not to go out of the way to support obscure insecure password entry methods.

<comment><USER27> I bet they just hash every character of the password separately!

/s

</comment></comment></comment><comment><USER28> KeepassXC with the .pdb synced with git and locally-distributed .key files has been my go-to for years. I don't use browser extensions.

</comment><comment><USER29> I'm excited to try this out. Just to mention two interesting projects:

On MacOS I use: [https://macpassapp.org/](https://macpassapp.org/) (Open Source)

I always wanted to try: [https://www.passbolt.com/](https://www.passbolt.com/) (Self-hostable)

<comment><USER30> I switched from MacPass to KeePassXC because it supports newer versions of the KeePass database spec and is compatible with Windows and Linux. If you ever end up sharing password databases, it's a must.

<comment><USER31> Could you please specify what is the dataspec support difference between MacPass and KeePassXC? As for formats they both support KDBX4. But yes, MacPass dev and releases are very slow. It's just that it has been such a functional and stable native app since years.

</comment></comment></comment><comment><USER32> While we're on the subject of password managers ... I'm still looking for one with decent multi-user & group support, with audit trails, which is self- hosted. Bitwarden sounded promising, but I'm put off by their MS based stack and their pricing model. Any other recommendations would be greatly appreciated.

<comment><USER33> I'm not sure what you mean by "their MS based stack", but if it is not about the build tools (.net etc), but about them hosting on azure: Bitwarden can be selfhosted just fine on Linux. [https://github.com/bitwarden/server#linux-- macos](https://github.com/bitwarden/server#linux--macos)

<comment><USER34> Unless it's changed since I looked at it, it requires MS SQL Server, which does run on linux, but isn't FOSS, and is very expensive to license if you aren't already using it.

<comment><USER35> > and is very expensive to license if you aren't already using it.

Not FOSS, but the express edition is free as in beer and the limits should not matter at all for bitwarden (I think the main one is max 10 GB). I prefer KeepassXC + Keepass2Android + Nextcloud though ;)

</comment></comment></comment></comment><comment><USER36> Thoughts on comparing this to bitwarden? Pros, cons?

<comment><USER37> Having used both, Bitwarden has been a better overall experience for me and much better for my friends and family. I still like both of them.

KeePassXC

* [Pro] Excellent desktop app. Fast, easy, polished, powerful (TOTP available by default).

* [Pro] Great data ownership philosophy and data storage flexibility.

* [Con] Poor cross-platform app experience, especially on mobile (iOS in particular).

* [Con] Tinkering required to sync data. This isn't a big deal for many of us on here, but presented a large barrier to entry for my non-tech-savvy friends & family.

Bitwarden

* [Pro] Excellent cross-platform experience.

* [Pro] Low barrier to entry via SaaS, making it a good option for less-than-tech-savvy folks. This is ignoring the nice option to self-host.

* [Pro] Sharing features (haven't actually used them).

* [Pro] Web vault is accessible via web browser (accessibility).

* [Con] Web vault is accessible via web browser (increased attack surface).

* [Con] App is a tad slow (electron), but this is an acceptable price to pay for the good cross-platform experience.

<comment><USER38> I self-host Bitwarden and I haven't even bothered to install the desktop app. Since I have a browser open at all times, I just use the browser extension.

Also, I think the Android client is quite a bit better than Keepass2Android.

<comment><USER35> I tried bitwarden once and didn't like it (can't remember why, don't care, no interest in switching ;) ), so I never tried their mobile client. But I'd be interested in what's better than K2A, I think the modern Android experience with it is awesome.

<comment><USER38> A few things I remember: adding new entries was clunkier in k2a because I had to tap multiple times to select things like category/folders that I didn't care about. Bitwarden has better URI matching as I could choose the matching rule. BW has better search, or rather it displays search results in a more useful way. The autofill service also seemed to work more reliably, and I don't think k2a showed the matching logins right in the autofill drop-down menu, but I could be misremembering there.

Ultimately though it was the browser extensions, combined with the self- hosting option, that sold me on BW. None of the Keepass plugins I tried over the years worked that well. BW has extensions for both Firefox on Android and Vivaldi on desktop that are as solid as anything I've tried.

</comment></comment></comment></comment></comment><comment><USER39> Why do people insist on putting everything, even passwords, in folders? I find categorizing files, let alone passwords, into a strict taxonomy a particularly hard job of questionable usefulness.

It would be much handier if we could just tag the records with a number of tags + add a description and/or comment rather than put it in a folder. I always use search rather than manual folder tree navigation anyway.

</comment><comment><USER40> Years ago I used KeePassX. It became stale, ugly, and didn't have a good Android app. KeePassX then moved to .NET, and didn't work well on Linux, so I looked around. I settled on enpass as it was a paid app without a subscription, and withyour choice of sync/backup. Enpass has excellent desktop/mobile apps with sync using your choice of cloud service. I'm very happy with it.

<comment><USER41> I actually just finished moving from 1Password to Enpass. KeePassXC was in the mix and is nice but what killed it for me was the lack of credit card / template support. Did not like the 1Password move from offline storage to online sync. You can buy a license but it is about $70 or so per platform. Enpass desktop is free and I can sync to my Synology using WebDav. That all said, I really hope KeePassXC vastly improves because I would love love love to use as much OSS as I can.

</comment></comment><comment><USER42> How does Keepassxc compare to other password managers (passwordstore with gpg- agent/gnome keyring, 1password, Bitwarden, etc) in terms of protecting secrets when the vault is unlocked?

For example, part of data may be held unencrypted in RAM that could be read by OS or other programs. Any use of TPM?

</comment><comment><USER43> Wait, so there's Keepass, KeepassX and KeepassXC? I understand the X is cross- platform (initially was linux-only) whereas presumably Keepass is win-only; but what's the "community fork" for? Why not improve KeepassX? And why don't KeepassX and Keepass merge now?

<comment><USER44> Keepass 1 is .NET Framework based. Keepass 2 is .NET Framework and has a Mono build of varying success. 1 and 2 are the originals and still actively developed.

KeepassX has stalled development since 2016 but was a true cross platform desktop client

KeepassXC is the fork of X and at this point in time is lightyears ahead of X.

I'm sure the developers of XC may have wanted to contribute to X but X seems to have been spearheaded by a single developer who stalled on letting other devs become maintainers. So the community forked it.

But to answer the question, it's impossible to merge X and the original because their code bases are in entirely different languages and arguably X doesn't give you anything than the one man dev show.

</comment></comment><comment><USER45> I used to use KeePass and KeePassXC for years at a time, but the amount of time I have saved not having to mess with syncing issues more than makes up for the ~$30 a year for 1password that always works across windows, linux, ios and mac.

</comment><comment><USER46> Is it better than KeePassX?

<comment><USER47> I like the design of X more Not sure what is better in XC though

<comment><USER46> X looks very unnatural on macos

[https://i.imgur.com/JtXVZW2.png](https://i.imgur.com/JtXVZW2.png)

</comment></comment></comment><comment><USER48> I'm curious why would anyone on Windows use KeePassXC instead of KeePass. Are KeePass plugins compatible?

<comment><USER49> For me personally because the author of KeePass is a stubborn person who is hellbent on not using a VCS. I see no reason why one would not use a VCS in 2020. From a security point of view this is a massive violation of trust due to the fact that a criminal entity could hypothetically sneak into the computer of the author of KeePass and modify a cpp file to link to malware and the author will have no idea of it and when he compiles and distributes it. He would have unknowingly distributed malware which due to the context of the application can cause massive damage.

I do know that I can compile myself but still I cannot audit every single release, this can be migitated by myself using git and extracting tar files on every release. But this should not be this difficult.

KeePassXC on the other hand is more practical and works on all platforms consistently and is easy to compile with cmake and has convenient cmake switches to disable network connectivity.

</comment></comment><comment><USER50> Has anyone migrated from Lastpass to KeePassXC? Was it difficult?

<comment><USER35> Lastpass to Keepass2 years ago, it was simply export/import. I assume it's pretty much the same for XC

</comment></comment><comment><USER47> I like the simplicity/design of KeePassX more than XC

</comment><comment><USER51> Been on the "regular" KeePass all along.

Should I switch?

<comment><USER52> I switched many years ago because Keepass didn't work well (or at all) on Linux. Since then, I think KeepassX and especially KeepassXC have surpassed the original Keepass in quality - so yes.

One thing that really amazed me was recently (1-2 years ago) KeepassXC got rid of the lock file and made it possible for multiple processes/computers to seamlessly work on the same file. This is fantastic for situations like having 2 computers running at the same time, opening a Keepass database file from Dropbox.

<comment><USER51> Fair point, but I'm a Windows user, so that alone is not really an argument.

The interface looks better, sure, but nothing really makes me to be dissatisfied.

<comment><USER53> Browser integration was a major issue with Keepass - haven't used it in years so I don't know if they've fixed it so you don't need the plugin hack.

<comment><USER35> That was my reason to switch from 2 to XC (on Windows) as well. Far superior browser support.</comment></comment></comment></comment></comment>


Show HN: aufond.me — a résumé for the modern age [Meteor.js MVP] - <AUTHOR> http://aufond.me

<comment><AUTHOR> Hi there, guy who made this here. There's a disclaimer at the bottom of the landing page for general context, but here is the technical side of the story

I took a shot at building something in my spare time (weekends and such), while having a fully engaging full-time job. It spanned over almost 6 months, but there were weeks when I had not even a single commit.

Besides having an idea to believe in, Meteor.js was also a big part of making this happen. It's the first time I'm building anything with it, but after a few weeks of setting the tone and a few small in-house lib files, the productivity of having it all in one place became unbeatable. I could write some more about my experience with Meteor if other people are curious to try it but never had the chance.

Meteor wasn't the only productivity booster though, I used as many out-of-the box services and technologies as possible. Not to mention organizing yourself as if you were in a team is a key ingredient in keeping a project together for so long with so many breaks. I used a private Github repo, but using Bitbucket or other similar tools is just as well

Technologies

\- Meteor.js

\- CoffeeScript (If you don't hate it you will eventually learn to use it to your advantage)

\- Bootstrap (It helped a lot, but I would drop it completely by the time the app could be considered out of the "MVP" state)

\- Underscore + Backbone Router (Models wouldn't fit with Meteor, I made something lighter by hand)

\- CSS3 (Go for it)

Services

\- Rackspace VPS for hosting

\- MongoHQ for data storage

\- Filepicker.io for image upload and processing

\- Mixpanel for stats

Code

\- 2068 lines of CoffeeScript (Including comments!)

\- 927 lines of LESS CSS (Here too, including comments---Yes, I add comments to CSS)

\- 583 lines of Handlebars HTML

\- 73 lines of Bash scripts

Project

\- 403 Git commits

\- 35 closed Github issues (the ones that made it through the "MVP" milestone)

<comment><USER2> "I could write some more about my experience with Meteor if other people are curious to try it but never had the chance."

Can you please give some more details about your experience with meteor? What makes it stand out among other frameworks? What are the pros and cons?

<comment><AUTHOR> I should write something more elaborate, but for the sake of not leaving your comment hanging, this is what I can highlight out the back of my head:

\- The best thing by far is sharing the same code for both client and server. It is as good as it sounds, at least as far as productivity and having a small codebase goes

\- Everybody is worried about security, but they got it covered. For each collection you can filer who can publish/insert/update or delete. Each go through a filter you attach a callback to, where you have the userId at hand and can easily only allow the owner of a document to be able to update or delete it. Or just as easy publish (for read) only the documents that a user owns, for all regular users, and publish all of them for an admin user.

\- It takes a while to create an organized structure though, there is a loading order for certain folder names, but basically everything that is in your project will be loaded in the project asynchronously, w/out having any control on the order. This makes it painful when dealing with inheritance, but in the end you get around it using the folder order of loading they provide and using the Meteor.startup callback, where you can assume all files have loaded

\- Another thing that I found a bit counter intuitive at first is that everything is template oriented. Usually you have a module of some sort, which loads a template. Here you have a template, which has _code_ attached to it. It's very easy to go the spaghetti-code no-framework JavaScript way. But if you like having control and are able to create a scalable pattern for modules/widgets, it becomes a very powerful tool

</comment></comment></comment><comment><USER3> I like it, it would make a great "about" page for someone's blog.

I'm not sure that it really works as a resume though (at least in my small part of the world which is finance in London). Where I am recruitment is dominated be recruiters, and the majority of them need a CV that they can change into their format (word) and send over to their client.

I'm also interested to know what meteor specifically brought to this, did you need the real time features of meteor in some way or is it just that you wanted to try it out?

It looks awesome though, really great work!

P.S. Are you really a paratrooper?

<comment><AUTHOR> Interesting perspective, you're not the first to mention that even though you like it, you don't necesserily see it as a CV. That's why I posted early, to validate the idea and direction. It's a common thing to pivot the market with the same product, after getting feedback from potential users. I'll certaintly think about this some more, thanks!

This is not your typical Meteor project. Almost everything is realtime, but because that's how Meteor works, not because it was a requirement. So yes, mostly I just wanted to try it out. But I can can confirm it can also be used as your everyday web framework, not just for chat servers or what one might imagine it was made for

Not an actual paratrooper, that would've been cool!

</comment></comment><comment><USER4> It's nice looking, but I question its usefulness as a replacement for an online resume. Recruiters have notoriously short attention spans and I doubt many would actually click through to the details on the highlights. That said, as sort of personal home page ala about.me, I think it has potential.

</comment><comment><USER5> My objection is what's in this for me? How is this better than writing a CV? Try something like "Stand out from the hundreds of people applying for your next dream job by telling an authentic story with aufond.me"

<comment><AUTHOR> I think I see what you mean, that the benefits should be more clear and more reward-oriented, that it should state what it does for you, instead of just what it does. (period)

Thanks for the insight, trying to make a product or app appealing is something I'm just learning

</comment></comment><comment><USER6> I tend to agree that this probably serves better as an "about me" replacement for someone's own site. I wonder if there's a way to have it generate it as static HTML (cleverly bundling styles too--at worse in an inline <style> tag) that you can then drop into your site? Or, go the embed route so that your service is still in the loop.

I think you might get more friction with the latter approach though. I suggest the former (generate static HTML to drop into any site) that possibly has a subtle footnote with something like "timeline created with aufond.me"

<comment><AUTHOR> The static HTML idea is awesome! After all, the same timeline used now was a static template I made for me a while back, so that's how it started :)

This somehow fits into the "Offline exporting options" question from the landing page Quiz. Can't wait to extract stats from it!

<comment><USER6> If you need any help with the static HTML generation with Meteor, I'll gladly lend a hand. It's not rocket science of course, but if you want to save time, I can share code snippets. I hang out in #meteor on IRC as matb33

</comment></comment></comment><comment><USER7> ... and other geeks. Recruiters and managers want something black and white, un-styled and printable. Good as a personal project for actual CV though.

</comment><comment><USER8> Down for me. :-(

<comment><AUTHOR> Damn, it's timing out for me as well. I'll restart it immediately and stretch the Rackspace instance if won't take long. Sorry

</comment></comment><comment><USER9> You might consider making the Font Awesome link open in a new window. I just smashed the thing I was creating.

<comment><AUTHOR> Ouch, sorry for that --- CTRL/CMD + CLICK ftw :)</comment></comment>


Show HN: Baryon - personal cloud file management system - <AUTHOR>

The goal of this project is to allow users to build personal cloud file storage using MongoDB. Thanks to GridFS this is possible!
Project is open source under AGPL v3 license.
It started as a weekend project, for personal needs, but evolved into a bit more. Current version is v0.1-b0. I used Grails 2.0.0 and mongodb plugin.
Work is in progress, but it already has basic features for this kind of system:
- upload (multiple), delete, move arround files
- create, delete, move arround folders
- trash
- import an entire folder structure through a zip file
- basic text and image viewers
- couple of other goodies...
http://code.google.com/p/baryon/
Any feedback from you guys is welcome. <comment><USER2> It's not clear that the personal cloud needs to be webscale; did you consider not using any database?

<comment><AUTHOR> If we'll take out any database, then management gets more complicated more expensive imo.

In this case scalability/replication is accomplished through MongoDB, which is great at storing binary files and is super easy to maintain...</comment></comment>


Emacs Lisp Animations - <AUTHOR> http://dantorop.info/project/emacs-animation/ <comment><USER2> It's quite pleasing to see this here. As noted on the page, these were notes which accompanied a class. I wanted art students to be able to write code to create something visual, and wanted them to be able to do this in an open source cross-platform environment. Emacs was a perversely appealing means.

Keeping these examples working led to discovering an obscure regression in Emacs ([https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22490](https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22490)). I turns out that, excepting animators, very few Elisp programmers need to generate zero newlines.

<comment><USER3> What was the students' response? Did they have a background in programming?

<comment><USER2> The students didn't have any coding background. Which, in a way, was good -- they didn't know how absurd this was to start programming with Lisp, use ASCII art as a visual vocabulary, and use Emacs and its REPL as an IDE.

I wanted the students to gain confidence in this weird situation by working off of clear examples. Hence I made these extensive online notes.

The students were generally great at typing in these examples and getting them to run, and some were creative with rearranging them, copying in extra code, and changing variables/strings to produce interesting effects. I didn't see "coding" in the sense of having a vision/plan, finding/inventing an algorithm to realize it, and then refining the result. But I saw "hacking" in the classic sense: gaining facility with an unlikely tool, and working through variations until something intriguing occurred.

Given that it was an art class, I was actually pretty happy with this. This felt in line with what allows for a lot of good art school work: students starting out with a technique and working/reworking until it results in something satisfying or maybe even resonant. I liked how it broke the paradigm of "useful" coding. The Emacs environment became simply something fundamental and even somewhat neutral to work at.

</comment></comment></comment><comment><USER4> Emacs has had SVG support for a while so you can get more than just ASCII art. See the svg-clock package on ELPA for example. This is what the code looks like: [http://git.savannah.gnu.org/cgit/emacs/elpa.git/tree/package...](http://git.savannah.gnu.org/cgit/emacs/elpa.git/tree/packages/svg- clock/svg-clock.el)

Or for pixel graphics: [https://github.com/gongo/emacs- nes](https://github.com/gongo/emacs-nes)

</comment><comment><USER5> This is quite wild. I did a few simple animations for my intros at emacsmovies.org. They were mostly manual moving of characters and M-x zone. Nothing more.

</comment><comment><USER6> The next big thing: emacs demoscene!

</comment><comment><USER7> _« Emacs ... is a great tool for animation »_. Emacs lovers never cease to amaze me.

<comment><USER8> You should think of emacs as less as an editor and more as a lisp machine.

<comment><USER9> ... or an operating system ;)

<comment><USER10> I like to think of it as a really bad axe. With it I can chop wood, wedge open crates, shave, climb mountains, fight off monsters, pick my teeth, scratch my head, and throw it at anyone I see.

I guess what I'm saying is - it hasn't killed me yet.

<comment><USER9> Nice!

After a year of using emacs I wrote a few lines of elisp to put in some hotkeys for functions I use all the time and now I finally feel like a freakin' hacker-wizard, lol. Good times. I ain't never givin' this shit up.</comment></comment></comment></comment></comment>


The Oatmeal (online cartoon) earns ~$1000/day - <AUTHOR> http://www.economist.com/blogs/babbage/2010/12/online_cartoons

<comment><USER2> Sure he's rubbed a few folks the wrong way but he's a satirist. That's his job.

I've worked with Matthew in the past and he's a good guy who conducts himself professionally. He's also worked his ass off to get where he is and the economist article is a huge coup for his career. You turkeys should be congratulating him.

<comment><USER3> It's not an article in _The Economist_ ; it's a post from one of their blogs on the site.

</comment></comment><comment><USER4> That's revenue from merchandise sale. What are the margins on that?

<comment><AUTHOR> not sure. FYI, xkcd also makes (or made in 2008) it's money on merchandise.

<http://www.nytimes.com/2008/05/26/business/media/26link.html>

 _"People are generally surprised that we make a living from it," Mr. Munroe said. Without being specific, he said that the sales of xkcd merchandise support the two of them "reasonably well." He said they sell thousands of T-shirts a month, either of panels from his strip or in their style, as well as posters._

<comment><USER5> Even Yogurt knew where the real money was: Merchandising. The Oatmeal the Flamethrower

<comment><USER6> I want a The Oatmeal the Flamethrower t-shirt.

</comment></comment></comment></comment><comment><USER7> My problem, if it really is one, with The Oatmeal, is that he isn't creating comics as an art or for entertainment. He creates comics that he knows will be linked to and drive up page views. A great example of this is his recent Christmas comic, where he portrays 30-somthings without kids having horrible holidays, which resulted in a fair amount of 30-year-olds getting mad and linking to his site when explaining why it pissed them off.

<comment><USER8> Who cares, as long as it's funny.

</comment></comment><comment><USER9> Matt also co-founded SEOMoz and Mingle2, which was acquired: <http://0at.org/>

<comment><USER10> He's also did an interview with Mixergy in March of 09' if anyone is interested. It's a little date at this point, but his main message is still relevant. If you participate in social bookmarking websites you'll eventually know what content they want to see.

</comment></comment><comment><USER11> $1000/day is revenue, not earnings, FWIW.

<comment><USER12> It also proves that Online advertising wont get you much. Creating and selling your own stuff will bring you more bucks.

<comment><USER13> $1,000 USD/day isn't even hard to attain if you have some coding/sysadmin skills and can grok basic marketing techniques. There's plenty of offers and affiliate programs that pay upwards of $20 per conversion and there's myriad white, grey and black hat ways to send traffic to them.

1,000 leads x 5% conversion rate x $20 per conversion = $1000/day. 1,000 leads a day can be obtained relatively easily. 5% conversion rate is extremely conservative (for the offers/programs I run, anyways).

I stopped working at venture-backed internet startups this year because I figured out how to make far more money on the internet (mostly) passively. Now I can work on my own "startup" projects and other endeavours (e.g., learning Haskell).

<comment><USER14> Interesting. I'd love to hear more about this. You don't happen to blog about this process do you?

<comment><USER13> No, blogs (Wordpress) are for getting Google traffic to you so you can get clicks through to your offers. ;)

Basic overview:

      http://en.wikipedia.org/wiki/Affiliate_marketing
      http://en.wikipedia.org/wiki/Website_monetization

Where I generally find products to promote (they usually come with banners, pre-made landing pages, etc.):

      http://www.clickbank.com/marketplace.htm

Recommended forums:

      http://blackhatworld.com
      http://www.warriorforum.com
      http://forums.digitalpoint.com

99.99% of the stuff people are trying to sell on those forums is crap, but there's lots of general information there that's very good. BHW's "Making Money" section has a tonne of stickied topics under each subsection with good info.

The advantage of having web dev/sysadmin skills is that you can take a method people are running manually (and probably even example code that's floating around) and scale it easily to 100x what they're doing. You don't have to innovate, you just have to automate and scale.

Be careful if you use shady methods. If the product owner realises what you're doing, they'll kill your account and refuse to pay the middleman who will refuse to pay you. :)

If you meet/befriend other people in IM and establish that you're not a noob, doors will be opened to better offers/products and better terms for payment e.g., being paid three days after the end of the week ("net 3") instead of seven days ("net 7").

You can get $75 USD free credit when you register on Adwords (<http://adwords.google.com>). After a few days, you'll be able to decrease your bids on keywords to $0.01, so $75 = 7,500 people clicking through to your landing page/offer. Unless your conversion rate is atrocious, you'll make back far more than $75. This isn't a bad place to start experimenting. SEO works, too, but it's more of a "long haul" thing. PPC advertising gets you traffic _right now_ , but you have to be careful that it doesn't annihilate your profit margins.

<comment><USER14> Wow, thanks for this reply, it's exactly the kind of info I was looking for. I've checked out those forums and most seem to have a great deal of noise, however, the stickies you mentioned in BHW do have a lot of really useful information to get started.

<comment><USER13> If you can filter out the noise, you can find a few gems. I've had good luck with taking existing promotion methods (which everyone and their brother are doing) and putting a unique twist on them.

If you can think outside the box, you can do really well.

Making the first $10/day is extremely hard. Once you hit $10/day, getting to $100/day is pretty easy. Then $1000/day... :)

<comment><USER15> By promotion method, do you mean your landing page or the way you promote your landing page?

<comment><USER13> The latter. You'll generally see strategies based around a certain facet of internet advertising (buy PPC ad placement, do SEO, follow people on Twitter discussing the item/niche, etc.), but few people will combine them or leverage them in new and interesting ways.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Matt gave a very entertaining Ignite talk that goes into some of his reasoning and marketing decisions behind his work: <http://theoatmeal.com/blog/ignite_video>

<comment><USER17> A more informative version:

<http://unfunnythings.tumblr.com/post/1312737586/theoatmeal>

</comment></comment><comment><USER18> from what I understand the majority of his traffic came from gaming reddit, which recently turned on him after he did something (don't quote me, but I think it had something to do with cursing someone out who got tired of waiting for a book).

<comment><USER19> The cursing out episode was from Twenty Seven B Slash Six, not The Oatmeal. And the bigger hubbub was over the fact that the author posted personal information on reddit (trying to confirm someone's shipping address).

<comment><USER20> This is correct. It was not The Oatmeal.

</comment></comment></comment><comment><USER21> Depressing to me, because I find most of the content there to be, "clever only to people of pedestrian intelligence." Then again, perhaps this is just savvy marketing.

<comment><USER22> Stephen King, whose success is similarly depressing to some, mentions this specifically in 'On Writing.' His great gift, as he put it, is to entertain those of similar intellect to himself. Fortunately for him, he's on the top half of the fat part of the bell curve, so there are many such similar intellects to entertain. I am glad to be one.

While I find 'The Oatmeal' to be somewhat boring and trite, I don't begrudge those who like it their enjoyment, nor do I begrudge the author his income.

<comment><USER21> _Stephen King, whose success is similarly depressing to some, mentions this specifically in 'On Writing.' His great gift, as he put it, is to entertain those of similar intellect to himself._

I think this is an exercise in awareness, which would be of particular value to the HN crowd. Apple's products are often castigated because their construction/composition/stats go against the preferences of a part of the highly tech-savvy crowd. However, this criticism doesn't take into account the intended audience. There is something similar at work with Ruby and Ruby on Rails. Certain purists might find the language impure and the Rails DSL too focused on a particular way of doing things, but there is a large audience that really likes and benefits from using that software.

 _While I find 'The Oatmeal' to be somewhat boring and trite, I don't begrudge those who like it their enjoyment, nor do I begrudge the author his income._

Well said! (Better than I did.) I don't begrudge either of those. I also hope no one in this society [1] begrudges my right to express my opinion.

[1] - Deliberately ambiguous, as it's widely applicable.

</comment></comment></comment><comment><USER23> Good for him. Seems like he's working hard for it :)

</comment><comment><USER24> It might surprise you that Inman actually makes a lot of his money from SEO. From what I've heard from people close to him, The Oatmeal business is still a relatively small portion of his income, as compared to the intelligence he has to use his viral marketing ability to promote websites that actually create large revenue streams through organic traffic.

I'm sure Oatmeal is his "pet project", the one he loves doing - but the SEO part is the one that pays the bills. It seems, of course, that he could monetize Oatmeal a little better without coming off as a blowhard, but I'm not close enough to the situation to say.

<comment><USER25> Howdy, I'm the Economist writer behind the Pease Porridge Hot story. I spoke to Matthew at some length, and have followed webcomics for over a decade. I'm not sure which people you spoke with, but Matthew clearly spends the majority of his time drawing The Oatmeal, dealing with sourcing merchandise, managing his web site (including programming).

There's no SEO business that he says he's currently involved with, and I have no reason to doubt that based on his posting schedule and the scope of The Oatmeal's operations.

We talked quite a bit about how traffic is generated, but there wasn't room in the article to discuss. Case in point was a cat comic he had posted the day we spoke that had received 40,000 page views an hour just before we met. He'd posted the comic, and it was already zooming around via his Twitter and Facebook feeds, and someone I believe had already linked it on either Reddit or Digg.

<comment><USER24> I know people who know him personally.

</comment></comment></comment><comment><USER26> So he is not funny, not clever and has absolutely no artistic talent. Seems like someone the mainstream media can really get behind.

</comment><comment><USER27> That's funny, I was just looking at their advertising stats here: [https://advertisers.federatedmedia.net/explore/view/theoatme...](https://advertisers.federatedmedia.net/explore/view/theoatmeal)

According to that site they get around 27m page views per month.

</comment><comment><USER28> congrats, you magnificent bastard.</comment>


Debian decides to adopt time-based release freezes - <AUTHOR> http://www.debian.org/News/2009/20090729

<comment><USER2> This is great, except I wish it was one year.

After about 1 year I start having a significant number of packages from testing, and it gets more and more troublesome. In particular security updates become hard to separate from the usual churn of testing. And most of the packages from testing are not even packages I want, but rather dependencies pulled in automatically.

<comment><USER3> As I alluded to below, I think with that large a project, that's done almost entirely by volunteers, one year just isn't enough turnaround.

<comment><USER4> But OpenBSD does it on a six month basis. I am wondering if it is more the degree of organization and planning rather than the size of the project.

<comment><USER5> I seriously doubt that OpenBSD has as many packages, with as much documentation, localization, on as many platforms as debian does. Debian is HUGE; and don't you forget the million other more specialized debianish distros that feed off of it.

<comment><USER6> This is correct. They also manage the core of the OS without all the nasty package interdependencies you get with Debian.

Debian does too much. That is the issue if you ask me.

<comment><USER7> Debian only "does too much" if what you want from an OS is a simple platform on which to build your own bespoke solution. The BSD operating systems, and OpenBSD in particular, abdicate a lot more responsibility for actual system management and application deployment to the sysadmin, while Debian provides opinionated defaults (in the form of package install layouts and configuration styles) that work for most environments.

Both have their place, but for general-purpose servers, I find Debian to be a much more productive system on top of which to build solutions. For firewalls, embedded storage devices, or load balancers, on the other hand, I still reach for a recent OpenBSD install disk, because the smaller footprint and security hardening have real advantages for systems running such a limited set of services.

</comment></comment></comment></comment></comment></comment><comment><USER3> Great news, and about time. I am not sure about a two year cycle though... that might be a bit too long for what I want as a user. But with such a big project, anything shorter might be difficult to accomplish, too. Anyway, it's a welcome direction: it's difficult to base things on a system that's not predictable.

<comment><AUTHOR> Historically, they have released almost every two years anyway. Potato and Woody are the only exceptions (1 year and 3 years). So it makes sense to me to shift it.

[http://www.debian.org/doc/manuals/project-history/ch- release...](http://www.debian.org/doc/manuals/project-history/ch- releases.en.html)

<comment><USER3> Sure, but stating that as a goal is quite different from "have mostly done so".

</comment></comment></comment><comment><USER8> Not all Debian developers agree with this "decision" anyway. They are right now discussing it. See: <http://lists.debian.org/debian- project/2009/07/msg00148.html>

</comment><comment><USER9> How about not freezing the vast majority of packages _at all_?

A huge amount of their effort is spent doing pointless crap like freezing versions of 10,000 end-user software packages, and backporting updates with the features stripped out.

It's totally reasonable to freeze versions of the kernel, glibc, xorg, dbus, etc. every 18 months or so. It makes some sense to regularly freeze heavily- interdependent meta-packages like Gnome or KDE, since their release model matches up. It's _ridiculously stupid_ to freeze Firefox that way.

</comment><comment><USER10> Looks like a nice decision, however I also feel that Debian's problem is the huge freeze of thousands of packages, making the 'stable' ('stale' is better for some) distribution out of date quickly while adding a large burden to it's developers and maintainers. This blog post by the author of Ion window manager sums it all up better than I could:

<http://modeemi.fi/~tuomov/b/archives/2007/03/03/T19_15_26/></comment>


Ask HN: A universal app for buying anything anywhere? - <AUTHOR>

I've found a job that I like, and will keep for a while. So my startup ideas are useless to me. Here's one I like. I wonder why it hasn't been implemented yet.
I'd like to pay for things with my phone. I call up Jimmy Johns twice a week for a sandwich. They take my credit card every single time, even though they know my name and address. I suppose they don't want to keep credit cards in their system. Fine. But the same thing occurs everywhere throughout the web. I find something that I want to buy online, and I have to type my number in again.
There are solutions out there. Chrome saves some cc information. But not all sites implement it. There are plugins, of course. But if I switch over to my iPad, or iPhone, or a friends, then I have to go through all this again.
So the new iPhone is going to use NFC to send some kind of tokenized cc information for me to pay for stuff in real life. Great.
But what about buying things online? What about buying things remotely (like over the phone).
Here's what I'd like to see, an app that can be pinged by anyone, to notify me that someone would like to charge my credit card. I call Dominoes. They take my order. I get a push notification saying Dominoes wants to make a charge. I swipe, enter a code, and the charge goes through.
You could pay by phone for anything, anywhere, using your bank account, credit card, whatever: but you'd only have to enter that information on installation of the app.
So that's the idea. Implementation details might include using Stripe connect as the backend. Maybe implementing IOS's thumb-reader, if that's available as an API (not a IOS dev here).
I can't quite understand why this doesn't exist yet, or why it is not in wide use, or if it is in wide use, why I haven't heard of it. <comment><USER2> Apple Pay would let any app do this. The merchant could send a push notification to their own app on your phone, which would get the transaction details and request payment via Apple Pay, which would have already been set up on your phone.

The reason this doesn't exist now is because of the way banks and credit cards work. They're issuer-centric, not user-centric.

Your credit card isn't yours. It's your bank's, and it's issued in partnership with the credit card network provider, MasterCard or Visa. The credit card network provider has the relationship with the merchant, which is why some merchants don't take Discover or American Express. Both the bank and the credit card network make money off of fees from the merchant. Yes, it's you who has to spend the money, but you're not the customer of the two people with the power (the bank and the credit card network): you're ancillary in their equations. You're only valuable to the merchant, and the merchant would prefer you to pay in cash.

Apple Pay is the first to do this for the exact reasons they stated at the launch: they're not trying to make money off the transaction. They're making money off of you, the user, by selling you hardware. So it's in _their_ best interest to give you this great feature, which is user-centric payment, abstracting away the merchant and the bank and the credit card network, because it sells you hardware.

Cell phone networks have the same problem; your SIM card isn't yours, it's your network provider's, despite being your electronic ID to them. There's no way for you to consolidate or control all these pieces of your digital ID, and there's no incentive with the way the industries are set up to allow you to.

<comment><USER3> I believe Apple is earning 0.15% on the gross transaction value. Not sure if that is a lot or a little.</comment></comment>


Microsoft launches a PC vs Mac website - <AUTHOR> http://www.microsoft.com/windows/windows-7/compare/pc-vs-mac.aspx

<comment><USER2> You know... all snark aside, a lot of these things are true:

* Macs get a tiny fraction of the games available to Windows.

* Macs really don't have Bluray support.

* Macs really are different from Windows, although they are different in arguably a good way, and my mom had no trouble learning them.

* Macs really do a crappy job with Word and Excel, and like it or not, and regardless of the degree to which this is MSFT's fault, Word and Excel are important in business.

* Macs are less compatible with hardware, although this is getting less and less so.

Now, obviously you have to trade this off against:

* Macs shipping out of the box able to do solid video and audio editing --- as in, "plug in the Flip camera and go".

* Macs superior out-of-the-box integration with the #1 online digital media store (ITMS)

* The all-around better user experience on the Mac for the things most people care about.

And, I am genuinely baffled by the "it's easier to share on Windows". Uh, no it isn't.

As a Mac user I say it's about time Microsoft stopped pussyfooting around making oblique references to Apple. It's a real fight, and they should try to win it.

<comment><USER3> I've never had a problem with microsoft word/excel for mac.

I'm not trying to say your wrong on all of these points or anything, I just always find it funny how companies use Marketing speak and omission to lie.

<comment><USER4> I'll agree with this under the condition that we're talking about the most recent release of Office.

Having had to wait 2 years for an Intel version of Office was disappointing. Office 2004 ran perfectly smoothly on my old iBook G4. But on a MacBook that otherwise should have run circles around that iBook, Office was nowhere near as responsive, and would often thrash the disk while trying to open documents.

</comment></comment></comment><comment><USER5> 9 out of 10 people already use Windows. Are they trying to get that number back up to 9.4 out of 10? I think their efforts are better spent in mobile and building an iPad competitor. It's really going to hurt when Apple and Google lock up the mobile and tablet markets.

<comment><USER6> I don't think this is a bad idea for them - I've heard (no sources, unfortunately) that new college entrants are now predominantly using Macs. It takes years for the loss of market share to truly translate into profit/revenue loss.

If it's true that the younger generation is flocking to Macs in droves, then it would be deceptive and ill-advised to say that 9 out of 10 people _right now_ use Windows, and that's the way it will stay.

I think MS is fighting to avert a disaster that will happen 5-10 years from now. This seems wise, though as a Mac user I have to scoff a little bit at it ;)

(Windows _can_ do more than Macs, but lack of integration and poor UI means that most of its users _don't_.)

<comment><USER7> This is precisely it. 1/10 are Macs, but among college students, it's 27% (<http://tech.fortune.cnn.com/2010/08/07/big-macs-on-campus/>). This is why MS is worried.

</comment></comment></comment><comment><USER8> They pretty much nail the "fun" category, but the repeated shots they take at compatibility (and iWork) seem pretty dishonest to me, considering, you know, Office for Mac has been around 25 years?

And the Top 10 list made me laugh aloud:

      1) the Dock and contextual menus have been around since 2001
      2) iMovie and iPhoto were out first
      3) Okay, score one for MS.
      4) It takes exactly three clicks on Mac OS X as well.
      5) Uh, Spotlight?
      6) Macs have long been applauded for their sleep/wake abilities.
      7) Again, nothing OS X hasn't done for years.
      8) Point two for MS.
      9) iTunes/Front are good, internet TV doesn't count.
      10) Not really seeing this one either.

<comment><USER2> The top 10 list isn't really interesting because it's just a framing device for Win7 features; the "real" top 10 list would lead with "native support for Word and Excel", and would include something about security.

<comment><USER8> > The top 10 list isn't really interesting because it's just a framing device > for Win7 features;

Right and it's not technically a top 10 of Mac vs. PC, but the tabs are right next to each other which is why I commented on it.

</comment></comment></comment><comment><USER9> What is most striking to me is the frequency at which this site says "many PCs", as in "not all PCs". Or "can get" as in "won't necessarily get". With Apple products, buyers don't have to think. They just buy the iMac which fits in their kitchen nook, or the largest (or smallest) MacBook they can afford.

I'm reminded of when I went to the Apple store to buy a spare battery for my Macbook. I wrote down the model and serial numbers of both my existing battery and the laptop itself. I got to the store, walked over to the accessories wall and said "I'd like a spare battery for my Black--". "Black MacBook? Here you go." He hands me the battery. "Anything else I can do for you?"

</comment><comment><USER10> I was amused by this key point: On a Mac, out of the box, you can only encrypt your home folder. With Windows 7 Ultimate, you can encrypt your entire hard drive and even USB drives. So your stuff can be safer wherever you go.

Obviously, the problem with this statement is, any and every Mac you purchase will have encryption available - even if it's "only" the Home folder (which, I'd guess, is where 99% of my personal data is located...) The same can't be said for the PCs at BestBuy with Home or Professional installed.

Just amused by it.

Now the, "the mouse works differently" statement...I'm not even going to touch that one!

</comment><comment><USER11> <http://www.apple.com/why-mac/>

I don't know about the technical details, but comparing it with the Apple website makes one thing clear: Microsoft has no design sense.

</comment><comment><USER12> "First they ignore you, then they laugh at you, then they fight you, then you win." Mahatma Gandhi

</comment><comment><USER13> Forget comparing the OSes, instead compare this to Apple's equivalent website: <http://www.apple.com/why-mac/>. I don't think there's any question who has the better campaign going.

</comment><comment><USER14> I think the crowning irony may be "PCs do what you want: they just work."

<comment><USER15> This bullet point needs to be taken out and shot for all platforms to which it refers.

</comment></comment><comment><USER16> Doesn't work on my iPad. "easer to share" Not so much and none of the other argument make sense either. How about cheap and not as bad as people say it is for a marketing campaign?

</comment><comment><USER17> I am a developer, and have been using PCs for 20+ years, always wanting to throwing out the windows whenever MSFT crashed the thing.

Bought a Mac two years ago, and to tell the truth, I never knew how bad Windows was really until I used OS X.

My wife started using computers two years ago, and she just loves the Mac, I am professional developer and can honestly tell you that developing on the Mac is just awesome to developing on Windows,the Mac rocks inside out!!!.

Pc's are old school, Macs will rule this new century in computing.

Macs are rock solid easy to used by both experienced and unexperienced users.

This Microsoft site seems quite lame, and is obviously targeted to users who have never used a Mac.

Best regards

<comment><USER18> _I am professional developer and can honestly tell you that developing on the Mac is just awesome to developing on Windows,the Mac rocks inside out!!!._

Honestly, I find this to be true only when developing against Unixy platforms or tools that have better support for Unix than Windows (like git or node.js or arduino)</comment></comment>


Show HN: Dit – A new kind of container file for standardizing data - <AUTHOR> https://github.com/isaiahshiner/dit-cli <comment><AUTHOR> Dit is ready!

About 4 months ago, we posted just a website to HN: [https://news.ycombinator.com/item?id=21263839](https://news.ycombinator.com/item?id=21263839)

Now we're launching the MVP and hope you'll join us in trying to make data much better!

For a primer on what this is all really about, I wrote quite a bit on this exact topic: [https://github.com/isaiahshiner/dit- cli/blob/master/docs/wha...](https://github.com/isaiahshiner/dit- cli/blob/master/docs/whats-the-point.md)

<comment><USER2> Interesting! You might be interested in an old HN discussion between Alan Kay and Rich Hickey (JGI). It sounds to me like dit is basically an attempt at solving the problem that Alan Kay was getting at when he conceptualized "object oriented programming" as affecting behavior (even extracting information) from an object by passing messages to it — which would be a critical bottleneck when trying to build an "inter-galactic network" in the spirit of Licklider's vision.

<comment><AUTHOR> Ah, this? [https://news.ycombinator.com/item?id=11945722](https://news.ycombinator.com/item?id=11945722)

Super interesting! It's like, data, without an interpreter, has no meaning. We rely super heavily on humans as general purpose interpreters, and when we design computers, we make sure as much of the meaning as possible is implicit.

Rich was saying that the interpreter is secondary, which is only true if data serves a single purpose. Alan is getting at the idea that data could serve every purpose if only the interpreter wasn't implicit. If the concept of "data" referred to both the value and the meaning, the language and how to interpret it.

But, from a reddit comment: _An interpreter doesn 't magically give meaning to data, since the interpreter has to translate to something, and that something has to be written by a program that understands both the from and to sides of the conversation._

The point of dit is to literally be that universal language. Yes, you do need both sides to explicitly lay out what they main, both to convey and understand the meaning. The difference is that the number of connections is unlimited. You need a human for that critical first step, but then the machine can speak "dit" language to any other machine that speaks dit. Rich couldn't conceive of the idea that dit could be real. I think it can. I think we can make Licklider's vision, data and programs that can move around without respect to the original developers intentions because they all speak dit.

Thank you for sharing, super interesting!

</comment></comment></comment><comment><USER3> Intriguing idea. I just breezed through readme so sorry if some of these are already answered.

You say Javascript and Python as if it is unique identity. Which version of language? Which interpreter? How do you make sure that both sides of communication run the same logic?

The data source wants to communicate data to receiver. Is the code transmitted together with data? What is benefit of running this code on receiving side instead of sending side?

Apart from validation the Dit file can include custom interpretation of data. Do you serialize and store validation and query code on disk? Is this good idea? As you build more features in the system, you end up with old data that cannot be queried as well as new data, even though the raw data is the same. For example dates - you might end up with a system where old dates cannot be converted to various date formats while newer can.

<comment><AUTHOR> > Which version of language? Which interpreter? Ah, very good question. > Currently, it's just whatever version is in /usr/bin/$LANGUAGE. You can see > in /home/$USER/.dit-languages how the language configurations are defined. > You can add another configuration, just by copying the Python configuration, > changing the name and path to Python2.7, and then doing this:

        validator Python2.7 {{ //Older python code }}

In the long run, this should be made a lot simpler I think, which leads me to your next question:

> How do you make sure that both sides of communication run the same logic? > This will probably require some way to send language configurations along > with a dit. If you send someone a dit which requires Java code, but the > client doesn't even have Java, the dit should be able to recover from this > somehow, by automatically installing Java, creating the configuration, etc. > I'm not exactly sure how this should work, but its one of those clearly > solvable problems that I'm trying to leave be until I have a good example of > the real problem.

> Is the code transmitted together with data? What is benefit of running this > code on receiving side instead of sending side? Yes, the code is always tied > directly to the data. Currently, source code must be sent, but in the > future, it could pull from a link, or even run the validation offsite, via > an API (important in case you want closed source classes).

In theory, there is no reason for the receiver to run the validation, (assuming the receiver trusts the sender to validate). But one purpose of dit is to prevent a message from ever being separated from it's meaning. If a client receives some data in a dit format they have never seen, they can learn how it works by looking at the dit. The validation code can even be used as ad-hoc unit tests when trying to process the data automatically. And also remember that querying (and converting, mutating, anything else that might be added) also requires the dit code.

> Do you serialize and store validation and query code on disk? Is this good > idea? Currently, the modified code is regenerated every single time. You can > see the code in /tmp/dit/. This is slower, but it does mean that the code > and serialized data are always as new as possible. Caching could be an > option, if done carefully.

> .old data that cannot be queried as well as new data. ...old dates cannot be > converted to various date formats while newer can. I'm actually not sure > what you mean here, I can't picture how this could happen. Could you > explain?

<comment><USER3> Let's say side A is a logger, with each log entry being timestamped. We want to be helpful so we provide way to convert data into MM-DD-YYYY string. These logs are transmitted to side B and stored to disk.

Few months later we decide to add another converter, one that gives out YYYY- MM-DD format. New logs can interpret themselves better than old ones, and side B needs to be careful what it can ask of dit file. If there are multiple log sources, then depending on source we have more or less powerful interpretation of _same_ data type, until they are all updated.

To me the code should be stored and managed separately from data. The side B should be responsible for parsing raw data from A. The interpretation shouldn't be bundled with data because same data can be interpreted better in future. The cleanest way I've seen it done is Clojure's spec library for describing and validating data.

</comment></comment></comment><comment><USER4> The project makes a bunch of big vague claims, like:

> Someday, there will be no file extensions: every file will be a dit.

reading: [https://github.com/isaiahshiner/dit- cli/blob/master/docs/wha...](https://github.com/isaiahshiner/dit- cli/blob/master/docs/whats-the-point.md) ...seems to imply you want to solve the problem where:

      "Name": "John Doe"

      vs.

      "Name": {
          "FirstName": "John",
          "LastName": "Doe"
      }

represents the same data?

But for me it's completely unclear if or how Dit solves this though.

[https://www.ditabase.io/faq.html](https://www.ditabase.io/faq.html) says:

> Dit is not a format, it is a container. It's trying to be a bridge between > other formats, and that means it relies on them heavily. You can't write > data in dit format, only wrap data in a dit.

So it sounds like a schema language, an alternative to JSON-Schema, Avro etc?

But then it also bundles in a bunch of other things...

Apparently contradicting the above, the are 'assigners' and a sort of query language which seem to create and return records in this format which you "can't write data in":

      // Assign an existing object
      myName.givenName = name;

      // Use the 'n' assigner inside a list
      myName.middleNames = [n('Leopold'), n('Koser')];

      // Assign the string directly
      myName.familyName.value = 'Shiner';

      dit query name.dit '@@print(myName)'
      "Hi! My name is Isaiah Leopold Koser Shiner"

And then there are the validators and printers, as chunks of embedded python or javascript code.

But it's still hard to see how any of this solves the "John Doe" problem?

If dit is meant to be a bridge between silos of incompatible data maybe it would be useful to show some examples of that use case.

<comment><AUTHOR> Hmm, I can see how I'm being confusing. This is partially trying not to give information overload with poorly written explanations, especially for features which I haven't added yet. It's also because dit is really trying to solve everything with Perfect Data all at once, and I need to go back and be clear about when I'm talking about which concepts. To solve Perfect Data, we need a single system that can do:

\- _Validation:_ This is for when you ask for a name and get "4jZw3ef\n". This already exists in database constraints, APIs, and, as you said, in things like JSON-Schema and Avro. The key difference is that the 'schema languages' are not languages. They don't have full flow control, libraries, classes, not even simple string functions. Dit does, by proxy of allowing for embedded languages, which let you do whatever you want.

\- _Schemas:_ Obviously other schema languages already do this. This is covered by dit classes. To solve the "FirstName", "LastName" issue, you just make sure you're using a Name schema like the one I demonstrated, in which Name contains a FamilyName/GivenName. But then everyone is using different classes for the same data, which you can solve by...

\- _Global Online Schemas:_ The only one really doing this is Schema.org. Everyone can agree that [https://schema.org/Person](https://schema.org/Person) is a reasonable official schema for a person. However, they have no validation, and changes are decided by a consortium, not free change. DitaBase.io would have a sort of copy of GitHub, in which each class is it's own page, and doesn't explicitly belong to anyone. Using meritocracy, democracy, and compromise, the community would agree on which exact schema of Person is best. If someone disagrees, they can make their own style and try to explain why it's better, while offering easy conversion between their style and the old style.

\- _Format Support /Universality:_ This is what I was getting at when I said "you can't write data in dit". Dit cannot afford be locked into one technology platform, the way JSON-Schema is locked to JSON, and the Semantic Web is locked to HTML. How do I write down data when you ask for it outside of a dit? In .json, .csv, .xml? Why not .yaml, .toml, .xlsx or .gsheet? There's no way to serialize data raw data as dit, only take data written in a .dit and print it some other way. The print functions and query system should allow you to request data in any format you want, including more than one. And ultimately, dit could never provide all of the features people could want. [https://ipld.io/](https://ipld.io/) is basically doing a JSON-Schema style of thing, specifically for the block chain. Dit isn't going to replicate their custom block chain features, so instead dit should _support_ IPLD, by allowing data to be read and printed in their format, and converted every which other way you can think of. I mentioned DitaBase having it's own object model, but the truth is this would almost certainly reference Schema.org, at least by extension.

Perhaps the thing I was least clear on overall is that dit is still an evolving concept. I know where dit is now, and I know where dit wants to go, but I'm not really sure how to get there. Maybe assigners are a terrible way to solve that specific problem. That's fine, we'll throw them out and make something better. All I know is that Perfect Data needs to be solved, is solvable, and dit has a much better chance of solving it than any other existing solution.

</comment></comment><comment><USER5> This might actually come in handy for the project I'm building! Currently working on a personal database to store data from external APIs like Gmail, Spotify, etc. I was going to use RXJS but the schema requirements seemed like it would get in the way of rapid integration. If there was an easy way to just drop in a JSONSchema like how DefinitelyTyped does with Typescript it would be super helpful. This is definitely a step in the right direction.

Link to the project for context: [https://github.com/aspen-cloud/aspen- cli](https://github.com/aspen-cloud/aspen-cli)</comment>