Depixeling Pixel Art - <AUTHOR> http://research.microsoft.com/en-us/um/people/kopf/pixelart/index.html

<comment><USER2> This was discussed earlier on <http://news.ycombinator.com/item?id=2578706>

<comment><AUTHOR> sorry, site:news.ycombinator.com search didn't turn up any results - very hard to check for dups.

<comment><USER3> Actually this thread was still very useful to me despite the dupe because virtually all the links in the original thread are dead.</comment></comment></comment>


(Android) Developer Income Report #11 - <AUTHOR> http://www.kreci.net/uncategorized/developer-income-report-11/

<comment><USER2> Has anyone offered to set up an American LLC and "hire" you as a subcontractor to allow you to sell android products under an American company and pay you the earnings minus a small fee?

<comment><USER3> There is no reason why he couldn't do it himself.

</comment></comment><comment><USER4> So I see you're from Poland, but Poland is not on Google's approved countries list for Google Checkout merchant accounts, according to this list: [http://www.google.com/support/androidmarket/developer/bin/an...](http://www.google.com/support/androidmarket/developer/bin/answer.py?hl=en&answer=150324)

How do you get paid? I see you're using ads in your apps, what network are you using?

<comment><AUTHOR> I have been writing about it many times. I can not sell apps and all my income is from ads in free applications.

<comment><USER4> My question was: what ad network(s) are you using?

I searched your blog, but couldn't anything related to that (maybe my GoogleFu is not good enough).

</comment></comment></comment><comment><USER5> Great to see your income is growing. Keep it up. Are you working on new Android apps, or still the old ones? I don't know your apps but I think you said your apps are pretty simple ones. Are you considering building a more ambitious app that might need many months of work before being launched?

<comment><AUTHOR> I am working on new apps. Not VERY ambitious but more complicated than current ones...

</comment></comment><comment><USER6> Chris, love that you are keeping up with sharing these numbers with us even as things grow and get more "serious".

Glad to see you have an eBook out and that income, month over month, is up. Best of luck!

</comment><comment><AUTHOR> New income report. As usual comments are welcome and strongly desired!

<comment><USER7> Care to do an after-tax-and-expenses analysis? In one of your previous income reports I've discussed that with a few people, but it'd be nice to see some actual numbers, since you don't seem to be coy about it at all.

<comment><AUTHOR> I have very low expenses (as I am just sitting at the computer). Tax is 19% from income - expenses. Moreover I need to pay about $150 of health and other obligatory insurances.

</comment></comment></comment><comment><USER8> Which ad platform are you using for your apps?</comment>


N26 e-bank promises free account creation and id verification over internet - <AUTHOR> https://support.n26.com/read/000001250?locale=en <comment><AUTHOR> And the fees are cheap [https://n26.com/pricing- international/](https://n26.com/pricing-international/)

Anyone tried them yet?</comment>


The Spectacle That Is Elon Musk Coming Undone - <AUTHOR> https://thewire.in/tech/the-spectacle-that-is-elon-musk-coming-undone <comment><USER2> I do struggle the reconcile this apparent lack of self awareness with the undeniable savvyness that he has shown in his life so far.

Is there a method to this madness? I'd like to believe that there is, and he hasn't just allowed fame and adulation to get to him.</comment>


Convincing a programmer to work for a startup for 0 salary and 0 equity? - <AUTHOR> https://www.quora.com/How-likely-is-it-that-I-will-be-able-to-convince-a-really-good-programmer-to-work-for-my-startup-for-0-salary-and-0-equity?share=1 <comment><USER2> If there's no salary or equity being offered, the company wouldn't be able to sign a binding contract with the programmer, since they'd be offering them nothing in return for their work (no "consideration"[1]). Thus, there would be no "work for hire" agreement, and the programmer, not the startup, would own all the intellectual property they created.

Also, if it's a for-profit business, paying zero salary for useful work would be violating federal and state minimum wage laws (in the U.S.).

[1] [https://en.wikipedia.org/wiki/Consideration](https://en.wikipedia.org/wiki/Consideration)

</comment><comment><USER3> This question is less absurd than it sounds. You just need to find someone who is both talented and lucky enough to have already made all the money they will ever need to live on, and whose biggest challenge in life is that of finding something meaningful to do with their time. You get them to work for free by offering something they can't just buy: work they are personally interested in doing which is aligned with their sense of meaning. The pitch is that you will do the work they don't want to do, you will put together the support team and infrastructure they need, and in exchange for their time and experience you will be giving them an opportunity for autonomy and accomplishment which is greater than what they could reach on their own.

The secret many people haven't realized is that this situation effectively holds for talented programmers even when you _are_ offering a salary: offering a salary broadens the pool of talented programmers who can afford to accept your offer, which is important, but it also clouds the issue by mixing in an extrinsic motivation for doing the work, which is not correlated with skill.</comment>


YogaGlo Update - <AUTHOR> http://www.yogaglo.com/blog/2013/12/yogaglo-update/ <comment><USER3> A few thoughts:

1\. Junk patents abound in today's digital world, where "method" and "computer" have been endlessly linked to suggest that something is innovative when it is not. YogaGlo's patent is a bit different but in the same spirit of method madness.

2\. For much of this, we can thank the loosening standards imposed over the past two decades by a specialized patent appeals court that has given overblown significance to what once was a highly specialized field of tremendous importance to the competitors immediately involved but not to average people. Result: average people see the flood of junk limiting, irritating, and frustrating their lives and are mad as can be at the skewed results.

3\. In a parallel world known as that of the law, it is business as usual, with the junk patents having become monetizing weapons in the hands of aggressors and with the industry generally profiting at every angle from the "growth business" that patent litigation has become. Most of the actors see the insanity but also see nothing at all that is poised to dislodge it because the many tentacles that combine to choke off common sense are so diffused and dispersed, with each having its own reason for failing to act: congressional leaders beholden to lobbying interests, market-leading device-makers seeking to keep competitive advantage by any means possible, those who seek to challenge them having of necessity to spend billions to buy their own arsenal by which to protect themselves, federal circuit judges who have a built-in incentive to magnify the importance of patents and of their role in shaping the "inventions" of the future, a federal system of checks and balances in which a Supreme Court must defer to constitutional restraints on its power to reform the mess it sees before it, a patent office that is overwhelmed with junk applications and simultaneously pressured to move them along in the system without being too finicky about which ones pass or not, and a startup community that is basically schizophrenic on the point in philosophically condemning the system while, in the case of any given venture, embracing it insofar as it gives to the venture a potential sustainable competitive advantage.

4\. Seen in this context, the YogaGlo defense is actually as good a _technical_ defense of a junk patent as one might make: it pleads that people try to understand that, as a business matter, the company needs to stake out its turf and block others from intruding on it through the same sort of legal means that all other ventures use and, thus, what should be so wrong in its doing what the whole world is doing anyway; it argues that the thing really is as narrow as one might imagine given that all sorts of non-patentable ways do and always have existed for filming yoga classes; and it claims that the company is really just reasonable and restrained and hardly intending to create the sort of dust-up that followed in the wake of people's shocked realization that they (or people they like) might get sued for doing what used to be a routine filming of an instructional video. Imagine if you were given the awful task of trying to defend this thing. How would you have done it better? From the company's standpoint, this is the baser half of the startup world's schizophrenic attitude toward patents: we may oppose the hell out of it philosophically but, when it comes to pragmatic advantage, stand aside and let us do what we must do to meet our business goals.

5\. Of course, in the end, this is really just one more junk patent and so the company's defense comes off as inadequate and even insincere. Yes, others may have made some unfair statements that distorted the facts but the company's problem is that such statements, though perhaps unfair in a narrow sense, perfectly capture the sense that most people have that this grotesque thing should not be allowed to stand and that no tears of sympathy need be wasted on those who brought it into existence, _whatever_ their motives.

<comment><USER4> > 2\. For much of this, we can thank the loosening standards imposed over the > past two decades by a specialized patent appeals court that has given > overblown...

No, this is just a common misconception. If you look at the history of rulings from east Texas, you will see they invalidate a higher percentage of patents than other courts in the US. East Texas just implemented rules on length of filings and length of arguments to cut out most of the crap out of patent cases, making the process cheaper and faster for both sides.

So, if you have an iffy patent, and you want to have the best odds of winning, don't file in east Texas. But expect to pay a lot more.

I guess the east Texas model is bad for lawyers who file thousands of pages of "supporting material", and then get paid $200/hr to read it. But how much of this supporting material was actually relevant? Not much, which is why the judge in east Texas was able to enforce page limits.

The east Texas model is the right way to rule on patent cases. But the patent system needs to be supported by better laws.

<comment><USER5> Sorry, but I don't think you're right. The data shows that in east Texas, patent holders win injunctions or damages nearly 2x of the time. That's why they go to trial there.

Since you didn't provide data to back up your assertion, I will provide a link to mine: [http://www.washingtonpost.com/blogs/the- switch/wp/2013/09/19...](http://www.washingtonpost.com/blogs/the- switch/wp/2013/09/19/why-do-patent-trolls-love-east-texas-and-delaware-they- win-more-there/)

<comment><USER6> The author of that article, James Bessen has been called out on questionable methods or analysis in some of his studies. For instance, he's the guy who created the "trolls cost 29 billion" meme out of thin air, the debunking of which [1, 2] never got much press.

Here's a study that directly refutes the claims article from another researcher with a lot more data:

[http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1597919](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1597919)

It finds that Eastern District of Texas is not even in the top 5 when it comes to plaintiff win rates.

1\. [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2117421](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2117421)

2\. [http://blog.patentology.com.au/2012/06/29-billion-us- troll-t...](http://blog.patentology.com.au/2012/06/29-billion-us-troll-tax-or- just-another.html)

</comment></comment></comment></comment><comment><USER7> > _Below are a few visual examples of what our patent protects. Note, there > are many other ways companies and teachers can create yoga classes that do > not look anything like YogaGlo's classes:_

I discounted every single word they said after seeing the pictures! I cannot believe any sane person, much less a patent official, can believe that those ought to be patentable.

What came to mind was a Sanskrit proverb many Indians would be aware of: "Vinaash Kale, Vipreet Buddhi", which roughly translates to, "When the hour of destruction is near, the brain abandons all logic."

I hope (against hope) the end of the patent system as we know it is nigh :)

<comment><USER8> I can't wait for movie directors and cinematographers to patent their styles.

<comment><USER9> Tim Burton better patent the ability to use Johnny Depp and Helena Bonham Carter in a movie together.

<comment><USER10> I'll bet J.J. Abrams already has a patent drafted for lens flares.

</comment></comment></comment></comment><comment><USER11> I go to any conference which is being filmed and what does the setup look like?

\-- Aisle down the center, speaker at the front ("a line of sight corridor between the rear area of a class and the instructor in the front of the class")

\-- Camera at the rear in the middle of the aisle, providing clearest, centered view of the speaker ("an image capturing device located in the rear area with an unobstructed view of the instructor, to provide a participatory view through the line of sight corridor")

\-- Everyone seated facing the speaker (duh) ("students in a class, facing the instructor, distributed across the classroom between the instructor position and the image capturing device wherein the students do not block the corridor.")

So they just took a standard filming technique and added 'yoga' to it.

</comment><comment><USER12> Does prior art mean anything with the US First to File system?

Is anyone looking through old DVD or VHS videos of Yoga lessons, or through Youtube (or similar) video sites?

This strikes me as another reason why DMCA is bad. Backing up an old VHS tape might require breaking the macrovision copy protection. Yet it's important to keep this old stuff around because it might be useful in cases like this.

<comment><USER13> "Does prior art mean anything with the US First to File system?"

Yes, first to file is about what happens when two people invent the same thing within the same year, not about "first guy to ever file something gets a patent".

</comment></comment><comment><USER14> They said they never sued another company related to this patent, but they forgot to mention they have sent Cease and Desist(s) [1]

[1] [http://yogainternational.com/article/view/patents-and- lawsui...](http://yogainternational.com/article/view/patents-and-lawsuits-the- future-of-yoga)

<comment><USER15> That is the point of the patent, isn't it? They have the patent so that no one else can use the same filming style. They don't intend to sue anyone, but if someone is filming in ways that are too similar to theirs, they will try to get them to stop. That can range from polite emails to cease-and-desists.

<comment><USER16> So basically, they don't intend to sue anyone over the patent unless they can? How exactly would you sue people who stop the infringing behavior upon request?

</comment></comment></comment><comment><USER17> Fuck 'em.

Also... frankly, this is awesome. We need increased lunacy outside of the software industry for people to understand how broken patents are. This story is getting enough traction that "Patent Reform" is likely to be an idea that will resonate with substantially more people.

</comment><comment><USER18> They claim their patent is very specific, then list points that amount to 'a camera on the back of the room, with a view of the instructor, and students around the room who aren't blocking the camera'. The supposedly non-infringing examples are silly, too - a bunch of videos with people standing in the way of the instructor. Can they realistically assert that not having students stand in the way, blocking view of the instructor, in an instructional/exercise video is novel, non-trivial, non-obvious and not done before?

</comment><comment><USER19> After reading a few sentences, it all started sounding the same to me. I still came away from this with the perception that they patented a camera angle. This will not win back any points for them.

</comment><comment><USER20> Since this is relevant to the tech community let me paint a picture before people start sharpening the pitchforks...

I've been meeting with investors recently and one of the most common questions/comments has been - "Why can't someone else just do the same thing? Can a group of Stanford grads build this in a weekend?" This line of questioning is relevant to pretty much all startups today.

The reality is, from what I can tell, to build YogaGlo, you could build this in a month with a fairly decent tech team and a little bit of hustle. Now imagine you're the CEO of YogaGlo today and an investor asks you these questions. Easy answer - "they can't, we have a patent". Think of this in another light. What happens if the company goes bust and there are no physical assets to liquidate? A patent (or IP) is an asset that can be sold. (think Nortel[1])

We've significantly lowered the barrier to pretty much every industry in the world. The production cost of one of these yoga classes can't be more than $100 per video and yet can reach a million in a click of a button. Since it's so "easy", we come full circle back to how important ownership, rights, IP and patents are. Otherwise your business is simply another replaceable middle man.

However here is where I believe YogaGlo has just screwed up in playing this game. Because it's so easy to reproduce their IP, companies like YogaGlo should be focusing on mindshare, and less about patentability and competition. Create such good relationships with yoga instructors and the people watching the videos that they wouldn't dare go to the competition. This sentence stuck out more than anything: _" Several companies offered to buy us, invest, license our technology, or hire YogaGlo to film their classes. When we declined, a few grew unhappy with us."_ You declined?! Are you out of your mind? Why not become the de facto company for licensing your technology, filming other Yoga classes, etc? That's how you build mindshare - <USER2> mindshare is IMHO the "new IP".

[1]-[http://en.wikipedia.org/wiki/Nortel](http://en.wikipedia.org/wiki/Nortel)

<comment><USER21> Your business being easily copyable is not a 'wrong' that should be righted by the legal system. That's a really, really nutty notion.

<comment><USER6> If a business is easily copyable and no-one will finance it for that reason, that business may never come to exist, which is clearly a net loss to society. Of course, this does not apply to yoga videos, but a lot of startups that venture into unproven technologies or markets are very risky investments.

<comment><USER16> >business may never come to exist, which is clearly a net loss to society

That is not at all clear.

<comment><USER6> Having new businesses is not a net loss to society? Sure, a vast majority of them will be worthless, but without experimentation how else will valuable new markets be discovered?

</comment></comment></comment></comment></comment><comment><USER22> I basically read "this is an incredibly strict patent. We didn't blatantly patent filming from the back of the class. Our patent only applies when the camera can see the teacher."

I've followed online yoga sites for years and this is by far the most common and obvious way of filming a class.

</comment><comment><USER23> The really upsetting thing is that the patent seems to center around a certain photographic composition. They've just added "oh and we stream it too". Couldn't this be extended to also cover non-yoga courses with the same composition technique?

</comment><comment><USER24> "Setting the record straight" has only emboldened my opinion that this patent is pure baloney and YogaGlo is a disgrace to the yoga community AS WELL AS the business community. I hope this patent goes down in flames and YogaGlo is put out of business in the process

</comment><comment><USER25> There should be a huge amount of prior art for this? Surely before yoga glo there must be ONE video with the same angle?

<comment><USER26> less than 20 seconds of youtube searching.

[http://www.youtube.com/watch?v=vOt35-GQ_8w](http://www.youtube.com/watch?v=vOt35-GQ_8w)

<comment><USER6> That looks pretty close (although I can't tell if the camera is at a height of 3 feet), but it was uploaded in 2011. This patent has a priority date of 27 Aug 2010, so to invalidate this patent, any videos like this from before that date would be needed.

<comment><USER27> The patent says "about 3 feet" instead of 3 feet, and while that's vague enough to be stupid they've helpfully provided images of their classes that represent a camera at that height in the post. Skimming that video it looks to be a very close match.

I'd be interested to know whether arguments used defending against prior art are legally binding afterward. For example if they said "nope, the camera looks to be 1m, not 3ft", would they be unable to consider something at 1m infringement forever?

<comment><USER6> _> I'd be interested to know whether arguments used defending against prior art are legally binding afterward. For example if they said "nope, the camera looks to be 1m, not 3ft", would they be unable to consider something at 1m infringement forever?_

Yes, it's called estoppel [1] which, amongst other things, basically means, "whatever you say can and will be used against you". This includes whatever comments and arguments they made during prosecution of the patent.

[http://en.wikipedia.org/wiki/Estoppel](http://en.wikipedia.org/wiki/Estoppel)

</comment></comment></comment></comment></comment><comment><USER28> They are definitely soliciting people to respond on that statement page, I'm sure of it. That, or they're making accounts to validate themselves against the people who ARE real.

Or people really just don't care, which is entirely possible, but I won't let my faith sink that low just yet. If you'd patent a camera angle then you'd probably have no problem creating accounts to bolster your ego.

<comment><USER29> They're moderating the negative responses.

</comment></comment><comment><USER30> I am glad the USPTO granted this patent. It shows how ridiculously idiotic the patent system is in America at the moment.

</comment><comment><USER31> Ha, and here I thought they were going to apologize and release the patent as the nonsense it is. Nope! Even better, a self-righteous screed about how there is nothing to worry about... _for most of you_.

</comment><comment><USER32> As an American and a Yogi I have to say America has to be the only country where "entrepreneurial" teachers of Yoga feel the right to patent Yoga.

Exactly when Yoga started is a matter of debate but most will grant it a couple of thousand years at least and most much farther back.

As an example is [Forrest Yoga]([http://www.forrestyoga.com/](http://www.forrestyoga.com/)) where prior art is technically in illustratiosn and text in ancient books. (There are diligent engineers in India working to scan every single page of these books as so people can claim it as prior art.

In Forrest yoga though they have made slight different in some of the poses to justify it.

More importantly its the morality of feeling like as a teacher with maybe 40 years or less experience that you have mastered Yoga enough to own it.

So, now in the US there is a lot of money in Yoga, and Americans at every level are trying to create patents to protect their "business" Be it in Yoga itself, in the teaching of Yoga, in the franchises, and apparently the filming of Yoga.

I feel we need a rule that will punish an organization or person filing or a patent that is objectively illegitimate. I suppose the punishment would have to be based on a percentage of the gross earnings of the company.

<comment><USER33> While the usage of the word "Yoga" to describe _spiritual_ practices is certainly quite old (the Yoga Sutras were apparently compiled a bit before Jesus), Hatha Yoga is only a few centuries old, and the gymnastic practice that is common today (asanas) is pretty modern (~150 years).

Doesn't make patents any less ridiculous, of course.

<comment><USER34> Jesus wasn't compiled, he's dynamically interpreted. :-)

</comment></comment></comment><comment><USER35> Let's be clear: there is nothing inventive about having a camera pointing down an aisle. If that's patent worthy, then so is wiping my ass with my left hand.

</comment><comment><USER36> I feel like it would be easy to make money with workout videos if you can get Netflix to stream it. Currently there's no streaming Netflix workout videos. Yeah, none. On my Roku box I have a few options for yoga and workout channels including YogaGlo channel. However I don't see how $18/mo just for streaming yoga videos is an option when I only pay $8/mo for Netflix streaming videos.

</comment><comment><USER37> Well here's the founder [http://www.yogaglo.com/who_are_we.php](http://www.yogaglo.com/who_are_we.php)

</comment><comment><USER38> I enjoy their helpful suggestions of "other" ways to film your yoga classes... at awkward angles, or outside!

</comment><comment><USER39> Here's a lovely bit of nasty hypocrisy:

"Yoga International could keep the videos on its website until it had a chance to re-film the classes using a different style."

So they say they're not using the patent as a weapon, but then describe themselves harassing another organization with it. Their patience is generous only if we can assume it's no trouble at all to re-film those classes (ugh).

And doesn't the existence of videos they "felt were very close to ours" imply a bit of prior art and/or lack of originality on the so-called patented style? Or perhaps are they are insinuating that Yoga International willfully "stole" or "reverse engineered" their style before the patent was issued?

</comment><comment><USER40> You can't patent or copyright a film technique, this thing would never stand up in a court. Unless they had discovered a new kind of camera that was the only way to take the shot, it is not an invention.

</comment><comment><USER41> Translation: "We exercised common sense in taking a video and have patented this." Prior art, I would have hoped, amounts to framing and take a video of anything and capturing essential attributes to deliver a valuable online experience. I'm a subscriber to yogoglo, and I'm ashamed. Any alternatives without scummy patent tactics you can recommend?

</comment><comment><USER42> As if yuppies didn't make yoga horrible enough already...what else can we appropriate from Eastern religion and patent for profit?

<comment><USER43> desktop zen rock gardens. I was looking for an authentic full size zen rake, and I couldn't find one, at all, since the search only yielded those kitchy things you find on some people's desks.

</comment></comment><comment><USER44> "UPDATE: We _really are_ douches."

</comment><comment><USER45> Dear Yogaglo, Go $!#@ yourself.

Namaste...

</comment><comment><USER46> Stupid patents!

Lets vote to get rid of the patent system.

</comment><comment><USER47> Where's the invention?

</comment><comment><USER48> I wonder if they're moderating for comments on their blog - or adding fake ones; I think those kinds of behaviour are in line with patenting and trying to control an environment.

</comment><comment><USER49> Is this from The Onion?

</comment><comment><USER50> I was thinking this was a Joke , but guys you are making fun of yourselves ;(

</comment><comment><USER51> Well I just canceled my subscription. Let's vote with our wallets.

</comment><comment><USER52> What is this crap about patenting yoga classes?

</comment><comment> no-brainer Hidiotic, if i do say so myself.</comment>


John Bain, YouTube most subscribed PC gaming critic has passed on - <AUTHOR> https://twitter.com/GennaBain/status/999785407087808512 <comment><USER2> Used to play starcraft 2 semi-professionally years ago (semiprofessionally meaning I took matches off of pros but wasn't consistent enough to be at the very top).

Never met TB in person, but he always conducted himself with the utmost integrity. He was willing to call companies on their bullshit, even for stuff most people didn't care about like games not having extensive settings menus, etc. Furthermore he never solicited donations; he always was "self-funded" and consistently produced quality content.

Super sad to see him go. He definitely knew it was coming (see [this extremely well written post]( [https://www.reddit.com/r/cynicalbritofficial/comments/8g4eoj...](https://www.reddit.com/r/cynicalbritofficial/comments/8g4eoj/official_totalbiscuits_future/)) ), yet remained very levelheaded about his situation.

<comment><USER3> Wow. He seems like a really awesome guy. I'm sad the world and his family have now lost him.

</comment></comment><comment><USER4> Damn. I knew this was coming but it still hurts.

He was one of the most respectable, honest, and hardworking people in this industry. His death is a massive loss.

I hope he rests in peace.

</comment><comment><USER5> RIP John Bain/TotalBiscuit/CynicalBrit.

For me the most kind, reasonable and elaborated voice in and around computer gaming.

</comment><comment><USER6> For those who don't know him by his real name, this is TotalBiscuit/the Cynical Brit.</comment>


consider implementing __await__ on concurrent.futures.Future - <AUTHOR> http://bugs.python.org/issue24383 <comment><AUTHOR> The intent feels totally reasonable at first but gets absolutely no love from GvR.</comment>


Ask HN: How do you document your applications? - <AUTHOR> I'm wondering what are others using to store documentation of their (non-public) services. Github wiki looks nice, but including charts/diagrams is a pain. It has the advantage of keeping docs close to the code, but searching wikis does not work.
Confluence kind of works (and has gliffy integration!), but its search is also terrible.
I'm referring to documents like: architecture overview, what is it and how it works, user guide, but a place for javadoc/godoc would be nice as well.
What works best for you? <comment><USER2> None of them is one best, but combined you can a make something that floats. I am also having similar situation, github wiki, issues, milestones, google docs, url to diagrams, readme... everything combined only gives what i strive for(so far). But still search, its PITA, I agree.

</comment><comment><USER3> I don't think you should need/want charts for developer documentation anyway. If you need charts to display the architecture for instance, but probably to focused on layering and not enough on producing code that actually does things.

The user guide can go on that shared drive where everyone ignores it anyway.

<comment><AUTHOR> It's all cool until someone else has to touch this "code that actually does things".

<comment><USER3> And then it's still cool because they can see what it's doing instead of having the logic spread across 15 files in 6 layers.

</comment></comment></comment><comment><USER4> I document my programs in .c format.</comment>


Ask HN: What would you recommend a group of 20 UK students do when visiting SF? - <AUTHOR> We're organising a trip to Silicon Valley/SF for 20 students from Oxford who are interested in tech/entrepreneurship in March 2016.
Currently the plan is to try to visit a good mix of companies (couple of bigcos, early/medium/late stage startups, maybe a VC or two) and do some cliché touristy stuff.
Is there anything you think we should do that might not be obvious or any specific companies you think we should try to visit? Thanks! <comment><USER2> If you will be in San Francisco I would highly advise you to go to the UCSD and in particular see the School of Engineering building :) [http://cdn.sandiegouniontrib.com/img/photos/2013/07/14/jacob...](http://cdn.sandiegouniontrib.com/img/photos/2013/07/14/jacobs_r900x493.jpg?122770e84b36f1c039d5c4c2ca15c2d8bc4ecd52)

You can also visit the place called Razor Point its really beautiful!

And to observe a sunset over Pacific Ocean is a must do! I am not sure about the weather in March but that side is really famous for its waves) so dont loose a change to have some surfing)

</comment><comment><USER3> I would highly recommend spending a few hours at the Exploratorium. I think it can instigate the imagination and trigger reflection at any age.

<comment><AUTHOR> Looks great, will check it out - thanks!</comment></comment>


Ask HN: What are some good resources for an engineer who wants to start a SaaS? - <AUTHOR> Following on the heels of this discussion [1] what other resources would you recommend to an engineer bootstrapping their first SaaS?
I'm about to give it another shot and was really impressed with the linked resource, and it's making me realize there's a ton of stuff out there that would be incredibly helpful – I just don't know where to look to find it.
If you could share some resources or where to look for them that would be incredible. Thank you!
[1]: https://news.ycombinator.com/item?id=23289185 <comment><USER2> An introductory book on accounting is very useful if you never ran a business before.

</comment><comment><USER3> Sales, sales, sales

The Challenger Sale

Crossing the Chasm

To Sell is Human

(reading startup / biz / leadership books should become a hobby / obsession)</comment>


Ask HN: Downvote brigade comes through at 3pm Pacific - <AUTHOR> I've noticed that during the work day (Pacific time zone ) I'll see comments get more and more points up until about 3pm, at which point they start going down very quickly.  Has anyone else noticed this phenomenon?  Is it an automated process?  Or a large group of cranky users? <comment><USER2> If you see a strange pattern, you can email dang (the moderator) at email@example.com . They can look at more data to try to confirm the problem.</comment>


Ask HN: How secure is my wireless iMac keyboard? - <AUTHOR>

I work in a shared office space with hundreds of people in close proximity. How likely is it that others can read my key input? <comment><USER2> Not worth worrying about. Bluetooth is decently secure (uses public key crypto for initial key exchange, entering the PIN at setup prevents against MITM attacks, and the range is short enough anyway you don't actually have that many possible attackers).

If someone in your office cared about what you're typing, they'd simply spy on you visually, with either their eyes or a camera. Or install a keylogger, if it's their device.

</comment><comment><USER3> It's unlikely, but if you're the type to ask that question, i'd consider it a possibility.

Bluetooth , in the past, has been _more_ secure for this methodology. Certain RF keyboards have been shown to be insecure, but that shouldn't make you feel as if it is entirely safe.

[http://en.wikipedia.org/wiki/Bluetooth#Security](http://en.wikipedia.org/wiki/Bluetooth#Security)</comment>


Business schools redefine hacking to "stuff that a 7-year-old could do" (2005) - <AUTHOR> http://blogs.law.harvard.edu/philg/2005/03/08/

<comment><USER2> Misleading headline, particularly the quotes. In this article no school said any such thing, only the author in creating an analogy.

Synopsis: Business schools outsource their student application web app, said web app has bug that allows students to change GET parameters and see their acceptance status early. Exploit is posted to BusinessWeek forums, and at least some of those students who tried the hack were denied admission to Harvard.

<comment><USER3> Harvard != MIT

<comment><USER4> The students were denied admission to Harvard. MIT came up because the author supervised MIT students creating an application with similar requirements.

</comment></comment></comment><comment><USER5> _As progressively dumber programmers build progressively more complex systems we will see more of this kind of attempt to paper over coding mistakes with lawyers, sanctions, policies, and laws._

How very true.

<comment><AUTHOR> And this would have been the submission title, too, if it weren't for the nonsensical 80-character limit.

</comment></comment><comment><USER6> Odd choice for the headline. I think the much more choice quote from Greenspun is this:

 _All the smart young Americans have gone to law, business, and medical school. Companies don't like to hire old people ( > 30 years) to write computer programs because it saddens them to see old folks doing something so degrading._

(he's attributing this mentality to the HBS lot)

I'm seeing this a lot now that I've gotten into development in the financial industry.

I think for some people developers will always be inseparably tied to the stereotypical unkempt and petulant tech-support guy who troubleshoots Windows boxes all day.

It's not a particularly well-respected profession unless you're doing the start-up thing in which case you're only respected because of the business aspect (and your potential to become a millionaire by 30), not the cool/hard things you may doing on the technology side.

</comment><comment><USER7> Note, this article is from March 2005.

</comment><comment><USER8> One of the more interesting parts of the college application process (there weren't many) was comparing the websites of top-tier schools. Echoing what the writer said - it's amazing how poor the structure, workflow, security and general design the web systems of these schools with $X-billion endowment are.

MIT stood out as an exception; the rest I dealt with were par at best. Fast forward two years - I now attend an ivy league school with what I would consider a laughable website and data storage system.

"You must close your browser to log out of the system" - I don't even have to probe to know it's bad.

</comment><comment><USER9> Top-tier schools already admit students based on a lot of fairly arbitrary criteria, so it doesn't seem like a very big deal to add "does not tinker with school-related web applications" onto the Harvard list.

<comment><USER10> That is particularly arbitrary considering how many HBS grads were discovered to have been involved in finance scams recently.

</comment></comment><comment><USER11> "Instead of students studying Literature, Art, History, and Science they would be going through the motions of a scholar while occupying their minds with things that formerly had been learned at a desk as an apprentice in a dreary Victorian counting house."

Wow, that may be the best description of the concerns of the MBA I've ever read.

I have my MBA and, to this day, I still don't know how I feel about it. Sure, it covered a lot of valuable theory and it's opened doors, but then again I often wonder if the time would have been better spent in industry, honing my skills in the trenches.

The #1 quote I remember from one of my professors, "A degree in business is a degree in nothing."

<comment><USER12> Sure. I think it's accepted that you go to business school to network with students with rich parents. A friend of mine applying said that if she didn't get into any of the top 5 programs, it wasn't worth going.

<comment><USER13> Friend of mine went to one that's around #25. His offer coming out was $35K more than the job he left to attend the program full time. And he moved fields from one he didn't like (healthcare) to one he did (marketing). No rich parents involved. Sample size of 1 FTW!

<comment><USER14> Is that really a win though? Your friend is out two years worth of income + considerable debt to make an extra 35K after two years.

<comment><USER15> 35k a year adds up pretty quickly. Salary acceleration is also likely to be increased.

<comment><USER13> I agree, especially with the first point. Also, though the program was a lot of work, two years of being back in a college environment is pretty cool for most people (from the people I've met in this program, it's not like the typical ennui- and angst-ridden experience you usually see other types of graduate school portrayed as -- although I guess it would be if you're going into it because you've got no other ideas, i.e. grad school as "the snooze button on the alarm clock of life")

</comment></comment></comment></comment></comment></comment><comment><USER16> I'm guessing this bug was fixed, but I applied to b-school this summer (starting part-time in the fall) and ApplyYourself was used for a few of the schools I applied to (NYU Stern, Fordham, NYU-Poly). From a front end/end user interaction point of view, it did not strike me as a well made system. I'm more an IT guy and not a programmer but I know a shoddy website when I use one. I applied to multiple programs at one school and the information could not be shared, it actually lost one of my applications at one point.

</comment><comment><USER17> I wonder how ApplyYourself found out which students took a peek? Were they dumb enough not to implement access at the Gatekeeper level but smart enough to some how keep a track, if someone did?

<comment><USER9> It seems probable that they just looked at the BusinessWeek forums on which the exploit was posted, and denied the applicants who they saw discussing it.

<comment><USER17> If thats the case, its very unreliable. Denying admission based on a post on a forum...gotta love the digital age.

<comment><USER9> In an age when many employers seem happy to deny employment based on social networking profile posts and pictures, I suggest that it might teach them an important lesson about the presence of foolish people in positions of power.

</comment></comment></comment></comment><comment><USER18> Huh, if they were disqualifying students for modifying URLs, I wonder how hard it'd be to scan the results for _all_ students applying.

</comment><comment><USER19> I thought the fandango thing was pretty much fair game as that is one of the first thing people learn, or should learn, about web scripting is what can be controlled by the browser versus controlled by the server.

And in a perfect world the programmer would have made up the price lost not the theatre nor fandango.

</comment><comment><USER20> hahaha this reminds me of a discussion I just had today with a student at the business school of my university. He was pissed off at the "IT people" because they know nothing about management and never finishes on time their projects. The way he talked to me was as if it was all our fault and that we were simply lazy. He was agressive to me even if he never worked with me and told me to check the "new york" methodology and the "ITIL" best practices for doing IT services. I haven't found them on google, does someone know anything about that?

It's great to live in a world where management loves and respect us! A world where they try to understand what is hard about software development instead of thinking about how much time it takes to "place a button there" :)

<comment><USER21> ITIL is pretty standard for managing IT Infrastructure. So standard in fact that <http://www.google.com.au/search?q=itil> maybe returns 1 result that isn't about ITIL in the top 50.

If you can't google for something as basic as that - then maybe the bus. guy was right about you being lazy.

<comment><USER22> FWIW, Google.com has the Wikipedia link up top: [http://en.wikipedia.org/wiki/Information_Technology_Infrastr...](http://en.wikipedia.org/wiki/Information_Technology_Infrastructure_Library)

Though it is interesting to see that ITIL originated in the UK, which might explain why not everyone has heard of it.

BTW, here's an article from '05 describing ITIL use in the US (and ITIL's history): <http://www.govtech.com/gt/articles/95672>

<comment><USER23> My first job out of uni was developing itil training software.

It was soul sucking.

I am in the UK, but hadnt heard of ITIL prior to the job, noone I know that can program has heard of it, I occasionally meet some business guys that have though.

<comment><USER21> True. It's not a Programming standard - as it is a way to manage IT Infrastructure which should be HW/SW/staff/etc to promote the goals of the business.

Remember everyone - there's a whole world of companies out there who don't know or care what AJAX or Python or Ruby is. They want to make the stuff they need to make, server their customers, and use computers as what they really are - a tool that should make stuff easier - not harder. (And it's in those industries that there is a lot of opportunity).

Oh - and don't take this as a post glorifying ITIL.. I think it's overdone and too verbose for an awful lot of companies.. (what do you expect coming out of a gov dept.) What I haven't seen is much of an alternative.

</comment></comment></comment></comment></comment><comment><USER24> Slashdot thread: [http://slashdot.org/article.pl?sid=05/03/08/2341213&tid=...](http://slashdot.org/article.pl?sid=05/03/08/2341213&tid=172&tid=146)

</comment><comment><USER25> title = troll, rtfa

</comment><comment><USER26> _Hacking :: stuff that a 7-year-old could do_

Wow, Python makes it that easy! _( just a quick laugh )_</comment>


Do Humanlike Machines Deserve Human Rights? - <AUTHOR> http://www.wired.com/culture/culturereviews/magazine/17-02/st_essay

<comment><USER2> Hmmm, tell you what. After you're done giving human rights to all of the _humans_ come on back and we'll start talking about the machines.

</comment><comment><USER3> This is the same question as animal rights. Of course neither robots or animals are human or sentient. But doesn't killing them have a scarring effect on us? And is that enough to outweigh the efficiency benefits of treating them as objects?

<comment><USER4> The word you're likely looking for is 'sapient.' According to the wikipedia, 'Sentience is the ability to feel or perceive subjectively.'

I think there's a pretty clear case for the ability of animals to feel emotions, and feel pain. Whether they're a human like intelligence is another matter.

<comment><USER3> I don't mean to get bogged down in a grammatical argument, but I really did intend to set a lower standard than sapience. What I mean is the second definition given by the OED for sentience, "self-awareness."

For example, I could make a robot that made all the expressions of pain when injured. Would such a robot be sentient? I doubt it. Perhaps I'm blinded by speciesist prejudices, but I still draw a bright clear line between humans, which are both sentient and sapient, and everything else.

There's definitely no cause for sapience in animals, but I doubt if there's even a case for sentience outside of some higher primates.

<comment><USER4> Do other _humans_ even pass your test? How can you be sure that they are not producing behavior simply _consistent_ with sentience, rather than actually being indicative. Animals too have behavior consistent with subjective emotional experience. What separates theirs from ours, except our prejudice?

<comment><USER3> I can tell humans are sapient through high level communication of complex thoughts that could only come from a sentient being. I know humans are sentient because sentience is a precondition to sapience.</comment></comment></comment></comment></comment>


Show HN: a minimalistic, svblt-inspired WordPress theme - <AUTHOR> https://github.com/wildlyinaccurate/wildly-minimalistic-wordpress-theme

<comment><USER2> Looks very nice. The blue/green text especially. Has a very modern look.

Been thinking about a new theme for my personal site, and this would be the perfect theme. :)</comment>


Ask HN: Good Go codebases to read? - <AUTHOR> I'm a Python programmer and I just started learning Go. What are some good Go codebases to read? I feel it helps me learn better if I look at some existing high quality open source code.
There was a similar post about Python a couple of years ago (https://news.ycombinator.com/item?id=9896369) and it helped me tremendously. I'm looking for something similar with Go.
Thanks! <comment><USER2> Humble suggestion / shameless plug: try using Sourcegraph to read through some of the excellent codebases mentioned in other posts. This is basically our prime use case (I'm one of the creators): reading through and understanding code structure with jump-to-def / find-refs / symbol search in your browser. I'd suggest starting with the main function and tracing through the static structure of the codebase from there:

[https://sourcegraph.com/github.com/golang/go/-/blob/src/net/...](https://sourcegraph.com/github.com/golang/go/-/blob/src/net/http/request.go) [https://sourcegraph.com/github.com/mholt/caddy@master/-/blob...](https://sourcegraph.com/github.com/mholt/caddy@master/-/blob/caddy/main.go) [https://sourcegraph.com/github.com/btcsuite/btcd@master/-/bl...](https://sourcegraph.com/github.com/btcsuite/btcd@master/-/blob/cmd/btcctl/btcctl.go) [https://sourcegraph.com/github.com/camlistore/camlistore@mas...](https://sourcegraph.com/github.com/camlistore/camlistore@master/-/blob/cmd/camtool/camtool.go) [https://sourcegraph.com/github.com/boltdb/bolt@master/-/blob...](https://sourcegraph.com/github.com/boltdb/bolt@master/-/blob/cmd/bolt/main.go) [https://sourcegraph.com/github.com/go- kit/kit/-/blob/example...](https://sourcegraph.com/github.com/go- kit/kit/-/blob/examples/addsvc/service.go)

<comment><USER3> I was trying to understand the go source code the other day, my process was:

`git clone [https://github.com/golang/go`](https://github.com/golang/go`) then `cd go`, and `tree .`, `git grep ...`, `vim ...`, etc.

Anyway, couldn't find how to get the tests to pass, but found this:

[https://golang.org/doc/codewalk/markov/](https://golang.org/doc/codewalk/markov/)

And a little explanation: [https://golang.org/doc/codewalk/codewalk/](https://golang.org/doc/codewalk/codewalk/)

Also: [https://golang.org/doc/install/source](https://golang.org/doc/install/source)

In terms of codebase, kubernetes and upspin seem pretty good too:

[https://github.com/kubernetes/kubernetes](https://github.com/kubernetes/kubernetes) [https://github.com/upspin/upspin](https://github.com/upspin/upspin)

<comment><USER4> I imagine upspin is one of the best examples because Rob Pike is one of the main contributors

<comment><USER3> Funny thing is that I couldn't get up spin to run :).

But yes having a global namespace is a genius idea.

</comment></comment></comment></comment><comment><USER5> HashiCorp put out good stuff. CoreOS can be hit or miss; Torus was nice, etcd is a wreck. I like [https://github.com/go-kit/kit](https://github.com/go- kit/kit) and [https://github.com/oklog/oklog](https://github.com/oklog/oklog). Definitely avoid Kubernetes and Docker -- they're Go by committee, look and feel like transliterated Java.

<comment><USER6> I know very little Go, but I have seen the Kubernetes code and my impression was "I bet these people were Java programmers in a past-life". You could tell by the multiple layers of abstraction, a lot of which felt unnecessary.

Having said that, Kubernetes is a solid piece of engineering, so they are clearly doing something right and I don't want to denigrate their hard work.

<comment><USER7> Kubernetes also came from the same engineers that worked on Borg (Google's internal Kubernetes), which is written in C++. I imagine a lot of the constructs and design/layers were inspired by their experience in Borg.

<comment><USER8> Some of the style adopted for Kubernetes mirrored both previous Java experience (inside Google and out), but most of it was simply observation of other large Go codebases.

I don't think much of the layering / structure has anything to do with Borg except in a few areas:

1\. Scheduler predicates

2\. The massive ball of yarn that the kubelet started off as and was unable to achieve escape gravity on (until CRI landed)

Everything else was focused on pure efficiency and is only slightly biased by general experience building large software projects (pass dependencies down, avoid complicated abstractions, rigorous style enforcement). A lot of that leaked as Kube grew into a larger and larger community and more people contributed.

The other abstractions people complain about mirror traditionally hard problems (API version stability with conversion across semantic changes, general API surface area management). Other than that we decided not to build on relational stores but a partitioned document model (etcd, inspired by chubby, but not fundamentally different from any other object store), I'd say the code is mostly just a reflection of being good enough to maintain now and refactor later. Pretty code is easy when it's a few people writing it. Harder when it's a team of tens / hundreds

<comment><USER6> > Pretty code is easy when it's a few people writing it. Harder when it's a > team of tens / hundreds

Yeah, this is a good point that I was overlooking. It's easy for me to be critical when I feel the pain digging through multiple levels of abstraction to find out how something works, but I didn't the feel the greater pain of trying to manage tens or hundreds of developers working on the same codebase.

</comment></comment></comment></comment></comment><comment><USER9> Standard lib source is good. I gained a lot of insight from Dave Cheney's blog: [https://dave.cheney.net](https://dave.cheney.net).

<comment><USER10> +1 on the standard lib. It's done so nicely in most places, that it's easy to convince myself to take a minute and read implementations of routines I'm reading godocs for, even though the docs are 100% clear... cuz it's actually a pleasant read.

In contrast, I've worked in places where I needed a drink or 3 before I can build up the gumption to open my text editor :-)

</comment></comment><comment><USER11> check out the videos that Francesc Campoy is putting out on his youtube channel "JustForFunc", he does code reviews and the one of him implementing the context package is great for learning the go way of doing things.

[https://www.youtube.com/channel/UC_BzFbxG2za3bp5NRRRXJSw](https://www.youtube.com/channel/UC_BzFbxG2za3bp5NRRRXJSw)

[https://github.com/campoy/justforfunc](https://github.com/campoy/justforfunc)

</comment><comment><USER12> IPFS. I'm not a go developer, but I was easily able to dive into the code in many of their repos, understand the code and make fixes which were merged. [https://github.com/multiformats/](https://github.com/multiformats/) [https://github.com/ipfs](https://github.com/ipfs)

</comment><comment><USER13> I've only read some of it, and not in depth, but nevertheless enough to highly recommend all of fogleman's Go projects:

[https://github.com/fogleman?utf8=&tab=repositories&q=&type=&...](https://github.com/fogleman?utf8=&tab=repositories&q=&type=&language=go)

</comment><comment><USER14> I really enjoyed studying the BoltDB source[1], which is Ben Johnson's popular key/value store library. I found it to be clear, idiomatically written, and well annotated.

[1]: [https://github.com/boltdb/bolt](https://github.com/boltdb/bolt)

</comment><comment><USER15> Several suggestions:

As others have suggested, looking through go's std library is a good idea as you will need to be familiar with it in any case. Use [https://golang.org/pkg/](https://golang.org/pkg/) liberally to go from reading API documentation to code.

Look at [https://golanglibs.com](https://golanglibs.com) categories and pick the one that interests you or is something you already know a bunch about. Then pick something simple from that category.

There is a library that converts some python libs to go packages. This may also help as you can see how the mapping worked.

Finally, just pick up the Go book and start coding something you care about! Go's online documentation is quite good. I was able to bootstrap 3 high-school interns this way fairly well and they actually produced a fair bit of working code in 7 weeks. IMHO you should spend a significant part of your "study" time writing code. Read other code as and when you need it.

</comment><comment><USER16> Upspin source is pretty good, since Golang creators are also working on it [https://github.com/upspin/upspin](https://github.com/upspin/upspin)

<comment><USER17> I second this one. They do a lot of things that I would consider best practices that are not incredibly obvious.

</comment></comment><comment><USER18> I'm surprised to not see Mattermost[0] mentioned yet.

[0] [https://github.com/mattermost/platform](https://github.com/mattermost/platform)

</comment><comment> enahs-sf The standard library source code is pretty good.

[https://github.com/golang/go](https://github.com/golang/go)

</comment><comment><USER19> A bit of a plug but this is my "flagship" open source project and I have worked on the codebase since late 2015 (a lot of time) so hopefully it should be a good example to take a look at.

Also would like to hear feedback if you spot something which doesn't seem pretty/idiomatic in my code.

[https://github.com/RichardKnop/machinery](https://github.com/RichardKnop/machinery)

</comment><comment><USER20> This isn't a codebase, but it's a piece of knowledge that I've found to be quite useful:

[https://commandcenter.blogspot.com/2014/01/self- referential-...](https://commandcenter.blogspot.com/2014/01/self-referential- functions-and-design.html)

</comment><comment><USER21> Standard lib 100%. And Dave Cheney's personal website/blog posts. You don't need anything else.

</comment><comment><USER22> I know Go is mainly used for systems and infrastructure level software, but I also know that some companies are using it at a higher level of abstraction for their application servers as well.

I'd really like to see more examples of these types of codebases but can't seem to find examples anywhere.

</comment><comment><USER23> [http://exercism.io](http://exercism.io) is pretty good, you solve programming exercise and then can look and see how other users solved the same problem.

</comment><comment><USER24> I'll do a little self promotion here: [https://pisc.junglecoder.com](https://pisc.junglecoder.com) It's a stack- based concatenative scripting language implemented in Go. There are also Go implementations of LISP (zygomys) and Lua that may well be worth looking into, if you'd like to see how one builds a language in Go.

Otherwise, the standard library is always a good way to find out about things that you didn't know existed, or forgot after reading the standard.

</comment><comment><USER25> Sqlx and go-kit are two libraries that helped while learning Go. Sqlx helped me understand the value of Go's implicit interfaces/package level structure, while go-kit helped me better understand good project structure.

[https://github.com/jmoiron/sqlx](https://github.com/jmoiron/sqlx) [https://github.com/go-kit/kit](https://github.com/go-kit/kit)

</comment><comment><USER26> [https://github.com/btcsuite/btcd](https://github.com/btcsuite/btcd) Learned a lot from reading this code

<comment><USER27> Agreed! It is crazy that this code even exists. They have since rolled it into their decred/altcoin project.

<comment><USER26> [https://www.investitin.com/decred-altcoin- review/](https://www.investitin.com/decred-altcoin-review/) [https://github.com/decred/dcrd](https://github.com/decred/dcrd) nice

</comment></comment></comment><comment><USER28> Hugo is well maintained - [https://github.com/spf13/hugo](https://github.com/spf13/hugo)

</comment><comment><USER29> Depends entirely on what you interested in building, but these are worked on fantastic Go engineers and architects:

[https://github.com/hashicorp](https://github.com/hashicorp)

[https://github.com/coreos/](https://github.com/coreos/)

[https://github.com/kubernetes](https://github.com/kubernetes)

</comment><comment><USER30> Caddy web server. Piece of art.

<comment><USER31> Link: [https://github.com/mholt/caddy](https://github.com/mholt/caddy)

</comment></comment><comment><USER32> I find anything made by tidwall super easy to read and informative. You could compare it to redis's code quality.

[https://github.com/tidwall/buntdb](https://github.com/tidwall/buntdb) [https://github.com/tidwall/tile38](https://github.com/tidwall/tile38)

</comment><comment> vhost- The Gogs codebase is pretty good, although it has many uses of package globals, which doesn't sit well with me. I mostly like what's in there: [https://github.com/gogits/gogs](https://github.com/gogits/gogs)

</comment><comment><USER33> I wrote this blogging server in go a few weeks ago. It is very small, and should be helpful getting some basic concepts across for you

[https://github.com/blhack/blogeyBlog](https://github.com/blhack/blogeyBlog)

</comment><comment><USER34> Camlistore is great: [https://github.com/camlistore/camlistore](https://github.com/camlistore/camlistore)

Many of what is now the Go standard lib came from Brad Fitzpatrick's work on Camlistore.

<comment><USER7> I'm not sure I agree. A lot of camlistore's idioms don't feel like "normal", idiomatic Go. Since it was still being written while the standard library and language was evolving, I get the feeling when reading the code that it's more like doing archeology of the Go language.

<comment><USER35> IIRC it also still has a non-standard build process (go run make.go) for the same reason (it was being written while the library/language were in their infancy).

</comment></comment></comment><comment><USER36> A friend of mine helped create Pilosa [0], a bitmap index. I've been meaning to read through that at some point.

[0] [https://github.com/pilosa/pilosa](https://github.com/pilosa/pilosa)

</comment><comment><USER37> Honorable mention of [https://www.goinggo.net/](https://www.goinggo.net/)

William is one of the Authors of "Go in Action" and a great teacher.

</comment><comment><USER38> Macaron has helped me the most [https://github.com/go- macaron/macaron](https://github.com/go-macaron/macaron)

</comment><comment><USER39> [https://github.com/coredns/coredns/](https://github.com/coredns/coredns/)

</comment><comment><USER40> The standard library is quite good and idiomatic. I particularly like net/* and io)

</comment><comment><USER41> How about etcd? [https://github.com/coreos/etcd](https://github.com/coreos/etcd)</comment>


Food in America compared to the U.K. (Why is it so different?) - <AUTHOR> https://foodbabe.com/food-in-america-compared-to-the-u-k-why-is-it-so-different/ <comment><USER2> I have to wonder... Is it that the ingredients are that different? Or is it that they simply have different labeling standards where some things don't have to be listed on the ingredients label.

I'm an expat in Germany until December. I've absolutely noticed a change in the food quality. To me it tastes worse, has less flavor, has less things like salt, etc. So there is an ingredient difference.

But that doesn't mean it will be on the label. For example - Beef in Germany tastes more gamey. This is because of the way they treat their cows and what they feed them. Also their lack of salt and spice.</comment>


Cisco set to open new accelerator focusing on 'world-changing' ideas - <AUTHOR> http://www.geektime.com/2013/08/14/cisco-set-to-open-new-accelerator-focusing-on-world-changing-ideas/

<comment><USER2> On paper this looks great. Get in on the startup game.

The skeptic in me asks:

\- Do you lose out on network effects by limiting it to 5 at a time? (Isn't part of the benefit of ycombinator that you're part of the larger family?)

\- Are there any success stories of this type of in-house accelerator programs? I remember a lot of not so great outcomes in the 2001 timeframe.

</comment><comment><USER3> Because every corporation these days want in house innovation and they can do it cheaply by incubating startups that they will eat once they are on something.

</comment><comment><USER4> Cisco tries to create some buzz, as a company that most of the time you don't hear about...</comment>


Airbnb's new typeface - <AUTHOR> https://airbnb.design/introducing-airbnb-cereal/ <comment><USER2> All I can gather from this is Airbnb has way too many engineers and designers for the amount of actual work there is to go around.

At the end of the day, the day to day engineering problems Airbnb has are not very interesting. It's a web app that can handle peak traffic with standard technologies (meaning nothing real time, live streaming, or millions of users at once).

I have no clue what most engineers would be doing there day to day.

<comment><USER3> HN at its worst: using a post about creating a font as a cheap excuse to mock Airbnb's engineers and designers, their jobs and their reason for being employed there.

And somehow it's the top comment in the thread, as opposed to, say, actually discussing the font or the content of the article. Wtf.

<comment><USER4> it's a classic HN. "I can build that in a weekend!"

<comment><USER5> Actually my response was - WHY build/work on this? I understand that licensing a font can cost a company a lot of money but there is no reason why a company of this size can't just use any of the thousands of open source fonts available. It is a waste of time/resources that is pretty characteristic of a big tech company (having worked at one).

In at least the cases I've seen - the reason why this happens is because design teams want to stand out and stamp their identity on the company. It is a reason to add imaginary value to internal "design studios" and promote designers to arbitrary titles.

And engineers, PMs, etc. mostly do the same. Create work, features, platforms that add no real value but simply to stamp their identity and pursue (effectively) self-promotion.

The original commenter makes a great point about saying that there are many other things to focus their energies. Okay, throwing engineers at a single problem is not a good way to do things.

But the AirBnB iOS app has been broken for ages. Various visual and functional bugs. Offline support is arguably the most important feature for an AirBnb app (if you're traveling and don't have service). But this hasn't been tackled at all.

Instead AirBnB engineers are going through all of their properties and updating their fonts, fixing issues with responsiveness/scaling, packaging on mobile platforms, etc. WHY?

<comment><USER6> The WHY is because they want a unique brand identifier. If they used a font anyone else could use then it would no longer be unique to the brand. Essentially they don't want you to feel comfortable or at home on a competitors site who may try to mimic their branding.

This expense goes under marketing not R&D.

</comment></comment></comment></comment></comment><comment><USER7> Dalton Maag probably had a pretty good 2018 so far: [https://twitter.com/kodform/status/996447044100386816?s=21](https://twitter.com/kodform/status/996447044100386816?s=21)

<comment><USER8> Yep. Those look almost identical.

<comment><USER9> Look again: a, f are pretty different, proportions differ all over (see O), and the author of the tweet clearly hid the tapered & much wider aperture of the Airbnbs e behind the image.

Type design is a subtle thing - they are clearly similar, but definitely not identical

<comment><USER10> Type design is a subtle thing is such a wrong statement. Type design is everything - big and small things. This is why it takes a long time to design a timeless font because the search domain is insanely massive.

Let's be honest here, Netflix Sans and Airbnb Cereal are pretty much identical except for the grotesk details.

<comment><USER11> I was curious if you used the word "grotesk" as a technical term in type design, like how "gothic" (apparently) has typographic meaning. I looked it up, and learned that "grotesque" is a class/category of sans-serif fonts.

Re-reading your last sentence, you probably meant in a general way, as in "grotesque: characterized by ludicrous or incongruous distortion; outlandish or bizarre".

[https://en.wikipedia.org/wiki/Sans- serif#Classification](https://en.wikipedia.org/wiki/Sans-serif#Classification)

Edit: Oh, here's a great comment from someone who worked on the font, with a mention of "Grotesque" san-serif.

[https://news.ycombinator.com/item?id=17075836#17080855](https://news.ycombinator.com/item?id=17075836#17080855)

<comment><USER10> I meant it in a typographical sense.

</comment></comment></comment></comment></comment></comment><comment><USER12> One of the people involved in the project and answering questions in the article. Happy to answer more questions.

We talk about reasoning for Cereal in the article and in my case study too[1]. In large organizations, you often have tens or hundreds of designers, support multiple platforms (ios, android, web(mac, windows, linux) and do ad campaigns around the world. When it comes to typefaces, there really isn't any universal system fonts (other than Arial maybe), that are available on all platforms. If you use different fonts on each platform, the design will be slightly different, trying to manage a cross-platform design system (like we do [2]) becomes challenging. Every time, designer has to pick the right font, potentially do 2-3 designs with different font to make sure they all look how they want them to. Also then each time user or anyone in the company looks at the design on their device, it look will slightly different. If the marketing then also uses different type, it will look slightly off if you include product shots (one reason why Apple now uses SF everywhere). Short answer: having multiple fonts causes additional work and can confuse people, especially inside the company.

Since there isn't universal cross-platform fonts, it means you often have to embed fonts, and in some cases license them. Licensing fonts is different than just buying a font file. Even for small developers quality fonts can run up to $50,000 per app (imagine what the licensing costs are for a global company with large userbase!). With licensing you never get exactly what you want in terms of expression and functionality, and other brands can easily buy the same thing.

As the last point, what I find really exciting that we can now consider font kind of like a software. We change it whenever we find problems or just want to improve something. That is usually not possible with licensing. Obviously, you would and should only do your own typeface if you have these kind of issues and care enough wanting to solve them.

[1]: [https://airbnb.design/working-type/](https://airbnb.design/working- type/)

[2]: [https://airbnb.design/building-a-visual- language/](https://airbnb.design/building-a-visual-language/)

<comment><USER8> Congrats to your team on creating what looks like a very versatile font. I can appreciate the benefits that creating a custom font will have.

One of the other commenters mentioned that AirBnB's Cereal and Netflix Sans (both overseen by Dalton Maag) are almost identical. Could you speak to the differences, technical or otherwise between the results and how that relates to differentiating the brand aesthetic?

<comment><USER13> op delivers a usual...

the fact is 99.999999% of people do not see or notice the difference.

i can say with strong belief that changing your font did not add to your bottom line.

<comment><USER14> Fonts are a very subliminal thing. Sure, you may not be able to point out the differences between certain fonts, but many can tell the difference between different corporate identities.

</comment></comment></comment></comment><comment><USER15> "We have specific business needs around brand distinction, legibility, and scalability, that no available typefaces were addressing"

The font looks almost identical to a lot of other sans fonts.

<comment><USER8> The difference between a fontset that looks similar and a fontset that solves for all the business requirements can be vast. Cereal appears to be extremely versatile and distinct in a few key areas. You don't need a custom font to distinguish your brand from others, but you probably do if you're going to be using that one typeface for every damn thing in every damn scenario.

<comment><USER16> I think the fact that this new font has an installed base of 0 counts against it's versatility.

I think the fact that a negligible amount of the general public could pick the new font (knowingly, not by guessing) out of a group of 9 other sans fonts counts against it's ability to distinguish the airbnb brand from others.

<comment><USER17> Installed base is pretty meaningless in a world of web fonts and mobile apps. Everyone will need to download the font once. Not a big deal.

<comment><USER16> The installation process isn't the sum total of the point there. Known-good is better than unknown, all other things equal (and not to sound condescending but they basically are).

It's low risk but frankly it's even lower reward. If their goal was to distinguish themselves, perhaps they could do it more effectively through something people would notice.

<comment><USER8> Their goal turned out not to be to distinguish themselves.

</comment></comment></comment></comment></comment></comment><comment><USER18> Why do they use a screenshot with a typo for demonstration purposes? Beautiful is misspelled as "beutiful". Why are all these companies designing their own fonts. It's not needed and for primarily mobile-based apps it ends up being jarring.

<comment><USER19> My personal take on this:

Q: why do they use a screenshot with a typo.

A: Maybe to bring attention to the font? To the letters that are missing or those that are present? Maybe just because they can.

Q: Why are all these companies designing their own fonts. It's not needed...

A: Many reasons. It can be cheaper than licensing other fonts. It makes their apps (and brand) stand out. Or people might find it more aesthetically pleasing. The perceived `need` for it, has nothing to do with whether or not you need it for their app/website to function properly. And maybe `jarring` is exactly what they want.

<comment><USER20> _It can be cheaper than licensing other fonts_

Can it? How many people-hours went into this, and which fonts have higher licensing costs than that?

<comment><USER21> It's definitely not cheaper than using free fonts. Or even modifying an existing one -- it's not as if Airbnb's exclusive use of this font is going to benefit them in any measurable way. Even if that were necessary, it seems like they should have just paid Netflix to use their font, and maybe make some changes, rather than working with Dalton Maag to make damn near the same thing.

<comment><USER20> I mean, what's the most expensive commercial font license? Neue Helvetica is $350/yr/cpu.

<comment><USER22> Does a per-cpu licence allow you to use the font in all your publications?

<comment><USER20> I don't know the details of Linotype GmbH's licensing agreements, but my point was that this route is surely less expensive than commissioning a new font.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> So... it seems like Netflix Sans plus more open apertures (angled terminals) on letters like "e" and "a"

Was Netflix Sans the determined starting point?

<comment><USER24> Pretty much... The firm that made Netflix Sans made this one too. Looks like they just tweaked it a bit for Airbnb.

[https://twitter.com/kodform/status/996447044100386816](https://twitter.com/kodform/status/996447044100386816)

<comment><USER10> But they will say - "Oh, fonts are all about subtle things". Yes and no, you're wrong. The search domain for fonts is extremely large and that's why it takes forever, in some cases a decade, to design a really timeless font. Not in 3 months, or worse - modify Netflix Sans and pawn it off as "One of a kind".

</comment></comment></comment><comment><USER25> I get Error establishing a database connection

<comment><USER26> Same here, in a very pedestrian typeface no less.

<comment><USER27> I found it bold.

</comment></comment></comment><comment><USER28> Does anyone else with astigmatism notice that the e, c, and even the a are way too closed off? Especially for print (and on the heavier weights), good luck distinguishing these characters from far away with an o.

<comment><USER29> Is your astigmatism uncorrected? I can make the characters out just fine, but I wear contacts for astigmatism.

</comment></comment><comment><USER30> i find it fascinating how bizarrely hostile to a company developing a new font some people are. it's just branding and identity, like logos, color schemes and design languages. not really a big deal. but holy smokes do people talk a lot of shit about fonts... for whatever reason. what's going on? is it really about the company, and not the font?

</comment><comment><USER31> > Our Latin character set has a few hundred characters but Chinese Simplified, > for example, has over 27,000. We intend to expand to include script systems > used by our global community including Chinese, Japanese, Devanagari, > Arabic, Hebrew, Cyrillic, Greek, and Thai, and that will take time.

Good luck with that. I wonder how long that will take.

</comment><comment><USER32> Cached version: [https://webcache.googleusercontent.com/search?q=cache:mm7CiH...](https://webcache.googleusercontent.com/search?q=cache:mm7CiHImqIkJ:https://airbnb.design/introducing- airbnb-cereal/+&cd=4&hl=en&ct=clnk&gl=us)

</comment><comment><USER33> This is really cool, and I love the name and its connection to Airbnb founding story

</comment><comment><USER34> God I wish we had "own typeface" money.

<comment><USER35> Just get Font-Forge[0] and a protractor. Give it a week or two and you'll be able to throw together some copycat _LL Circular_ [1] derivative, to give the illusion of having 'own typeface' money, which might in turn look rather impressive to prospective investors.

(At least, when you say 'we', I presume you're speaking on behalf of a fledgling business. If you're just saying that you'd like more money for your family, well, I guess I'd still recommend making fonts because it's very lucrative work apparently.)

[0]: [https://fontforge.github.io/en-US/](https://fontforge.github.io/en-US/)

[1]: [https://fontsinuse.com/uses/7192/airbnb-identity-website- app...](https://fontsinuse.com/uses/7192/airbnb-identity-website- app-2014-redesign)

</comment></comment><comment><USER36> Is it just me, or is the design motif that airbnb is adopting in this post fairly similar to dropbox's? I'm also reminded of it in the new gmail interface.

<comment><USER37> and iOS 11

<comment><USER14> How so?

</comment></comment></comment><comment><USER38> I'm not at all a font expert or even geek, so forgive me if that's dumb: Do all those new product fonts look like Circular [1]? It's always struck me as a very unique font, but it's becoming less unique every day it seems.

1: [https://lineto.com/The+Fonts/Font+Categories/Text+Fonts/Circ...](https://lineto.com/The+Fonts/Font+Categories/Text+Fonts/Circular/)

<comment><USER39> That's a curious charge, since Circular _was_ Airbnb's CI font until today.

</comment></comment><comment><USER40> [https://youtu.be/cISYzA36-ZY?t=1m30s](https://youtu.be/cISYzA36-ZY?t=1m30s)

Anybody?

</comment><comment><USER41> This post is like the corporate version of the masterbatory Ikea scene in Fight Club.

</comment><comment><USER42> I liken this to a hotel that decides to make their own lightbulbs. Or a department store that produces it's own bespoke cash registers.

You can't argue that typography is so vital to their business that this is a useful allocation of resources. Obviously, design is important to any company that markets itself in some way. But not every company designs their own typeface (although it seems like it, lately.)

Some are saying it's important for AirBnB to have their own distinct look, and that requires a custom typeface. BS. Plenty of successful companies managed to create a distinct brand identity using helvetica.

[https://99designs.com/blog/creative-inspiration/famous- logos...](https://99designs.com/blog/creative-inspiration/famous-logos-made- with-helvetica/)

Some are saying it's cheaper to make your own typeface than to license one. Really? There are no cheaper typefaces that look suitable? (I'm not saying this is impossible. I'm genuinely curious. Is that how bad it is?)

We have open source typography. Are none of those fonts suitable for their purpose? Can any of them be improved by the designers at AirBnB? That sounds like it would be cheaper than starting from scratch.

I care about beautiful typography as much as the next web designer / marketer / start up-whatever. But I also know how a business runs. And this seems like something the business should not focus on. Tell me I'm wrong.

<comment><USER43> This is as much about designers and egoists jerking themselves off in the service of a new 'corporate identity' as it is about a meaningful evolution in image.

<comment><USER44> The recent HN links to articles on "bullshit jobs" come to mind.

</comment></comment></comment><comment><USER45> I don't really know much it costs to buy a custom font by these designers (Google suggests 150K USD and up).

To me this seems like a pretty cheap (and effective) marketing play by Airbnb.

</comment><comment><USER46> No need to reinvent the wheel. There's already Comic Sans.

</comment><comment><USER47> Error establishing a database connection

<comment><USER48> [https://webcache.googleusercontent.com/search?q=cache:mm7CiH...](https://webcache.googleusercontent.com/search?q=cache:mm7CiHImqIkJ:https://airbnb.design/introducing- airbnb-cereal/+&cd=1&hl=en&ct=clnk&gl=ca)

<comment><USER49> that serves up garbage.

I'm surprised they don't have a static site up for this kind of thing.

</comment></comment></comment><comment><USER50> Sad that an article on Airbnb's font gets more attention than most startups could ever hope to get.

<comment><USER51> Well, Airbnbs font will be seen by more people than most startups...

</comment></comment><comment><USER52> I find it profoundly stupid for Airbnb to have their own typeface. It's like they have lots of designers around and have to keep them busy with something.

Well at least they did not give them the usual entertainment for bored designers: redesigning stuff that does not need a redesign.

<comment><USER53> Creating a typeface which you own is cheaper than licensing a third-party typeface, at scale.

<comment><USER44> >> Creating a typeface which you own is cheaper than licensing a third-party typeface, at scale.

The cheapest fonts are the ones installed on a users system. Web sites and apps do not need to include fonts at all. In fact it's easy to argue that the users should be selecting the fonts on their devices in most cases.

<comment><USER54> Never let the user control your brand. System fonts should always be thrown away.

Every company web site & app needs to include their own font. Otherwise, you become a commodity, and you can be replaced by your competitors.

Business is about being different from competitors, not the same. And people buy things that look good.

Companies that have crappy branding lose money, because they lose customers to other companies.

<comment><USER55> If your major differentiating factor is mainly branding, you are already a commodity. Customers will often use shitty looking products if there's something in it for them.

<comment><USER51> Not for a network effect business. A network effect business doesn't need a strong advantage or even any advantage if the network is strong enough. Note that eBay has barely changed in 20 years yet is still the only place to go to get Hamburglar sunglasses or whatever.

<comment><USER55> Good point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER56> Must be nice to have enough millions (by taking away apartments from city- dwellers and avoiding laws) to afford a custom typeface.

</comment><comment><USER57> Please do a major rehaul of your crappy user interface instead of that stuff

</comment><comment><USER58> This font is the definition of frivolous corporate idiocy.</comment>


A simple Metropolis-Hastings MCMC in R - <AUTHOR> https://theoreticalecology.wordpress.com/2010/09/17/metropolis-hastings-mcmc-in-r/ <comment><USER2> Thanks, this is a nice little intro.

Is it common practice in R to define global variables and then use them in functions without passing them directly, as is frequently done in this script?

<comment><USER3> Not particularly, although R doesn't have much of a canonical style and some of it is pretty hairy as most of the users don't have any formal programming experience.</comment></comment>


Security Issue February 2019: FAQ - <AUTHOR> https://support.500px.com/hc/en-us/articles/360017752493-Security-Issue-February-2019-External-FAQ <comment><USER2> The title here may be a bit misleading. From the article, it actually sounds like 500px used MD5-encryption for a subset of their users' passwords, and this is the subset that they've prioritized forced password resets for due to higher risk.

As per tachang's comment, MD5-hashing passwords isn't secure, but also per their comment, this is also an opportunity for them to migrate that subset of users to the presumably more secure hashing function used for the rest of their user base.

<comment><USER3> We've reverted the title from the editorialized '500px: don't worry, your passwords were "MD5-encrypted"'.

</comment></comment><comment><USER4> For those wondering MD5 by itself is a terrible hash for passwords. It's really fast and without salting you can build rainbow tables against it with reasonable speed.

If the passwords were salted it still means that a determined adversary can find your password relatively quickly.

Other better hash functions for passwords include things like bcrypt. Though I do understand it is a pain to migrate users over since you can only do it when they login.

<comment><USER5> > Though I do understand it is a pain to migrate users over since you can only > do it when they log in.

Had a thought on this, but I'm no security expert so if someone else could weigh in, that'd be awesome. Couldn't you just add a layer to the password hashing?

I.e., you start with MD5 because that's the best at the current point in history. Bcrypt comes around and you want to do a migration of all your users, so you take the stored MD5 hashes and run them through bcrpyt. Making sure, of course, that your login system does the same, MD5 followed by bcrypt. When the next-gen hashing algorithm comes around, you do the same, now the path is MD5->bcrypt->next-gen.

That way you're relying on the strongest algorithm "wrapping" the weaker one(s) without having to make everyone login again to generate the new hashes to be stored.

Curious to know if there are downsides to this (performance is an obvious one) or whether you're weakening the stronger hash by hashing a weaker one?

<comment><USER6> > Curious to know if there are downsides to this (performance is an obvious > one) or whether you're weakening the stronger hash by hashing a weaker one?

You're weakening the stronger hash by hashing the weaker one. The two main problems of MD5 are entropy (128-bit maximum) and collisions (because of lack of entropy).

By always hashing to MD5, you are losing the entropy of the stronger hashing algorithm.

<comment><USER5> Confirms a suspicion I had that it might be an issue. I assume it's a problem whenever you hash a weaker with a stronger, not just MD5 in particular.

Thanks!

<comment><USER7> It does cap it at 128 bits, but it is _not_ an issue. 128 bits of entropy is plenty.

</comment></comment></comment></comment></comment><comment><USER8> How is 'how did they get in' not a Frequently Asked Question?</comment>


Uber Engineering Bug Bounty: The Treasure Map - <AUTHOR> https://eng.uber.com/bug-bounty/ <comment><USER2> Having descriptions of all the various services is great.

Something I couldn't see here is that while you ask for bugs related to a variety of accounts, are there ways of creating such accounts? I can fairly easily ensure I don't poke at the normal user account of someone else, but what about drivers/businesses/etc?

More generally for HNers, are there common ways of dealing with this? Do people try and run parallel stacks that don't contain real info? Or do devs setup fake accounts?

I'm not in this business so apologies if I'm missing something really obvious.

<comment><USER3> I sent an email to Uber about this. Other companies like facebook, xbox have a way to create test accounts.

</comment></comment><comment><USER4> There are a ton of bug bounties nowadays, but it's a nice change of pace to have a company give some data on backend stack, subdomains, and purpose of the services up front.

Great move on Uber's part!

</comment><comment><USER5> I would love a Marauder's Map for bug bounty programs: Show me who is working on what, where they're finding bugs, and help me identify where I can most efficiently spend my time. Lots of 'feel bads' if I report a bug that's already been reported, and thus don't get a payout.

<comment><USER6> I am currently working on bug discovery for every big company. You should probably stay away to avoid feel bads.

<comment><USER5> oh, i know -- i got spoiled working at matasano where we'd usually get the first crack.

</comment></comment></comment><comment><USER7> How about UX bugs

Like:

1\. Messages to drivers are apparently not through uber?

It seems like sending a message to a driver happens through SMS rather than through uber itself. This seems to result in driver not seeing message. Had that happen twice yesterday. Told driver exactly where I was. Driver gets lost and calls me and from conversion it's clear he never read the message.

2\. Can't change your pick up point.

Ran into this yesterday. Was waiting near corner of franklin and market on market on the outbound side wanting to go to sunset area. Guy doesn't read message which specifically said turn right on market (he was on Page that lets you turn right onto market). Instead he crossed market which at that point I had to cancel the ride because it would have been another 10 minutes for him to drive the 10+ blocks to correct his mistake

That led to getting driver #2. He was coming down Gough so in the interest of making it easier for both of us I walked up to Gough. I wasn't able to change my pickup location. I messaged him that I had moved to gough and market. He called when he got to franklin and market making it clear he didn't get my message.

<comment><USER8> As an uber driver, I've never had any problems messaging passengers or receiving messages. I prefer that they go through my SMS.

The pick up point issue I have had on multiple occasions. Mostly it's that the customer enters a bad pick up point or the pick up point they enter for some reason on my end is a house or two down. When it's an apartment building the pick up point directs me towards the back of the building. But a lot of common sense and knowing my city well goes a long way.

<comment><USER9> This is particularly annoying when you travel abroad and the driver may not be capable of sending messages to a US phone number.

<comment><USER10> Have you ever actually experienced that?

<comment><USER9> Yes - I was visiting India last year and used Uber (ubiquitous and cheap in major cities there) and noticed that the drivers had trouble finding me. One or two of them told me that they tried to call my number (a US number on T-Mo) and their plan didn't allow it.

</comment></comment></comment></comment></comment><comment><USER11> The going rate for critical bounties is way too small. It's upsetting to see a company worth $10+ billion offering $5k - $15k when it comes to the protection of their user's information. Just earlier this month Facebook rewarded a paltry $15k for a bug that could unlock any user's account. That sort of information in the wrong hands or resulting in a massive PII leak will cause a few orders of magnitude higher in damage to their market cap and goodwill.

And I say this from personal experience. Two years ago I submitted a bug to a $10B+ public company which revealed the personal information (email, name, home address, phone) of ~145M users and they offered $10k. Another recent example to a $50B+ public company via HackerOne that exposed the same sort of data for ~77M users. They paid out $1k. I assumed they had left off a 0, but nope, they actually told me $1k was higher than their normal bounty due to the severity. Submitted a bug to a publicly traded food delivery company in the UK, which revealed detail order history (customer name, address, email, phone, partial CC #) for their entire platform. They offered me £500 in food delivery credit. All of my submissions have been purely in good faith and nothing at all resembling extortion, but I assure you there are thousands of bad actors out there far more skilled than I.

And there's plenty of legal outlets for this information (depending on how it is accessed of course). Local governments and Lyft would love to know ridership usage details about Uber.

<comment><USER12> > paltry $15k

The tech/security community is crazy.

<comment><USER13> No. YOu have to compare that number to how much you could get for that exploit on the black market. 15K seems cheap for a critical bug on a major platform.

<comment><USER14> For many qualified technical people, $15k + recognition is worth more than $500k + guilt + possible prison / looking over your shoulder for years.

<comment><USER15> Well the parent seemed to miss the point -- the real calculus is cost to the company if the exploit were to be used effectively, monetary benefit to the person who finds the bug, and the recognition you'd get in the blackhat community.

<comment><USER16> Yes the payout calc by company is cost to the company of an exploit, but with a repeated game scenario.

i.e. you can't look at the bug and payment in a vacuum, you have to factor in future bugs.

So the cost is the value to the company for the exploited bug if used properly plus the expected value of future bugs.

Which is weird, right? This shows companies can be internally incentivized to reduce bug bounty payments to show 'they are improving' when in fact, developers are leaving their bug bounty program.

</comment></comment></comment></comment></comment></comment><comment><USER17> So the first 'season' of the bug bounty is 90 days long, and to qualify for payment you need to find 4 bugs before you can be eligible for payment? That seems initially quite off putting.

<comment><USER18> I had to read that part twice as well. It seems that it's in addition to whatever they are offering 'per bug' \- you basically get a 10% bonus on the average of everyone else's payouts.

So for example:

Bug 1 - $2k

Bug 2 - $3k

Bug 3 - $6k

Bug 4 - $1.5k

Bug 5 - $2k + 10% of total commuity average payout as bonus

<comment><USER17> Yeah I've looked around and can't quite follow it.. The rest of what they have set out is really interesting though.

</comment></comment></comment><comment><USER19> Laying out all their services and telling you what each runs on...ballsy. It's the electronic equivalent of telling strangers where you live and who built the house.

<comment><USER20> Security through obscurity will not get you very far. This map just removes that false protection and potentially gets more bug hunters' eyes on their services.

</comment></comment><comment><USER21> As someone whose not really familiar with Uber except at a high level overview kind of way, does anyone know their reasoning behind not wanting a path from email to uuid as a unique concern to them?

<comment> jon-wood My guess is that they're trying to avoid people who've acquired a list of email addresses being able to trivially work out which of those addresses have Uber accounts. With that information one could target only those accounts with phishing attacks and the like with potentially fewer people flagging those emails as suspicious.

</comment></comment><comment><USER22> "What to look for" part sort of did not make any sense. If the security engineers at Uber has a sense of where the vulnerabilities might come from, they might as well seek those themselves.

I don't think anybody would say "oh yeah we were expecting some security bug to arise from this code". I thought the point of security issues is, they show up from places where you wouldn't even expect. I might be wrong.

<comment><USER23> I took more as them saying "these are the things we really don't want to have bugs, so if you find them we'll pay well"

</comment></comment><comment> jon-wood As an almost complete beginner how would I get to the point of being able to consistently find security issues where they exist? I've got enough experience as a developer to avoid the most common vulnerabilities, but I don't really know how I'd go about approaching things from the other direction to surface potentially undiscovered issues.

</comment><comment><USER24> It shows quite a bit of wisdom that they've acknowledged the internal undocumented mobile API to be the greatest surface area for attacks.

Even if they are certificate pinning, aren't there jailbreak ways to disable that?

</comment><comment><USER25> Only $10k for a remote code execution bug?</comment>


This popular teen app is quickly turning into Chatroulette 2.0 - <AUTHOR> https://www.cnbc.com/2017/08/03/popular-teen-app-monkey-turning-into-chatroulette-2-point-0.html <comment><USER2> The Not Hot Dog protocol in action!</comment>