MusicKit JS - <AUTHOR> https://developer.apple.com/documentation/musickitjs <comment><USER2> Props to Apple for releasing this. The way Spotify has handled the deprecation of libspotify without a proper replacement and removing streaming/playback from their other SDKs has been extremely disappointing.

<comment><USER3> I'm kinda late to the party and I wonder. With streaming/playback, do you mean player control, playing sound or other missing features?

[https://developer.spotify.com/documentation/web-playback- sdk...](https://developer.spotify.com/documentation/web-playback- sdk/reference/#api-spotify-player-toggleplay)

<comment><USER2> libspotify and the old iOS Spotify SDK used to provide the ability to stream and play songs in your app, without having to play through a Spotify device or backgrounded Spotify app. This was particularly great in the case of libspotify because it was written in C, making it easy to bind to whichever language you preferred. It was complete enough to write an entire alternative client with.

It looks like this web playback SDK works by creating a local Spotify Connect device to play to, which I guess would technically work, but it'd be much nicer if it just directly played songs as libspotify did and now MusicKit JS does.

<comment><USER3> Hmm that sounds indeed much better! Sadly not C, but cross-platform JavaScript is still nice to have.

Is it possible to embed this in native apps with an embedded browser? Hmm sounds complicated, or is there a different way to integrate this (using the apis the library uses).

<comment><USER2> Embedding just the web player in native apps would be a pain due to communication between the native and web layer. If you just did the whole thing in JS (electron, etc) you're barely any better off than the official client in terms of resource consumption, defeating much of the point of building an alternative client.

There are reverse engineered libraries available (mainly librespot[1]) but they come with the caveat of violating the EULA and risking the accounts used with it. AFAIK Spotify hasn't banned anybody for using it yet, but it's always a possibility.

[1] [https://github.com/librespot-org/librespot](https://github.com/librespot- org/librespot)

<comment><USER3> Good that they limit use to Premium users, making them not lose money.

Thanks for the tip!

</comment></comment></comment></comment></comment></comment><comment><USER4> Doesn't seem like there's an NPM package. Would be better if you could import it with Webpack and use await rather than callbacks etc.

<comment><USER5> Well it's using promises, so you can just await those.

But agreed, the documentation looks like it was written in 2014/2015.

<comment><USER6> The "user's cloudAlbums" example is awful. Might as well use callbacks if you aren't gonna chain promises to avoid callback hell.

<comment><USER7> Where is that? Link?

<comment><USER6> Under the "JavaScript Methods" heading

[https://developer.apple.com/documentation/musickitjs#3004817](https://developer.apple.com/documentation/musickitjs#3004817)

        music.authorize().then(function() {
            music.api.library.albums.then(function(cloudAlbums) {
                // user's cloudAlbums
            });
        });

        Should be:

        music.authorize().then(function() {
            return music.api.library.albums;
        }).then(function (cloudAlbums) {
            // user's cloudAlbums
        });

</comment></comment></comment></comment></comment><comment><USER8> A 99 USD commercial web API. This one, and their other endpoints, require being part of paid Apple Developer program. I understand, but it's frustrating if you're wanting to play around or use in free open source.

<comment><USER9> Do any competing platforms have a similar API with a less imposing barrier?

<comment><USER10> Spotify and Deezer, OTOH.

</comment></comment></comment><comment><USER11> I don't get it.

What's the use for this? ( in a mainstream product way, not in some cool personal private project way)

<comment><USER12> One real-world use case is on Genius.com, where it can be used to play songs (or previews, for users without Apple Music) while reading an analysis of their lyrics.

</comment></comment><comment><USER13> I've always wondered why Netflix and all don't have clip widgets that you can link/embed on other sites. It is essentially free mass embedded paywalls.

<comment><USER14> I can see the short term benefit, but inevitably some big content distributor would want to opt out on condition of providing their content to Netflix due to some disadvantage they perceive with it. From there more and more content providers would want to opt out ("Disney does it, we should do it too because it makes us more like Disney") and then the feature becomes useless and people who use it get mad.

<comment><USER15> They can do it once their library is 100% Netflix originals.

<comment><USER16> Tangential questions: has anyone done an analysis of share of originals in Netflix library as a function of time?

</comment></comment></comment></comment><comment><USER17> You can play your iTunes library online now?

<comment><USER18> Your Apple Music library, this SDK already exists for years so it's not exactly new.

<comment> crooked-v If you have "Sync Library" turned on (the feature's gone through several renames by now), it will also let you play local mp3s that have been uploaded.

</comment></comment></comment><comment><USER19> can a web app play music and run js with the screen off?

</comment><comment><USER20> About time. Rdio has such an amazing embed api (I built the JS api for it at the time and a site that was really heavily used). Total shame when Apple bought and shut them down. Maybe I can bring that old site out from the dead. Hmm

<comment><USER21> Apple did not buy Rdio, they basically went out of business and sold what they left to Pandora.

<comment><USER20> Hmm it's been a while. I don't know why Apple stuck in my brain. Maybe it was another service similar...

But still, I miss rdio.

<comment><USER22> Are you thinking about Lala?

[https://www.cultofmac.com/211126/the-inside-story-of-how- app...](https://www.cultofmac.com/211126/the-inside-story-of-how-apple-bought- music-startup-lala-and-then-bought-it-again/)

<comment><USER20> Oh very likely. I don't really remember the name but they interface looks so familiar.</comment></comment></comment></comment></comment>


MongoDB schema design from Mongo UK conference - <AUTHOR> http://effectif.com/mongodb/mongodb-schema-design

<comment><USER2> This is a commentary on a presentation. The actual slides (linked to at the end of the piece) are at [http://www.slideshare.net/mobile/kbanker/mongodb- schema-desi...](http://www.slideshare.net/mobile/kbanker/mongodb-schema- design-at-mongouk-2010)</comment>


Web Startup Calculator - <AUTHOR> http://www.webstartupcalculator.com All
I have made a simple web startup calculator at  http://www.webstartupcalculator.com/
Its supposed to do four things
1) Describe the web startup in a one line pitch 2) tell you how much time you are saving a potential client 3) tell you how much money you are saving a potential client 4) Help you understand how many sales you need to make a month to achieve a certain amount of profit
It doesnt take into account customer acquisition costs or tell you how many sales people you need, but it will give you an idea of what the financial model could look like, it is a basic model
Best to click on the youtube full screen button to watch
Any feedback appreciated (my voice isnt the most sexy for youtube demo ;-)
Its useful for producing real figures around an idea. <comment><USER2> I actually like this very much. Simple. Does one thing, well, visually, and easily. No real bells and whistles, but for what it is that's fine. On a side note, I felt that the video, though of a fairly low production value, did have a sincerity and "approachable" vibe to it that I liked as well. I'm not sure how you might monetize something like this, but all around ... good job!

<comment><AUTHOR> yes its very low production as its just me ;-) i appreciate you looking so thank you, i was only going for honesty that thats it, so I appreciate what you have said

</comment></comment><comment><USER3> A very interesting idea. Of course my favorite part was seeing Visual Studio open with a couple of website debuggers running in the task tray ;) Did you make this with MVC3?

I love seeing .Net related things in the startup world!

<comment><AUTHOR> lol thank you, always have a debugger open, some people view that as bad, maybe I should of hide it :-) the achievement is the delivery of concept, well to me anyway ;-)

</comment></comment><comment><USER4> Interesting idea but I'd like to see the intro video slimmed-down a bit. I know it's not terribly long but a better-organized walkthrough would get people to _using_ the tool rather than watching a video.

<comment><AUTHOR> thats cool, tell me what you want it to say?

</comment></comment><comment><USER5> Is there an argument to say if you can't work this data out yourself, then you probably shouldn't be running a startup?

Well put together as a hobby project though, so thanks!

<comment><AUTHOR> peoples abilities are all different so its difficult to guess peoples abilities, so i provide a simple need

</comment></comment><comment><USER6> Bloody amazing!

Now if only it could negate the need to show investors anything but the numbers from this...

<comment><AUTHOR> a common way of communication is always appreciated, standards enforced are never agreed, I only wish life was simple like this..

</comment></comment><comment><USER7> If only it did something beneficial...

<comment><AUTHOR> lol i like this, it will not write the code, but if you have an idea it forces you to think about it and whether you should spend money on it and if you spend money on it how much money it will generate for you..

<comment><USER8> Even though the concepts are easy (nothing you cant do with a couple of excel/google docs formulas) I think it's quite nice if you want to do some basic startup pricing maths. A humble suggestion, you can improve the UI, i.e. reduce the video size (as suggested by others) or also give more visibility to calculated data in the page, i.e. "Units Required" and "Sales Revenue Needed" should be more clear and highlighted because they are actually (one of) the "result" of the calculation

<comment><USER7> In my opinion, none of it was clear without the video. How can one launch a website without a basic layout that is self-explanatory? And to launch a website for something that takes 5 min in Excel to make? I still can't see the benefit. It takes longer to learn his interface than to just make it yourself.

<comment><AUTHOR> thats true, but only if you know what you are making, thats what the video explains for those that have not done it before

thanks for the feedback</comment></comment></comment></comment></comment>


Apple Updates MacBook Air and Adds Touch Bar to Entry-Level MacBook Pro - <AUTHOR> https://www.theverge.com/circuitbreaker/2019/7/9/20687402/apple-macbook-pro-air-updates-true-tone-processor-touch-bar <comment><USER2> Sad that the touch bar keeps on keeping on. I was hoping they would drop it, since it's useless and annoying.

<comment><USER3> >>>THE TOUCH BAR IS NOW STANDARD FOR THE MACBOOK PRO LINE

Yeah, like the current keyboards, may be one day this will see its imminent death..</comment></comment>


1Password Leaks Your Data - <AUTHOR> http://myers.io/2015/10/22/1password-leaks-your-data/ <comment><USER3> I don't get why people are making out this isn't a big issue - people would assume whatever is saved in the 'vault' is completely encrypted.

You'd never encrypt a password but leave all the filenames/directories viewable without the password...

(I've noticed this before when grep-ing for a domain, and it came up with stuff from my 1Password vaults, but couldn't work out a better solution so still stick with 1password ). Its a shame, because 1password is great in almost all other aspects.

<comment><USER4> WinZip made a similar choice with its encrypted archives: you could see the list of directories and files before supplying a password.

I would prefer that my account info be encrypted, but I can't use the new OPVault format, because it requires 1Password 5, which isn't supported on OS X 10.9.

<comment><USER5> I think it is just how the .zip format works, not just the WinZip program. It's very easy to get around that though by double zipping.

<comment><USER4> WinZip encryption is an extension to the Zip format that they defined:

[http://www.winzip.com/win/en/aes_info.htm](http://www.winzip.com/win/en/aes_info.htm)

</comment></comment></comment></comment><comment><USER6> As an user of 1Password and indie app developer myself. I don't think talking about this question in YCNews is not a nice gesture.

You are talking about an outdated data format which AgileBit had dropped. They already provide OPVault to solve the problem. What do you expect they want to fix?

Some of the readers may only skim the title of this article / They don't understand the technical details. So they will assume that 1Password IS NOT SAFE. It's a minor bug which will affects almost no one. But this article ( Title ) will affects so many people's impression on 1Password. You are just writing an article to punish AgileBit.

(Update: I was wrong about the Agile Keychain being dropped. It's still using in Dropbox Syncing but iCloud/CloudKit)

<comment><USER7> I'm a new client of 1Passwords and I bought licenses for OSX, Windows, Android and iOS because I'm a multi-platform kind of guy. I also have a Linux workstation and figured that I'll just generate passwords on my phone and then use the 1Password Everywhere dump on Linux. And I decided to use 1Password because it has this portable read-only interface.

Are you telling me that I've got a choice between the safety of my data and dropping functionality for which I paid for? Do you even know if OPVault works in the Android client? But forget Android, does it work with Dropbox syncing? Some posts from their forums claims it doesn't.

Also this isn't a bug. It was a conscious design decision. Now I wonder if I can ask for a refund.

<comment> grey-area Can't you use wifi sync?

<comment><USER8> There is no linux client to sync too

<comment><USER9> Not a perfect solution by any means but the Windows version runs pretty well with Wine. Even works with the browser extensions.

I ended up just buying the Windows version because I was so tired of 1Password Everywhere.

</comment></comment></comment></comment></comment><comment><USER10> Of the many password vault tools out there I still prefer ones that store the data locally, secure with published and and peer-reviewed crypto, sync directly across devices without uploading to a service. I just don't need the hassle of discovering belatedly that an online service has leaked any data. Especially if they are inclined to say it was by design.

<comment><USER11> Perhaps I wasn't clear in the article. This is an entirely optional feature. If you don't want to store 1Password in Dropbox you don't have to, and you certainly don't need to have it in your public folder (I'm not sure those are even a thing any more?). The concern is that if someone has access to your keychain in any way at all, it is open to this. Perhaps you left your machine unlocked for a few minutes? Set up a read only network share for friends to stream movies from you? etc.

<comment><USER10> I'm not sure I'm following you, but in short I'm not trying to attack this piece of software. All I'm saying is that I have a particular point of view and it appears based on the description that this tool isn't the one for me.

</comment></comment></comment><comment><USER12> You buried the lede here:

> Well, in December 2012, AgileBits changed the format of their keychain from > the Agile Keychain, to OPVault. So how is this new format? Well the first > thing is that you cannot use 1PasswordAnywhere with this format any longer.

And:

> Let me summarise: Do not use the Agile Keychain format. It leaks your data. > If you are using it, convert it to the OPVault format immediately.

<comment><USER11> I'm not surprised I butchered it. I'm not a writer by any means. If you look at the few other things I've written, the writing there is just as terrible. Practice makes perfect though I guess.

<comment><USER12> I guess what I meant was that you are emphasizing that the old-style format is what is the problem here, and that it hasn't been the default for three years now, but the headline makes the scope sound much worse. So saying 1Password as a whole suffers from this flaw is pretty misleading. I agree it's an issue that you weren't warned about the need to migrate to the new format.

<comment><USER11> No, the problem is that they have a new format but the OLD one is the default. It's incredibly difficult to use OPVault as your keychain format if you aren't on Windows. Even if you are on Windows, you still need to change it every time.

</comment></comment></comment></comment><comment><USER13> Funny, the title doesn't pop quite as much when it's replaced with the more accurate "1Password Leaks Some Metadata When You Upload Your Keychain to Public Servers".

<comment><USER11> Metadata is still data? Sure, it's not your password, but the title isn't "1Password Leaks Your Passwords". And it's not just when it's uploaded. It's when anyone has access to your keychain. The primary feature of a password manager is that it is supposed to be resistant to attack.

<comment><USER14> No, metadata is not data. It's metadata.

<comment><USER15> It's data about data. So, still data. The title may be a bit sensationalized ("your data" sound like "all your data", but it really is "some of your data"), but it is not false.

<comment><USER14> There's a reason it's not called 'data', is my point. It's false, insofar that it's not the 'data' you give to 1Password.

<comment><USER16> > There's a reason it's not called 'data', is my point.

Is there, actually, in this context? What _is_ the reason you're drawing this distinction? What makes generated passwords 'data', but password reset urls and hand-typed entry names 'metadata'?

<comment><USER14> Because people seem to think everything they do on a computer is or should be private. It's not and shouldn't be.

<comment><USER16> What about everything that is expected to be private, can be made private, has security implications for not being private, and has no gains for being public other than "it's slightly less expensive"?

Why _shouldn 't_ my password reset urls be private? They _are_... in the password database I use.

Why _shouldn 't_ my database entry names be private? They _are_... in the password database I use.

Are you saying that these things are metadata in 1Password by virtue of the fact that they weren't secured? Because that would seem like circular reasoning - that you can never leak data, because leaked data is metadata. I don't share your definition of metadata in such a case.

Are you saying that these things are metadata in 1Password because they shouldn't be private? I just plain strongly disagree if so.

Are you saying that these things are metadata because users shouldn't expect a password database to secure them properly? Then I could at least see where you're coming from. But I don't think it makes sense to tie the definition of metadata to that - among other complaints, I think it lets off companies/software that leak your (meta)data off far too easily, and that such word games absolve them of too much responsibility.

<comment><USER14> I didn't say anything of the sort. I said metadata isn't data and just because metadata is about you/your data, doesn't mean you own it.

I've been intentionally vague so as to discuss this in more macro terms rather than the specific case as presented here, because I feel there's a panicked "deer in the headlights" attitude that comes with talking about data and metadata, and I'd like to try and help folks think a little more rationally around the topic rather than simply "EVERYTHING RELATED TO ME IS MINE AND NEEDS TO BE ENCRYPTED AND HIDDEN".

I regularly forget about how closed-minded the HN userbase is when it comes to privacy.

<comment><USER16> > I've been intentionally vague so as to discuss this in more macro terms

You may want to lead with that next time - I'm not the only one attempting to interpret your vagueness in-context (that is, in the specific case as presented here) which apparently isn't your intent. Hopefully it'll generate productive discussion instead of a confused chorus attempting to clarify terminology.

> I feel there's a panicked "deer in the headlights" attitude that comes with > talking about data and metadata

Are you seeing that in this thread? Or is this more of a generalized feeling of HN? Or of the internet?

I feel like I'm mostly seeing discussions about what specific data was involved, what alternatives are out there, and the severity and history of the problem (which I'm seeing as mostly "not as severe as your initial kneejerk to the title might imply, but not ideal either" \- pretty levelheaded and accurate, IMO?)

None of them seemed particularly frozen, unable to move forwards, or panicking beyond the time it took them to evaluate what specific (meta)data was leaking - to me, at least. And given that password databases secure the keys to the castle, so to speak, I'm not sure a little panicking isn't warranted in this specific context.

> I regularly forget about how closed-minded the HN userbase is when it comes > to privacy.

If that's in response to this thread, keep in mind that, in-context, the "privacy" many professionals in here are concerned about, is the "privacy" of their amazon account keys, to avoid their servers being subverted into part of a malware distribution botnet. And the "privacy" of their user database - <USER2> avoid the reputation hit that comes when all your customer's passwords are cracked, and their inboxes are flooded with porn spam. I think it'd be a mistake to overgeneralize that response.

<comment><USER14> What you've just done to my comment is common on the Internet, but extremely harmful to an intelligent discourse. I wrote what I did all together because each sentence informs and provides context for the others. In isolation, each sentence may carry a different meaning than if they're grouped.

In the future, remember this when you decide to dissect someone's writing.

<comment><USER16> The sentences are still grouped together immediately above my post - in your post. This isn't some blog post quoting snippets from some other link, or a book quoting sections from another resource. I also strongly disagree that these things are inherently harmful, if that's what you're indeed saying. They can be misused to harmful ends, to be sure - but what would you have me do, ditch quotes entirely? Quote only entire books? Chapters?

Quoting entire paragraphs may not be sufficient to provide proper context, and especially if being willfully misinterpreted, can be potentially harmful.

But well intentioned quotes, immediately under a post providing them in their full context - which is the case in my post you replied to? I'm hard pressed to see that as distorting your meaning and harming discourse. If you have specific grievances as to how I have, _please_ state them. If my understanding is distorted, there is harm to discourse regardless of whether or not it's visible in the form of distorted quotes.

The many questions I'm asking are my attempts at understanding the context of your statements, to avoid such distortions. The couple that you've answered have clarified some things. A couple more have been mooted by indirect responses. Many others are still relevant and unanswered.

Even now, I'm a bit unsure if you're saying that I've done harm, in the specific post I made that you were responding to - or if you're making vague generalizations again, this time about sentence level quoting on the internet in general. I'm assuming the former for now - but please correct me if I'm wrong. I would ask, but that's clearly not working out for me.

<comment><USER14> Last word.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Not defending it but this was always a known, though not massively publicised, issue with the 1password format.

I seem to recall that the original justification was that it allowed for checking to see if 1p had a login for the current site without having to ask for your password to decrypt the db.

My understanding is that the new format addresses the issue, but it hasn't been rolled out to the dropbox sync yet.

Hopefully the noise here will push that ticket to the top of their priority list :)

[http://taoofmac.com/space/blog/2011/04/28/2233](http://taoofmac.com/space/blog/2011/04/28/2233)

<comment><USER11> That's the hope with the noise. Agile keychain is old and shouldn't be used. I just want them to use OPVault by default and tell users the risks they take with Agile keychain.

</comment></comment><comment><USER18> Wrote about that back in 2011. Surprised to see it's still an issue, really - I changed formats, but there's no reason for the JS to still work that way.

[http://taoofmac.com/space/blog/2011/04/28/2233](http://taoofmac.com/space/blog/2011/04/28/2233)

(edit: Just noticed that someone else also linked to my blog post further down. Apologies for the redundancy.)

</comment><comment><USER19> What's also bad is it's under shared origin dl-web.dropbox.com so some kind of persistent XSS or cross window JS can leak all your passwords.

</comment><comment><USER20> Why don't people just use KeePassX? Are these paid solutions worth it when you have a decent open source alternative?

<comment><USER21> If by people you mean "Hacker News crowd", I don't know.

If by people you mean "people in general", just look at their respective website. The answer is rather obvious.

I contemplated over which password manager to use before deciding on 1Password simply because of its simplicity and usability. I try to be as aware of my privacy and security as possible and even though I was aware of this leak beforehand, I went with 1Password anyway.

"Hacker News crowd" (to be clear, I'm not using this in a derogatory way) usually think about security in terms of how things work technically, but practicality is just as important. If some piece of software is secure but not usable, that doesn't do any good to the user.

KeePassX is plain ugly, has a terrible website that doesn't give any confidence and scares the user by giving them technical details right out of the gate (check their website). I get that it's open source, it's free, probably more secure than 1Password and they most likely don't have enough income to hire as talented designers as AgileBits already employ, but that just doesn't matter to the user.

<comment><USER22> What makes you believe KeePassX is "probably more secure" than 1Password? I have the opposite impression.

<comment><USER23> Opposite impression based on what?

<comment><USER22> More than a hunch.

<comment><USER24> You just slandered a security product based on nothing.

That wouldn't be a problem if you didn't have a bunch of followers who believe every word you say. But you do, because your analyses are usually decent quality.

<comment><USER22> I almost wrote a comment correcting you, but realized I'd just be feeding the drama you're hoping to generate. No.

<comment><USER24> Why would I be hoping to generate drama? Your behavior is very confusing.

I was disappointed that you had something to say about that password vault, and then didn't say it. You opted for this weird gray area of "I have more than a hunch it's less secure than 1Password." Huh?

Maybe you have nothing to say. It's really strange to see you drop to hunches from substance.

One of the best pieces of advice I found on HN was when someone told me to unplug. It helped me a lot. When you start to see everyone as a troll, it might be time to step back a bit.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Before you run migrating to OPVault do note that at this moment it is not supported on the Android app.

</comment><comment><USER26> I had different issue with their 'secondary vault' feature. Adding additional vaults as your secondary vaults is not just UI thing.

ADDING A SECONDARY VAULT EFFECTIVELY MEANS STORING MASTER PASSWORD OF YOUR SECONDARY VAULT IN YOUR PRIMARY VAULT!

This was confirmed by their support as a reply to my email below. It is better for UX, but it is not explained properly IMO.

Theoretically you could get burnt in scenario when you use personal primary vault with some weak-ish password and add your super-important employer's vault as a secondary vault for convenience. You effectively make super- important vault as weak as your weak-ish master password of your primary vault (without knowing).

My email back in March 2014 (shortened):

I somehow ended up in situation where 1Password pretends to keep my data safe but does not require password for unlocking secondary vault as long as I have unlocked the primary vault. If I don't unlock primary vault and switch to the secondary vault first, the correct secondary master password is required. [Contrary switching to primary vault while having unlocked secondary vault requires me to enter primary master password to unlock it (expected behaviour)]. This behaviour is exhibited in 1Password.app, 1Password mini and chrome plugin.

I'm a developer. I have just read all the documentation available on your site [http://help.agilebits.com](http://help.agilebits.com) just to better understand the system and reason about it. And I cannot really explain this behaviour. 1Password should not know how to unlock my secondary vault without my secondary master password (unless it caches the master password somewhere behind my back) OR my secondary agilekeychain file is not really encrypted, but UI pretends it is, because it requires correct master password (when I go and want to see the secondary vault without unlocking the primary vault first). I noticed this behaviour only recently I think originally this worked just fine. This hiccup could be caused by latest update or my upgrade to 1Password4 a few months ago.

</comment><comment><USER27> Hello all, I'm the Chief Defender Against the Dark Arts at AgileBits, the makers of 1Password.

The discussion and analysis in Dale Myers' article is very good, although someone who just reads the headline could very easily come away with the wrong impression.

The "older" .agilekeychain format (AKF) — designed nearly a decade ago – does indeed expose the same sorts of information that would be in someone's browser bookmarks. So if someone gets hold of your AKF data they will be able to see what sites you have Logins for and what titles you have for your items.

Given the constraints we faced back then, that might have been a reasonable design choice at the time. But it is certainly not an acceptable design choice today.

The article does point out that that the OPVault data format was introduced as a replacement for the AKF back in December 2012. The OPVault format not only encrypts much more of the metadata, but it also provides for authenticated encryption and includes many other improvements.

The article also points out that the behavior of the AKF "discovered" is documented in many places. We've blogged about it, we've talked about it on our discussion forums and it is in the docs. What isn't in place is some big red letters in the user interface that says "Using this format leaves URLs and Titles unencrypted".

Dale Myers' article also correctly points out that we do offer instructions on how to migrate your data from the Agile Keychain format to OPVault.

The article criticizes us for (a) Not making OPVault the default for new Dropbox synching, and (b) Not providing a nice easy way to migrate

Obviously we would love to see everyone on the new data format. It is a big improvement over the old one in an enormous number of respects, but until we can be confident that everyone is running clients on all of their platforms that can handle the new format, we are treating migration as an "expert only" thing.

Rolling out a data format change when you have one "product" and one platform is easy. But we need to make make sure that people are using versions (and that such versions are available) of 1Password that handle the new format on all of the devices that they sync with.

So if we were to make OPVault the default sync format on Mac, we would need to know that the 1Password app people are using on Windows. We have been conservative about this.

Also, in our beta testing of data migration, we discovered a nasty bug in how we encoded keys for the some attachments. The result is that some of our beta testers would have lost data if they had not had good backups of their AKF data. Obviously, that is not something we wanted to push into general release. (Only attachments created in specific circumstances were victims of that, so we didn't spot it in internal testing.)

Now you may very well disagree with some of our judgement calls, particularly about how cautious we have been and continue to be in migrating people to the new format. But I hope that even if you do disagree, you will see that there are reasons for our choices.

<comment><USER28> Security is your thing. I think when it comes to protecting your user's data vs inconveniencing them, you should inconvenience them. This will make us trust you more vs creating a new database format almost 3 years ago which fixes some of the security bugs of the old one and expecting only the experts to figure it out. Please make it the default.

<comment><USER29> "I think when it comes to protecting your user's data vs inconveniencing them, you should inconvenience them."

I'd rather they protect their user's data. ;)

<comment><USER28> I poorly worded it :).

I'd rather be inconvenienced if I know my data is safer.

</comment></comment></comment></comment><comment><USER30> So the threat is that if someone hacks Dropbox and gains accesss to your Dropbox they can read which sites you visit?

Wouldn't this be "self fixing" problem, if you use 1Password to comeup with a secure Dropbox password?

Obviously this isn't ideal situation, but I see no reason to switch away from 1Password and currently I don't even know where I would go from 1Password. I jumped from LastPass to 1Password since I want to have access to my passwords on mobile devices without paying a yearly fee and now that LastPass has been acquired by LogMeIn I'm in no hurry to jump back. And I don't know if opensource managers like KeepPass have mobile support.

<comment><USER31> Another problem is that _Dropbox_ can see which sites you are visiting.

<comment><USER30> And? If you use Facebook, Twitter, G+ or Google Chrome you are already broadcasting every site you visit

</comment></comment></comment><comment><USER32> This is why Keeper uses zero-knowledge encryption. Our CTO, Craig Lurey, wrote more about data leakage here: [https://blog.keepersecurity.com/tech/2015/10/23/dont-be- leak...](https://blog.keepersecurity.com/tech/2015/10/23/dont-be-leaky- password-management-privacy/) We're assisting any adversely affect customers who are interested in migrating to Keeper and offering 50% off worldwide (except 5 countries). Just shoot a note to firstname.lastname@example.com

</comment><comment><USER21> I noticed the same issue awhile back, but I didn't make a big deal out of it thinking I had no other choice. Good to know they have another format that limits the leak of metadata. Thanks for the post.

</comment><comment><USER33> Ouch. 1Password is probably the best usable password manager today; they can do better in a few areas, including this. Another area would be putting blessing/device keys on each device on top of a password, because I don't trust a passphrase alone, and many platforms are getting trusted computing features -- you have a slow process to put a device key on each thing, which is then entangled with your passphrase to decrypt. You could even do a hw token, too. Another area they could improve is network sync -- I don't trust iCloud or Dropbox, and wifi-sync is a pain, so supporting WebDAV or some other open format they could develop would be a lot better.

Long tangential digression:

My personal design goal is to maximize the number of distinct entities which have to collude to cause me serious harm.

Pure online SaaS is often very bad. There are cases where the risk is acceptable, but "here, maintain a password list" is not one of them. The "shared google sheet full of password" is a great example of this. Evernote is another example. I avoid these wherever possible.

Systems like LastPass where the binary is distributed by an entity every time I use it, and then talks to that same entity for the backend, are are better, but still bad. Hushmail was the canonical honeypot of this type -- download a java applet after logging in...

A long-lived binary (standard client software) talking to servers operated by that entity is better. Swapping the binary out is more detectable, and harder to do for a single user. iOS apps are probably the best for this right now, since Apple is sort of a semi-trusted intermediary here. You'd at least have a shot of catching the compromise after the fact.

Client software which talks to servers run by separate third parties is better. e.g. 1P using iCloud/Dropbox. It is better as the set of third parties is bigger and more diverse.

The ideal is being able to run client/server on your own platforms. Being able to run a cloud storage service (e.g. AeroFS) entirely on your own private network is ideal.

Open source on top of this is great, but in reality independence of operating the services is worth more. An open standard with multiple implementations, many of which are open source, would be meaningful, but merely publishing source code isn't as meaningful, at least without verifiable/repeatable builds and a good runtime level matching.

</comment><comment><USER34> The part I don't understand about all of this, is how this information becomes public when it's stored in Dropbox? My understanding is unless you create a sharing link for it, it will be privately stored in your Dropbox.

<comment> why-el You can also put things in the public folder. No idea why you'd do it though. Perhaps you store your Dropbox password itself in 1Password and therefore you don't have access to it when you are away from your devices, hence the need for a public and open link. (you still need to remember the public link to the keychain though)

</comment></comment><comment><USER35> It seems content.js at least for me is still hashes of passwords and not the passwords themselves, perhaps you need to open the website to have it be decrypted and saved in content.js?

<comment><USER11> Correct. The passwords are not breached in any way. It's the metadata that is the leak, and that alone can be enough to compromise accounts.

</comment></comment><comment><USER36> The only place I've ever used that was inside of Dropbox's web interface, where I'd have to first be logged in. Is it a common use case where it'd truly be public?

<comment> why-el Not common, but what you said means you remember your Dropbox's password so I guess it is not in 1Password.

</comment></comment><comment><USER37> Great job finding and writing this. I didn't find your writing to be shit, unlike another user here. I felt it was clear and succinct, without being sensationalist.

Edit: like -> unlike

</comment><comment><USER38> Does this only happen if you use Dropbox? What if you use iCloud?

<comment><USER39> It makes no difference if you use Dropbox or iCloud. It depends on the file format.

<comment> grey-area Incorrect, according to 1Password:

[https://support.1password.com/switch-to- opvault/](https://support.1password.com/switch-to-opvault/)

</comment></comment></comment><comment><USER40> Hmm.. reading all the time about hacks and data leaks from password managers. Never heard of one while using Sticky Password. Hope they won't get hacked.

</comment><comment> grey-area For those using 1Password, this isn't as bad as the headline implies.

1\. This doesn't apply to local data

2\. This applies to metadata, rather than passwords

3\. This only applies to an old vault format changed in 2012 used for syncing via external servers [edit, specifically dropbox or folder sync, still in use for that it seems]

So 1Password leaks your metadata if you use the old vault format from 2012 and upload your passwords to a public service (or share them some other way), but that's perhaps not such an upworthy headline.

Personally I would use local wifi sync and keep your data local, whatever password manager you're using.

<comment><USER39> The problem is this "old" file format is the default still today.

<comment> grey-area Only for remote files, and only if you choose to sync your files to a remote folder which is not icloud ( Dropbox and Folder Sync), it's not used for local data is it, and only for remote data (if you choose to do that) for certain services?

[https://support.1password.com/switch-to- opvault/](https://support.1password.com/switch-to-opvault/)

</comment></comment></comment><comment><USER23> Does somebody know if Chrome sync with passwordphrase also encrypts the url? I'm not 100% sure... this is why I'm asking.

</comment><comment><USER8> An other reason why it's sad that Agile Bits does support Droppbox but not Webdav or any other selfhosted sync option

</comment><comment><USER37> Do we need be concerned about previous .1p4_zip backup files? I just changed to .OPVault file format.

</comment><comment><USER28> Anyone here use Enpass? What is your experience?

<comment><USER41> I've played with it a little. I'm curious because it's so cross-platform (I use Mac, Windows 10, iOS, and Windows Phone), yet has a really slick UI like 1Password. It seems about on par with 1Password so far, but like I said I've only used it a little.

I'll try to remember to poke around the data files this week if I get a chance.

</comment></comment><comment><USER42> "1Password Leaks Your Data was published on October 22, 2015 by Dale Myers."

Yet more proof of time travellers..

<comment><USER43> In the future, we might not want you talking about us.</comment></comment>


Ask HN: Help with project ideas - <AUTHOR> Hey!
I'm a devops engineer, who loves writing random open source projects/websites in my free time and for the past month or so I haven't been able to come up with ANY ideas. I've trauled through reddit threads for 'build this please' and such and can't find anything interesting.
If anyone has any ideas for an open source website, anything new or interesting, I am ready and willing! <comment><USER2> Checkout [https://github.com/karan/Projects](https://github.com/karan/Projects)

</comment><comment><USER3> Hi Matt, I'm working on a project to address the issues with the UK Universal Credit (UC) System. Please drop me an email on firstname.lastname@example.com

Speak soon</comment>


Darpa offers $50,000 prize if you can figure out these shredded puzzles - <AUTHOR> http://www.networkworld.com/community/blog/darpa-offers-50000-prize-if-you-can-figure-ou

<comment><USER2> IMO, the scans are way too low res.

Automatic detection of upside down pieces, etc is considerably more difficult with this low resolution.</comment>


The Plane Finder AR: An App Threatens Airline Security? - <AUTHOR> http://www.ndtv.com/article/technology/a-phone-application-that-threatens-security-56673

<comment><USER2> London (parody): A cheap mobile phone application that can track the precise location of passenger buses on the road can be a serious terrorist threat, security experts have claimed and called for its immediate ban.

The Bus Finder AR application, developed by a British firm for the Apple iPhone and Google's Android, allows users to point their phone at the road and see the direction, speed, and likely destination of passing buses.

It also shows the bus line, route number, departure point, destination and even the likely course-the features which could be used to target a bus with a rocket-propelled grenade, or to plot suicide bombings, the 'Daily Mail' reported.

The programme, sold for just 1.79 pounds in the online Apple store, has now been labelled an 'aid to terrorists' by security experts and the US Department of Homeland Security is also examining how to protect airliners.

[...]

After the September 11 attacks in America in 2001, a senior Federal Aviation Administration official warned that published bus schedules could be used by terrorists.

He wrote: "Revealing the identity and location of buses... would open the door for a terrorist to attack a specific bus or coach line."

[...]

Conservative MP Patrick Mercer, former chairman of the Parliamentary Counter Terrorism sub-committee, said: "Anything that makes it easier for our enemies to find targets is madness. The Government must look at outlawing the marketing of such equipment."

[...]

The firm claims more than 2,000 people have downloaded Bus Finder AR from iTunes since its launch last month.

(Also posted to my Tumblelog: [http://aggregated.alanhogan.com/post/1238682952/a-phone- appl...](http://aggregated.alanhogan.com/post/1238682952/a-phone-application- that-threatens-security))

<comment><USER3> At first glance, I thought you had simply copy-pasted the article. Posting here in hopes of calling attention to your subtle parody.

<comment><USER4> There is no parody of over-security sufficiently over the top and paranoid that it cannot be mistaken for the real thing.

<comment><USER2> Poe's Law applies to security and terrorism parodies as well? Interesting.

</comment></comment></comment></comment><comment><USER5> Right, because it would be so difficult to find aircraft without this nifty software.

I mean, a terrorist with a rocket launcher just gets in the damn car and drives to an airport, points it, and blows up a plane. Clearly, cars need to be outlawed. Or roads.

I hate terrorism pieces. The stupid just plain burns.

</comment><comment><USER6> How does this app work? I really don't see how it's possible.

<comment><USER3> ADS-B is an automatic broadcast of an airplane's position and velocity, intended for making management of the airspace easer, among other things. It is not encrypted, and you can set up the hardware to receive the signal with a modest amount of effort. There is apparently a website somewhere where these hobbyists are aggregating this data.

<comment><USER7> Then this data must be encrypted.

And since it would be an obvious security risk to allow bad guys (ie foreigners) to access this data then none US aircraft couldn't be allowed to fly in the same airspace as non-Us aircraft. So US aircraft couldn't be allowed to fly abroad and foreign aircraft couldn't be allowed in the US.

Operation complete isolation (as the proposal is known) would greatly increase security.

<comment><USER8> What's the threat model here?

<comment><USER9> Exactly, what's the threat model? If I were a terrorist with a ground-to-air missile, would it matter to me whether I blew up a _specific_ plane or just the first Jumbo-class plane of $country's airline to take off? Would it matter to society at large whether a plane had been randomly or specifically targeted?

</comment></comment></comment></comment></comment><comment><USER10> <http://www.flightradar24.com/> <\-- how is it much easier than a laptop with an internet connection?

Found by: Google Search. Search phrase: "ADS-B online" (without quotes) 6th link.

<comment><USER11> Also: <http://www.flightstats.com/go/FlightTracker/flightTracker.do>

</comment></comment><comment><USER12> As much as I dislike scaremongering about attacks on aircraft this sort of thing does lower the barrier of entry so to speak especially for solo nutbags. Given that the information is freely available however the issue is with the ADS-B system rather than the iPhone app.

<comment><USER13> Pray tell, how does this lower the "barrier to entry"? Are we presuming that terrorists are stone deaf, nearly blind, and incapable of memorizing daily aircraft routes?

If so, I agree with you, and further suggest banning iPhone-holders for Stinger missiles.</comment></comment>


EDG C++: The parser used by Microsoft and Intel compilers [pdf] - <AUTHOR> https://www.edg.com/docs/edg_cpp.pdf <comment><AUTHOR> Home page: [https://www.edg.com/](https://www.edg.com/)</comment>


Memory-efficient XML parser that yields Ruby objects - <AUTHOR> https://github.com/monterail/saxy

<comment><USER2> Nice one. But in few words - what makes it better than Nokogiri::XML::SAX::Document from which you inherit?

<comment><AUTHOR> I wouldn't say it's better. saxy wraps around Nokogiri SAX Parser by implementing it's callbacks.

What I wanted to achieve is to take advantage of SAX parser (memory efficiency when used correctly) with as little preconfiguration as possible, because I often face one-off tasks that involve importing large XML files into database.

I've seen some implementations of SAX parsers, but they either missed the point by only using it's API under the hood and still returning all the results at once (thus not being memory-efficient at all) or required extensive configuration (which seems a waste for one-off imports).</comment></comment>


In the Works – AWS Region in Canada - <AUTHOR> https://aws.amazon.com/fr/blogs/aws/in-the-works-aws-region-in-canada/ <comment><AUTHOR> About time! :)</comment>


A Neglected South American Masterpiece - <AUTHOR> http://www.newyorker.com/magazine/2017/01/23/a-neglected-south-american-masterpiece <comment><USER2> > "I consider man a maker of noises," the narrator declares. The omnipresent > racket is obviously some kind of symbol, in the existential way: its > significance may be that it has none.

Great piece, thanks for sharing. Although Bolano is quite different, I would raise his Savage Detectives as another contender for the "Great American Novel". Another book with individuals consumed by an inevitably futile quest that they pursue relentlessly.</comment>


Preventing AMI's BiOS from interfering with coreboot flashing on the Librem 13 - <AUTHOR> https://puri.sm/posts/preventing-interference-from-the-old-bios-while-flashing-coreboot/ <comment><USER2> Also looks like the coreboot payload/distro they'll be shipping is Heads! [https://puri.sm/posts/purism-collaborates-with-heads- project...](https://puri.sm/posts/purism-collaborates-with-heads-project-to- co-develop-security-focused-laptops/)

<comment><USER3> Trammel Hudson, the guy behind Heads, does a lot of interesting maker type projects too. His personal project site is worth checking out: [https://trmm.net](https://trmm.net)

<comment><USER4> Wov. How can one person find time for all that?

</comment></comment></comment><comment><USER5> Chromebooks use coreboot. What's the idea behind sourcing parts from upstream vendors who are hostile to the goal of openness, rather than from some manufacturer (e.g., Dell) already shipping Chromebooks?

<comment><USER6> Good general purpose hardware. Chromebooks have limited soldered hardware aimed at giving you enough power to get to Google's services, but not more.

<comment><USER5> There are Chromebook configurations where a i3/i5/i7 CPU and 4GB/8GB/16GB RAM are among your options. Just about the only thing that's consistently undercut is storage capacity, but options also include Chromebooks with user- upgradeable SSDs and SD slots.

It sounds like you're working off an outdated understanding of Chromebook options, one where 2011-era limitations play a major role in your perception of how suitable they are for getting work done.

<comment><USER6> No, I'm quite aware of what chromebooks have to offer, and there isn't a single general purpose workstation style chromebook. Find me an i7 (quad-core) chromebook with 16+ GB of RAM and expandable storage. The closest was the 2015 Pixel, sold at some extortionate price, and still with limited storage.

<comment><USER5> The thoughts in each of your two comments are at odds.

It also may be the case that there are no existing Chromebook configurations that satisfy your criteria, but recall that the context here is a design and manufacturing strategy for Purism to produce the Librem. There exist Chromebooks with comparable specs and comparable price points. If you think that existing high end Chromebooks are a bad value proposition, that's fine, but then the same is true for you of the existing Librem, so what are we even doing here?

Even disregarding that, what would there being no _existing_ Chromebooks have to do with the discussion? We're talking about getting a shop who's interested in producing a custom design work to try to source parts from more diverse and more agreeable vendors. Of course you can't order that hypothetical machine today—the fact that it doesn't exist is fundamental to the discussion.

Your comment only makes sense if the proposal here were, essentially, "Purism needs to take an existing Chromebook and rebrand it as the Librem." But that's not what I said, because there's no value in it and it wouldn't make sense—you'd be better just buying the unrebranded version directly.

<comment><USER6> I'm not sure what you are arguing for. I'm not entirely sold on their value proposition. I just think that they are building something like a chromebook without the conventional limitations of chromebooks. The talk of sourcing friendly parts or replicating chromebook's methodology isn't very accurate because a) The deals that Google can get can't necessarily be replicated by others b) There probably aren't magical "friendly" parts. The parts are mostly similar across laptops with significant engineering and s/w work done by Google (for coreboot etc.), or by Purism in this case for their laptops.</comment></comment></comment></comment></comment></comment>


Deadly pathogens have escaped the lab over and over again (2019) - <AUTHOR> https://www.vox.com/future-perfect/2019/3/20/18260669/deadly-pathogens-escape-lab-smallpox-bird-flu <comment><USER2> W8 but FB "fact checker" who worked at the lab said it can't be because they were cautious [https://m.youtube.com/watch?v=fPUfcoHW87I](https://m.youtube.com/watch?v=fPUfcoHW87I) and this is from 2019 so it can't possibly be the case for covid-19</comment>


The madness of corporate web filters - <AUTHOR> http://blog.thestateofme.com/2011/01/12/the-wrong-sort-of-radio/

<comment><USER2> Perhaps a cost-saving measure would be to provide unlocked netbooks and a separate wireless connection to them, distinct from the company network. Even if employees would be discouraged to slack off, if they did, they had an outlet for it.</comment>


Ask HN: Startup Ideas vs Bureaucracy? - <AUTHOR>

This is more of a discussion question.
How do you guys deal with (government) politics and the hurdle of a good idea?  Do you think of ways around it or just hold off the idea till later?
One of the coolest things about the internet is the lack of politics and bureaucracy. Want to start a website about something social?  Just start it!  Unfortunately though, as time goes on and more people want their hand in the cookie jar, politics and bureaucracy will rear it's ugly head similar to other more mature industries.
For example, I have a cool idea of a medical start up where doctors and people get together and treat and research each other.  The hurdle?  Nine thousand miles of red tape, politics, court orders, licenses, insurance, privacy laws, liability laws, and so forth.  That's even before I get to the idea!  It's so much easier to start a social networking start up than to deal with that mess.  Though for how long, I don't know. <comment><USER2> At a previous gig I worked with a company that was providing legal, medical, and financial information online. They dealt with it by being based abroad. It may make sense for you to explore this as well. If you incorporate somewhere other than the US, you can still live and work here just fine. (Keep in mind that this may make it harder to raise financing in the US.)

However, there was still a lot of red tape for people providing that sort of information (our service providers). For example, we found out that financial advisors are not supposed to provide their services across state lines. Of course this makes no sense for someone practicing online. What we ended up doing is dumping a huge amount of disclaimers in the terms of use to try and protect everyone involved.

tl;dr: terms of use; disclaimers; perhaps incorporate in another country

</comment><comment><USER3> I worked in the operations department for one of the Navy training commands for a short period of time. It was amazing how many random regulations there were that didn't make sense and were only sporadically followed.

If you have the confidence to stick your neck out there and not worry about getting yelled at, its better to just do it and beg for forgiveness later. If it works, minor berating. If it doesn't work, well, getting yelled at doesn't have too many permanent negative effects.

</comment><comment><USER4> I work in healthcare. What types of problems are you running into?

<comment><AUTHOR> It was just an example. I was just looking at other people startup ideas in the medical realm and the problems they face.</comment></comment>


Self-Driving, Electric Cars Are Going to Have Tons of Strange Effects on Society - <AUTHOR> https://www.technologyreview.com/s/604047/self-driving-and-electric-cars-are-going-to-have-tons-of-strange-effects-on-society/ <comment><USER2> Interesting analysis.

I disagree about the loss of repair shops, though. Cars will still need brakes, tires, wheel bearings, struts, etc. Replaced.

Car repair will have to become much more sophisticated, though. When I was a college dropout I was an auto mechanic and while the job definitely appealed to the intellectual/engineer in me, most mechanics are incentivized to move volume, so they end up "throwing parts at the car" until it's fixed, then explain to the customer that "the crank sensor, the coil, AND the ECU were all bad! We had to replace them all!" In reality it was only the last part they replaced that fixed the problem, but it's not worth their time to swap the part back out the return it.</comment>


Copyright Lawyers Sue Lawyer Who Helped Copyright Defendants - <AUTHOR> http://www.escapistmagazine.com/news/view/105651-Copyright-Lawyers-Sue-Lawyer-Who-Helped-Copyright-Defendants <comment><USER2> Previously reported: <http://news.ycombinator.com/item?id=1941207></comment>


Stephen Hawking has figured out exactly how much time humans have left on earth - <AUTHOR> http://www.techly.com.au/2016/11/18/stephen-hawking-has-figured-out-exactly-how-much-time-humans-have-left-on-earth/ <comment><USER2> "Stephen Hawking has figured out exactly how much time humans have left on earth" \-- Techly

"Humanity only has around 1,000 years left on Earth, Stephen Hawking predicts" \-- Science Alert

"Stephen Hawking: We might have 1,000 years left on Earth" \-- USA Today</comment>


Apache Spark on Kubernetes - <AUTHOR> https://banzaicloud.com/blog/spotguides-spark/ <comment><USER2> There's still a lot of development on the Kubernetes features for Spark. If you are really thinking about moving your production jobs from Yarn or Mesos to Kubernetes, wait until version 3.0 comes out.</comment>


A daily investigation of proactive and reactive helping at work - <AUTHOR> http://psycnet.apa.org/record/2018-43398-001 <comment><AUTHOR> From article KEEP TO YOURSELF! DON'T OFFER CO-WORKERS HELP UNLESS ASKED: [https://msutoday.msu.edu/news/2018/keep-to-yourself-dont- off...](https://msutoday.msu.edu/news/2018/keep-to-yourself-dont-offer-co- workers-help-unless-asked/)</comment>


Interview With Ash Damle of MEDgle.com (they built a useful health information site) - <AUTHOR> http://www.thinkgene.com/interview-with-ash-damle-of-medglecom/

<comment><AUTHOR> Medgle is an intereresting startup that I hadn't heard about... they haven't had a lot of publicity, but they built something useful.</comment>


Why Portland is a great place for startups - <AUTHOR> http://www.centernetworks.com/why-youll-love-portland-oregon

<comment><USER2> You know what Portland does _really_ well? Not start-ups, not yet. It has fostered an amazing array of web geek user groups. Check out this list of goings on in the local tech scene, and note that the calendaring app itself was developed by a collaborative effort that spawned from a user group:

<http://calagator.org/>

And the quality of discourse at some of these local meet-ups is astonishingly progressive and technical. It feels like Portland's start-up scene isn't the best indicator of our technical culture and potential. Our traditional start- ups stand in the long shadow of Silicon Valley, and may expend too much energy wondering when someone will swoop down and invest.

Portland will make a name for itself by doing business in a much different manner than is done in the valley. The absence of venture capital will force us to invent better models.

BTW, have you guys seen Urban Edibles? It's a collaboratively developed wiki detailing where one can find food growing in Portland's urban areas. <http://urbanedibles.org/>

My roommate used it to make 3 jars of golden plum jam entirely from foraged fruit.

<comment><USER3> Does SF have anything like calagator? If not, someone should build it.

<comment><USER4> It probably goes without saying, but the source behind the calagator.org site is freely available: <http://github.com/calagator>

</comment></comment></comment><comment><USER5> Portland has this almost unhealthy obsession with getting itself "On The Map".

\- If we just build this convention center, that'll put us Portland The Map.

\- If we can build a successful light rail system, that will put Portland On The Map.

\- If we could only attract a major league baseball team, that would put Portland On The Map.

There's a Map out there somewhere, and Portland _really_ wants to be on it. Pick any thing that any big city has, and Portland will want one too, because that will be the thing that finally pushes it over the edge to where it is respected as a "real city."

This article sounds like more of the same. There are Startup Hubs to be had, and P-town needs one. Because that'll put it on the map.

Don't get me wrong. I lived in Portland for almost 10 years, and it's a great place. But it's got like 1/10 the population of Seattle, and I think that gives it a bit of a complex. I wish it would chill out and settle into its role of a comfortable small city where you can live and work downtown.

That's all you need to be, Portland. Stop trying to grow up too fast.

</comment><comment><USER6> Portland really is a great city, and I think it's a lot calmer than Silicon Valley. Although your local pub might not be filled with a dozen angel investors, Portland _has_ embraced the young startup culture. With groups like OMSI, DorkbotPDX, Cubespace, and recently TechShop, it's a haven for hackers of all types. Not to mention a great music scene, delicious food trucks, and the best microbreweries in the nation.

The crucial thing it's missing is a large technical school. And that's likely the reason it will never be able to touch Silicon Valley in terms of startups.

<comment><USER7> "The crucial thing it's missing is a large technical school".

100 miles south of Portland is the OSU. I hope they do something about this.

<comment><USER8> Not true. Portland State has a decent Engineering/CS school that's growing like a weed. It's just going to take a little while for it to build a bigger rep.

</comment></comment></comment><comment><USER9> Yes and No.

I am currently in Portland and we started our company here (Mugasha) about a year ago. Cost wise, its much cheaper to live here which definitely reduces burn-rate. The community is pretty cool, lots of awesome people who are constantly throwing local tech events. Lot of designers and developers (creatives) in the area.

What is missing? For one. Statup types. Most people I have come across in Portland don't seem to be the type that would build companies. People seem to be working on mostly side-projects. The community is very "social media" driven and there is not a lot of chatter going around on about how do you build businesses?

Second, would be. Mentorship. It has been fairly difficult for us to find people who have been there and done it. People who have built companies in the past. There are no VC's here. Very few angels here, at least angels who are focused in the web/tech space.

I think Portland is a great place to start a project. Potentially meet co- founders. Although, It's hard for me to say that I would continue to build my company here.

<comment><USER10> I'd like to start a group for "Startup Types". Interested?

<comment><USER9> Go for it.

</comment></comment></comment><comment><USER11> This years DjangoCon (conference from 8th - 10th September; sprints from 10th to 12th sep) is in Portland, OR. It's my first time travelling to USA and I'm really looking forward to this :-)

</comment><comment><USER12> I grew up here and moved back after college in CA, so I'm a little biased. It's a great place to live. The tech scene is really inviting and impressively sophisticated as others have mentioned. The Ruby group where that calagator app was developed is superb, as is DorkbotPDX. I find it substantially cheaper and easier to get around here than LA/SF since it's not that big of a city (strict urban growth boundaries), it's reasonably dense and it's public transportation is well above average.

While it's easy to find people who are passionate about technology and building things, I don't feel it has the culture of ambition that's so prevalent in CA. Maybe it's because people are happy to be doing things that don't cost anything, like enjoying the outdoors or local music scene, and are less self conscious about what they drive.

</comment><comment><USER13> I've actually been considering going up for a few weeks, because California's tax structure, high cost of living, and overall lack of decent public infrastructure is seriously unfavorable to small business.

<comment><USER14> Oregon has no sales tax, and as such its income and property taxes are much higher than many states. This is especially true in Multnomah County (where Portland is located), due to county income and business taxes on top of state. See, i.e.

[http://credc.sterling.net/business/infocenter/Clark- Multnoma...](http://credc.sterling.net/business/infocenter/Clark-Multnomah- Washington%20Tax%20Comparison%20-%20Jan%202009.pdf)

I've lived in both San Francisco and Portland, and anecdotally I found Portland's infrastructure and services to be far inferior to those in San Francisco: worse roads (climate doesn't help), more homeless, more difficult city bureaucracy, etc. This is of course somewhat subjective, so YMMV.

Personally, if I were to move from the Bay Area due to cost of living and taxes, I'd be looking at Texas.

<comment><USER15> Arguably the real reason many people are keen to move to Portland, especially from California, is that it's the whitest city in North America.

<comment><USER16> I presume by "arguably" you mean "I have a bizarrely distorted worldview and therefore I'm going to assert this fact that I have just produced from the depths of my colon."

<comment><USER15> No, actually it was the articles about white flight from California I've encountered over the last few years.

<comment><USER16> And the reason those articles stated was that people were leaving for "whiter cities"? I think that's a stretch. The last I heard a lot of people were leaving California because the white collar jobs were leaving California. As I'm sure you're aware, there are more white people working white-collar jobs, so maybe that's the reason, eh?

If those articles said that people were leaving because California wasn't "white enough" or whatever, I'd love to see them.

</comment></comment></comment></comment></comment></comment><comment><USER17> I think we've been through this recently: <http://news.ycombinator.com/item?id=732923>

(sent from the Sheraton Portland Airport)

</comment><comment><USER18> I am in Portland now and have been for the last nine years. I would say that pdx is a great place for startups if you are a hardware company and/or a venture related to Intel. Other than you will be hard pressed to find qualified SW engineers that are actually can write something else other than drivers. Then there are the occasional VB slackers or .NET potheads that do contract work.

</comment><comment><USER19> How are y'all dealing with the water? Is it an obnoxious drive to the beach?

<comment><USER20> The drive is fine, but it's not like anyone actually gets in the water once they get there. It's far too cold.

</comment></comment><comment><USER21> I drank the kool-aid. :) Goes great with the doughnuts.

</comment><comment><USER22> I like Portland a lot, but I'll assert that:

[X] is a great place for startups.

Where [X] = wherever you happen to be.

<comment><USER16> I disagree with that; as soon as you need one other person who is local, location does matter.

<comment><USER23> Also: as soon as you need funding, location does matter. In-person access to investment shouldn't be discounted.</comment></comment></comment>


Virtual Reality is a Fad - <AUTHOR> http://www.pigsdontfly.com/2016/03/virtual-reality-is-fad.html <comment><USER2> tl;dr This headline is clickbait. Early in the article, the author admits that VR is _not_ a fad:

> _No doubt, VR will have many uses. It 's fairly disruptive_

The article is really arguing that this particular generation of VR hardware is a fad, not that VR itself won't become mainstream.

<comment><USER3> The article can be read both ways (also saying that VR is a fad long term).

The fact that it admits that VR is "disruptive" and has "many uses" doesn't mean it's not a fad when it comes to the general population. Something that's trully useful in a lab or educational setting can still be a useless fad gadget people have bought for personal use.

<comment><USER2> That's still an assessment of VR _as it currently exists_ in current products. It's ludicrous to argue that VR as a whole (immersing someone in a believable, manufactured reality) is a fad. IMAX movies, video games, Second Life, and even role-playing are poor versions of VR that demonstrate that humans are striving toward it.

<comment><USER3> Are humans really taking to IMAX movies or Second Life -- or even Role Playing these days? I'd call those fads too.

</comment></comment></comment></comment><comment><USER4> Reality is a fad ;)</comment>


JQuery Shutters Plugin Site - <AUTHOR> http://plugins.jquery.com/

<comment><USER2> Let me give you a little background on this, I'm on the jQuery Board and a member of the core team.

A new jQuery plugins site isn't too far away. We should have a blog post up in the next few days with the details, I won't steal the thunder but the new site will discourage spam, promote plugins with higher quality, and provide a consistent way for users to report/discuss bugs.

> Wouldn't it be better to open the new plugin site then close the old one?

Yeah that was our goal. In cleaning up spam on the old site we got a bit overeager and decided it wouldn't make sense to leave the broken remains.

> It would be great for the end user and plugin authors if they (jquery.com) > curates the plugins themselves.

Most of us are volunteering our time to the jQuery project. If you are agreeable to the same pay scale, you can be one of us and help curate the new plugins site. Get your company to give you 20%-time.

<comment><USER3> I would volunteer to help curate the plugins. However, to be clear, I didn't necessarily mean manually curate them. You all can simply create a mechanism for the community to curate them (vote up/down, track number of downloads, reviews etc). When I said you all aka jquery.com, I simply meant that it will be controlled on your domain - not that you have to give more of your time.

With that being said, thank you for giving your time freely to help grow the community. I think I speak for most when I say, I appreciate it.

<comment><USER4> A site that has good curation of a large number of small, useful code snippets: <http://phpjs.org/>

</comment></comment></comment><comment><USER5> If I was to create a jQuery plugin site, I would make it a "shopping cart" system where you can pick and choose all the (curated) plugins you want and the site will package it all in a nice zip, provide you with a snippet of code to run it properly, and optionally give you a (paid) hosting of the customized code on a CDN. It could eventually have paid plugins available for further monetization.

<comment><USER6> I agree. When I wanted to make a new jQuery plugin site (until this post!), I planned on being able to view the plugin source online, like on GitHub. Aside from viewing the code and its quality immediately, it would also let us copy- paste plugins that are just one .js file. It's a bit bothersome to have a .zip in that case.

<comment><USER7> Actually, that is a great idea... why not just make a site that links everything to github? The plugin pages could just be github pages and downloads. Issue tracking? github. Pull requests. github. Makes perfect sense to me.

</comment></comment></comment><comment><USER8> I've been disappointed by the quality of many of the plugins listed on the site for a while. I often have to rely on plugins I have used before, read of on HN in the past, or ask other developers--rather than going to the plugins page. Granted the plugins I end up using are also in the list I would have seen, there is nothing separating them from the really bad ones.

I wonder if the number of bad plugins comes from the relatively small disparity between being able to use jQuery and writing a plugin. jQuery's whole premise is being an easy to use programming language. In other models (wordpress for example) the bottom 50% (or more, I don't know, I'm just making up numbers) of "administrators" would have no idea how to make a plugin. Verses the bottom 15% (again completely fake numbers, just for demonstration) of jQuery users may be unable to do so.

<comment><USER9> A jQuery 'plugin' can be written in one line... the level of functionality one might provide is much lower than the minimum functionality found in a WordPress plugin.

<comment><USER10> A WordPress plugin can be just one line too. There used to be a very popular one whose only job was to disable the WordPress filter that turned line breaks into paragraph tags.

        <?php remove_filter('the_content', 'wpautop'); ?>

<comment><USER9> Aha, good point. So there isn't really any skill difference between the minimum jQuery plugin and the minimum WordPress plugin.

<comment><USER8> Right, but my point was of the difference in disparity between the minimum plugin and minimum usage. To use jQuery is closer to creating a plugin than using wordpress is to creating a plugin.

<comment><USER9> Is that what you should be comparing, though? I think there's an impedance mismatch between WordPress and jQuery. WordPress is not seen primarily as a programming tool.

'Using' jQuery could mean visiting a website that employs jQuery which doesn't bring you any closer to writing anything. What we mean is people who program with jQuery, though.

The average WordPress user (say, an author or site owner) doesn't do any programming at all. A user who does do programming, like someone who customizes WordPress for people, could write one of these one line plugins. Ultimately it's comparing JavaScript to PHP, and I don't think one is more difficult.

</comment></comment></comment></comment></comment></comment><comment><USER3> Finally. It would be great for the end user and plugin authors if they (jquery.com) curates the plugins themselves. I'm sure a lot more exploration will happen on their site vs scouring the web. I know I've never relied on their old plugin site to find anything.

</comment><comment><USER11> Wouldn't it be better to open the new plugin site then close the old one?

<comment><USER12> I agree with this. Perhaps there was a technical or security reason for taking the current one down, but barring that, don't take away the old thing until there's a new thing to take its place.

</comment></comment><comment><USER13> I would rather they defer the handling of plugins to Github. The social features of Github makes it easy to evaluate what plugins are popular among respected developers. Github also encourages contribution to an existing plugin as opposed to creating two dozen plugins that all do the same thing.

</comment><comment><USER14> My preferred solution is Ender (<http://ender.no.de/>) and searching sites like GitHub.

</comment><comment><USER15> If I remember right, the jQuery plugins site was one of the only other open- source repositories powered by the Drupal Project module (drupal.org/project/project) besides drupal.org itself. I think that jQuery might even have been running the Drupal 5 version. The Project module, which they'd have to either fix or dig out of, is a massive chunk of code. Upgrading to Drupal 6 would be painful, and finding people who have the knowledge and desire to hack on the Drupal 5 version would probably be really tough.

</comment><comment><USER16> Please forgive me, but I'll use this post to ask a question I've been wondering for a while. Is it better to use a minified js/css of _all pages of the website_ or to make each pages as minimal as possible? For instance, if I use 4 jquery plugins on a splash page, 2 jquery plugins in the "signup" part and 5 other jquery plugins a little bit everywhere.. should I bundle all these plugins into one big .js, minified it and put it on the splash page so that it is cached?

<comment><USER17> It depends on how big it all is when it comes together.

For example, you'll have 7 plugins (and associated code that runs them) that won't be used at all on the splash screen. That's going to increase load-time when someone hits that page.

If someone hits a page direct and avoids the splash screen, it's not going to be cached in the first place so it'll all be loaded. Only this time they're loading 4 plugins and the related code that won't even be used.

IMO you should compress what's needed for each page. Several smaller downloads is often better than one large download, and you shouldn't be relying on a user's cache to gauge your own site's performance. If you're not going to use it, don't include it.

</comment></comment><comment><USER18> I believe this is a good thing. I jQuery daily, and when searching for a plugin lately I would avoid the plugins site when it came up in search results. It was outdated and the stuff in there isn't generally well maintained. I was glad to hear about a new plugin site coming (it was announced at jqcon in Oct I believe) and see this as a positive move towards that being live.

</comment><comment><USER19> What's the advantage of shuttering a site over just leaving the existing site running and developing a new one behind the scenes?

<comment><USER20> Getting a bad reputation from the spam it has been encountering apparently.

<comment><USER21> Good move. Reputation is far more important than people getting easy access to useful tools.

Don't get me wrong - it's their fair right to shut down a site they own. It's just highlighting a particular set of priorities they seem to have.

<comment><USER22> Think of it this way: what if someone new to jQuery (although jQuery is almost like a household name to us, there are a lot of people new to web development) wanted some plugins? They would look at the page on the jQuery web site, and they would see spam. This is bad for new users, and especially bad for the jQuery community as a whole if they wind up using buggy or outdated plugins. By contrast, an experienced person who's already been using jQuery is probably just going to go on Github or do their own searching. There's no tangible benefit to keeping it around.

The question you really have to ask: how useful is the plugin page? From my experience, it's pretty useless. A newbie will find most of the widgets they need (with high-quality code) in the jQuery UI/Mobile projects, and there are tons of authoritative blog posts if they do a little bit of searching.

</comment></comment></comment></comment><comment><USER23> Maybe a third-party curated site like rubygems.org would be better.

</comment><comment><USER24> This certainly is interesting timing. I've been dissatisfied with plugins.jquery.com for quite a while. Earlier this year, I began development of an entirely new site for hosting javascript packages (including but not limited to jquery plugins (after all, jquery plugins are nothing but normal javascript code with a dependency on jquery)).

As of last week, that site is finally up and ready for beta. I was planning on announcing it this week or next.

If anyone here on HN has a jquery plugin or any other opensource javascript library or framework, and would like to give some feedback, please let me know via twitter or email (see my HN profile for both). The more people that can test it out privately, the better I'll feel launching it :-)

EDIT: Also, I plan on completely open-sourcing the site itself, like Github has done, once the site is launched.

</comment><comment><USER25> Misleading headline, it is only temporarily closed.

I assume it was effecting their Google rank, otherwise they would have left the old one open.

<comment><USER26> It's not misleading; it says 'shutters' not 'shut'. As in how you'd close a shop overnight by pulling the shutters down..

<comment><USER27> Not only that, but the linked to page also says "shutters."

</comment></comment></comment><comment><USER28> +!

</comment><comment><USER29> Although WordPress' repo uses SVN (I prefer Git), it runs really smoothly. Something like that would be great for jQuery, but you wouldn't need the whole update feature set.</comment>


Quotes collected by Terence Tao - <AUTHOR> http://www.math.ucla.edu/~tao/quotes.html <comment><USER2> It's missing some aalewis.</comment>