Toward a Technological Cage for the Masses - <AUTHOR> https://cheapskatesguide.org/articles/techno-cage.html <comment> Funes- I want to stop for a second and appreciate how much I like websites like the one on the OP: no javascript; no ads; non-commercial, honest content; light, straightforward design. All in all, just a no-strings-attached personal site. That's what the Web should be all about.

I miss the late 90s' and early 00s' world wide web. Any search would direct you to a bunch of personal sites just like this one; now, you'd be lucky to find something similar among the typical pile of irrelevant commercial sites bordering on being straight scams that any search engine throws at you.

<comment><USER2> Can't agree more.

</comment></comment><comment><USER3> > After all, who needs anything but four cold, bare walls, a toilet, and a bed > to sleep on. You will be happy here, where "we" will decide what you need > and what you don't. "We" will feed, clothe, and house you. "We" will provide > you with everything "we" feel that you need

It's kind of a bad joke, this idea that these encroachments on the freedom on the internet are going hand-in-hand with 'free stuff from the government' because in most cases in the anglosphere it seems like, with the notable exception of furlough schemes brought in for the pandemic, we're generally seeing the opposite trend: social protections being torn up and we're told to be happy about this.

Our avenues for complaining about it are slowly being captured primarily by large, ultimately unsympathetic corporations who would rather we as individuals be as insecure as possible so as to be maximally dependent on them and their peers for a wage.

</comment><comment><USER4> The approach suggested in the article is to use market forces, i.e. boycott products which move us closer to unwanted futures. This is challenging when the majority of products are headed in one direction, driven by market demand that companies can influence by advertising.

Another approach is to use regulatory power in democratic societies, e.g. to enact legislation for right to repair ([https://www.ifixit.com/Right-to- Repair/Intro](https://www.ifixit.com/Right-to-Repair/Intro)), or specific DMCA exemptions for owners to modify device firmware ([https://sfconservancy.org/blog/2020/sep/16/dmca- exemptions-2...](https://sfconservancy.org/blog/2020/sep/16/dmca- exemptions-2020/)). These are necessary but insufficient steps to restore choice in functionality _and_ freedom, which are sometimes placed in false opposition via vague threat models.

In practice, what has worked has been competition from smaller vendors. In a world of more complexity, we need more than GPD Pockets and kickstarters to lead the way with pioneering examples that can be copied by bigger companies. Without the creative force of a Steve Jobs, Apple depends on the broader market to experiment. Several iPad Pro features can be credited to MS Surface, including concessions (still poorly implemented) on a local file system. If we end up with a few monopolies, will innovation slow without competitors teaching consumers about alternatives?

There needs to be a commercial arena where engineers in smaller companies have economic incentives to develop prototypes that increase freedom without compromising security, which "appliances" can then copy. FPGAs and RISC-V have some promise for open hardware, but progress is slowed by closed software toolchains. There are no quick fixes, but pockets of general-purpose hardware success can be encouraged by legislation, engineering talent voting with their feet, and yes, commercial support by customers.

<comment><USER5> _In practice, what has worked has been competition from smaller vendors._

I feel like I have to mention here System76 and the work they are doing on firmware and the development of an attractive Linux environment.

[https://system76.com/](https://system76.com/)

I am not affiliated in any way.

<comment><USER6> Also Pine64!

</comment></comment></comment><comment><USER7> I'll be the contrarian: Has the author ever heard of Linux?

I'm being glib, and share many of the author's frustrations with the state of things, but really the trends covered in the article have been happening for well over a decade. In that time Raspberry pi's have hit the market and the microcontroller market has never been better for hobbyists and professionals. Likewise with scientific computing frameworks like R and Python. The author even managed to get a personal website up for all of us to read. The options for personal computing are wide, wide open, even if some markets or products remain closed and proprietary and tough to hack.

Also,

> I suppose one can argue that if we all have nothing but dumb terminals > running software from a ROM (which cannot be written to), then no malware > can get onto our computers. But, do we want to go back to the dumb terminal > days of the 1980's? Is this the "modern" operating system that we want?

For certain stuff like online banking, yes.

<comment><USER8> If only the desktop (read: personal) computing experience on Linux wasn't so awful[0]. I realize that's a subjective statement, but come on, I've been hearing "Year of the Linux Desktop" rhetoric for 20 years now and it's still a platform[1] so utterly unorganized and chaotic that even a whole lot of people like me, who believe strongly in personal computing and value the ideas of openness, don't want to use it[2].

[0] I can, and have, gone on at length about why I think this and I won't repeat it here.

[1] One of the big problems of course being that Linux Desktop isn't a platform so much as a loose umbrella label describing a bunch of kludges.

[2] I've been using Linux Desktops for 2 decades and until recently I ran Linux on 4 out of 5 of the personal computing devices in my possession. I have written Linux software, contributed to FOSS projects, put together my own distro, and was even president of a LUG for a while. I have tried to give Linux Desktop a chance and it and its community have driven me away time and time again.

<comment><USER9> I suspect it's a function of your use cases. I've used Linux on the desktop since the late 90s, and I still use it every day. My employer makes me use MacOS for work, and it's a constant source of frustration for me, but Linux is consistently wonderful.

Vague criticism is useless though. My frustration with MacOS is mostly that stuff is either broken or unintuitive. I use Emacs, and after upgrading to Catalina, Emacs could no longer open files on my Downloads folder, even after manually assigning it permissions to read the entire disk. This turns out to be because Emacs has a Ruby script it gets launched through that has distinct permissions from the executable itself, so I have to hand-tune the launch scripts to make reading from disk work correctly.

There's lots of stuff like this. Mouse avoidance mode on Emacs is broken when it is set to 'banish, completely breaking the ability to drag the Emacs window around the desktop. Took me a few weeks to track down.

I want to tile a window to the side, so I have to click and hold on the full screen button, then select a side, at which point MacOS goes into some weird full screen mode and forces me to select some other window for the other sid, which I didn't want. I just wanted to tile a window on one side. If this feature were launched in Linux, I fear the derision would never end. Pop!_OS did it better.

For some reason, MacOS can't remember that I type Dvorak. After I log in, it remembers, but on the log in screen, I have to manually select Dvorak every time so I can type my password. If I've already selected my account, there's no reason it can't do that for me. Linux does, except Elementary OS, which is broken in dozens of other ways as well.

If I touch the play/pause button on my headphones by accident, my entire desktop gets buried beneath iTunes (I guess Apple Music now). I had to remove execute permission to avoid this, but updates seem to revert the behavior from time to time.

And this is just me trying to run Slack, Emacs and a browser. I'm not even doing anything fancy. So when I hear that Linux isn't ready for the desktop, it just doesn't resonate with me. I've used it for decades as my daily driver, and I plan to continue.

<comment><USER8> Good for you, but the statistics on desktop OS usage are pretty clear that you're in the minority.

<comment><USER10> Statistics on desktop OS usage reflect OEM preloading, marketing, and momentum of familiarity, not anything inherent to the operating systems or environments.

Anecdotally with friends and family, Fedora has been "normie"-friendly since 2007 or so, with the only notable exceptions being one gamer and one Excel power user.

<comment><USER8> > Statistics on desktop OS usage reflect OEM preloading, marketing, and > momentum of familiarity, not anything inherent to the operating systems or > environments.

Yeah, Linux Desktop evangelists have been saying that forever and yet, as I mentioned, even a lot of people like me who both are capable of and have reasons to desire a different OS find Linux Desktop too broken to deal with.

The community chooses the narrative that protects their ego.

> Anecdotally with friends and family, Fedora has been "normie"-friendly since > 2007 or so

Anecdotally I know a lot of people who do some kind of work with their computers and are programmers and general nerds who hate Linux Desktops because they are so broken.

</comment></comment></comment></comment></comment></comment><comment><USER11> The problem is that people want cages. They want cages, especially, for their foes (real or perceived): every time you hear someone say, 'there ought to be a law' what he is really saying is, 'I want armed men to use the threat of deadly violence to herd people who do what I don't like or don't do what I like into cages.'

Less obviously, many (perhaps most) people want cages for _themselves_. They don't trust themselves to make adult decisions, or simply don't want to be responsible for their choices. There is security to three hots & a cot, just as there is security to the iOS App Store. What's missing is not security but liberty.

And folks don't just want cages for their foes and themselves; they want not to be confronted with it. Just note the downvotes any post about the lack of freedom on iOS will get.

<comment><USER12> You are articulating _the_ insight that has been intuitively grasped by leaders, revolutionaries, and despots alike, throughout history.

If you look at it from a systems point of view, the mass of humanity provides the 'inert balast' that allows for continuity and long-term activities. The system design bug here is that, the acquiescence of the masses is obtained via pschological phenomena common to the human being. The implication of that is that there is a _system level disconect_ between "how am I actually doing" vs "how do I think I am doing". The system of collective human management operates at the partially fictional level of "perception" vs factual "reality". It is this psychological content, formed via psychological manipulations (such as religion, ideology, propaganda), that informs the 'views' and 'decisions' of the masses.

We don't have a systemic approach to providing decentralized "information as utility" services for our societies. There are no technical issues. ("Business model" is not a technical problem.) A centralized approach allows for maintenance of power for existing entities (individuals, families, organizations, corporations). The forces behind centralization are _powerful_ and _entrenched_ , and the opposing vision is held by relatively marginal entities. Obviously entrenched power will fight tooth and nail to maintain power. What "people want" is neither here nor there; they'll use whatever toy they are given, because that is what "people" have been doing since day 1.

</comment></comment><comment><USER13> This article is kind of comical, but I get his point. Even though I think it's not really taking into account the whole picture. Consider as a fact that the internet is broken, in regards to free speech. How many bot/fake accounts are created that spam toxic messages and influence culture? People with the most followers or likes getting to the top of the algorithms list so they exploit the algorithm. Most of the people are abusing the idea of "free speech" as anonymous trolls or maybe not even human at all or from the same country. It's a serious problem. I don't think people would say half the things they do on the internet if it were connected to their identity. Something isn't right here...

<comment><USER14> The irony is that it is the weak who actually benefit most from anonymity.

</comment></comment><comment><USER15> What I find really concerning is that all of this is man-made.

So we have management who wants to maximize profits. I don't really blame them, it's a lot of money involved and a shark tank environment. (I mean I do blame them, but I can see their reasoning). But then we have engineers who just do as they told in making all this possible, having the craziest ideas, like:

> The Asus EEE PC 900 that I bought had a 4 GB SSD held in place by a screw > that was soldered in place. This prevented the SSD from being upgraded.

In the end humanity is its biggest adversary

<comment><USER16> > But then we have engineers who just do as they told in making all this > possible, having the craziest ideas, like:

These engineers are paid A LOT of money.

<comment><USER17> The person who designed the hard drive lock didn't get rich off it. Some VP did.

<comment><USER16> That person makes a living, though.

Life isn't just about "getting rich" and being wolf of wall street. Engineers aren't billionaires or VPs but they're making a real good living most places in the US.

<comment><USER15> That's true. But if you think about it: if you have the skillset to design a laptop, your possibilities for jobs are much grander than making laptop's less upgrade-able

</comment></comment></comment></comment></comment><comment><USER18> The main gripe here is, I think, that many people trade away privacy and flexibility without even understanding what they're doing.

Most people who read HN don't do that, even if they choose platforms that tilt towards those sorts of services and software.

For instance, I'm pretty firmly in the Apple ecosystem, but I _could_ migrate to something else pretty easily IF I wanted to (I don't). I'm not locked in here. My data is stored locally (though I use Dropbox to make it available across multiple devices and platforms). I use proprietary formats very very sparingly. I feel pretty comfortable the "cage door" can't close on me without me changing these choices pretty drastically.

I'm sure there are Android/Windows people here who do the same thing. Sure, Windows does some invasive things, but if you're careful, you can avoid most of it, and preserve your ability to switch to something else without much difficulty. No cage door there, either.

The trick is to avoid getting SO enmeshed with a vendor that you cannot easily leave. This is one reason why companies like AT&T want you to bundle cell service and home Internet and cable and telephone, because it makes it harder to "fire" them when they screw up.

This "trick" is pretty easy, again, for the sort of person who reads this site. It's a lot harder for your uncle Larry who just wants to read ESPN and balance his checkbook and cares not one whit about the privacy implications of Google docs or whatever.

<comment><USER19> Have you ever actually TRIED leaving Apple's ecosystem? Like doing regular backups _and restores_ of your data, you're confidence level should be equal to your ability to actually follow through.

<comment><USER18> I feel like this isn't really a question you're asking so much as an attempt to suggest that it isn't easy or possible.

It _totally_ is, and I _know_ it is, because I maintain a parallel working environment on a Dell XPS 15 for a bunch of complicated reasons. All my data is there, too.

I hate that environment, so I don't work there _often_ , but I could if I had to (such as a couple years ago, when my battery failed in my previous Macbook and had to go in for repair -- it was trivial to do my job from the (previous) Dell for a few days).

This is possible because I do the things I outlined above. I use exclusively x-platform tools, like Office, when I use something with an obscure file format. My notes and management tools are exclusively in Orgmode in emacs. Etc.

Also: *your, not you're.

<comment><USER19> My point is, that unless youv'e actually done the sw'itch then you dont know you ca'n do i't. Sounds like yo'uve done it, so congrat's.

</comment></comment></comment></comment><comment><USER20> This is somewhat why I collect computers, because one day, you can't buy a general purpose machine anymore.. I just hope when that happens, mine will be top of the line and solid enough to last.

Though, is this not tinfoil hat territory? Won't the fact that _some_ people _want_ general purpose computer, mean that they will always exist? Even if the established manufacturers decide to stop production, won't someone else start a production ?

</comment><comment><USER21> There are users at all levels; some are really fine with the spreadsheet in Google Drive, and really it leaves them with time to take a stroll in the park and talk to friends and relatives. Some users want to put together their own computers and their own operating systems, and they will do too. No point in complaining for what the "masses" don't want to do.

<comment><USER22> > Some users want to put together their own computers and their own operating > systems, and they will do too.

We'll see how feasible/affordable that is in 10 years. I'm afraid that consumer hardware is only going to get more and more locked down in the name of "security".

</comment></comment><comment><USER23> Things got back and forth between open and closed - freedom and convenience. There is no end state.

Once upon a time everyone thought IBM was invincible and then Intel and then Microsoft. Then what happened?

To understand the cycle read - The Master Switch: The Rise and Fall of Information Empires by Tim Wu (of Net Neutrality fame).

</comment><comment><USER14> This is the future that RMS has been fighting against this whole time. I think he's always been a bit of a Cassandra.

[https://www.gnu.org/philosophy/right-to- read.en.html](https://www.gnu.org/philosophy/right-to-read.en.html)

</comment><comment><USER24> >they wanted consumers to hate netbooks, so that they would go back to paying for higher-priced laptops.

Manufacturer induced non-flagship fatigue is real. We're never getting a reasonable forever laptop, it must always be lacking in obvious areas that costs very little to correct. You only get that if you over pay for everything at the top of the line -- where dissatisfaction is not allowed.

Best we can do is buy direct from upstart companies with at most one or two thunderclap flagship offerings every tech cycle. Amazon scale advantage only entrenches the endless consumer bait and suffering by trusted brands.

</comment><comment><USER25> I'm not too concerned

Sent from my iPhone

</comment><comment><USER26> Unfortunately, I think this author is far more correct than not. Also unfortunately, we can't just create computer companies that do better; there are too many perverse incentives.

<comment><USER27> I don't think author is correct. One more piece from someone who cannot imagine people being interesting in other things than computers. I don't see car enthusiasts lamenting (maybe they do, I just don't see them) that Joe Average has no idea how to tune a carburetor or change the brake fluid.

Once again some talk about the imagined war on "general purpose computing". You know who is interested in general purpose computing? People doing it. For others computer is just a tool helpful to write an email, retouch some photos, or compose some music. Do we see public WiFi where we have zero access to configuration, as the "war on general purpose networking"? Or do we not care as long as it works (snooping aside).

<comment><USER26> The phrase "snooping aside" invalidates your whole argument. It's not like using a car will harm Joe Average on average, but because of the snooping carried on by general-purpose computers, using a computer _does_ hurt Joe Average on average.

<comment><USER27> If you think it invalidates my whole argument, then you did not understand my argument at all.

It is extremely sad that HN folks have zero empathy.

<comment><USER26> I think you didn't understand me. I do understand that Joe Average wants to use general-purpose computing to accomplish things. My point is that Joe Average does not understand the hidden costs of using computers that are spying on him, costs that might make him want to find some other way of accomplishing his tasks.

</comment></comment></comment></comment></comment><comment><USER28> The problem of the technological cage posed by reliance on cloud services is one of the reasons Urbit is being developed. It's a _personal_ server that operates on a P2P network. You own your own data, and your messages are encrypted. It feels like a cloud service, except you own it completely.

The project has been in the works for over a decade. It works, has an active community, and is making rapid strides in functionality and stability. I'd know, because I use it every day. Here's a good primer on what Urbit is looking to create: [https://urbit.org/blog/urbit-is-for- communities/](https://urbit.org/blog/urbit-is-for-communities/)

Many seem to like to whine about Urbit and claim that it's creating a kind of digital feudalism. Perhaps they think that what we currently have isn't that. I have no interest in engaging with those old and tired arguments, which is why I originally ignored them and looked into it myself. If you also like to think for yourself, let me know and I'll bring you onto the network.

<comment><USER29> Urbit looks like some strange combination of rent seeking, land grab, and absurdist comedy. I keep waiting for the whole thing to come out as having been a joke.

<comment><USER30> What do you mean? Why do you think it's "rent seeking, land grab, and absurdist comedy"?

<comment><USER26> Urbit's system creates an elite: the galaxy owners. They will, of course, use their positions to seek rent and grab "land" (control over territory, where territory is just planets and the like).

<comment><USER31> Somebody's got to own the resources, because they come from the physical world. That will be either power users who know enough about ownership, community groups, or commercial groups. Unless you have a fully distributed system with no centralised nodes, that's what you get.

<comment><USER29> Urbit doesn't seem to tie the ownership to physical scarcity of computing resources, though. They just invented some "land" to seek rents from, or sell to those who would seek rents. I'm all for spending money to bring physical computing resources to the system, including reselling access to those resources to others for profit, but the whole "stars / planets" false scarcity model ruins Urbit for me.

</comment></comment></comment></comment></comment></comment><comment><USER32> Check out civboot.org

Even if there's not some kind of secret agenda, the increasing complexity will make it so most people can't use a computer anyway in the horizon. I want to do something about it.

</comment><comment><USER33> I want to add a personal anecdote to this very interesting article.

Basically as soon as I fully understood that all my voice communications were stored by the NSA, by my ISP (and can be accessed by my countries government without me knowing), and by various other institutions and secret services, I decided to record all my phone calls.

The rationale being that I could not prevent most of the world to listen to me, but at least in the event they would use what I said against me, I had a piece of the evidence and would be able to defend myself.

On a more practical level, everytime I call a big company they have a prerecorded message telling me that the conversation "could" be recorded (they definitely record all of them). And those company (ISPs, insurances, government...) will very often promise thing on the telephone and then not follow through as they know that it is very hard for most people to precisely recall the content of the phone call, even less to prove it.

So, it did put me in a weird spot legally as my country's laws specify that the consent must be explicitly requested to the receiver of the call to be allowed to record. The thing is that it is not illegal to record phone calls without an agreement. But such a recording cannot be shared or released and would not be receivable as an evidence in a court of law.

I was perfectly happy with this situation, as already being able to precisely recall what was said during a call would alleviate a lot of concerns.

Android recently removed (in v.10) the possibility to record phone calls (except to a few of their close friends apps, FB, MS...)

They unilaterally decided to interpret my countries laws as an interdiction to record phone calls. On top of that, they made no official announcements about that, not even a trace in a changelog here or there.

The worst in all that is that obviously, most people didn't understand that it was Google's decisions. So now if you go to a call recorder's app page you will see a mass of people claiming that the app is a scam [https://play.google.com/store/apps/details?id=com.appstar.ca...](https://play.google.com/store/apps/details?id=com.appstar.callrecorderpro&hl=en) . They even managed to totally shift the blame on their partners.

Now, the only option I'm left with if I want to be able to record calls again, seems to be to root my phone. Which obviously from a privacy focused perspective seems unacceptable (giving root access to all userland applications!)

So precisely as the article describe, I lost what I consider is a very important feature, I have no say or recourse in that and the issue is not big / mainstream enough to gather any attention.

<comment><USER22> Rooting your phone does not give root access to all of your apps. Is this why people keep acting like rooting is a security risk?

I'm very tired of this message. Google has root to your phone and you don't. You think that puts you in a _better_ position? (Not "you", the person I'm replying to- the rhetorical "you")

<comment><USER33> It's true that I might not fully grasp what happens if I root my phone and it's part of the problem.

It seems that the process of rooting my phone already requires me to download an APK's (KingoRoot?) from sketchy websites. And then what this APK's does is not clear either... Reading a bit, it seems that that this software could be considered as malware...

So the process is not really transparent and is kind of scary.

Maybe if you have a different perspective or some resources pointing to open source alternatives?

<comment><USER22> To be fair, the process _is_ scary.

Depending on your phone, rooting often involves exploiting security flaws because the manufacturers don't want you to have root (reason #1 that makes me _want_ it all the more).

I have an old Pixel 2, which allows you to unlock the bootloader, so I didn't have to break into my own device, which is nice.

I don't know anything about KingoRoot. I use Magisk ([https://magisk.me/](https://magisk.me/)) which is FLOSS.

When you have root on your phone, an app has to _ask_ for root access. You may deny, grant temporarily (15 minute default IIRC), or grant forever. Very few app should require root. But it's important to me to be able to run whatever I want on my own computer.</comment></comment></comment></comment>


Ask HN: How do you keep notes of things you learn - <AUTHOR> I think keeping notes is really useful especially in a career like software engineering. How do you manage your notes or knowledge base that you build everyday <comment><USER2> My goals for my personal knowledge base are that it's comprehensive (i.e., it has a lot of stuff) and it's accessible.

To achieve this, I need a way to support these two different phases of notes:

* The first phase is "get-it-down."

* The second phase is "refine."

The "get-it-down" phase needs to be fast. It's important for me that I don't need to think about where to write. The "refine" phase is where you can delete, organize, edit, and build off of what you've written. It should also be fast.

I always had to use two tools to satisfy these needs. I needed one place where I could write fast/loose, and one place that's more organized and structured. This resulted in me writing to the "organized" knowledge base less. So I was less likely to get the most out of the things I was learning.

That's why I built bytebase.io.

With Bytebase, you jot things down into a temporary space called "No Man's Land." Then you organize your notes using keyboard shortcuts. If you want to check out our closed beta, email me at firstname.lastname@example.com. Would love any feedback.

<comment><AUTHOR> Really like your product Do you have to be a paid user to get access

<comment><USER2> Great to hear! Currently Bytebase is free to use.

When we move out of Beta, we'll have both free and paid tiers.

<comment><AUTHOR> Just sent request acsess

</comment></comment></comment></comment><comment><USER3> There is one category of Knowledge Base tools where you're putting stuff in yourself: Emacs org-mode, Notion, Evernote, Roam etc. There's definitely benefit in that. You could even take notes in the form on Anki cards.

The other category, which is quite under-served in my biased[1] opinion, is the Knowledge Base that grows automatically and is maintained for you.

You learn by spend time on various different articles, some of them you upvote on Hacker News. You do a number of such things all day everyday. Wouldn't it be great if a tool compiled all that information automatically, "your history" if you will, and made it easily available to you? That's [https://histre.com/](https://histre.com/)

[1] biased because I'm solving this problem by building Histre.

<comment><USER4> I love this, and have had the same idea. Said another way, the goal is to convert your wasted "data exhaust" into potential energy in the form of automatically organized knowledge.

<comment><USER3> Thanks! Exactly! You create so much signal just by doing things online and all that is being thrown away. Histre works towards putting that to good use for yourself.

</comment></comment></comment><comment><USER5> At the risk of pumping my own project, and recognizing that this is an untested methodology, I've just recently created this project to do exactly that:

[https://github.com/senorprogrammer/til](https://github.com/senorprogrammer/til)

I spend most of my day in the command line, so having a fast, simple way to capture things is the goal.

<comment><AUTHOR> Wow i really like this project Its simple and easy to use especially for some one who's an avid commandline user

<comment><USER5> If you give it a try and have any feedback, please do let me know via GitHub.

<comment><AUTHOR> Sure definitely Do you think if we can search to it that would be great

</comment></comment></comment></comment><comment><USER6> Being a developer ;) I built an application for exactly that purpose: [https://contextualise.dev/](https://contextualise.dev/). Saying that, check out apps like Roam Research and TiddlyWiki. For more examples of apps to manage your knowledge check out this resource: [https://github.com/brettkromkamp/knowledge-graph- radar](https://github.com/brettkromkamp/knowledge-graph-radar)

<comment><AUTHOR> I really like your app

<comment><USER6> Thanks. If you have any questions, just let me know.

</comment></comment></comment><comment><USER7> I used to have an elaborate system, but I converged on a simple solution: I stash everything in a single Google Docs document.

I made the conscious decision to optimize for ease of use, so that the friction/effort to write something down is minimized.

At the same time, I also made a decision to _not to adopt_ any organization system -- anything that increases the friction of use is eschewed. Search was all I needed. I've been using this system for the past 5 years or so, and it's been very productive.

To extract ideas from it, I routinely re-read stuff (it's in log format, so it's very easy to read) and use the _Fieldstone approach_ (Weinberg) to coalesce similar and interesting thoughts and rewrite into larger thoughts. I've gotten a lot of actionable ideas this way (that I actually go on to execute on).

So it's a system optimized for postprocessing rather than pre-processing. I find that pre-processing systems are unsustainable over the long term unless you're exceptionally disciplined. I try to build systems that don't rely on sustained human discipline.

</comment><comment><USER8> I have a markdown file that I don't actually view in markdown, but rather in my editor so that the syntax colors can break things up be it sections (e.g. the bash section v the git section). Further I'll write the command, and then write an explanation in the comment which is a different color.

I can do a ctrl + f for " __git__ " and get to my git section straight away.

 __git__

\- git checkout $deleting_commit^ -- $deleted_file <!-- undelete $deleted_file, ^ will grab the previous commit before the $deleting_commit-->

\- git checkout develop .circleci/scripts/feature_branch_deploy.sh <!-- pull in the develop version of feature_branch_deploy.sh -->

\- git clean -f <!-- revert all local changes on branch -->

\- git reset HEAD~ <!-- undo most recent local commit -->

<comment><AUTHOR> What text editor do you use to do that. I have explored vimwiki to keep track of things i learn and it has been helpful but sometimes it gets harder to maintain sometimes (thats just a personal opinion)

<comment><USER8> Yeah I hear you. I usually just keep a combination of things that I use often and some of the more fringe commands that are useful and might take awhile to find again.

I use VS Code with the atom one dark theme, but I have an atom onedark plugin installed on vim that gives me the same colors / functionality.

This is the only thing in my .vimrc ``` syntax on colorscheme onedark ```

</comment></comment></comment><comment><USER9> Will you go back to your notes and refer to them after you learnt something? Personally, I use taking notes as a method of learning and not as something I will come back to refer again. I find it is easier to just google for what I am looking for rather than go back to my notes.

But, I do get good ideas to explore further when I am learning something new. Once I finish learning, such ideas don't come back to me again. So, I use Mindmap to record such ideas and references to the material, I was learning from, when the idea came. These ideas become the basis for the projects that I pursue to further solidify the learnt material or a side project or a hobby project etc.

<comment><AUTHOR> I think its really useful to have track of things you come across when doing a project and learning something new. Yes you can google search but if you have already written it somewhere its just easier to go back to and further more you can even share it with other people and they might discover something new too.

<comment><USER9> You are confusing "come across when doing a project" aka documenting project or information specific to a project (ex: config, strategy etc) with "learning something new" (ex: neural networks, linear algebra). They are two different activities and requires different strategies. One requires proper documentation not scribbled notes, the other requires learning and notes as a method of learning and not a tool of reference.

</comment></comment></comment><comment><USER10> If you're willing to invest the time in it, org-mode will reap you dividends and a note taking system that will last you for life. org-roam, especially, is really great.

<comment><AUTHOR> I have been thinking about it lately to learn emacs and especially for orgmode

</comment></comment><comment><USER11> [https://www.giuspen.com/cherrytree/](https://www.giuspen.com/cherrytree/)

Hierarchical structure of notes, which are either plain text or rich text. Supports unicode. Can store notes "one file per node" or "the entire structure in one file". Works on Windows and Linux. Is free and open source. There are no magic characters, so you can copy-paste code without further editing. (This is the part that I dislike about most alternatives; the need to add backslashes before dozens of characters whenever you make notes containing code.) Supports encryption.

How to organize the nodes? I'd say, adaptively... start with one huge file for everything, and optionally separate the parts that grow too large. Or by access rights, e.g. "this needs to be encrypted" or "this I also want to use at work, but this is private". Refactoring is simple.

Right now I have two files I use at home: "Everything" and "Private" (password-protected). One file called "Computer science", which is shared between my private and company computer. And one file I only use on the company computer, containing company-related stuff, including the projects I work on. (For example, "how to do X in project Y" would go to the company file, but general "how to do X in language Z" would go to the shared file.)

</comment><comment><USER12> This is a very important topic for me, to be able to take notes and check them everywhere I am.

I built a portfolio / blog with Jekyll + github pages and write notes with markdown. Free was important at the start as I didn't know if I was going to keep using it.

I'd show but funnily enough I'm moving the hosting right now from Github Pages to Google Firebase so the page is down.

</comment><comment><USER13> If I actually learn something and use it I remember it. If I come across something possibly useful I copy it to Google Keep.

<comment><AUTHOR> Do you think are there any open source alternatives for google keep

<comment><USER13> I don't know. I use Keep because it's simple and syncs across all devices. And it's free, but not open source.

</comment></comment></comment><comment><USER14> I have to be honest, I just take notes on paper. It is not optimal for finding stuff across old notebooks though.

If I had today's technology back when I started, I would probably digitally record it with something like an Apple pencil etc. If it was all OCR'ed I would print it with an index in book form.

</comment><comment><USER15> I keep my project notes and useful miscellania in OneNote in separate subtrees so stuff that's inert-but-useful doesn't get mixed with the stuff that's more directly related to action.

</comment><comment><USER16> I use [https://colab.research.google.com/](https://colab.research.google.com/) for long form notes like setup instructions, code snippets Anything small, I use google keep

</comment><comment><USER17> I keep everything from notes (markdown) to config files etc in a private self- hosted repo (gitea) accessable from anywhere. Don't trust any online provider for personal notes

</comment><comment><USER18> I've recently started using Roam Research and have basically fallen in love with it.

[https://roamresearch.com/](https://roamresearch.com/)

<comment><AUTHOR> Looks cool seems like you have to request access to it

</comment></comment><comment><USER19> Markdown files using Nextcloud - I can edit and the files on my phone/browser. When it comes to note taking, I want something fast and everywhere.

</comment><comment><USER20> one big plain text file stickied in Notepad++'s Post-It mode. hashtags and timestamps so I can search through previous notes.

</comment><comment><USER21> ripgrep + fzf in vim are a big win, in a nv-alt-like workflow and always a keyboard shortcut away

</comment><comment><USER22> found this react native open source Joplin but unsure of privacy using webview [https://joplinapp.org/](https://joplinapp.org/)

<comment><AUTHOR> This sounds promising I wish they offered an api to update the notes

</comment></comment><comment><USER23> Notion.</comment>


Custom UI Controls for iOS and Mac OS X - <AUTHOR> http://www.cocoacontrols.com/

<comment><USER2> I'm the creator of the site. I'm not sure why this is showing up on here right now, but I'm certainly not complaining!

Please let me know if you have any questions, I'll check back on the thread throughout the day.

<comment><USER3> You're doing good stuff, although sometimes we have trouble keeping up with the demands from developers; any thoughts on adding "monetization" links? (Guess we could do this in our GitHub readme too...)

By the way, how are you determining license type? What exactly are you scraping on GitHub to determine this? [http://www.cocoacontrols.com/platforms/ios/controls/openspri...](http://www.cocoacontrols.com/platforms/ios/controls/openspringboard)

<comment><USER2> Thanks!

Can you be more specific about monetization links? What form would you like to see this take? We do offer the ability to commercially license your controls via our site (e.g. you could dual-license your control and offer commercial support for a fee).

License type: totally 100% manual right now. When the repo is first added to Cocoa Controls, a field is filled out for specifying which licenses the control is made available under. This information may get out of date as time passes (I've seen many instances where a developer changes from GPL -> MIT or Apache 2.0, e.g.).

I actually asked GitHub to make license a first class piece of repository metadata a few weeks ago, but no clue when or if this will ever be added.

<comment><USER3> > Can you be more specific about monetization links?

I don't mean to confuse this with a license type... we get about a 30 referrals a week from your site (nice traffic for a control!) and just wondering if we can direct them somehow to try the app which actually uses the control. Does Apple have an app store affiliate program? Maybe you can leverage that somehow?

> When the repo is first added to Cocoa Controls, a field is filled out for > specifying which licenses the control is made available under

Can this be updated, manually?

<comment><USER2> Ah, I see what you're saying. Let me think about that a little more, and see if we can figure something out. I'm looking at letting control authors edit their controls without ever having to go through me (I'm planning on setting up an audit log to prevent spam), and I think that—as part of this—I might allow sanitized HTML in the description field for a control. So, that way you'd be able to point people to your website.

> Can this be updated, manually?

By me, yes. By you, not yet. Shoot me an email (it's in my profile), and let me know what you want changed.

</comment></comment></comment></comment></comment><comment><USER4> Fantastic site! It'd be great if there was more metadata ahead of time to such as:

\- Memory management model (ARC, GC, or refcount)

\- Min/Max OS X version or SDK

\- If it is sandboxable

It'd also be fun to see a list of projects which use the controls.

<comment><USER2> Great suggestions, thanks!

</comment></comment><comment><USER5> Great resource, but we've always found the issue with these to be the level of polish expected on iOS.

On occasion you spend as much time customizing these controls to fit with your UX/UI as you do building it from scratch.

As an added benefit, building from scratch gives you a clean room implementation.

</comment><comment><USER6> This is great. I like the search-by-license, but there needs to be more categorization for browsing. Where I don't have a designer on staff for my projects, I will often find myself browsing for a component that can "fit in". Paging through 50 pages is too much, though.

<comment><USER2> Totally agree. I've been meaning to do this, but I haven't quite found the time yet. Good to know it would be helpful; I'll make sure it's properly prioritized.

<comment><USER6> No worries. Thanks for putting this out there!

</comment></comment></comment><comment><USER7> Back in the late 90's / early 00's custom components in Delphi were a big thing. I recall there were quite a few sites dedicated to listing all the latest and greatest components.

It's great to see something similar specifically dedicated to Cocoa/UIKit controls.

</comment><comment><AUTHOR> I submitted this but I'm pretty sure there are similar websites out there. If anyone knows one please comment here.

<comment><USER8> There's also the objective-c category over at Binpress - <http://www.binpress.com/browse/objective-c>

Disclaimer: I'm one of the founders

</comment></comment><comment><USER9> Good resource, and the upside is if they're licensed well and missing polish then the community gets better.

</comment><comment><USER10> At first glance, this looks like a great way to find those controls instead of making them myself.

Definitely going to use some of these on a current project :)

</comment><comment><USER11> Great resource. Thank you! Does anybody knows a similar resource for Android controls?

</comment><comment><USER12> Excellent idea. This beats my mile-long Github watch list.

</comment><comment><USER13> Awesome resource</comment>


Apple Rejects iOS App for Using MoltenVK - <AUTHOR> https://www.phoronix.com/scan.php?page=news_item&px=Apple-Rejects-iOS-MoltenVK <comment><USER2> _"Apple back in May allowed the game into the App Store while using MoltenVK, but […] is now being blocked […] Specifically, the game was rejected for "non- public API" usage."_

It may be blocked _"for using moltenVK"_ , but that doesn't follow from the information in the article.

I would guess Apple's rejection letters don't include the name of the function being called because they don't have a name outside of Apple. That makes it harder to find a call to non-public API, but I guess (again) it still shouldn't be too hard. The application would have to get the function's entry point/name from some place other than Apple's public headers, and that's relatively easy to spot from the code.

So, do MoltenVK or this application make such calls?</comment>


The Strange Politics of Gertrude Stein - <AUTHOR> https://www.neh.gov/humanities/2012/marchapril/feature/the-strange-politics-gertrude-stein <comment><USER2> The past needs to be judged in context.

Stein was the den mother of the Lost Generation, a group who had been brutalized by the last gasp of the European monarchies in WW1. As an avant garde movement, the Lost Generation embraced many new political philosophies.

WW2 had not yet been fought, you cannot judge the intellectual interests of the Lost Generation based on what was learned at the Nuremberg Trials

</comment><comment><USER3> I compiled a works list of the composer Virgil Thomson, who wrote two operas with texts by Stein. I don't think it is that hard to understand the politics of certain modernist artists given their impulses towards utopia, comparative naïveté in geopolitics, and, as mentioned in other comments, the prevailing structure of feeling at the time.

Yes, it would be strange to see a poet of Stein's stature today staking out the positions that she does, but artists such as Dalí were also doing similarly puzzling political declarations at the time. That's not an excuse for any of them, but history does not get written (merely) for us to stand in judgement of mistakes of the past.

</comment><comment><USER4> i never saw petain as such a bad guy. In ww1 he changed the French strategy to something that wasn't batshit crazy and saved many lives. In ww2 he stopped a fight the French could not win. Signed a deal. Did what he had to do. I don't think supporting him is that strange at all.

Petain did bad things too but basically anyone who was with the nazis had to. What matters is whose idea it was to slaughter Jews and other civilians and also who forced who to do what.

<comment><USER5> > Did what he had to do.

I enjoyed _Paris at War: 1939-1944_ , by David Drake, for its description of every-day living in Paris during the occupation. This paragraph[1] suggests an alternate view exists.

Meta observation: So much information is lost when collapsing the complexity of a person, government, subcultures, and historical movements, down to one- liners, and thence to a 'bad guy? or not?' judgment, that it's not clear to me the resulting signal is useful.

[1] p365, 2nd paragraph "Patain had a very different reception in the former Unoccupied Zone. [...]": [https://books.google.com/books?id=LCxUCwAAQBAJ&lpg=PP1&pg=PA...](https://books.google.com/books?id=LCxUCwAAQBAJ&lpg=PP1&pg=PA365#v=onepage&q&f=false)

</comment></comment><comment><USER6> At the time of writing, there are three humanities articles on the front-page and they are the only articles that have 0 comments: this, Spinoza's Ethics, and A Defence of Common Sense.

So why are people upvoting these entirely subjective articles (because I don't see how they belong here)?

<comment><USER7> I really despise this kind of extreme reductionist binary thinking. Not only is it wrong, it makes tech people look like the intellectually empty caricatures that the general public thinks we are.

<comment><USER6> Except there is nothing intellectual about it. It's an article about what somebody believes GS was doing/thinking during the World War II and a couple of anecdotes. If you already know the premises (GS was a Jewish writer who lived in Vichy France where she also worked as a propagandist) you end the article like you started, knowing nothing more.

Besides, all "modernists" have done is produce __trash__ and it will be remembered as such no matter how deeply the humanities try to paint it as intellectual and deep, it will never reach the level of Caravaggio, Velazques, Rubens, Cervantes and the like. Nope, it will be forgotten because it's neither beautiful nor good in any objective sense.

It's not that tech/STEM people are intellectually empty, many people in STEM simply don't buy the bullshit.</comment></comment></comment>


The Plan for Code - <AUTHOR> http://open.nasa.gov/blog/2012/01/04/the-plan-for-code/ <comment><USER2> Can anyone explain why software developed by a government agency would not be in the public domain, once open?

And given that NASA has chosen to use a specific open source license, why a custom license and not one that is familiar to the community?

<http://ti.arc.nasa.gov/opensource/nosa/>

<comment><USER3> Although under US copyright law all federal works are in the public domain, that does not prevent the government from having valid foreign copyrights in its works that are enforceable abroad.

Some more information is available at <http://www.cendi.gov/publications/04-8copyright.html#317>.

</comment></comment><comment><USER4> <https://github.com/nasa></comment>


The History of SQL Injection - <AUTHOR> http://motherboard.vice.com/read/the-history-of-sql-injection-the-hack-that-will-never-go-away <comment><USER2> I am sure there is a lot of code out their vulnerable to SQL Injection, namely ASP code. But I have never seen anyone write new code that way for years. I think it is written about so much mainly because it is easy to explain to non- techies.

<comment><USER3> From yesterday: [https://news.ycombinator.com/item?id=10619578](https://news.ycombinator.com/item?id=10619578)

<comment><USER4> I get a 404 from the page posted there, what was it?

<comment><USER5> This:

[https://archive.is/8z5yZ](https://archive.is/8z5yZ)

</comment></comment></comment></comment><comment><USER6> "Another is to "use SQL libraries that take care of input sanitization for them," Al-Bassam suggested. This, in short, scrubs any data entered by the user to remove any potential malicious parts of it."

This is bad advice. Some people have apostrophes in their name. Deal with it.

Shameless plug: [http://blog.hackensplat.com/2013/09/never-sanitize-your- inpu...](http://blog.hackensplat.com/2013/09/never-sanitize-your-inputs.html)

<comment><USER7> Pretty sure he would have meant sanitization as in escaping characters like quotes and not just deleting quotes.

<comment><USER8> Escaping won't help. Parameterized queries all the way.

<comment><USER7> Sure, I really meant always use some library that will do whatever is needed to pass potential unsafe characters over to SQL and that sanitization doesn't mean you have to delete these characters. Obviously relying on yourself to properly escape everything is going to fail.</comment></comment></comment></comment>


Ask HN: What I need to learn to become a tech entrepreneur? - <AUTHOR> I have self learnt various things, like coding in Python, creating and hosting websites, integrating payment systems, building tutorials. What else should I learn to become a tech entrepreneur? <comment><USER2> Probably the most important skill to make it the business: sales.</comment>


Letting nurse practitioners be independent increases access to health care - <AUTHOR> https://www.washingtonpost.com/opinions/heres-an-easy-way-to-increase-access-to-high-quality-affordable-health-care/2020/01/02/46c64768-29d8-11ea-b2ca-2e72667c1741_story.html <comment><USER2> How is this different than minute clinics and such at places like CVS? We definitely need more NPs. So much of basic health care doesn't seem very complicated.

</comment><comment><USER3> Anything we can do to water down the Doctor's guild is good. Their salaries are absurd and possible only because of regulatory capture.

</comment><comment><USER4> When I had a major health need about a decade ago, I went from MD to MD with no success for months. Eventually my family was desperate enough to pay out of pocket to see a NP with good recommendations. She listened, investigated options, and fixed me. Later on, for less serious needs, my experience with others was that NPs consistently delivered better care.

<comment><USER4> This is 100% an anecdote as worthy of skepticism as every other. But I'd encourage everyone not to let your own "common sense" color your interpretations of the evidence that shows that NPs give >/>= care.

</comment></comment><comment><USER5> > Lusine Poghosyan is a professor of nursing at Columbia University

No bias here!

<comment><USER6> Speaking from personal experience, it's impossible to find anyone who wouldn't be labeled as unbiased in this area.

There are too many turf wars, government sanctioned monopolies, and rent seekers for anything but that to be the case. There's biases in maintaining the status quo too.

I suppose you could have someone with a pure economics or public health background but in my experience they tend to avoid these topics, in part because they have no incentive to fundamentally change healthcare delivery structures.

Lack of real competition among providers is a real underecognized problem in discussions of healthcare in my opinion. Much could be deregulated in a very beneficial way, but discussions almost always focus on payment instead. When deregulation is raised as an issue, it's almost always done in a way that focuses on easing obstacles to large pharm corps, without addressing other forms of deregulation.

In every case that I'm aware of, increasing scope and practice of providers only has net public health benefits. The only losing group is physicians. It's has always been that way, all the way back to dental practice.</comment></comment>


Petition for President Obama to read 3 Felonies a Day - <AUTHOR> https://petitions.whitehouse.gov/petition/read-book-3-felonies-day-chronicle-prosecutorial-overreach-department-justice/gpHshPps I am petitioning President Obama to pick up the book "3 Felonies a Day". It is a chronicle of people who have been targeted by federal prosecutors for felonious crimes that they had no idea they were committing and who had zero reason to believe that they were committing a crime.
These people were shown no mercy in court despite their situation being more than understandable.
Prosecutorial overreach is a serious issue facing this country and if the Obama Administration is interested in true justice, the President will pick this book up and start making some changes.
Book Description:
http://www.harveysilverglate.com/Books/ThreeFeloniesaDay.aspx
Scenarios where you too could be the target of a felony court case:
http://www.threefeloniesaday.com/Youtoo/tabid/86/Default.aspx <comment><USER2> Obama has a law degree and has been a civil rights lawyer.

I find it hard to believe he is ignorant of how the system works, nor its abuses.</comment>


How to win Seedhack: church donation gaming, #holylight, blessings from above - <AUTHOR> http://2founders.com/2012/04/02/seedhack-winning-holylight-jesus/

<comment><USER2> Awesome job guys!

<comment><AUTHOR> Thanks man! If you haven't encouraged us on Friday I would have just gone home ;)

<comment><USER3> Thank laughter you didn't just go home!</comment></comment></comment>


Things I Learned After My Photo Hit #1 on Reddit - <AUTHOR> http://petapixel.com/2014/07/25/things-learned-photo-hit-1-spot-reddit-probably-shouldnt-posted/

<comment><USER2> There's a tension between promoting open-source and wanting to maintain copyright. Another relevant example: [https://news.ycombinator.com/item?id=7484106](https://news.ycombinator.com/item?id=7484106)</comment>


Searching for the Witches' Tower - <AUTHOR> https://www.archaeology.org/issues/358-1911/features/8075-england-pendle-witch-hunt <comment><USER2> Dear website, going to your page show me 2.7KBytes of story text, and with that downloads over 20MBytes of other stuff (mainly as large hi-res images scaled to thumbnails).

If you wish to abuse my bandwidth like that I must regrettably decline to continue.

yours sincerely etc. etc.</comment>


Thanks, Obama: NSA to stream raw intelligence into FBI, DEA and pals - <AUTHOR> http://www.theregister.co.uk/2017/01/12/obama_nsa_sigint_fbi_dea/ <comment><USER2> How does this jive with the Posse Comitatus Act? The NSA is a military operation, and the FBI is a domestic operation. Surely there is information that should be shared between them, but a firehose from one to the other, no matter how limited, seems to be a reasonably clear violation.

We now have clear evidence that 'for foreign investigation' is absolutely no boundary to domestic collection. Why would such a limitation be any different here than it was (not) for the NSA's collection?

[https://en.wikipedia.org/wiki/Posse_Comitatus_Act](https://en.wikipedia.org/wiki/Posse_Comitatus_Act)

<comment><USER3> IANAL. But I think it probably violates Posse Comitatus, and unreasonable search and seizure, and several other things. (The right to privacy means you can get an abortion, but you can't get actual privacy? Say what?)

But, in the place we have come to, nobody seems to actually care what the law (or even the Constitution) says.

But it's odd that Obama would do this on the way out the door. Why would he? It's not likely that he wanted to leave Trump all the tools to become a dictator. (I don't subscribe to that flavor of conspiracy theory, that both parties are in it to steal our freedom, despite the massive evidence in support.) It seems more likely that Obama felt this was genuinely necessary. Either he's right (which is very sobering), or he's mistaken. In the latter case, I could buy that the intelligence community genuinely believed that they needed it, and argued for it very persuasively.

But I still can't believe that they're right. Too many people died for freedom for us to give it away to avoid casualties. (If we're willing to make that trade, we won't keep much in the way of freedom, and we won't deserve to.)

<comment><USER4> Obama has spent 8 years not caring about the 4th Amendment.

</comment></comment></comment><comment><USER5> See also [https://news.ycombinator.com/item?id=13383833](https://news.ycombinator.com/item?id=13383833)</comment>


What algorithm should I use for trending detection? - <AUTHOR> What algorithm should I use for detecting trending items? (Whether that is toics, or articles)<p>I am tempted to just look for articles read which have a moving average period M which is high than their moving average period N. (Where M is smaller than N). <comment><USER2> I would suggest checking out "Programming Collective Intelligence" and review their chapter on decision trees. That way you would be able to build a 'model' of 'trends' based on "reads" per "time quotient" and use that for your classifier.

<comment><USER3> thanks. slaps head. goes to own library.</comment></comment>


Anatomy of a Rental Phishing Scam - <AUTHOR> https://jeffreyladish.com/anatomy-of-a-rental-phishing-scam/ <comment><USER3> From the screenshot, the scam is actually pretty easy to spot if you know what to look for. Here's some clues:

1\. All accomodations are available (w/d in unit, pets ok, wheelchair accessible, furnished!) - eliminating listings with all of these checked will nearly eliminate the scam listings.

2\. The description doesn't include any information about who's the renter. Usually the landlord or property manager will mention something about themselves.

3\. Professional photos. This in itself is not a giveaway, but given the above two clues, almost always indicates the photos were taken from another listing. A reverse image search can confirm.

4\. The deal is too good to be true. Know the market. $4.5k may not be enough to get you a furnished luxury 3BR single family home in the Bay Area.

I've had to browse through a lot of CL listings in the Bay Area and these are the nearly guaranteed ways I've found to eliminate the scam listings.

If that's not enough, I start my emails with requesting times of showings. If someone isn't willing to commit to meeting and showing me the place, I won't go any further.

<comment><USER4> > $4.5k will get you a 1 BR in the Bay Area

Average one-bedroom rent in San Francisco is $3,520, and two bedrooms is $4,550. It's much cheaper elsewhere in the Bay Area. In Oakland, average one- bedroom rent is $2,470, and two bedrooms is $3,050. $4,300 is very plausible in Oakland.

Source: [https://www.zumper.com/blog/2020/02/zumper-national-rent- rep...](https://www.zumper.com/blog/2020/02/zumper-national-rent-report- february-2020/)

<comment><USER5> That is really mind blowing to me. I just looked at the local rental website for my small town and the first 2 bedroom duplex I looked at had a nice yard and looked good on the inside and was only $900/month. That is in Canadian dollars too I may add. That $4550 would be about $6000 Canadian and you would have people begging you to move in if you agreed to pay them a portion of that.The highest rental I see on the site right now is about $1800Cad.

<comment><USER6> SF is just another world to me, whenever I read about salaries or rent, it might as well be on Mars. We just bought our first home(3 bed, double drive, large garden) in a large UK city and the mortgage is £580/month(~$750 for you Americans). And it's not like we're poorly paid either, we both drive brand new cars, go on holidays twice a year etc etc. And then you get SF residents being paid well into 6 figures and unable to have a decent standard of living. It's just crazy to me.

<comment><USER7> >And then you get SF residents being paid well into 6 figures and unable to have a decent standard of living. It's just crazy to me.

To be more accurate, it is only a subset of SF residents (in the IT space) that get that kind of pay, I often wonder how is the life of those that do not belong to that elite and that do not make that kind of 6 figures money.

<comment><USER8> They don't live in SF. It isn't unheard of to commute two hours for a retail job in SF just to get where you can afford the rent.

<comment><USER7> Well, there must be also a given number of "middle class" people, that are not top notch programmers, nor "entry level" or "retail".

If we take these as valid data:

[https://www.bls.gov/regions/west/news- release/occupationalem...](https://www.bls.gov/regions/west/news- release/occupationalemploymentandwages_sanfrancisco.htm)

And set an arbitrary threshold at 45 US$/hour, the amount of people exceeding that are 31.1%, if we set it at 50 US$/hour they are 19.4%.

If we draw another line, those that get less than 25 US$/hour are 42.1% and those that get more than 25 but less than 45 are 26.6%.

So, even if we assume that 40% of people commutes for long distances (and BTW technically are not SF residents), since only between 20% and 30% of San Francisco workers can actually afford it, it still leaves us with 30%-40% of people that must be in a really tight spot.

<comment><USER8> I'm not an expert in California, but if I understand prop 13 correctly it is possible some of those are people who have lived in SF for many years at the same address - their house is paid off and taxes are minimal so they can afford to live on much less. If your house only costs $400/month to live in ($100 insurance, $100 taxes, $200 other utilities) minimum wage still leaves plenty left over, and presumably if you bought a house 30 years ago you were worth more than minimum wage...

<comment><USER7> Maybe that would account for a part (I am also not at all an expert in California, so it is just speculation), but those cannot reasonably account for 40% of workers.

I mean, if you live in SF and have a yearly income of "only" 50-60,000 US$ working some 2000 hours at 25-30 $/hour, and you live in a house that you can rent for roughly the same amount or that you can sell for (say) a million, what actually keeps you there?

Maybe you can find somewhere else a similar job, paid in the 15-20 $/hour range, you lose 20,000 on the job but get an additional 40,000 from the rent or from interests on the capital.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The Craigslist ad is still up (or up again): [https://sfbay.craigslist.org/eby/apa/d/berkeley-two- story-3b...](https://sfbay.craigslist.org/eby/apa/d/berkeley-two- story-3br-2ba-updated-cozy/7068211716.html)

The house appears to exist as pictured at the claimed address on Google maps. Oddly, although Jeffrey's emails about the place were from a couple weeks ago, this current ad says "Posted a day ago". It also says "Call Laurence", although as before there is no phone number.

Personally, I'm still not completely sure this is exactly the scam that is being described. I'm wondering if there might be another layer here --- maybe someone who took over an existing Craigslist ad? It does seem very well crafted for a plain rental scam.

Edit: There is also a listing for the same house with same pictures on VRBO with 172 positive reviews: [https://www.vrbo.com/564881](https://www.vrbo.com/564881). Given all the reviews, I presume that one is the real one. Maybe the Craigslist ad is a just a straight copy of this?

Edit 2: Ooh, I wonder if the reason that the scammer is willing to meet people at the property from February 14th to 16th is that he has it reserved for those dates from VRBO. Might be interesting to cross-reference.

<comment><USER10> Many times they are a copy of a legitimate ad.

<comment><USER11> Copying photos and the body text of a legitimate ad would certainly be a lot less time and effort on the part of a scammer than writing new custom scam ads every time.

<comment><USER12> Oh boy, story time. I encountered the opposite scam.

I was selling a house myself. I took photos, paid to have it listed, posted a sign out front, and posted ads in various places including CL.

Someone contacted me to say they responded to an ad on CL for a rental house. The prospective renter was told by the scammer he was out of town and that they could go to the house and look around the property. He would transact the rental remotely and mail them the keys if they liked it. They were also told to ignore the For Sale sign out front! They did go see the house but saw the For Sale sign and called the number - me - at which point we figured out what was going on. They had also spoken to the guy on the phone, who sounded foreign.

I found the CL fake rental ad, it was all of my photos from my sale posting, simply copied onto the fake rental ad. I responded to the ad and almost instantly got a long response from a Hotmail address. It was clearly a prepared response and included some clumsy standard rental application forms. Anyone who fell for this would have lost their rent/deposit/security as well as all their private info.

Local police couldn't do anything about it but traced the phone to a VOIP, dead end. CL pulled the ad.

Be careful out there.

<comment><USER13> VoIP can be "backtracked".

Takes a bit of effort, but the DOJ got providers to do it for the fake IRS/SSA/INS calls.

There's a standardized process for it.

Might lead to a deader-end, but "it's VoIP so we can't do anything" is a cop- out.

<comment><USER14> More should be done to standardize VOIP tracking. It's a huge problem and this method is widely used for scams.

I don't know if caller id spoofing can be prevented though. I get on average 10 scam calls daily, some days more. My phone is on vibrate and am using this as a way to relax instead of geting upset. I stand up from my desk and take a walk around the office. It mostly doesn't bother me but sometimes when it catches me at the wrong time it does get to me and Id rather this stopped. Sure, my phone does give me the 'Scam likely' but I wouldn't pick up from phone numbers that are not in my address book anyway. And I if phone vibrates I check after I finish what I currently doing so it could always wait.

What bothers me is the ease with witch someone on the other side of the planet can do this. This thought only bothers me...

<comment><USER13> Neighbourhood spoofing is definitely a problem because I have on-call and it means it could be a known or unknown colleague (big org).

Then there's the time the scammers called every number sequentially (or simultaneously?) in a number block, jamming the incoming/outgoing lines because we have an exchange code block, but only a reasonable number of lines.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> The scammer almost immediately sending a bunch of photos of 'himself' is very interesting to me.

I've noticed the same technique on dating apps. 9/10 times if the person you're talking to is not real they'll send a 'casual' looking photo after 3-4 back and forth messages, completely unsolicited.

Like the author of this article it seems to be a misguided attempt to prove that they're real somehow and immediately gives away that they're not. When this happens on dating apps I like to give them my Google Voice number and play along for a bit to waste their time. They usually end up pretty angry and it makes me laugh.

<comment><USER16> _I 've noticed the same technique on dating apps. 9/10 times if the person you're talking to is not real they'll send a 'casual' looking photo after 3-4 back and forth messages, completely unsolicited._

I used to do the same when online dating -- despite many people's claim to the contrary, much of dating is physical (i.e. visual) attraction, so I sent additional pics (natural, not staged) early in the conversation just to find out if it was going to go anywhere... whether solicited or not.

But I was male -- if a super attractive woman sent me pics unsolicited, then I knew it was a scam. (my apologies if any real women were out there that look like super models, but were searching for your true love online if only someone would help you pay for a visa)

</comment></comment><comment><USER17> What I'm left wondering is: what is the payoff for these scams? These aren't easy to scale, as you need to be manually writing plausible looking, personalized emails, waiting for someone to take the bait, "nurture" them over days or weeks, etc. Also you need specific, valuable skills: between the social engineering, the actual engineering, the perfect grammar, the creativity, someone who can pull this off can definitely get a high-paying, honest job pretty much anywhere. Add to that the hassle of having to constantly change web hosts, stories, payment processors, etc. as you're constantly going to be chased by your previously scammed "customers", and the very real risk of prosecution. The payoff must be ENORMOUS for it to be worth all this trouble. What am I missing?

<comment><USER18> Large parts of this can be automated (scraping profiles, setting up ads based on that scraped info, templates for responses etc), CRM system to track interactions, for which you have 'white collar' staff. The rest you farm out to call center style operations, the 'blue collar' work, who can also do things like 'customer support' for ransomware victims etc. There are entire villages in e.g. Eastern Europe that are notorious for housing gangs like this. They're actual businesses, ran in a professional manner, with an HR department and tech support guys and accounting people etc. The key to financial success is keeping all your staff occupied in a efficient manner - balancing the 'lead generation' with the actual work involved, just like any other business.

Edit: Google "Râmnicu Vâlcea" if you're into this sort of stuff and have some time to go down an internet rabbit hole.

<comment><USER19> that's a lot of overhead and effort for a scam. It would be easier to just to have a normal job such as being a software developer.

<comment><USER20> > It would be easier to just to have a normal job such as being a software > developer.

Sure it is, but there's a whole world outside of the US, where jobs aren't as easy to find, nor as well paying as software developer job in the US.

</comment></comment></comment></comment><comment><USER21> A similar, though less sophisticated, scam has been around in France for over a decade. They put ads with professional photos on websites with rental offers (the price is good, almost too good to be true but you're desperate for a place to live and think that maybe, just maybe, you got very lucky), talk to you in polite and agreeable manner, offer a visit and then demand a downpayment before the actual visit occurs. The red flag was that they demanded a scan of ID before the meeting (the landlord cannot ask for it beforehand) and of course the downpayment request. I searched online after that and found out it's been around for a looong time. Be careful who you're paying!

</comment><comment><USER22> Same scam (and probably same scammer? - same backstory) posted on reddit a few months ago a few towns over:

[https://www.reddit.com/r/bayarea/comments/czfr3m/warning_cle...](https://www.reddit.com/r/bayarea/comments/czfr3m/warning_clever_fraudster_on_craigslist_home_rental/)

<comment><USER9> And deep within that thread are links to a couple other scams by the same person for an NYC apartment and a car for sale. What would need to change so that serial scammers like this are arrested rather than allowed to continue preying on people?

<comment><USER23> You could have some digital technology that allows a person to credibly prove that they own a particular property, that is resistant to hacking techniques.

Alternatively you could have a legal rule that requires the seller to turn up in person with ID, and police could search for scam listings and then go arrest the scammers, and fine lazy legitimate sellers who want to break the rule.

</comment></comment></comment><comment><USER11> The very first email from the "landlord" would tell me it was a scam. Maybe it's just because I've been doing things on the internet from before the web was a thing, but that's a pretty obvious scam.

The whole "I'm working away from my usual home city on oil/mining/gas projects in (HARD TO REACH LOCATION)" thing is at least 20 years old now for scams.

<comment><USER24> Maybe. Real estate is weird, full of odd personalities, third parties, bizarre business practices.

My first NYC apartment I left the broker feeling 90% sure I had been scammed. But all of the things that seemed weird to me were actually fairly normal and indeed I had the place. In big cities where rentals are big business, the unusual is pretty usual.

<comment><USER25> My first real job I got from a recruiter who reached out with an email of broken English and different fonts/colors. Turned out to be a huge legitimate company.

</comment></comment></comment><comment><USER26> So apt. I'm moving to the Monterey area in the coming months and looking at places to rent. I started with Craigslist and emailed some listings without thinking much of it. And fell for one person telling me they can't let me see the property but I have to send them an application with rent attached. I quickly realized what was happening. Then I moved on to Zillow and saw postings by rental agencies mixed in postings by unknowns. So I think those are scammy too(the unknowns). From Zillow I got some names of property management companies and now I look straight on their website.

It seems like people on Zillow copy rental agency postings for scamming. But they definitely copy Zillow postings on to craigslist.

This arrival seemed relevant to what I'm going through now. So I figured I'd pitch in with a bit of my story.

</comment><comment><USER27> I'm assuming there is a Stripe/other payment form behind the button, and not a login form for phishing. This seems like a lot of work for just phishing. It would seem amenable to actually taking payments because people are booking months in advance, giving you months of no complaints or chargebacks or fraud reports so the criminals can cash out.

<comment><USER13> Maybe it "fails" and then they ask for WU or something non-repudiable.

As you get more committed, the more of a length you'll go to get the place?

<comment><USER28> WU or just a bank transfer to a drop account. They definitely aren't after card info with a scheme requiring this much interaction.

<comment><USER29> It's enough to drain few thousands per sucker with scam this automated.

It will be pushed immediately to a temporary account and forwarded in non- repayable way to the scammer, leaving bank or credit card company to take the fall and a big headache to the user.

<comment><USER28> That doesn't happen. The whole idea is utterly ridiculous, if someone could cash out credit cards like that they'd just buy the cards for dollars a piece and not waste their time on a complicated scam like this.

> scam this automated

haha no

<comment><USER27> You are wrong because the nature of this setup specifically allows them to ensure no card owner will be able to find out that they've been conned for several months (by only accepting renters who want to move in in several months). If you just buy card info and charge them, some of those card owners will notice right away.

</comment></comment></comment></comment></comment></comment><comment><USER30> This scams are very common and fairly easy to detected even without contacting the person.

I have been looking at apartments since november and finally found a place in January, and this is the third apartment I have rented in SF over the last 5 years. I believe this one would have been caught by point 2.

Detecting a SF craigslist rental scam:

1\. Is it too good to be true? Its a scam. What's too good to be true you ask? Check other listings, especially on something like rentSFnow, or the many other property management company to get a baseline price range.

2\. Reverse image search the images and if it comes from a house listing on redfin or some other website to buy/sell houses, its a scam.

3\. Does it mention a management company? Check their website, if the apartment is not listed there, its a scam. If they don't have a website, its a scam. Does the building/apartment's google maps or yelp not link to the management company website? Its a scam.

4\. Are the pictures really good/professional looking? It MAY be a scam.

5\. Does the listing provide no/very little info about the apartment/roommates? Its a scam.

6\. Look for listings for the same apartment on alternate sites like apartments.com/hotpad/zillow/trulia. Don't find another listing for the same place? Its a scam, with a minor chance that the owner may not be technically adept, in which case look at the pictures, if they are good, its a scam.

7\. Are there multiple postings on the same day/close by with different titles but same content? Its a scam.

If it passes all of these, it may still be a scam, reach out and proceed with caution.

If after reaching out, they ask for deposit before seeing the place, its a scam. If they ask you to sign up on any website, it may be a scam. If the sign up requires credit card/bank account or sensitive personal info, its DEFINITELY A SCAM.

Ignore most things they tell you, the only thing you should care about is actually checking the place out and making sure it works for you in person.

Even if they let you see the place, IT MAY BE A SCAM. Proceed with caution and make sure the person actually own the place/has the right to rent the apartment.

<comment><USER31> > Even if they let you see the place, IT MAY BE A SCAM. Proceed with caution > and make sure the person actually own the place/has the right to rent the > apartment.

This part was mind-blowing. I would never considered that someone would show an apartment they don't actually own.

<comment><USER32> Real estate is a very fragile system with all sorts of crazy scams. Deed fraud is a thing — people buy houses and incompetent banks write loans on houses that aren't for sale.

There were a bunch of cases in Brooklyn a few years ago, some were related to corrupt officials in the Surrogate/Probate court and deceased persons property. Others were grifts affecting unoccupied properties. The system isn't really designed to stop these sorts of frauds.

<comment><USER33> Friend of mines neighbor lives in a rental with an absentee landlord. Someone stole the landlords identity, took out a homeowners loan on the place, then wired the money to a bank in South America. They found out because real estate vultures started knocking on their door.

</comment></comment></comment></comment><comment><USER34> In the reply, I'd probably include 1x1 pixel hidden tracker image or maybe a legit looking logo below signature and get the client ip of the scammer's computer when it does http GET on it. The ip can tell more about where they're located.

<comment><USER35> This is a great idea, but if he's gone through all this trouble already, then he's probably behind a proxy or VPN...

<comment><USER36> Reverse Captcha? Send an image, ask them to email you at the address in the image -- at that point their handlers will likely decide you're too much trouble and you'll be ghosted.

</comment></comment></comment><comment><USER25> At the place I moved into, they apparently had to constantly remove signs scammers had put in the yard.

<comment><USER37> What sort of signs?

<comment><USER38> "Up for sale/rental, call xxx" probably.

</comment></comment></comment><comment><USER39> It makes me deeply depressed that real estate is huge right now, many more people than ever are renting and we still have to deal with Craiglist scams to find a place to live. Ignoring the fact that the last ten years of UX seems to have passed Craiglist by, it's unbelievable that such a huge site has the absolute minimum of fraud prevention. There are so many comments on here about various kinds of CL scams, why does a trusted marketplace for rental housing not exist?

<comment><USER40> You'd think they have the world's biggest dataset of scam posts too, with people constantly labeling posts for them (including law enforcement).

<comment><USER41> The problem is that scam posts are frequently just copied legitimate posts. The only thing we found that worked was to force communication to go through a messaging proxy to run classifiers on those messages.

</comment></comment></comment><comment><USER42> Craigslist is the Wild West; use it at your own risk. A few years ago, I answered an enticing ad for a pretty nice apartment in a good school district near Boston. The price was about half what you would expect; that was the only tell.

They answered my inquiry right away and said something about being "away in Africa on mission work and need someone to sublet our place". I supposed this was somewhat plausible, but decided to test them.

Since they said they wanted someone quiet, I said, "We have a pet howler monkey. I hope that's okay."

They replied "That is fine." I then knew something was wrong, so I mentioned that he's not really house trained, and tends to throw things, and then they ghosted me.

Meanwhile, someone else might have fallen for the scam. I did report the ad, of course, but that takes a few hours or days and in the meantime, someone else might have been suckered. Craigslist could really benefit from some kind of comment/review system that would allow you to immediately call out these kinds of posts publicly. Of course it would also require a systematic way to take down revenge or mischief posts that unfairly attack legitimate sellers.

<comment><USER43> Have had this same scenario play out several times myself on CL. The other most common scammy post is a roommate.com one where when you get in touch with the poster, they have you go to a roommate.com link which basically requires you to sign up for a ~20$/mo membership. I get the need for such sites but I've seen this so often I consider it a scam and wonder if, like hired shills and trolls, people get hired to post such content just to drive membership.

</comment></comment><comment><USER44> There should be simple highlighter on the domain name in the browser so you can easily see:

airbnb.com.rooms-040349.town vs airbnb.com

Or some kind of script that can recognize likely b.s. for common domains. Now that I say it, it probably already exists.

<comment><USER45> That seems like a great idea!

Why _doesn 't_ the url bar highlight the domain? Given how security-critical it is compared to the rest of the URL, why is it not bold and obvious?

It seems so easy for browser vendors to implement...

<comment><USER46> I think you may be saying this sarcastically, but in response to the comment you replied to, at least my browser (Firefox) does do this. On this page, "ycombinator.com" is highlighted in white.

<comment><USER45> No sarcasm.

Chrome does not display any significant difference... or if it does, it's too subtle for my 20-40 vision.

Firefox is noticeable, now that you mention it. I never noticed before. A for effort, C- for execution?

Given the security implications, how about bold and blue? Maybe even a bigger font size? It should stand out, no?

<comment><USER47> Perhaps even a color chosen based on a hash of the domain name, so a visually similar domain name (e.g. goog1e.com) shows in a different color than the user is used to.

</comment></comment></comment></comment></comment><comment><USER48> Something like this happened to me as well in Germany. I reported to authorities and they said "well, since no damage was done, we can't do anything" THANKS, lol!

</comment><comment><USER49> Interesting! I encountered this same exact scammer recently and as soon as he sent the email with all the pictures I knew it was a scam. I was definitely fooled up to that point as well though...

<comment><USER50> Hello,

My apologies..I know this is a bit unrelated but I saw that you had a post for a full stack developer listed almost a couple months ago I wanted to find out if this opening is still available or if it has been filled? Thanks

</comment></comment><comment><USER51> This was awesome! I didn't know the <a href="[https://reverseimagesearch.app">reverse](https://reverseimagesearch.app">reverse) image search</a> was working so well (I never quite thought about this until I did this). I used it on a video game and the algorithm looks amazing!

</comment><comment><USER23> It's pretty amazing that modern browsers don't flag _.com._ as a scam.

Is there any legitimate use for addresses like this?

It's also amazing that email software doesn't highlight fake link texts. There should be a rule that if the text looks like a URL then the actual URL has to match it exactly.

<comment><USER52> I was under the impression that in quite a few countries they are quite widely used. E.g. .com.au in Australia.

<comment><USER23> OK but outside of a few legitimate exceptions?

Surely it's reasonable to flag .com.blahblahblah.thing.spamdomain as fishy?

.com.au/ or any other actual country top level domain is ok

</comment></comment></comment><comment><USER53> This is the one downside of Let's Encrypt. They made running https scam sites cheap and easy. I still think having https everywhere is worth the trade off, but the downside should be acknowledged.

I wish there were an EV certificate like alternative for sites where actual money is involved (banking, hotels, etc) which cost a decent amount of money, so that at least the cost of running these scams would go up. For example, airbnb paying $1000 for one of these certificates would be a rounding error to them, but it would stop a lot of scam sites.

EDIT:

Right now the issue is the phishing protection is reactive in that we try to flag bad sites after the fact. I wish there was someway to make it proactive so that good sites could be attested to.

<comment><USER54> That isn't a downside of L.E. though because HTTPS by itself was never meant to imply trust in the site, and any notions to that effect should rightly be dispelled. Sounds more like a benefit of LetsEncrypt if it brought more awareness to this.

And FWIW the EV cert that sites like AirBNB buy cost in the range of $500. The cost isn't what makes it prohibitive, though, but instead it's the corporate and personal identity that they (should) do as a part of the process.

<comment><USER24> > but instead it's the corporate and personal identity that they (should) do > as a part of the process.

And often that isn't nearly as intensive as you might think.

<comment><USER55> It doesn't even matter. Tax havens like the United States of America or the United Kingdom go out of their way to make it easy for foreigners to create "corporations" with no local footprint, no ties back to anything and no practical way to investigate.

If you have $1000 and don't live there you can set up a bona fide US Corporation today and get an EV cert issued for it, within 24 hours. So long as you pick a unique name in the place where you register (any of 50 different US states) they don't need and won't ask for any further information - <USER2> paperwork will show up as "American" even if you can't point at the US on a map and have never even visited in your whole life. Congratulations, you are entitled to an EV certificate for, let's say, Okland Best Property Rentals Inc. a US company that older browsers show a proper American flag for and looks 100% legit but in fact proves nothing except that you filled out a web form and had a few hundred dollars.

If somebody tries to "send in the cops" to "Okland Best Property Rentals" expecting it's some crook who actually lives in California they'll be fighting a multi-billion dollar state-sponsored entity whose purpose is to help (non- US) crooks hide money, the agencies will stall and eventually, after a long and expensive fight, give up a PO box address in Abuja, Nigeria or something. There the trail ends. Bye.</comment></comment></comment></comment>