Drinking 3-4 Cups of Coffee Is "More Likely to Benefit Health Than to Harm It" - <AUTHOR> https://www.sciencedaily.com/releases/2017/11/171122190659.htm <comment><AUTHOR> I'm going to go out on a limb here and state a theory I've been considering for a while that could explain these coffee health benefit results...

The liquids I and everyone else consumes can be placed in two classes: pure water and everything else.

When I'm not drinking pure water, my drink of choice is usually coffee, of which I drink about 3 cups a day.

Now let's think of the alternative non water drinks out there... Many of them are sodas which have obscenely high sugar levels, just like most drinks that aren't pure water.

Someone who doesn't drink coffee may have more of these sugar containing drinks when they're not drinking pure water, inundating their bodies with harmful amounts of sugar.

So the benefits we see from high levels of coffee consumption come not from the coffee itself but from a substitution effect of replacing unhealthy sugary drinks with coffee.

A good test for this would be to see if tea drinkers also experience health benefits similar to those seen in the study. If not then that may indicate that my theory is wrong.

<comment><USER3> Here's another theory. Coffee makes you move more. Moving is healthy. Think of how coffee gets people off their desks to get it and also because of the caffeine and the need to urinate after. Its unlike other drinks as people don't carry it in bottles, it requires more movement. Maybe the sedentary lifestyle is what's killing people.

<comment><USER4> Coke and Meth also make you move more ... not sure I'd call those health supplements.

<comment><USER5> Could have sworn i have seen old ads for meth as a diet pill...

</comment></comment></comment></comment><comment><USER6> In about 100 years, people will realize that this kind of research doesn't actually work.

Here's the problem: the human body is an immensely complex system, with millions of factors influencing its status and well-being. Untangling these factors correctly and producing an accurate and sophisticated statistical theory of the body would require a comparably large number of parameters - <USER2> the order of millions or more.

Unfortunately, modern medical science relies on low-N observational or clinical trials, with N on the order of hundreds or thousands. In this radically low-data regime it is impossible to justify the use of complex models. If you try to use a complex model, you will just get overfitting. You can use a simple model to avoid overfitting, but there's no reason to believe that a simple model will produce a good approximation of the underlying dynamics.

<comment><USER7> I've never understood this phenomena myself. Those who do this kind of research on a daily basis must have been rather smart to get their job. Surely, they must be intelligent enough to realize that what they do does not really add up to much?

<comment><USER8> Publish or perish.

</comment></comment></comment><comment><USER9> I think this kind of information is funded by the caffeine industry. This is pure insanity. It took me a month to quick coffee (IT professional here) and to stop hating my life. Another 5 months to finally get completely over it where I didn't feel like I was dragging every day.

Now, I am free from coffee addiction and happy as I have ever been. No way in hell is that stuff good for you.

Read Caffeine Blues, it will wake you up for real.

[https://www.amazon.com/Caffeine-Blues-Hidden-Dangers- America...](https://www.amazon.com/Caffeine-Blues-Hidden-Dangers- Americas/dp/0446673919/)

<comment><USER10> Yeah, what I find weird is this:

[https://en.wikipedia.org/wiki/List_of_coffee_chemicals](https://en.wikipedia.org/wiki/List_of_coffee_chemicals)

More than a thousand chemical compounds in coffee, area of active research. Does this imply that we don't know much about coffee yet?

And more anecdotally, what I find weird is that when I switch from coffee drinking to tea and soft drinks, there seems to be no amount of caffeine intake that make the withdrawal symptoms go away. For me, there certainly is something in coffee besides caffeine that hooks me.

<comment><USER11> There are more than a thousand chemical compounds in anything you eat that came from nature.

</comment></comment></comment><comment><USER12> We all have gene in our liver for making enzyme that breaks down caffeine. Due to small genetic differences, some of us have enzyme that breaks down caffeine quickly and others that breaks it down slowly. If you win genetic lottery and produce enzyme that breaks down caffeine fast then you flush out caffeine and end up reaping benefits of antioxidants found in coffee beans. If you have enzyme that breaks down caffeine slowly, caffeine hangs around longer causing health problems. That's all there is.

<comment><USER13> Do you have a source for this?

<comment><USER10> [https://en.wikipedia.org/wiki/CYP1A2](https://en.wikipedia.org/wiki/CYP1A2)

<comment><USER14> Where on this page does it say that having this mutation makes coffee less harmful?

</comment></comment></comment></comment><comment><USER15> So the article touched on this briefly but I think it's a point worth exploring: a big problem with many sources of caffeine is also that sugar confuses the issue. Many people have an excessive amount of sugar with their coffee (personally I find coffee revolting and 4+ sugars is the only way I could cope if I were forced to drink it).

Other caffeinated drinks (eg sodas) are either sweetened (sugar or HFCS or have artificial sweeteners.

So about a month ago I decided I was drinking too much caffeine. I'm talking 600-700mg a day. I should also point out that my variance with and without caffeine is pretty low. In college for example I tried once to take caffeine pills to stay awake to cram. Not sure how much I took but it was enough that my hands were shaking. I still fell asleep just fine. Some people really do seem a whole lot more sensitive to this than I am.

Anyway, my reason wasn't coffee in particular but sugar. For years I've drunk artificial sweetener sodas and ignoring any other possible side effects I think the big problem is that they still taste sweet so it seems like they still feed the craving loop for sugar without containing any sugar.

It's early days yet but I think I can already notice some difference. Like I had ice cream tonight that I've had many times before and it tasted too sweet.

Anyway I think it's impossible to talk about caffeine consumption without also considering sugar consumption because they really do go hand in hand.

Caffeine is a stimulant and seems like it can be used to enhance some activities including athletic ones [1].

[1] [https://www.theatlantic.com/health/archive/2014/03/how- athle...](https://www.theatlantic.com/health/archive/2014/03/how-athletes- strategically-use-caffeine/283758/)

<comment><USER16> > Anyway I think it's impossible to talk about caffeine consumption without > also considering sugar consumption because they really do go hand in hand.

Not for everyone - there are people who drink coffee black with no sugar (especially espresso drinkers).

<comment><USER17> Yep. I only drink black coffee, no sugar, and I don't eat sweets, cookies, or anything. In fact, I mostly don't consume anything but coffee from I wake up until dinner time, 6-7 PM.

<comment><USER18> So you're repeatedly having coffee on an empty stomach? That can't be good for you.

<comment><USER17> Haven't noticed any of the supposed side-effects doing so could cause. For a while, not eating for hours was also supposedly bad for you. Then fasting started to show benefits. It turns out traditional dietary advice might not be worth jack shit.

[https://www.coffeeandhealth.org/topic-overview/coffee-and- di...](https://www.coffeeandhealth.org/topic-overview/coffee-and-disorders-of- the-stomach/)

One study found a slight increase in acid reflux when drank on an empty stomach, a problem I don't have, other than that there does not seem to be any associations with gastritis, ulcers, or dyspepsia.

<comment><USER18> Yes, intermittent fasting is said to be quite good for organisms. Maybe a form of hormesis. I'm unfortunately not in a position to comment much on caffeine's health effects aside from various interesting and likely true points of speculation but I find what you shared interesting and do not doubt for a second that medical science (including nutrition, and immunity) is not properly understood except by a rare handful who have the ability to see things whole.

<comment><USER17> I believe coffee has a lot of beneficial properties, but I have a slight concern regarding caffeine as it reduces CBF. That might impair cognitive functions. Supposedly you can mitigate some of the vasoconstriction with flavonoids.

[https://www.ncbi.nlm.nih.gov/m/pubmed/19219847/](https://www.ncbi.nlm.nih.gov/m/pubmed/19219847/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Observation: Coffee studies often report (in headlines and abstract and body) consumption in terms of _cups_.

At best, this refers to a standardized 250 ml or 8 oz measuring cup (unfortunately, still rarely what "a cup of coffee" generally means to those who read these headlines and adjust behaviour as a result).

At worst, the term is used to allow for ambiguity and variance expected in self-reporting.

I recognize there are many other variables that are even harder to measure than beverage volume, like mg of caffeine or diterpenes or antioxidants. But "cups" just seems so loose.

Related question: Is there a somewhat accurate amateur method of measuring caffeine content? I vary my beans and roasts and method a fair bit for fun and taste. e.g. various beans, light vs medium vs dark roasts, varying apparatus, mass of beans per "cup", filter types, and brewing time. I would like to have insight into how much caffeine I'm consuming.

<comment><USER20> Ahh, now here comes the fun part. There is no standard.

250ml is 8.5 ounces. Some places in Europe standardized on this.

A cup of anything else is 8 ounces.

A "cup of coffee" (the actual unit) is 6 ounces, and this is the standard everywhere where 250ml isn't, and we're not in Japan; but even though the US follows the 6 ounce standard, the USDA considers a cup 8 ounces on their nutrition table.

Japan has standardized on 200ml (or about 6.7 oz).

What SHOULD be measured is _not_ liquid volume, but bean weight (measured in grams; even Ameicans measure it in grams when they're the type to weigh it instead of just throwing ambiguously heaped tablespoons in); and _then_ shifted according to that blend's particular caffeine content (outside of specialty products with high-caffeine bean variants, caffeine content can vary about +/\- 50% depending on the origin of the beans (roasting does not effect caffeine content meaningfully, although the myth lives on)).

</comment></comment><comment><USER21> There's enough anecdotal evidence here to fuel a study in it of itself. I'm surprised there isn't an app out there where you can opt into any number of studies. Surely there's potential for an app like this.. Anyone want to get together and build it?

* edit - maybe it's just an app where you like 'Facebook' all your medical history, and post daily diets, health issues like headaches, acne, etc...

All the data is public and accessible by anyone to trend. There would be no usernames though, everyone just has a guid and all the guids can find people like themselves and chat with anonymity.

<comment><USER22> Open for massive fraud as an elective system which might be very damaging for the endeavor itself and could completely discredit it.

<comment><USER21> We have an open position for you on the team to use machine learning to root out fraud ;)

</comment></comment></comment><comment><USER23> I only drink one cup per day and I only started when I was in my early 30s so I guess I'm not getting much out of it.

Some people like me are very sensitive to caffeine. I wonder if we the jittery ones process caffeine slower and could that be a disadvantage.

Acrylamide due to roasting isn't a great thing either.

Hot liquid ingested every day may be a risk for throat cancer. [https://www.cancer.org/latest-news/world-health- organization...](https://www.cancer.org/latest-news/world-health-organization- says-very-hot-drinks-may-cause-cancer.html)

<comment><USER24> Your link's first paragraph states coffee is usually consumed at temperatures below the risk threshold. A couple paragraphs later is states that coffee has been removed from their list of beverages they're worried about.

<comment><USER23> But that information seems to change every few years. The acrylamide is the newest twist created during roasting, even cold brew can't escape acrylamide.

For me, I have to be careful drinking coffee because I have GERD if I drink too much coffee my throat spasms and at night I cough up stomach acid while asleep. It gets into my lungs and over time damages lung tissue.

Even for coffee roasters, the people near the coffee are at risk of lung damage from whatever roasting coffee emits. [https://www.jsonline.com/story/news/investigations/2017/09/2...](https://www.jsonline.com/story/news/investigations/2017/09/26/cdc- finds-workers-coffee-facility-wisconsin-increased-respiratory-symptoms- abnormal-breathing/699422001/)

</comment></comment></comment><comment><USER25> I wonder what the health benefits are for different caffeine metabolizers (i.e. for different CYP1A2 genotypes). The source article only mentions that slow metabolizers have a higher risk of hypertension, but is that outweighed by the other benefits?

</comment><comment><USER26> 4 cups of coffee in a row don't do anything to me and adding more makes me asleep. I guess I am one of those for whom coffee is just one of ways to stay hydrated and nothing else. Similarly alcohol, it doesn't affect my thoughts just coordination, I am not more open/brave/socially whatever with it. I guess I should be a monk...

<comment><USER27> I used to be like that until my 30s but suddenly it changed. Now I can't sleep if I drink just one cup. It also makes me uncomfortably hyper.

</comment></comment><comment><USER28> Many people in this thread are sharing that coffee/caffeine doesn't work for them, and then others are replying that it must not be true, there's scientific evidence!!11 Look, one scientific study doesn't mean it will work for everyone. It's very likely that there is plenty of counter evidence available, as with almost every study. We all live by our own personal guidance, and that's fine if it doesn't hurt anyone. Coffee or not, it's great what works for you. But those replying here saying that person's personal experience mist be wrong, are just rude and ignorant.

<comment><USER29> This isn't just one study, it's a meta-analysis of "over 200" studies.

</comment></comment><comment><USER30> If I drink that much caffeine I get _very_ sensitive to anxiety attacks.

<comment><USER31> Yeah I used to think anxiety attacks were something I could not get, but then I got into a stint of drinking 1 (!) cup of coffee daily when I was under pressure to get some boring work done, and made a habit out of that for maybe 3 months.

During those months, I experienced anxiety attacks for the first time in my life. I did not realize at first that long term (for me, 3 months) coffee consumption slowly helped drive myself towards constantly doing more than I realistically had the energy to do, somehow triggering these very anxietic episodes couple of times, where I was feeling like I was in danger, it was hard to breath, and I was panicking, I really didn't know what was happening.

Later I realized coffee did this. There are studies of coffee putting the body into a state of fight-or-flee constantly, rising the heart rate and making people very jumpy, so that might explain why this happened.

Also, I've been noticing that drinking coffee tends to over focus my focus on one task and not see to whole picture, so it is very easy to go in one direction too far with a project for example, and just start fine tuning whatever little details come at me, when more better would be to see the big picture again and change directions.

I can hardly see how coffee is a good thing on a global scale, except for the work force who want to do stuff that is not otherwise interesting.

</comment></comment><comment><USER32> Drinking decaf ~one week a month is a good way to reset your tolerance

<comment><USER33> This doesn't make sense. Caffeine has a half time of 4 hrs (3-7 according to this source [1] but lets assume 4 for the sake of argument). So if you consume a cup, in 4 hours, you got 50% of caffeine remaining. If you then drink another cup, you go from 0,5 to 1,5 and after 4 more hours you are on 0,75 which is 75% of your first dose. We're then 8 hours in the day. 12 hours into the day you're on 0,375 and at that point you're winding down.

If you'd drink one week a month decaf (assuming you can enjoy the taste. I dislike it) you get caffeine withdrawal the first day, and the other days you don't. But as soon as you start consuming coffee again, you also get withdrawal symptoms because the half time is ~4 hours.

The way I deal with it which is the correct way is limit coffee intake to 2-3 cups a day in the morning/afternoon. None in the evening because it will cause sleep deprivation.

[1] [https://en.wikipedia.org/wiki/Caffeine](https://en.wikipedia.org/wiki/Caffeine)

</comment></comment><comment><USER34> Personally, I've found drinking that much coffee is very likely to give me headaches, and has even given me a couple ocular migraines over the years (not fun). Not to mention making me feel terrible once the caffeine starts to wear off in the evening.

Add in the caffeine withdrawal afterwards, and I've decided that it's best to just avoid caffeine altogether. Overall, I feel like I have more energy now... but it does require being more careful about getting enough sleep.

<comment><USER35> Haha for me it's the opposite. Caffeine cures my migraine the same way rizatriptan does. They are both vasoconstrictors and help reduce my throbbing migraine.

</comment></comment><comment><USER36> Go easy on the coffee. You'll discover it has caused you acid reflux, long after you can do anything about it.

Also: sugar masks the flavor. Good coffee tastes best with just cream.

</comment><comment> open-source-ux There's an excellent, clear summary of this study on the NHS website:

[https://www.nhs.uk/news/food-and-diet/drinking-3-4-cups- coff...](https://www.nhs.uk/news/food-and-diet/drinking-3-4-cups-coffee-day- may-have-some-health-benefits/)

</comment><comment><USER37> I feel like I have a real problem with some scientific studies on the human body, which apparently link things to specific outcomes and later on reverse those links and sometimes even linking the opposite to the same outcomes. As a researcher myself, but not in a biological field, I believe more and more that it is just insanely difficult to understand the complex interactions inside our bodies. This doesn't mean that I'm against this type of research, on the contrary, we need more and more studies.

<comment><USER38> Right, so it is 11 a.m. - who is for coffee? So I pick up the tray, go down to the kitchen, make everyone a cup of tea/coffee/defac-coffee and pick up a can of some fizzy drink for that guy who lives off energy drinks instead of coffee.

In the kitchen I have a joke with the guy from accounts as well as have a really positive buy-in for the new 'aggregated accounts' plan. I have some chat with the cleaning lady, she smiles, I smile. Someone else gets doors for me, I say please and thank-you. Finally beverages get served by me to my colleagues. Everyone is happy.

On the way to and from the kitchen I have got the blood circulating, not a very big walk, certainly not a gym workout, but all moving is good in the sedentary office world. Yes, it does take a lot of muscles to smile, and just with the light convo needed to get to the kettle and sink I have had a little workout. Unlike press-ups I can put my heart into a smile.

So what happens if I am in a mood and can't be bothered to make tea for the rest of the team? I sneak into the kitchen and make a coffee just for myself. Or if it is the weekend and I am home alone, with no interaction with people during the consumption of coffee.

On aggregate I do make coffee and it be a social thing rather than a loner thing. We are social animals and the act of sharing coffee is probably better for our well being than whatever is in the coffee. I don't think it is possible to do studies without the bigger social picture.

So could claims that 'coffee is good for you' stack up, even with the above?

In my anecdata there is also the girl I sit next to that is not in the 'tea round system'. She makes her own drink, and will tend to have a jogger style water bottle at hand at all times. She will also make her own infusions - ginger tea etc, but not a round for everybody. Because she just serves herself then she is not in the kitchen for as long as me, not needing to converse to complete the task (no tray). Furthermore, she does not get to greet everyone in the team, or to have that special thought for them, e.g. mug colour preference, tea/coffee strength etc.

So, anecdata, but, if coffee and the sharing of coffee is important, then the claims that 'coffee is good for you' could stack up but it not be causation/correlation on the caffeine, even if that appears to be the case.

</comment></comment><comment><USER39> Can coffee still be more beneficial than harmful if you suffer withdrawal effects? I have some co-workers who get headaches if they try to have a morning without coffee.

<comment><USER40> That's a known thing. Drinking coffee blocks adenosine receptors (which affect tiredness). In result, they increase in number to compensate that. So if you stop drinking coffee, the increased number of receptors causes more intense feeling of tiredness. If you stop drinking coffee for a long time, the number of receptors adjusts back down.

</comment></comment><comment><USER41> previously: [https://news.ycombinator.com/item?id=15679522](https://news.ycombinator.com/item?id=15679522)

The relative risk vs coffee consumption curve fist goes below 1.0 (no coffee = 1.0) and reaches minimum around 3-5 cups then starts to increase slowly again. cardiovascular disease and stroke risk go above 1.0 after 9-10 cups per day.

The study mentions that results may not apply to unfiltered coffee (eg, French press, Scandinavian boiled, or Turkish/Greek coffee). Other studies have shown that cholesterol-raising factor in coffee does not pass a paper filter.

NOTE: Cholesterol increasing effect in coffee is not from dietary cholesterol. It comes from cafestol and kahweol (diterpenes). They seem to have adverse effect to cholesterol regulation in the body, [http://www.annualreviews.org/doi/10.1146/annurev.nutr.17.1.3...](http://www.annualreviews.org/doi/10.1146/annurev.nutr.17.1.305)

</comment><comment><USER42> Consider supplementing drinking coffee with taking l-theanine. You can read more about the benefits at [https://www.reddit.com/r/Nootropics/wiki/beginners/](https://www.reddit.com/r/Nootropics/wiki/beginners/)

Magnesium replenishment also helps, esp. with >2 cups of coffee / day.

<comment><USER31> L-Theanine is great when combining with coffee, but at least for me when I've experiment with this combination, if doing it routinely, it really can start to deplete maybe the serotonin levels or something in my brain, because I start to feel more dull in a way, it's hard to describe, it's kinda like this slight fuzziness.

Just for more info, I've been experimenting with 200 mg of L-theanine combined with one cup of coffee. Not something I would take in long periods, but definitely useful for those stints where you just have to get something done and need the stimulants.

L-theanine is good also for relaxation alone, and calming the nerves down, I sometimes take it by itself if I feel too anxious also.

<comment><USER42> That's interesting, your findings are contrary to what's generally reported. I haven't found data confirming any negative side effects for l-theanine including prolonged use. I suppose it all depends on an individual and dosage of all stimulants.

<comment><USER31> Yeah, it's interesting to hear that people have no side effect. It's not anything really substantial, but there is definitely some side-effect. I'm used to being really sensitive to any substances though, for example I couldn't drink 3 cups of coffee a day, that would drive me totally hyper.

But after all, that calming effect has to come from somewhere with L-theanine.

</comment></comment></comment></comment><comment><USER43> We seem way too focused on whether coffee is good or bad for our health.

All I know is it tastes fucking delicious, it makes me feel good, and we've been drinking it for generations. If I die earlier because of it, then so be it. At least I'll have had an enjoyable coffee-drinking life.

<comment><USER44> > If I die earlier because of it, then so be it. At least I'll have had an > enjoyable coffee-drinking life.

On the other hand if coffee drinking causes strokes you could live for years with severe impairment.

<comment><USER43> I'll take my chances and just not worry about it :)

I don't think I've ever heard of a person in old age lamenting, "If only I hadn't enjoyed coffee so much!"

Cigarettes on the other hand...the effects of those are a lot more clear-cut.

</comment></comment></comment><comment><USER27> I don't know. When I drink more than 2 cups my sleep suffers and even my personality changes. I get pretty hyper and less patient. With my girlfriend I can tell immediately whether she has had coffee just from the way she talks.

<comment><USER45> Try to cut off the caffeine consumption by 3pm and your sleep should not suffer (based on the half life of caffeine and average human adult body weight).

Disclaimer: I consume ~4 cups of coffee per day between 8am and 3pm and get ~8 hours of sleep per night.

<comment><USER46> The CYP1A2 gene affects how quickly you metabolize caffeine. Stopping at 3pm may not be enough.

<comment><USER45> I'll check my CYP1A2 SNPs on 23andme in the AM and report back.

<comment><USER47> I'm not sure if that's sarcasm or not. Maybe I'm just not hip.

<comment><USER45> Not sarcasm at all. Last time I checked, 23andme reports if you're a fast or slow caffeine metabolizer. I just don't recall offhand which I am.

</comment></comment></comment></comment></comment></comment><comment><USER48> How big is a "cup" of coffee in this study?

<comment><USER49> Typically my "cup" measures 2 cups based on the coffee pot.

</comment></comment><comment><USER50> I hope 10 cups a day are ok :)</comment>


Ask HN: How do you know you are still in early market? - <AUTHOR> I just recently started to realize that the question is much deeper than it seems at the first glance.
Imagine you are in the middle of 1990s, looking at the Internet
you may think it's already done/finished and there is nothing big you can invent. You have perfect Netscape browser and very convenient Yahoo along with cool AltaVista.
If you were being told about yet another brand new search engine (Google),
you may think - why those guys are wasting their time, there is no chance to beat Yahoo.
Yet, Google became monopolist amongst search engines.
Then you watch how dot-com bubble burst in 2000.
Then you may think, the Internet is done for sure. There will be no second company which grow as fast as Google did.
Then, you will observe rise of Facebook. In the beginning you won't believe it could grow THAT big, after all it looks like match.com for Harvard students.
Then you will discover somebody wrote Bitcoin. You won't even recognize it's a currency
because it's just tokens in p2p network with no connection to real world.
Then after reading stories about Silk Road,
you finally started understanding that you can use as a currency literally anything
as long as it hard to reproduce and in limited supply.
But watching Bitcoin crash in 2011, you may think that Bitcoin reached its limits.
In beginning of 2015, you would think crypto-currencies are just a bubble. Nobody in their right mind would spend their time and effort to create yet another crypto-currency.
Yet, Ethereum started in 2015 and quickly become the second largest crypto-currency.
I tend to always think it's too late and market is already done.
So returning back to my question: How do you know you are still in early market?
As an answer, it would be awesome to have some references to insights from some founders or VCs. <comment><USER2> Hindsight is 20-20 but does not swivel forward.

One strategy is to make a habit of staking odd, unusual or long-sighted ideas. You would lose 9 out of 10 stakes, but hopefully the tenth would cover the losses.

I found out about bitcoin around 2010, back when they were still almost CPU- mineable and cost a dime a dozen, and mined a few "just in case they would become galactic credits or something". It sounded like a bizarre idea, but i couldn't think of any solid reason why it can't just became money one day. Later, i got a bunch of Ether because i had a habit of collecting altcoins, and it seemed like something unusual compared to the meaningless forks abound back then.

Sometimes you need to understand the tech. I groked the idea of cryptocurrencies quite early, because it's just math and code. But i wasn't aware of Facebook's existence until around 2014, because social networks were some bizarre, unsearchable chat-forum mutants with zero information content or conceivable uses. Even though i am as old as Zuckerberg and had all the knowledge to make one, an idea of social network would never have occurred to me.

So, there is some degree of personal alignment and aptitude - if you are not in a certain field, it's hard to get what can have traction and what can not, but if you are familiar with a field, you can detect unusual ideas with potential more often than not.

TL;DR: Kinda sorta something like that, no real answer, didn't meaningfully succeed at it either.

</comment><comment><USER3> We are constantly falling into the trap of thinking "everybody knows this" or "that's obvious", whether in business or in technology.

So one way to answer your questions is to turn it upside down.

How do you know the market is very mature?</comment>


Need drug list for my app - <AUTHOR>

Folks,
I am looking for an api based or free drug reference in my app?
I have tried to find out using google but no luck , some can help me out? <comment><USER2> You can download and use data from Drugbank freely, but you need approval to use it in an app: <http://www.drugbank.ca/downloads>

<comment><AUTHOR> Thanks for the link, will give a spin</comment></comment>


Coronavirus May Kill WeWork - <AUTHOR> https://www.forbes.com/sites/amyfeldman/2020/03/17/coronavirus-may-kill-wework/ <comment><USER2> I think it's obvious that WeWork collapses as a result of COVID-19. Their model will be slaughtered not only by work from home orders, but also from the sharp decrease in tenants when millions of self employed are no longer self employed and are cutting their costs. A receivership and restructuring awaits in the coming months.</comment>


Ask HN: Are online free sms services illegal?  - <AUTHOR>

There dozens of sites for sending free online sms worldwide. Most of them are ugly websites with tons of ads, looks like they are built in 5 minutes. But the service works. I follow them,  after sometime they shut the service down, something happens. I don't know why, and I'm not sure how do they do it.<p>In most of countries SMS is very expensive and there is no way to send SMS for free. I'm sure there are millions of people would use this kind of service. Would it be possible to build a paid service for sending SMS worldwide? Is there any legal way? I know that there are some API services like Twilio but they are too expensive. What do you think? <comment><USER2> Though I am unable to answer your question of whether a legal and profitable SMS system can be built, I'd like to point out a hidden answer in your statement — "after sometime they shut the service down, something happens. I don't know why"

Most of these "ugly websites" are fly by night operators. They are spammers looking for in-use phone numbers to build a database. The database then could be used to send bulk spam SMSes or could be sold to tele-marketers for a profit. So essentially these websites never make any profit from actually sending the SMS but instead scam the users to share their phone numbers.

Now you know why!

</comment><comment><USER3> I was thinking about this a few months ago, but I couldn't find a way to make it affordable.

Showing banner ads doesn't seem to be enough, since the cost to send one SMS is greater than the profit from one banner. Perhaps that's why those sites had so many banners?

<comment><AUTHOR> I don't think that they use a paid API to give the service. They somehow have a free access for sms sending. But most of them get banned after some time.

Actually if there would be a legal way, it can be very good business model. For example; 1$ monthly subscribtion for 1000 sms worldwide monthly. There some voip services, but they are too expensive.

</comment></comment><comment><USER4> I'm using this service <http://smssheep.com></comment>


Programming Steve Reich's Piano Phase in SuperCollider - <AUTHOR> https://www.ezralafleur.com/programming-steve-reichs-piano-phase-in-supercollider/ <comment><USER2> And here is a "Piano Phase" written in C with no libraries that fits in an (old-style, 140 character) tweet:

main(){int l=999,i,j;int v[]={133,119,89,80,75,119,113,80,89,119,75,80};for(;;){putchar(250*(j++%v[i%12]&&(j+i)%v[i%12]==0));i+=(j%l)==0;}}

Just compile and run that with "a.out | aplay".

It's been a while since I wrote this, and I remeber cheating a bit somewhere, but not surprisingly I can't figure out what it's doing much less how it's cheating.

<comment><USER3> that's funny

</comment></comment><comment><USER4> For those not familiar with Steve Reich's music, it makes great programming music, in my opinion. Melodic, repetitive, propulsive and most pieces lack a foregrounded instrument vying for your attention.

Some favorite pieces of mine are:

      - New York Counterpoint (esp the version with Evan Ziporyn on overdubbed clarinets)
      - Electric Counterpoint (esp the version with Pat Metheny on overdubbed guitars)
      - Different Trains
      - Variations for Winds, Strings and Keyboards
      - Tehillim (probably not good coding music)

The 5 disc Nonesuch retrospective is a really great entry point / survey.

<comment><USER3> I would add Music for 18 Musicians.

EDIT: here is my favorite recording of this masterpiece by ECM: [https://www.youtube.com/watch?v=ILpCKQlDmhc](https://www.youtube.com/watch?v=ILpCKQlDmhc)

<comment><USER5> and Drumming

and Come Out

Drumming is fascinating to watch players perform

Come Out has amazing analog audio tape phasing

<comment><USER3> It's all on the aforementioned Nonesuch Retrospective.

</comment></comment></comment></comment><comment><USER6> I have a peculiar reaction to Reich's music. Part of my brain thinks it's silly, but another part is thrilled.

</comment><comment><USER7> Off topic, but possibly the people here might be able to help: Is there a name for the type of music where the theme evolves over time. Not (obviously) repeating, no echoing on another instrument, just progression. The bass line in Free's Mr Big ([https://youtu.be/Azkef2lXW88?t=282](https://youtu.be/Azkef2lXW88?t=282)) is the classic example for me. Is it a one-part fugue? or something with no name that just happens and has no name?

I asked a musician theorist friend and he said Minimalism, but that doesn't seem quite right.

<comment><AUTHOR> The classical term for what you describe as far as overall form is concerned would be through-composed ([https://en.wikipedia.org/wiki/Through- composed_music](https://en.wikipedia.org/wiki/Through-composed_music)). For themes/melodies specifically I think they could either be repeated or not in any genre (think improvised sections vs. thematic sections).

For a more all-encompassing take on music that evolves over time and where the tie-in to minimalism might be, Generative Music as originally conceived by Brian Eno ([https://inmotionmagazine.com/eno1.html](https://inmotionmagazine.com/eno1.html)) is where it's at</comment></comment>


AppImage: Linux apps that run anywhere - <AUTHOR> http://appimage.org/ <comment><USER2> Seems unnecessarily complicated.

A script like this gets you 95% of the way there:

      mkdir AppDir
      mkdir AppDir/bin
      mkdir AppDir/data

      cp $INSTALLDIR/app AppDir/bin
      cp -r $INSTALLDIR/data AppDir
      cp `ldd AppDir/bin/app | grep -o '\W/[^ ]*'` AppDir/bin

      cat << "EOF" > AppDir/app
      #!/bin/bash
      SCRIPT_PATH=$(dirname $(readlink -f $0))
      $SCRIPT_PATH/bin/ld-*.so.2 --library-path $SCRIPT_PATH/bin $SCRIPT_PATH/bin/app $*
      EOF

(Sometimes I wonder if people make a big mystery of Linux app distribution on purpose, to discourage distribution outside of proper, secure channels.)

<comment><USER3> I think you meant "$@" rather than $*

(The quotes in "$@" are important.)

Also, your script will fall over if any of the paths have spaces in them, such as INSTALLDIR.

You should use lowercase for variable names like SCRIPT_PATH. Uppercase is for exported variables.

readlink -f $0 breaks on OS X. You must do both readlink -f $0 and readlink $0 in order for it to work everywhere.

Shell scripting isn't easy. It took a year to understand these nuances to the point that they're second-nature, and I'm still discovering new ones. Anything that improves this situation would be a welcome change in my opinion.

EDIT: cat<<'EOF' is necessary here. cat<<"EOF" will interpolate variables.

<comment><USER4> > Shell scripting isn't easy. It took a year to understand

That might make it seem like too hard for some people. It's really not that bad. These particular mistakes were beginner's mistakes.

But it _is_ tricky! I usually try to tell people to avoid writing shell scripts until you've _at_ _least_ read the "Bash Beginners Guide" or something similar. It's comparably short (remember, you're learning a new _language_ and an arcane one at that) but at least lets you avoid the easy traps. Also, indent and comment. Surprisingly many people seem to think hygiene is somehow less important outside their main language.

On a side note, what's up with not reading manuals these days? When I am tasked with something new, no matter how trivial, my first step is to at least skim the manual get a feel for what the problem domain looks like and how you are supposed to wield the tool I am about to use. Turns out nobody does that anymore. Zero, out of over a dozen people in my closest (java, web) team have read the documentation for the product we build on. I find it unprofessional, but I realize I'm the strange one and it's probably just me getting older.

<comment><USER5> > On a side note, what's up with not reading manuals these days?

The difficulty of finding manuals, and when you do, they're badly written in such a way that they assume all sorts of contextual knowledge based around the sorts of problems the author of the software was trying to solve in 1986 or whatever year. Manual writing is at least 1000x more difficult than bash scripting, because you have no way of knowing up front how the target "machine" is going to interpret your "script".

And of course that's all assuming a manual even exists at all.

</comment></comment></comment></comment><comment><USER6> What this could and should lead to is this: a separation between system packages and user applications, prefferably with two different managers.

What we have now are mostly system package managers, you want them to be stable, secure, having the latest features might not be necessary.

But we see more and more often that that distribution channel doesn't work well with applications: you end up with old, buggy, insecure applications because the distribution just couldn't keep up with the upstream update cycle. Why not have a cross-distribution application manager which distributes AppImages? That way, application distribution is an effort concentrated over all the distributions, possibly benefiting the entire community.

<comment><USER7> Not everyone has root on their Linux box and even if you do, you ought to be able to install applications as you without sudo'ing anything. Right now most Linux applications guide you to a deb/rpm which runs as root (and who knows if you can trust it).

TBH this is just the start of making applications more secure, they ought to be sandboxed too, so one application can't read the data from another application by default (similar to how phones work).

<comment><USER8> GNOME is working on it: [https://wiki.gnome.org/Projects/SandboxedApps](https://wiki.gnome.org/Projects/SandboxedApps)

<comment><USER9> You can make it slightly harder to infect the rest of the system leaving the factual truth that the moment you install malware you are hosed unchanged

</comment></comment></comment></comment><comment><USER10> I believe the core problem here (that led to containerization, application images and alike) is that correct packaging for most distros is hard.

There are tools like fpm or even checkinstall that can build simple good- enough-but-not-really packages, but I think maintaining a "proper" Debian packaging requires some pretty arcane knowledge that's spread around various pieces of documentation (and maybe I'm just stupid, but also a lot of trial- and-error).

<comment><USER11> Ranking package managers by difficulty of creating packages (1-10, lowest to highest):

1\. tarballs (slackware)

2\. Ports (FreeBSD)

3\. Portage (Gentoo, Calculate Linux)

4\. pacman (Arch, Archbang, KaOS, Manjaro, Antergos)

5\. building from source (Linux From Scratch, Most old installs eventually turn into this)

6\. rpm (Redhat, Mandriva, Scientific Linux, UnitedLinux)

7\. deb (Debian, Ubuntu, Mint/LMDE, Hanna Montana Linux)

Why Debian and Redhat-derivatives are the most popular, I'll never understand. I have _way_ less headaches maintaining custom Calculate Linux chromebooks than I ever did with fleets of Redhat or Ubuntu laptops.

<comment><USER12> The web of dependencies for both build and execution can be maddening. This is why apt-get and yum have won: they take care of finding and downloading those 3246536245 libraries which are absolutely essential for each stupid two-liner application out there. And when it comes to large software (which you probably don't manage on a chromebook), good luck downloading and compiling several GBs of KDE or GNOME source code with the right options for your hardware.

<comment><USER11> running/building a full plasma 5.5 KDE 5.x current. Full install including most office apps (Libreoffice, etc), a bunch of emulators/games (free and proprietary - steam included), and other apps.

Intel haswell/sandy bridge chromebooks with custom hard drives. I think you're greatly overestimating how difficult it is to maintain all of this on Portage. I invite you to try a distribution that isn't Debian or Redhat-based. You might never go back.

<comment><USER13> A comment like this is even better if you mention what distro you were using and maybe drop a link to a guide showing how easy Portage is to use. Then, people might experience what you describe.

<comment><USER11> I already mentioned in the great-grandparent that I was doing this with Gentoo and Calculate linux (which are interchangeable).

I try not to specifically invite people to "install gentoo" thanks to /g/. they'll find it on their own. There's a lot of learning before quickpkg makes an install take 3-5 minutes.

<comment><USER13> Gotcha. But thanks to /g/? Didn't know that existed so how would I have found it on my own? And "lots of learning" despite you having way less headaches? I'm a little confused as some of your answers inspire more questions.

<comment><USER11> /g/, the technology troll board of 4chan, has a meme of "install gentoo" whenever someone says "which is the best distribution to install for a new user?" Those users usually come back about a week later hating everyone for putting them with such a difficult OS. Calculate Linux has effectively removed most of this barrier, though, making Gentoo really easy to maintain for newbies.

The Gentoo Handbook is an amazing tool to learn linux. By the end, you have an expert's understanding of how Linux works, and how to install it without a GUI (or even a package manager). I learned it during the "Stage 1 era", when the install started with bootstrapping, then building your compiler before installing the rest of your system. Nowadays, you partition disks, format, chroot in, set timezone and encoding, untar the stage 3 tarball, emerge --sync, build your kernel (which is the hardest part), install a bootloader, install wpa_supplicant, and you're done. It's about 30% more difficult than an Arch install, becuase you probably _will_ screw up your first kernel configuration and make a nonbooting kernel, booting to a black screen. But unlike Other OS's and distros, when it breaks in Gentoo, it's probably your fault.

I have way less headaches, because chromebooks are braindead to deploy this way. flash a bios, and then install the binaries once booted off a LiveUSB. Quickpkg allows you to make binaries of your existing system (built for Sandy Bridge, until I decommission the C710's, then I'll build for haswell) with all your custom flags already set, so VLC and other apps are _far_ more robust than their Ubuntu/Redhat versions. Gentoo is also the only distro other than GalliumOS that actually has working Elan touchpads for many chromebooks (thanks to Hugh Greenburg of GalliumOS's patches that I'm maintaining for newer kernels), as the patches have not been included in Arch or other distributions's kernels.

I run a Poettering-free install (JACK instead of PA, wpa_gui instead of NetworkManager, OpenRC instead of systemd), so having one master install I can re-deploy in the amount of time it takes to brew coffee is pretty handy, especially considering de-poetterizing a new Debian/RHEL/Fedora/Arch install is painful, if not nigh-impossible, and at the very least time-consuming.

<comment><USER13> re /g/

Haha. That is pretty evil given my experiences starting with command line Linux back in the day. Far as learning, I've heard that before about Gentoo. Thought about doing it at some point. Right now, kind of mixed between learning BSD or Linux as the security enhancements I create might need to temporarily stay proprietary to support their development. BSD vs GPL you know. I mean, I'd give back bug-fixes or feature developments where possible but differentiator has to be secretish.

"But unlike Other OS's and distros, when it breaks in Gentoo, it's probably your fault."

I'm avoiding that right now but fine with the concept. Reminds me of Mentor's Hacker Manifesto we used to quote to justify such responsibility.

"so having one master install I can re-deploy in the amount of time it takes to brew coffee is pretty handy"

That is handy. I've always especially liked how the source-based distros were customized to one's own hardware. That drastically increases the initial deployment time but significantly reduces many issues along the way.

<comment><USER11> there are two solutions for reducing deployment/build time. First is to use distcc on all machines (so when idle, they contribute to the building of any packages). Second solution is to build one master image, quickpkg it, and then deploy the binaries. I use a combination of both; all binaries are compiled for sandy bay architechture, so I get _most_ of the benefits (though haswell/broadwell gets faster VLC/ffmpeg if I recompile), and they build at night when nobody's around.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> On my Linux Mint 17.3:

1\. Downloaded the app, opened Nemo and double clicked on the app. Another Nemo window popped-up and the app didn't start. Opened terminal and checked permission to find that it wasn't executable. The point of the ease-of-use is kind of lost as user would be puzzled and give up.

2\. How do I uninstall the app? Is it as simple as deleting the file? What if doing that leaves orphan files (that I don't know about) that double-clicking on the appimage file could have created? The website doesn't mention how to uninstall files?

PS: regarding #2 above, I found that right clicking on the Mint Menu entry for the app shows Uninstall option. Clicking on Uninstall removes the entry from Mint Menu. The .appimage file needs to be deleted manually separately (which kinda makes sense). I just hope it hasn't left orphan files.

<comment><USER15> As to 1.) you downloaded the app (.appimage) and double clicked on it. Why? Nowhere in any documentation does it say that .appimages are executable out of the box. In fact this is a security feature that it doesn't. IN all placves that I have seen .appimages available there is a statement that says the user has to go into permissions and make the file executable before it will run. Makes sense since most malware is made to run without user intervention. If an app doesnt need _you_ to run it, then its the perfect platform for malware/virus.

<comment><USER16> > Nowhere in any documentation does it say that .appimages are executable out > of the box.

Sure, but literally the first thing on the landing page is...

> As a user, I want to download an application from the original author, and > run it on my Linux desktop system just like I would do with a Windows or Mac > application.

<comment><USER17> On my windows box, if I download an exe, windows won't let me run it until i go and "unblock" it. So it seems the experience is sort of similar.

</comment></comment></comment></comment><comment><USER18> So every time there is glibc / openssl / anything else security update, We will have to update all appimage programs as well ?

<comment><USER19> Do you have any specific problem with that?

<comment><USER20> I'm not hrtghrth3, so can't speak for him... but..

Yes, I have a problem with that. I trust I can count on Debian/Ubuntu/RHEL will ship a new package for every critical CVE promptly, without forcing me to upgrade to the latest upstream version. I have zero faith upstream maintainers will do the same - which leaves me with two choices

1) Pretend there is no CVE

2) Use the latest app version, bringing with it all new bugs, workarounds, incompatibilities and so forth - and hey, the latest version might not even have the fixed code in it.

<comment><USER21> > I trust I can count on Debian/Ubuntu/RHEL will ship a new package for every > critical CVE promptly, without forcing me to upgrade to the latest upstream > version.

There was an article just a couple of weeks ago pointing out that distributions frequently don't fix security issues:

[https://statuscode.ch/2016/02/distribution-packages- consider...](https://statuscode.ch/2016/02/distribution-packages-considered- insecure/)

No doubt it's better for high-profile applications, but there are far more applications that people want to use than distros have the resources to issue security updates for.

<comment><USER22> Sure, you're boned if the security flaw is in the custom protocol handler of some random package of which you are one of 37 total users. Typically, however, security code does not reside in such packages. They typically link to popular libraries for e.g. TLS support. Those popular libraries are kept current by reputable distros. You shouldn't be using low-volume packages that implement their own security, anyway.

<comment><USER21> One of the packages in the article I linked above was Wordpress, which is not exactly low volume. I work on the Jupyter/IPython notebook - we found a security bug last summer, got a CVE (CVE-2015-5607), issued patches... and the version in Debian unstable hasn't been fixed, seven months later.

If distros can't do security maintenance for the software people use, claiming that they shouldn't use that software at all is no kind of an answer.

<comment><USER22> If one can't build a server app from source then one shouldn't be connecting it to the internet all by oneself. There are any number of companies who are happy to host WordPress for reasonable fees. Keeping software updated is hard work, and those who do it for free will keep their own schedules. I'm sure it's frustrating to maintain a package that's "in the middle": too popular to just say "install with pip", not enough volunteers to maintain the Debian package in-house. Perhaps that means that Debian is too accepting of packages. I don't think it's an indictment of the idea of a package manager. I also doubt that lots more free labor will appear now that there is yet another new zipfile format to keep maintained.

<comment><USER21> If building it from source is acceptable, why would using packages direct from the maintainers not be? For anything in an interpreted language, there's little difference anyway.

I agree that Debian is too accepting of packages. We don't recommend that anyone installs Jupyter/IPython with apt, and I wouldn't mind if Debian removed it from the repos. But if there are all these packages that shouldn't be distributed through Debian, we need some other way for users to get them conveniently. We often use language package managers like pip, but they're not great for desktop applications - they can't easily set up a launcher entry, for instance. That's where something like AppImage comes in.

<comment><USER22> I think it's perfectly acceptable for project maintainers to provide rpms, debs, ppas, etc. as long as those artifacts are organized in largely the same way that distro maintainers would organize them. (I doubt any distro maintainers would disagree.) I don't think it's a good idea to pack lots of already-distro-packaged libraries into those artifacts. Building for many distro formats is a pain, but I doubt that building this new format in a universal way will be easy either. If you have a different AppImage for each distro/version combo, is that an improvement?

For the packages you've mentioned, live active projects with maintainers who can produce this distribution format but can't deal with apt, maybe the giant ball of wax is okay. I won't be installing anything this way, but clearly I'm not the target user. It seems certain, however, that in future we'll be hearing about lots of vulnerabilities attributed to AppImages linking in old library versions.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Having re-transitioned last year back to the land of Free *nixen after a long stint on OS X, I marvel at how awesome package management is, and wonder how I ever gave it up. Even where I'm now forced to use OS X (work), I try to brew / brew cask everything.

The Windows / Mac distribution model feels more like a necessity on a closed system than something that is ideal.

EDIT: I realize that comment sounds more critical than what I intended. While I have a preference for package management, others clearly don't. Also, I might be inclined to use something like this for fast-moving big apps where I want the newest features. I could see trying Guile-Emacs or QGIS this way.

<comment><USER24> What OS X at least gets right is that OS-bundled software is _immutable_ , or desired to be. If you want a recent version of e.g. Python, you install separately and add it to your $PATH instead of changing the base. Then any app that depends on Python can continue using the system version.

</comment></comment><comment><USER25> I am profoundly uninterested in a third-party package manager that does not provide any sandboxing features. xdg-app has them, but AppImage does not mention sandboxing on its web site or in its README.

<comment><USER26> Well, first of all AppImageKit is not a package manager. For a comparison with xdg-app and other systems, see [https://github.com/probonopd/AppImageKit/wiki/Similar- projec...](https://github.com/probonopd/AppImageKit/wiki/Similar-projects)

As for sandboxing, this is definitely an area which we would like to add to AppImageKit, e.g., see [https://github.com/probonopd/AppImageKit/issues/77](https://github.com/probonopd/AppImageKit/issues/77) \- thoughts and pull requests welcome!

<comment><USER27> Why are you not using containers for sandboxing?

<comment><USER26> Probably just because I haven't had the time to investigate them yet. Can containers be used without the need for root access? Pull requests welcome.

</comment></comment></comment></comment><comment><USER28> I too love package management like the rest of the people on this thread but the existence of this project confirms that we have a problem, distribution is pretty hard.

<comment><USER26> Linus Torvalds addresses some core issues in his "DebConf 14: QA with Linus Torvalds" talk starting around 5:40 [https://youtu.be/5PmHRSeA2c8?t=5m40s](https://youtu.be/5PmHRSeA2c8?t=5m40s)

</comment></comment><comment><USER29> This is very similar to the approach that we took in our InstallBuilder cross- platform installers ([http://installbuilder.birock.com](http://installbuilder.birock.com)), embedding a filesystem in the executable that gets mounted at runtime. If you do it right, it can support a wide variety of Linux distributions and significantly decrease the amount of pain end users and app developers experience. Those who disagree with this approach and believe "this is not the Linux way" should take a look at the referenced Linus Torvalds vieo

<comment><USER30> Just a heads up, your link is pointing to the birock.com domain instead of bitrock.com.

This is the correct URL: [http://installbuilder.bitrock.com](http://installbuilder.bitrock.com)

</comment></comment><comment><USER31> I find it interesting in a "Post-Snowden" 2016, that the web page with details about a mechanism to produce fat executables (and links to a demo app) is not protected with SSL. Certificates were cheap before... Now they are free thanks to Let's Encrypt.

There's really no excuse for this.

<comment><USER32> The cost of the certificate is a very small part of the overall cost of a proper SSL/TLS implementation.

If you don't want to exclude older browsers, you need a dedicated IP address, or you need a system to manage putting multiple names on one certificate. Let's Encrypt is a great option for multi-SAN certificates, as long as you don't care about Windows XP users.

If you have any kind of redundancy, doing perfect forward secrecy gets much harder. The open source approaches to scaling TLS along with PFS are bleeding edge, poorly documented, and may involve writing some code.

I agree, TLS everywhere is a worthy goal. But I think it's easy to underestimate how complicated it can get, especially at scale.

<comment><USER31> > If you don't want to exclude older browsers, you need a dedicated IP > address, or you need a system to manage putting multiple names on one > certificate. Let's Encrypt is a great option for multi-SAN certificates, as > long as you don't care about Windows XP users.

This is a website for AppImage. I doubt they're targeting XP users.

> If you have any kind of redundancy, doing perfect forward secrecy gets much > harder. The open source approaches to scaling TLS along with PFS are > bleeding edge, poorly documented, and may involve writing some code.

This is simply a brochure website, so this does not apply.

For more complex applications or websites, there is a certain degree of engineering required to support HTTPS-by-default. But in today's world it is a necessity.

</comment></comment></comment><comment><USER33> One of the best things about Linux systems is having this huge pool of apps that you update centrally that are guaranteed to work on your system.

This is a backwards step, if anything.

<comment><USER26> Well, this is what Linus had to say about packaging: "I've seen this firsthand with the other project I've been involved with, which is my divelog application. We make binaries for Windows and OS X. We basically don't make binaries for Linux. Why? Because binaries for Linux desktop applications is a major f*ing pain in the ass. Right. You don't make binaries for Linux. You make binaries for Fedora 19, Fedora 20, maybe there's even like RHEL 5 from ten years ago, you make binaries for debian stable, or actually you don't make binaries for debian stable because debian stable has libraries that are so old that anything that was built in the last century doesn't work. But you might make binaries for debian... whatever the codename is for unstable. And even that is a major pain because (...) debian has those rules that you are supposed to use shared libraries." (August 29, 2014 DebConf Q&A with Linus Torvalds)

</comment></comment><comment><USER34> I'm confused and couldn't find an answer searching for "xdg-app" in AppImage's website/github. Is this a whole alternative to xdg-app, or a layer on top of it?

If it's indeed an alternative, why would anyone choose this rather than xdg- app? xdg-app being backed by fedora/freedesktop/gnome folks might mean more traction and maintenance, doesn't it?

EDIT: okay, saw [https://github.com/probonopd/AppImageKit/wiki/Similar- projec...](https://github.com/probonopd/AppImageKit/wiki/Similar-projects) mentioned below by the author, sorry for the noise.

<comment><USER21> From an application developer POV: AppImage looks like something I can use to package an application today. xdg-app looks like what I might want to use in a few years.

</comment></comment><comment><USER35> Why not just use a package manager? If the one in your distro sucks, find a better distro. (Arch Linux would be a good example.) The rule of thumb with OSes and implementing features is to avoid reinventing the wheel.

Ports-like tools work very, very well on Linux. Binary distribution works fine too. Also, the shared libraries of each application don't have to be (and usually shouldn't be!) bundled with the application.

Finally, I'm concerned about the MIT licensing, with all the GPL code floating around in that repository.

<comment><USER36> Did you read the intro paragraph on the website?

"As an application author, I want to provide packages for Linux desktop systems, without the need to get it 'into' a distribution and without having to build for gazillions of different distributions."

So you are a developer. You don't want to build gazillions of packages, but you want to target lots of users. Suppose you build a package for one distribution. Good luck convincing all your users to switch to that distribution.

I guess you are using Arch. Suppose the developer's opinion is that Gentoo's package manager is better, so he only bothers making a Gentoo package. He then tells you to switch to Arch if you want to use his app. Will you seriously do that?

<comment><USER37> I am sorry, but if YOU, the author, will ship MY GPLed library with YOUR application, then YOU are FORCED to open YOUR code under MY terms. Understand?

Don't steal my code, please. Don't bundle it with your proprietary app without my written permission.

<comment><USER36> What does the GPL or using libraries have anything to do with the topic discussed?

<comment><USER35> Bundling a GPL library with your application, even as a shared object file, is not allowed unless your application is also under the GPL.

Furthermore, the application seems to include parts of Linux and certain other GPL'd code files while trying to maintain an MIT license.

This is rife with licensing concerns, only one of the many concerns I have with it.

</comment></comment></comment></comment></comment><comment><USER38> This is missing the point. Linux distributions do not lack package management options, they lack stable and sane APIs for developers to work against. No amount of static linking and binary bundles can fix that.

<comment><USER32> The Linux Kernel interface does an excellent job of remaining stable. There's a surprisingly small set of interfaces that the kernel actually exposes to userland, and in the words of Linus, "WE DO NOT BREAK USERSPACE!".

I don't see the lack of stable APIs elsewhere as an actual problem. The biggest problem is that it makes life harder for proprietary software developers - it's pretty much mandatory for them to setup automated CI & release processes if they want their software to actually be usable.

There's a huge upside to not caring about a huge stable userspace API: it's much easier to continue to evolve if you just stop caring about backwards compatibility. And often, backwards compatibility means giving up your future to hold on to your past. The difficulty of getting _anything_ done grows exponentially more complicated, often with few significant tangible benefits.

<comment><USER38> What exactly was _achieved_ in the backwards compatibility nightmare that is Gnome 3, for example?

This:

[https://trac.transmissionbt.com/ticket/3685](https://trac.transmissionbt.com/ticket/3685)

All things UI in Linux distributions go through so much insane thrashing that very very few application developers want to bother. There are no tangible benefits to UI thrashing; people use systems for _software_ , not window chrome!

<comment><USER32> Desktop Linux is definitely still maturing...

I'm not up on the latest in Gnome-land and don't know the background on the issue you linked, but it looks like the benefit is that they get to stop maintaining a bunch of code for a UI feature they've decided isn't actually a good idea. That will make it easier for them to continue to build reliable software, as there will be less legacy code to consider when writing future code.

The UI churn you talk about may be because the "window manager" concept is probably fundamentally flawed. Creating a coherent and sensible UI when you have to target a whole suite of different window managers which may use entirely different UI paradigms is... probably a nigh-unsolvable problem which might not even be worth working on.

<comment><USER39> The only time you run into a WM issue is when you try to ape the OSX singular menubar.

As long as you go with the Windows thinking of having the menubar inside the relevant window, your UI will work across just about every WM out there.

I really don't see why the UI world is so hell bent on moving away from the menubar. That is unless they are stuck up on turning every UI into a touch UI...

</comment></comment></comment></comment></comment><comment><USER40> This is what powers [1]PortableLinuxGames and it often comes pretty handy.

[1] [http://www.portablelinuxgames.org/](http://www.portablelinuxgames.org/)

</comment><comment><USER41> So this attempts to solve the problem of shipping and running desktop applications in a distribution agnostic way.

It cannot actually do this however, because in order for an application to actually run you need to ensure that it's dependencies (in particular shared libraries) are installed on the OS in a version that's compatible with the application, and the documentation is essentially hand-waving the problem away:

      Gather suitable binaries of all dependencies that
      are not part of the base operating systems you
      are targeting. For example, if you are targeting
      Ubuntu, Fedora, and openSUSE, then you need to
      gather all libraries and other dependencies that
      your app requires to run that are not part of
      Ubuntu, Fedora, and openSUSE.

So what does an application author do if the application requires OpenSSL, which exists in multiple ABI incompatible versions in different versions of distros?

xdg-app actually solves that problem with its Runtimes - you create an xdg-app application by building it against a SDK that corresponds to a particular Runtime, which won't be updated in ABI breaking ways. Application authors know exactly which libraries they can rely on and which they have to bundle.

</comment><comment><USER42> The problem boils down to shared library version number compatibility. The idea of shared libraries is to reduced storage space (disk and memory) at a processing price overhead. Note that this storage constrain becomes less critical these days.

Another benefit of shared libraries is security fixes and this becomes more and more important.

The only solution I see is that distros must preserve the role of shared library managers and support cohabitation of many library versions. The shared libraries have been designed to support this cohabitation. Any app that doesn't support this cohabitation should be fixed or rejected.

Shared libraries should have a version release and patch number. The apps should only depend on version and release number. The patch number is for bug fixes.

Users ahould have specific permissions to add new software, which can be enforced by write access to the shared library directory. Users should not be allowed to install crappy and insecure software/libraries on computers shared with other users.

</comment><comment><USER43> Issues others mentioned are the bundling of libs as well as the lack of sandboxing. But I think the developer experience of xdg-app is superior specially if you just want to make a small change to an app without needing a day setting up the dev environment and maybe even another distribution for compiling the stuff.

</comment><comment><USER44> So .. I have project on my plate which is basically a firmware updater for a project based around the ESP8266 (see [http://magicshifter.net/](http://magicshifter.net/) if you're interested).

My question to anyone who knows the answer: would it be possible to write an app (in Linux of course) which access the /dev/tty.FORESP8266 and writes/reads raw blocks, such that it could be bundled into AppImage and run on, basically, OSX and Windows as a Linux app - and still have the raw i/o access it needs to perform a firmware update?

If so, I'm willing to expend the time to learn how to use it and build this app .. it seems to me to be a more interesting approach than using, for example, Qt to build a cross-platform serial i/o app ..

<comment><USER45> Bear in mind AppImages are not Java, they run only on Linux, not on OSX or Windows.

Anyway, I'm using Qt5+QtSerialPort myself inside AppImages, and works beautifully.

</comment></comment><comment><USER46> "As a user, I want to download an application from the original author, and run it on my Linux desktop system just like I would do with a Windows or Mac application."

what? no, man... this is the win9x "freeware" application install.exe, with my machine fill with crap

<comment><USER36> If you install an untrustworthy application, it's game over no matter which packaging model is involved. That doesn't mean it's not worth the effort to make sure you can easily install _trusted_ apps directly from the author.

What if you want to install the latest version of VLC?

<comment><USER46> linux repositories, whatever distro you choose, are great because of that: I _don 't_ trust $developerfoo or $startupbar, I just trust my distro packager.

BTW: normally I don't care if I don't use the _latest_ _latest_ version of $program. Do you REALLY need to always get the latest tip of git of every program you use? oh, and who said to you the latest version of $program is packaged?

<comment><USER47> Sometimes you just need the latest version. KiCAD has recently gone through development sprint after being dormant for years. My distro offered ancient version without new features. After trying to resolve source building dependencies for an hour, I just ran latest windows binary using Wine, and had no issues using it. It was bizarre experience.

</comment></comment></comment></comment><comment><USER48> I wish we could kill this idea that the Windows/Macintosh model of running around the web finding random binaries to install is a good one. Every time I have to use a Mac or Windows machine and do this I find it a major chore, and also get pretty firmly freaked out by the number of spoof application homepages with trojaned installer "bundlings" you see flying around the web. could be an easy mistake to make for a less savvy user.

As for "it just works", I do wonder how long the rest of you have spent trying to get Postgres and psycopg2 reliably working together on a Mac. (Yeah, Postgres.app "just works"...)

It's a one-command, ten-second install on my Debian machine.

<comment><USER26> You shouldn't run "random binaries", but binaries from the original author of the software. E.g., Scribus from [https://www.scribus.net/](https://www.scribus.net/) or Subsurface from [https://subsurface-divelog.org/](https://subsurface-divelog.org/). If you don't trust the original application author, then you should better not run the software at all.

<comment><USER49> For the average user this relies on the original author having the resources to be the top hit on google.

</comment></comment></comment><comment><USER50> I used to be interested in this kind of thing but it turns out lxc containers are lightweight and do the isolation thing well so let's use them!

Just need something in the file manager to recognize container images and run them like an app.

<comment><USER51> What about the stereotypical non-technical relative, who you've moved to Linux (because all they do is web and email and message) to reduce your family support effort. Is it reasonable to expect them to run container and run things in that? It seems at least more support load.

This "drop this in and run it" seems a lot more promising for that use case. Similar to freezing a python app, I suppose.

<comment><USER50> It all depends on a simple interface, no reason containers couldn't be run on (double) click, or put in the main menu, etc.

</comment></comment></comment><comment><USER52> This is pretty exciting to me. At my job we create a Linux desktop app using NW.js, which basically has Ubuntu 12.04 as a minimum requirement. Unfortunately almost all of our customers use RHEL/CentOS 6.x, which dates from 2010. I've gotten NW.js compiled in CentOS 6.x (and submitted patches to it as well as Chromium, which it is based on), but Chromium is a famously moving target and the latest betas will take even more work to backport. Hopefully this will solve this problem.

</comment><comment><USER53> Isn't this what dockers original design goal was?

</comment><comment><USER54> > "As a user, I want to download an application from the original author, and > run it on my Linux desktop system just like I would do with a Windows or Mac > application."

Has _anyone_ ever said such a thing? My guess would be the exact opposite: users like the comfort of installing via the OS package manager, rather than hunting for binaries on the internet.

</comment><comment><USER55> This seems like it does fill a need, but what I'd really rather avoid the Windows scenario, where each and every single app has its own auto-update manager - in addition to the system update manager. That just becomes a redundant mess very easily.

</comment><comment><USER56> I have to wonder if the Subsurface demo was key to achieving the endorsement from Torvalds.

</comment><comment><USER57> How would this relate to AppC / RunC?

Why not take the opportunity and package app in a way that isolates them like SubgraphOS is trying to achieve? :)

</comment><comment><USER58> [http://www.gobolinux.org/](http://www.gobolinux.org/)

</comment><comment><USER59> This uses the fuse file system to intercept and rewrite paths. Anyone know the performance hit of doing this?

<comment><USER26> Depending on the scenario, an app packaged as an AppImage may launch as fast as or sometimes even faster (due to the compression) than an installed app. In most cases, there will not be a noticeable difference for normal desktop applications. Since an AppImage is also a valid ISO, you can loop-mount it and copy its contents wherever you like, and do a comparison.

</comment></comment><comment> a-dub So it's shar that cleans up after itself with LD_LIBRARY_PATH set for you?

</comment><comment><USER60> Do you guys remember those "Portable" Windows executables?

<comment><USER61> I do - they worked find for me. Did they give you a hard time? I ask because of the quote marks around portable.

<comment><USER60> Some better than others- I was able to grab a copy of portable office (Office 2007?) that ran fantastic on x86. I also went through the trouble of sandboxing every one I ran due to the unknown packing mechanics... Cool stuff none the less

</comment></comment></comment><comment><USER62> Oh exploitable!

</comment><comment><USER63> Ugh, please don't fuck with my scrollbar.

<comment><USER64> I just made a pull request for fixing it.

<comment><USER63> Thanks, looks like it was merged.

</comment></comment></comment><comment><USER65> Congratulations, you just have invented Windows ;)

</comment><comment><USER66> is it safe?

<comment><USER62> Of course not. Hehehee. Stuff like this makes people like me happy, because of all the exploits.

</comment></comment><comment><USER67> _As a user, I want to download an application from the original author, and run it on my Linux desktop system just like I would do with a Windows or Mac application._

Please pull over. I want off this ride.

Why the hell are we regressing to shipping around hackily built binaries?

<comment><USER68> Because users and developers both want to be able to download and use new versions of software at a release cadence that makes sense for that application. The "every application gets the same release cadence no matter what" approach only appeals to people making distros.

<comment><USER69> Nothing in using the distro's packaging formats forces you to release only at the same time as the distro.

<comment><USER70> While of course you are technically correct, think about it from the grandma perspective. Grandma uses $app that requires wine, but grandson set her up on Debian stable. She can't run the latest wine because it isn't stable, and it's needed for $app, without updating the system to unstable.

I could be erroneously attributing the intended use case, but I believe this isn't designed for people who know what they're doing; it's for people who don't know, like grandma.

</comment></comment></comment></comment><comment><USER71> From the website:

>Just download the application, website, make it executable, and run!

You want me to download some mystery program and run it with all my privileges? No ... that isn't going to happen...

<comment><USER72> Presumably, you'd only do this if you knew what it was and you wanted it.

</comment></comment><comment><USER73> TL/DR: Let's take the broken app model that lets people download and run buggy, virus-infected programs on Windows and OS X, and bring it to Linux!

<comment><USER72> Every model ever devised lets people run buggy programs. If I couldn't run buggy programs, I wouldn't be able to run any programs at all.

<comment><USER73> _> Every model ever devised lets people run buggy programs._

There's a big difference between:

(1) A user being able to run buggy programs _if_ someone is able to hack the secure distribution chain or _if_ someone is able to get the user to give root permissions (or any permissions other than those of their ordinary user account) to a piece of malware;

and

(2) A user being able to run buggy programs because the default app model on their system dumps all app binaries into their ordinary user account's data area, with that user having write access to all the files, so any random piece of malware running as that user can hose them.</comment></comment></comment>


Ask HN: What toys inspired you? What inspires your children? - <AUTHOR>

I am interested in educational toys, games, books or general life experiences. <comment><USER2> Cuisenaire rods. This is the set I have: [http://www.amazon.co.uk/Legler- Multiplication-Sticks-Educati...](http://www.amazon.co.uk/Legler- Multiplication-Sticks-Educational- Toy/dp/B00074U7SO/ref=sr_1_4?ie=UTF8&qid=1432071048&sr=8-4&keywords=cuisenaire+rods)

Lego.

Garden tools, seeds and bulbs, etc.

Sand and a tray. A bunch of different jugs and pots and funnels -- these can be used with the sand, or in the bath, or you can nail them to an outside fence to make a water chute.

Blackboard paint on a door and chalk.

Cooking.

A good magnifying lens; later decent binoculars; a robust microscope; later a decent telescope. And stuff to look at.

Playdough, both commercial and homemade.

In the UK local councils have industrial recycling facilities where they separate out a bunch of stuff that can be used for craft project. So, for example, you can find industrial sized bobbins of different shapes and sizes; fabric off cuts; some mis-shapen spectacle lenses; weird bits of plastic; etc etc. You turn up, pile stuff in a box and pay a small sum for it. You then make stuff from it. (We made fake binoculars and a race car.)

There's a bunch of sensory stuff that I thought my child would like, but it turns out I like them much more. EG: a glitter bottle. You take an empty plastic soda bottle, half fill it with clear glue, add a bunch of glitter (restrict it to two or three colours) and add a few drops of food colour. Top it up with clean water. Seal the top. Shake very well.

The theme here is fuck commercial toys. Imagination and time is what makes the difference.

</comment><comment><USER3> Not exactly a toy, but I rally loved building forts with other kids from the neighborhood. There was an empty field near out house, with a beat-up old olive tree that was the base for a series of forts. After a while we moved to making forts in ~3 foot deep pits, and lining them with old carpet and covering them with discarded plywood scavenged from construction sites.

I'm just starting to build forts with my own kids. They are excited about it, but not as excited as, say, playing video games. It's kind of weird, but I hardly see any kids making forts any more. In ten years or so I've seen maybe one place that would qualify as a fort. Nothing like when I was a kid.

</comment><comment><USER4> I used to spend way too much time with my TI-82 calculator. I programmed it, I played with graphs on it, I played with numbers and equations on it. I received it at a time when there was no way my parents could afford to give me such a thing (I think they were darn close to $100 at the time, which was a lot, and honestly still is). I had a Junior High Math teacher who had cancer and was retiring, given only a few months to live. I was helping her to clean out her class room on the last day of school and she handed it to me and said "Make sure to pass what you learn to someone else". Honestly, I will never forget that woman and the lesson she taught me.

No other teacher ever gave me any problems which needed that kind of power at the time, so I just played. I learned so much.

</comment><comment><USER5> Lego was a huge one for me -- I loved having a giant tupperware box of random pieces and no instructions.

Another big one, but one that I don't see often, is Capsela ([http://www.wikiwand.com/en/Capsela](http://www.wikiwand.com/en/Capsela)). I loved the fact that it actually moved and did stuff and could roll or float.

Nowadays, if I were a kid, I'd probably play with one of the programmable Lego sets until it broke or broke something else!

</comment><comment><USER6> Taking apart old lawn mowers (and rarely getting them back together). Unrestricted use of a farm shop. A play house in the woods. A dog.

</comment><comment><USER7> I LOVED Tonka trucks when I was a kid. I spent so much time out in a dirt box by myself playing for hours. I can't say how they inspired me, but for some reason when you ask for toys that inspired me that is what popped in my head immediately.

</comment><comment><USER8> My dad's hand-me-down Swiss Army Knife (IIRC I was ~8 when he gave it to me). It was one of the larger ones with lots of different tools and I used it to pry things open, unscrew electronics and put them back together, strip wires for repairing devices I may have previously torn apart to vigorously. Also used it for lots of dumb stuff that was kind of dangerous but the blades were no longer than ~100mm so I couldn't do much harm.

Made lots of models, primarily fighter jets (F-14, F-15, F-16, F-18) but also a lot of Star Trek ships (a large 1701-D was my baby). Lego as well...

Also had a decent microscope and chemistry sets.

Teach your kids to make things and explore.

</comment><comment><USER9> I spent A LOT of time playing with Legos in my formative years. I don't know if it counts as educational, but it kept me out of trouble and definitely allowed me to use my imagination in a constructive way.

</comment><comment><USER10> Legos, bar none. I loved legos as a kid and I recently rediscovered a large stash of them my Mom kept for me all these years. Now my 3 year old daughter and I play "little legos" every chance we get. Love those little legos - especially the vintage ones that require imagination. Not a big "lego kits" guy... like to create my own stuff.

</comment><comment><USER11> Endless hours messing around with this software [1] as a child, likely what got me interested in programming.

[1] [http://www.microworlds.com/solutions/mwex.html](http://www.microworlds.com/solutions/mwex.html)

</comment><comment><USER12> Books: Carl Sagan. Illustrated encyclopedias.

Toys: Whatever I had would be dwarfed by any smartphone available today or even a Raspberry Pi.

Life Experiences: Doing my own (tiny kid-style) startup.

</comment><comment><USER13> What inspired me: lego, playmobil, zx spectrum, scientific calculators and having enough indoors and outdoors space available.

</comment><comment><USER14> undoubtedly lego mindstroms they are amazing pieces of machines you would love them a lot.......

</comment><comment><USER15> code.org - my 5 years old daughter created a simple game</comment>


How Did Jordan Peterson Become So Successful? - <AUTHOR> https://greyenlightenment.com/how-did-jordan-peterson-become-so-successful/ <comment><USER2> This article does a good job of , at least in my estimation, summarizing the main factors of Peterson's success.

One additional factor I do think is a major reason so many young people find him interesting is because he synthesizes religious ideas in a modern evolutionary and scientific context to attempt to give meaning and purpose to life. This speaks to a lot of young people in post-modernist / post-religious society I think.

I don't necessarily agree with him on much, but I think the benefits of having meaning and purpose, and a social spiritual life are something most modern atheists tend to neglect, to their own and society's detriment.

</comment><comment><USER3> I'd say he gained followers by publicly saying that which "can't be said publicly"...people value honest and raw communication over the scripting corporate PR non-sense most of hear day-in and day-out.

Even if it is something we disagree with, it is still refreshing to hear people speak honestly about their real opinions on whatever the topic happens to be.</comment>


Face Detection with HTML5 & JavaScript - <AUTHOR> https://github.com/liuliu/ccv/tree/current/js/

<comment><USER2> Now if a browser had <device> support, we could _really_ start hacking!

[http://www.whatwg.org/specs/web-apps/current- work/complete/#...](http://www.whatwg.org/specs/web-apps/current- work/complete/#devices)

</comment><comment><USER3> <http://news.ycombinator.com/item?id=1860778> \- 1 day ago discussion about this sample</comment>