YC Reject - We've been offered an investment to fund our Summer 2011 class - <AUTHOR> http://www.ycreject.com/2011/04/yc-reject-has-been-approached-with.html

<comment><USER2> I was amazed by how motivated I became by being involved in the "November Startup Sprint" back in the fall so I think a more formal program could potentially be pretty cool. I'd move away from being a "YC Reject" program to a "Hacker News Startup Co-op".

I would open it up after interviews so that those who got interviews but don't get accepted can participate.

Accomodate all groups who want to participate and don't mess with the financing at this point. The financing talk gives me kind of a "no" feeling.

Have your weekly dinners and get speakers.

Have a web site where YCR startups can promote their projects.

Schedule and hold a Demo Day. I bet you'd be able to get a few investors to drop by or else watch the videos that will go up on the YCR web site.

By banding together, I think everyone will have a really productive 3 months, get to know alot of like-minded individuals, and have a decent shot at attracting some investor interest.

I live in Ireland and wouldn't be able to participate but I think it's a great idea.

<comment><USER3> _I'd move away from being a "YC Reject" program to a "Hacker News Startup Co- op"._

How about "Peer-to-peer Startups"?

</comment></comment><comment><USER4> There was an article a month or two ago about the problems with tech accelerators gaining popularity.

I can't find the link but it basically said the accelerator bubble is going to happen when the secondary groups get the 'B' talent startups, and then the next groups get the 'C' talent...

While I have no idea about the quality of YC Reject groups, this does kinda have that same feel to it.

<comment> brown9-2 A group of "B" talent or "C" talent startups get funded - so what?

The only people who lose out are the investors, who have plenty of chance to evaluate their investment before making a decision (I imagine), so they can only blame themselves for making a bad investment.

<comment><USER5> Seconded. The economics probably make sense even if 90% are "Cs." One or two winners per batch is enough given the relatively small investment for the relatively large stake. Keep in mind that these investments typically result in an initial valuation of somewhere around $300 - $500k. 6% of something that size for relatively low cost makes room for quite a few losers. My only advice is to make sure that there's a lot of focus on getting great advisors and mentors for the program. That piece is easily as important as the funding.

</comment></comment></comment><comment><USER6> I have a name for it (I love naming things):

ReCombinated

<comment><USER7> My name suggestion: ZCombinator (one more than Y)

</comment></comment><comment><USER8> I've never been accepted into YC so this may be totally wrong, but ...

Don't lose sight of the real value in this for a group trying to create their own startup - the mentorship, fraternity, alumni network, initial amount of funding and then finally the demo day presentations which will result in a lot of visibility. Not to mention, at this point in time, the YC brand stamp. I know you have to start somewhere, but I don't think starting with investors is the right move. It won't be difficult to find people willing to invest, as you've already experienced (they came to you). You need to start by trying to provide the startups with the things they can't get on their own - mentorship, fraternity, etc. I have gone through my own adventures of pitching my ideas to VCs, while being completely uneducated about it and green, and I can say it's not difficult to get money from them - so you will be able to get it when its required. At least for me, the money is not really the appeal of YC.

I think dclaysmith says it well here: <http://news.ycombinator.com/item?id=2432040>

</comment><comment><USER4> Crazy stuff. Can you imagine the analog in other professions?

"I got rejected from Harvard Law School. So I got a couple of my fellow applicants together and decided to study law together for 3 years, sans professors. We all just got 6 figure offers from the big firms on Wall Street."

<comment><USER9> Here is a list of companies that didn't go through YCombinator and did pretty well: Microsoft, Google, Facebook, Cisco, Amazon.

So I think the 'sans professors' thing is a bit unfair.

<comment><USER4> And Abraham Lincoln went 'sans professors'.

I didn't mean to bash. I merely meant to accentuate how unique the situation/industry is.

</comment></comment></comment><comment><USER10> I know it's been said over and over but why don't all these YC and now YC rejects just get on with it. Build their products, start their businesses and make some money. Why the obsession with being a YC'er and now a not-a-YC'er. Can't they see the whole thing is just a distraction from their already difficult task?! nikcub hit the nail on the head with his comment, it's just a shame YC doesn't lend itself to a plithy title such as "Boo Hoo" (en.wikipedia.org/wiki/Boo.com).

<comment><USER11> Well having a support group and something structured like weekly meetups to drive the startup forward week to week seems like a good thing to me. I don't think it's so much a YC obsession but an obsession with giving a startup the best possible chance to succeed.

</comment></comment><comment><USER12> in ten years time when the social software era zeitgeist is written it will definitely mention 'and even a YC reject group was funded'

<comment><USER13> Bar Camps began as an alternative to O'Reilly's Foo Camp, for those who weren't invited. Now there are barcamps almost every weekend, in a dozen or more countries.

If nothing else, the rejects (always) have force of numbers on their side.

<comment><USER12> I don't have a problem with it at all, it is interesting and unusual

He put so much effort and determination into this 'not-YC' that he probably would have been funded anyway

Being rejected from YC will probably end up being the best thing that has ever happen to him

</comment></comment></comment><comment><USER14> This is one of the crazy things I've come across - one moment there's a call for YC rejects to hang out together, next day there's cash for equity! Since this is an experiment maybe it would help to keep it simple in the original form and leave investment out of it till the end of summer?

<comment><AUTHOR> What about the quality of the applicants? Will the better candidates not bother with this project since no money is involved?

<comment><USER14> It would be interesting to diff the original applications and those after the money announcement to gauge the interest and quality. I think quality startups will want to reach a certain level (prototype, proof of concept) and then money will find them. The blanket offer for investment without knowing the startups or prior relationships is a bit too good to be true?

</comment></comment></comment><comment><USER15> At this point though, if we're taking PG & co's rankings of applications, the top 10% of YC applicants are still in the interview phase - if I were the OP I would want to wait until after the class gets announced, right?

</comment><comment><USER16> From who? That seems pretty important.

<comment><AUTHOR> For purposes of full disclosure, I was approached by an individual angel and I sat down with the investor for a meet and great. The selection process needs to be sorted out and the term sheets need to be agreed upon by all parties before it's finalized and a check is written.

The reason I posted this blog, is because I want to get candidate feedback. The money involved in YC is just a small (but helpful part) of what they do. Will teams that participate in this grassroots project want to give up 6% of their company? What are your thoughts?

<comment><USER17> The money was a very small part of YC's appeal for me. Access to the mentors and other human capital was the real draw. I can't see giving up 6% of my company if the program doesn't offer human capital similar to YC's.

</comment></comment></comment><comment><USER18> Someone should get started on the 'YC Reject Reject' fund.

</comment><comment><USER19> The thing is, with YC you get except the 20 grand or whatever it is, the advice from pg and others, and the alumni network, which is both worth something.

<comment><AUTHOR> With 40-50 groups now your time spent with him as a YC'er is significantly less. He's added staff, but scaling out his time is a big problem. Plus with the 40-50 groups - I can only imagine that the demo days are a complete circus. Will angels continue to invest their money in what essentially has become a meat market? If I were to invest my money on a high-risk venture I'd like to get a little T.L.C.

<comment><USER20> The last YC batch was the smallest in a while (I believe it was well under 20). I don't believe they've continued to grow the size of the batches. I'd be shocked if they ever grow to 40-50 groups. That many wouldn't fit in the YC office for the dinners. Where are you getting this "40-50 groups" number from?

"Will angels continue to invest their money in what essentially has become a meat market?"

The evidence seems to indicate that the answer is "yes".

"If I were to invest my money on a high-risk venture I'd like to get a little T.L.C."

Personally, if I were an investor, I'd rather get a little R.O.I.

<comment><USER21> The last batch had 43 groups (see ycombinator.com).

<comment><USER20> Wow. That's too many.

<comment><USER22> Actually, it's a bit more than 43.

I think alumni will always think the subsequent batches are too many.

</comment></comment></comment></comment></comment></comment><comment><USER9> "We're like YC but better!" has "sour grapes" written all over it. If it's that much better, why did you bother applying to YC in the first place?

Also, on a lighter note, will there now be a ycrejectrejects project/site?

<comment><USER23> YC came out of an unmet need as well, VCs not finding at the seed stage.

<comment><USER9> What's that got to do with anything? My point was that by defining themselves in terms of "not ycombinator" it doesn't look good.

I'd much rather read about an "independent, peer-based company building support group" or something like that.

<comment><USER23> They haven't defined anything yet, this is just the first few days, everything is up for adjustment, not getting in YC is driving them, if this works it will have to change to work as you're suggesting.

</comment></comment></comment></comment><comment><USER24> The original idea had something special and different. Now this is really just another accelerator.

<comment><AUTHOR> The money is only a small part of it. It's really there to make sure you can focus on your project and not worry about putting food on your plate or making rent. The money was put on the table, but I'd like to get feedback to know if it's something that interested teams would want in exchange for equity.

<comment><USER25> The money to me was important as well as everything else YC offered. I wouldn't have applied otherwise. I can't afford to build my business without the seed money at this point. So it's either find a job, go back to school and/or look for funding elsewhere.

</comment></comment></comment><comment><USER26> If YC Reject groups get similar funding, this might be a good way to empirically test whether either Y-Combinator succeeds at choosing more capable groups or Y-Combinator offers advantages over other accelerators.

<comment><USER17> I wish I could agree, but I do not. There are way too many variables. To even get close to making a valid test you'd need to run the same startups through different accelerators at exactly the same time.

<comment><USER27> I guess it is more a test of how the money affects the startup vs. the mentorship/network.

</comment></comment></comment><comment><USER28> My initial thought is to leave investment/equity out of the program and stick to the original vision. There are dozens of established incubator programs that have a reputation and history of performance.

</comment><comment><USER29> Accepted applicants articulated their idea & company better than non-accepted applicatns as per YC scale. If you aren't accepted by YC, shouldn't it be same as getting rejected from a VC?. In most cases VCs are investing in companies that are rejected by other VCs. How one perceives opportunities for an idea/investment, is very subjective. YC and YC Reject will not be same even though offer is similar ($12,000-20,000 for about 6% of the company).

</comment><comment><USER30> WoW.....I don't want to say bubble....but this sure seems like some sort of frenzy.

Kudos to you for taking the initiative and doing what you need to do...and for siezing what could potentially be an amazing opportunity.

I hope it doesn't turn out to be a fad, and something sustainable can be built here.

</comment><comment><USER30> YC Reject could turn out to be an interesting development just based on the way YC does self-selects for a 50/50 success ratio.

See more here: <http://news.ycombinator.com/item?id=2431712>

</comment><comment><USER31> I was going to try something similar a while back. Perhaps a different persons perspective on a similar idea will stimulate your mind: <http://news.ycombinator.com/item?id=925134>

</comment><comment><USER32> This is an invitation for a trademark infringement lawsuit.

</comment><comment><USER33> Where's the accompanying news.arc?

</comment><comment><USER34> This is insane and hilarious, as well as a great initiative.

</comment><comment><USER23> Could this be a scheme to look at everybody's applications? Why would the angel not directly go to YC demo day or ask them for the reject list? When desperate it is easy to lose sight of what is plausible.

Please don't get me wrong, I am not calling you a liar, but this is just healthy skepticism. If I were to ever go along with this I would need to see some written proof.

If you have actually done this you're doing a great service to a lot of people.

<comment><AUTHOR> That's a fair question. Without knowing me, it's hard to gauge my integrity. If you have any questions, I'll be happy to speak with you.

<comment><USER23> Thanks for keeping an open mind! :)</comment></comment></comment>


Sources at Washington Post during Bezos announcement: 'It was like a funeral' - <AUTHOR> http://www.theverge.com/2013/8/5/4592674/sources-at-washington-post-bezos-announcement-like-a-funeral

<comment><USER2> Are there any good stories from workers at Amazon? Conditions, pay etc? I hear lots of bad ones, but given how big Amazon is, there must be good ones too?</comment>


Leaving Apple and Google: My Eelo Odyssey. Bootstrap on Kickstarter - <AUTHOR> https://hackernoon.com/leaving-apple-and-google-my-eelo-odyssey-bootstrap-3ad0d763226f <comment><USER2> Dude - don't bother! And don't get me wrong, I would love to see you succeed and prove me wrong - but the chances of success in this are like the proverbial "ice cube's chances in hell" \- there's so many obstacles to success - regroup and solve a solvable problem... 1) yes there are a few privacy zealots, and they may care, but consumers do not - they will talk a mean streak about the importance of privacy but give it up in a second for any bit of freebie or customization (I know having worked on the PrivacyFix app - look it up) 2) The ecosystems are against you. No developer wants to write to and support their app on some obscure platform with a handful of users. Hackers may target your users just as a lark and to make press for hacking your unhardened app eco-system 3) Data storage is not free, and won't be. Users will upload troves of garbage photos and data and expect you to maintain it in perpetuity - that will not be free 4) Read up on asian hardware relationships - even if you get a few million dollars and spend all of it on a handset OEM - you'll need to be there on the ground every step of the production run and you'll probably get nothing but the crap that no reputable brand would take 5) and on security; why do you think that your team will be able to build and maintain a secure device and infrastructure? HomeDepot, Target, Experian, the NSA - have all had leaks and breaches - why would someone trust three guys working remote to do better at this than a meg corporation or the government? * that's just the tip of the iceberg; not trying to be harsh - just don't want to see you waste a lot of time and crowd- sourced money on something with so little prospects of success</comment>


Why whooping cough is making a comeback - <AUTHOR> https://www.ajc.com/lifestyles/health/why-whooping-cough-making-comeback/ <comment><USER2> Returning 404.

This seems to work:

[https://www.ajc.com/lifestyles/health/why-whooping-cough- mak...](https://www.ajc.com/lifestyles/health/why-whooping-cough-making- comeback/Hgvm5041UvCPfSZa9fp4tM/)</comment>


Negativland – Don't Don't Get Freaked Out (Feat. Eliza) - <AUTHOR> https://www.youtube.com/watch?v=StFY_SG9wlk <comment><USER2> Negativland famously fought a fair use case after they released an EP called "U2". The way the cover was put together, people thought that it was a release called "Negativland" by the band "U2". They wrote a book about it: [https://www.goodreads.com/book/show/387495.Fair_Use_](https://www.goodreads.com/book/show/387495.Fair_Use_)

Also, their albums are pretty wild. They are basically the audio version of Adbusters. I'd recommend the album "Dispepsi" to anyone who wants to poke fun at corporatism and has an interest in experimental music.

</comment><comment><AUTHOR> Possibly related to the song they release last year, "More Data"[1]? Both songs use the same "Meeeeeee..." sample, and they have complimentary topics.

[1] [https://www.youtube.com/watch?v=sTWD0j4tec4](https://www.youtube.com/watch?v=sTWD0j4tec4)</comment>


The Postal Service May Be Headed the Way of the Pony Express - <AUTHOR> http://www.nytimes.com/2009/08/08/business/08nocera.html?ref=business <comment><USER2> Protected content. Needs login & registration.

<comment><USER3> The NYtimes link? It worked fine for me. I was linked straight to the article.</comment></comment>


Ask HN: Redo of OwnerBuilderBook.com after 10 years - <AUTHOR> https://www.ownerbuilderbook.com

<comment><AUTHOR> Hello, we have been working on a redo of OwnerBuilderBook.com (website and community for "The Owner-Builder Book"). The site has been around since 1997 and was in desperate need of an update - the last time the layout was substantially changed was in the early 2000's. Here is a wayback link that shows the old sight for comparison: [https://web.archive.org/web/20120328175741/http://www.ownerb...](https://web.archive.org/web/20120328175741/http://www.ownerbuilderbook.com/)

Please let me know what you think.</comment>


This never worked out – should I just dump the source on GitHub? What license? - <AUTHOR> http://www.flightdeckapp.com/users/login

<comment><USER2> I can't seem to find any description of the service it provides anywhere on the site. I had to find the twitter account to even know what it does:

        Easy database backends with powerful analytics
        for your mobile, game or web development.

But to answer your questions:

1) sure why not.

2) MIT

<comment><AUTHOR> Ya. So that description fit the pivot... (I should probably write a blog post)

Basically it was sort of like a rough SharePoint written in Ruby - you can make lists, set up columns, make views, set permissions..

I'll put it up with MIT - thanks for the feedback!</comment></comment>


Evolving JavaScript with TypeScript - <AUTHOR> https://youtube.com/watch?v=Ut694dsIa8w

<comment><USER2> I stopped watching when the guy claims JavaScript has no classes (and no modules).

JavaScript has prototypes, which are more powerful than classes, and therefore allow you to emulate classes.

In ES6, a traditional syntax for classes was introduced, for people who don't want to learn how JavaScript works. Also modules were standardized, but people have been using modular JavaScript for ages.

I thought Google Talks were good... :-/</comment>


AWS bastions and assume-role - <AUTHOR> https://engineering.coinbase.com/you-need-more-than-one-aws-account-aws-bastions-and-assume-role-23946c6dfde3 <comment><USER2> Also take a look at aws-vault [1]. This not only assumes roles but also helps you store your original credentials in an encrypted form rather than a plain text ~/.aws/credentials file. You do have to configure all assumed roles in ~/.aws/config

They have an exec command but you can also export your credentials to env variables with somethings like

        aws-vault exec "$AWS_PROFILE" -- env | egrep '^AWS' | awk '{print "export " $1}'

[1] [https://github.com/99designs/aws-vault](https://github.com/99designs/aws- vault)

<comment><USER3> This is the best tool I've found so far to manage profiles securely and switching roles between the ~35 accounts im working with right now.

<comment><USER4> I'm about to evaluate it for my needs. Do you run into any issues with the temporary tokens expiring, e.g., with developers working locally on a web app over a period of a couple hours?

<comment><USER3> Not really. Its quite straight forward and really just makes it easier to store your creds (on any platform) securely, and enables you to switch roles via profiles in your ~/.aws/config.

One thing I would point out is that by default it will timeout the session in 4h and the role in 15m. This means that every 15m you will need to exit your bash shell that aws-vault exec created, or replace the env vars you generated. Set the two env vars for session and role ttl to your desired values in your bash profile to avoid setting them on the cli on every invocation.

You just want to look at this file, as the env vars are not documented. [https://github.com/99designs/aws- vault/blob/4acbb48b48b90555...](https://github.com/99designs/aws- vault/blob/4acbb48b48b905553024331408f890f7c18dd517/cli/exec.go#L43)

<comment><USER4> Appreciate the link. Until now, I've used aws-vault with the `exec` command to run CLI tools with a quick return, so the role TTL isn't much of an issue.

I'd like to employ the tool to support local development on a containerized web application. The assume role TTL may prove to be the real issue, so I need to weight the tradeoff of allowing a longer life on the STS keys. I suppose I could set up a profile without a role and override the AWS_PROFILE environment variable within docker-compose. And I know that aws-vault also supports the virtual meta-data service.

Either way, the benefit of something like aws-vault extends beyond security. We've discovered numerous inconsistencies with the profile-based credential handlers in the Java API ([https://github.com/aws/aws-sdk- java/issues/803](https://github.com/aws/aws-sdk-java/issues/803)) which beg for a simpler solution in terms of supporting developers.

</comment></comment></comment></comment></comment><comment><USER5> I know of no service that is more complex and off putting to newbies than AWS. I mean, wait, I need multiple accounts? Getting my team access to the one account we have took me 3 hours already!

No wait, I need a _design pattern_ for how to manage accounts of a SaaS service?

I'm probably not the target audience here but I strongly get the impression that these patterns would not be necessary if AWS would get their shit together in terms of AWS Console UX design.

<comment><USER6> AWS is not for newbies, they released a paired-down version: [https://amazonlightsail.com/](https://amazonlightsail.com/)

<comment><USER7> AWS is totally for newbies, so long as you aren't afraid of performing sysadmin work.

You don't need to have some zany serverless infrastructure. The overhead in setting it up isn't worth the trouble.

<comment><USER8> Sure you can use AWS as newbie but I wonder how much money you burn because of not clicking one checkbox.

<comment><USER7> Checkboxes can be tricky! Why, I unmounted several local volumes when adding a Windows server to a failover cluster just last month...

</comment></comment></comment></comment></comment><comment><USER9> In Google Cloud, something like this is mostly unnecessary. The project model scopes resources to a particular project within an organisation, rather than all resources being global to the account. This gives a really good first cut at isolating different environments and projects.

<comment><USER10> This goes beyond just prod/staging. It allows you to easily manage fine- grained roles down to e.g. particular microservices and also control how users can access those resources as minimally as is necessary.

So you can recreate the project-model here, and also refine it beyond that.

</comment></comment><comment><USER11> I like AWS multiple accounts support it helps securing specific environments, but I don't like that going this route increases the cost.

Here are some things I don't like:

1\. if you want to use AWS support, you need to purchase it per account, otherwise support will refuse any help that involves anything specific to the account (they will only respond with generic documents)

2\. with separate account you need to recreate the same components (and therefore pay more) for example if you want internet access on your VPC over IPv4, you need to set up a NAT instance per account, you can't for example use VPC peering and use NAT instance on another account

3\. you are being charged for any data going between accounts even if same AZ is used. Yes, I understand that one can't easily tell which AZ is which across accounts since they are randomized per account but still...

<comment><USER12> If you use the same billing account I'm pretty sure 1 is not true. I only know at higher support levels though it is not a problem for sure.

<comment><USER11> Well, I don't have access to the root account to see if these accounts are under the same billing account (but best of my knowledge it is), and the support we purchased is Business.

When I had question related to one of account I was told that I will need to open a support ticket on that account, but I couldn't open because they had basic support.

We contacted our TAM and he just shrugged. If this is true that would be great.

Edit: I checked and looks like our account are consolidated until single master one, although we did not purchase support for the master account since nothing is running on it. If there is a way to not have to purchase separate support I would like to know since it could save some money.

</comment></comment></comment><comment><USER13> Great article and nice tool. Switching role and profile with multiple organizations is indeed cumbersome with AWS.

We are also developing an open source CLI for AWS named awless (cf. [https://github.com/wallix/awless](https://github.com/wallix/awless)). We currently support easy MFA, profile switch and role assuming in CLI with the '-p' flag and are working on extending these features to support multiple organizations. We had multiple issues filed on GitHub which are closely related to this.

</comment><comment><USER14> 2018 Hottest AWS Job Postings:

      - Identity-Access-Management Manager
      - Pricing Oracle
      - Sysadmin we fired when Moving To The Cloud(tm)

</comment><comment><USER15> Poor choice of name, as the term "bastion" is already commonly used in AWS to describe a bastion host for a VPC.

<comment><USER16> That's exactly the reason for this naming choice.

</comment></comment><comment><USER17> Now that I'm comfortable with the IAM side of things, I will always use multiple accounts. I'm also beginning to think it's valuable to not even limit yourself to a single account per environment. Tools like Terraform become essential, though.

I've written about using multiple accounts in combination with CodePipeline to manage Lambda deployments here: [https://medium.com/statics-and- dynamics/automated-lambda-dep...](https://medium.com/statics-and- dynamics/automated-lambda-deployments-with-terraform- codepipeline-a4d2a2019eae)

</comment><comment><USER18> Like everyone else, I also wrote a CLI login util in GoLang for multiple AWS account with this "bastion/main" account setup: [https://github.com/lencap/awslogin](https://github.com/lencap/awslogin) . Simplicity is the main driver. I welcome constructive input.

<comment><USER19> This is nice, but having the ability to get prompted for all the authorized roles for a user in an account is nice, as is done by the aws-login node app.

</comment></comment><comment><USER20> We took this approach at 99designs with aws-vault and bastion accounts: [https://99designs.com.au/tech-blog/blog/2015/10/26/aws- vault...](https://99designs.com.au/tech-blog/blog/2015/10/26/aws-vault/)

</comment><comment><USER21> Very well written article with some good advice. We found very early on the need for multiple AWS accounts and managing varying levels of access to all of them has been challenging.

I also recommend looking into using SAML with your own login provider, if you have one, to assume individual roles in AWS accounts.

<comment><USER22> Would you mind describing your needs? I read the article and I still don't fully understand the need for multiple accounts -- seems the article is more about the tool. I would understand the need when it comes to API rate limiting, but I have never ran across this on a million+ session/day website.

</comment></comment><comment><USER23> Cool! We do the same but we call it root account instead of bastion account, since bastion is an overloaded term in the AWS universe.

<comment><USER24> We call ours the "hub" account, since we picture the relationships between our accounts as a hub-and-spoke model.

"Root account" is also a bit misleading, because the root user is the initial non-IAM login associated with the account ([http://docs.aws.amazon.com/IAM/latest/UserGuide/id_root- user...](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html)).

<comment><AUTHOR> I think naming things is difficult, and the best name for a thing is the most meaningful to you and your company.

</comment></comment></comment><comment><USER25> This is what we do. Each product has it's own prod and qa account.

</comment><comment><USER26> Unless I'm missing something, isn't this whole process made a lot simpler just by using STS?

It also works incredibly well with Vault's STS backend.

<comment><USER10> Isn't STS exactly what the article is describing? This is just an sts usage pattern

</comment></comment><comment><USER27> As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly.

Edit - Getting downvoted a lot.

Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure.

Best practice is defence in depth.

That means you secure everything including your implementation details.

If a zero day is found in any of their stack, they're a google search away from being found for that.

<comment><USER28> Good security doesn't require obscurity.

<comment><USER29> what then is an 'information disclosure vulnerability'?

<comment><USER30> It's not what you think. It's more about disclosing business-related data or metadata (e.g. customer names, last time a customer logged in) than technical information (e.g. internal service names, minor debug information).</comment></comment></comment></comment>


Creating a Web Development Newspaper. Thoughts? - <AUTHOR>

A little over a year ago, I had the idea of working toward creating a publication for web developers, written by the designers / developers themselves. I quite fancied the idea of making it newspaper based, given it was possible through newspaperclub in the UK at the time.
I had a little amount of buzz regarding it, through local communities and some friends but ultimately no one stepped up to create articles for it. That's how it's remained since.
I still have a passion for the idea and was wondering if any HN'ers would like to shed their thoughts - would you purchase a newspaper on this theme? Is HN all you'll ever need? Would you be interested in submitting an article if things were to start moving?
webpap.com <comment><USER2> Sorry for being a buzz killer, but I think an old fashioned newspaper about Web Development is as good as a telegraph transmission about a phone conversation.

I do follow Web Design/Development publications such as A List Apart, and I often find myself copying and pasting code, or going back to them through google. This is something I can't do in a newspaper. Also, most online web-dev stuff is top notch and free, it would be difficult competing against that.

</comment><comment><USER3> The question is what will this newspaper do that HN doesn't. Perhaps an approach would be creating a friendly and attention grabbing wrapper for HN, one that shows "trending" stories and popular comments to greater effect. Positioning questions and showcases in their own spot to maximise interest.

Also bear in mind who you're making this for. The developer mindset may require page efficiency (size of text, number of features), while designers may value page effectiveness (pictures, layout).

<comment><USER4> I'd have to agree with everyone else on here that this probably wouldn't take off. Specifically with services like Flipbook coming out I don't see how even writing a HN wrapper would give you a real advantage.

<comment><USER5> Hacker Monthly is basically an HN wrapper, and seems to be doing well - 5,000 subscribers as of a few months ago[2].

[1] <http://hackermonthly.com/> [2] <http://news.ycombinator.com/item?id=2445314>

</comment></comment></comment><comment><USER6> I would be interested in submitting an article but not paying for it. I think it's an interesting idea and would allow developers to show case their talents. On the other hand, it's probably hard to draw people away from HN

</comment><comment><USER7> I follow the .net publications out of the UK (Future Publishing). They are gorgeously produced magazines and CDs, have full digital archives, are prohibitively expensive and worth every penny!

</comment><comment><USER8> I like the idea but the only way I would pay for it is if it provided some amount of value that I couldn't get elsewhere. I like reading online.

</comment><comment><USER9> Why a newspaper? Why not a blog?

<comment><AUTHOR> I guess my reason is selfish. I prefer to read this way. I find content I read in print tends to have more of an impact on me when I can take it away and properly absorb it.</comment></comment>


More Patent Nonesense - <AUTHOR> http://www.avc.com/a_vc/2010/02/more-patent-nonsense.html <comment><USER2> Disclaimers: I haven't read the patent in question, I work for facebook, and therefor know some of the engineers whose patent we're discussing..

Most eye-rolling at patents never get past the title. This betrays a misunderstanding about what a patent is. Putting it in terms that are more readily accessible to engineers, a patent's title describes the problem to be solved; the USPTO, on the other hand, grants a patent to confer rights on that problem's _solution_. If I titled my patent "System and method for offline sorting", and armies of bloggers started scoffing, "Offline sorting! That's been around since the 1950's!", they would be missing the point. The relevant question is whether _my_ offline sorting technology is sufficiently novel and non-obvious.

Applying this to facebook, "System and method for a social news feed" or whatever is not the same thing as "having a patent on a news feed." The patent is on the combination of techniques and systems that facebook in particular contrived to deliver a newsfeed. It could still be the case that this is insufficiently innovative, but the discussion is not as simple as pulling up another example of a news feed and closing the case.

</comment><comment><USER3> imagine where facebook would be today if someone had patented 'social network'.</comment>


User loses 1400 BTC to malicious Electrum node - <AUTHOR> https://github.com/spesmilo/electrum/issues/5072#issuecomment-683356052 <comment><USER2> The answer seems to say: "Because there exists least some user errors that the software cannot guard against, guarding against this class of error isn't worthwhile".

My bank manages to block a lot of phishing. If Electrum doesn't, does that make Electrum better or worse than fiat-currency banks?

</comment><comment><USER3> This is why you shouldn't use a lightweight wallet and should use the official wallet, or at least host a full node.</comment>


A Criminal Gang Used a Drone Swarm to Obstruct an FBI Hostage Raid - <AUTHOR> https://www.defenseone.com/technology/2018/05/criminal-gang-used-drone-swarm-obstruct-fbi-raid/147956/?oref=d-topstory <comment><USER2> > Mazel said counter surveillance of law enforcement agents is the fastest- > growing way that organized criminals are using drones.

Why do I have a feeling this was one of a few rare times the FBI has encountered drones during a raid?

CI/law enforcement people love to exaggerate high-technology threats... just like phone encryption a few years back when they already had workarounds for many years, it only became a problem when it became widespread. The only difference is they want solutions to be cheap and inexpensive so they always have a power edge. The fact obvious solutions exist doesn't matter, they want to be the only ones with that power and they want complete access to that advantage, regardless of the progress of (consumer) technology.

All this translates to me is a) some high paid consultants selling threat solutions b) overblown media headlines or c) scare tactics to regulate technology pre-emptively when it's not really a significant problem.

They should be accepting this as a reality of society and technology and adapt their surveillance tactics against high-value targets. Instead of trying to punish regular people for using the technology, as is typically the case.

</comment><comment><USER3> [https://news.ycombinator.com/item?id=16992058](https://news.ycombinator.com/item?id=16992058)

140+ comments</comment>


Design for Failure: Processing Payments with a Background Worker - <AUTHOR> https://www.petekeen.net/design-for-failure-processing-payments-with-a-background-worker

<comment><USER2> > Your page will poll /transactions/<id> until the transaction ends in either > success or failure.

If you do something like this you need to make sure to verify that the user actually created the transaction. Blindly loading it by id and returning it back would let any user check on any transaction. Plus it's particularly easy if the ids are sequence numbers.

</comment><comment><USER3> I recently implemented something similar to this and it works fantastically well.

In my case I use pcntl_fork() in PHP to split off a job to communicate with the payment gateway.

The parent process returns a hash to the client.

The client then polls with this hash. The child process communicating with the bank will put the bank's response onto a beanstalkd tube named using this hash.

</comment><comment><USER4> Isn't this code just adding a single retry? What if it fails after that?

EDIT: Also, is it really a good idea to poll every 500ms? Why not use long polling?

<comment><USER5> It does not do a retry. It runs in the background to present the user with immediate feedback. Seeing a "processing" page with a "spinner" animation for 30 seconds is much better than the browser waiting on the server for 30 seconds.

RE EDIT: From the article: "Typically, this completes almost immediately.". A 500ms poll isn't really a problem when for most people it will return success on the first poll.

<comment><USER4> So ruby isn't a primary language form me, but doesn't the tx.save in the rescue block cause a retry?

Also the 500ms poll looks like it is coming from the client - that definitely seems like a no-no. You'd hit the server 60 times over a 30 second back-end timeout.

The worst time to ratchet up load on your server is when your back-end is having issues.

<comment><USER5> Not quite. `txn.save!` just writes the data to the database. The call to do the actual processing happens earlier, on the line beginning with `charge = Stripe::Charge.create(`.

RE the poll: I tend to do doubling polls for stuff like this (500ms, 1s, 2s, 4s, 8s, etc), but in this case I don't think it matters, since all the server does is one database lookup and render as json.

Side note to OP: It seems like a bad idea to use the auto-incremented id as a key for polling, since it would allow an attacker to get full details of all transactions.

<comment><AUTHOR> Yep, you're right. The book[1] has a much more fleshed out version of this example that uses a random guid as the key, plus a whole lot more.

[1]: [https://www.petekeen.net/mastering-modern- payments](https://www.petekeen.net/mastering-modern-payments)</comment></comment></comment></comment></comment>


CSS is for design, HTML is for content - CSS Zen Garden - <AUTHOR> http://www.csszengarden.com/

<comment><USER2> Seriously? I guess you missed the memo over 6 years ago?

<comment><AUTHOR> Perhaps a bad choice of title. Although I know that inline styles are bad, I still find myself using them in my own projects out of laziness, and I thought it was cool to see an example of what is possible when style and content are kept totally seperate.

<comment><USER2> Hey, I completely understand. The site is great, and I've used it to demonstrate this point to unenlightened coworkers... but I was expecting actual news about this ancient and hallowed site, not just a repost 8)</comment></comment></comment>


Google is using a phone number provided for "security" purposes to telemarket - <AUTHOR> I just received a call from a "google specialist," also known as a telerobot, marketing google's advertising services to me on a number I provided as a way to retrieve my password. Don't they have a   moral obligation to separate these two activities or is their security procedure just a thinly disguised way to gather information for marketing purposes? <comment><USER2> It's not Google that called you. They don't do robocalls, not for any program in any department. The callers are independent SEO/SEM companies, and a well known scam. I get these calls too, 2-3 times a week, and they come in on a phone number I don't use, not the one I've given to Google for my accounts.

Google "Google Specialist" and you'll find hundreds and hundreds of people talking about the calls, as well as Google ads above the results with the headline "Google Never Robocalls - Report Suspicious Calls". The ad links you to the Report Google Robocall Scam form, where you can help Google track down the companies running the robocall campaigns:

[https://www.google.com/safetycenter/everyone/start/report- ro...](https://www.google.com/safetycenter/everyone/start/report-robocall- scams/index.html)

<comment><USER3> Indeed. Totally not Google.

Also these companies call entire blocks of phone numbers that are "typically" associated with businesses (they can see what is a residential and what is a business block, and call the corresponding one with the appropriate scam(s)).

This link has more info on the "Google Specialist" scam (and what they're selling): [http://www.mechamcompany.com/getting-calls-from-a-google- spe...](http://www.mechamcompany.com/getting-calls-from-a-google-specialist/)

<comment><AUTHOR> Thanks for the information...I would think Google would make sure they don't use their name by taking them to court as it affects their brand.</comment></comment></comment>


Apple's much-anticipated tablet device coming early next year - <AUTHOR> http://www.appleinsider.com/articles/09/07/24/apples_much_anticipated_tablet_device_coming_early_next_year.html <comment><USER2> My capacity to pay for ultimited data for multiple devices is waning.

<comment><USER3> I agree with you completely. It has to be one monthly payment to access internet anywhere and everywhere.

</comment></comment><comment><USER4> I guess it will run an updated iPhone OS (not the full fledged OS X) and it will probably have automatic resolution switch to retain the compatibility with the existing apps catalog.

</comment><comment><USER5> Yawn. Again? Same source probably told them that the Newton will come back too :-)

</comment><comment><USER6> Incidentally, Apple is rumoured to have no debt and $30Bn in the bank.

What do you reckon the biggest limitation on them making use of their cash reserves is? (Assuming they aren't, that is).

Is it ideas? Ability to scale their corporate culture? Their management culture? Their hardware development teams? Their software development teams? Manufacturing arrangements?

<comment><USER2> I think part of it has to be that they don't want to canibalize their own sales. There's a limit to how much discretionary spending cash people have available ... particularly now. Most people can't afford more than one or two Apple products, so there's little reason to push forward devices that may compete with each other for people's hard earned cash.

</comment></comment><comment><USER6> > The 10-inch, 3G-enabled tablet, akin to a jumbo iPod touch, > _is the latest > brainchild of chief executive Steve Jobs_

As if everyone in the Peanut-, er, Apple-Gallery hasn't been clamouring for something like this for many years.

(Not that I can see why. Wacom's digitiser-tablet built into an LCD is a great solution for pen input. A computer with only a pen input is a crummy solution for general purpose computing ... unless the input is never-before-seen tremendous - like Apple's multitouch iswas).

<comment><USER7> With Bluetooth in the tablet, you can have a keyboard and mouse when you want them.

<comment><USER6> My iPhone has bluetooth and I can't have a keyboard and mouse when I want them.

I don't want to underestimate how annoying companies can be when they put their minds to it.

</comment></comment></comment><comment><USER8> Again?</comment>


Wikipedia over DNS - <AUTHOR> https://dgl.cx/wikipedia-dns

<comment><USER2> "Foo over DNS" was innovative and amusing a decade ago. While a clever hack, it has no advantages other than the fact that the latency drops from 200 ms to 20 ms or whatever. I don't know any applications consuming wikipedia blurbs for which that's an issue.

As for parsing Wikipedia and extracting summaries, that's already been done by Freebase. They also let you search, so you don't even need the exact article title. I'm a happy user of their wikipedia blurb feature and a lot of the other data that their API offers. Freebase can be useful for enhancing practically any web app; go check it out if you aren't familiar with it.</comment>


JSON in URLs - <AUTHOR> https://blogs.dropbox.com/developers/2015/03/json-in-urls/ <comment><USER2> A little confused. The author is arguing _against_ JSON in URLs, right?

The piece starts as a list of complaints about hacky query parameter encoding, and has the feel of one of those "aren't these things annoying... but here's the right answer!" posts, except instead of a correct answer we get a discussion of how JSON is nice in some cases but we shouldn't use it in URLs, except maybe sometimes.

Is this a response to some post about how JSON _should_ be used in URLs? Overall, I struggled to find a coherent narrative / argument here. Perhaps something went wrong in the article's editing process.

<comment><USER3> The argument is that JSON in URLs offers better abstraction.

</comment></comment><comment><USER4> Even this article's final conclusion is that this is a bad idea.

Data within the URL also has a number of other issues including:

\- It is easier to leak (e.g. browser history, proxies, some browser extensions, etc). Very few things record HTTP POST parameters unless they're doing something evil, very many non-evil pieces of software record the full URL.

\- Users intentionally or inadvertently re-posting data is much more likely. No browser's autocomplete re-posts HTTP POST parameters to the website, many will do so with HTTP GET parameters, which could result in a worse user experience (or in rare cases the user performing actions on your website within intending to).

\- Maximum length

\- The encoding/decoding step could be extremely expensive for some data. JSON itself requires a lot of decoding but depending on what you're moving it could mean almost all of the data requires it making the URL string insanely massive.

\- Users will copy/paste these URLs to one another and the JSON will remain in all its 200+ character ugly glory. This may not be a security issue but it is a user perception issue. URLs are meant to be getting cleaner/more human readable.

<comment><USER5> For your two User points, both revolve around "Users" having access to these APIs, however the article argued that these should be deeper APIs. Not for human consumption, right? I feel like that was part of the (vague) point - Params give a URL human-usability. To go beyond that and to get more power out of a URL, they (vaguely) propose JSON as a non-human friendly format.

So for these deeper APIs, how many humans are accessing these?

And, most importantly, i don't believe the article was arguing against POST (in fact, it doesn't mention POST.. once). I believe the argument was for times when you are already using URLs to convey data, such as in a search query, that JSON might be a useful alternative to plain HTTP Params.

No?

</comment></comment><comment><USER6> A JSON like syntax that is URL query compatible sounds like a great solution to me. Rison tried this approach a couple years back: [https://github.com/Nanonid/rison](https://github.com/Nanonid/rison)

<comment><USER7> Rison (specifically O-RSON) is a great solution to this problem. We use it in production and have done so for a couple years now, and it's served us very well to address this problem.

</comment></comment><comment><USER8> Well that has a smell doesn't it. There may be a use case where you feel the need to stuff a url with json data, but it sure feels wrong.

</comment><comment><USER9> I designed something similar while writing scoutcamp (an express.js competitor). I made it so that it could parse both normal queries (eg, `?age=12&cards=visa&cards=mastercard`) and JSON (eg, `?age=12&cards=["visa","mastercard"]`).

I'd argue that design is easier to read and allows graceful degradation: someone using an API with fields `age` and `cards` can rely on the traditional way to work. They can easily reformulate their query when more complex structures are required. Yet Ajax scripts can use a simple shim to make XHR calls that send arbitrary JSON data.

[https://github.com/espadrine/sc/blob/master/lib/camp.js#L82](https://github.com/espadrine/sc/blob/master/lib/camp.js#L82)

<comment><USER10> 'I made it so that it could parse both normal queries (eg, `?age=12&cards=visa&cards=mastercard`) and JSON (eg, `?age=12&cards=["visa","mastercard"]`).'

It's worth pointing out, since even here in 2015 people often don't realize this, that the querystring is permitted by the standard to contain more than one value of the same type. Thus, your second example in this case could also be cards=visa&cards=mastercard.

This is particularly a problem when you've got an overly-helpful web framework in a dynamically-typed language that normally exposes querystring parameters as a string, but if more than one gets passed in, suddenly you have an array. This can cause all sorts of fun problems, including security failures, though usually just bugs.

(Even in a dynamically typed language, a web framework should either represent querystring parameters as an array at all times _xor_ enforce a clear, stated policy of which string it accepts if it is going to pick just one, but it should definitely not just split the difference. The latter, despite in some sense being "wrong", does have the advantage of matching people's mental model, which is a useful enough thing on its own.)

This is, incidentally, a useful "Are the developers at least this tall?" test to apply to your new Web Framework o' the Week.

</comment></comment><comment><USER11> related: [http://evertpot.com/dropbox-post-api/](http://evertpot.com/dropbox- post-api/)

Basically everything about the status quo is messed up.

JSON into parameters: bad.

JSON into request body: undefined with the GET method.

JSON into request body with POST: great, but we're not actually mutating anything, so it's bad practice and won't be cached by varnish/nginx + a barrage of other problems.

I really wish someone would take up on [http://www.ietf.org/rfc/rfc3253](http://www.ietf.org/rfc/rfc3253) \- like REPORT as an analogue to GET, just with a JSON request body. Hey, we as a community finally managed to get PUT and PATCH on track, why not this one?

<comment><USER5> PUT and PATCH on track? I'm going to have to look into that. I had no idea progress was being made there, and i thought PUT and DELETE were basically dead.. atleast, in hopes of browsers being able to use them.

<comment><USER12> > PUT and PATCH on track?

I'm not sure what the reference to PUT is (its a base HTTP method) but I assume that PATCH refers to getting it added as an RFC-specified extension to HTTP/1.1.

> and i thought PUT and DELETE were basically dead.. atleast, in hopes of > browsers being able to use them.

 _Browsers_ can use PUT and DELETE.

 _HTML Forms_ however, support only the post and get methods. (I don't really get why: the semantics as form methods for PUT, PATCH, and DELETE as form methods seem pretty obvious given those of GET and POST.)

<comment><USER5> Ah yea, i'm referring to HTML Forms specifically. Thanks for the correction

</comment></comment></comment></comment><comment><USER13> When I pass around any parameters in GET or POST parameters I wrap them in base64. That makes a _lot_ of escaping bugs go away (and adds a bit of "security by obscurity", as well as true security when combining the query with a random number, a sha256 hash of the parameters and a serverside secret).

<comment><USER4> Not that this matters to your overall point, but base64 isn't actually a valid format to use in a parameter as a base64 string can legally contain: '+', '/' and '=' which would be interpreted and corrupt the data.

In the .Net world you'll want to use something like HttpServerUtility.UrlTokenEncode()/UrlTokenDecode() since it gives you a base64-like string with '+', '/' and '=' replaced or removed.

<comment><USER14> You can use base 64 with a URL-safe alphabet, as specified in RFC 4648: [http://tools.ietf.org/html/rfc4648#page-7](http://tools.ietf.org/html/rfc4648#page-7)

</comment></comment></comment><comment><USER15> May I recommend the following blog post:

[http://blog.lunatech.com/2009/02/03/what-every-web- developer...](http://blog.lunatech.com/2009/02/03/what-every-web-developer- must-know-about-url-encoding)

and the HN discussion of that post:

[https://news.ycombinator.com/item?id=5930494](https://news.ycombinator.com/item?id=5930494)

I used JSON in the URL to preserve the state of a report across reloads. I kind of regret it, because it wouldn't have been that much work to maintain a URL with normal query args. I think I had in mind that JSON would better handle things like the collapse/expand state of nested groups (a tree, essentially), but mostly I was just lazy, considering that I never got that far.

</comment><comment><USER16> Once you get there, maybe base64url binary blobs are way more efficient and quite compact.

<comment><USER5> Agreed. I was thinking the same thing. A fast and small encoding _(whatever that encoding may be)_ would help immensely, and is far more sane than url encoded JSON, imo.

</comment></comment><comment><USER17> We actually do something similar to this to make our application state (within limits) be reflected by the url and support navigation — both good things. The urls are horrible though and we're considering simply storing the state in a service and giving it a serial number (but this has its own issues).

I was hoping the article was proposing a better way of encoding Json as urls, e.g. using the characters that are allowed in place of curly braces etc and doing simple translation. E.g {"foo":"bar","baz":[]} becomes foo=bar&baz=&&

<comment><USER18> Semi-related - there is rison: [https://github.com/Nanonid/rison](https://github.com/Nanonid/rison)

</comment></comment><comment><USER3> JSON in URL: /log?%7B%22a%22:%22b%22,%22c%22:4%7D

You are debugging and need to quickly identify the values you are passing to the API. Better have a JSON parser handy.

<comment><USER19> This is already a problem if you ever have to work with non-ASCII characters. Check out a URL to a page in the Japanese Wikipedia, for instance.

<comment><USER3> [http://ja.wikipedia.org/wiki/ベーカーストリート・アンド・ウォータールー鉄道](http://ja.wikipedia.org/wiki/ベーカーストリート・アンド・ウォータールー鉄道)

<comment><USER20> Ahh but that is not the value that is sent to the webserver, that is just your web browser prettying up the display. If we open the inspector and see what was sent we have:

Request URL:[https://ja.wikipedia.org/wiki/%E3%83%99%E3%83%BC%E3%82%AB%E3...](https://ja.wikipedia.org/wiki/%E3%83%99%E3%83%BC%E3%82%AB%E3%83%BC%E3%82%B9%E3%83%88%E3%83%AA%E3%83%BC%E3%83%88%E3%83%BB%E3%82%A2%E3%83%B3%E3%83%89%E3%83%BB%E3%82%A6%E3%82%A9%E3%83%BC%E3%82%BF%E3%83%BC%E3%83%AB%E3%83%BC%E9%89%84%E9%81%93)

Your browser will equally pretty up the json in the url for display purposes.

</comment></comment></comment></comment><comment><USER21> We have used this syntax for url filters, works surpricingly well:

/v1/movies?year>=2011&artist!=cage

meaning - to add more meaning to the parameters in the query string, just add a suffix to the fieldname ><!~ etc. Before using the query, just filter them out. To add an array of options, just add the same field twice or use comma in the value:

/v1/movies?year>=2011&artist!=cage&name=the+rock,face+off

</comment><comment><USER22> I'm all for (ab)using specs whenever convenient, but this is just such a bad idea.

You will rarely actually use query args (ie ?x=y&foo=1) with a true REST API anyway. Use your resource path and avoid query args except for idempotent GET operations. If you have complex data, just put it in a request body as JSON. Don't put that crap in a query arg. That's not what it's for.

</comment><comment><USER23> Why JSON in the url as query parameters?

What benefit do you give you API caller?

What benefits do you give browser / caller caching for GET?

It really feels like they needed to get some content out for some reason, and just found some post in some internal dropbox wiki and posted it. Maybe they posted a draft by accident? I dont know...

</comment><comment><USER24> I noticed this on the official results page of the recent Parliamentary Elections in Greece. It uses JSON in the hash.

[http://ekloges.ypes.gr/current/v/public/index.html?lang=en](http://ekloges.ypes.gr/current/v/public/index.html?lang=en)

</comment><comment><USER25> A simple solution that can often work is to store the JSON in a database, assign a number to it, and use that number in the URL instead of the JSON. One could even add a cryptographical checksum (e.g., hash with secret salt) to make it a bit safer.

</comment><comment><USER26> Reminds me of one of my favourite @apenwarr articles.

        "Programming inside the url string"
        http://apenwarr.ca/log/?m=201212#18

</comment><comment><USER27> So the only example of query paramaters screwing up security is actually not about url query paramaters at all.

What a bad article.</comment>


APIs – a beginners' guide - <AUTHOR> http://benhowdle.im/2013/01/24/apis/ <comment><USER2> This seems to jump into web-based APIs without mentioning it. An API _does not_ have to be web based: it could be a set of classes, or methods, or modules or functions to be used from a language directly.

Web services, of course, tend to have web-based APIs. But that's a subset of _all_ APIs.

Since this article seems aimed at beginners, I think it's an important distinction to note. You would not want beginners to think that APIs are _always_ web-based because then they'll be confused by things like WebGL, which is also an API but _does not_ involve web requests or AJAX.

<comment><USER3> From my experience of explaining APIs, most people don't understand the distinction between the web and software, let alone the difference between a web-based API and a software one. If a user knew what WebGL actually is, I would guess that they already know what an API is.

</comment></comment><comment><USER4> As I noted in the article's comments, I'm pretty sure you can't just add "dataType:jsonp" and have it automagically bypass all the cross-domain security restrictions.

What actually happens is jQuery appends something like "callback=some_random_function" to the end of the querystring when it makes the request, and then the server is supposed to return you the standard data, wrapped in a function definition with the same name. jQuery then automatically executes the function, making the json data available.

Some servers require a specific function name, which can be specified as an ajax option using "jsonpCallback: functionName". All this effectively does is uses a specific function name instead of a randomly generated one, so that it matches up with the function returned from the server in the response.

</comment><comment><USER5> Thanks for this -- I think I'm your target audience here. CS student, entirely aware _of_ APIs, but not a clue how to interact with them. Yet I now have tweets flying left, right and center. So thanks!

<comment><AUTHOR> Awesome, glad you liked it!

</comment></comment><comment><USER6> For restful HTTP...

I like to keep my API strict resources, and nest them if necessary. Also avoid using more than 4-5 verbs per resource. <https://github.com/seivan/DocumentationExample>

POST, PUT, GET (member), GET (collection) and DELETE on a resource and nothing more. If a resource needs different kinds of colletions (say a filter) I'd use query parameters.

This makes working with API's as a consumer so much easier, especially as a iOS developer. :-)

Very Rails like, I know. I tend only to use the resources and/or resource method keywords. No custom matches and etc. Not for the API anyways. Just my two cents.

</comment><comment><USER7> I feel like this is missing something, perhaps a working demo.

I'm experienced in php and jquery but after 2 days of fiddling and stack overflowing, i could not get my demo api to POST...any helpful links are appreciated.

I was especially confused with php/cURL. .ajax seemed a bit more straightforward but jquery/javascript is so dang hard to debug. for cURL do you have to have any (non-default) settings installed on your servers?

</comment><comment><USER8> >So, $.ajax in JavaScript (jQuery) and cURL in PHP. That's it.

This is a bit confusing. "That's it" makes it sound as though this is the complete scope of what people mean when they say API. Somewhere it should be made clear that we are talking about one API of a particular type.

After reading the post someone could come away with the idea that if you don't have .ajax and jQuery or cURL and PHP then you aren't using an API.

<comment><AUTHOR> I hoped this line "From personal experience, I've used APIs heavily with only two languages; JavaScript and PHP." would convey that I'm only going to be talking about these two...

<comment><USER8> But ajax and cURL aren't the entirety of dealing with APIs in Javascript and PHP either.

</comment></comment></comment><comment><USER9> It's "a beginner's guide" that starts with an explanation of what an API is and then jumps straight into PHP code with cURL!

When someone just learnt what an API is and doesn't have a clear idea of what it is or how it works an example code doesn't help at all.

When I'm asked to explain what APIs are these are the things I mention,

\- an API is a fancy name for 'a way to talk to an external service'

\- when you need to do something with an external service like Twitter you have to use their API to communicate with them

\- an API is like a 'contract for communication' which specifies how to talk to the external party

\- Most web APIs use the HTTP protocol as a way of communication to send messages back and forth and they also have a method of representing data, for example JSON or XML, that's just the same thing but a different way, using JSON or XML is like saying the same thing in English or Spanish, using the HTTP protocol or something else is like writing down a sentence vs shouting it out.

\- When you use Twitter's API to unfollow someone, you don't know how exactly the unfollow happens, you don't have to know, all you know and have agreed with Twitter is that you ask Twitter to unfollow someone and they will do it, so in a way, using the API you are just sending them a 'signal' to do something. They can go ahead and change the inner workings of that API and as long as the part that is exposed to you remains the same you don't care because as far as you are concerned it does the same thing even though it may be doing it in a very different way

Here's a trivial example of a real-world API,

Imagine you run a restaurant and you need to buy fresh supplies to cook your delicious dishes every day.

You hire someone and teach them to buy the supplies as you order. You trust them to buy good quality stuff and deliver them to you.

You agree to give them order instructions via SMS. And you agree on the following format:

       BUY
       15 Salmon Fish
       20 Avocados
       DELIVER BEFORE 30 January 2013 14:00
       END

Now the person you have hired can use your 'Order API' to work with you. You send them a message in a format that you have agreed upon and using a medium that you have agreed (SMS).

Hope that helps some beginner who is struggling with all the fancy terms being thrown around without explaining the principals and the simple details that everyone takes for granted once they have passed the initial learning phase.

</comment><comment><USER10> I think the term SDK should be in there - it goes hand-in-hand with API in terms of "traditional" development that's not web-based. I understand he didn't go there because he doesn't do that himself, but jes' sayin'.

</comment><comment><USER11> +1 for Focus Mode.

<comment><AUTHOR> +1 for this.</comment></comment>


Show HN: Time series visualization service (many weekends project) - <AUTHOR> http://graphspot.com/

<comment><USER2> Do you have plans to include screenshots of the graph output?

<comment><AUTHOR> The graph output is a work in progress, I will update it in a couple of days with a screenshot.</comment></comment>


ComScore: Facebook is conquering Europe - <AUTHOR> http://news.cnet.com/8301-13577_3-10219774-36.html

<comment><USER2> the interesting thing is to look at countries that had dominant social networks already, like Germany:

[http://trends.google.com/websites?q=www.studivz.net%2Cfacebo...](http://trends.google.com/websites?q=www.studivz.net%2Cfacebook.com&geo=DE&date=all&sort=0)

It looks like fb is going to be able to dominate in the long term. My guess is people have enough friends that are in different countries. At least this is true in Europe where having all people in Spain and France is valuable to Germans.

China on the other hand may not have this dynamic and could be a lost cause for facebook at this point:

[http://trends.google.com/websites?q=www.xiaonei.com%2Cfacebo...](http://trends.google.com/websites?q=www.xiaonei.com%2Cfacebook.com&geo=CN&date=all&sort=0)</comment>


Discovery of widespread platinum may help solve Clovis people mystery - <AUTHOR> https://phys.org/news/2017-03-discovery-widespread-platinum-clovis-people.html <comment><USER2> Fascinating. But, where is the comparison with stratigraphically higher and lower material on the time scale of a few thousand years?</comment>


Mexico's Supreme Court rules in favor of allowing recreational marijuana use - <AUTHOR> https://aztecreports.com/marijuana-ban-unconstitutional <comment><USER2> Obviously this isn't legalisation. But as more and more countries/states legalise recreational marijuana, hopefully politicians will see the light and see that there's little demonstrable harm in legalisation, and that legalisation results in far more benefit than harm.

Unfortunately, this is unlikely. At least in the UK, New Zealand, and Australia. Politicians aren't opposed to drug law reform on the basis of safety, they might say they are, but in reality they're opposed to drug law reform because they believe that drug use is a moral sin. There are a significant number of politicians (in particular the religious ones), who believe that it's a sin to alter your mind, whether it be by alcohol, marijuana, mushrooms, MDMA, etc. etc. And they believe that it's their God- given duty to stop people from committing these sins.

The sad thing is that there are a lot of people in society who agree with them, hence they keep getting voted in. Just look at the comments on Facebook on any news story about somebody dying at a festival from drug overdoses, and there will be a slew of people literally saying that they deserved it for taking drugs in the first place.

And in Australia, I can't help but think that some politicians are using the war on drugs as a weapon in a fight against alternative culture. In Sydney, they have drug dogs at train stations, in particular in the Western Suburbs (the poorer, more ethnic side of the city), despite the fact that drug use is constant through the socioeconomic scale. Run a sniffer dog through the investment bankers' offices and see how much coke they'll pick up. They'll also use sniffer dogs at music festivals (especially non-mainstream events, like techno festivals), but they won't deploy them for the horse races, despite the fact that drug use is rampant at both.

<comment><USER3> You can make this point about these "side effects" for other countries as well. You will find plenty of commentators making the point that the US' War On Drugs has effectively been institutionalizing racism against blacks in the US, like the ACLU [1] or individual civil rights scholars calling it the "New Jim Crow" [2]. Others even claim that it may have had roots in a motivation to target "blacks and hippies" [3].

Whatever the reason, statistics describing the outcome of legal disparities between crack and cocaine in the US [4] seem to support the claim that the US justice system and drug laws in particular tend to reinforce racism and social exclusion.

Whatever the war on drugs was supposed to achieve, it certainly seems to be achieving something different altogether.

[1] - [https://www.aclu.org/other/race-war- drugs](https://www.aclu.org/other/race-war-drugs)

[2] - [https://en.wikipedia.org/wiki/The_New_Jim_Crow](https://en.wikipedia.org/wiki/The_New_Jim_Crow)

[3] - [https://www.huffingtonpost.com/entry/richard-nixon-drug- war-...](https://www.huffingtonpost.com/entry/richard-nixon-drug-war-john- ehrlichman_us_56f58be6e4b0a3721819ec61)

[4] - [https://americanaddictioncenters.org/cocaine- treatment/diffe...](https://americanaddictioncenters.org/cocaine- treatment/differences-with-crack/)

</comment></comment><comment><USER4> A step in the right direction, but it's not quite there yet. From the article

> It would still require individuals to bring their cases before the Supreme > Court before the judges can rule whether their case is constitutional, which > is still a little different to having the absolute freedom to consume > marijuana across the country.

It's also non-commercial use, which makes me think that the situation would be akin to Washington D.C. where it's legal to consume it, but not to sell it.

</comment><comment><USER5> Even with the case having to be brought to the SC, I wonder if this is Mexico's initial step toward attempting to curb the drug cartels. With the states legalizing recreational marihuana, that has already slowed down a lot of the over-the-border smuggling, at least IIRC without digging up articles.

OT: Canada seems to maybe thinking the same thing with legalizing. If we legalize it, we're erasing the incentive of backpacking through the back channels of the Canada-US border.

<comment><USER6> All of the weed transiting the Canada/US border is flowing from Canada into the US. Canada legalizing weed will have little to no impact on that, except reducing the risks for the Canadian growers. Legalization in several US states, especially Washington and California has already killed most of that trade though. There is plenty of weed being grown in the US now, and it's much easier to move it between states than it is to move it over a border.

</comment></comment><comment><USER7> Soon, 100% of illegal North American marijuana use will occur in the USA.

</comment><comment><USER8> Step in the right direction. It's legal in Canada and I can report that society hasn't crumpled (nothing's really changed honestly).

<comment><USER9> It's been like one week. At least give it a minute! ;)

<comment><USER10> The Brave New World will take a few generations, I assume.

</comment></comment></comment><comment><USER11> ¡Viva México!

</comment><comment><USER12> > _The Supreme Court found that adults have a "fundamental right to the free > development of the personality" without interference from the state. "That > right is not absolute, and the consumption of certain substances may be > regulated, but the effects provoked by marijuana do not justify an absolute > prohibition of its consumption," the ruling read._

What a bunch of lawless nonsense for a high court to be engaged in. This might be good policy, but the more ominous implication is what it means for the judiciary to be substituting its own judgment for that of the legislature, based on indeterminate legal theories about "fundamental rights" invented out of thin air.

<comment><USER13> All "fundamental rights" are invented out of thin air. Neither physics nor nature recognizes such "rights" as life, liberty, the pursuit of happiness, property rights, what have you.

<comment><USER14> Isn't that implicitly an argument for keeping the surface area of fundamental rights small?

<comment><USER15> > Isn't that implicitly an argument for keeping the surface area of > fundamental rights small?

It is at least one premise short of a basis for such an argument:

P1. All "fundamental rights" are products of human invention not found in nature.

P2. ?

C. Therefore, the number of fundamental rights on which a social system rests should be kept small.

<comment><USER14> P2 is something like, "It's difficult to get country-sized populations to agree on products of human invention."

I'm also implying a P3 that looks something like this: "Widespread agreement on the question of what exactly are the fundamental rights is a necessary condition for the survival of a nation."

This is sort of an argument of the form, "make things as simple as possible, but no simpler."

<comment><USER15> > I'm also implying a P3 that looks something like this: "Widespread agreement > on the question of what exactly are the fundamental rights is a necessary > condition for the survival of a nation."

That doesn't seem to be true in practice. It may be a desirable (either fundamentally or instrumentally to some other desired quality result) condition in a nation, but plenty of nations have survived an extended period despite fairly durable disagreements on the nature and scope of fundamental rights.</comment></comment></comment></comment></comment></comment>


Ask HN: Turned down an accelerator & still succeeded? Share your story. - <AUTHOR>

<comment><AUTHOR> Just to clarify -- this would apply to people who turned down or were turned down by an accelerator.</comment>


Ask HN: Ethically, should I disclose why I track "Hours Worked"? - <AUTHOR> A senior leader at my company recently demanded that all engineers log the number of hours worked for every engineering ticket, stating that the data would be used for software capitalization. I have inside information that the data will actually be used to measure that engineers are spending 85% of their time on "real work."<p>Ethically, should I tell the engineering managers the real reason why this "Hours Worked" metric is being tracked? <comment><USER2> I don't think it matters. The reason your company stated for doing this is transparently bogus, so pretty much everyone will probably assume the real reason is to help determine which staff members are going to be laid off.</comment>


Mike Lazaridis (RIM CEO) Job Ad from 1987 - <AUTHOR> http://groups.google.com/group/kw.jobs/browse_thread/thread/a07672b88690b933/ae30550ac36fe547?q=job+mike+%22research+in+motion%22#ae30550ac36fe547

<comment><AUTHOR> And here's another one: [http://groups.google.com/group/kw.jobs/browse_thread/thread/...](http://groups.google.com/group/kw.jobs/browse_thread/thread/ef2f85633398fa0e/bfeb8611c760ad51?q=job+mike+%22research+in+motion%22#bfeb8611c760ad51)</comment>


Introduction to Serverless on Kubernetes - <AUTHOR> https://www.edx.org/course/introduction-to-serverless-on-kubernetes <comment><AUTHOR> This is a course commissioned by the LinuxFoundation. You can learn for free, and there's an optional verified completion certificate you can pay for if you wish to have it.

The course covers the landscape, CNCF projects and the various installable projects with a nod to one or two managed services like Cloud Run and AWS Lambda.

I had fun creating this and I hope you'll enjoy learning from it too.

Course outline: \- Chapter 1. Introduction to Serverless \- Chapter 2. State of Serverless in CNCF \- Chapter 3. OpenFaaS \- Chapter 4. Setting Up Kubernetes and OpenFaaS \- Chapter 5. OpenFaaS Features \- Chapter 6. Create Your First Function with Python \- Chapter 7. Configuring a Function \- Chapter 8. Operating Serverless \- Chapter 9. Taking It Further

</comment><comment><USER2> I've been using serverless/cloud-native for a few years and even I learnt things from this course. Well worth reading.</comment>


14 years ago: the day Teller gave me the secret to my career in magic. - <AUTHOR> http://shwood.squarespace.com/news/2009/9/21/14-years-ago-the-day-teller-gave-me-the-secret-to-my-career.html <comment><USER2> It took me a while to appreciate it, but what I enjoyed most about this was the letter from Brushwood to Teller. Teller's letter was awesome in all of the general ways, and he makes great points about about doing something besides the thing you want to excel at.

But Brushwood's email was great because it asked for advice for a _specific problem_ , and it was a problem that Teller _had the expertise to answer_. Not "Oh Teller! I want to be a great magician just like you!" Not "What are 10 things an aspiring magician should do?" Not "Dear Teller, would you mind sending me information you find relevant or letting me pick your brain over coffee?" It was "I want to develop my own style, here's what I've done to that end. I've had some success, but here's how I struggled with taking it to the next level. What do you suggest, as someone who's accomplished this?" Emails like that tend to get the best kinds of responses.

<comment><USER3> >It was "I want to develop my own style, here's what I've done to that end. I've had some success, but here's how I struggled with taking it to the next level. What do you suggest, as someone who's accomplished this?"

Connecting thought from this video: <http://www.youtube.com/watch?v=ywu7Vu8Hko0>

Quote, not verbatim: "Roadblocks are there to stop people who don't want it badly enough."

Questions like...

> "Oh Teller! I want to be a great magician just like you!"

> "What are 10 things an aspiring magician should do?"

> "Dear Teller, would you mind sending me information you find relevant or > letting me pick your brain over coffee?"

... are indications of people who don't want it badly enough. They are infatuated with the fabulous end product, but not infatuated enough to really dive into it. The advice to "prod and demonstrate the failure/successes of your prodding before asking for advice" is not a heuristic against laziness - rather, it's meant to find out the depth of passion in the inquirer. Putting effort into an infatuation elevates it from a passing delightful thought into a serious, long-term passion. People who have chased life-long passions like to help those who aim to do the same.

<comment><USER4> Here's the link to the actual lecture with relevant quote.

[http://www.youtube.com/watch?v=ji5_MqicxSo&t=5m45s](http://www.youtube.com/watch?v=ji5_MqicxSo&t=5m45s)

<comment><USER5>
       The brick walls are there for a reason. Right? The brick
       walls are not there to keep us out, the brick walls are
       there to give us a chance to show how badly we want
       something. Because the brick walls are there to stop the
       people who don't want it badly enough.

       -Randy Pausch

</comment></comment></comment></comment><comment><USER6> Is anyone else as impressed as I am that Teller remembered the name of an up- and-coming magician they met after a show more than a year earlier? And that he referenced the 'inside joke' with no prompting?

Also, I think folks are missing what seems to me to be the key takeaway: "And if I'm good, it's because I should be a film editor. Bach should have written opera or plays. But instead, he worked in eighteenth-century counterpoint." He's taking something that's well understood in one area and bringing it to an area where that thing is not understood. Sometimes people call that a 'distinctive'. Sometimes it's a 'paradigm shift'. Teller could have been an average film editor, or he could take ideas from film and bring them to magic.

<comment><USER7> I actually went back to e original letter to see if I had missed a reference. From what I've seen of Teller, though, it isn't surprising that he would remember or that he would reply. He's one of the few famous people I wouldn't mind meeting.

<comment><USER8> If you'd like to meet him, even briefly, go to the Penn and Teller show at the Rio in Vegas. After every show, they hang out in the hallway and chat with the audience as they leave. They usually wait until everyone is gone before they head out. (By the way, Teller's letter mentions his version of The Miser's Dream, which is still in his act. And it's the most amazing interpretation of it I've ever seen.)

I always joked that if college didn't work out, I'd work as a street magician. As I've traveled around the country, I still make a point, time permitting, to stop by magic shops. I've yet to find one that doesn't have something from Teller written on the walls somewhere.

<comment><USER9> Isaac Asimov and Piers Anthony have both written in their books that they never suffer from writers block, and the reason both gave is that they read and reply to letters from their audience. Isaac Asimov especially replied to every single letter he received (I'm not sure about Piers Anthony).

Penn and Teller seem to have the same idea: Interact with every member of your audience who wants to talk to you. And they are one of the most successful magicians.

I think everyone should learn from this. Do you write a blog? Read every single comment you get, and reply to as many as you can. Run a business? Read as much customer service mail as you can. And if you are small read ALL of it.

<comment><USER10> Piers Anthony had one ongoing correspondence with a fan, and he wrote so much that he published a novel length book, Letters To Jenny, containing that correspondence. And it's a good read, too. Obviously Peirs doesn't write so much to everyone, and I can't answer whether he responds to everyone, but he certainly welcomes the letters.

</comment></comment></comment></comment></comment><comment><AUTHOR> I think there are some great points that adapt well to the startup mindset.

* [Ship stuff]. A lot. Try stuff. Make your best stab and keep stabbing. If it's there in your heart, it will eventually find its way out. Or you will give up and have a prudent, contented life doing something else.

* We did not start as friends, but as people who respected and admired each other. Crucial, absolutely crucial for a partnership.

* Have heroes outside of [startups / technology / business]. ... You're welcome to borrow [other people's], but you must learn to love them yourself for your own reasons. Then they'll push you in the right direction.

* Love something besides [technology / startups / business]. Get inspired by a particular poet, film-maker, sculptor, composer. You will never be [ $famous_startup_personality]. But if you want to be, say, the Salvador Dali of [startups / technology / business], THERE'S an opening.

<comment><USER11> I also especially liked the "be the $personality of $unrelated_domain". I think it could work really well because you can extract "meta-qualities" (if you'll excuse the made up term) that personality has and re-apply them to your domain.

Musically, punk rock popped into existence in a world of disco and polished/complex 'arena rock', bringing music back down to the essentials and playing it loud and fast. Be the punk rocker of startups by creating products that are lean, refuse to hide anything under a polish, and don't apologize for it.

When you edit a video (without musical soundtrack), you can get a good pacing for the scene by editing it to sync up with a song that evokes the emotions you want to express, and then removing the song when you render out. In this way you take in the qualities of pacing/emotions of the music, but don't need to actually reference the music.

And of course, we all write our code like poets. We rewrite lines that don't fit in well, and we refactor when functions get too long. Or we at least recognize when we're reading something that someone has put effort into crafting.

I'm not sure I'm supporting the argument well, so much as I'm just dumping out thoughts that the idea triggered.

</comment></comment><comment><USER10> "Here's a compositional secret. It's so obvious and simple, you'll say to yourself, 'This man is bullshitting me.' I am not. This is one of the most fundamental things in all theatrical movie composition and yet magicians know nothing of it. Ready?

Surprise me.

That's it. Place 2 and 2 right in front of my nose, but make me think I'm seeing 5. Then reveal the truth, 4!, and surprise me."

Teller absolutely means this. Watching the Penn and Teller Magic and Mystery Tour, this was the one best scenes in that show or in anything else I watched on Netflix last year:

<http://www.youtube.com/watch?v=TgtgOs_OkTU>

Yes, Teller is speaking, but that isn't what matters at all. The takeaway for me is that you must KNOW YOUR AUDIENCE! This is a magic trick that would not be a magic trick at all if it weren't performed for someone like Teller, a master of his craft. This scene from an otherwise interesting but forgettable show blew my mind.

<comment><USER12> Thanks for letting me know that the movie is on Netflix. Going to watch it now :-)

</comment></comment><comment><USER13> Humorous story: I once got yelled at by Teller. I was in Vegas for the World Series of Poker which was held at the Rio, the same casino where their show runs. The previous night I had had dinner at Okada with Penn's wife, Emily, who was a friend of the friend who put the dinner together. I also had tickets the next day to see their show for the first time.

On a break from my tournament I stopped by Starbucks to properly caffienate and saw Penn and Teller sitting in a corner. I went over to introduce myself, as I would to the spouse of anyone I had just met if I somehow recognized them. Right when I got there Teller gave me the evil eye and said something like "Can't you see we're working here?".

Of course they were just sitting at a Starbucks talking. They didn't have any props or anything. And probably they were hashing out details for the show or something, but I still found it quite rude, especially since I know they greet people outside of the show every night afterward.

But mostly I just thought it was funny to get yelled at by a guy most people think is mute.

<comment><USER14> I wrote out a significant response about the strange segregation of being a celebrity (of any repute) before rereading your post.

The most interesting thing to me is that within the span of 24 hours you ate alone with one partner's wife and the next day got yelled at by the other partner.

Did you talk to them after the show?

<comment><USER13> I went up and said hi and left it at that. I didn't really think ill of Teller for the whole thing, I can't imagine what it's like to be bothered all the time. I more than anything thought it was funny to be yelled at by a guy who is possibly more famous for not talking than anyone in history.

</comment></comment></comment><comment><USER15> I learned this lesson accidentally.

I was showing a friend a new card trick I'd made up, fanned the cards and asked him to pick one, remember it and replace it into the deck. As he did that I got confused - I thought I'd gone wrong and, apologising, asked him to pick another card. Fanned the cards again and he looked down at them to pick another one. In the middle of the fan, staring right back at him one card was face up; the card he'd chosen the first time.

I hadn't gone wrong at all, the trick had gone perfectly - I was just confused and _thought_ I'd gone wrong when I hadnt. It wasn't the plot line I'd originally had in mind for the trick, but it blew him away because when he went to pick a card the second time he wasn't expecting to see the card he picked the first time. The surprise was a huge contributing factor to the impact of the trick.

</comment><comment><USER16> Brian Brushwood is an amazing magician, but as a person, he is even more amazing. I had the fortune of meeting him last weekend at a common friend's house and saw him take time out to entertain a kid. If you're not familiar with his work, he has a weekly podcast on Revision3.com (<http://revision3.com/scamschool>).

<comment><USER17> He is even more prominent on TWiT (<http://twit.tv/>) doing shows like NSFW or GameOn etc.

<comment><USER16> This is not surprising considering that his original producer (<http://twit.tv/people/eileen-rivera>) for Scamschool on Revision3.com went to Twit.tv.

</comment></comment></comment><comment><USER18> > _Here's a compositional secret. (..) Surprise me._

> _Here's how surprise works. While holding my attention, you withold basic > plot information. Feed it to me little by little. Make me try and figure out > what's going on. Tease me in one direction. Throw in a false ending. Then > turn it around and flip me over._

This is the secret of storytelling. Hell, it's the secret of art. Music, painting, writing, architecture, wine making... you name it.

Storytelling > story, BTW. That's why P&T can make new with the same old tricks. If you tell the same old story in a new way, it feels unique.

The surprise is not in the content, it's in the experience.

</comment><comment><USER19> I recall reading a study once where the brain waves of people listening to a story literally synchronized with the brain waves of the person telling the story. Quite literally the storyteller was controlling the minds of the listeners.

Apparently we are hard-wired to become entranced by stories, but there is a skill to telling them in a way that doesn't break the trance--or, as Teller talks about, leading people to a place where you can smash the trance in a dramatic way for maximum impact.

Storytelling has fascinated me ever since I read that study. I must go find it again.

<comment><USER20> That sounds very interesting, and I'd love to read the study. Please post back here if you find it.

<comment><USER19> Here ya go sir [http://mblogs.discovermagazine.com/80beats/2010/07/27/study-...](http://mblogs.discovermagazine.com/80beats/2010/07/27/study- the-brains-of-storytellers-and-their-listeners-actually-sync-up/)

<comment><USER21> There's also a related radiolab episode: [http://www.radiolab.org/2011/apr/18/soul-mates-and-brain- dou...](http://www.radiolab.org/2011/apr/18/soul-mates-and-brain-doubles/)

</comment></comment></comment></comment><comment><USER22> First: Brian is the man. (Had him on a show I used to be on called The 404, and he had me both laughing and vomiting by the end of the show.)

Second: Teller's advice is echoed by another great... Ira Glass. He talked about how to make it in broadcasting. [http://shorty.randallcbennett.com/post/36484012/ira-glass- gi...](http://shorty.randallcbennett.com/post/36484012/ira-glass-gives- creative-types-a-pep-talk-one-of)

The thing with all of this is pretty simple. When you start, you have taste. If you have good taste, you'll know what you're making isn't quite what you want, but it's on the way to being good. If you keep perfecting your taste along the way, you're making positive progress. For startup entreprenuers, that often means starting lots of insignificant companies / working at insignificant companies on your way to perfecting the sense of who you are.

I feel like I'm _just_ starting to know who I am professionally. It's been about 7 years, and now I know that the only thing I want to do is make it so anyone can create TV quality video without a TV quality budget.

Failing in numerous ways has finally led me to figure out who I am. Now, it's time to take what I've learned and actually contribute something to the world.

For Brian, it's kickass magic which people can consume online. For me, who knows what my end "product" will be, but either way, if you don't enjoy the taste refining process, you'll probably both be dissatisfied with your life, but also miss out when you're about to break through.

I hope anyway.

</comment><comment><USER23> Why does transferring knowledge across domains have such exponential returns?

Is it only because the time it takes other fields to adapt to new methodology is longer - or are there other factors?

EDIT: Holy crap, I worded this terribly.

Rewritten: Why does going across domains with new ideas have such high returns? Obviously you're a fresh idea but are there other reasons that influence your success?

<comment><USER24> "A change in perspective is worth 80 IQ points." (Alan Kay and others)

Basicly I think its because they have different points of view on problems we can find similarities in.

<comment><USER25> Ah, but _which_ perspective? One can't sell non-apples, and 'a stroll through the insane asylum demonstrates that faith proves nothing'.

Perlis, epigram 39: "Re graphics: A picture is worth 10K words - but only those to describe the picture. Hardly any sets of 10K words can be adequately described with pictures."

<comment><USER26> Is there any way to discover how much selection effect occurs here? I wonder how many people apply insights from study in one field to another, and utterly fail because they weren't applicable at all.

</comment></comment></comment></comment><comment><USER27> Teller closes with a great point about where to draw inspiration from. Look beyond your own field. If you can distill something about the greatness you admire in a different art and adapt it to yours, then you will have accomplished something original. Study the masters, but especially the masters of other arts.

I wonder if the same could be said for software engineering. Maybe it's pretentious but I like to think of it as a practical art. Certainly much of what Teller teaches about "how to surprise" could apply to Steve Jobs' keynotes. Withhold information. Tease. Throw in a false ending. LAND the real ending.

Sounds like Jobs had a lot in common with magicians.

</comment><comment><USER28> Great letter. Thrilled at the start where he remembers, without prodding, one of thousands of people he briefly met long before. Great insights, prompted by the questions I want to ask great people but could not put in words.

P&T have a great show. As the letter, they tell so much more than just clever tricks - they comment on the human condition. Because of its insights into Occam's Razor "Teller Smoking" is my oft-recounted favorite ... Well, that and the bullet trick, but that because I inspected Teller's bullet, shell and gun, and still have the shell I marked and the bullet (also marked) Penn "caught" and spat into my hand.

</comment><comment><USER29> Hey did you guys check out the comments section with that one guy calling BS, saying regular people didn't have access to email way back in 1995? Good stuff. I love how people assume their tiny reality is _the_ reality.

<comment><USER30> Heh, I noticed that guy, too - made me look up my earliest Usenet post, July 4, 1994, when I was 15 years old. I had other Usenet, Fido, and BBS identities before that, but I can't remember what they were.

So yeah, in 1994, a 15 year old and his 12 year old brother were definitely able to figure out their way onto the "Live Internet" (to differentiate from dialup relay like Fido or UUCP)

Then came the convincing of the parents to get a dedicated line so we could leave our SLIP connection up 24/7 so that others could check our finger status, etc....

<comment><USER29> Similar case here, but it was 1984 when I was 15 and had email. Didn't have internet then of course, but BBSes were already linked, with email and forums being synced among the others in the network every night.

Even then I knew I was late to the game, Compu$erve was in it's prime, and the grassroots infrastructure was rapidly maturing.

That's what kills me with this guy pulling the "IT Professional" card. 10 years later claiming regular people didn't have email. That's like 100 computer years.

</comment></comment></comment><comment><USER31> What I took away the most from this article is taking things outside of your realm and applying it... Goes hand-in-hand with "Good artists copy, Great artists steal"

</comment><comment><USER32> Yet another reason to love P and T. Although unmentioned he captured the valley spirit of execs mentoring youngsters who might nonetheless become competitors.

</comment><comment><USER33> Teller's letter is amazing, and I think we all have much to learn from it.

</comment><comment><USER34> This is truly relevant to all who strive for greatness.

</comment><comment><USER35> > _Surprise. Withold information._

Works well for Apple.

</comment><comment><USER36> Wonderful.

</comment><comment><USER37> Not a very relevant HN material. Still puzzled on why it got so many votes.</comment>