Show HN: Desk.Fit – Powering healthy Desk Environments (curated list for now) - <AUTHOR> https://github.com/SaschaKrause/Desk.Fit.Curated <comment><AUTHOR> Greeting fellow desk heroes.

I'm building [http://Desk.Fit](http://Desk.Fit) out of frustration.

I sit on my desk for 8 hours a day. I look around the office and I see people doing the same. Bent over the keyboard for hours, sitting on chairs that just doesn't feel right.

I look outside the window, and what I see is dozens of office buildings, with hundreds of offices and thousands of office workers. Everyone of them is risking their health in the long run. Most of them know this already, but almost nobody acts accordingly.

Don't get me wrong, I choose to work on a desk. But I started to feel unhealthy some time ago because of how I spent my time in the office. I really want to change things for myself and the people around me.

Experts say you should invest into a really good mattress because you spend one third of your day sleeping on it. That's also what I did. But I would like to go further, as another third of the day I spent in the office.

So I looked around to see what is already out there that could help me. I categorised all those products and services and created a curated list out of it (that is basically the research I did for Desk.Fit). I hope that this might be of value for others as well.

I'm trying a lot of those products and services my self. I'll blog about my experiences with them and put this also into a newsletter (You can sign up at [http://desk.fit](http://desk.fit)). That said, my main goal is to create products that will look at healthy desk environment solutions from a new angle. My research showed me that there are a lot of half-baked solutions out there.

With todays technology and user focused design methods, there could be done so much more to help people. From easy things like providing healthy snacks during the day, to small exercises that can be performed without the need to stop working, to proper desk light, eye-resting reminders and much much more.

I'm happy for any kind of feedback. Thanks for reading</comment>


The World's Worst Website Ever - <AUTHOR> http://www.theworldsworstwebsiteever.com/ <comment><USER2> Not even close. Just off the top of my head, the infamous Yvette's Bridal Formal website was easily a couple of orders of magnitude worse. I think Yvette's is gone now, but here is a mirror: [https://yvettesbridalformal.p1r8.net](https://yvettesbridalformal.p1r8.net)

Even better (worse?), unlike the submitted site Yvette's was not _intentionally_ a bad site. It was actually a serious attempt at a good site promoting their business.</comment>


YouTube tightens rules after David Icke 5G interview - <AUTHOR> https://www.bbc.co.uk/news/technology-52198946 <comment><USER3> We can't outsource our critical thinking to private companies. People need to develop the ability to think critically for themselves and not rely on appeals to authority. This can't happen if people become lazy and simply trust whatever media is out there.

This also raises concerns for me around the question of freedom of speech and censorship. I fear we are centralizing too much power into a few private companies that effectively wield more power than the government and the people for whom it represents.

I'd rather have freedom of speech even if it means tons of misinformation out there.

If and when there is some information that is unpopular but critical for people to know, I don't want censorship to be the norm.

<comment><USER4> There's a huge difference between freedom of speech and actually hurting people. Organizing violence, for example, is already illegal even in many jurisdictions with strong protections for speech. "Information" that's not only going to get people killed but also is factually wrong is definitely fair game IMO.

<comment><USER5> Could you not make the same argument about many politically divisive questions? Medicare for all, climate change, etc.

<comment><USER4> Yeah, politically debatable questions seem much more defensible to me than this. This is a straight-up lie with no benefit to anyone.

<comment><USER6> You can't easily separate "straight-up lie" and "politically debatable questions". There are tons of "straight-up lies" used for creating questions, making them "politically debatable" and then acting violently.

<comment><USER7> A couple of months ago the idea that Covid 19 would become a worldwide epidemic was a conspiracy theory.

<comment><USER6> It goes both ways.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Spreading misinformation is bad. However, maybe casting media into the memory hole risks creating glorified digital martyrs.

I wish the WHO made more transparent arguments about the utility of masks. Their failure and apparent flip-flop gives the crazies low-hanging fruit and ethos.

<comment><USER9> We have a major "boy who cried wolf" problem with the media, and many of our truth-finding institutions. There've been enough instances in recent decades of arrogant incompetence and self-serving deception, that the public grows to distrust experts disproportionately in domains where it really matters: vaccines, epidemics, climate change.

<comment><USER10> A healthy dose of distrust towards experts is necessary, because they're wrong all the time.

What about the experts - including those at the CDC - that said COVID-19 was no worse than a flu? Are they no real experts, or are they just the _wrong kind_ of expert?

[https://www.businessinsider.com/wuhan-coronavirus-lesser- thr...](https://www.businessinsider.com/wuhan-coronavirus-lesser-threat-to- americans-than-flu-2020-1)

"Trust the experts" is nothing but an argument from authority. You're likely going to trust whatever expert confirms what you already believe.

<comment><USER11> This covid-19 debacle illustrated a big conflation with experts and authoritative bureaucracies.

Researchers, scientists, and people on the ground in China, Taiwan, and South Korea issued early warnings well ahead of the WHO, CDC, and FDA flip flopping on transmit-ability, masks, and testing.

Unfortunately the average person can't tell the difference between a researched investigative journalism piece in the New York Times and an opinion column in the New York Times. Most people can't tell the difference between the Washington Post and the Washington Times. Many people can't tell the difference between the Chicago Tribune and a random website that stole the Chicago Tribune's layout.

All these differences matter an enormous amount. They don't matter subtlety like missing the freeway exit and taking the next one. They matter like chopping your hand off instead of keeping it.

<comment><USER12> >Researchers, scientists, and people on the ground in China, Taiwan, and South Korea issued early warnings well ahead of the WHO, CDC, and FDA flip flopping on transmit-ability, masks, and testing.

Do you have a rough timeline for 'well ahead'? From what I've read it was classified as zoonotic, because the staff in China who handled the initial cases weren't presenting, and the wet-market was the only causal link. That's when the WHO reported (mid/late Jan) that human-human transmission wasn't possible.

>Unfortunately the average person can't tell the difference between a researched investigative journalism piece in the New York Times and an opinion column in the New York Times. Most people can't tell the difference between the Washington Post and the Washington Times. Many people can't tell the difference between the Chicago Tribune and a random website that stole the Chicago Tribune's layout.

But its not just "average people", its most people, including HN folks. On any expert topic, when you have no hands-on expertise, you apply "common sense", or read some articles, and then you're back to square one. Most scientific fields are advanced to the point where common sense doesn't get you very far. Not only that, there are a lot of professional explainers who muddy the waters by repeating things without understanding the nuances. I think its fine to say whatever, as long as its fine for me to ask "OK, but what makes your opinion worth something".

</comment></comment></comment></comment></comment><comment><USER13> Suppressing David Icke only makes this conspiracy stronger. Icke has close to zero credibility in the UK and well known to believe in lizard people and other such wacky theories.

If you stop people knowing he is also talking about this then the only people left to talk about it are the regular normal seeming folks. Channels like this [https://www.youtube.com/channel/UCsAwM1EqcYXKeIEufJqwWjw/vid...](https://www.youtube.com/channel/UCsAwM1EqcYXKeIEufJqwWjw/videos) thousands of views per video, seems like any normal bloke you'd chat to down the pub.

So well done by silencing a known eccentric you just made the only voices in this conspiracy the normal everyday folks, if regular people searched this theory and Icke popped up they might have actually questioned it because they don't want to be associated with the lizard guy.

<comment><USER14> > Suppressing David Icke only makes this conspiracy stronger.

I think this is begging the question. Why does Youtube, in particular, have an obligation to not "suppress" this person, especially when there's no element of Youtube's terms of service that would force them to carry his content?

He's not being hauled to jail by the authorities, he's just being denied (the greatest use of) the Youtube platform. If Youtube wants to enforce a degree of content control over what it hosts, that would ordinarily be its right -- in the same way that if I run a print shop I don't have to print flyers from any crank who walks in the front door.

Moreover, you're making a testable point here, that suppression "only makes this conspiracy stronger." Is there social science evidence to back this claim up, or is this just an intuitive opinion? An alternative framework is that by denying a pernicious idea its greatest platforms, it makes the topic seem more rare and thus less credible. (The converse of "everyone's saying it, there must be some truth to it.")

<comment><USER15> > Moreover, you're making a testable point here, that suppression "only makes > this conspiracy stronger." Is there social science evidence to back this > claim up, or is this just an intuitive opinion?

If there is, you might begin with this: [https://en.wikipedia.org/wiki/Streisand_effect](https://en.wikipedia.org/wiki/Streisand_effect)

But the conspiracy minded do seem to latch on to anything resembling information suppression.

</comment></comment></comment><comment><USER16> They need to be careful, such approach would have limited the info about covid-19. When I was watching the news, youtube videos in early Jan, it was coming from the "conspiracy theory" folks. Not mainstream media. Those folks were right.

<comment><USER17> They weren't right, they were just doing their usual shtick: weave panic narratives. The only reason they were 'right' because it so happens COVID-19 is actually pretty bad. But if you go and check their history of 'predictions' I bet everything in my savings account they've predicted a thousand 'tragedies' before and none of them came to pass.

In other words: even a broken clock is right twice a day, that doesn't mean it's working.

<comment><USER18> They were 100% right. "Wuhan: Chinese Authorities Welding Apartment Doors Shut to Impose Quarantine" [https://www.youtube.com/watch?v=TXpHD9bjGe0](https://www.youtube.com/watch?v=TXpHD9bjGe0)

"Wuhan: Disinfection Spray over Wuhan" [https://www.youtube.com/watch?v=bCY6OJskQRk](https://www.youtube.com/watch?v=bCY6OJskQRk)

9 Feb 2020 was full conspiracy theory while mass media stood silent.

Even today its not entirely common knowledge to what lengths China went at the end of January while WHO was spreading lies about no human to human transmission, no masks, and definitely no international border closing necessary.

</comment></comment></comment><comment><USER19> To some degree, the media needs to treat its audience like grown ups who are capable of thinking rationally and coming to reasonable conclusions. The more they try to handhold everyone, it will produce two effects: reduce audience ability to make informed decisions, and reduce audience trust in the media.

Someone showed me the Icke lecture, and so we discussed what are easy ways we could falsify his claims. E.g. countries with high incidence of covid19 and no 5g.

Especially when the conspiracy theory is so easily debunked the media should handle such cases more liberally. Think of it as inoculating the population against misinformation.

I do tentatively agree there are some kinds of misinformation that should be suppressed, but any such thing should be very exceptional, and very well explained. Otherwise, the media will end up being the modern Catholic church and go the way of the reformation. The church has spent centuries undoing the mistakes it made handling Luther's and other's criticisms.

<comment><USER20> > the media needs to treat its audience like grown ups who are capable of > thinking rationally and coming to reasonable conclusions

Sure, right after we feed them some unicorn tears for breakfast.

<comment><USER21> The fact that it's not true is largely irrelevant. When the media pursues a strategy of manipulating the masses rather than reporting the truth, the masses notice and stop believing what the media has to say. In the modern age, the media only has power to the extent that people believe what it's saying.

<comment><USER20> The problem extends far beyond "the media".

Substantial numbers of people don't trust their own pediatricians on vaccinations. 40% of Americans think God created humans in their current form instead of evolution.

Society has become hostile to _facts_ , and sites like YouTube are all too often happy to serve up bullshit if it gets engagement.

<comment><USER19> The important question to ask is 'why?' Are these people just stupid ignorants requiring being spoon fed information, or is there something more going on?

</comment></comment></comment></comment></comment><comment><USER22> > Conspiracy theories linking 5G signals to the coronavirus pandemic continue > to spread despite there being no evidence the mobile phone signals pose a > health risk.

> One falsely suggests 5G suppresses the immune system, the other falsely > claims the virus is __somehow using the network's radio waves to communicate > and pick victims, accelerating its spread.__

(__ emphasis mine)

W T Actual F people!

Facepalm.

If it were true it might be one of the greatest discoveries of all time ;)

</comment><comment><USER23> David Icke: [https://en.wikipedia.org/wiki/David_Icke](https://en.wikipedia.org/wiki/David_Icke)

Can't remember him when he was a footballer, but I wonder how many times he headed the ball ;-)

<comment><USER24> Isn't this basically an ad hominem attack? I don't know the guy, but you're attacking him and not his argument. Isn't the rule here to take the strongest part of an argument and go off that?

Edit: Downvoted on a site for pointing out the rules of the site. Maybes it's just me, but since the Great Quarantine, some websites have been a little extra smug and "hide the wrong think" prone.

<comment><USER25> Are we actually under obligation to listen to everything a crank says and then evaluate each statement? Once I find out someone believes in "reptoids", I don't see a lot of value in wasting my time with them, and it's exhausting to make that effort when they clearly aren't.

<comment><USER24> No, I believe you have the option of not watching his content, not replying to it, and generally allowing others to be as wrong as they would like to be. Unless someone is forcing your to interact with him... are they?

That isn't the topic of an ad hominem however. Saying "he's been kicked in the head too many times" is.

</comment></comment></comment></comment><comment><USER26> Don't like the direction YouTube and other social media companies are headed. This is pretty much censorship of free speech. I understand that he may be spewing garbage, but sheesh. At this rate YouTube will only have content it wants you to see; this is how it starts.

</comment><comment><USER27> Whenever conspiracy theory talk pops up, I notice 2 groups of people: 1) the conspiracy theorists 2.) the people calling the conspiracy theorists crazy lunatics....rarely anything in-between. Is there anyone out there that can scientifically debunk this guy's claims?

<comment><USER28> 5g isn't alien technology. It was developed over years by engineers and technicians. Did any of those folks show symptoms of 5g poisoning?

<comment><USER27> I have no idea, do you know if those folks haven't shown symptoms of 5g poisoning? Probably something worthy of looking into since many people have concerns about 5g.

<comment><USER25> > Probably something worthy of looking into since many people have concerns > about 5g.

Take flat earthers. Because many people believe it we should investigate - <USER2> people post evidence that the earth is round, the flat earthers reject that evidence and make the flat earth claim again. So do we keep investigating? The same number of people still believe. How many times around that wheel do we go? Do you believe that no one has honestly looked into the health effects of 5g? What evidence do you think it'll take for someone who believes radio waves are causing these effects, even though scientists have pictures of the virus, to have their mind changed?

</comment></comment></comment></comment><comment><USER29> Google: "it's better to be illiterate than have the possibility to read something wrong."

I swear to god I thought the internet would be so different in 2020.

Before (and even after) the ban there was a lot of good information on YouTube, a lot of it was from trained medical professionals and now it's all going away and people will be left with gossip and guesses.

<comment><USER30> Could you please elaborate on what you mean by the YouTube information going away?

</comment></comment><comment><USER31> How about we remove all the videos claiming people shouldn't be wearing masks?

Or is actually saving lives to much bother and it's more fun attacking people who believe in reptilians?

<comment><USER32> Are those getting as many views?

</comment></comment><comment><USER33> What is the problem with believing 5G causes coronavirus? The people who believe it are misinformed, and so what?

I understand why it's harmful to spread anti-vax memes, but 99% of "misinformation" is harmless. It's often difficult to separate theory and conspiracy from harmful information, a dubious concept.

<comment><USER28> A couple days ago in Long Beach, CA, USA, a train engineer derailed his train in an attempt to stop a medical ship which he believed was part of a government takeover. Conspiracies are all fun and games until a simpleton believes them and does something that hurts others.

<comment><USER32> [https://www.npr.org/sections/coronavirus-live- updates/2020/0...](https://www.npr.org/sections/coronavirus-live- updates/2020/04/02/825897966/train-engineer-says-he-crashed-in-attempt-to- attack-navy-hospital-ship-in-l-a)

Wow.

Is this a "misinformation control" issue or is it more a "monitor mental health of employees in high trust positions" issue?

</comment></comment></comment><comment><USER34> _> Now any content that disputes the existence or transmission of Covid-19, as described by the WHO [World Health Organization] and local health authorities is in violation of YouTube policies._

 _> This includes conspiracy theories which claim that the symptoms are caused by 5G._

Yeah, fair point. But it's a red herring.

 _> For borderline content that could misinform users in harmful ways, we reduce recommendations. We'll continue to evaluate the impact of these videos on communities around the world._

This one is KEY. Truth is, the majority of views comes from the Recommended, Trending and Next to Play. No one without a direct link will see your video, if it's nerfed by the algorithm. Checkmate.

Corona is a very heated topic with many unknowns. Deciding what can and can not be labeled as misinformation is thus very tricky even for an expert, because there is a very fine line between misinformation and speculation (which is different in the sense that it's done in good faith and thus perfectly fine). Who's going to make these decisions? A private corp with zero transparency?

We sorely need very clear distinction (maybe even legal - e.g. a framework for Terms of Service) between _media_ and _medium_. With the former being free to set arbitrary rules, push agendas, ban otherwise harmless content, fuck with content promotion in whatever ways they want, etc. And the latter providing just the infrastructure and technical means to publish content with minimal governance. Status of being either of these must be granted upfront and then prohibited to change.

Otherwise every "social media" platform will eventually mutate into a weaponized propaganda machine, promoting the interests of its stakeholders and greater powers-that-be and suppressing any dissenting opinion. This temptation is evidently impossible to resist.

<comment><USER35> If you weren't already convinced that YouTube is a publisher rather than a platform, this latest episode should make it obvious.

<comment><USER34> Absolutely. My point is that this won't change unless we as a society explicitly regulate/prohibit such behavior.

</comment></comment></comment><comment><USER36> All social media are strangely censoring anything that even remotely questions the official coronavirus story. I had shared this article on twitter some days ago and it's not even some weird conspiracy theory but twitter flagged it [https://off-guardian.org/2020/03/24/12-experts-questioning-t...](https://off- guardian.org/2020/03/24/12-experts-questioning-the-coronavirus-panic/)

<comment><USER37> Because this is not the time for conspiracy theories. People talking about the earth being flat doesn't really hurt anyone. People believing conspiracy theories about a global pandemic can be seriously dangerous.

<comment><USER38> This particular incident actually sounds like it involves pretty heavy "out there" stuff. But in general the term conspiracy theory means barely more than "not in line with government press releases". The average conspiracy theory guy is much less crazy than one might assume and a surprising number of now public revelations have been circulating in these corners of the internet way earlier. It can be quite informative and challenge critical thinking at the same time.

<comment><USER37> I have no problem with conspiracy theories, or people talking about them. What I do have a problem with is the general category of misinformation/conspiracy theories which hurt or endanger others. For instance, for every person who doesn't get a vaccination because they believe some of the anti-vaccination conspiracy theories, there is an immune-compromised individual who is being put into harm's way because of misinformation because they medically cannot receive the vaccine.

In the case of the coronavirus, we are dealing with a very dangerous global pandemic, and I personally think that this falls into the category of "misinformation can be very dangerous."

<comment><USER38> People are entitled to form their own opinions, even and in particular on vaccinations. They own their body after all.

<comment><USER37> As much as I agree with you when it comes to pretty much anything else, I have to draw a line when it comes to conspiracy theories which are undeniably false such as anti-vaccination ones, which harm others who cannot medically get vaccinations.

<comment><USER38> I see your point and can understand your position.

Just as a counterpoint I would still add that "undeniably false" is a very high bar that many believe is not reached with some topics, the "gospel" (not meant dismissive) on vaccinations being one of them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> This will only further fuel the conspiracy theories because of course the high tech companies suppress information critical of 5G

</comment><comment><USER40> I think a solution would be to let the video on the platform but display a huge yellow banner or something like Reddit's quarantine thing where it says "this video contains misinformation about Covid-19" or something more intrusive if you'd like. That way you're not necessarily compromising free speech

<comment><USER32> How about modelling good behavior? Instead of opinionated name-calling "misinformation", simply add a comment with their claims about such and such authorities explanation of the situation. If you can trust people to believe your facts, why would you assume they trust your opinions?

</comment></comment><comment><USER41> The interview is on London Real's FB page for anyone interested.

[https://www.facebook.com/londonreal/videos/206277527340570/?...](https://www.facebook.com/londonreal/videos/206277527340570/?vh=e&d=n)

</comment><comment><USER10> I don't think this is helpful, it's quite possibly counter-productive. If you're prone to conspiracy thinking, you're going to link any current event to any alternative explanation, no matter how far fetched.

If 5G wasn't in the news, it would be something else. Suppressing the signal only makes it stronger, because now you've "proven" that "the elite can't allow the secret information out".

David Icke is preaching to the choir, he isn't converting anyone. Nobody who is otherwise capable of sound reasoning is going to watch him and go: "I might disagree with this person on whether Zionist Reptile Shapeshifters are controlling the world, but his analysis of the effects of 5G on human health and COVID-19 seem credible!"

Conspiracy thinking is extremely common even among clinically sane people. The "cure" is not suppression, not derision, but letting people figure it out how their mind sometimes works against them. The biggest obstacle is the human ego.

</comment><comment><USER42> Good. This conspiracy theory idiocy about 5G is actively harmful to public infrastructure and it has to stop.

My only complaint is that Icke wasn't demonetized over this. He should be banned from the platform entirely. He's actively harmful to society.

<comment><USER10> I disagree completely. David Icke is responsible for the major conspiracy theory innovation that the Zionists controlling the world are actually shape- shifting Reptilians, effectively letting the Jews off the hook.

That means a set of people who could've otherwise ended up in classic Nazi conspiracy circles end up in something closer to a science fiction fanclub. Yet another set of people who dipped their toes into conspiracy theories might actually start to question whether it's all bullshit, upon finding that the Pope is supposedly a lizard.

The 5G thing on the other hand is something that _a lot_ of people think is probably dangerous, whether they're conspiracy theorists or not. Of course conspiracy theorists picked it up, but if it wasn't 5G, it would be fluoride, or contrails, or literally anything else that might somehow be polluting water, ground or air.

<comment><USER43> Except when Icke says "the aliens" sometimes he means aliens and sometimes he means "The Jews". Anti-Semitism is part of his beliefs.

See for example this. [https://twitter.com/davidicke/status/667764406466441216](https://twitter.com/davidicke/status/667764406466441216)

<comment><USER10> Icke's theory does not differentiate between Zionists, Illuminati, the Rothschilds, the royal family, the pope and so on. They are all reptilian shapeshifters from another universe, sometimes posing as Jewish leaders, sometimes as Christian or secular leaders, but it's never "the Jews" as a people.

The reason this distinction is important is because if you believe "your enemy" is really reptilians from another dimension, you don't have a reason to be hating or threatening the jews next door. It's strictly better than you becoming a Neonazi ready to pick up where the "final solution" left off, which is another possible trajectory.

Bottom line, if you have the predisposition to believe in "secret group controls the world" stuff, I'd much rather have you believe in Icke's theories. If you _don 't_ have that predisposition, you're not going to believe in any of that stuff either way. You don't need to be "protected".

<comment><USER32> This is absurd. Saying "famous Zionist are reptiles" doesn't protect non famous Zionists. It promotes violence because it's a lot easier to set fire to a synagogue than assassinate a Prime Minister.

<comment><USER10> Jews and Zionists are not the same. A lot of Jews aren't Zionists, in fact some of the most Jewish looking Jews are anti-Zionist:

[https://i.ytimg.com/vi/FKplabTRuak/maxresdefault.jpg](https://i.ytimg.com/vi/FKplabTRuak/maxresdefault.jpg)

[https://en.wikipedia.org/wiki/Anti-Zionism#Jewish_anti- Zioni...](https://en.wikipedia.org/wiki/Anti-Zionism#Jewish_anti-Zionism)

Furthermore, a huge amount of _leftists_ are openly anti-Zionist.

I'm not saying the alien lizard theory is "protecting" anyone, I'm saying it's the _better alternative_ to whatever Nazi conspiracy theory you're going to buy into otherwise.

</comment></comment></comment></comment></comment></comment><comment><USER44> latest updated figures of coronavirus on [https://coronaworld.info](https://coronaworld.info)

</comment><comment><USER45> The answer is education.. we need free, comprehensive education for every person on the planet

<comment><USER32> Cool. So, who writes the textbooks?

The Indian government allegedly (can't find source except John Oliver's TV show, so take with grain of salt) published textbooks claiming that Caucasian people are undercooked toast and Africans are burnt toast, and is currently running an ethnicity cleansing campaign to eliminate Muslims.

</comment></comment><comment><USER46> oh man... David Ike.

If you ever wanted a trip through la la land go visit his website's forums....

Its a not so coherent and less nasty version of 4Chan where _everyone_ is off the hinge. some more than others.

</comment><comment><USER47> This makes me wonder if there will be "covid19 deniers" in the future just like there have been holocaust deniers ever since the war, claiming that it never happened and is a conspiracy.

It's really depressing these theories, anti vaccine, and anti science ideas are gaining so much momentum in recent years. And then the world governments pull something like they just did, saying masks don't work when in fact they help... how can you ever convince anti science people to trust, well, science and governments when this happens??

I suspect this will become a bigger and bigger problem, with more and more people dying of illnesses we have vaccines for. Very sad.

<comment><USER48> There already are "deniers".

</comment></comment><comment><USER49> If some speech is suppressed everywhere, how can one know that it's false?

</comment><comment><USER50> Just because there is no evidence (yet) doesn't mean it is misinformation

</comment><comment><USER51> When did David Icke try to pass a gun range in Kentucky off as Syria?

[https://www.nytimes.com/2019/10/14/business/media/turkey- syr...](https://www.nytimes.com/2019/10/14/business/media/turkey-syria- kentucky-gun-range.html)

<comment><USER52> When did David Icke issue a correction?

<comment><USER51> What does David Icke have to correct?

<comment><USER53> 2 random examples that would be useful corrections from him:

"The Protocols of the Elders of Zion aren't a legitimate historical document laying out a plan for world domination"

"No world leaders are human/shapeshifting-alien hybrids"

<comment><USER51> In that case, " _The Weekly World News_ " has a lot of corrections to issue.

<comment><USER52> So you've admitted that Icke and The Weekly World News are comparable and not like ABC News.

<comment><USER51> I admit that I don't live in bizzaro world--where some crazy old man's conspiracy theories must be suppressed, while multi-billion-dollar corporations that deceive broadly, frequently, and incompetently are the " _good guys_."

" _But, BUT, we retracted!_ " After they were caught...

<comment><USER52> It was incompetence that they then corrected. Should the whole company be disbanded for a few employees' corrected mistake?

Meanwhile, crazy old man has never retracted any of his conspiracy theories, instead repeating them over and over. One is a reliable source of information, and the other is a reliable source of misinformation.</comment></comment></comment></comment></comment></comment></comment></comment>


Don't Use OAuth for your API - <AUTHOR> http://ashfurrow.com/dont-use-oauth-for-your-api

<comment><USER2> To quote Destroy All Software:

wat.

Instagram uses OAuth2. It's right there in their doc: <http://instagram.com/developer/authentication/>

Second: OAuth uses access tokens, just like OAuth2. It also imposes request digests including a timestamp parameter, which prevents replays and doesn't permit forged requests if you manage to intercept an unencrypted request.

OAuth2 is arguably _less secure_ than OAuth, because as it's being used by Instagram, the whole kit and kaboodle is wrapped up in the bearer token, which is wholly reliant on TLS for its secrecy.

Corporate network with a custom CA installed? Your account is theirs (seriously, your employer doesn't have to ask for your Facebook password to spy on you, they just have to make sure their proxy's CA is installed on your work-issued machine, and they can crack your Facebook account open like a pinata). Cert issued from a bad CA anywhere between you and the target server? Your account is theirs. Any breach in the host's enforcing of TLS? you've just leaked full access to your account to anyone that's listening. Hell, even an XSS breach can result in a leaked bearer token.

Oh, and guess what? You can still suck an auth token out of memory and use it to forge requests. And you can still suck the OAuth2 keys out of the package or memory or whatever and use them to forge authentication requests. The exact same issue exists for OAuth2 (and Instagram's usage of it) that exists for OAuth. Implicit authentication flow is great, but the core problem of "I can crack open your app, take your client ID, and use it to create authentication requests for my app while masquerading as you" still exists. With OAuth, you also have to steal a client secret in addition to a client ID, but the end result is the same.

OAuth2 is a lot more friendly than OAuth for client developers, I'll grant that, but it's just flat wrong to argue that it has some mystical protections against the problem that aren't present in OAuth.

<comment><AUTHOR> To quote from the page you linked to:

> If you're building an app that does not have a server component (a purely > javascript app, for instance), you'll notice that it's impossible to > complete step three above to receive your access_token without also having > to ship your client secret.

I guess I've misspoken here. Instagram uses OAuth for authentication, but actual calls to API endpoints are sugned by appending your access_token, not signing each request with OAuth.

<comment><USER2> OAuth (1) requests are signed with a combination of access token and shared secret. I can't impersonate you (as a user) just by sucking the OAuth secrets out of the app.

OAuth 2 requests are identified by a bearer token, and have no shared secret signing.

<comment><AUTHOR> Thanks for the info - I've updated the post according to your feedback. I think this is more an article discussing why you shouldn't use OAuth 1 when OAuth 2 is available.

<comment><USER2> With all due respect, it needs some work, then. You've framed it in the context of security, and there's been no compelling reason presented for as to why OAuth 1 is an inferior solution to OAuth 2 from a security perspective. Both use access tokens. OAuth2 has implicit flow, which serves to keep my server-side client secret out of the hands of mobile users, and which I can achieve in OAuth 1 by using a separate client secret for my mobile distribution than I do for my server distribution.

At the end of the day, all information on the client is subject to compromise. Period, paragraph, end of story. Any identification system that relies on a shared secret is subject to compromise as long as that shared secret is stored on a client-controlled device or ever entered into memory. That's true for OAuth, OAuth2, basic auth, pubkey authentication, passwords, biometrics, and literally every other single-factor identification scheme on the planet.

</comment></comment></comment></comment></comment><comment><USER3> In your post, you state that Instagram does not use OAuth. But then, you link to their API page.

First sentence I read was: "Instagram's API uses the OAuth 2.0 protocol for simple, but effective authentication and authorization."

<comment><AUTHOR> They offer different authentication mechanisms depending on whether you're writing a client or web app.

<comment><USER4> Can you point to anywhere that documents that?

"Instagram's API uses the OAuth 2.0 protocol for simple, but effective authentication and authorization." seems pretty clear. So's this bit:

> Client-Side (Implicit) Authentication

> If you're building an app that does not have a server component (a purely > javascript app, for instance), you'll notice that it's impossible to > complete step three above to receive your access_token without also having > to ship your client secret. You should never ship your client secret onto > devices you don't control. Then how do you get an access_token? Well the > smart folks in charge of the OAuth 2.0 spec anticipated this problem and > created the Implicit Authentication Flow.

</comment></comment></comment><comment><USER5> In the article Ash writes:

> Basic HTTPS auth makes it easy to crack the protocol's encryption and get > the username and password.

Does anyone know what he is referring to?

He also says:

> However, getting [a value] isn't difficult; it's easily accessible by a > malicious user using an HTTPS proxy.

That, I am fairly certain, is not a serious concern because HTTPS uses a certificate chain to prevent the use of proxys. Sure, someone capable of generating bogus certificates (the NSA, for instance, and probably several other powerful governments) can insert a proxy without your knowing, but if they can do that then they can ALSO undermine the entire world financial infrastructure. Anyone capable of doing that is probably NOT going after YOUR app.

<comment><AUTHOR> Repeated username/combo requests over HTTPS produce patterns over multiple requests that can make cracking the encryption easier. Additionally, there's the issue of having to store usernames and passwords somewhere in the app (hopefully not plaintext, and hopefully somewhere inaccessible).

As for proxies, I'm talking about someone with physical access to a device and network, which I believe would work for extracting unencrypted HTTP headers from HTTPS requests (that's why an OAuth signature is itself encrypted by the consumer secret and user authentication token). However, I'm not a network security expert, so maybe I am mistaken.

<comment><USER5> > Repeated username/combo requests over HTTPS produce patterns over multiple > requests that can make cracking the encryption easier.

Interesting! Do you have any references where I can read more?

> As for proxies, I'm talking about someone with physical access to a device > and network

HTTPS really does protect against someone with physical access to the network, by encrypting the data streem and preventing man-in-the-middle attacks (except by attackers who can subborn a trusted root authority). It does NOT protect against someone with full access to the "device" where the client app is running -- someone with such access can, more-or-less by definition, view all values that the program sends (including credentials).

</comment></comment></comment><comment><USER6> I'm either missing the reasons being backed up by Instagram's documentation or my sarcasm meter is completely broken this morning.

1) Dissent against OAuth; "OAuth sucks", "Don't use OAuth"

2) Focus on the fact that Instagram doesn't use OAuth

3) Link to Instagram documentation which says they do and it's awesome:

> Instagram's API uses the OAuth 2.0 protocol for simple, but effective > authentication and authorization

> Well the smart folks in charge of the OAuth 2.0 spec anticipated this > problem and created the Implicit Authentication Flow

4) ???

What'd I miss?

<comment><AUTHOR> Yeah, sorry about that. I was mistaken and have udpated the article.

<comment><USER7> Updated with pictures of cats!

</comment></comment></comment><comment><USER8> I think the more important lesson here is: don't use light grey text on a white background.

</comment><comment><USER9> The question here is: who is responsible for user behavior, the user or the application? If the user is solely responsible then just using client tokens is fine, because you can ban the user by invalidating her tokens. But how to you ban an app? There's no good way to solve that problem if everything is client side.

<comment><AUTHOR> The Stack Overflow question I link to offers an interesting point: OAuth would work fine if tokens and secrets were passed out on a per-app, per-install basis. That way you could ban a developer of an app, or an individual, if their token/secret combo becomes compromised. Something like federated key management: [http://www.scmagazine.com/federated-key-management-as-the- ba...](http://www.scmagazine.com/federated-key-management-as-the-basis-for- secure-cloud-computing/article/158089/)

<comment><USER10> The problem is that to do per-install tokens, one needs a secure side channel between the server and client over which to exchange these tokens, or a secure side channel to some kind of key management/federation server. That's fine and good, but it completely defeats the point of OAuth 1, which was to provide a request signing method that _didn't_ depend on any other secure side-channels to operate.

With OAuth 2, of course, the point is mooted a bit by the decision to go with HTTPS as the secure channel, and such a scheme seems much more plausible.

</comment></comment></comment><comment><USER11> What are some OAuth alternatives that you guys know of or have used in the past? I only know of two-way SSL and SAML.

</comment><comment><USER12> The title of this article is "Don't Use OAuth 1 for your API" instead of "Don't Use OAuth for your API"

<comment><USER4> It wasn't until it was pointed out to the author that the article was completely incorrect.</comment></comment>


Ask HN: Do you believe that Authy cloud backups are secure? - <AUTHOR> Authy looks like a neat service, and their blog post about the security of backed-up TOTP keys is promising, but obviously no one can independently audit the code.<p>Could anyone else weigh in on the security of this product, if there's any public information? Have there been any serious breaches or exploits? <comment><USER2> Many security-conscious product companies go through an independent audit of their security processes to become certified. This doesn't necessarily mean that the code is secure, but it does mean that the company/product follows procedures and policies designed to ensure that the company and its products are secure, such as going through an annual penetration test. According to their website Authy is SOC2 compliant, so you should be able to ask them for their report (you typically have to sign a NDA). Importantly, you should read the report, ESPECIALLY the exceptions. It should give you a good feel for their security model and security defenses.

<comment><AUTHOR> That's interesting. You think they'd let a CS student look it over?

<comment><USER2> As long as you're considering buying it and are willing to sign a NDA. Twilio also has a generic white paper that's available without scheduling a demo, which may be more accessible. If you're having trouble with Twilio/Authy giving you permission to view the SOC2, you should reach out to one of the evangelists.

</comment></comment></comment><comment><USER3> I haven't looked in to it past being an Authy user but when restoring from backup I was a bit miffed that the service (Google, GitHub, Other, etc) and the comment (e.g. username, email) were able to be seen without inputting my backup password.

</comment><comment><USER4> I ask myself the same question and I always stop at thinking that its just the 2FA tokens and not the actual passwords.

</comment><comment><USER5> I would agree</comment>


Scott Aaronson tears NKS apart [pdf] - <AUTHOR> http://scottaaronson.com/papers/nks.pdf <comment><USER2> I'm more impressed with the book than the review.

It's a good review, no doubt, but I think Aaronson, while catching Wolfram using a bit of hyperbole on occasions, misses the essence of what NKS is.

It's not simply a review of existing CS theory.

The Feynman quote was quite illuminating. Wolfram does take the discrete conversation to the next step. He doesn't answer the questions, mainly because what he is proposing is, well, a New Kind of Science. Which means that there are going to be hundreds or thousands of questions.

What might be missing the most is a methodology for exploration. But I think overall Wolfram is just a bit ahead of his time. Those things will be worked out.

<comment><USER3> Because it was no review but an analysis. Review is when renowed reviewer gives his opinion which is backed by his authority. When your'e a poor grad student, like Aaronson in 2002, then you better withold emotional opinons and give facts.

 _he is proposing_

And what Aaronson analyses is that book's statements form no proposal.

</comment></comment><comment><USER4> Wolfram's talent for self-promotion has been nicely demonstrated by the publicity campaign ahead of his WolframAlpha launch. Multiple pre- announcements, screenshots, peek-reviews, demos have been appearing on NH for weeks already.

Which may not be a bad thing, except it all comes at a price of credibility. Why does one need to create all that fuzz? Isn't it because the revolutionary product/idea cannot win followers and reputation solely on its merits?

Same applies to his book. With a bit of modesty its impact could have been so much greater. Especially since its subject is indeed fascinating.

<comment><USER5> Since when has Hacker News, with its highly entrepreneurial core, ever so viciously attacked publicity? I haven't read NKS, so maybe I don't understand the depths of this man's capital offense, but I see nothing in your list that any smart business won't do. Maybe it isn't revolutionary (whatever that means), but it's a damn cool project that's going to be useful to a lot of people, and isn't that all we care about?

 _Isn't it because the revolutionary product/idea cannot win followers and reputation solely on its merits?_

If the odds are worse without promotion, what rational human wouldn't use it?

<comment><USER6> _Since when has Hacker News, with its highly entrepreneurial core, ever so viciously attacked publicity?_

I believe the last time was Cuil.

Being able to work the hype machine is great, but if you generate more hype than you can deliver on it hurts your image. Since _A New Kind of Science_ was similarly underwhelming, not to mention even more pretentiously hyped, many are cynical.

<comment><USER5> _I believe the last time was Cuil._

Cuil's sin was failing at a solved problem, and most plainly, trying to be a "Google killer" (I believe they lectured Google on the size of their search database before they even launched).

NLP answer engines aren't a solved problem, and WA was a pretty decent 1.0. Sure it failed techcrunch's vanity test, but for what Wolfram promised in those videos, it performs.

<comment><USER6> I think what you're saying is true, but it's orthogonal to my point. Both of them generated more hype than they delivered on in their launches and people were underwhelmed. That WA has more promise is a separate matter.

<comment><USER3> It is interesting to parallel Wolfram with Thinking Machines founders.

It is a rather little known fact that, trained through TM catastrophe, its founders went on to form a stealth company, called Ab Initio, which is wildly successful despite having no marketing. Indeed they're actively avoiding it through NDA contracts to the point that general public doesn't exactly know what exactly their products do.

I am not ridiculing Wolfram, just wanted to point that above is as an interesting anecdote.

</comment></comment></comment></comment></comment></comment><comment><USER7> Wolfram is remarkably short-sighted. You'd think that such a smart guy would have realized that spending 1100+ pages blowing is own horn would tend to turn off the very people he hoped to convince.

They say that love is blind, ego must just be plain blinding.

<comment><USER8> > You'd think that such a smart guy would have realized...

This is the best theory I've seen yet to explain his behavior:

[http://groups.google.com/group/sci.math/msg/37f51351f5340e58...](http://groups.google.com/group/sci.math/msg/37f51351f5340e58?dmode=source&output=gplain)

It makes a lot of sense, in light of the man's biography.

See this:

<http://www.cscs.umich.edu/~crshalizi/reviews/wolfram/>

for an informed critic's perspective on the details.

</comment></comment><comment><USER6> Kurzweil's write-up on it is also good:

<http://www.kurzweilai.net/articles/art0464.html?printable=1>

</comment><comment><USER8> I prefer this review:

<http://www.cscs.umich.edu/~crshalizi/reviews/wolfram/>

</comment><comment><USER9> Wolfram is a brilliant, egotistical, narcissistic credit hog. The history of science is littered with them. Some of the greatest discoveries of mankind are credited to the wrong people.

<comment><USER10> Can you give examples? I'm genuinely interested. Rosalind Franklin and DNA is about the only 'greatest discovery' I know of where I think credit wasn't given where it was due.

Also, SW hasn't gotten anywhere near a 'greatest discovery', so I'm not sure the comparison is valid.

<comment><USER11> Everyone likes to talk about the immortality that comes with proving an important mathematical result, but it's rarely that easy:

The first publication on the Mobius strip was written by a guy named Listing, who did the same work as Mobius at the same time. I have to warn you that googling "Listing Strip" is slightly NSFW.

Kalman was only the popularizer of the Kalman Filter.

Grassman, who invented vector spaces and developed a lot of linear algebra, only got credit posthumously.

Some people, like Fourier, only _inspired_ the theory named for them. Modern theory is so much more general than classical theory that entire careers can be built by translating an old mathematical idea to a new domain.

Sometimes, a new idea gets labeled as an extension to an existing idea if it so much as resembles an old idea. For example, the Hamilton-Jacobi-Bellman equation was Bellman's work. This is dangerous if you're after immortality -- there are very few ideas in math that aren't even slightly hinted at in the works of: Euler, Gauss, Jacobi, Hamilton, Lagrange, Laplace, etc.

Sometimes, though, the new guys can usurp the old. When set theory being laid down as the core idea in all of mathematics, the mathematicians who reformulated ideas in rigorous set-theoretic language often got the new names. That's why we now have the Haar Measure instead of the Hurwitz Invariant Integral.

</comment></comment></comment><comment><USER12> Until I read the PDF, I assumed this would be about Nobody Knows Shoes. It's better to abbreviate A New Kind of Science as ANKOS to avoid confusion.

<comment><USER13> I prefer WANKOS (Wolfram's ANKOS...)

</comment></comment><comment><USER14> Thanks for the alley-oop? <http://news.ycombinator.com/item?id=612002></comment>


The BlackBerry PlayBook Review - <AUTHOR> http://www.anandtech.com/show/4266/blackberry-playbook-review/1 <comment><USER3> It's an obvious v1.0 product, but the free tethering and pairing makes it look pretty compelling if you're already a Blackberry user (which I am).

Judging from the videos, the performance of the software is much better than I would have guessed. I'm assuming most of the bundled software is written in Adobe Air. The prospect of being a 1st-class citizen on the OS should be appealing to existing Flash developers.

I'm not yet sold on a 7" screen size for a "tablet", although it would be more luggable; the only way my iPad leaves the house is in my laptop bag. However, I am absolutely sure that the iPad's 4:3 screen ratio is the only way to go. The only time 16:10 doesn't cripple you is when you're watching a movie.

Anyway, I'm curious to see this thing in person.

</comment><comment><USER4> [http://images.anandtech.com/reviews/tablets/RIM/PlayBook/IMG...](http://images.anandtech.com/reviews/tablets/RIM/PlayBook/IMG_00000116.jpg)

Back to 80's! Seriously though I just hope they have a good, defensive multitasking system that unloads apps from memory automatically and do save/restore state as required. Otherwise it's going to have a bad rap - <USER2> are just not used to seeing out of memory messages on mobile phones while starting apps.

</comment><comment><USER5> Many people say RIM has an odd shipping model but I just think they're slow. When you look at how Apple ships a product, they announce the product, the details, show off the apps, and then BAM! It's available in two weeks and sells millions.

RIM on the other hand announces something and then every few months teases you with more and more details and then releases some half baked product with bi- monthly updates. By the time the product becomes what they intended it to be I already want something new.

As a Blackberry user, I can't give it up. I love my Blackberry's form factor. At the same time, it's an incredibly frustrating experience.

<comment><USER6> Underpromise & over-deliver vs over-promise & under-deliver. When you over- promise you're raising expectations that you can't possibly meet, but when people have nothing to compare the product to, e.g. the first iPhone/iPad and it's launching in days/weeks, not some ethereal date subject to change a year or more away. Remember that HP-Windows 7 "iSlate" Ballmer showed off? Vaporware. Why even bother telling lies if it's only going to inevitably disappoint? Maybe they are just naive?

</comment></comment><comment><USER7> I've had a change to play with it for about 2 minutes recently and now, after reading this review, I'd absolutely love to have it. If only I had the cash ... Well I could probably afford it, but then I'd want to upgrade my Bold 9000 too, and that would amount to some serious shortage in my wallet :)

I'm really happy for RIM (as this looks like an awesome product), everybody is "picking" on them and basically putting them into a grave. I really hope PlayBook turns this trend around a little and they return to their former glory.

</happy-bb-user>

</comment><comment><USER8> Interesting that you would neglect to tell readers how warm / hot that baby got after playing with it for a while. Also, make sure you mention how cheap and easily breakable the buttons felt on it.

</comment><comment><USER9> I'm impressed by the UI, at least on video. It looks responsive and fluid, and the bezel gestures seem to work well. Not an easy feat!

</comment><comment><USER10> The consensus seems to be "it's solid, but not special". I guess RIM needs to keep working even harder now to actually determine whether their tablets make it or not.

The good news for them is that starting 1 year behind the competition doesn't necessarily mean they won't be able to carve out a profitable slice of this rapidly growing market in the future.

<comment><USER11> The business market, where RIM has had a lot of success, seems to prefer "solid, but not special". I don't think they will do as poorly as many seem to think. Everyone compares it to the iPad, which feels like more of a consumer toy than a business tool to me. I think there is definitely overlap, but I don't think it is trying to be the iPad. This is good, because if it were, it would fail.

To someone that does not want to play games or watch movies, all of those features stack up to absolutely nothing. I opted for a Kindle DX over an iPad 2, and some people think I am crazy. It does what I need, and does it very well. That's all the PlayBook has to do to be successful.

<comment><USER12> The PlayBook's #1 priority should have been to leverage the popularity of BlackBerries among existing enterprise customers. The PlayBook should have tightly integrated support for RIM's BlackBerry messaging services and Microsoft Exchange. Instead, the PlayBook does not even ship with email, calendar, or address book apps!

<comment><USER11> It does, just not at launch. At launch, you have to use the AES-256 bridge to your existing blackberry.

[http://www.engadget.com/2011/03/29/blackberry-playbook- faq-c...](http://www.engadget.com/2011/03/29/blackberry-playbook-faq-confirms- native-email-calendar-and-cont/)

<comment><USER13> In fact, the AES-256 bridge possibly means even -faster- adaption as opposed to all native apps. Big corps would insist on all sorts of due diligence and ridiculous testing for a brand new model connecting to their BES (I've seen how long a certain company to get the 9700 approved...). With the BB bridge, way less silliness to go through.

<comment><USER14> Actually if a company is already paying for your blackberries data plan it may not like to pay for another blackberry device. But if you can use your phone a a bridge and save the need to have another data plan I think it is an excellent idea.

</comment></comment></comment></comment></comment></comment><comment><USER15> RIM is not a credible player in this market based on my reading of this review. They are a year plus behind, yet they all but promise that there will be multiple form factors (and therefore screen sizes) for PlayBooks. Have they thought through what that means? More developer complexity. Or some disgusting, fugly AWT-like layout manager hell. If there's some enormous development matrix that publishers need to deal with in order to get their products working with a _maybe_ number three player, RIM is doomed. Seriously, I don't think anyone there understands how to launch or grow a platform or do quality product management, which often requires making tough choices and sticking with them. E.g. three sets of APIs, recall... (Android support for app "tonnage".)</comment>


Ask HN: Which project management and team communication software do you use? - <AUTHOR> <comment><USER2> I love Clubhouse.io. Best description I think can be a nicer looking Trello on steroids. It has a focus on software development management, but nothing stopping you from using it for any project management. Pricing is also reasonable.

Using Asana as well for a different project.

—

For non software dev, stopped using/didn't go back to a type of app I've always had a soft spot for because of pricing. App being Basecamp and apps heavily influenced by it like Teamwork.com. It's just myself, my partner, and a freelancer right now. So Basecamp only price of $100/mo and Teamwork having 5 user minimum at $9/mo (so $45/mo), ends up not being worth it. I'd love to find an app like these for a more fair price.

</comment><comment><USER3> * [https://taiga.io/](https://taiga.io/) for project planning

* [https://ryver.com/](https://ryver.com/) for team communication (Slack clone)

* [https://connect.yandex.com](https://connect.yandex.com) (like GSuite, but free)

</comment><comment><USER4> Trello.

We aren't a tech company (though I subscribe to the every company is a tech company, some just make things) and I'm the only programmer.

Trello is by far the most intuitive tool for none-trivial I've seen, if anyone knows of a better one I'd be interested.

Since Trello had an API I just integrated against that the bits I didn't already have.

<comment><USER5> I subscribed for startinfinity.com beta and it seems they are solving trello limits and have really great UX.

</comment></comment><comment><USER6> 1\. Zulip (Slack clone with proper threading)

2\. after evaluating Kanboard and WeKan we decided to keep it simple and reuse the Gitlab (issue-tracker) as a Kanban board (we already used gitlab anyway so this was something everyone was familiar with).

<comment><USER7> Just want to mention that Zulip is not a Slack clone. The development of Zulip was started in August 2012[1] while Slack was released in August 2013. Folks who are interested to know more should take a look at [https://zulipchat.com/why-zulip/](https://zulipchat.com/why-zulip/)

[1] [https://github.com/zulip/zulip/commit/ea43d2e40e59cb0240ea36...](https://github.com/zulip/zulip/commit/ea43d2e40e59cb0240ea362fe30f9a435a4a2a1f)

</comment></comment><comment><USER8> Riot [https://about.riot.im/](https://about.riot.im/) (and therefore Matrix [https://matrix.org/](https://matrix.org/)) for chat. Kanboard [https://kanboard.org/](https://kanboard.org/) for kanban board. Gitea [https://gitea.io/](https://gitea.io/) for git (and Drone [https://drone.io/](https://drone.io/) for CI)

</comment><comment><USER9> Email - Seriously having tried out literally everything I could, email is still the both worst tools and best tools for the job. Worst because you cant really get much efficiency out of it, best because everyone knows how to use it and there is no learning curve involves.

</comment><comment><USER10> For project management: Redmine[1] and analog whiteboards.

We picked Redmine back in 2012 because you could have multiple repositories in a single project.

[1]: [http://www.redmine.org](http://www.redmine.org)

</comment><comment><USER11> A text file and git. The analysis compiler does all the grunt work. If we want a UI we sync with Trello. (Disclaimer: I wrote the book on making stuff people want with minimal overhead, so my preferences are probably biased towards extreme simplicity and maximum flexibility, not graphs or reports. If you're handling information like that, the UI, graphs, and reports are a fairly trivial issue.)

</comment><comment><USER12> Too many!

We started off all ad-hoc, in the room chatting about stuff, and when we got a remote team, we switched to TFS, with phone calls and Skype. Someone suggested Slack, so we tried that, and then someone else suggested Teams, so we tried that. Now we've got loads of different people on different platforms, and no- one ever knows the best way to communicate any more.

We need to work on our communication...

</comment><comment><USER13> Asana + Slack mostly (and github issues). Trello with its card management did not worked really (although I like it).

<comment><USER14> In my experience Trello is fine until your cards don't all fit on the same screen.

</comment></comment><comment><USER15> Tuleap [https://tuleap.org](https://tuleap.org) for Scrum, Kanban and Source code management (git)

Mattermost [https://mattermost.com](https://mattermost.com) for instance messaging (way superior to slack, esp. for thread management).

</comment><comment><USER16> JIRA and Slack.

We started off with just the development team using Slack, and the rest of the company using Skype. Now we all use Slack internally, and Skype when that's all clients have.

I think the reason that the company moved to Slack was cost based, but really I think they wanted to play with the integrations :)

</comment><comment><USER17> Hey, we've been really unhappy with most of the solutions. So we did the only right thing and build our own.

If you want to work Agile and need something easy & beautiful to plan and manage your projects give it a shot:

[https://scrumpy.io](https://scrumpy.io)

</comment><comment><USER18> Mostly just plain old Open Source stuff: mediawiki (same as wikipedia), an IRC server, an email server...

I find it weird that people tolerate depending on anything else. You are at the mercy of some other company. They can cut features (for example, confluence killing wiki markup compatibility to lock users in), they can jack up the price, they can totally discontinue the product, they can switch licensing, they can require an always-on backdoor for "upgrades" or "licensing", and so on. Why would you tolerate this risk to your business?

</comment><comment><USER19> We use Confluence and JIRA. I have created a business process that uses both to create requirements and a specification that turn into a set of tasks to program.

I have wrote a short post on how to apply GTD with JIRA if your interested [http://tysonmaly.com/gtd/how-to-user-jira-for-getting- things...](http://tysonmaly.com/gtd/how-to-user-jira-for-getting-things-done- gtd/)

</comment><comment><USER20> We started using excel for task lists and gantt, google drive, slack and whatsapp (yes, whatsapp). We tried Trello for the Kanban view. Lately we started using ZOHO Projects. So far its been great. Especially after their recent update. Its got all the functionality of EVERY tool I mentioned earlier. I, for one, am not a big fan of using Whatsapp for official communication, and post Zoho Projects, we only use Whatsapp to plan team outings :P

Its free. Give it a shot.

</comment><comment><USER21> At Work : TFS 2017 (On Premise), most of the communication is done at the coffee break.

At Home : Used to work with Gitlab CE on a Raspberry Pi, sometime Github. but most of the time a local git repository is enough (so nothing). We used Gitlab / Slack for a project with a group of friends, but moved to Telegram.

</comment><comment><USER22> I've been using Slack and Trello most recently but I've found it difficult to keep track of communication between several tools.

So I've been building Seat ([https://www.useseat.com](https://www.useseat.com)) to bring the best of Slack and Trello together in addition to document management.

</comment><comment><USER23> Jira, Confluence, and Google apps for most persistent things. Google hangouts and Discord for communication.

We have no requirements for any particular tools, so it's really organic. Team-members, leads, managers have freedom to try new tools. We use what works until it doesn't.

</comment><comment><USER24> Trello (with Planaway) and Slack

We are looking into switching Slack to Hangouts Chat (why pay for 2 services when you can do it with 1). However we are getting mixed feedback from our test users… Anyone here with Hangouts Chat experiences?

<comment><USER25> We shifted from Slack to Hangouts Chat about 3 months ago.

It has generally gone down pretty well. It has nice features like the way it makes posts in Rooms their own 'threads', and allows the user to enable or disable notifications per 'thread'. Also, as you say, the cost for Chat was included with our G-Suite license.

However, as a SysAdmin it doesn't have the same level of administrator controls that you see in more mature products, such as Slack (and even Discord). In my opinion it is still very much in beta and Google need to keep adding to the admin and end-user features before it really competes with Slack.

</comment></comment><comment><USER26> [http://www.targetprocess.com](http://www.targetprocess.com) \- project management

[http://slack.com](http://slack.com) \- team communication

</comment><comment><USER27> I used Clubhouse at a previous workplace and really liked it. [https://clubhouse.io/](https://clubhouse.io/)

</comment><comment><USER28> Anyone know of a tool that integrates with Jira but allows for "executive reporting" on timelines, delivery dates and the likes, akin to a Gantt?

<comment><USER29> I think Tempo does that stuff.

</comment></comment><comment><USER30> Slack and Asana or Trello.

I've been using Discord quite a lot outside of work and it seems like it would work well as a Slack replacement. Has anyone used Discord for work?

<comment><USER31> I haven't yet used Discord for an actual company, but I've used it to manage and organize several projects now, some quite large. IMO, it beats Slack in every way. I really can't imagine using Slack for any new project/organization at this point.

<comment><USER14> Have you hit any limits when pinning files to a channel? It's pretty tempting to try Discord instead of Slack at this point.

Well, the ideal work messenger would be a Slack clone (maybe with threading options) with native apps as clients, instead of javascript turds, but I guess that's never going to happen.

</comment></comment></comment><comment><USER32> JIRA, Zulip, and G Suite. I hate JIRA with a passion (everything's 10 clicks away, I never know where to click), but Zulip and G Suite are pretty good.

</comment><comment><USER33> Do you know a such tool where all database (issues, tasks etc) is stored into a git repo ? I am considering to do this using org-mode (for my own 1st).

<comment><USER34> [http://www.bugseverywhere.org/](http://www.bugseverywhere.org/)

</comment></comment><comment><USER35> Excel (I kid you not) and Skype. Does that count? :)

<comment><USER36> Same here - with a side of Slack.

</comment></comment><comment> db-dzine Ora - free & perfect for small to mid projects.

[https://ora.pm/](https://ora.pm/)

</comment><comment><USER37> IRC, textfiles, pastebin links and a remote filesystem accessed with sshfs. It's for an oss project.

</comment><comment><USER38> Trello & Taiga. (Also partially Github Projects) Discord, Skype Zendesk G Suite & Office 365

</comment><comment><USER39> Pivotal tracker/Slack

Very happy with the setup

<comment><USER40> Pivotal tracker's flow is excellent when you get everyone on board!

<comment><USER41> Does it force any particular process / workflow? I'd like to try it but the investment of time and social capital in trying a new tool that doesn't work out for the team is very high.

<comment><USER40> Yes, it has one workflow, personally I think it's a good middle ground between simplicity (like Github issues) and completeness (like Jira), there is this 8 min tutorial on it here: [https://youtu.be/bzCZysm5lG8](https://youtu.be/bzCZysm5lG8)

I agree with the investment thing, can't help with this one though :)

</comment></comment></comment></comment><comment><USER42> the usual suspects: JIRA, Confluence, (lots of) email, WhatsApp groups and cisco webEx.

</comment><comment><USER43> Jira, Confluence, email, WhatsApp groups.

So much email. So, so much. Some Rocketchat usage but not huge.

</comment><comment><USER44> Notion.so for project management and documenting stuff. Highly recommended.

</comment><comment><USER45> Jira, trello, skype, a lot of bloody email,

Sharepoint, badly. Starting with confluence.

</comment><comment><USER46> Slack & GitHub Issues

</comment><comment><USER47> Slack and keka is the best project management and team communication software. [https://goo.gl/bBsbMr](https://goo.gl/bBsbMr)

</comment><comment><USER48> GitLab tickets and wiki, gsuite, twistapp.com

</comment><comment><USER49> MS TFS and MS Teams. pretty happy with it.

</comment><comment><USER50> Rally - I feel brain-damaged already...

</comment><comment><USER51> Microsoft Teams and Planner

</comment><comment><USER52> Redmine, xmpp/jabber.

</comment><comment> eugene-s ActiveCollab + Slack

</comment><comment><USER41> Trello, Slack, Zoom

</comment><comment><USER53> VSTS + Slack

</comment><comment><USER54> Crocagile

</comment><comment><USER55> JIRA

</comment><comment><USER56> monday.com and MS Teams</comment>


Exactly-Once Messaging in Kafka - <AUTHOR> http://ben.kirw.in/2014/11/28/kafka-patterns/ <comment><USER2> I'm the same 'mjb' from the linked lobste.rs thread. If anybody is interested I expanded that comment into a blog post here: [http://brooker.co.za/blog/2014/11/15/exactly- once.html](http://brooker.co.za/blog/2014/11/15/exactly-once.html)

The core problem here is making the act of writing down that you've done something atomic with doing the actual thing. If you can solve that problem, exactly-once processing is easy. If you can ignore that problem, for example because doing the thing is idempotent, exactly-once processing is easy. In the real world, however, it can be really difficult to solve these problems in general and very specific (and often 'incorrect') solutions are used. OP's post talks about a bunch of those, which is very useful.

Very often, though, real-world systems settle for 'at least once' or 'at most once' and find out-of-band ways to handle the missing or duplicate messages. Whether this is practical or not depends on the message rate, and the cost of getting it wrong.

<comment><AUTHOR> Hey, thanks for the excellent writeup.

I enjoyed and totally endorse the content of your blog post, but I did find the title / intro a bit misleading. Exactly-once is pretty much always what people want: it's the easiest model for most folks to reason about, especially when they're new to the whole distributed-systems thing. (If exactly-once delivery was easy, you certainly wouldn't find people going out of their way to build systems that dropped or duplicated messages.) Of course, you might not _need_ exactly-once delivery to get what you want -- which is good, because like you say, that's a hard / impossible problem to solve in general.

It feels to me like people in the stream processing universe have taken that message a bit too much to heart -- things like the 'lambda architecture' treat stream processing as "too hard to get right" and relegate it to approximate, disposable calculations only. My post was partly an effort to push back on this; as a community, I don't think we should give up without a fight.

</comment></comment><comment><USER3> Although indirectly related, the comments in [https://issues.apache.org/jira/browse/SAMZA-390](https://issues.apache.org/jira/browse/SAMZA-390) are also interesting reading (hi Ben!).

The Kafka/Samza ecosystem is coming alive with tons of neat ways to interacting with streaming data. For example, take a look at [https://github.com/milinda/Freshet](https://github.com/milinda/Freshet)

<comment><AUTHOR> Oh hi!

The Samza ecosystem seems to be a magnet for this sort of thing these days -- the community's really committed to taking full advantage of Kafka, and not just papering over it so it looks just like any other queuing system. Really excited to see where all this will lead.

<comment><USER4> Speaking as a bystander who mainly reads blogs, my perception of Kafka is that it's marketing (for lack of a better term) has successfully positioned it with "we can keep your arbitrarily large logs" and "they are pretty durable, consumers can revisit them if they fall behind".

This offers a nice distinction from MQ-ish systems, where the emphasis seems to be on a different set of benefits like "we can handle complex centralized distribution logic for you" and "we help manage your synchronous calls".

Does that seem accurate in terms of how Kafka is evolving its future niche? Personally, I'm interested in optimistic-locking when adding to a log.

<comment><AUTHOR> Yes, Kafka certainly is good at those things, and I suspect Kafka will only get better at them. But it's actually quite a simple bit of infrastructure at heart[0] and this means it's useful for a large variety of other things, many of which we're only figuring out now.

Re: optimistic locking... there are a couple proposals for this floating around, and I'm not sure which / if one will get in. It certainly seems consistent with the general mission, though.

[0] [http://engineering.linkedin.com/distributed-systems/log- what...](http://engineering.linkedin.com/distributed-systems/log-what-every- software-engineer-should-know-about-real-time-datas-unifying)

</comment></comment></comment></comment><comment><USER5> Some caveats about Kafka replication are discussed here: [https://aphyr.com/posts/293-call-me-maybe- kafka](https://aphyr.com/posts/293-call-me-maybe-kafka).

It is important to include these in the "exactly-once" discussion... (hard to be exactly-once if messages are lost broker-side).

Also, great discussion from Coda Hale about "CA" systems here: [http://codahale.com/you-cant-sacrifice-partition- tolerance/](http://codahale.com/you-cant-sacrifice-partition-tolerance/)</comment>


Second Life Ordered to Stop Honoring a Copyright Owner's Takedown Notices - <AUTHOR> http://blog.ericgoldman.org/archives/2011/01/second_life_ord.htm

<comment><USER2> But only a single owner. That's important, and the title doesn't even hint at it.

tl;dr - Someone is suing someone else and issuing copyright takedowns to Linden Labs since they are hosting the content. Judge apparently didn't think they had much of a case and ordered Linden not to comply. Article thinks this is a violation of Linden's rights and should be allowed to take it down if they want.

Personally, I do see the rights issue. It could have been worded better, I think... At least given Linden the option to ignore it, instead of forcing them. But the judge is trying to protect the rights of the defendant, and said defendant would be losing money if Linden complied. (Linden loses money as well since it takes manpower to comply, but it also takes manpower to ignore the takedown request. If Linden has streamlined their takedown process, I think it unlikely they have a section for Judges' orders of negation.)</comment>


Bitcoin Prices Down As Mt. Gox Concerns Escalate - <AUTHOR> http://www.coindesk.com/bitcoin-prices-mt-gox-concerns-escalate/

<comment><USER2> Hmmm... If you removed 6% of the world's gold supply (or even, if it were knowable, 3.5% of all the world's gold supply ever) you would expect the price of the remaining gold to rise.

Bitcoin dropping is a sign of panic and uncertainty in the market about the long term viability of it to retain value. If you're confident the underlying value still exists, as many people would do with gold, then this is a great buying opportunity.

/s/gold/commodity-of-your-choice I'm not trying to debate fiat currencies and gold standards here.

[Edit: Thanks to the commenters below for pointing out that the MtGox money hasn't been lost to the world.]

<comment><USER3> It hasn't been _re_ moved, just moved. Scarcity hasn't changed, but a question about what "ownership" means has been introduced. When I have a buck in my pocket, I have a buck in my pocket. When I "have" a coin in my wallet, do I really have a coin in my wallet, or just some bits that represent a previous state of a coin that has long since moved on?

<comment><USER4> I haven't looked in to the details but if it was in your wallet it would be safe. The issue is people leaving coins in online wallets where the security is in the hands of others (who really don't have the experience required).

<comment><USER3> The thing is that you can have many more than one copy of a wallet. Are you sure that you have control over all of them, and that they're all secure? Again, to go to the cash analogy: I know that the buck I have in my pocket is the only copy of that particular buck, that nobody else can spend that buck as long as I'm sure its in my pocket. Yes, bummer if I lose the buck, since there's no backup pocket with the same buck in it at home or in a safe deposit box somewhere. But at the same time, nobody can take my backup pocket and spend the buck that's in it, evaporating the value of the buck that I know is in my pocket.

<comment><USER4> I don't totally understand your analogy. I have my own wallet and I can keep that secure. If someone takes that from me it's akin to being mugged, or having my house burgled. That sucks but it's a bit different from giving someone else my wallet to look after.

With these exchanges, most people don't seem to know better, and treat them as banks. They're not banks, banks are regulated and governments make sure they don't just close their doors and walk off with your money.

<comment><USER5> I think the core of the analogy is not in the security itself, but in the user experience.

Unless you trust a third party, carrying a Bitcoin wallet with you becomes a hassle -- you have to set up software to pay from a given PC, and if you move between a lot of devices, you have to assume even your private keys for your wallet may be compromised.

I think at least when it comes to the experience, people would like to have BTC operations as seamless as sending money via their internetbanking or paying with a debit card.

BTC then becomes less useful if you still need a large entity to trust so you have a pleasant experience sending and receiving money. (Useful still, but less so.)

<comment><USER4> The usability is a huge and totally valid critisism, though I don't think for the reason you suggest. You can use software to allow you to sync keys between your devices. I use 1password - that's a fairly minor usability hurdle.

More of an issue is the bitcoin client software itself. It's a usability disaster. From every point of view - it's hard to use / understand for the layman. But even as someone technically minded, it's hard to figure out what you need from the software to manage your wallet. Given that all you need to keep your coins safe is a tiny bit of text that you can take with you - why is it so hard to get it out and in to the client software?

Edit: for a layperson the 1password hurdle is a lot bigger so you're right about how that's a major usability issue.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Cough, E-gold[1], /cough.

[1] [http://en.wikipedia.org/wiki/E-gold#Criminal_abuse](http://en.wikipedia.org/wiki/E-gold#Criminal_abuse)

</comment><comment><USER7> I'm a bit surprised/confused that the price has held as well as it has. [http://bitcoinity.org/markets/](http://bitcoinity.org/markets/)

</comment><comment><USER8> so someone got away with 740,000 bitcoins? at $500 per bitcoin, would that be the largest robbery ever?

<comment><USER9> Rogue traders at conventional financial institutions (Nick Leeson at Barings; Jerome Kerviel at Societe Generale) each cost their employer over a billion dollars, but they didn't keep the money. So, if the perp here got away with all the stolen BTC, it's big. Even if not, it's up there...</comment></comment>


Business ideas are dead; chase after market opportunity - <AUTHOR> http://paraschopra.com/blog/entrepreneurship/business-ideas-are-dead-chase-after-market-opportunity.htm?src=hn

<comment><USER2> Previously submitted, although no discussion:

<http://news.ycombinator.com/item?id=1949988>

In fact, I see that you, the same person, has submitted this twice, the second time putting a tracker on the URL deliberately to fool the dup detector.

I'm not convinced that's ethical.</comment>