Ask HN: Which Android phone would you buy (Nexus 4 sold out) - <AUTHOR>

Since the Nexus 4 is not easily available, which Android Phone would you buy in its place? <comment><USER2> If you have a phone that you could manage to get by with for another few weeks, I'd wait for the Nexus 4.

If you really can't wait, there are still some good options. The S III is one of the best phones ever made. The Note II is just as nice as the Nexus 4 and the S III, but it might be too big for some people, myself included. Also, you might be able to find the Galaxy Nexus, which is the phone I currently use. The Google version is no longer for sale, but you might be able to find a brand new one on Ebay, or if you aren't comfortable with that, some of the wireless carriers might still be selling them.

</comment><comment><USER3> A Samsung Galaxy S III with Cyanogenmod 10, which is usable as a daily driver

\- or -

If I could deal with the size and pending a usable CM10 build for it, a Galaxy Note II, which is essentially a giant-screened SGS III with monstrous battery life and a pen (which won't be usable under CM10).

Both support 64GB microSD cards, unlike the N4.

</comment><comment><USER4> Wait for the Nexus 4. I've had one stock Android phone (Nexus S 4G) and 6 non- stock. Stock beats custom skins, hands down. I know CM is (mostly) always an option, but the hassle is reminiscent of trying to remove bloatware from a Windows PC.

</comment><comment><USER5> Wait till it's back in stock -- as a developer you want to be seeing the flagship model and Nexus is it. And I say this to you as an Apple fanboy who just ordered a Nexus to make sure I know what's going on in the other side of mobile.

</comment><comment><USER6> In its place I'd get the Galaxy Note 2, I really like the big screen.</comment>


Show HN: Embed Kubernetes as an application server for pre-packaged/ISV software - <AUTHOR> https://ruckstack.org/blog/2020/04/looking-for-feedback/ <comment><AUTHOR> Hi HN,

I've spent a good portion of my life dealing with getting my software installed into other people's environments and it is never easy.

As an ISV, you don't have control over the environments your software is going to be installed in, and have to deal with extreme variations in setups.

Plus, there is always an vague answer to the "who's problem is it when the system goes down?" which makes it difficult to handle downtime effectively.

Kubernetes solves a lot of the problems I'd face through containerization, health checks, standard configuration systems, monitoring, logging, network isolation, etc. but it is very centered around datacenter management.

The goal of Ruckstack is to be the glue + best-practices it takes to refocus Kubernetes tools around a single application running on a small set of machines.</comment>


Ask HN: Ideas to Explore and Develop Together? - <AUTHOR> As the WFH currently happening, I have automated most of my works, giving me some downtime to work on ideas/hobbies rather than watching shows.<p>Any suggestions on ideas to explore and can be developed together? <comment><USER2> I've got a list of ideas to explore on my blog. Maybe you have some thoughts on them :) [https://beepb00p.xyz/ideas.html](https://beepb00p.xyz/ideas.html)</comment>


Mark Zuckerberg on the Three Keys to Facebook's Success [video] - <AUTHOR> http://thestartupfoundry.com/2011/02/05/mark-zuckerberg-on-the-three-keys-to-facebooks-success/

<comment><USER2> I didn't think the video was all that informative. I was hoping it was three keys to the initial success of Facebook. Not, three keys that keeps Facebook successful which are:

1) Culture

2) Developer's platform.

3) Leverage with hiring. e.g. Mentioning the impact that engineers will have.

<comment><USER3> agreed,though the leverage is an interesting way to look at hiring. If that is one of the key things that Zuckerberg points at when talking about the success of Facebook, I have to wonder if when he sits down with a potential new hire, he asks him self 'does this person have the capabilities and initiative to lead 1 million people'.

<comment><USER4> I've seen it mentioned somewhere that facebook has been having a problem finding self-directed developers. They want the good ones to be mini-ceo's, and they're having problems finding that. Instead they're getting lots of hotshot coders who flounder around.

I think they'll have a difficult time finding those mini-ceo's without changing the culture quite a bit. This is what happens when you hire straight out of school.

</comment></comment></comment><comment><USER5> Why is luck not listed?

<comment><USER6> He already 'won' the social media lottery, now he's talking about investing his 'prize' to ensure it returns a good investment.

</comment></comment><comment><USER7> The real keys to Facebook's success:

1) Prior campus projects made him locally famous.

2) An upper-crust seed population.

3) Exclusivity during expansion.

4) A clean interface which appealed to something other than the rebellious, "express myself" teen (i.e. not MySpace).

5) Timing. He hit the right audience at the right time.

6) Luck.

I don't doubt that there is a lot of skill at Facebook these days to keep it riding high on the social wave, but if you want to talk about what _made_ Facebook successful, it's mostly the above.

<comment><USER8> > _3) Exclusivity during expansion._

I'm not sure this helped. A social networking site is only as useful as the number of people on it. I expect Facebook would have grown faster without exclusivity.

> _4) A clean interface_

Definitely.

The worse thing about MySpace, and one reason I never considered getting a MySpace account, is that users can customise their page to make it hard or even impossible to read.

If I made a site like MySpace, I'd allow users to customise their page, but I'd also give users an option to use their own customisations when viewing someone else's page. That way, people can read the damn thing!

<comment><USER9> _> 3) Exclusivity during expansion._

 _I'm not sure this helped. A social networking site is only as useful as the number of people on it. I expect Facebook would have grown faster without exclusivity._

I think exclusivity was key - and probably facebook's main difference from other networks (in it's early days). A social network isn't only about aggregating as many people as possible - this can also have a contradictory effect. What is much more important is the relevance of the community to you. Would you rather join a network with ~500 weak contacts or one with your 4 most important? The current popularity of facebook is also inherently causing a lot of people to stop sharing their personal lives on facebook.

But lastly let's not forget, that many elder social networks simply screwed up - both friendster and myspace got big troubles to scale their systems (database integrity etc.) - whereas facebook has a culture strongly driven by engineers (however that's gonna turn out... but facebook definitely has got fantastic uptime).

One last thing: build a social network that effectively and nicely solves the problem of the different social communities a person belongs too - and you might just as well build the next fb.

<comment><USER10> "The current popularity of facebook is also inherently causing a lot of people to stop sharing their personal lives on facebook."

This is troubling to me. I feel like I'm looking at a bunch of ghosts when I view people's profiles now. Anyone else? Their photos and a bit of their bios are still up, but they've mostly moved on to other forms of tech to post anything dynamic because of the logical fear that they will no longer control what aspects of their personal lives will become public record. What, I wonder, is the company doing about this issue beyond just pr stuff like funding privacy-related nonprofits? If they don't address it in their core functionality, they've got a potential wasteland on their hands.

</comment></comment></comment></comment><comment><USER11> I watched it twice because I didn't really pick up on 3 separate ideas. I guess they conflate into one and that's why it works. Plus, it's a bit naive of The Business Insider to think success in innovation can be attributed to only 3 main ideas. But correct me if I'm wrong, these are the 3 key points I picked up:

1) Don't be afraid to try new things (be bold).

2) Execute quickly while keeping future quickness of execution in mind.

3) If/when keys 1 & 2 work out and "explode" your userbase, giving you massive leverage... use it.

<comment><USER2> I gathered it was Culture, Developer Platform, and Leverage/Impact

</comment></comment><comment><USER12> Facebook succeeded because MySpace failed.

<comment><AUTHOR> I disagree. Both Facebook and MySpace tried to solve the problem of connecting people digitally, but that's where their likeness ends. They tried to solve that problem in fundamentally different ways.

<comment><USER4> Both were(are) homepages that list your likes/dislikes/memberships and have a stream of comments. It was friendster et al that tried to do the real hard CS graph theory stuff. Facebook /still/ doesn't do those things - though they talk about "the graph" constantly.

Just try searching for everyone within X miles in your network.</comment></comment></comment>


Navigational breadcrumbs in Rails - <AUTHOR> http://www.onlineaspect.com/2010/06/19/breadcrumbs-in-rails/

<comment><USER2> Isn't it easier to just build up breadcrumbs from a nested structure that represents your menu and just walk backwards from the current element?

I've got a simple little rails plug that builds meny, submenu and breadcrumbs from a yaml file and can handle privileges/visibility.

<http://github.com/sunkencity/joels_menu>

</comment><comment><USER3> The real gains in terseness come when you recognize that the entire navigation for your site can be generated from table relations.

</comment><comment><USER4> Very nice Rails-like solution! I'm looking into breadcrumbs for my app, but unfortunately I haven't been completely good about nesting my resources.</comment>


Amoeba-Based Computer Solves Traveling Salesman Puzzle - <AUTHOR> https://thenewstack.io/amoeba-based-computer-solves-traveling-salesman-puzzle/ <comment><USER2> Similar posts have been discussed in the past. For example [https://news.ycombinator.com/item?id=18735903](https://news.ycombinator.com/item?id=18735903)

Note that the amoeba system finds only an approximated solution, it is not guarantee to found the best solution. Also, it finds it in linear time (for some definition of linear). And the graphs are small (8 cities).

So ... this is at best a new nice heuristic. There are plenty of heuristics, it's not clear that is better than the other heuristics.

The difficult part is guarantee to find the best solution fo large graphs in non exponential time.</comment>


How Cloudflare Workers Are Used for Malware Campaigns - <AUTHOR> https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c <comment><USER2> We (Cloudflare) noticed this and implemented measures to block it a couple weeks ago. The attack described in the blog post is not effective today.</comment>


Adobe Flash Getting P2P Capabilities - <AUTHOR> http://labs.adobe.com/technologies/stratus/

<comment><USER2> this.... could be huge, considering the footprint of flash, but i highly doubt they would do aggressive skype-like things to get around nat issues, so this may not be the panacea we are looking for

<comment><AUTHOR> they are doing NAT traversal

</comment></comment><comment><USER3> Does this compete with Google's Wave and the XMPP protocol?

</comment><comment><USER4> Too bad they don't have a demo application showing off the features in action like google did with wave. It could be viable alternative to write collaborative software.</comment>


Rob Pike's Talks About GO At Stanford  - <AUTHOR> http://stanford-online.stanford.edu/courses/ee380/100428-ee380-300.asx

<comment><USER2> <http://ee380.stanford.edu> gives the schedule of the talks in the series. Click on the video camera icon to see the video. Needs Windows Media Player.

IMHO it's a great talk.</comment>


You're bored? - <AUTHOR> http://mikesowden.org/feveredmutterings/awesome-boredom

<comment><USER2> HA. I think most of this list is 'boring'. Keeping yourself busy is not the same as entertained. I'd be just as likely to be bored while doing most of these items. Instead, find what you enjoy doing and go do THAT.

</comment><comment><USER3> _In essence, you're saying you have run out of things to do that are worthy of interest._

Isn't a key part of that phrase _'worthy of interest'_? I bet it's the opinion of many that those things listed are not worthy of interest. The post assumes that everything there is to do in the world is supposed to be interesting to you.

<comment><USER4> Agreed.

"Boredom: the desire for desires." - Leo Tolstoy

</comment></comment><comment> guard-of-terra Most things he suggest you to do are boring (learning, especially: extremelly boring, if I'm going to stare into screen looking at some guy slooooowly telling me some common knowledge I'll die of frustration).

He suggests that to avoid boredom, we should do busywork.

No we won't.

</comment><comment><USER5> Some wise guy told: "Only boring people gets bored".

Seems to be true. Since I'm not boring I hardly remember how does it feel to be bored. :) There's so much stuff to do. Only thing you have to do it to see it's awesomeness and then "good bye, boredom". :D

</comment><comment><AUTHOR> Personally i took a little more out of that article.

The idea that in this world we live in today one can be bored when there is so much to do, to learn, to see and to experience.

Brings to mind an Einstein quote: "There are only two ways to live your life. One is as though nothing is a miracle. The other is as though everything is a miracle."</comment>


All of the SmartPhones Revealed at Mobile World Congress (MWC) 2011 - <AUTHOR> http://itechvision.blogspot.com/2011/02/all-of-smartphones-revealed-at-mobile.html Many Smartphones were announced at the MWC (Mobile World Congress) in Barecelona Spain 2011. Many of the smartphones are running Android 2.2 Froyo or Android 2.3 Gingerbread. We have compiled a list of the Smartphones that were announced at MWC 2011. <comment><AUTHOR> great!</comment>


How MoPix is turning movies into mobile apps - <AUTHOR> http://news.cnet.com/8301-1035_3-57491222-94/how-one-start-up-is-turning-movies-into-mobile-apps/

<comment><USER2> Funny. I once made a photo sharing site called MoPix.</comment>


Kaspersky launches its own OS - <AUTHOR> http://www.theregister.co.uk/2016/08/23/kasperskyos/ <comment><USER2> Kaspersky launches an OS to be used in routers and in critical equipment.

To be more secure it was written from scratch, and

> To achieve a guarantee of security it must contain no mistakes or > vulnerabilities whatsoever in the kernel [...]

Here is where it begins: IMHO, Cisco and any other manufacturer of sensitive OSes, even Microsoft with Windows NT, probably had a goal of not having defects and vulnerabilities.

But security isn't a binary knowledge, where you just know or don't. Many attacks, many exploits, happened in ways that nobody had previously imagined.

To be secure, all possibilities must be considered during manufacturing/development. To be insecure, just one failure needs to be found, in any point.

Example: if the data you send to some input (that is perfectly secured, sanitized and so on) can cause a RAM bit-flip, there goes your security, even if the blame goes to the chip manufacturer...</comment>


Storage Space Doubled For All Linode VPS plans - <AUTHOR> https://blog.linode.com/2013/07/25/storage-space-doubled/ <comment><USER2> I had been a Linode customer for years, but I had to drop them when I lived through two security incidents where there was an almost complete lack of response by the Linode staff. They've completely lost my trust. I work in the information security industry, and I know the reality that almost everyone will get hacked eventually. I don't blame them for getting hacked. I blame their poor incident response plan. For my purposes, I just can't depend on an infrastructure provider who isn't brave enough to tell me up front that they made a mistake, or if they tell me "don't worry, the attackers weren't after _your_ information!"

Because next time, they might be. You're going to have to do better than incremental upgrades to convince me to come back.

<comment><USER3> Can you provide an example?

Every time someone says that I've noticed either: A) They missed the public notification. B) Their security expectations aren't in line with a VPS environment where everything is controlled through a WAN control mechanism. [e.g. $200k worth of bitcoins stolen...why on earth aren't you using a colo box with your own dedicated hardware that you can be certain is as secure as you can possibly make it. That is something you can do with $2k and at most $200/month.]

<comment><USER4> What the hell are you talking about?

a) Linode was extremely cavalier in releasing a public notification. It was all over slashdot and in their support channel, with _ZERO_ notification from them (till long after the fact), leaving the community to assume the worst, which was inline with what actually happened.

</comment></comment></comment><comment><USER5> I'm a linode user and not impressed. They are just keeping up with the competition. ram/cpu/storage prices are always falling, so their prices have to fall or resources increased to compete. They won't cut their prices as that will cut into revenue, so they increase resources.

<comment><USER6> As a fellow Linode user, I find this to be a pretty silly comment. This will save some customers a little bit of money and provide some storage breathing room. It's an important latest step to firm up their offerings, and I commend them for consistently doing so over time.

If you think Linode is a good value for the money, continue using them. If you don't, go somewhere else. I don't think anyone here cares whether you're impressed.

<comment><USER7> It works both ways you know. Nobody here cares that you're not impressed.

The point is valid though that due to falling component prices it is expected that Linode will either increase resources or decrease price.

</comment></comment></comment><comment><USER8> Dear Linode: I fucking love you. I was a loyal Slicehost user until Rackspace bought and ruined them. I should have switched to Linode long before that. My dearest hope is that Rackspace doesn't buy them too.

<comment><USER9> Counterpoint: Linode is incompetent at security. $228,000 worth of bitcoins were stolen because Linode's admin interface was compromised by an attacker. The reason you probably haven't heard about it is because Linode never publicly acknowledged that it happened, as far as I know. Those are two serious black marks against the credibility of Linode. Use at your own risk.

[http://arstechnica.com/business/2012/03/bitcoins- worth-22800...](http://arstechnica.com/business/2012/03/bitcoins- worth-228000-stolen-from-customers-of-hacked-webhost/)

<comment><USER10> While the security breach is a big problem, it seems like storing $228,000 worth of bitcoins on a server that can be attacked from the internet is a bad idea.

<comment><USER9> It was a bitcoin trading platform. Many bitcoins had to be accessible by a sever.

It wasn't the platform's fault that they lost the bitcoins. Linode's admin interface was the attack vector. This is roughly equivalent to getting robbed because your landlord left your apartment's master key under a doormat.

<comment><USER11> To continue that analogy, its roughly equivalent to keeping $200k cash in a briefcase the floor of your apartment instead of in a safety deposit box at the bank.

<comment><USER9> That analogy is completely invalid. It was a trading platform. How do you propose they trade bitcoins without those bitcoins being accessible by the server?

<comment><USER12> Bitcoin trading platforms do not need bitcoins accessible by remote servers. They should have a huge portion of the coins in cold storage (not available from remote servers). Also, the storage and attribution of coins to accounts should be done by a server under physical possession/control, so that authentication cannot even be forged in the event of a frontend breach.

There are a lot of things you can do to protect your bitcoins. Having them all on linode servers is the worst thing possible.

[http://en.wikipedia.org/wiki/Air_gap_%28networking%29](http://en.wikipedia.org/wiki/Air_gap_%28networking%29)

<comment><USER13> Yeah, that's one of those applications that you really need to colo and secure yourself with outside security verification, or at the very least go with a host that has a reputation for ironclad security. Hosting that kind of thing on a low-cost VPS is ridiculous.

<comment><USER14> From what I remember, it was a 17 year old kid who built and ran the site, and it was his first time ever handling financial transactions (there was another bitcoin-related hacking around the same time, so I might be confusing them.) It was a recipe for disaster.

<comment><USER9> It's incredible how much people are willfully ignoring Linode's gross incompetence in this matter.

<comment><USER14> Their only gross incompetence was not informing customers in a timely manner, which I could forgive them for. _Having_ a security breach is something that happens to, quite literally, _every_ hosting provider.

I say all this as someone who dropped Linode for DO due to not being able to afford them anymore.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> And this is why I love Linode. I have been paying $20/month for around 3 years. At first I had 256M of RAM and 12G of harddrive space... and now I have 1G of RAM and 48G of harddrive space. I dare you to look at other providers and see if they have offered such aggressive, yet free, upgrades

<comment><USER16> Meanwhile, $20 a month at digitalocean gets you 2G of RAM and 40 Gb of ssd.

Not to diss Linode, I use them myself, but they're not the cheapest. It's quite evident to me that these free upgrades are a defensive tactic.

How much memory or disk space would $20 a month get from other providers 3 years ago?

<comment><USER17> I switched to DO a few months ago, ... and just recently switched back to Linode.

I'll pay the extra few bucks for reliability and decent uptime.

I had very frequent downtimes and the support was often unhelpful. I heard from others that it was just the datacenter that my VPS was on and other DC weren't as bad, but I guess it gave me enough of a bad impression that I went back to Linode anyway.

<comment><USER18> I'm using it non-production things, and have had a similar experience. I'm in the SFO data center, and I've lost connectivity to the machine at least 5 times in the past month.

<comment><USER19> I've had the same issues and it's preventing me from using it for anything serious. A lot of the other things with DO (provisioning, backup, snapshots) are great but the network seems to the biggest issue at the SF datacenter.

</comment></comment></comment></comment></comment><comment><USER20> Everyone interested in web dev should own a VPS.

After a year working at a Rails shop that deploys to Heroku, I decided it's time to learn some sysadmin basics. Here are some things I've done the past couple months that might give other noobs some ideas.

\- Make aliases for most Linux commands. Abstract Linux into a simple interface of aliases that you can browse in your .zshrc/.bashrc/fish.config. Linux becomes much more enjoyable when you can type `untar <file>` instead of remembering the magical incantation `sudo tar -xzvf <file>`. Make aliases for everything. nginx-reload. nginx-restart. alias z="vim ~/.zshrc && source ~/.zshrc". I even abstract apt-get commands into ag-install, ag-update, ag- remote, etc.

\- Use dropbox cli, a shared folder with dotfiles, and symlinks to keep dotfiles synced between your server(s) and laptop(s).

\- Install tmux on it so that you can `$ tmux attach` to a persistent shell so that things still run when you close your remote connection and they're still there when you log back in.

\- Run weechat (terminal irc client) in tmux so that you never have to log out of irc again.

\- Learn how to rsync up and down files from your server.

\- rsync your Sinatra app (or whatever) onto your server and run it on port 5000, immediately see it live.

\- Install nginx and have your VPS serve multiple domain names, each domain name pointing to a Sinatra app running on port 5000, 5001, and 5002.

\- Run each website in its own tmux tab. At the beginning it's easier to reason about a foreground process than some daemonized process.

\- Install postgres or whatever database you use to your VPS. Get your db- driven app to connect to it. Connect to your remote db using your favorite db gui.

\- Take notes of all the commands you use to set up each component so that you can refer to them later, see how you might have messed up.

\- Learn enough bash/zsh/fish to automate all of those commands. Polish it enough so that you can curl your script from a Github gist on a fresh VPS and it will set up your entire environment.

\- Install `htop` as a nice overview of your server's stats and the processes that are running. Run it in another tmux tab. My tmux right now has a tab for weechat (irc), tabs for my Clojure apps, and an htop tab. On Friday nights I pretend I'm NASA mission control.

\- Learn how to use the `ssh` command to reverse tunnel a connection from your VPS to an app you're running on your local machine for a fast development feedback loop.

\- Learn how to use your VPS to encrypt your connection when you're working at coffee shops.

I'm still a noob but I leveled up considerably from this quest arc. I highly recommend.

I still don't have a raging clue about most of Linux, even stuff like what all the folders are supposed to be for: /var/opt /etc/www /usr/local /usr/shared/local ... etc. and why files go the places they go, but it's all an iterative process.

Email me (profile) if you need help with any of the bullet points. I am trying to shape it into a more helpful blog post to share with other noobs.

<comment><USER21> >\- Make aliases for most Linux commands. Abstract Linux into a simple interface of aliases that you can browse in your .zshrc/.bashrc/fish.config. Linux becomes much more enjoyable when you can type `untar <file>` instead of remembering the magical incantation `sudo tar -xzvf <file>`. Make aliases for everything. nginx-reload. nginx-restart. alias z="vim ~/.zshrc && source ~/.zshrc". I even abstract apt-get commands into ag-install, ag-update, ag- remote, etc.

One problem with this is you become a cripple when you have to use an outside machine or need to write a script for wide distribution.

<comment><USER20> I find that it's the opposite for me since my needs are so simple and I'm not logging hours into Linux cli every day. I simply don't use the VPS cli enough to retain everything and that just makes it frustrating. It's more like Billy's First VPS Side-project rather than a roadmap for industrial-grade sysadmin skills which I'll probably never have.

Aliases become a self-documenting interface. Using my aliases, getting exposed to them every time I add a new one, tweaking them, and simple browsing them from time to time is what helps me remember commands.

It saves me brain cycles sort of like buttons on a GUI.

For me, the alternative to writing an `untar` alias isn't that I remember `tar -xzvf` but that I have to google it every time (or scroll through dozens of possible flags in the man page). I'm not untar'ing things every day.

Now multiply that example across all sorts of commands. I never remember the right flags to `stat`. or `column -nts: /etc/passwd` just to quickly see users.

I won't remember that I like the `--show-upgraded` flag sent to `apt-get upgrade` every time. I don't remember that my nginx conf and websites are in `/etc/nginx/` while their static files are in `/var/www/`. When life gets busy and it's a month since my last VPS login, I'll remember my own `disk-space` abstraction instead of `df -h`.

Finally, I'm not a sysadmin. I don't find myself on random machines nor am I writing scripts for wide distribution. When I spin up a new VPS, I curl a gist that even installs fishshell and then bootstraps the rest of my niceties with fish scripts. If I'm lazy, I'll just wget my .bashrc aliases. If I'm even lazier, I'll just curl it like it's a manpage and browse my abstractions. Not much different than using manpages directly.

But actually over time it turns out that I end up remembering what many of these aliases represent.

<comment><USER22> The concern you are responding to here was my initial reaction, but I think you've changed my mind.

I like this a lot. Not only do you gain experience using commands by setting up your aliases, but you now have a reference for the future and are learning the commands by repetition; exposing yourself to the config during tweaks.

Add in the use of apropos to find appropriate commands (without googling) and learn to use the search feature while viewing a man page (/[STRING] same as vim!) and you're golden.

</comment></comment></comment></comment><comment><USER23> It's frustratingly difficult to find a high-storage VPS at an affordable price. This announcement by Linode is a start. But I think the market has a ways to go yet.

<comment><USER24> You can back your way into one at Dreamhost. Their shared hosting plans are unlimited disk/unlimited bandwidth for web-related data. Then add a VPS to that. You still get the same disk/bandwidth allocation. If you get really big, there's probably some throttling, but it works well for me. I have over 500GB of data stored there.

<comment><USER25> Dreamhost's policy is that your storage space is unlimited only for files related to the sites you're hosting with them. Not to mention, availability of Dreamhost's shared plans is, well, a nightmare. Don't get me wrong, it's still a bargain, but you get what you pay for.

</comment></comment></comment><comment><USER26> Why would anyone use them over DigitalOcean? What's the advantage? Am I missing out on something?

<comment><USER27> I'm a customer of both DigitalOcean as well as Linode. I use DigitalOcean for random experiments and side projects and Linode for production sites.

I haven't directly observed any practical differences in ways that affect me in terms of VPS infrastructure itself, but I've found Linode's support to be significantly better and I'm willing to pay a premium for that on "sites that matter". I don't want to imply that DigitalOcean's support is bad -- it's not, but I feel they're average when compared with Linode responses.

On the other hand, my impressions may be biased since I rarely have to contact support in the first place. I'd be interested in whether or not others have had the same experience in terms of customer support.

<comment><USER28> I wrote this a while back: [http://www.welton.it/articles/webhosting_market_lemons](http://www.welton.it/articles/webhosting_market_lemons)

Part of the problem is that it's very easy to compare on price, but difficult to compare on service. I think my conclusions may not be quite as valid today, because news gets around so quickly, but I think the concept is a worthwhile one to think about.

Anecdotally, I've been very happy with Linode's service: a few months ago, I had some kind of problem and things weren't booting. Panic! I sent in a support ticket, and went to their IRC channel right away. I started describing the problem, and one of the guys in the channel says "oh, I think I just answered that", and indeed, the support ticket had already been answered with real, helpful information.

My interaction with them has usually been quite positive.

</comment></comment></comment><comment><USER29> To be honest I would never trust my credit card number to linode again.

<comment><USER30> Why? You lose nothing if it's compromised. That's the bank's worry.

<comment><USER29> For starters, I had to pay for the replacement card...

<comment><USER31> What kind of shitty bank do you have?

</comment></comment></comment></comment><comment><USER32> If OVH ever brings that $27 i5 dedicated to the US (CA) datacenter, VPS providers are in trouble.

<comment><USER33> They have $39 ones :)

[https://www.ovh.com/us/dedicated- servers/kimsufi.xml](https://www.ovh.com/us/dedicated-servers/kimsufi.xml)

I wish they'd let Australians buy them... They actually forbid you from buying outside your country.

<comment><USER32> Only the K2 $50 one listed there is equal to the 16G, not the K1

The 16G is effectively half the price.

And I believe people buy ovh servers in other countries all the time for backups, maybe you need an account with them first in your own country (but they are not in AUS I guess?)

</comment></comment></comment><comment><USER34> This is excellent news. I've had a VPS on Linode for a couple of years now and the only thing that was really lacking was the disk space.

</comment><comment><USER35> Here's a question: where can I get a VPS with a large amount (multiple TB) of not-necessarily-fast storage? It seems like someone out there should have a SAN-backed VPS, yet I've had trouble locating one.

<comment><USER36> [https://backupsy.com/](https://backupsy.com/)

$80/mo for 2TB. Deals floating around as well as "40% Off For Life Coupon: 40PERCENT" on the home page.

Just signed up with them, and they are having problems with credit card billing, so only feedback so far is they seem responsive to tickets...

</comment></comment><comment><USER37> I've recently started hosting with 6sync and been very happy with their services so far. It's a lot lighter on documentation and has fewer users than linode. But functionality and performance is there.

</comment><comment><USER38> I think DigitalOcean is next shiny hosting thing :), even without this security thing everyone keeps reminding me.

</comment><comment><USER39> The question I keep asking everybody is: "Where do I host my Postgres if I want to have the option to grow disk without paying for higher VM tier?". Specifically assuming I'm managing Postgres myself, not going through Heroku etc. So far only AWS seems to give you that option.

<comment><USER3> I believe Linode used to have the option to attach extra storage but you'd still need to reformat, merge, etc.

Personally, for high diskspace growth needs, I just use a dedicated where I can just get them to throw additional disks in with little to no downtime.

<comment><USER40> They still have that option, but you're limited to an additional 12GB (at least on the 2GB plan). Costs $1/mo per GB that you add on.

</comment></comment></comment><comment><USER41> Still no SSD option? As the owner of a top forum, I think IOPs are far more important than gigabytes.

<comment><USER42> A lot of your woes would be solved by in memory caching.

<comment><USER43> If it's a LAMP app, then not really.

If you have tables with TEXT fields, MySQL up to and including 5.5 will perform certain joins with on-disk tables _no matter what you tell it to do_ and will _ignore indexes_ you create to prevent that on-disk stupidity. This behaviour is independent of engine.

Being I/O choked on Linode is why I moved to DigitalOcean.

<comment><USER14> It sounds like you should have moved from MySQL to PostgreSQL instead of switching hosting providers.

<comment><USER43> Please call me when Wordpress and thousands of plugins and themes have been expunged of all MySQLisms.

Otherwise, heartily agreed.

<comment><USER14> Ahh, Wordpress. You have my deepest sympathies.

If you don't mind my asking, is there some key feature of Wordpress or its plugins that holds you to it? I'm always interested to hear why people stick with it.

<comment><USER43> I personally detest it. But my bloggers are comfortable with it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> Is it because of competition or prices goes down?

</comment><comment><USER45> Every time I upgrade I lose email functionality. Anyone having the same problem?

</comment><comment><USER46> it's good to see more space but it would be nice to see IOPS options

</comment><comment><USER47> What got hacked this time?

</comment><comment><USER48> This thread reminds me of webhostingtalk.com.

</comment><comment><USER49> Sweeeeeeeeet</comment>


Ask HN: How would you handle a large traffic spike (eg. being frontpage on HN)? - <AUTHOR> What strategies would you use to prepare or respond to a large spike of traffic? <comment><USER2> This depends almost entirely on what you're doing. If the site at issue isn't dynamic, my suggested action is probably "do nothing", because being frontpaged by HN is not going to tax any computer routinely used to serve web pages in 2017.

If you genuinely have problems, then the question boils down to "What is going to break first?" and whether it makes more sense to harden that or temporarily disable it. If you're a flight search engine and responding to flight searches is just intrinsically costly, then you probably need more capacity and/or a way to "shed load" and redirect folks into some sort of queue or alternative UX ("We're overloaded; give us your email address and we'll get back to you.")

If the dynamism on your pages is something that is incidental to their functionality, fakeable, or chosen simply for programmer convenience, you can dial down the dynamism for the time being via e.g. sticking a cache in front of the page, serving a static HTML version of it, pre-baking the default search/etc rather than recomputing it live for each of the 40k sessions, etc.

The most common "HN killed my website" is probably WordPress being served by Apache with KeepAlive on. That isn't simple to remediate if you continue serving WordPress from Apache; this would be one of my fairly few cases where it's a fundamental technology choice. (It is possible this has changed in recent years, but for a period of several years "apt-get php apache2" would get you an install guaranteed to blow up in production with over 10 simultaneous users.)

<comment><USER3> Absolutely nothing. I've had my personal site reach the top a couple of times and its been totally fine each time. My site is static and runs on a $5 Digital Ocean droplet. The traffic barely even made it blink.

<comment><USER3> Just realized that my app responded to the top comment rather than the post itself.

</comment></comment></comment><comment><USER4> Caching.

I used to be responsible for sites involved with the Olympics. For 100 weeks traffic was next to nothing. For the two weeks preceding and two weeks during the games there really was spike after spike after spike.

The site basically used nginx with SSI to serve up static content that was generated from Rails. Almost everything we could make static was. We rsync'd files every minute or so across the cluster and would lazy load for content at an individual node if needed.

For dynamic stuff we figured out tricks to use JS, APIs and memory cache dynamic partials. I wouldn't recommend any of that unless you really have the need though.

<comment><USER5> Did you really use Rync? I figured there might be something more modern.

<comment><USER4> Yeah this was back in 2010-ish.

I explored a lot of distributed file systems, was really looking for something that would share files across the cluster once generated by one node. NFS, Ceph, GlusterFS, GridFS, some others.

</comment></comment></comment><comment><USER6> Turn on caching. That's it. Even at #1 on HN, you're looking at no more than 10-20K visitors in a day. It's not _that_ much traffic.

</comment><comment><USER7> To prepare:

1\. Load test and fix what breaks. In the fastest and least-sophisticated way, this is just taking typical requests and throwing increasing numbers of them at your server until it breaks (or if you're testing in production, until user experience begins to deteriorate). This is the most accurate way to identify performance bottlenecks and also gives a rough estimation of your total capacity. If you do nothing else, do this.

2\. Make sure your failure state isn't disastrous (for example, if our servers go down, you're still presented with a somewhat-functional webapp, not a 503 error page).

3\. Make sure you are able to (and know how to) identify when systems are failing due to traffic and quickly add capacity to any component of your system. Ideally you have SMS/email alerts for this (they're really easy to set up in AWS, for instance).

"Hugs of death" (at least at the HN or even large subreddit scale) are not usually caused by lack of raw computing power, they're usually caused by architectural/algorithmic flaws exposed by unusual request volume. Send that traffic yourself ahead of time, and then fix those.

This is essentially how sites and services for large hardware launches are scaled (such as console launches), just with more sophisticated methods. I took this approach with Guilded ([http://www.guilded.gg](http://www.guilded.gg)) and the hug from hitting #2 on a million-person subreddit only reached about 15% of capacity.

</comment><comment><USER8> Caching! Cache responses where possible and have the webserver serve it instead of going to a dynamic backend (php, node, ruby, python, ...).

Not worked with apache for a while (it is probably sufficiently configurable too), but nginx is quite resilient and makes "basic" caching very easy (proxy_cache and fastcgi_cache should cover you)

</comment><comment><USER9> If our current site got a 10x spike in traffic with little to no warning, the only thing we could do to prevent it from keeling over would be to raise the cache timeout on our caching proxy.

Why?

Well, we could easily add more application servers as needed. That would take about 15 minutes, and we'd probably only need to increase the count by about 50%, as we've got plenty of spare capacity.

The real problem is our database server. Or rather, the way our CMS uses the database. Any sort of traffic increase to the CMS hammers the DB to the point of deadlocks (yes, on reads) for other portions of the site. We have some plans to improve the situation (including changing some stupid DB config decisions made a decade ago), but nothing that can be implemented short term.

Thankfully, the CMS content is fairly static, and our 1-min caching isn't very aggressive. Increasing the cache timeout to 10-15 min would result in far less backend traffic and get us through most traffic spikes. The rest of our site either is available only to paying users (and thus far less likely to be significantly affected by a traffic spike) or served primarily by other data stores with much more room for capacity growth in their present configuration.

</comment><comment><USER10> Make everything static. Unless you really need some sort of dynamic content. If you do need dynamic content, make sure to stress test it. There are tools out there to load test your website to see if it breaks.

Put it on Cloudflare. Cloudflare can absorb huge volumes of traffic with ease. Keep in mind there are other WAFs (Web Application Firewalls) you can check out.

Use as little third party widgets / bells and whistles as possible, and self host assets when you can. If these go down (which they will when your site is trending on Hackernews), then your site may not load correctly and leave your users frustrated. Remember the recent S3 failure? It broke thousands upon thousands of sites.

<comment><USER11> Also, if your site is dynamic but doesn't really need to update on every load you can set up Cloudflare to cache for a short period (e.g. 5 minutes).

</comment></comment><comment><USER12> If you don't make your website a megabyte-sized monster, it isn't a problem. Serving simple html/css content is possible to more users than hn has at any given point in time from a single-core Pentium 2. Anything more than that is just bloat.

</comment><comment><USER13> Prepare ahead of time. Short of using an elastic load balancing service, predict when you may have traffic spikes, and choose a cheap-to-implement solution such as request-level load balancing.

Create replicas of your web server processes on different machines for the duration you expect a potential traffic spike. Use a fast dispatcher like nginx[0] as a reverse proxy to load-balance requests to the appropriate replica web server machine.

If you see consistently low traffic, spin down the replicas and remove them from your load balancer configuration.

[0] [http://nginx.org/en/docs/http/load_balancing.html](http://nginx.org/en/docs/http/load_balancing.html)

</comment><comment><USER14> Last time (actually, the first time ...) a blog post on my website went to the front page of Hacker News WordPress with proper caching enabled (using WP Super Cache with pretty much the default settings) worked just fine.

</comment><comment><USER15> A one-off (or hoped-for) event? I'd just stick CloudFront in front of it...

If I were hoping to build a high traffic site (as in - I expected long-term heavy traffic, rather than a single "spike") - I'd work out how to most easily implement my cms's caching options with CloudFront or S3 or some other CDN.

Most important thing is to make sure a page view doesn't _really_ require a bunch of db hits or personalisation. (Especially not if you're using something like SiteCore or are running super lean with WordPress on inexpensive shared hosting...)

</comment><comment><USER16> I've had several posts on the front page running on small boxes without issue. At peak I saw 150-200 simultaneous users in Google Analytics. Sitting at the top of the front page for several days would probably see more than that. Putting a Cloudflare caching layer in front wouldn't hurt, but I didn't really need to do anything to prepare.

Alternatively just publish on a hosted blog service like WordPress, Medium, etc.

(This assumes your content is a post and not an app.)

</comment><comment><USER17> Static content in a ram disk and haproxy+apache replicas grown as required. No CDN.

Even the most "dynamic" sites in terms on non user-specific content can be turned into a static snapshot via a simple cron job. That means the dynamic content is only ever hit by one person, that being cron.

Real user-specific dynamic content must require a login and cookies for haproxy to even let the connection pass the first stage of validation.

</comment><comment><USER18> Happened to me with an article of mine.

It got to be 3rd at the most, if I remember correctly.

I got 300 people at the same time for about 10 hours, then high but not crazy traffic for 2-3 days after that.

300 people at the same time is not a lot.

I had a WordPress website with no cache on a dedicated VPS (but nothing crazy), and neither the CPU nor memory got that busy. 300 people are about 1 person/second, 2 max. That's not a lot of load for a server.

</comment><comment><USER19> My company did some email marketing that would spike traffic to 50,000 visitors in 30-60 mins and Wordpress MySQL would go nuts. Who knows how many horrible plugins marketing had in there but first go to for me was varnish, then cloud flare then final awesome fix was swapping everything to static HTML that we crawled every night ourselves from our own htaccess blocked Wordpress. Only thing that had to be dynamic /do related was the contact form.

<comment><USER20> >Who knows how many horrible plugins marketing had in there

Why aren't you proactively working with "marketing" to figure out why they installed the plugin and helping them reach their goal in another way?

<comment><USER21> I've seen many marketing departments go around IT because they perceived it as too rigid, slow and inflexible.

</comment></comment></comment><comment><USER22> Is HN front page a large spike in traffic?

<comment><USER2> No.

For the benefit of other folks doing capacity planning: expect peak load of ~25 requests per second [+] in the first few minutes after your thing hits the front page and 50k~80k sessions over the course of a day for a typical article-style UX, coming both from HN and Twitter/etc assisted magnification of HN articles.

[+] For your HTML; you'll of course get the usual multiplication for linked scripts/css/images but you'll come nowhere close to saturating your uplink with those, so the limiting factor is almost certainly processing time for dynamic requests.

</comment></comment><comment><USER23> My planned solution: Use Jekyll instead of WordPress.

I have still not finished that migration.

<comment><USER24> Surely there are Wordpress plugins that handle caching/static page serving? Or is it insufficient?

Otherwise did you consider Grav[0] or Zotonic[1]

0\. [https://getgrav.org/](https://getgrav.org/)

1\. [http://zotonic.com](http://zotonic.com)</comment></comment>


Ask HN: Why do you use Azure? - <AUTHOR> I recently changed jobs, and new employer is heavily invested in using Azure and is using everything they can from Azure. If I had to say why it seems it is maybe because Azure had some free credit with visual studio licenses that my employer already pays for everyone, but this credit is mostly not used. It may be that the industry I work in is a bit more windows heavy also.
In general though I find Azure quite horrible to work with. One of the things we use from azure is azure DevOps - which is one of the most unfortunate things I have seen in some time. Gitlab's free offering is vastly superior and I don't think you will have to go far to find something that is a substantially better choice than Azure DevOps.
In general Azure seems to be quite rickety, with VMs sometimes taking more than 10 minutes to delete. The consideration for linux is also severely wanting when it comes to their tooling.
I have worked with AWS and GCP, both are significantly less painful to work with. I don't get why Azure is even a player in the market with how sub par their offering is. <comment><USER2> Clearer dashboard, much clearer and more complete docs (compared to AWS I've been working with).

Also, I'm really a fan of DevOps, the dashboard is really complete and versatile, and allows for more serious planning than just issues.

I don't have trouble working with Azure, including for user management and access rights, where it's always been a hell in AWS to learn.

About GCP, I can't compare, they never accepted my bank credentials.</comment>


Show HN: Px - A tiny 2D canvas framework for puzzle games - <AUTHOR> https://github.com/stillwwater/Px <comment><USER2> Cool stuff! It reminds me a bit of puzzlescript, although the codebase looks a lot more capable of expansion (tried fixing an issue on Puzzlescript's UI once and... man I found it very hard to read anyway).

Considering the simplicity of the games, making a UI for building the games seems like it'd be pretty easy, do you have any plans for that?

<comment><AUTHOR> Thanks! I'm new to HN and I totally missed your comment. The idea really was to keep the codebase as small and easy to read as possible so it could be modified as needed for more complex games. Definitely took inspiration from puzzlescript, but yeah their codebase is massively complicated.

The level editor right now is really lacking, a nicer UI would indeed be pretty easy to do. I'll look into improving it, or if people want to contribute that would be cool too.</comment></comment>


BTW: Where is the link to top news.yc? - <AUTHOR>

<comment><USER2> I got rid of that link a couple weeks ago. You can tell how useless it was from the fact that no one mentioned this till now. You can still get to the page via the url:

<http://news.ycombinator.com/best>

<comment><AUTHOR> Hm ... when I came here for the first time, I read probably everything in the top section ... it was useful for me as a newcomer.</comment></comment>


Python manylinux - awinter-py https://github.com/pypa/manylinux <comment><AUTHOR> A mention of what a "wheel" is would be nice somewhere. I associate it with the "wheel bit", which appears to be entirely unrelated.

<comment><USER2> awinter-py has the correct answer.

And in keeping with the cheese shop gag, a wheel is "A container for cheese." [http://wheel.readthedocs.io/en/latest/](http://wheel.readthedocs.io/en/latest/)

<comment><USER3> What came first, egg or the wheel? The egg.

</comment></comment></comment><comment><USER4> Looks like arch users will need to install at least one package from the AUR(ncurses5). But apart from that, I'm pretty excited for this, it should make stuff like installing pyqt5 in a virtualenv really simple.

</comment><comment><USER5> Does this mean no more need for a c compiler (and associated libraries) when using pip?

<comment><USER6> Yes.

</comment></comment><comment><USER7> Does anyone else think that github project pages are horrendous?</comment>


Path of Exile (Poe) Is a Worth Playing MMO – Five Reasons to Explain That - <AUTHOR> https://www.awow-tech.com/forum/topic/reasons-of-path-of-exile-why-you-really-need-to-play-path-of-exile/ <comment><USER2> PoE is a great game, but this post just seems like an ad for RMT services, which are very not allowed in PoE and will get you very banned.

Looking at OP's post history, it seems like all they do is advertise these RMT services.

This post should be deleted.

edit: RMT is 'real money trading'; buying currency is RMT

</comment><comment><AUTHOR> Path of Exile has been successfully launched for eight years, and it still has not got an sequel, that you can know how popular this game is. But some players might still do not know why this game is so popular, and they wonder whether they should give it a try, well, after reading this post, you will know why you should play PoE and how to buy PoE Currency. Keep reading by clicking this: [https://www.awow-tech.com/forum/topic/reasons-of-path-of- exi...](https://www.awow-tech.com/forum/topic/reasons-of-path-of-exile-why- you-really-need-to-play-path-of-exile/)

<comment><USER3> Please, DO NOT BUY currency from farming bots, enjoy the lore and learn the game mechanics, it's much more rewarding.

I've given this game over 2k hours of my life and I have no regrets. If you have fun with games where there's a LOT to learn, steer away from EVE Online, it will steal your life.

</comment></comment><comment><USER4> I played Path of Exile for many years since the 1.0 release and always found reasons to go back to it. The only reason I stopped playing was a decrease in leisure time and having to choose between it and Minecraft. Minecraft lets me exercise my creativity much more which is the only reason I picked it. The devs do make some questionable moves (like their mystery boxes aka gambling boxes and frequent nerf/buff cycles simply for the sake of change) but they are by far the most in touch with their playerbase of any game I've played and this really shows. The game looks amaznig, plays amazing and is always improving.

/plug

</comment><comment><USER5> I don't really understand the multiplayer portion. If I've only played Diablo 2 single player what should I expect to be different in the gameplay. If you say MMO is it a world that's always full of other players?

</comment><comment><USER6> one of my favorite games for the sheer depth of all the systems / mechanics available in game</comment>


Emacs hidden gems: Version Control - <AUTHOR> http://www.credmp.org/index.php/2007/12/08/emacs-hidden-gems-version-control/ <comment><USER2> "There are only a couple of keybindings to remember for day to day usage; C-x v i, C-x v v, C-x v =, C-x v l, C-x v m and C-x v g"

That's about 6 too many for my taste...

</comment><comment><USER3> Most of what is gem-like about Emacs seems to be hidden.

</comment><comment><USER4> Shame it doesn't support darcs.

<comment><USER5> My thoughts exactly on seeing this article. Looked on google and found this: <http://chneukirchen.org/repos/darcsum/>

Only limited support (you'll still be using the command line) but the whatsnew and record functionality is really useful (just make sure the cursor is at the bottom of the whatsnew buffer before hitting R otherwise it misses all the changes for some reason, at least on my machine)</comment></comment>


Startup Quote: Tim Westergren, founder, Pandora - <AUTHOR> http://startupquote.com/post/1467390350

<comment><AUTHOR> Don't be shy about believing in your ideas - even if folks around you think you're crazy.

\- Tim Westergren (@timwestergren)

<comment><USER2> Thank you, the link was gratuitous.</comment></comment>


Do startups outsource their hacking needs? - <AUTHOR>

I'm an American hacker and I've lived in the Philippines for almost a decade. I'm considering the possibility of re-launch an outsource programming business that failed several years ago due to shall we say "less than steller" marketing efforts.
I can provide highly skilled engineers in C++, PHP/MySQL and many other languages for labor rates in the $1200 - $1800 a month ($7 - $11 per hour) range and the Filipino programmers I've hired in the past have been more focused and motivated than most others I have worked with throughout my long career in this industry.
Yet I'm struggling to understand whether or not IT startups are potential clients for outsource programming services, and I'm also not sure how to market the business successfully this time around.  Having a salesperson in the USA is something we didn't try the last time and perhaps it would be a productive approach, but perhaps other marketing techniques might make even more sense.
What do you think?
Are there startups that might hire me to provide their programming services on an outsource basis, or is my market limited only to well-established web and IT ventures?
Or should I be looking at other industries to find the best clients and customers for this type of business?
And what type of marketing should we be engaging in this time around? <comment><USER2> I think that many startups outsource their hacker needs, especially early on. Contact me [wirdog at gmail dot com], I would love to find out more about what your engineers can do for me.

<comment><AUTHOR> Thanks for your interest wirdog, I will email you privately as requested.

My former partner had his own marketing ideas so we never tried to serve startups before. He always claimed that startups do their own programming. His big thing was to bid on contract jobs on scriptlance, getafreelancer, etc. but those were mostly dead-end efforts. We seldom got any repeat work, and too many advertisers care only for the lowest possible price rather than quality or reliability. Go figure ...

</comment></comment><comment><USER3> awadsayeed at gmail dot com, i'd be very interested in hearing from you</comment>


Pylava: A fork of the Pylama code audit tool for Python 3.7 - <AUTHOR> https://github.com/pyfocus/pylava/wiki/Announcing-Pylava:-A-fork-of-Pylama-for-Python-3.7 <comment><USER2> I've had this experience with a bunch of popular Django-related projects recently, where they stop receiving regular PR review and releases. Keeping up with Django's release cycle then requires digging into the bug trackers and forks for common dependencies. It's totally understandable for that to happen, when even popular projects rely on the volunteer effort of one or two people.

One model I'm curious about is [https://jazzband.co/](https://jazzband.co/), "a collaborative community to share the responsibility of maintaining Python- based projects." Not sure how well that works in practice, but it would be great for something like that to crack the maintainer-burnout problem.

<comment><USER3> One thing which would help would be corporate support. The Django project itself gets some support, probably not enough, but many people forget how much of the value from Django comes from the apps rather than the core framework.

<comment><USER2> Jazzband is interesting from that angle as well -- maybe encourage employees to spend some 20% time as Jazzband maintainers?

<comment><USER3> Agreed — it'd be huge if companies donated even modest amounts to ongoing work on the open-source products which power their business.

</comment></comment></comment></comment><comment><USER4> > On some Python 3 distributions, you may need to replace pip with pip3 in the > command above.

Are there any distributions where the command pip just works with Python 3?

In every Python 3 installation I have used, I had to invoke it as pip3. So it seems to me that pip3 is the commonly used command and one may need to replace pip3 with pip only on some distributions.

<comment><USER5> Arch Linux has been shipping Py3 as the default python for a long time…

<comment><USER4> I am aware of that. So has been many other distributions like Debian, Ubuntu, etc.

My point was: Which command do you normally use to install packages in Python 3? pip3 or pip?

I thought it was pip3 but the article seems to imply that using the pip command to install packages in Python 3 is common too. If this is true, which distribution ships Python 3 with pip instead of pip3 for installing packages in Python 3? Does it not conflict with pip of Python 2?

<comment><USER5> If 'python' is 3, I'd expect 'pip' to be for 3, and 'pip2' for 2.

<comment><USER4> Ah! That makes a lot of sense. If Python 3 is the default, it does make sense 'pip' to be the Python 3 pip. That way 'pip' always refers to the default version.

Unfortunately in the Ubuntu and Mac world 'python' is still Python 2.7 and 'pip' refers to the Python 2 pip. Python 3 is available as 'python3' along with 'pip3'.

</comment></comment></comment></comment></comment><comment><USER6> This is an interesting story. Python breaks perfectly reasonable code which is surprisingly nothing new for Python. A tool stops working. Users want fix. Author of the tool is unavailable. The tool needs to be forked. A new name needs to be chosen. A new distribution point needs to be established.

All because Python chooses to break existing code.

Can't the software designers of this century choose to provide feature flags (use strict, use VERSION, etc.) to enable new features that break existing code?

There was a nice and popular article/blog post from someone famous about never ever breaking existing code or functionality because users depend on it but I cannot remember the title of that post to search it.

<comment><USER7> I guess you're mostly complaining about Python 2->3? That was a long time ago, and Python is hardly the only language to introduce a new, breaking major version.

This is a code analysis tool, quite different from your average library. It broke because Python introduce new reserved keywords (async/await). This is a non-breaking change for almost all libraries/software (and if it IS breaking for you, you probably just have to change variable names or something similar), but code analysis tools are different, they have to be totally up to date with new language features. Lots of languages introduce new reserved keywords decently often (in fact, lots have explicitly added async and await somewhat recently), it tends to break very little, except code analysis tools.

</comment></comment><comment><USER8> > With the release of Python 3.6, it became clear that Pylama was in need of > maintenance updates. Python 3.6 warned that async was about to become a > reserved keyword in Python 3.7.

I can imagine there must be lot of code bases with async as variable name. For example:

      async = True

This is an error in Python 3.7.

      >>> async = 1
        File "<stdin>", line 1
          async = 1
                ^
      SyntaxError: invalid syntax

But this used to run just fine without any warning or issues until Python 3.5.

So now any code that uses async as a variable name would break. So is Python 3.7 considered a breaking change that is not backward compatible?

<comment><USER9> Yep, Python doesn't use semver and after 2-3 I doubt they're keen on major version changes any more.

From the 3.7 release notes ([https://docs.python.org/3/whatsnew/3.7.html](https://docs.python.org/3/whatsnew/3.7.html)):

Backwards incompatible syntax changes:

        async and await are now reserved keywords.

<comment><USER8> Has any other mainstream programming language like C or Java introduced such reserved keywords in a new release? I guess if C or Java were to do something like this it would cause a lot of hue and cry.

I remember when C++ had to introduce a keyword for automatic type inference they reused the 'auto' keyword instead of introducing a new keyword at the risk of breaking a lot of existing code.

How do other mainstream languages handle a scenario like this where a new keyword is required?

<comment><USER5> C/C++ compilers support multiple versions of the standards at the same time. You can compile one file with -std=c++98 and another with -std=c++17 and link them together just fine.

Rust is now doing the same thing with editions.

Perl has 'use VERSION', but I'm not very familiar with it, not sure if e.g. new keywords only become available with that statement. The docs say 'use VERSION also lexically enables all features available in the requested version…'</comment></comment></comment></comment>


2 Hours of Standing at Work May Boost Your Health - <AUTHOR> http://www.livescience.com/51819-sitting-standing-health.html

<comment><USER2> 700-person sample size monitored for 1 week, and they didn't change their behavior during the study.

This is totally meaningless. You can't even draw meaningful correlation from a sample size and time period this small, and causation is absolute fantasy. Maybe healthy people stand more on their own? (Probably, actually)</comment>


Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security - <AUTHOR> https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3213954 <comment><USER2> Questioning the authenticity of records (be they second hand accounts of events, paper documents or 1s and 0s) has been the norm since it became common for people other than royals and clergy to be able to read and write. Jefferson and Adams would not find the concept of "fake news" foreign at all. The sophistication of the authentication mechanism for a document usually has to do with the use case. Official letterhead was good enough for most important routine correspondence. Birth certificates get stamped. Money has fairly sophisticated anti-counterfeiting features.

We'll remember the late 20th and early 21st century as the exception to the rule because during that time period if there was an audio/video recording of something you could be reasonably assured that it was legit. That won't be the case going forward. Audio and video will become a free for all like every other medium.

I'm not worried.

<comment><USER3> Not sure I understand. You seem to be saying that money (amongst other things) can be easily faked (a "free for all"?). But you're _not_ worried??

</comment></comment><comment><USER4> Again, ask yourself why the powers that be are priming the public in order to partially defuse forthcoming very damaging videos...</comment>


Ask HN: how much are houses to buy in silicon valley? - <AUTHOR>

how much is like 2 bedroom apartment or 3 bedroom house in silicon valley, im talking averages here, it deosnt have to be in the nicest area, but not far away from the geeks and techie hype? cheers :)) <comment><USER2> <http://www.zillow.com> or <http://www.trulia.com/>

(Downvote WTF here - he wants house prices, I gave him house prices)</comment>


Show HN: CLJS Fiddle – ClojureScript - <AUTHOR> http://cljsfiddle.com <comment><AUTHOR> I wanted to say thanks to the LambdaX team[1], (of replumb aka clojurescript.io fame) for lending me a hand while trying to wrangle the bootstrapped clojurescript compiler. cljs-in-cljs is actually pretty tricky!

[1] - www.lambdax.io

</comment><comment><USER2> I really like this!

This is definitely needed for the community and I'm very glad to see something like this pop up.

A few missing items for those who wish to share code on StackOverflow, for example: external stylesheets and a way to share the code you've written.

Not everyone uses Regent, so perhaps something more vanilla with ClojureScript + Hiccup, but I see how this could devolve into a rabbit hole.

Overall, a very solid start and I hope this continues.

</comment><comment><AUTHOR> Hello, this is a site for live-evaluating cljs forms into UIs, the way the Reagent library does.

Some ideas about next steps include adding parinfer[1], the ability to save cljsfiddles, or $YOUR_SUGGESSTION.

[1] - [https://shaunlebron.github.io/parinfer/](https://shaunlebron.github.io/parinfer/)

<comment><USER3> This is very nice for evaluation of cljs.

I know this is your own project, and adding parinfer could be useful, but I wonder if collaborating with proto-repl[0][1] to add cljs support to Atom could be something you'd be interested in.

The fiddle is very useful for sharing code snippets, but better clojurescript support in Atom would be a big benefit for me.

[0] [https://github.com/jasongilman/proto- repl](https://github.com/jasongilman/proto-repl)

[1] [https://github.com/jasongilman/proto- repl/issues/54](https://github.com/jasongilman/proto-repl/issues/54)

</comment></comment><comment> Syrup-tan Here's a simple modification to get the random number between 1 and 10

        [:div
         [:p "Hit Run to get a random number:"]
         [:h1 (+ 1 (Math.floor (* 10 (rand))))]]

If you weren't previously familiar with the syntax I figured this might help.

<comment><AUTHOR> I really want to add the ability to save/load content that can be built on. I think it would be awesome to share clever tricks!

</comment></comment><comment><USER4> This is fantastic. As the creator of appshare.co, another clojurescript web repl I realise that this could turn into something really great. Well done!

</comment><comment><USER5> This is cool, IMO. My main ClojureScript experience to date has been non-web (mobile, bootstrap, etc.), but this fiddle even makes it ridiculously easy for someone like me to quickly try an idea out and just experiment.

No need to run through the ClojureScript "Quick Start"—this is just "Start". :) Bravo!

</comment><comment><AUTHOR> Thought I'd bump here and mention that I've added the ability to save/load code using the fiddle. Here's the announcement:

[http://cljsfiddle.com/#gist=d0c3121fb7083f066273](http://cljsfiddle.com/#gist=d0c3121fb7083f066273)

Yay!

</comment><comment> vim-guru This is great! I believe the next logical thing to implement would be handling of multiple files, but `parinfer` sounds good to.

</comment><comment><USER6> This is great. I wish I had this when I was learning reagent.</comment>


You Only Look Once: Unified, Real-Time Object Detection - <AUTHOR> http://arxiv.org/abs/1506.02640 <comment><USER2> This is very cool. It looks from the videos like the next step for them is to provide some sort of temporal stability so that detected objects don't get temporarily forgotten across frames and so the bounds expand and contract smoothly. It's obvious that the detection is being run frame-at-a-time.

I also wonder to what extent merging the detection with underlying P-frame information from the video codecs would help. Knowing that a segment of video just moved to the left would mean the detected object could be moved to the left by the same amount, even if it was passing behind another object. Calculating the movement vectors independently seems silly if you can get that data from the underlying video codec itself.

</comment><comment><USER3> They named their method "YOLO"…

Edit: to add something more "helpful" to this comment, their paper links to a YouTube channel [1] that shows demos of their method, which I think is great.

[1] [https://goo.gl/bEs6Cj](https://goo.gl/bEs6Cj)

<comment><USER4> (Darknet) [https://github.com/pjreddie/darknet](https://github.com/pjreddie/darknet)

</comment></comment><comment><USER5> This is really cool, even inspiring. Not just because it's one of the first examples I've seen of accurate, real-time detection powered by neural nets, but because they're getting these results via black magic, basically.

The objective function is defined heuristically, and involves about five different sub-objectives (top of page four). Some of the parameters chosen seem to be rough guesses, as does the decision to scale up the images to twice the resolution when moving from classification (the pre-training task) to detection.

It seems miraculous that a process of estimating and refinement, guided by experience, can work on tasks where you have no mathematical guarantee that a good solution can be found. Maybe in time we'll build the theory that explains just why deep learning works so well, but for now I'm just kinda awed and impressed every time one of these stories comes out.

<comment><USER6> I share your optimism, however it isn't obvious from the paper how many hyper- parameters and different variations of the loss function were tried to get this result. It is still cool that something so heuristic can work so well.

</comment></comment><comment><USER7> In the paper they use the abbreviation mAP without explaining what it is or providing a reference, such as "Fast YOLO, processes an astounding 155 frames per second while still achieving double the mAP of other real-time detectors"; do folks know what mAP is?

<comment><USER8> I'm assuming "mAP" in this context is "mean Average Precision": [http://fastml.com/what-you-wanted-to-know-about-mean- average...](http://fastml.com/what-you-wanted-to-know-about-mean-average- precision/)

The other possibility would be "maximum a posteriori" which doesn't fit their usage here.

</comment></comment><comment><USER9> One of the authors has additional information posted here: [http://pjreddie.com/darknet/yolo/](http://pjreddie.com/darknet/yolo/)</comment>


Life as a bug bounty hunter - <AUTHOR> https://www.technologyreview.com/s/611896/life-as-a-bug-bounty-hunter/ <comment><USER2> Bug bounty literally changed my life.

In 2013 Facebook paid me $5000, because of it I was able to pay my education loan(in India) and avoided all those compound interest.

I started way before when it was popular and actually got my current job from this thread "list of YC companies I've worked with(Hacked)" [https://news.ycombinator.com/item?id=10463286](https://news.ycombinator.com/item?id=10463286)

Bug bounty is really hard these days, you are competing with the whole world - whoever report first, wins(even when you have put equal efforts)

It's good for side hustle but you can't do it full-time these days.

<comment><USER3> I'm still doing bug bounty as my full time job these days and planning to invest some of my bounty for a business in the future :)

<comment><USER4> Are you in the US?

It seems like it may be possible to live on the bug bounty rewards in places with cheaper cost of living, but you would need to get, like, 10 $5,000 bounties a year to survive in the US wouldn't you?

<comment><USER5> > you would need to get, like, 10 $5,000 bounties a year to survive in the US > wouldn't you?

More like 2 $5k bounties a year for me. Where I live in the U.S., I could rent a house for $500/mo ($6,000 a year), and I eat about $200 of food per month ($2,400 a year). So the cost of living per year is $8,400.

But yes, it entirely depends on where you live. For me, I specifically chose this place so that I could live comfortably on bug bounty income

<comment><USER6> Assuming you don't need to pay for health insurance and can handle financial ruin if you break your leg.

Assuming you don't need to pay for electricity, water, trash service, internet, phone service, medicine, toilet paper, detergent, need to leave your house ever, buy a computer to actually work with.

<comment><USER7> I mean, i had lady brag to me that she was in a super nice apartment for $375/mo in my area. That leaves a lot of room for toilet paper and detergent.

<comment><USER6> So you a pseudonymous stranger have heard from an anon stranger that somewhere there is an apartment for rent with undefined qualities and location that is "super nice" for near 1/3 the median rent. A rate that wont rent a yurt in most places.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I had one experience reporting a security vulnerability to a bug bounty program and never want to do it again. I reported an issue to United Airlines that I could reset anybody's MileagePlus number by only guessing their Security Questions ("what is your favorite sport", etc), bypassing any email confirmation or anything like that. After 3 months of back and forth with their security team, they released an Android update that patched the issue. I was then told "It turns out this fix was pushed by the QA team and was actually unrelated to your Bug Bounty submission" and that my submission was ineligible.

Your mileage may vary, but the headache for me is not worth the payout

<comment><USER9> > Your mileage may vary

Not anymore, thanks to your report :)

</comment></comment><comment><USER10> There are some people who make a living doing this, but 99% of people are just making some side cash and messing around.

I've made some money doing it, not a lot, and to be honest, most of the submissions I've sent have been to unpaid programs (but through Hackerone, Bugcrowd, and some companies own bug bounty systems). Why? It's fun to be able to poke at large orgs, find issues, report them, and not have some pissy response like I used to get before bug bounties were a thing. You'll actually see them get fixed and you're doing stuff that may prevent unsavory types from screwing people over.

My favorite response though is still the "This is a duplicate from [random date six months ago]". Oh, so you're purposefully just leaving an XSS live on your corporate SSO? Makes sense! Nobody ever tries to phish corporate logins at large organizations.

<comment><USER5> > My favorite response though is still the "This is a duplicate from [random > date six months ago]". Oh, so you're purposefully just leaving an XSS live > on your corporate SSO? Makes sense!

Ug. I've submitted 2 bugs to Vimeo that gave this exact response. I even followed up a few months later to see if they'd patch it and they responded, "the developers are aware and working on it" ...

Seriously? Leaving 2 XSS bugs open on your website that you run a bug bounty program for?? for a year?

I really wish hackerone would punish this sort of behavior as it's a waste of every hacker's time to find a bug, write a report, only to be told it's a year old known bug so it's not eligible for a bounty.

<comment><USER11> I found an submitted a bug once through bugcrowd to a very well known company where a session cookie could be used for complete account takeover even after the user had signed out etc. I was blown away when I got the "duplicate" response for a submission that was almost a year old. I wonder if they've ever fixed it...

</comment></comment></comment><comment><USER12> If you're genuinely good at finding vulnerabilities, and you can legally work in the US or Europe, you're pretty eminently hirable, and the impression I have is that the rate you'll command will probably swamp what you make on (ordinary) bounty submissions. I think most people who are really good at this either (a) use bounty programs as a way to liquidate _extraordinary_ vulnerabilities, and are well compensated for it, or (b) do it as a side hustle.

<comment><USER13> Bounties are one thing but how about selling exploits to organizations like zerodium? Since you won't disclose,won't they pay a lot better?

<comment><USER12> If you can repeatably find the kinds of bugs Zerodium claims to buy, you probably already know what your best financial options are.

</comment></comment></comment><comment><USER14> >> Companies like Bugcrowd and HackerOne (both of which Ricafort has worked with)

This article is very poorly written. It leaves out a lot of key details that could sway ones take away. It mentions that he has done a lot of bug bounties and not gotten paid for some of them. Were they duplicate reports? Was he doing these on his own merit and not going through the bug bounty programs?

The staff at hackerone and bugcrowd will make sure you are squared away when you are submitting reports and dealing with payouts. If a company were to refuse to pay you even though you submitted an in scope report that qualified for payment, these sites would help you resolve those conflicts.

This article to me tries to paint a picture of: Here is a hard working bug bounty hunter who's efforts barely go noticed because so many mean companies don't want to pay him, he can only make a meager living.

I take it as someone who doesn't go through the proper programs and sites, so he's playing with fire on getting his findings reported. If you are just some random hacker who emails a company out of the blue with a random vulnerability finding, most will not take you seriously. Companies who want to be hacked, have bug bounty programs and disclosure pathways. If he's as good as the article paints him to be, he should be making a ton more money than it says he is. So either he is getting royally screwed out of payments by not going through bug bounty programs, or he isn't as good of a hunter as he may seem.

<comment><USER15> A number of companies have bug bounty programs that do not go through HackerOne and such, and the quality really varies, from what I hear.

<comment><USER14> Which is why it's irritating that the article left out how he's going about this. I want to know if a majority of his finding were on a site like bugcrowd or if he's trying to do the freelance thing and just getting shot down. I have no input or information about experiences from freelance bug hunters, so I don't know if being ignored is a common thing or if this guy just isn't that good to warrant himself attention.

<comment><USER5> You can find some of the programs he's successfully submitted to via his website: [http://evanricafort.com/achievements/](http://evanricafort.com/achievements/)

a lot of them aren't on H1 or bugcrowd.

</comment></comment></comment></comment><comment><USER16> As a bug bounty hunter, this is nowhere near normal. The average payout for a single vulnerability is over $500, so even finding just one vulnerability a month would be more than mentioned in the article. Full-time bug bounty hunters often earn thousands to tens-of-thousands per month, making it far from a "struggling" profession.

</comment><comment><USER17> At least hackerone still feels focused around disclosure so if you have a dupe you get linked to the original report.

With bugcrowd you can get closed as duplicate and never get to see the original report so just have to trust it's really a dupe.

With hackerone you can push for disclosure which puts a clock on companies (unless they completely disappear from the platform which has happened).

Neither feel like a route to riches but both are good for finding companies which probably won't aggressively react to researchers finding something.

Both major platforms feel like they've lost momentum though, on both platforms though it feels like there isn't much in-flow of new companies, and on bugcrowd most companies go through private programs first which really limits how much you can find as a casual well-meaning amateur. The participating companies probably get a better experience that way but the early days of hackerone were more fun.

<comment><USER12> Most H1 companies start "private" as well; the impression, and H1 amplifies it, is that the general public bounty programs are really noisy.

<comment><USER18> My experience is hackerone reports are almost 100% low effort spam, managed in an opaque manner. I would not choose it as a platform for a new bug bounty program.

<comment><USER12> That is not at all my experience with H1, and we manage (and have managed) a bunch of H1 programs for our clients. I wouldn't advise most startups to do bug bounty programs at all, but if I was, I'd recommend H1.

<comment><USER18> You have more experience than I have, obviously, because I'm only involved in running one bounty program on H1.

I have not been impressed with H1. Perhaps my opinion will change as our program matures, but I am not optimistic. I think there's a lot of space in this market for competition.

I suspect if I was driving as much revenue as you are, they might be more responsive. That's life.

<comment><USER12> I mean, I don't know what the problems you had were.

I look at H1 like a loot box in a game like, I don't know, Team Fortress 2. Most of the time you get a bunch of lame stuff. Every once in awhile, no matter how you structure your program or how much you pay, you get an excellent bluebird bug. In a twist on how "real" loot boxes work, sometimes you get bullshit that wastes your time.

I wouldn't pay a lot of money for access to those loot boxes, but for what they are, they're fine, and I think H1 does a good job of presenting and managing it.

I am _not_ a believer in the sales pitch that different bug bounty sites have materially different cohorts of testers. The people you really want to attract probably aren't affiliated with any particular bounty site.

</comment></comment></comment></comment></comment></comment><comment><USER19> I once found a bug for a company and reported it on Hackerone. Then they said it was a duplicate bug report and paid nothing but also immediately fixed it. My problem is most bug bounty programs put the power completely in the hands of the company.

I think there is probably a market for a site where users post the bounties with a detailed and accurate description and their desired price or the community and affected company bid to determine the value of a bug. The affected company could then "purchase" the bug and then the person who filed the report would pay an authoritative trusted third party like a professional security firm to verify the vulnerability. Then the person who found and reported it gets paid if the third party verifies it exists. The company would only get the vulnerability description if the third party verifies it to exist.

</comment><comment><USER20> I used to work on the android VRP doing report analysis; I can confidently say that we never intentionally ignored or downgraded reports to save money. There were a few cases of things slipping through the cracks by missing bug assignees, but the majority of the engineering staff really did want those researchers to get as large of a payout as we could justify, and I imagine other companies/VRPs are in a similar position.

I think the true root cause of the payment discrepancy issue we see in this article is the bias towards believing the vulnerabilities that we find are more significant than they may be. It often can be either a matter of pride, or sometimes just a misunderstanding of the severity guidelines as published.

</comment><comment><USER21> Feel like one could make more than $500 a year doing anything else with the skills required for bug hunting.

<comment><USER22> Node he's making about that much a month, which is apparently around the average income where he lives.

Still, it seems low.

<comment><USER23> There is people making way more on average doing it on the side. It is really hard to judge how skilled someone is (what is the framework to compare with?), but it is not like nobody actually makes real money.

</comment></comment></comment><comment><USER24> My team runs the bug bounty program for our company.

What we get is a lot, lot of garbage reports (with public programs) and we spend a lot of time on basic communications with people who barely speak English. At some point we had to mention that we acknowledge the reception of each report and if you do not hear from us then it means that it is not accepted.

And then there are the good reports and, boy, some are really neat. We gladly pay for them and keep having many of the hunters coming back.

Making things clear from the start and keepingvyour word makes a long way. Bug bounties are great when well organized and a hell on earth for the unprepared.

</comment><comment><USER25> Why do people do that? Selling their findings for chump change, possibly very serious vulnerabilities highly paid architects missed? Obviously they want to do The Right Thing, but they are very much in a position to negotiate.

<comment><USER26> I guess it's like fishing or hunting. You don't necessarily want to eat the catch, but there's a certain thrill to it.

</comment></comment><comment><USER27> Exploiting smart contracts are the ultimate bug bounties these days.

Forget these fortunes 500s, governments and startups.

And to the cynics? This is perfect for you if you hate cryptocurrencies and everything blockchain. Yeah, they're broken, make some money off of that.

<comment><USER15> Has there yet been any attempted legal action against someone who has "exploited" a software contract?

I mean, most of the smart-contracts crowd seem to be of the opinion that whatever a software contract permits must be its intent as well, but I don't imagine that conviction would prevent them from filing suit once they'd lost money.

<comment><USER28> In general, doing research in the US is a bad move because of the CFAA.

<comment><USER27> "Researching" a smart contract just means broadcasting a transaction to a node in the network.

There are over 15,000 Ethereum full nodes, you can hit one not in the US from your own reported location not being in the US.

The gas you use in your address also needs to be unlinked from your identity too. So basically over tor just shapeshift like $5 worth of Monero to an ethereum address you just created.

A transaction with a specific set of instructions will execute the smart contract program on any of the 15,000 nodes in the network.

</comment></comment></comment></comment><comment><USER29> This has been discussed a few times before on HN and I shared the anecdote that I have attempted to report multiple serious security issues to Google and Facebook and have been completely ignored, 100%.

There is a tiered internet nowadays, if you go real name and have a following you are treated quite differently from everyone else. You can't even get a response to emails or forms, much less paid out a bounty if you're not in the former group. The algorithm has made everyone who isn't a minor celebrity irrelevant. I don't care how much it benefits the corporations interested in marketing to me, I don't want a following, thanks.

Fortunately being able to "crash google" at will during cocktail parties and job interviews always impresses people, so I guess I'll just keep on doing that until they fix the problem.

<comment><USER20> I think your idea of "serious security issue" differs from googles. nobody cares if you can cause a local crash with some bad js in the console.</comment></comment>


Beyond the Bay: Comparing the world's top startup ecosystems - <AUTHOR> https://www.simplybusiness.co.uk/microsites/top-startup-ecosystems/

<comment><AUTHOR> It look me a minute to realize, but you can change to any of four different data-visualizations by clicking the large buttons under the header.</comment>


Watch SpaceX's StarHopper hop 20 meters untethered - <AUTHOR> https://www.youtube.com/watch?v=Rfb0cd17IAY <comment><USER2> Launch delayed till tomorrow.

</comment><comment><USER3> When the flames started coming out the side for the ABORT I was freaking out. "Nooooo not again!"</comment>