How to root a Nook Color to transform it into an Android tablet - <AUTHOR> http://arstechnica.com/gadgets/guides/2011/02/howto-root-a-nook-color-to-transform-it-into-an-android-tablet.ars <comment><USER2> A few notes:

* Dalingrin's overclocked kernel is very nice- it can overclock from 800mhz to 1.2ghz stably, and 1.3ghz slightly less stably. Works on all 2.2/2.3 ROMs (Stock 1.2, Nookie Froyo, CM7), and is included with recent CM7 nightlies: <http://forum.xda-developers.com/showthread.php?t=925451>

* The app Nook Color Tweaks (<http://forum.xda-developers.com/showthread.php?t=1104039>) is also very nice- if you have Dalingrin's kernel, it'll let you customize the voltage settings for overclocking, increase speaker volume, and this:

* USB Host support. If you buy a microUSB male to USB female adapter, you can plug in a mouse, keyboard, game controller, webcam, flash or hard drive, what have you. Works extremely well. <http://forum.xda-developers.com/showthread.php?t=1105497> (note that the Nook Tweaks app with the Dalingrin kernel already has this built-in)

* CM7 (and maybe Nookie, not sure) have Bluetooth support, meaning that you can use a BT headset or controller (Wiimote, mostly) with it. The main downside is that it's kinda wonky- it works most, but not all of the time, and it has a really terrible range (I think 11 inches was the last I heard). However, when it works, it works fabulously.

* In CM7, if you'd prefer using the internal 5Gb of storage as opposed to a microSD card, flash this in recovery: <http://forum.xda-developers.com/showthread.php?t=1034939>

* The Netflix app won't show up in the Market by default, and even if it does, browsing the menus won't work in landscape. Grab a fixed APK from here: <http://forum.xda-developers.com/showthread.php?t=1159266>

* If you want to get Hulu working, look here: <http://forum.xda-developers.com/showthread.php?t=1040971>

* There are a few apps that crash if you don't have an IMEI, which the Nook Color does not. It's not a fantastic idea, but here's an IMEI generator: <http://forum.xda-developers.com/showthread.php?t=1103766>

I've had a CM7'd Nook Color for a few months, and it works fantastically. As long as you're not gaming and don't mind the lack of webcam, it's better than an iPad and half as expensive.

<comment><USER3> Is it possible to use mouse with android? This can be very useful for high resolution precise input. Thanks for a very informative post I am going to get a Nook Color now.

<comment><USER4> Yes. I have a Sylvania tablet with USB host and plugging in a mouse causes a pointer to pop up.

</comment></comment></comment><comment><USER5> I don't know if Nook Color is counted in the Android tablet category ( think it counts as e-reader) , but by far it is the best tablet for value.

<comment><USER6> It's quite possibly the largest Android device by count. Estimates put it put it over 3 million Nook Colors sold. This means there are more Nook Colors than there are Galaxy Tabs, Zooms, or Transformers out in public.

</comment></comment><comment><USER7> I got one 2 months back, and I'm loving it. Flashed it with CM7 the day I got it, and it's perfect for reading books (EZPDF), browsing (Opera Mobile, Dolphin) and news consumption (Greader, Pulse). I also occasionally watch movies on it (Rockplayer) and videos on Youtube. And, of course, Angry Birds on the big display is fun.

</comment><comment><USER8> CM7 nightlies + Google Apps. It's actually a very nice, useful tablet. Flashing mine took me about an hour of effort (mostly waiting).

I do wonder if this is a loss-leader for B&N. Not that I care if they have a broken business model. I just wonder because it's so cheap.

</comment><comment><USER9> I just hit the BN page ( <http://www.barnesandnoble.com/nookcolor/index.asp> ) to check for international shipping - seems they do it - and noticed this blinker: "Save 15% on One Item. Use Coupon Code T9P8A9P Through July 25!". I suppose it applies to the Nook, haven't tried it.

<comment><USER10> "In compliance with shipping regulations, some item(s) in your order cannot be sent to Tel Aviv in Israel."

Meh. You gave me something to impulse buy, but something (? No idea what. The shipping FAQ even lists Israel and the requirements for ZIP codes, i.e. 5 digits) saved me the money I guess. Bad luck.

<comment><USER11> I got the same message for the UK (and instead of "Tel Aviv" it just repeated the random string I'd inputted for my city).

</comment></comment></comment><comment><USER12> Rooting the b/w e-ink Nook is also possible and it's a better deal imho. You get a tablet with the advantages of e-Ink. Yes, it's grayscale but you can use it for weeks without charging your batteries and it's much better for the eyes.

<comment><USER2> The major downside being that you really can't use it for doing much besides reading. The slow refresh rate of eInk just doesn't work for most things.

<comment><USER13> "Most" is a bit presumptuous; email, social networks, and Hacker News are all good examples of things that are all reading-oriented. I'd say "most" of my casual computer interactions are eInk-friendly.

I've ordered a Nook Touch for rooting and development work, and to find out how well this theory works in practice. Maybe in a couple of weeks I will eat my words ;)

<comment><USER2> A bit presumptuous, yes, but I'd wager not for most people- out of the people I know who use tablets (mostly iPads), very few of them do any reading on them. Maybe the eInk bit would change that, I don't really know- the N2E is basically the first mainstream eInk tablet, so there's not a lot to go on.

However, for the sake of argument, let's assume that people do mostly read on their tablets. Unless B&N did something to the N2E that I'm unaware of, Android doesn't really do page-based scrolling. That's kind of what I was trying to get at with the horrible refresh rate comment- even if it can technically do email and social networks, it's not going to be a great experience (kind of like the Web on the Kindle). Here's a video of Angry Birds on the N2E, as an example: <http://www.youtube.com/watch?v=k22BB8VPI5o>

(Edit: I do seem to remember that the N2E has a web browser built-in, so, assuming that it has pagination, that would work alright for email/social networks/HN. Though, IIRC, it's a slightly hidden feature- even B&N doesn't want to admit it's in there: [http://www.barnesandnoble.com/nook/container/standard_bothna...](http://www.barnesandnoble.com/nook/container/standard_bothnavs.asp?PID=35678) (#10) )

<comment><USER13> "out of the people I know who use tablets"

I didn't mean to make that comparison, I guess. I specifically don't own a tablet because it doesn't offer any really appealing use cases to me. I can't speak for the market in general, the iPad is a big-selling device, but e-readers are quite popular too[1].

I guess I want to wind this up; I never intended to lay in to your criticism of the eInk screen, simply to offer that my experience of people's use cases differs to yours. It's kind of redundant right now anyway, the number of hoops you have to jump through to turn a nook touch into a general-purpose Android box means that it's still not a consideration for most users.

[1] a quick google for "more tablets than ereaders" yields the converse <http://www.google.com/search?q=more+tablets+than+ereaders>

<comment><USER2> Sorry if it seemed like I took it personally or anything- I just kind of like debating and arguing :)

</comment></comment></comment></comment></comment></comment><comment><USER14> Is the a capacitive touch screen? How does the screen size compare to the iPad?

<comment><USER15> Yep, capacitive touch screen. Personally, I think the screen size is ideal... it's easier to hold than an iPad. It's not especially powerful, but it's nice for web browsing and playing Angry Birds :)

We bought a bunch at work and installed Cyanogenmod for one of our projects. It's the right size, and waaaay cheaper than an iPad. For $250, I'd recommend it for a general purpose (wifi-only) Android tablet. SSH is nice on it too.

<comment><USER16> I own both an NC and an iPad, and I'd disagree with the assertion that it's easier to hold. Even though it's glass, the flat surface coupled with the mostly-flat back of the iPad makes it a lot easier for me to grip.

Even though it's Android, the price is certainly right for an entry-level tablet.</comment></comment></comment>


Dosing time matters - <AUTHOR> https://science.sciencemag.org/content/365/6453/547 <comment><USER2> Anecdotal: I suffer a genetic disorder of metabolism [1] and I take a number of over the counter supplements to improve my vitality.

By trial and error since I was diagnosed 11 years ago, I have settled to take them - except for resveratrol and berberine - at bedtime. The effect is clearly noticeable. I thought it was because my body needed them most while recovering from everyday activities, but as usual, things get more complicated as we gain knowledge.

Anyway, an interesting read and another opportunity to further improve my health.

[1] [https://www.mda.org/disease/mitochondrial- myopathies](https://www.mda.org/disease/mitochondrial-myopathies)

<comment><USER3> I've just discovered berberine recently and have had great success taking 500mg before each meal. I'm diabetic and have been able to halve my insulin dose since taking it. What's the timing/dose that you use? Same question for resveratratol which I'm also planning on introducing.

<comment><USER2> I take 500mg first thing in the morning, but this dose is in the lower side.

My rationale here is to midly uncouple complex I of the electron transport chain to induce mitochondrial biogenesis of my wild type mitochondria.

<comment><USER2> Ooops, I missed resveratrol. Same dosage, same timing, same rationale.

</comment></comment></comment></comment><comment><USER4> I hypothesize there very well could also be differences between "morning people" and "evening/night people". The dosing guides that suggest taking before/after meals could be more specific (E.G. your primary meal), while dosing patterns for regular drugs might be completely different and even benefit from some patients taking stronger/weaker doses (at different times of the day) based on how their body is reacting.

All of this would be much easier with, and the correct contribution of tech would be, integrated continuous telemetry from smart sensors and systems. That data would also be a privacy nightmare and should be something that the patient can read and choose to share or not.</comment>


Gentrification's Price: S.F. Moves: Yuppies In, the Poor Out (1985) - <AUTHOR> http://articles.latimes.com/1985-04-03/news/mn-28445_1_san-francisco-s-skyline <comment><USER2> For anyone who is interested in a CPI inflation adjusted view of those numbers, "$900-$1000" for rent in North Beach in 1985 is supposedly worth about $2100-2400 now.

Their combined salary of $30,000 per year would now be about $71,000.

[https://www.bls.gov/data/inflation_calculator.htm](https://www.bls.gov/data/inflation_calculator.htm)

However, the article says "$900-$1000" was for "an apartment" without specifying the number of rooms. It seems reasonable that it might've been a 2 bedroom apartment.

<comment><USER3> It probably was a two bedroom. When I moved to SF in 1994, I was sharing a four-bedroom on South Van Ness that cost $1200 total.

The next big rent spike came around '98 or so, as the dot com boom was in full swing. Rents didn't only shoot up, it got so that there was no housing left to be had. You could show up to an open rental with stellar credit and references, only to have someone else offer the landlord 25% above the asking rent, and pay the entire first year in advance.

<comment><USER4> And you had to go through MetroRent or RentTech

</comment></comment></comment><comment><USER5> I often wonder about how sustainable SF's growth is. Between the issues with housing, rent control, NIMBYism, and poor infrastructure, there has to be a price tag at which this can't continue. I live in the city, and the quality of living here is terrible compared to other cities.

The only thing SF has going for it is the people, but sooner or later the right social pressures could cause a mass exodus, and I wonder what those pressures look like.

<comment><USER6> Your question gets asked often: How long can this continue?

And the answer is: It will continue as long as people are willing to pay the rent.

I understand from your post that you are fed up with the high rent and the low quality of living. But the most important part of what you said is the fact that you are still willing to pay, and you are still willing to stay, despite all of the disadvantages. In other words, you have decided (whether you like it or not) that in your case the advantages of living in SF outweigh all of the disadvantages.

And there are many others like you. You are all collectively voting for things to continue the way they are.

Making it stop would require you (or others like you) to decide the trade-off isn't worth it.

<comment><USER5> My girlfriend and I decided in January that the trade off is no longer worth it. Now it's just about timing.

While I hear what you're saying, I'm musing more specifically on what that function looks like. I understand "it will continue as long as it can" but looking for a less rhetorical answer.

</comment></comment></comment><comment><USER7> I don't see what is so wrong with gentrification. As the economy expands and people become more prosperous, it restores blighted parts of the city to their full potential.

I also think that rent control is disrespectful to the rights of the property owner. Other than making sure that there is no discrimination, and that properties aren't fire traps, government should get out of the way.

<comment><USER8> _> rent control is disrespectful to the rights of the property owner._

Is there an inherent right of way for property owners over renters on the residential moral crossroads? If you've grown up in a neighbourhood, raised your own kids in that neighbourhood, spent time in _and on_ the neighbourhood, don't you deserve some respect? People without the fiscal wherewithal (nor social impetus) to buy, but who spent effort safe guarding their community, organising events for locals, tending to parks, churches; they created the neighbourhood. They added value to every single property. But God forbid they were not raised to "buy": make way for the Propery Owner!

I find this incongruous with what I've seen around me time and time again. People who've suffered through the hardest times of an area get pushed out when it does better. They deserved it the most, but got hoodwinked for the newer, flashier wind.

Not unlike a spouse who stays with their partner through a tough disease, depression, or poverty, only to be dumped for a more beautiful and opportunistic competitor when the hardship has sailed.

I'm not a staunch anti gentrifier (hell, _I_ gentrify!), but I find using the word "respect" a bridge too far.

<comment><USER9> On rent control and gentrification I don't have a strong opinion right now. But I'd argue that if one has the means to buy but chooses not to, I can't feel bad for them if they get pushed out by rising rents. Buying a house is a good way to establish roots in a community. For those who can't afford to buy I feel that the argument that gentrification is harmful has some merit though, of course if the renter has started in a bad neighborhood I wouldn't think it would typically be that expensive to buy.

To use your analogy, if you don't put a ring on it you might lose it [your partner]. At least if one is divorced there is likely some alimony.

I suspect much of the real problem with gentrification involves the legacy of redlining and other abuses of vulnerable populations, like predatory contract loans and subprime mortgages. If populations such as inner-city blacks weren't systematically prevented from purchasing property in past decades gentrification would probably be much less a hot-button issue.

</comment></comment></comment><comment><USER5> If you want to see the latest in the gentrification war, check out the San Francisco subreddit. On the one hand, it's everyone complaining about the nuisance of the on demand scooters; on the other, it's people complaining about the needles and human feces. It may have been about poor vs yuppie in 1985, but it's a culture war now.

<comment><USER10> Wow...

> Last week I saw a similar report of a man filling up syringes with blood and > throwing them at people walking by

[https://www.reddit.com/r/sanfrancisco/comments/8hj7j7/man_ju...](https://www.reddit.com/r/sanfrancisco/comments/8hj7j7/man_juggling_used_syringes/dyk8w2b/)

<comment><USER11> One unconfirmed anecdote does not a trend make.

<comment><USER12> You're right. But when that anecdote doesn't surprise anyone (look at the tongue-in-cheek responses) you may have a problem.

</comment></comment></comment></comment><comment><USER13> Assuming that the housing supply is finite, the poorest person living in a city is also displacing a different potential resident, just as much as a medium income person, right? Yet gentrification is always portrayed as the "richer" people trampling on poor people. Go figure.

<comment><USER14> >potential resident

Gentrification and displacement are distinct from the exclusion of potential residents. To get someone's home transferred to you, you generally have to outspend them, so the gentrifier is essentially always richer than than the displaced person (though there could be corner cases with similar means but different willingness to spend on housing, etc).</comment></comment>


Ask HN: What is your preferred physical position when programming? - <AUTHOR> Reclined on a couch? Seated at a desk? In a lounge chair? What's your preferred position for working hours at a time? <comment><USER2> I like sitting where I am right now, in my X-Rocker gaming chair, laptop in my lap, and my feet propped up on the arms of the conventional office chair right in front of me. Usually I'll have music playing through the speakers in the gaming chair. A stack of books nearby makes a nice place to rest a cup of coffee or a bottle of Coke Zero.

Sometimes when I want a change, I move to the regular office chair and lean back with my feet propped on the edge of a book case that's nearby.

In either case, some variation of "leaning back with my feet propped up on something" is roughly where I prefer to be.

Rarely, I may program sitting in bed sitting upright with a bucnh of pillows behind my back.

</comment><comment><USER3> morning: upright at a table at the coffee shop

after lunch: prone, sprawled out on the couch at home</comment>


Ask HN: Do you really need a  $1000 phone? - <AUTHOR> I am trying to come up with reasons why anyone will spend such an amount for a mobile phone when you can probably get good performance and use same apps with devices < $500.<p>Why would you spend > $1000 on a mobile phone? <comment><USER2> Because the higher-end Apple devices have crossed the line into a luxury good. Go read this link from HN yesterday:

[https://stratechery.com/2018/the-iphone- franchise/](https://stratechery.com/2018/the-iphone-franchise/)

The answer turned out to be pretty simple:

 _" Apple wouldn't go down-market, nor did its customers want it to."_

The final conclusion seals the deal further:

 _" Some people buy an iPhone every year; some are on a two-year cycle; others wait for screens to crack, batteries to die, or apps to slow. Nearly all, though, buy another iPhone, making the purpose of yesterday's keynote less an exercise in selling a device and more a matter of informing self-selected segments which device they will ultimately buy, and for what price."_

</comment><comment><USER3> Microphone and camera quality is very important for some of my side projects, and professional-grade equipment can add up quickly in price, volume, and weight.

I'm not spending $1000 on a phone, I'm spending $1000 on a very small and portable (admittedly not quite pro-level) video camera that works well enough in a wide range of light conditions and noise environments.

<comment><USER4> What kind of side projects do you do? The microphones on smartphones really suck, you can't capture anything unless you're in a fairly quiet room or speaking to it up close. The lense just isn't large enough to capture enough detail. Recording video drains the battery extremely fast. Even as a hobbyist, I find it extremely limiting.

I bought some used recording equipment that's probably 10 years old for $200, it's miles ahead of what my smartphone can do.

</comment></comment><comment><USER5> Do you rally need a $1000: -pair of shoes? -pants? -tshirt? -jacket? -pen? -<add our own>?

No you definitely don't need. You want!

Now then.. how come you/I/anyone ends up wanting a $1000 phone? Marketing? Vanity? Riches beyng sense? Need for portable computing power? Need to constantly have with you 5000 photos, 5000 songs, 50 movies?

<comment><USER6> > Do you rally need a $1000: -pair of shoes? -pants? -tshirt? -jacket? -pen? > -<add our own>?

> No you definitely don't need. You want!

That's a weird way to start an argument, because I definitely don't need a $1000 tshirt. In fact, a quick tally suggests that my entire wardrobe cost slightly less than $1000 (retail value, not present value).

</comment></comment><comment><USER7> Need? No, I don't need it. I have an iPhone X, which I paid $1,200 for. It replaced a Samsung Galaxy S7 Edge, which I think I paid $700 for.

My X gives me better integration between my MBP, iPad, and AirPods. Siri is actually somewhat usable now, though it has room for improvements. I use it quite a bit while driving to "read" and respond to text messages, and I almost always have my AirPods in while driving. I drive a Jeep, without doors, and I've noticed some hearing damage that I attribute to the wind noise at highway speeds. My AirPods mean I can listen to podcasts or music without cranking the volume so high that people can hear it in their houses next to the road.

It's neat that my iPhone has so much processing power, but I rarely use it. The camera is good enough that I don't feel I have to carry my dedicated camera with me on a daily basis anymore, but when I do, I occasionally transfer my photos from it to my phone to post something on Instagram or upload through Lightroom to a shared gallery. I do all of my photo post- processing in Lightroom on my iPad, and usually have it with me.

At the end of the day, though, it's purely a luxury item. I like having good tools, and I make enough money to buy some. The difference in satisfaction for me between using my old S7 Edge and the iPhone X is enough to justify the cost to me.

</comment><comment><USER8> "Need" is too of a strong word. People doesn't need a $80,000 car that can go from 0-60 miles per hour in 1.9 seconds in a country whose max highway speed is around 75mph but they buy it anyway when they can afford it.

<comment><USER9> Un, speak for yourself...I SO MUCH need a car that'll do 0-60 in 1.9 seconds. If you can find a car in that price range that can actually do that, please let me know.

<comment><USER10> Don't the 100K-ish Teslas, in monster mode or whatever it is, get within a few tenths of a second of this? 2.3 seems to stick in my mind, for some reason. Maybe even 2.2 or 2.1 .

And that was a year or more ago.

<comment><USER11> Ludicrous mode. And you can't get 1.9 for 80k. That is ludicrous. P100D is ~135k starting. Off the top of my head a Z06 will do just under 3 and you can pick them up for <=80k new

<comment><USER12> FatF taught us all you need is a 9-speed FWD DSM.

</comment></comment></comment></comment></comment><comment><USER10> I've been pretty happy with my Moto G5+ 4/64 GB, except for a few things:

Updates: Its lesser powered successor, the Moto G6 (no + in the U.S.) runs Android 8. The G5+ certainly could. Moto's X4 has the same 630 CPU along with a GB _less_ RAM and, I've read, will be advanced to Pie. The G5+ _could_ be, if Moto chose to do so.

Camera. Take one of these "budget" models, and add $50 or even $100 to the price to put in a top-notch camera. I'd buy it. I don't need CPU "up the wazoo", nor a super-whatever bezel-less display (a good IPS is enough, for me); however, I would like to take really good pictures. (Really good, less the "AI" stuff -- and its cost -- that I'm not asking for; rather, top notch optics and sensor.)

I really don't need, nor even want, a $1000 phone. Only, the manufacturers refuse to make some modest upgrades to the lower tier models -- because money, I guess.

It also, in my opinion, reflects the lack of real competition in this space. In a truly competitive market, I believe my "market segment" would be found to be far from trivial and so worth pursuing.

Hell, with a generation older CPU and such tech (I don't know about cameras), all the tech is well known, has stable drivers and all, and is probably more easily supported. Should be a no-brainer, at this point -- except, well, money.

P.S. I haven't had the models in-hand, to compare, but putting together all I've read on them, I gather that both the G6 and the X4 have _worse_ cameras than the G5+ . The G5+ camera isn't bad, but it doesn't perform nearly as well -- in detail, low-light, and some edge cases -- as the top-tier cameras -- even those of a generation or two ago.

<comment><USER13> Why not buy older or used models then?

You're never not ever going to get the latest technology/functionality in a low margin device--because return on investment, I guess.

<comment><USER10> I've started thinking about this. Although I'd want some way -- for a reasonable upcharge -- of assuring that the hardware, particularly the camera, was in excellent condition.

Pixel 1's are below $300, I understand, and I'd be reasonably happy with one, except I believe their support window is about done. (Last Google phone with a headphone jack, to boot, IIRC. On the other hand, lesser storage capacity and no microSD support; microSD support is very nice, with my G5+.)

</comment></comment></comment><comment><USER14> Don't tell people how to spend their money. Need isn't an issue here, people who have $1000 can spend it on whatever they _want_ whether or not they "need" it.

$1000 is a lot for a phone, but for a device people use so often is it too much? I'm not so sure.

The more relevant question isn't whether or not a $1000 phone is "worth the cost" (or "needed"), but whether or not the overall prices of Apple's phone lineups make sense. Given their sales figures over the years it's hard to say that they are overcharging for their phones, even now.

</comment><comment><USER15> I am a pretty consumerist person. If I had a choice between working-little- and-having-little, and working-a-lot-and-having-a-lot, I'd choose the latter.

I didn't choose the above attitude consciously per se, but thinking about it in retrospect, I'm comfortable with it. I have a lot of product-category- choices that make little sense to someone unwilling to spend $1000 on a phone: wool underwear, an Onyx Boox Max 2 (wonderful device), an Urbit star. I don't spend money pragmatically.

<comment><USER16> >>wool underwear

Ha, what? Now I'm intrigued. What kind??

</comment></comment><comment><USER17> The same argument could be made for almost everything people might purchase. Just buy what works for you and don't worry about what others choose to do with their money.

</comment><comment><USER18> NO! Not at all. Jesus Apple. Give me a break. I like the privacy, I am invested in the ecosystem, and I can afford it, but a phone isn't worth $1000 dollars to me. It isn't a computer, it can never replace my macbook, and it will never be anywhere near a third as valuable to me.

<comment><USER19> > It isn't a computer, it can never replace my macbook

That's probably why most people don't mind paying that much. They see their phones as their personal computer and don't need an actual desktop, or even notebook anymore. And a phone delivers a lot of extra value like the camera. A high-end GPU alone could be seen as luxury and some of their MSRP are already over $800.

</comment></comment><comment><USER20> "Everything is worth what its purchaser will pay for it." \- Publilius Syrus, ~100 BC

Nor is there any accounting for taste. Looked at purely logically, it is absurd to spend 1K on a phone. Humans aren't always logical. We don't need a 1K phone, some people just want one.

</comment><comment><USER21> When I heard what they were charging for the iPhone X I thought it was a joke. but I know several people who now have them, and they all say it was worth it. And they can't explain why. I suspect they're all deluding themselves, like people who have watched 9 seasons of a terrible TV show and try to convince you it was worth the time and you should watch all 9 seasons too. I can't understand it. I wouldn't even spend that much on a full laptop. I stay 2-3 years behind the curve. I can buy a phone that was state of the art in 2015 for <300 and do everything the guy with the iPhone X can do.

<comment><USER22> Phones evolve. The evolution to a near edge-to-edge OLED screen is a costly one, look at the competition. In your ideal world Apple would delay the X by three years and continue to pump out forehead + chin LCD phones with spec bumps? iPhone X is the future you can have today, at a premium. If you don't want to spend the extra money, wait. You can buy it in 2020, when all new phones look like it. It's not like Apple is forcing you to buy it. Each phone they make is overpowered so that older phones are still good-enough for every day tasks, they release new iOS patches to even five year old devices, and they specifically advertise the older phones with price drops at every keynote. What is it that you want them to do differently? You want them to treat people like you as their target demographic for new phones?

</comment></comment><comment> swingline-747 I can't see it either. If I had to, I'd get an used 16 GiB iPhone 6S, change the battery for $29 while it's still cheap and then flash chip-swap to 256 GiB via the usual sources. Headphone connector and undocumented water-resistance if you replace the gasket (6 for $5 on eBay). If you look at the iPhone 6S carefully, you can see it was a pilot project for water-resistance because of all the gaskets around ports and the screen. I wouldn't take a good phone into a shower or pool, but it would be fun to see with an used cheapo phone to see how water-resistant.

</comment><comment><USER23> >when you can ___probably_ __get good performance

This is a big problem with android. Performance sucks overall, and like windows, degrade over time. The quality of apps is not there.

And also, android is the worst if you care a bit about privacy and security.

When you must decide between a clear superior product (iPhone) vs a overall inferior (except if you take a lot of care in researching, have luck or expend almost the same money) and have a tight budget? Go for the best, because we don't have money to waste money. \---

BTW: My policy is buy the previous model when needed, so I still not expend that much neither waste money with android.

</comment><comment><USER24> Something you use a lot every day is definitely worth spending money on. Myself, I am an Android guy, but if the new iPhone is only a little better than the previous, out may very well be worth buying.

</comment><comment><USER25> Android in particular really benefits from the faster hardware in my experience. I fly frequently so I get a lot out of more storage and better displays as well. Battery life is a big deal. That added up to me getting a Note 9. The main thing I use the pen for is just taking screenshots.

Really for me it's just a nice to have though. A few years ago I got by with a Lumia 520, I'm sure I could live with a $100 Android phone if the cost were an issue. But I use my phone _a lot_ so it's worth it for me.

</comment><comment><USER26> Yes. I don't live in the states. I travel nearly non-stop. I was sick to handle literally dozens of SIM cards and go through the possibly painful registration process in many countries abroad. Cheaper Google Project FI Phones were sold out. So I coughed up nearly 1k for a Pixel One 64 GB google project fi phone.

Otherwise a 200 Dollar phone is likely more than enough. Actually, since I buy laptops used, my phone nearly costs three times as much as my refurbished dell XPS 14"

</comment><comment><USER9> Of course not. You also don't need a $600 pair of Chanel sunglasses or a $6,000 Gibson guitar. It's kinda like a luxury moniker at this point.

</comment><comment><USER27> I went for the longest time without a cell phone. Then I had a job change and had to get one. (Fortunately, my employer paid for it.)

I started out with a flip phone. That was adequate until somebody showed me the many advantages of a smart phone-- primarily the web browser, which brings weather, news, etc. etc.

I don't need a $1k phone, but I do feel I benefit a lot from a smartphone.

</comment><comment><USER28> Most (non-tech) people I know are interested in the camera. People are change- adverse (so those with an Apple device want to stay on iOS) and want the latest photo taking capabilities.

Especially for friends who rely on photos for their jobs / side projects, it is a huge difference comparing pictures from a Google Pixel / iPhone X and phone models from a few years ago.

</comment><comment><USER29> When I bought my current phone (an iPhone 5) I paid $700 and half-jokingly told the sales clerk that would be the last phone I ever bought. That might not end up being literally true, but I just blew this year's new toy budget on a banjo instead, so I guess I can wait a little longer.

</comment><comment><USER30> I would if:

* I needed the performance of a $1000 device. For example, if I did a significant portion of my work from my phone, I'd consider it a worthwhile investment.

* I had enough disposable income and wanted a particular ~$1000 device

* I wanted it, had a credit card, and no financial or common sense.

</comment><comment><USER31> I would if it was the last phone I ever needed. It had full service unless you were a mile underground. A battery life that made Jesus jealous.

I like the future idea that phones become such a throw away item you can buy them from vending machines with instant service.

</comment><comment><USER32> Simple, it's a luxury status symbol like Vertu phones of the past, Gucci bags etc. There are a LOT of people in the world that can afford such things, and there are a lot more that will go beyond their means to pay for it.

</comment><comment><USER33> Salary Sacrifice means my AU$1500 note 9 cost me approx $700 I'll sell my Note 8 for about $600... I can live with that. a $100 512GB Note 9 :-P

but yeah I wouldn't be buying it without sal sac.

</comment><comment><USER34> I am thoroughly satisfied with my LG Zone 4. It cost me $120 and I've never met an app it can't run.

Truly an amazing off the shelf Walmart phone, a breath of fresh air from my throttled iphone5

</comment><comment><USER35> Do I need it? No.

Do I want to have a nice phone that is a bit of a luxury good from an ecosystem that I'm a fan of? Yes.

No one is making anyone buy a $1000 phone, but why not if you want to?

</comment><comment><USER36> I don't need it but I did buy the iPhone X as basically this is the one device that I use all the time everyday.

</comment><comment><USER37> I don't need it, but the extra size is nice and my budget allows for it, so why not.

</comment><comment><USER38> I would spend $1k on a phone the size of the SE with a headphone jack, fingerprint unlock, 3-day battery life, a camera like the ones on the new iPhones, and internals robust enough to last 8-10 years.

</comment><comment><USER39> There can never be a good answer to such questions.

</comment><comment><USER40> I don't even spend $1k on my cars. While I'd love to have a new, secure, iPhone I can't justify that level of expense.

Regardless, what other people do with their money isn't your problem.

<comment><USER9> You don't even spend $1,000 on your car? Sheesh, are you like 17?

<comment><USER40> $1k cars are just $2k cars with dirty interiors and $2k cars are just $4k cars with one or two current problems. ¯\\_ツ_/¯

I work for BigCo make almost six figures (real dollars in a moderate cost of living area, not SV funny money dollars) so it's not like I couldn't afford better if I wanted. I do all my own work so maintenance is basically free. I have other things I'd rather spend my money on.

I'm probably gonna buy a small pickup this January (when everyone else is short on cash from all the traveling and gift buying they did in November/December) because I want a middle ground between the wagons and the full-size truck. I might buy a minivan if I can find an Aerostar with a manual transmission.</comment></comment></comment>


Why JavaScript Programmers Hate You (2013) - <AUTHOR> http://www.youtube.com/watch?v=t3GzCwoQfb4

<comment><USER2> The title should be: Why javascript programmers hate statically typed languages, because they are less flexible than dynamically typed languages. I honestly thought the talk was boring, nothing new.

</comment><comment><AUTHOR> There was one slide that caught my attention here:

 _Computer Science_ : Fixed programs, transient data

 _Data Science_ : Fixed data, transient programs</comment>


Apple granted patent where carriers bid to provide service to iPhones - <AUTHOR> http://www.appleinsider.com/articles/11/02/09/apple_granted_patent_where_carriers_bid_for_iphone_service.html

<comment><USER2> Reminds me of a patent granted to Google a few years ago.

News article: [http://www.newscientist.com/article/dn14808-instant- auctions...](http://www.newscientist.com/article/dn14808-instant-auctions- could-replace-cellphone-contracts-.html)

Patent: [http://appft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Se...](http://appft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=/netahtml/PTO/search- bool.html&r=1&f=G&l=50&co1=AND&d=PG01&s1=20080232574.PGNR.&OS=DN/20080232574&RS=DN/20080232574)</comment>


No job? Start a business, says UK universities minister - <AUTHOR> http://www.guardian.co.uk/politics/2010/jul/16/david-willetts-graduates-job-expectations

<comment><USER2> Sounds good in theory, but how would a newly-degreed person without any capital start a business?</comment>


Ask HN: What would your reaction be? (final year undergrad. OS exam) - <AUTHOR>

Explain in simple terms how operating systems turn the ugly into the beautiful? (2 marks)<p>I go to what the world thinks of as a "top university". This question was part of our terribly-designed final year undergraduate exam paper on Operating Systems. <comment><USER2> One of the most important parts about an undergraduate degree is that it's a foundation for knowledge, not narrowly focused on one particular topic. That's why gen-eds exist.

Anyway, had I received this question on a test, I would have started with a discussion of the command line and how powerful it is (i.e. the "ugly") and compare/contrast it with UIs (i.e. the "beautiful"; start with Win 95 and continue on to Win 7/8, Mac OSX, etc).

I'd throw in references to Spolsky's famous adage about "all abstractions are leaky" - i.e. you could discuss how UIs are beautiful, yet the command line (ugly) is where the power exists. There's at least 2-3 pages of content in that alone.

I'd end with how UIs brought the power of computing to the common man - learning to use the command line is difficult (esp for the elderly, the young, the mentally-challenged), but pasting a UI on top allows even the most computer-illiterate to work. Add in some discussion on the desktop metaphor and you're done.

<comment><AUTHOR> That's definitely a thorough way of approaching this but from an examination point of view, bear in mind that there are 98 other marks to be answered.

</comment></comment><comment><USER3> I don't get what your objection is?

It's obviously a mini-essay question, a chance to show your opinions and reason about ideas. Seems good to me.

Do you not like it because it's not a yes-no question? Welcome to reality, where not all questions have simple answers, even in CS. That's probably why it's a top-tier university!

Whatever you do don't look at this exam paper from Cambridge - it will blow your mind [http://www.phil.cam.ac.uk/u_grads/Tripos/Ethics/Past_Exams/1...](http://www.phil.cam.ac.uk/u_grads/Tripos/Ethics/Past_Exams/1b_Paper_03-2012.pdf). Example question "What makes death bad?"

<comment><AUTHOR> I think my objection is mainly due to the unscientific nature of the question. A question like this that is looking at the goals of the OS is very objective and has a clear answer. I would expect a question to be worded like this in a Philosophy, Law etc. exam (like the link posted by you). In my opinion, there are some questions, even in CS, that can be open-ended and be very interesting to attempt but this certainly isn't one.

<comment><USER3> But people make technical design decisions in operating systems based on trying to make the operating system as conceptually simple as possible, which is what he means by beautiful, which I hope you would know from reading the literature.

I would relish this essay question - I would have written about the history of Unix, the evolution towards Plan 9 and why it failed. These are important issues in CS, and if you are ignorant of them you are likely to repeat them. Your professor is testing that you have understood these lessons from history.

I think you need to retract your implication that it's somehow an inherently bad or embarrassing choice for a question.

All you have left is that you are fundamentally opposed to any philosophical, historical or human factor thinking in CS, and I don't think that's a supportable position.

<comment><AUTHOR> Those are interesting points and luckily I am aware of them. I quite like the angle at which you're looking at this; it made me think again.

<comment><USER3> We should be very very thankful for these questions. They differentiate the people that have really read around and understand what it is that we're doing in CS, and those that have just been to the lectures.

</comment></comment></comment></comment></comment><comment><USER4> My reaction?

I suppose my reaction would be to answer the question.</comment>


Startup Ideas - <AUTHOR> http://joelg.info/startup-ideas-4 <comment><USER2> It would be fun to have this kind of info standardized into its own DNS resource record type.

By doing this in addition to what you currently do, you could unlock a much larger market in a long term, I think.</comment>


Has the Internet Actually Been a Force For Good? - <AUTHOR> http://www.foreignpolicy.com/articles/2010/04/26/think_again_the_internet?hidecomments=yes&page=full <comment><USER2> My experience is that the more successful i18n is the more people stay in their ghetto and nationalism, Internet of 10 years ago was way more international and boundary shattering than it is today.</comment>


Startup chatroulette - <AUTHOR> http://helpastartupout.com

<comment><USER2> Here is an example of the specific chat we were having <http://envolve.com/s?fG>

This is made by <http://www.envolve.com/>, just installed it and already 10+ people are chatting on here</comment>


Ask HN: If you open source some code, are you responsible for maintaining it? - <AUTHOR> This is something I have been wondering for a while. At my company, we depend on a lot of open-source technologies. We expect that someone will keep rails up to date, fix security vulnerabilities etc.
At the same time, I have a lot of projects that I open sourced but have no desire to maintain. Here's an example: http://github.com/egonSchiele/mdpress
This is a simple Ruby script I wrote that is now one of my most starred projects. I haven't used it in a while (I don't make many presentations) but I still keep getting and responding to bug reports. What's my responsibility here? I am happy to open source my code, but I don't want the extra work of maintaining something I rarely use. <comment><USER2> I would just put that clearly and prominently in the readme.

"Released open source in case this code is useful to you, but there will be no support, no further releases, no bugfixes, and no response to issues. If you find this code useful and would like to modify it, please feel free to fork it."

[I forget if Github lets you turn off 'Issues' entirely, but if it does, do so.]

This way people know what they're getting into when they use the code. You have no _obligation_ to do anything, and it's better to share the code as examples for others trying to do the same thing than to keep it private because you don't want to support it.

But people may assume the code is supported, and regardless of what they assume, they can make a better decision on whether to use it or not (and use it how), if they know it's unsupported, and it is the right thing to do to let them know up front. If I found useful code, but knew it was 'abandonware', I might or might not choose to use it anyway, but that knowledge would effect my decision.

If you have code that you released without making that clear, and _have_ been supporting half-heartedly anyway (setting some expectations), well, contrary to what I predict will be the HN consensus, I think you do have _some_ responsibility to your users. But you still aren't trapped forever in indentured servitude. Wind it down gracefully, maybe find someone else to take it over (have you accepted a pull request from anyone ever? if so, that person is a good candidate :) ), maybe keep responding to issues for a little while after you make the announcement that it will soon be abandonware. Or if you're completely burned out on it and just don't have time, then stop cold turkey if you have to, but post in the README what you're doing. (Don't delete the repo, that would be very rude to current users).

<comment><USER3> Yeah, the Issues function of a repository can be disabled, most useful for if there is already a way to report issues with a system such as Bugspray.

<comment><USER2> looks like pull requests can't be though?

</comment></comment></comment><comment><USER4> There's one thing you're responsible for that I don't see mentioned here : potentially wasting a name from the global namespace.

There are too many abandoned projects that took the easy to remember / cool names. At a smaller scale and as an exemple, nowadays if you want to implement a protocol and publish it on NPM there is 99% chances the name is taken and the implementation is poor. Too many people thrown away quick hacks only to leave them die. People willing to work and invest time in proper implementations may end up discouraged and give up trying to publish or even coding them.

Names are the scarcest resource of all. My point of view is that when you take a name you take with it the responsibility of not wasting the cognitive paths associated with it. This is not a small responsibility at all, in my humble opinion.

It probably doesn't apply to the example you gave. Just took the opportunity to voice my concern.

<comment><USER5> With golang that problem goes away :) but if you're stuck on Node, there's always several different implementations to linking libraries (although, a pain in the ass, but this isn't the fault of the open source author -- complain to Isaac for making an incredibly useless packaging system [nicest to play with though hence the popularity]).

Don't get me wrong, I love Node, but blaming an NPM problem shouldn't place blame on an open source author. None of these solutions works for you? Time to be an open source contributor :)

<comment><USER4> Golang's stance on this struck me when I saw it. "Of course". URLs have the answer embedded in their name from the beggining. There of course are pros and cons but it seems to me much saner to have URLs as package names and registries as mere search engines leveraging package metadata.

I think you're a bit rude to NPM though. It had many things right and finding defects in retrospect is always an easy task.

Regarding my involvement in open source, I have no clear picture of a solution to this problem at the moment so I will refrain, following the spirit of my previous point. I tend to publish only what I know will be firm ground for others to build upon.

<comment><USER5> > I think you're a bit rude to NPM though. It had many things right and > finding defects in retrospect is always an easy task.

In retrospect, NPM was a bit rude to it's userbase. We've asked for support on custom, multiple, and private registries. PRs have even been made for them and Isaac explicitly shut them down only to later (much later) come out and talk about NPM Inc. NPM is a great tool, and the community for building upon it is absolutely fantastic and wonderful, but the leadership and advisory board behind it are pretty terrible for something as good as NPM.

May be I am a bit harsh, and I may be a bit biased coming from "the old crowd" in Node before it was the cool thing on the block (funny to think back on Rubyist snickering at me for mentioning node to them :))

At least NPM has git URLs which is nice, and may be NPM can do these things (I've abandoned it for much saner practices other than cloning a 50+gb registry, pointing to a registry that falls back to an official registry [big security no-no, at least allow checksums], etc).

Thank you for the perspective though, less whining and more typing (contributing to NPM). My anger is more so towards the leadership of NPM rather than the toolset itself and I didn't express that in my OC ^

</comment></comment></comment></comment><comment><USER6> Open sourcing some code means making it available under a license. That's it. No further promises are made by you.

So you're free to add a notice that you won't maintain it and that people are free to fork it and maintain it under another name.

Or you could maintain it if you think it's good for your career and/or you simply enjoy doing it.

</comment><comment><USER7> Well, for that particular repository the README still encourages pull requests, so while that's still there I'd probably expect you to maintain the project. If you turned issues off and put in the README that you had stopped maintaining the project I'd think that would be enough.

Really, I think once you open source something you should be prepared to maintain it for perhaps somewhere between 3-6 months at a minimum. If it's popular, I'd expect you to maintain it while it's still relatively popular and people are regularly sending pull requests and reporting issues.

If the repo is still popular, I'd think that you'd probably have to hand it over to someone else if you're not going to look after it. If it's less popular, a simple note in the README should be fine.

</comment><comment><USER8> You have no formal responsibility. No obligation. If someone complains to you about fixing bugs, they are welcome to fix them themselves. That's what open source is for. Anyone can fix issues without having to wait for the creator.

<comment><USER9> Indeed. Additionally if you loose interest in the project you can also see if someone who contributes back would be interested in taking over the project as well.

</comment></comment><comment><USER10> You can hand it off to other people to maintain if it's something you don't want to do.

Other people can fork it if they are unsatisfied with what you're doing.

Please don't allow it to cause you any stress! Many quiet users are just grateful that devs release stuff.

</comment><comment><USER11> I've never seen a programmer be held responsible for maintaining code.

I've seen them paid to do it. I've seen them do it because they want to. I've never (ever) seen any of them do it because someone else told them they had to.

</comment><comment><USER12> TL;DR You have no responsibility to keep coding, but you do have a responsibility to transition the project to a new maintainer if someone sufficiently competent volunteers.

As many others have already mentioned, it is very useful to clarify in the README what the status of the project is.

Something I would like to add is that if someone else comes along who offers to take over maintenance, that is a useful thing which you should probably accept, and then you should update your README to point to the new official maintainer. You can also explicitly mention in the README that the project is looking for a new maintainer, which to me always seems a bit friendlier than just stating you've abandoned the project.

Even if you don't officially pick a new maintainer for your project, if a couple of forks spring up on github consider linking to them from your README if they still seem active after a couple of months.

<comment><USER13> No, actually you don't have the responsibility to transition the project. It would be the nice thing do. But not a requirement

</comment></comment><comment><USER14> Begin rant:

I'm going to be the one who says it. I am frankly tired of the sense of developer entitlement. We get so much amazing and great work from people, yet it never seems to be enough for some. They bitch about semantic details, style choices, lack of support, and yet refuse to pay for quality services. Instead, they cockily spout "...why would I pay for that when I can just code it myself?"

I think this mentality is what separates these sort of developers from entrepreneurs. Entrepreneurs will pay for services happily that make their lives and business easier and improved, while entitled developers will just "hate" on the technical merits or "poo poo" the language, framework, or design decisions.

On to the OPs question, no you don't have a responsibility to maintain anything you give away to the community.

</comment><comment><USER15> I think it depends on how you go about it. If you just make it available and from the outset make it known that's what you're doing, then I think it's fair game. If, on the other hand, you spent time convincing people to use it and then just abandon it, I think that's kind of a jerk move. I see this happen a lot with freelancers using open source as a means to drum up clients.

</comment><comment><USER16> Please don't turn off issues so people wanting to try your code are aware of bugs. Just say it's unsupported.

</comment><comment><USER17> I would say that if anyone is obligated to maintain the code is is the people who are using it and benefiting from your initial work. (Not using "obligated" in the literal sense, more to mean "ought to").

</comment><comment><USER18> No, you are not. But it boils down to what you advertise.

Perhaps declare in readme that project is unmantained and disable Issues on such project (no emails). Also declare how much hours/month you are willing to put into maintenance. And finally use separate email for OS activity, public email generates a lot of spam (viagra etc)

I actually build my living around one such abandoned project. Original idea was great, but it needed some TLC to make it usable.

</comment><comment><AUTHOR> Thanks for the suggestions HN! I added a note to the top of the README and will try to wrap up existing issues. I won't delete the repo from github.

</comment><comment><USER19> You have a responsibility to your own reputation. When you publish some source, are you trying to help other developers, or are you just making a public online backup? If the former, then do so; if the latter, then just be clear what you're doing. Put "I'm just dumping this on the 'net" in the README, and people can take it for what it's worth (nothing, probably).

</comment><comment><USER20> You can turn off issues and wikis on github repositories and force people to file pull requests to fix issues if you'd like.

</comment><comment><USER21> Mentioning the state of the project in the README is useful. Additionally, you could selectively reach out to some of your users and offer them GitHub's "collaborator" status. This enables them to accept pull requests, push to master, etc.. That way your code can be maintained by people with a current interest in it.

</comment><comment><USER22> You have no responsibility. If people want bugs fixed, they can fork it and do it themselves...

</comment><comment><USER23> You don't have _responsibility_ to maintain, but the copyright holders of the code are potentially open to _liability_.

When you open source something, you have to make sure it has a clear license which includes legal disclaimers of warranty and liability. For instance take a look at the disclaimers in the GPL and BSD licenses.

As far as maintenance goes, you have no contractual obligation to anyone to fix anything for them, if you aren't being paid.

<comment><USER24> [http://choosealicense.com/licenses/](http://choosealicense.com/licenses/)

All open source licenses are not liable for damages arising from the use of open source code

<comment><USER25> Interestingly that page doesn't include the WTFPL [0]

As that licence doesn't include a "no-warranty" statement, and copyright is automatic in most countries (from your link), there must be a fair few open source repos on Github etc that could be liable for damages arising from the use of open source code (or at least fall into a nice grey area I'd personally rather avoid).

[0] [http://en.wikipedia.org/wiki/WTFPL](http://en.wikipedia.org/wiki/WTFPL)

</comment></comment></comment><comment><USER26> [http://thefirstruleofopensource.net/](http://thefirstruleofopensource.net/)

</comment><comment><USER27> >At my company, we depend on a lot of open-source technologies. We expect that someone will keep rails up to date, fix security vulnerabilities etc.

That's a pretty terrible, and indeed entitled, attitude to hold I must say.

>I haven't used it in a while (I don't make many presentations) but I still keep getting and responding to bug reports. What's my responsibility here? I am happy to open source my code, but I don't want the extra work of maintaining something I rarely use.

Then don't. Invite others to collaborate and submit patches themselves.

</comment><comment><USER28> If you don't plan to maintain your code what you did is not "open sourcing": it is merely a source code "release". "Open source" means "welcome", if you don't mean it, don't say it.

If you are tired of maintaining your old project just put a tar.gz of the last stable release up on your own site and let it die or be used. Or, at the very least, disable GitHub's issue tracker.

<comment><USER6> Open sourcing does not imply future maintenance. That's why everyone should evaluate the state of a project before starting to use it.

<comment><USER28> Putting the site on a social site and setting up an issue tracker implies future maintenance.

Making it clear in the README that no maintenance is guaranteed _and_ disabling the issue tracker should be enough to send the message to would be users. If the OP doesn't do that he is _actively_ implying future maintenance.

<comment><USER29> It does not imply future maintenance, any more than having an account on Facebook means that you'll reply to anyone else's comment, pokes, or app requests, or that you'll even log in again.

Having an account on Twitter doesn't mean there's an obligation to respond to every tweet directed your way.

In dating web sites there's no obligation to reply to every "hi, I'm interested in you" message.

In fact, in no social site I know of has an obligation for future engagement.

Why is code different?

You also assume that "social" => "with the world." If I want to work on a project with friends in California and New Zealand, why not set it up as a public account on github? We're being social, just not social with you. Our obligations are towards each other, not some stranger on the internet.</comment></comment></comment></comment>


Tool scans Facebook to work out if tenants are good for their rent - <AUTHOR> http://www.springwise.com/tool-scans-facebook-work-tenants-good-rent/?utm_campaign=434119_Springwise%20Weekly%20-%202016-06-29&utm_medium=email&utm_source=Newsletter&dm_i=3GJ2,9AYV,39CHK8,V4VQ,1 <comment><USER2> Is this the kind of society we want?</comment>


LifePIM – a fast and secure place to store the Metadata of your life - <AUTHOR> https://www.lifepim.com <comment><AUTHOR> I think I may have the record for the slowest 'startup' ever - I registered this domain 15 years ago and have tried many designs (in several languages), but I am happy with this layout.

Please give it a try and let me know what you think.

Thanks</comment>


Ask HN: What is the best way to find out about competition for an idea? - <AUTHOR>

I know that it's a pretty common desire on HN and in the startup community to find out what competition exists for a particular idea, but I don't know of any fool-proof ways of going about it. You can use a combination of startup indexes like Angelist.com and Techcrunch's Crunchbase, search through HN of course, and browse the app stores, but it's very easy to not find out about competition for a long time even employing these tactics. Does there exist one all-encompassing resource or directory that makes it easy to vet an idea? <comment><USER2> What has really worked for my co-founder and me is to talk to potential customers. Basically, once we start asking questions, our potential customers inevitably start saying things like, "Well, we tried this company...." or "Have you heard about this other company...."

I think this yields great up-to-date information. Sometimes directories can be horribly out of date and irrelevant.

</comment><comment><USER3> If you use chrome this is really helpful => <http://www.gethoneybadger.com/>

</comment><comment><USER4> Just pitch your idea to everyone you know. Trust me, they'll tell you who's already done it, and who you're competing with.</comment>


The Basics of Web Application Security - <AUTHOR> http://martinfowler.com/articles/web-security-basics.html <comment><USER2> I've taken a different approach to explaining the basics of application security.

These are the things that are most likely to cause your application to be secure:

        1. Data being treated as code.
        2. Invalid (or missing) logic.
        3. Insecure operating environment. (e.g. outdated packages)
        4. Cryptography failures.

Data being treated as code covers the obvious things like SQL Injection and Cross-Site Scripting, and makes it easier to conceptualize the solution: Never mix the two. That's what prepared statements accomplish.

Invalid/missing logic is the realm of "missing access controls" and "confused deputy" problems. (This is also where I'd place CSRF vulnerabilities.)

Insecure operating environment: A secure application on an insecure server is not secure. Patch your systems. Use HTTPS. WordPress can't save you from CVE-2012-1823. Apache can't save you from Shellshock.

Cryptography failures are their own category, where the phrase "padding oracle" is routinely uttered with a straight face, a single mistake can cripple your application, and comparing strings the normal way programmers compare strings is considered dangerous. The solution here for people who aren't interested in becoming an expert is to hire one. Or a team of them.

These descriptions are an attempt to address the fundamental problems with how insecure code is written, rather than to arm the reader with a checklist of specific instances of vulnerabilities they can check off.

I generally dislike checklists (OWASP 10, SANS 25).

How many people are well-armed against SQL Injection, but pass user data to PHP's unserialize() function with reckless abandon? This is a data-as-code issue.

How many people use str_shuffle() for password reset token generation? This is a cryptographic failure.

I wrote about this at length here: [https://paragonie.com/blog/2015/08/gentle- introduction-appli...](https://paragonie.com/blog/2015/08/gentle-introduction- application-security)

If anyone's interested, I also curate this reading list on Github: [https://github.com/paragonie/awesome- appsec](https://github.com/paragonie/awesome-appsec)

<comment><USER3> This is an amazing resource! [https://github.com/paragonie/awesome- appsec](https://github.com/paragonie/awesome-appsec)

</comment></comment><comment><USER4> I say this with a lot of respect, but this seems pretty noddy for a Martin Fowler article. There's not a lot of meat here and I really don't consider myself an app sec expert :-)

<comment><USER5> Isn't this article going to be updated though? ala [http://martinfowler.com/bliki/EvolvingPublication.html](http://martinfowler.com/bliki/EvolvingPublication.html)

<comment><AUTHOR> Yes, there will be more sections added over time. From the bottom of the page:

 _> This article is an Evolving Publication. Our intention is to describe more basic techniques that developers could, and should, use to reduce the chances of a security breach._

</comment></comment></comment><comment><USER6> It's a good start, covering SQLi and XSS vulnerabilities. It would be great if it covered CSRF vulnerabilities too. I think those are possibly the three most common dangerous vulnerabilities in web apps, and this page would be a perfect resource if it had those three.

<comment><USER7> Or things like JSONP, CORS, and directory traversal :-/.

</comment></comment><comment><USER8> Some notes:

1) Never blacklist. Seriously, unless you are in the business of writing and securing browser parsers, you are never going to catch everything. There are many vectors not listed on OWASP's XSS Filter Evasion Cheat Sheet. See [https://www.w3.org/TR/html5/scripting-1.html#restrictions- fo...](https://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents- of-script-elements) for an idea of what you're up against.

Because of the incredible number of ways you can cause security vulnerabilities through injection, in 2016 unless you're sending Content-Type text/plain always try and use secure templates. [https://github.com/cure53/DOMPurify](https://github.com/cure53/DOMPurify) is nice, but there are likely good options for your language.

I say use secure templating because you need highly contextual encoding. As this article points out, escapes for HTML will not work in Javascript. Neither will they work for URLs. Single quotes are not escaped in most URLencoding schemes for example.

Many an application has been hacked due to a well-meaning engineer trying to prevent open redirect by only allowing urls with '/' at the front in links, not realising that '//x.com' also takes you out to x.com, or preventing '/' at all, not realising that '@x.com' will take you to x.com, or that '../../..' injection can cause requests to any endpoint on the same domain.

2) Javascript is not your only enemy, and it is not by any means your most fierce. You can use CSS to exfiltrate secret tokens: [http://mksben.l0.cm/2015/10/css-based-attack-abusing- unicode...](http://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode- range.html)

Practically any injection can 'redress' your page so it appears drastically different from a user, which is potentially more powerful than just script injection. You can bypass same origin policy boundaries by coercing the user into making input into an invisible iframe if the stars is aligned.

3) Though this article talks about input validation a lot, it doesn't talk about actually how to do this defensively. You need to construct terse expressions that limit to input data you know can only be safe. Many an application has been hacked by specifiying /#[A-Fa-f]{3,6}|.*/ for hex colour codes.

Wherever you can, do not deal with raw DBMS language strings (SQL, Javascript) and string interpolation, that's a huge red flag. Instead use a driver / wrapper that provides injection safety and use prepared statements.

4) Unless you really want to invest time into learning web security and doing CTFs, don't try to write your own filters. For example, the suggestion that escaping "'" to "\'" can be bypassed simply by adding a "\" just before the open quote. "'" -> "\'", but "\'" -> "\\\'", closing whatever single-quoted string you're in.

5) Serialization is not secure escaping in some contexts. For example, if your endpoint identifies as text/html, but instead returns JSON, I'm going to send some HTML in the JSON string and send a user to the endpoint directly to get XSS.

6) HTML is not your only enemy. XML documents can exfiltrate secrets through XXE and can be coerced into XSS with XHTML islands. Flash is a terrifying thing because it for the most part ignores Content-Types (see: [https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta- fla...](https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)). Requests that flash applications make are just as injectable as any other.

Unfortunately, though this article might cover a fair portion of encoding security, huge issues like effective and secure CSRF protection is not discussed. That's a story for another day. One day there will be a thorough and true guide to security in webapp development, but that is not this day.

<comment><USER9> _I say use secure templating because you need highly contextual encoding. As this article points out, escapes for HTML will not work in Javascript_

I just wanted to reinforce this comment because I work in infosec (mostly web app security) and many of our clients make mistakes in this area. If you don't encode depending on context, you're going to have a bad time.

Most developers are aware of URL encoding and HTML encoding but then you also need to consider other encoding techniques for contexts such as JavaScript and CSS. As an example the single quote when:

URL encoded is %27

HTML encoded is '

JS encoded is \x27

CSS encoded is \000027

It gets way too difficult and cumbersome to manually write encoding code for all these different contexts and deal with the endless number of edge cases. Don't go hunting for single quotes or angled brackets and then replace them what what you think it should be. Rather, you should rely on encoding libraries available in your framework. As an example, in .NET you can import the AntiXSS package and then you have a number of library functions such as CSSEncode(), HTMLEncode() and JavascriptEncode() at your disposal. Similar libraries exist for other major development frameworks.

<comment><USER10> To add as well: html _attribute_ encoding vs html encoding as another context.

</comment></comment></comment><comment><USER11> I like this, but the glaring omission of auth and handling auth information is striking.

<comment><AUTHOR> "Omission"? This article is about to be be extended, we don't yet know which topics they plan to cover. From the bottom of the page:

 _> This article is an Evolving Publication. Our intention is to describe more basic techniques that developers could, and should, use to reduce the chances of a security breach._

[http://martinfowler.com/bliki/EvolvingPublication.html](http://martinfowler.com/bliki/EvolvingPublication.html)

</comment></comment><comment><USER3> I'd love to see these more basic security guidelines included in the documentations of frameworks and packages using these technologies and the online resources teaching them.

In the last few years plenty of fantastic, user-friendly online learning resources have popped up teaching all the cool things you can do with code but very few of them ever mention security. And all too rarely do github repos mention 'Watch out! This could be dangerous!'.

Teaching security always feels like someone else problem. I'm all for many more articles like this one!

<comment><USER12> To be fair, the authors of frameworks probably know more about security than your average user of the framework. The first time I heard of CSFR was when I couldn't get my Django forms working and had to read up on why.

</comment></comment><comment><USER13> I am not sure about ng-bind-html being dangerous.

"Note: If a $sanitize service is unavailable and the bound value isn't explicitly trusted, you will have an exception (instead of an exploit.) " Source - [https://docs.angularjs.org/api/ng/directive/ngBindHtml](https://docs.angularjs.org/api/ng/directive/ngBindHtml)

</comment><comment><USER14> A bit of a bummer that [http://evil.martinfowler.com/](http://evil.martinfowler.com/) resulted in Server Not Found.

<comment><USER15> This is just a wild guess which I can't verify at the moment, but have you tried setting the evil bit in your outbound packet headers, as per RFC3514?

</comment></comment><comment><USER5> Is this the same Martin Fowler that came up with REST?

<comment><USER16> Nice you now understand why some people don't trust REST.

REST is based on a lot of optimism. Security is based on a lot of pessimism.

Building is a sane balance between both. Basically, you build slow to secure stuff.

Remember cathedrals were built for centuries by dedicated generations of small teams of highly skilled non compromising masons.

That's the way you build security. At the right speed.

openBSD is a going a tad too fast, and is a tad too big, but it is still quite secure and functional.

The problem is industry is wishing to make it go faster by throwing more unqualified man power creating a Babel tower effect.

Well, it does not seems to work.

<comment><USER5> Not sure why you think this shows why I shouldn't trust REST...

I can't see how REST is fundamentally insecure! Could you elaborate?

<comment><USER16> It is not REST that is unsecure by itself. It is people following ideas without critical thinking.

Maybe I only had _under brained_ CTO, but I always had problems in details. And even though I have been an architect/sysadmin, recently I went back to coding for others, because I prefer coding.

I saw a lot of mess in signaling the error code, or changing how to return them (is it an 5XX error or a { "status" : "bla", "error" : ... }) or even using the "PUT/GET/POST/DELETE" correctly.

Wrong handling of cache too... of HTTP headers, media type... authentication ...

Also trying to make distributed transactional systems without synchronized clocks on server (and with unsecure NTP source because editing the default ntpd.conf is sooooo hard). And denying the need of FSM for distributed REST servers because REST is supposed to be stateless. (lol)

Or the specs of rest limited to a nice HTML page with one example of the "right case" and no descriptions of the types and no informations on how errors are handled.

On the paper REST is great. In practice ... Oh boy. It is the PHP of messaging.

<comment><USER5> I think you probably need to read up on RFC 2616 again then, and in particular section 9, method definitions.

In terms of status codes, the RFC is very clear: "Response status codes beginning with the digit "5" indicate cases in which the server is aware that it has erred or is incapable of performing the request" [2] so if you are returning a 200 OK when using REST and there server is indicating an error, then you are doing it wrong.

In terms of caching, OPTIONS is not cacheable; GET is cacheable if it conforms to section 13 [3], HEAD can be cacheable, POST is not cacheable at all, responses to [UT are not cacheable, likewise with DELETE.

As for REST being stateless - well, yes! HTTP is "a generic, stateless, protocol" \- and indeed every request you send is an independent transaction unrelated to any previous request.

As for producing a distributed transaction system, sure if you have a distributed set of servers processing REST requests, without some sort of FSM it's going to be hard to implement... I just don't see this as a fundamental issue with REST.

As for "Or the specs of rest limited to a nice HTML page with one example of the "right case" and no descriptions of the types and no informations on how errors are handled" \- aside from the HTTP RFC, REST is detailed in Roy Thomas Fielding's doctoral dissertation [4] and is a really great read, I recommend reading it if you haven't already as it details many of the things you raise as issues.

1\. [https://tools.ietf.org/html/rfc2616#section-9](https://tools.ietf.org/html/rfc2616#section-9)

2\. [https://tools.ietf.org/html/rfc2616#section-10.5](https://tools.ietf.org/html/rfc2616#section-10.5)

3\. [https://tools.ietf.org/html/rfc2616#section-13](https://tools.ietf.org/html/rfc2616#section-13)

4\. [https://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arc...](https://www.ics.uci.edu/~fielding/pubs/dissertation/rest_arch_style.htm)

</comment></comment></comment></comment></comment><comment><USER17> And never run eval() on any user input.

<comment><USER18> Avoid running eval(), unserialize(), etc. because you're wrong about what isn't user input.

</comment></comment><comment><USER19> Seems like an intro to the basics of web app sec. :-(

First step... do not try to do application security until you know it all: until then, find someone who does know all about it.

Before you even start development research your risks and expectations: \- legal requirements (financial, data protection, healthcare: fines or criminal charges aren't fun (although who knows anyone who got investigated never mind lost? Enforcements a joke!)) \- ethical (it's not just about money) \- your targets (customers, staff, browsers, servers, network) \- financial (data, financial/payment systems, IP, etc)

\- Work out what you must do (legal) \- Work out what would be crazy not to do (financial) \- Work out what you should do (ethical) \- Work out what the hell your capturing that you don't need to (mother's maiden names belong with financial institutions and your mother's family; do you really need them to check for your user? Is a Captcha and some 2FA setup with a mobile and email not good enough for you?) \- Don't have a business model where you catch all and work it out later (Google has billions for lawyers so it can just screw everyone, we're not all Google) \- Document the rest, so you have a baseline for any future analysis.

Other todos: \- keep libraries up to date (owasp CVE checking helps), if there's a known attack on the mapping library you are using then escaping might not be enough \- worry about url content (screw REST when it comes to PII: demanding /firstname.lastname@example.com is not a good idea: never put PII or security tokens there if they might be bookmarked or sent as referers) \- understand http headers (especially referers, CORS, etc) \- understand how to setup https servers/clients (that actually authenticate certificates) \- be wary of social engineering risk (one factor auth is easy to commit to github, no devs should be exposing test servers bound to 0.0.0.0 on Starbucks wifi) \- test your security! system tests and integration tests: definitely not just external testing companies (they're terrible unless they can see your source code) \- don't use security frameworks without reading the documentation (some are dumb enough to have default private keys in there: Apache Shiro I'm looking at you)

Most importantly of all....

Document and share your security expectations with all of your team. When Graduate Bob walks into work and doesn't know enough about application security, he shouldn't be commiting to master in your web app until he does. Ensure expectations are regularly audited and that code reviews and testing reflect the expectations.

If you have a problem with this, leave sensitive data alone: there's lots of jobs in IT that don't base their business model around capturing as much personal data as possible (well, there's a few left).

</comment><comment><USER20> Somewhat OT: I really dislike the terms "blacklist" and "whitelist". Are there alternatives?

<comment><USER21> How about denied & allowed?</comment></comment>


The right to disconnect: French employees can legally ignore work emails at home - space-kablooie http://news.nationalpost.com/news/world/french-employees-can-now-legally-ignore-work-emails-outside-of-office-hours <comment><AUTHOR> Extensive discussion from 2 days ago:

[https://news.ycombinator.com/item?id=13290875](https://news.ycombinator.com/item?id=13290875) (128 comments)</comment>


Silverlight adoption hampered by economic crisis  - <AUTHOR> http://www.infoworld.com/article/09/01/28/Microsoft_Silverlight_adoption_hampered_by_economic_crisis_1.html

<comment><USER2> Looks like Microsofts's growth strategy for Silverlight is based on forced adoption by delivering exclusive content rather than features offered.

My workflow is as follows: (1)If javascript cant => Use flash (2)If flash cant => Use SilverLight.

Rarely(never) does it trickle down to step2. It is good to have a completion for Adobe flash, but unless Silverlight offers somethign really awesome that Flash doesn't, Microsoft shouldn't expect large scale organic adoption . Forced adoption by shelling cash on exclusive content is a different story and thats probably why they have to blame the low adoption rate on recession.</comment>


Ask HN: Python side-projects that makes you some passive income - <AUTHOR> <comment><USER2> Betting predictions, Data analysis, Twitter bots.. etc. If you can automate it, chances are you can make money from it whether it's hosting it on a website or providing a service</comment>


Open-sourced Parse now supports push notifications - <AUTHOR> http://blog.parse.com/announcements/parse-server-push-notifications/ <comment><USER2> This is by far the best shutdown of a service I've seen in recent memory. (Though they're still getting a post on 'Our Incredible Journey'[0])

[0][http://ourincrediblejourney.tumblr.com/](http://ourincrediblejourney.tumblr.com/)

</comment><comment><USER3> This is really fantastic and looks like the parse team is delivering on the promises ([https://github.com/ParsePlatform/parse- server/issues/56](https://github.com/ParsePlatform/parse-server/issues/56))!

I am looking forward to seeing the dashboard now :-)

<comment><USER4> Yea I am really hoping they have approval to release the dashboard as its a majority of the value of the Parse service.

<comment><USER5> We do! I'm in the middle of adding the schemas API to parse-server, without which the dashboard won't work.

</comment></comment></comment><comment><USER6> I wonder whether open-sourcing Parse tools could increase its use rather than be used to shut it down.

<comment><USER7> We have been having that discussion internally at the company I work for. After the initial shock wore off and we started deciding what we would do with the projects currently on Parse, we realized that this could very well be a good thing. Before this, we were not able to use Parse for larger clients or clients with specific database hosting needs, but that may no longer be an issue. I'm excited to see what the future holds for Open Source Parse.

<comment><USER8> We spent a few days investigating alternatives and then decided to just wait and see what happens over the next few months. We want to switch to DynamoDB instead of MongoDB due to cheaper hosting costs through AWS for the amount of data we use. There's already someone working on cleaning up the DB code to allow for switching DB providers.

<comment><USER9> In my study of Dynamo DB I found that it might actually be more expensive than managed Mongo DB. But I didn't get a chance to test this out because of lack of budget as we decided to build against Mongo DB rather than build for both and check which one is more expensive.

The problem with Dynamo DB is that one needs to provision the read and write capacity in advance, which means that one needs to over provision in order to be sure. Also even for things like exporting database which requires lots of reads in short time, one needs to provision the read capacity. This can make the back ups very expensive. However I am basing this from my study of their docs as we were building our application. (A chat server).

It will be good if somebody can share their actual experience about Dynamo DB especially from the perspective of cost. Yes, almost unlimited scalability is very attractive, but I found that I had to think about data access patterns a lot to ensure that we will stay in acceptable read write quota for Dynamo DB. This was causing a lot of delay in our MVP. So we decided to go with Mongo DB which we knew we could scale fairly beyond our MVP and may be rewrite the data access layer later on if we achieve a mass that requires a switch to something like Dynamo Db or manual sharding.

</comment></comment></comment></comment><comment><USER10> Smart quotes in code that's meant to be copy-pasted. That's a paddlin'.

<comment><AUTHOR> Fixed! Stupid Wordpress with their smart quotes converter.

</comment></comment><comment><USER11> Is the idea that you're already using Parse in your mobile application? Or can this be used as a standalone tool to enable push notifications in existing, non Parse apps?

I found it fairly trivial to do push notifications with Node and pre existing libraries.

<comment><USER12> There are many apps using Parse only for Push, so it's good for both... But, you've already got that solved (in a similar fashion, this is using node modules.)

</comment></comment><comment><USER13> I'm confused. Can someone please point me to material that explains when to use a parse-like solution?

</comment><comment><USER14> Very quick turnaround. Glad the devs are serious about keeping Parse open and available.

</comment><comment><USER15> This is the main use I had for parse, so I will certainly be checking it out

</comment><comment><USER16> Parse going open source is all good... But is it only me that considered one of the best things with Parse being their very generous free tier?

<comment><USER17> Probably not, seeing as they had to close their doors.

</comment></comment><comment><USER18> was waiting for this!

</comment><comment><USER19> I had written a project which is based on parse. I can not afford to change it by now. I am so disappointed by startup services that close up suddenly.

<comment><USER20> Hey, I'm sorry to hear that. I know it's really frustrating when you rely on a service that closes down. I'm curious - can you not afford to change it because it's too much work, or can you not afford to change it because the alternatives are too expensive? Maybe there is a way forward that is not as bothersome as you expect.

<comment><USER21> I'm involved in a project that uses Parse, and by this point the client SDKs are so thoroughly embedded into our codebase that changing to another backend system would indeed be a fair bit of work. Apparently modular design is a thing.

Fortunately, Parse has provided us with more advanced warning and open-source support that I could ever have expected. This is consistent with my experience using the service; you probably don't remember, but you personally responded to a tweet I sent regarding an outage, and followed up to make sure that the issue was resolved for me.

Many thanks to you and your team for all your hard work.

<comment><USER20> Well the nice thing with this migration is that you don't have to rip out the client SDKs. After migrating the backend to the open source stuff, you just have to change the serverURL and you can point the same mobile app to the new backend.

Thanks for your kind words ;-)

<comment><USER21> Yup! And hosting the Node server on Heroku/MongoLab should be a reasonable solution, especially if the open source community takes this and runs with it.</comment></comment></comment></comment></comment>


Hacking the Toshiba T4800CT (a love story) - <AUTHOR> http://blog.jgc.org/2011/02/hacking-toshiba-t4800ct-love-story_9458.html

<comment><USER2> Use the same trick to get root access on a linux server at school. As the Webmaster of our site on the server I had some sudo rights, thus the trick was actually not so clever ;) But I had sudo rights using Vim and when I went to the command shell in vim I had root rights.</comment>


Ask HN: Has YC ever accepted an ecommerce startup? - <AUTHOR>

Web retail is my industry, and I am fully aware of how unsexy it is compared to the plethora of mobile, social, and saas startups that have been the mainstay of YC's selections.<p>That said, it's also a very profitable industry, and there's no reason that a YC-funded ecommerce company can't be wildly successful.  Yet, as far as I can tell by reviewing yclist.com, they have never accepted one.  Am I blind, am I missing something, or is there something fundamental about the web retail model that YC absolutely hates? <comment><USER2> I doubt YC would turn down a Bezos. I think you've built amazing businesses with Ties.com and Scarves.com. Apply to YC. Keep kicking ass anyway.

<comment><AUTHOR> Thank you for the sentiment, but I have no intention of applying.

I was just curious why the list appears to be so devoid of ecommerce companies. I strongly suspect the answer is somewhere along the lines of "same reason Henry Ford didn't manufacture buggy whips".

Besides, giving up 6% at only a $283k valuation would be insane, no matter how great the YC network is :)

<comment><USER3> You may want to negotiate a better deal than that, but I doubt you're so far along that it would be "insane".

<http://www.paulgraham.com/equity.html>

<comment><AUTHOR> staunch, I wish I could upvote you more. This is an excellent article you linked to, and it may very well be the case that the YC network adds sufficient value to make up for the "insane" valuation. Thank you.

That said, I'm still hoping for an answer to the original question. I find the lack of ecommerce companies very strange.

<comment><USER3> I know the answer: Yes they would absolutely invest in an ecommerce retailer company. They have no "categories" or "types" they avoid religiously.

The filter isn't "ecommerce" but whether it's a "scalable" idea or not.

They might ask "How could you envision your company becoming Really Big in the future?"

Bezos would have said "We're doing books now, but our plan is to be the Wal- Mart of the web".

If you can convincingly argue that your niche businesses in scarves/ties are the gateway to a scalable business you would probably be a good candidate for YC.</comment></comment></comment></comment></comment>