A Butterfly's Beauty Comes from Organized Chaos (2013) - <AUTHOR> http://nautil.us/blog/a-butterflys-beauty-comes-from-organized-chaos

<comment><USER2> > A butterfly's colors come from its scales, each a single cell, pigmented a > single hue.

Fascinating article but I think "pigment" is perhaps misleading. I was taught that butterfly wings are often _structurally_ coloured, i.e. the colour is the result of the microstructure (shapes) of the cells, rather than a dye or specific molecule.

[https://en.wikipedia.org/wiki/Structural_coloration#Structur...](https://en.wikipedia.org/wiki/Structural_coloration#Structure_not_pigment)

Also of relevance to complex patterning (though I'm not sure if this applies to butterflies, or if this is what the article was hinting at) is Turing's Morphogenesis:

[https://en.wikipedia.org/wiki/The_Chemical_Basis_of_Morphoge...](https://en.wikipedia.org/wiki/The_Chemical_Basis_of_Morphogenesis)</comment>


Most Detailed Observations of Material Orbiting Close to a Black Hole - <AUTHOR> https://www.eso.org/public/news/eso1835/ <comment><AUTHOR> Simulation of Material Orbiting close to a Black Hole

[https://www.youtube.com/watch?v=Zmdcew3g9ME](https://www.youtube.com/watch?v=Zmdcew3g9ME)</comment>


Browser Speed Tests - Opera Fastest, Firefox 3 Least Memory Usage - <AUTHOR> http://lifehacker.com/396048/speed-testing-the-latest-web-browsers

<comment><USER2> Eight tabs? I have well over 100 open at any time with Opera. This sort of browsing behavior chokes Firefox 2.x. I'd like to see whether Firefox 3 can handle it.</comment>


Hot startups for Founders at Work v2 - <AUTHOR>

The only book I've read cover to cover and I want MORE! If there were a follow up on this, which successful startups would you pick?? <comment><AUTHOR> Facebook, Youtube</comment>


How the Mac App store could blow up the software market - <AUTHOR> http://tech.fortune.cnn.com/2010/12/09/how-the-mac-app-store-could-blow-up-the-software-market/

<comment><USER2> Yes, yes, we know that. Marco Arment already made that point in this excellent article: <http://www.marco.org/1432156914>

The Mac App Store isn't for today's Mac developers. It's for all the other ones who are on the way.</comment>


Why is this game so tough? - <AUTHOR> https://apps.apple.com/us/app/curry-bird/id1474782300 <comment><AUTHOR> And what the heck does curry bird even mean?</comment>


Square Register - <AUTHOR> https://squareup.com/register <comment><USER2> One piece is missing: a much more robust card reader that doesn't swivel or threaten to snap in two after a day of swiping.

<comment><USER3> I noticed a local business (Blue Moon Burgers) using iPads as registers, using similarly flimsy (though not Square) card readers. They gave up after a few months and switched to a traditional POS setup. I don't know whether it was the card readers that were to blame, but I'm guessing they were part of it.

<comment><USER4> External card reader would be much more expensive because it has to (IIRC banks enforce it (probably thanks to insurance companies)) encrypt all communication with the "register" (in this case iPad). So it can't be just some dummy device.

<comment><USER5> AFAIK only PIN pad units require encryption but my knowledge could be out of date.

</comment></comment></comment></comment><comment><USER6> I can't actually remember the last time I swiped my card and signed for anything, because we in the U.K., like most of Europe, use Chip and Pin (EMV is the official name). I wonder if Square will still function when this gets pushed into the U.S. market.

Surely this is due soon in the U.S.? [http://corporate.visa.com/media- center/press-releases/press1...](http://corporate.visa.com/media-center/press- releases/press1142.jsp)

<comment><USER7> Square will be in trouble if NFC takes off. That is why its coming up with what I think is its main product line, the register. The credit card reader thingy is not where it makes money. Once prople get hooked on the analytics it can hope to add the NFC functionality in and still keep going.

<comment><USER8> Square seems to be attempting to counter NFC with Card Case[1]. Still requires the merchant to be using Square, but has the upshot of working /now/, with the cards/phones you already have, instead of maybe in a year or two when ISIS gets it's act together.

[1] <https://squareup.com/cardcase>

</comment></comment></comment><comment><USER9> First time a URL like:

      https://squareup.com/register

Hasn't been about signing up for the web site.

</comment><comment><USER10> I don't like how, as the customer, I have no way of seeing what exactly is being charged to my card. For all I know, anything could be running on that ipad (foreground or background) and i could be charged any amount without knowing. Sure, I can ask for a receipt, but even the legacy till they replace in the video has a customer facing display, not a shiny piece of aluminum with some fruit. It's interesting that video never switches to the customer view either.

<comment><USER11> I used to work at a retail outfit that used the really old-fashioned credit card system involving carbon paper slips and handwritten amounts, which would be entered into a credit card processing system at another location at a later time. We could have essentially charged whatever amount we wanted, and this was fairly apparent to anyone who paid via credit card. And yet, out of every thousand people who go to pay with a credit card, I could probably count on one hand the people who express any serious concern about this fact.

Businesses have an incentive in maintaining their reputation and not getting into trouble with payment processors, and I generally think people assume any business approved by a payment processor is probably sufficiently low-risk to give a credit card.

<comment><USER12> any business approved by a payment processor is essentially zero-risk. if you ever get an unauthorized charge on your credit card, it is trivially easy to have the charges reversed.

</comment></comment></comment><comment><USER13> No other startup has ever been so primed for an Apple acquisition. Everything from execution, design sensibility, culture and even CEO is heavily Apple inspired but in a different but still complementary industry.

<comment><USER7> Square is a POS, cash register company. Why would Apple be interested in it?

<comment><USER5> It's an area ripe for disruption. Apple is already a payment processor (iTunes) and has easy to use touchscreen devices (iPad). Seems like a good fit to me.

</comment></comment></comment><comment><USER14> Slightly tangential note - Square has the most gorgeous product videos I've seen from a startup. Their jobs section even lists an open position for doing these so I guess they do them in house. Very impressive.

<comment><USER15> Thank you! Our in house video team is pretty awesome.

</comment></comment><comment><USER16> The Application looks amazing. Well done.

What I do wonder though, is why they're shipping this with such a terrible stand/card reader attachment? I can't see those lasting 6 months in a busy shop environment. I'd like to see a swivel stand that's locked to the counter which you can slide the ipad into, then bolt secure and lock with a key. While you're at it, build a robust card reader into the side of the case. Basically something similar in form factor to this: [http://www.directindustry.com/prod/elo-touchsystems/touch- sc...](http://www.directindustry.com/prod/elo-touchsystems/touch-screen- monitors-with-card-reader-9044-121138.html)

I could probably put something like that together in a weekend with a trip to fry's/home depot, but why should I have to?

Also, a question I'd have before using this - what happens in the event of a software crash? Where is my data, how quickly does stuff get backed up online?

<comment><USER17> Most likely because a lot of their business relies on easily being able to provide a ton of people with free card readers. I'm sure they've explored a more robust option, but it's probably nowhere near as cheap as the current model.

Maybe a paid upgrade card reader is the next step, but if their goal is broad, cheap and easy distribution they'll probably be shipping with this model for a long time.

<comment><USER16> I'm not suggesting this is free, by any means. However, given the cost of buying existing POS hardware solutions, I'm confident I could handcraft bespoke ipad cases with card readers, sell them an ipad and _still_ make a profit, all while undercutting a more traditional setup.

</comment></comment></comment><comment><USER18> This looks awesome! It's important they get this kind of product right on the first release -- because small business owners can't tolerate 'beta' for something so critical as their cash register.

Case in point: One of my favorite restaurants in Seattle was using iPads for registers (not using Square's product). I came back a few months later and they had switched to a 'normal' POS system. "What happened to the iPads?" I asked. "There were too many issues and they crashed way too often." It was a case of a restaurant that wanted to be on the cutting edge -- but in the end it didn't work out, so they went with a standard solution that worked well.

I don't doubt that square can execute -- they have already shipped some great products. I just want to point out that it's not as simple as some people might imagine.

</comment><comment><USER19> Scanning through the page, I noticed one oddity in the screenshots: the "Add an Optional Tip" page showed various fixed-size tips, but no way to enter an arbitrary amount. In previous versions of the interface, I thought the UI had an option to enter an arbitrary tip amount.

</comment><comment><USER20> Must be an American thing, I guess. Is EFTPOS (ie debit card) less common in the US than in Australia? Seems odd to provide a credit card service by itself. People don't pay for coffee and things on credit, do they?

<comment><USER21> Why not? Why pay now when you can pay later for free?

<comment><USER22> With 1% cash back, no less. I try to funnel all my expenses through a card -- and pay in full each billing cycle naturally.

<comment><USER23> The cash isn't free. You're paying the X% credit card tax on purchases via higher prices.

<comment><USER21> Not really. All the people not using a credit card are subsidizing your purchases so the impact on prices is negligible or non-existent.

</comment></comment></comment></comment></comment><comment><USER24> I would love to see a slight modification to the design of their reader hardware. Keep the audio interface, obviously. But design a small plastic frame that the reader can fit into that fits flush against the edge of the top of the iPad/iPhone. Make it a bit longer with slightly sloped internal edges so that its easier to guide a credit card to the scanner. This will also have the benefit keeping the reader from swiveling around while in use. Actually sounds like a Kickstarter project if Square doesn't come out with it themselves soon.

<comment> sans-serif Mount the reader separately, and connect it to the iPad with an audio cable.

</comment></comment><comment><USER25> I'm not sure if I'm missing something, but desensitising the general public to devices that their card is being scanned through (and occasions where that might be appropriate) will surely lead to to an increase in card fraud.

What's to stop someone jailbreaking an ipad, writing a custom fake ui, clipping in a square scanner, and writing off a days worth of cheap merchandise down at the park for a haul of card details?

If this becomes common, will credit card companies still offer the same guarantees on transactions?

<comment><USER26> > What's to stop someone ... writing off a days worth of cheap merchandise > down at the park for a haul of card details?

The fact that stolen credit card numbers, even with a full billing address and CVV2 code are still only worth a couple dollars on the black market. Your setup wouldn't even capture that, so your merchandise is probably worth more than the numbers. And you're putting yourself at pretty serious risk of getting caught by running this scam in person, when it's much easier to do some kind of phishing scam online anonymously, with more valuable results.

Stolen credit card numbers just aren't very valuable. If you're not living in a nation with an ineffective or corrupt legal system, what are you going to do with the numbers without a high risk of getting caught? Making your own plastic cards and magnetic tracks is expensive and you end up on security camera video using them. Ordering anything tangible online means linking your fraud to your physical location one way or another. You can order a bunch of porn or other intangibles, but that's a pretty low reward for all the risk.

In the end, it's a moot point anyway. Normal credit card terminals can be bought on eBay for less than an iPad and can be used for card theft just the same.

<comment><USER25> Thanks.

In europe we use chip and pin, so a fake app could collect the pin directly. If someone was to harvest 30 cards with pin, could they then visit an atm directly? Perhaps I'm underestimating the difficulty of cloning cards. If that is possible, CVV2 would be unnecessary.

I hear your point about normal credit card terminals being available. As a european I wouldn't expect to see one on a stall by the side of a road though, and would normally be suspicious of anyone suggesting that they accept credit cards under these conditions.

<comment><USER27> And that's why you need a separate terminal to enter your PIN (at least here in the UK, although I'm fairly sure that also applied in Europe), and the PIN number is never transmitted to the actual POS application, just a token indicating success or failure.

<comment><USER25> Right, but in this instance the 'terminal' to confirm your pin and POS application are one and the same, and ultimately just replaceable software on an iOS device.

</comment></comment></comment></comment></comment><comment><USER28> The text is all garbled in my stock Android browser. Please ut this seems like quite a nice idea.

<comment><USER29> Same here (your first sentence).

</comment></comment><comment><USER30> I wonder if they plan to open a web store interface, so users can purchase things without an iPad... I've been looking for a sexy place to set up shop, but my business doesn't have walk-in customers. I know that's not really square's game though

</comment><comment><USER31> There's lots of talk about the survival of the Square reader under heavy demand, certainly another more durable reader needs to be produced.

However is the market for square at this price point really for anything above one or maybe two point of sales?

Using this setup in some bar environments would require some hardware to protect the iPad, I've worked looking after hardware in busy student union bars where the staff just destroy the tills with spillages.

My impression of the earlier square products for POS were that it's intended for giving the small business something, not for running your local branch of Starbucks.

</comment><comment><USER32> This could be a game changer. Restuarant management software is a space that needs innovation as well - I'd be surprised if they don't roll something out that incorporates both payments and reservations.

</comment><comment><USER33> Awesome to see Square continuing to progress forward on a regular basis! The register app looks great!

Does anyone know if it works well (or at all) with multiple iPads? Can you view/manage the inventory online?

<comment><USER15> We sync your items, settings and payment history between multiple devices. That was...not easy.

<comment><USER34> Nothing worthwhile is ever easy. =)

</comment></comment></comment><comment><USER35> I don't understand where the actual cash came from in the video. Would this mean I still have to have a register to store the cash in? Wouldn't this make the whole process borked again?

<comment><USER36> If you scroll down on the sales page, theres a wireless/ethernet controlled cash box that can be purchased.

</comment></comment><comment><USER37> Did anybody go through the verification process when ordering the device? After I input some basic info (like my birthday and last 4 digits of my SSN), I was asked to answer questions I have no idea how they even came up with.

One example is, "What hospital did you live near when you were on RandomName St.?"

How did they immediately know what street I lived on some years back, and also that it was near a major hospital?

The authentication was all pretty impressive, but kind of creepy too.

<comment><USER19> That doesn't seem like a useful security question at all. Anyone can trivially find out the answer via online maps, and meanwhile the actual person who lived at that location might not necessarily know the answer themselves without looking it up. At most, if you use it as a trick question ("Hah, caught you, the person you wanted to authenticate as never lived on RandomName St!"), you get one bit of information, which you could get much more straightforwardly by asking "Have you ever lived on RandomName St?".

<comment><USER38> Street names are quite common though, knowing the street name is unlikely to give you enough information to answer the question. The real person however, would know the location of the street and be able to use this to look up the right answer if they didn't already know.

</comment></comment></comment><comment><USER39> I love Square's work to date. The way they've changed the retail and hospitality industry for the better, and looking damn good while doing so. That being said, I can't say I'm a huge fan of the Register icon. Even the Card Case icon is strobing a bit on this monitor.

<comment><USER33> Agreed. It doesn't really communicate anything about the application. It has the square logo, but those colored squares could be anything. Items or inventory aren't what come to mind. The app looks cool though.

</comment></comment><comment><USER40> FWIW my local coffee shop uses ShopKeep and Perka and they work great!

<http://www.shopkeep.com/ipad-pos>

<http://itunes.apple.com/us/app/perka/id428620381?mt=8>

</comment><comment><USER41> I'm drawing up a design to make them a better stand. What they have just looks like it's waiting to get pushed off a counter. They are only a few blocks away, I could just drop it off.

<comment><USER36> Is it not just the iPad software and the card reader they are selling?

I thought the stand was for demonstration.

The video shows a different stand than the homepage pic.

</comment></comment><comment><USER42> I just stopped in at a coffee shop in the middle of Philly the other day using Register. Guess they got access to the beta testing.

</comment><comment><USER43> It's great to see a company taking an existing product (iPad) and building on top of it's powerful software and hardware.

Instead of stores having to buy some expensive & clunky cash register or crazy expensive PoS solution; they can pop down to their local Apple or electronics store & buy a future PoS device.

It's very powerful when anyone can start accepting payments by just popping down to their local electronics store.

</comment><comment><USER44> That's a horrible logo. I had no idea that was "Square" at all when just looking at the logo.

<comment><USER45> As opposed to an Apple? I get that the logo is modelled on the dongle (which may or may not get phased out), but it's extremely generic and will probably not work very well for branding purposes in the future.

</comment></comment><comment><USER46> We need such innovation (at any level - design, engineering, technology) Keep it up guys!

</comment><comment><USER47> I wonder what Jack Dorsey is thinking, while reading of all these. I seriously doubt he worries about "...one retailer and they weren't using the device because the square was too wonky ..." It just sounds like a problem too easy to fix, and I am sure they've got bigger fish to fry.

<comment><USER48> Dorsey is definitely reading, or I certainly hope he is!

Good information here. Lot's of valid points, complaints, arguments. There are many ways to improve Square, the UI, the hardware, the usability, training, etc. They have a solid product.

</comment></comment><comment><USER49> I really wish they would work on pushing a final version of their API.

</comment><comment><USER50> Any update on when this will be available in european countries?

<comment><USER31> I'm hoping from the November press release they're moving international this year. They took on Branson as an investor too.

</comment></comment><comment><USER51> The app is downloaded via the App Store - according to the terms of the app store, aren't Apple entitled to claim 30% of transactions through the app?

edit: Or, at the very least, entitled to 30% of the fees charged by Square to the merchant?

<comment><USER27> Although the immediate parent is being downvoted, it's actually interesting to understand why Apple have allowed this without collecting a % of the transaction fees that Square receives.

Or perhaps they are collecting a (lower?) percentage.

<comment><USER52> From what I understand In-app purchases (where Apple gets a 30% cut) are only required when the item is only for use from within the app (virtual currency, level packs, digital subscription etc). Purchasing a physical items does not require transaction to use Apple's IAP API. In fact, it is expressly forbidden.

</comment></comment></comment><comment><USER53> This is a gimmick or a hack. Not much better than what you will see on hackaday.com

I did a LOT of POS work a few years ago for small businesses. An iPad/iPhone would be dead and broken in less than a month for most retailers. You need pretty hard wearing industrial grade kit if you don't want to throw it away 3 times a year. That flimsy card reader is almost comedic - you'll break it and your device.

If it's your revenue collection equipment, it makes sense to buy something that will last i.e. was designed for the job rather than sit there not being able to take cards.

<comment><USER54> Apple uses iPod touches with a more beefy card reader setup in their retail stores. You could do the same with a slightly modified iPad case, and a reinforced reader.

<comment><USER53> It would still be no good. If you drop one, it's dead. If you drop a Barclays PDQ, you pick it up and continue the transaction.</comment></comment></comment>


Ask HN: Business movie suggestions? - <AUTHOR>

Hi guys. I've recently watched The Boiler room, which is a awesome movie that can really teach you about selling stuff.<p>Have you watched any movies that taught you about business? Please share. <comment><USER3> You should watch the documentary _startup.com_

<http://www.imdb.com/title/tt0256408/>

<comment><USER4> I second that! This documentary captures the late 90s .com boom better than anything else I've seen.

</comment></comment><comment><USER5> Even if you didn't care about learning business through film, I would recommend these. Most are classics and highly enjoyable. I left out the great ones already mentioned.

Risky Business - going from idea to execution in a very short time

High Fidelity - small business, vertical expansion, labor relations

There Will Be Blood - "I have a competition in me."

Office Space - process reengineering, efficiency, employee motivation

It's A Wonderful Life - customer service, community building, ethics

The Man In The Gray Flannel Suit - work life balance

The Player - handling office and industry politics

Enron: The Smartest Guys In The Room - ethics (and the catastrophe that befalls those without them)

</comment><comment><USER6> I might be wrong but I like the way Scarface (<http://www.imdb.com/title/tt0086250/>) does business. There's a lot to learn from him.

</comment><comment><USER7> hustling: The Entrepreneur

some business history: Pirates of Silicon Valley

business culture: Barbarians at the Gate, Rogue Trader

wealth: Bonfire of the Vanities

</comment><comment><USER8> The Hustler - 1961 & The Color of Money - <USER2>

Both with Paul Newman.

Optically about pool hustling. Really about the processes through which the naive progress as they encounter the underbelly of reality.

</comment><comment><USER9> Ghostbusters.

</comment><comment><USER10> El método - <http://www.imdb.com/title/tt0427582/>

</comment><comment><USER11> Riot on!

<http://www.imdb.com/title/tt0427783/>

</comment><comment><USER12> "Executive Suite" - The essence of running a business is captured beautifully in William Holden's speech to the board at the end.

"Glengarry Glen Ross" - great depiction of salemen selling a commodity on commission :-(

"Wall Street" - 20 years later and they're still cheating as much as ever.

"The Godfather" - notice all the references to the difference between what's personal and what's "strictly business".

"The Devil Wears Prada" - I just want people like Meryl Streep on my side.

"My Big Fat Greek Wedding" - Look at what life can be like if everyone just keeps working. (How many small businesses was that family running anyway?)

"Other People's Money" - similar to Wall Street, but a little more uplifting.

</comment><comment><AUTHOR> Catch Me If You Can seems like a good movie to learn about business. This guy managed become "successful" talking his way to success.

I quote successful cause he basically scammed a lot of people.

</comment><comment><USER13> Glengary Glen Ross. Steak knives.

</comment><comment><USER14> Wall Street,

Boiler Room</comment>


Ask HN: How do you determine an initial valuation? - <AUTHOR>

I'm getting ready to start looking for some angel funding but I'm having trouble determinig how to value my startup for their investments.
Did PG have any advice on this in any of his articles?
Those of you who have gone through this, how did you come up with your very first valuation? <comment><USER2> Avoid it like the plague. Get a lawyer and issue convertible notes instead. Valuing a seed company with half a product and no customers only ends up in tears.

</comment><comment><USER3> I assume you have some kind of neighborhood of your company's worth in mind, right?

How much do you think your company will be worth in 2 to 5 years? Do you have any data to back that up? What are the valuations of similar companies? Are you able to grow to their size? What does your overhead look like? What sort of cash flow do you foresee generating?

It's a bit of a black art, but you should be able to have some idea of what you honestly think your company should be worth. If you don't have a clue about this, then you need to wait to pursue any sort of funding until you can figure out what your value proposition is.

Remember that when you look for funding you are offering to sell a portion of your company at a discount in exchange for expertise and liquidity. That discount increases along with risk. I don't know if it's a linear relation, but the two are most definitely related.</comment>


How does Facebook manage releases without downtime and poor UX? - <AUTHOR> http://www.quora.com/Major-Internet-Companies/How-do-big-companies-like-Facebook-Google-manage-software-releases-without-causing-system-outages-and-poor-user-experience

<comment><USER2> It would be interesting to know a little deeper. For example, the "Gatekeeper", once features are rolled out, are they permanently "on"? Does the feature to disabled them get removed? Or does their control panel look like Firefox settings?

</comment><comment><USER3> very very cool post!</comment>


Intel's Remote AMT Vulnerability - <AUTHOR> http://mjg59.dreamwidth.org/48429.html <comment><USER3> > If you reboot you should see a brief firmware splash mentioning the ME. > Hitting ctrl+p at this point should get you into a menu which should let you > disable AMT.

my Lenovo T450s's vPro/AMT setup menu (MEBx) requires a password from me. The default password ("admin") won't work -- which is wonderful, as I have no idea how to reset it. Yaey.

<comment><USER4> I don't trust Lenovo anymore. Far too many shenanigans like these from them. It wouldn't surprise me if they do it on purpose for the Chinese government. Also, the last Lenovo I bought, kind of fell apart in 2 years, so there's that, too.

<comment><USER5> Right, they've been caught several times now. How many didn't get publicized?

[http://thehackernews.com/2015/08/lenovo-rootkit- malware.html](http://thehackernews.com/2015/08/lenovo-rootkit-malware.html)

[https://www.us-cert.gov/ncas/alerts/TA15-051A](https://www.us- cert.gov/ncas/alerts/TA15-051A)

etc.

</comment></comment></comment><comment><USER6> Say you had an afflicted machine on the public internet, but completely firewalled in terms of IP, is this exploitable? I'm still not clear on how it happens.

Edit: Sorry read a bit deeper. Presumably this has to be enabled in the bios, but O/S level firewall won't help. Ack.

<comment><USER7> Firewalled at which stage? OS-level firewalling will do nothing, but if your border is rejecting packets for port 16992 then only people on your local network will be able to attack you.

<comment><USER6> Thanks. Didn't realize there's another big thread, will have a read.

<comment><USER8> Was curious, it's this one: [https://news.ycombinator.com/item?id=14237266](https://news.ycombinator.com/item?id=14237266)

<comment><USER6> Sorry for not linking it, was in a rush.

<comment><USER8> Not at all a problem.

</comment></comment></comment></comment></comment></comment><comment><USER9> Is it true these packets are HTTP requests full of XML, i.e., SOAP? Do they use HTTPS on ports 16994 and 16995?

To avoid a crash, users can mount potentially malicious filesystems in userspace, i.e. users can run kernel drivers like ffs outside of the kernel. This feature comes from a non-Linux kernel. I have read this may be able to work on Linux too but I have never tried it.

<comment><USER10> Here is a script which speaks the AMT lingo: [https://github.com/wentasah/amtterm/blob/master/amttool](https://github.com/wentasah/amtterm/blob/master/amttool)

It's clearly using SOAP, and looks like you can choose between HTTPS or HTTP.

</comment></comment><comment><USER11> > which probably means it's possible to use a malformed filesystem to get > arbitrary code execution in the kernel.

I'll concede that there are some older vulns allowing that, but if you meant for a reasonably up-to-date Linux or Win7+ system: reference needed.

<comment><USER7> [https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2016-4913](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2016-4913), for instance?

<comment><USER11> Thanks - didn't hear about that one.

<comment><USER7> Filesystems are basically parsers that were only originally tested against well-formed input. Upstream Linux developers will happily tell you that you shouldn't allow untrusted users to mount filesystems (or trusted users to mount untrusted filesystems…), but unfortunately that's not really an option in the real world.

<comment><USER11> Well, for the past 4+ years "arbitrary kernel code execution through mounting a malformed FS" has been considered a major security issue, and a lot of effort does go into finding and fixing stuff like that through fuzzing, code audits, static analysis, etc (for both Linux and Windows). I think it is fair to say that this class of vulns is declining in frequency, with the rate of discovery having peaked somewhere within 2008-2012.

<comment><USER7> Eh. Bugs get fixed as they're found, but I don't see much evidence of it being taken into consideration when adding new code (in Linux, at least - <USER2> wouldn't surprise me if Windows were better in this respect)

<comment><USER12> If the attacker just provides a file system that contains setuid shells or unsecured device files, that's not really a bug and not remotely exploitable. But it's still a vulnerability.

<comment><USER13> Hopefully filesystems mounted by normal users will have nosuid,nodev enforced (whoever is responsible for this these days, policykit??). Please tell me I'm correct...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> If I have AMT enabled on systems that never leave my network and no ports are forwarded through my firewall this should not be a problem. It could be a problem if someone found a bug in my router and got through the router but I'd be more concerned about iot devices than AMT on a couple desktops.</comment>


An Embedded Implementation of Redis  - <AUTHOR> https://github.com/symisc/vedis

<comment><USER2> This thing needs to get on Kickstarter pronto! I'd back. Can't not love clothing that comes with source code.</comment>


Ask HN: What are the best email marketing tools out there? - <AUTHOR> <comment><USER2> You are asking a very broad question without really indicating what your requirenments are.

I use Mailchimp for my project [https://dndemail.com](https://dndemail.com). It has been a great way to launch my solo project. MC has been great primarily because it is:

1\. Flexible 2\. cheap 3\. easy to implement API

I use the api to push the email address of new sign-ups into Mailchimp.

In Mailchimp I have an automated DRIP campaigns that start emailing the users with regular emails about how to use my app and take advantage of all the features.

I can update the user's marketing channel in Mailchimp depending on their actions in my app. For example, if someone cancels their subscription, I trigger a Mailchimp email asking for feedback.

</comment><comment><USER3> I've used MailChimp a lot and it's good Campaign Monitor is awesome from a templating standpoint. Sendy is by far the cheapest and is self hosted (I haven't used this so can't say whether it's any good or not)

</comment><comment><USER4> MailerLite. Found it much easier to build an email welcome series automation sequence compared to Mailchimp. And it is free for 1,000 active subscribers.

</comment><comment><USER5> Drip. Mailchimp is overrated.

<comment><USER3> Drip seems really focused on marketing automation for ecommerce rather than general email marketing with its built in ECRM</comment></comment>