HubSpot files for $100M IPO - <AUTHOR> http://betaboston.com/news/2014/08/25/hubspot-files-paperwork-for-its-initial-public-offering-of-stock/ <comment><USER2> S1 filing here:

[http://www.sec.gov/Archives/edgar/data/1404655/0001193125143...](http://www.sec.gov/Archives/edgar/data/1404655/000119312514320044/d697256ds1.htm)

Hubspot has always been a high burn rate business and it looks like it may be catching up to them. According to TechCrunch ([http://techcrunch.com/2014/08/25/with-money-tight-hubspot- lo...](http://techcrunch.com/2014/08/25/with-money-tight-hubspot-looks-to-tap- public-markets/)):

HubSpot's slim cash load and expanding losses — the firm had a deficit attributable to common shareholders of $16.37 million in the first six months of 2013 — are contravened by its rising revenues: HubSpot had revenue of $51.27 million during the first two quarter period of the year, compared to $35.08 million in the preceding-year calendar period. HubSpot's days of hyper- growth appear to be mostly behind it.

The theory is that they can control their burn rate and become profitably, but I am not so sure. As great as their software is, selling marketing software is a tough business and there is a lot of competition. Their S1 filing seems to indicate that they plan on keeping the burn rate high after the IPO in order to compete.

<comment><USER3> The challenge hubspot and some related business face is heavy reliance on service. In their case, it seems like most of the business is "coaches" to help SMBs with their content/inbound marketing. The amount of software/technology behind it is questionable.

Seems like the investment strategy is to go long within the first 60-90 days and then dump it once the public markets get hip.

<comment><USER4> > In their case, it seems like most of the business is "coaches" to help SMBs > with their content/inbound marketing. The amount of software/technology > behind it is questionable.

This is absolutely spot on. Lots of webinars, on-boarding, weekly training, more training than software oriented.

Source: someone who was trained up on Hubspot software in a startup.

</comment></comment></comment><comment><USER5> This is a good company. Just look at the numbers. Revenue is growing really well. Their biggest expense is head-count and this year they will almost break even (they are on route to 105M). This will also be the year were expenses growth will be the smallest(23%). 2013 they simply grew very fast - which was quite expensive (59% increase).

This year they are growing revenue really well, while their expenses are moderately increasing(less than half of last year). There is a very clear path to profitability in less than 24 months.

Revenues:

2011 —> 2012 -—> 2013 -—> 2014

    	 80% -—> 50% —-> 35%

Costs:

2011 —> 2012 —> 2013 ——> 2014

             35% —> 59%  ——> 23%

</comment><comment><USER6> I loved this bit from the TechCrunch article:

"The stock market has shown something akin to reticence in recent quarters when it comes to companies looking to go public that have large, sustaining losses."

[http://techcrunch.com/2014/08/25/with-money-tight-hubspot- lo...](http://techcrunch.com/2014/08/25/with-money-tight-hubspot-looks-to-tap- public-markets/)

</comment><comment><USER7> The only thing I know about they are the projects[1] on github on frontend stuff.

Their odometer[2] saved me on my last project, bussiness people love it.

1 - [http://github.hubspot.com/](http://github.hubspot.com/) 2 - [https://github.com/HubSpot/odometer](https://github.com/HubSpot/odometer)

<comment><USER8> Interesting library of gadgets. Thanks for linking them.

</comment></comment><comment><USER9> Wow, with a quarterly loss of $17MM, and having raised only $100MM, they really NEED this IPO to sustain operations at their current level.

<comment><USER5> No they don't. They have a $35M credit line that should get them 12 months. Further, most of their expenses are around Sales and Marketing, and further the increase in their expenses is mostly more head-count (not ad's etc.)

Reducing the sales headcount to last years head-count and they would be profitable by end of year.

<comment><USER10> Funny. I would have guessed that a profitable company would garner a higher valuation, especially since they don't need money, yet the company is pushing for IPO now.

I wonder why they elected to sell themselves short?

</comment></comment></comment><comment><USER11> These are honest questions:

1) Why should the public fund a company that could not get to profitability before its IPO?

2) Why, in public markets, a business with $1B in revenue and $10M in net loss has a higher valuation than a business with $30M in revenue and $10M in net income?

<comment><USER12> You can short the stock if you disagree with its valuation.

<comment><USER11> But shorting does not speak of the value as much as what others are willing to pay.

<comment><USER13> Value is only what someone is willing to pay for an asset. Shorting the stock allows you to profit off of your knowledge that the stock is overvalued compared to what the market thinks.

But remember, the market can stay irrational far longer than you can stay solvent.

</comment></comment></comment></comment><comment><USER14> Hubspot has a ton of assets to speak of that are taking off and not yet monetized at all or to their full capacity. Inbound.org, for instance is the HN for inbound marketing and has attracted a huge user base in their short existence. Tons of plans to monetize that and of course, drive more customers to their services.

They also have a great conference, coming up I beleive in Boston that is also not too shabby. Their content brand is also very much on point, their blog is a huge resource and ranks for basically any inbound/SEO type of query you could think up.

I'm not trying to argue against their profitability or growth, but Hubspot is a good company that has a lot of tricks up their sleeve. Dharmesh is also an extremely savvy individual who has elected a very capable CEO.

I don't know if I'd buy shares of Hubspot or not, but I will keep my eye on them.

<comment><USER15> >Inbound.org, for instance is the HN for inbound marketing and has attracted a huge user base in their short existence.

I agree, the userbase is high, but relative to their current revenues, even a well monetized Inbound isn't going to make a dent in their rev.

Also, the quality of the site is fairly low in my opinion.

Currently on the trending is a 2013 AMA from Rand. Over a year ago, the content is still on the homepage.

Dharmesh also recently posted a discussion about the ranking power of subdomains vs. subfolders. The CTO and founder of a company losing tons of money every quarter that doesn't have enough to last if they DON'T IPO is talking about a somewhat trivial (in the grand scheme of things) ranking factor [1].

[1] [http://inbound.org/question/view/it-s-2014-what-s-the- latest...](http://inbound.org/question/view/it-s-2014-what-s-the-latest- thinking-on-sub-domains-vs-sub-directories)

</comment></comment><comment><USER16> As a bootstrapped startup I was a bit skeptical of their pricetag but once I dedicated a full time person to train and exclusively work on it I've been incredibly impressed. Huge ROI and a strong increase in inbound leads requiring us to ramp up sales. Integrates well with Salesforce and they have a very rigorous onboarding program that must be contributing to that high burn rate. Glad to see a SaaS IPO in Boston stick around- they could well have been acquired years ago.

</comment><comment><USER17> It seems that simple, profitable business models are hard to come by these days with tech startups, especially in the SAAS space.

<comment><USER18> The common counterargument to this is that investors want to buy growth, not profits, and to maximize valuation you should give them what they want.

Profitable SaaS businesses are not rare. Profitable SaaS businesses which do $50 to $100 million recurring within fiveish years of founding? Those are pretty rare. (Most HNers could, if they thought through it carefully, name one example.)

<comment><USER19> I thought you were going to say "Most HNers could, if they thought through it carefully, create one" and I judged it over-optimistic. How over-optimistic I was!

</comment></comment></comment><comment><USER20> How is this happening? I thought the rule of thumb was $100mm/yr run rate and profitable before IPO, now. This business violates all of that.

<comment><USER21> You could also chalk this up to a global asset bubble. With all of these federal banks trying to keep interest rates down, money needs to be gambled on riskier investments in order to get any return. That's why it's now plausible for a company like this go to public. Have a look at ECOM. Almost the exact same story.

The sad thing is, a lot of pension money will probably be put into these "technology" stocks which are a lot of smoke and mirrors.

I am very familiar with ecommerce and SEO and hearing analysts and investors talk about these types companies is pretty astounding. The people investing tons of money in them have very little understanding of what they actually do.

</comment></comment><comment><USER22> Great to see. I was recently in their Dublin office, they seem to be doing interesting work, and doing it well.</comment>


Ask HN: Isn't VR an indirect competitor for the self driving car? - <AUTHOR> What's the benefit of streamlining the process of moving our carcasses when our senses can eventually travel for free at the speed of light? Yeah we need a distribution network to move inanimate objects, or for the occasional vacation, but for us consumers/workers don't we primarily drive today to connect our senses anyway.  #firstworldcommuteproblems <comment><USER2> By asking this question, you're essentially making a huge assumption. Firstly, Do humans drive to work to only connect their senses? When you say we "primarily drive to connect our senses anyways", you're diluting the purpose of the entire exercise of "working" to "connecting our senses". Which is false.

Consider the profession of driving. There will always be a need for "drivers", not just humans, for transporting goods, services etc. Is driving an exercise of just connecting our senses? No. It also involves performing actions based on inputs from these senses. Why would anyone want to create VR based drivers? It makes no sense, because self driving cars are already possible. Self driving cars have already won the competition in this case. This is the one scenario where VR and self driving cars compete.

Now consider the profession of software development. Here, let's say VR made it such that you wouldn't have a need to drive to work. Then, you wouldn't drive to work, but you'd still need to get places - for which a car (maybe self driving) is still required. In this case, again, self driving cars and VR are not competing. One has made removed the need for the other for a very specific purpose. This is not competition.

I think your question is asked with a very narrow minded view of "working". You're probably a software engineer. AMIRITE?

<comment><USER3> > but you'd still need to get places

Or places could come to you. Nearly all labour is likely to become replaced by robotics eventually. The human body could be seen as being there only to transport the mind; but when the mind gets its _information_ and _stimulation_ virtually, and when the mind's physical will is fulfilled by robots, there is no longer a need for the body to relocate.

</comment></comment><comment><USER4> It's a very novel way to look at it, but I think you're right. Constructed reality by its very design replaces the use of actual reality. We've seen this trend with the internet and I can only imagine it will continue.

People are driving less, interacting less, working from home more, and using screens more. I'm fairly confident this isn't going to change when you make staying at home even more convenient and pleasurable. It should naturally accelerate.

Take a look at this graph:

[http://blog.sgws.org/files/2012/04/MediaUseGraph.jpg](http://blog.sgws.org/files/2012/04/MediaUseGraph.jpg)

In fact, if you want to enter the rabbit hole of tech pessimism, read this report from 2010:

[http://docs.google.com/viewer?url=http%3A%2F%2Fwww.whywaldor...](http://docs.google.com/viewer?url=http%3A%2F%2Fwww.whywaldorfworks.org%2F06_Global%2Fdocuments%2FEURO- ScreenMedia.pdf&embedded=true)

It isn't pretty.

</comment><comment> thomas-b It's definitely an interesting way to look at how VR and robotics could affect us depending on the direction we take with it. I'm sensing a whole lot of Wall-E in that.</comment>


Sustaining git-annex development - <AUTHOR> https://campaign.joeyh.name <comment><USER2> We (rsync.net) are supporting git-annex by offering all git-annex users a heavily discounted rsync.net account.

This was announced a few days ago, but not on HN in any way:

[http://rsync.net/products/git-annex- pricing.html](http://rsync.net/products/git-annex-pricing.html)

We've been explicitly supporting git-annex on our platform since our friend Jason Scott first showed it to us[1] and we will be contributing to the new campaign.

[1] [http://ascii.textfiles.com/archives/3625](http://ascii.textfiles.com/archives/3625)

<comment><USER3> That's nice :)

And just so people know without having to check the site:

> git-annex users may sign up for our full featured offsite filesystem at a > rate of 10 cents per GB, per month. An annual payment is required, and the > minimum account size is 50 GB. There are no usage/bandwidth charges, no > signup fee, and no contract to sign.

<comment><USER4> Wow, that looks great. With the discount it matches S3's storage pricing, but without bandwidth charges, with a more convenient interface (an ssh-reachable regular filesystem), and full-service support. Plus an interesting attempt at a "warrant canary": [http://www.rsync.net/resources/notices/canary.txt](http://www.rsync.net/resources/notices/canary.txt)

<comment><USER5> That canary thing is an interesting trick, previous discussion here: [https://news.ycombinator.com/item?id=702247](https://news.ycombinator.com/item?id=702247). (Four years ago!)

<comment><USER2> We've been operating the warrant canary since early 2006.

</comment></comment></comment></comment></comment><comment><USER6> For those of you wondering whether this is worth supporting, the answer is Yes.

I work with a lot of smart engineers, and periodically ask them what they do for personal backup of images, video, etc. I don't think I've yet talked to someone who was satisfied with their system.

Git annex (with the assistant) brings me closer to my ideal system than I've been before: a drive at home, one in my desk drawer at work for fire-proof backups, easy automatic shuttling of data between them using my phone or USB sticks, and pluggable cloud storage if I decide I want it.

Oh, and a friendly, responsive and excellent developer behind it, developing software in a cabin, in the woods. :-)

<comment><USER7> Time Machine to a local drive for immediate restores. Backblaze for disaster recovery.

Time Machine could easily be replaced by cron and tar or some other local backup option. Other backup providers are easily found.

This is not to say anything about git-annex's usefulness or the value of supporting the developer. It just surprises me when engineers are still struggling with backups. I can kind of understand "regular folk", but that's not really the git-annex market, either.

<comment><USER8> Can you use Time Machine to shuttle data via a USB stick? How well does it work when you have more than two drives that you want to keep mostly synchronized?

<comment><USER9> Time Machine does the one thing it does really well, which is incremental, local (or network-local) backups and easy restores.

It's not for snapshotting or mirroring. I used to use CarbonCopyCloner to clone my boot drive to an external USB drive every morning at ~4am, so if the internal drive on my iMac died I had an immediate bootable replacement.

(And when the internal drive DID die, I just rebooted the machine and took nearly a year to get around to replacing the internal drive!)

</comment></comment></comment></comment><comment><USER10> The best part of git-annex assistant is that the developer managed to deliver, or even over-deliver what he was pitching in Kickstarter campaign. There wasn't a single week in the whole year where he didn't do some real work on the project. You can check his development blog [1] for details.

[1] [http://git-annex.branchable.com/design/assistant/blog/](http://git- annex.branchable.com/design/assistant/blog/)

</comment><comment><USER11>
        "Git-annex now auto-syncing photos from my android phone
        to a Tor hidden SSH service I control (via
        @guardianproject's Orbot) #prismbreak"

Interesting. I love to see how that is all set up. I'm wondering if that can be done with a Drobo. If not, what is required to get a mini-server set up that connects to Drobo over iscsi.

</comment><comment><USER12> I donated and I don't often donate (though I really should). It's not just how awesome the software is that compels me but his dedication to his work and his frugal lifestyle that leaves me wanting to support this guy with all his projects.

</comment><comment><USER13> His personal finances are really impressive. Selling his fulltime dedication for 12k/year...

<comment><USER14> His arrangements are interesting, to say the least, see [http://joey.hess.usesthis.com/](http://joey.hess.usesthis.com/) . The whole thing is worth a read, but here's a sample:

> So the whole house runs on 12 volt DC power to avoid the overhead of an > inverter; my laptop is powered through a succession of cheap vehicle power > adapters, and my home server runs on 5 volt power provided by a USB adapter.

<comment><USER15> There's also his notes to a caretaker: [http://joeyh.name/blog/entry/notes_for_a_caretaker/](http://joeyh.name/blog/entry/notes_for_a_caretaker/)

</comment></comment></comment><comment><USER16> Blimey, [https://campaign.joeyh.name/blog/initial_goal_reached_in_sev...](https://campaign.joeyh.name/blog/initial_goal_reached_in_seven_hours/)

Congratulations!

</comment><comment><USER17> How does git-annex compare to bittorrent-sync?

(I'm a big fan of Joey's other work, so I bet this is top notch, there just seems to be more momentum behind bittorrent-sync.)

<comment><USER18> bittorrent-sync is closed source.

<comment><USER17> I can't believe I missed that. Thanks!

</comment></comment></comment><comment><USER19> Can anyone give me an example of their usage of git-annex? The project looks interesting, but the most immediate usage I see would be to add big files (e.g. a database dump, PDF documentation, etc.) to a git repository. What else do people use it for?

<comment><USER20> I use it to manage my "archive" folder, which contains large binary files which rarely change. This includes music, some tv series, operating system .iso images, backups of retired computers, etc..

The great thing about git annex is that each clone of the repository has the entire tree structure of the repository, but by default has none of the data. So if I'm going on a trip I can just cd into the right folder on my laptop and type "git annex get ." or "git annex get Windows*.iso". Being able to tab- complete all the files in the annex even though you don't have a copy of most of them makes it very convenient.

The numcopies constraints also help enforce redundancy on the data. I could use raid to have local redundancy, but that only protects against a harddisk crashing. If I have four repositories in different physical locations and set numcopies to three, then git annex helps make sure there are always enough copies of a file (in three different physical locations), so I won't lose data even if my house burns down.

</comment></comment><comment><USER21> I can't remember why I didn't switch to git-annex from Unison, although it did put me onto bup (which still doesn't quite do what I want either).

I think my biggest problem was by and large I want a versioning sync tool, and worry a lot less about managing what's on my devices.

<comment><USER20> I think you can automate most or all of that with the git annex assistant now (and I think most of its functionality is exposed as commandline commands as well, so you don't have to use the GUI if you don't want to).

</comment></comment><comment><USER22> Is there a German cloud storage provider that I can use as a git annex remote?</comment>


Musings about Debian and Python - <AUTHOR> http://notes.pault.ag/debian-python/ <comment><USER2> I didn't realize there was a fight going on.

It seems like this is where everyone settled and is a good solution:

Virtualenv + pip for development

system wide (apt, dpkg) python etc for system tools and packages.

This makes sense to me. Keep your personal code sandboxed from your system tools.

As an aside, I know there are quite a few tools and programs in both Debian and Ubuntu written in Python. I wonder if we'll look back in 5-10 years and realize/think this was a mistake. Particularly for UI code. I love me some Python, but I cringe every time I have to interact with a Python GUI application.

<comment><USER3> > I cringe every time I have to interact with a Python GUI application.

How are Python GUI applications worse than C GUI applications?

<comment><USER2> Performance

<comment><USER4> I never noticed any performance problem with Python-based GUI programs. Well, calibre's start-up time is a little too long, but once it's running I don't notice any slowness. If you have a special program in mind, would you explain a bit about it?

<comment><USER2> I use Ubuntu, so I don't know if these are in Debian as well, but Jockey and Ubuntu Software Center come to mind.

My main issue with them is the common symptom where both "hang" or "freeze" for a few seconds. Visually this can look like the window gets grayed out for a bit (common in Jockey) or it it is just stuck for a few seconds with no clear indication anything is happening (more common in Software Center).

EDIT: I should note that I've previously written a few PyGTK apps and have recently started writing Ubuntu Touch apps via their Ubuntu SDK (Qt/QML). I've found that Qt/QML/Ubuntu SDK is a much better experience in both writing the app and the responsiveness of the resulting application. And I'm by no means proficient in QML, I'm just starting out.

</comment></comment></comment></comment></comment><comment><USER5> I have a slight tangent to this topic: Why does every language need their own package manager? I can understand avoiding a specific distro's PM but do we need to reinvent the wheel for every single language? Do we need to poorly reinvent Make just so the build syntax matches the source?

It seems like a better solution would be to declare a common interface, both to users and to tools, for each language's package system. At least that way there's some guarantee (or at least a strong hint to the author!) that any given tool would support some nice-to-have extra functionality.

A use case for me is that I see a really neat thing Foo written in an unfamiliar language. Install instructions go something like: "Just run 'simple_make foo' to try it out!" or perhaps "Just run 'curl [http://get-foo- bar.baz/rootme](http://get-foo-bar.baz/rootme) | sh -'". Okay, now perhaps it's installed. It might even be installed where I want but it probably won't be. But what happens if I need to update it? How can I keep all of these pet projects up to date? I have to go and learn easy_install, gem, leiningen, sbt, maven, npm, go, quicklisp, cabal, etc.

I mean, I'm not too lazy to read up on each tool but it adds up quick and not every tool supports an Autoconf-like --prefix or apt-get {update,upgrade}.

<comment><USER6> Because everyone hates centralized package info manager, for instance, Windows Registry.

</comment></comment><comment><USER7> Where I like to draw the line between apt and rubygems/pip is between "things that are base system" and "things that are app deployment". So in a typical rails stack that would be apt installs the system-wide stack (apache, ruby, passenger, rubygems) and then capistrano is used to deploy my webapps with their gems from my dev machine to their app-specific directory in the production server.

This way I can have my sysadmin hat on while setting up the server and depend on debian/ubuntu to handle security upgrades and generally create a consistent system. Then I can put my devops hat on and use capistrano and bundler to manage the security/dependencies of my own code.

But I see where this breaks down. If the base stack is moving at a much faster pace than the distributions (e.g., right now the version of passenger in Ubuntu LTS is incredibly old) it's attractive to just ignore the system packages and install everything from original sources (e.g., install ruby from source with rbenv). But doing that is just throwing away the integration work the distribution has done. I'd much rather include some extra repositories to get updated versions that integrate through apt for the few things that I care to upgrade faster than Ubuntu LTS allows me. Right now that's puppet, passenger and a few more.

<comment><USER8> I agree with you. The pain occurs when this breaks down. Take Vagrant, for example. Brilliant tool. Depends on gems that weren't distro packaged for years.

This made Vagrant unusable for anyone not deploying a ruby-based application stack, unless sysadmins accepted that they were going to have to deal with the extra work associated with multiple vendors and update mechanisms for each language on the system. So those of us using other stacks could use Vagrant, but only if we adopted Ruby's app-level packaging system. See [https://news.ycombinator.com/item?id=2059964](https://news.ycombinator.com/item?id=2059964) as an example of life being made difficult for distro packagers by the Ruby community. Since Rubyists tend to insist that distro packages are bad, so this is how it tends to stay.

Thankfully the packaging of Vagrant and dependencies has now happened (finally; after years), and I can "apt-get install vagrant" now. But I hope this illustrates the problem.

In the common use case, there is a dichotomy between distro and app-level dependencies, packaging and development. But in the grand scheme of things we all want to share our work across communities, and this dichotomy is a barrier to this ideal. Dependencies don't just go in one direction with language module repositories like pypi and rubygems at the top. Sometimes we want parts of the system to depend on them, too.

<comment><USER7> I think the issue is one of development speed. Currently things like passenger and puppet are behind on Ubuntu LTS packaging because their development cycle is much faster than LTS releases. Apache on the other hand is well past that point, while nginx is probably somewhere in between. Right now I install passenger through gems but I'll be moving that to the just released deb repository the phusion guys have just released and eventually I expect development to quiet down enough that Ubuntu's packaging will be up to date enough. So basically I expect software packaging to evolve in three steps:

1\. When in fast development get it from gems (my case with passenger now)

2\. When it starts getting mature (or as soon as you have resources to do enough QA) build a deb repository (puppetlabs does this for puppet)

3\. When it becomes stable and boring just use what's in the system (apache and thousands of other things)

Moving from step 1 to 2 is probably not natural for a lot of ruby (and python to a lesser extent) developers because they see their software in the context of apps that are "things you deploy to a host" not "things that are part of the base system".

</comment></comment></comment><comment><USER9> I don't want to start any argument, but there is a reason why Stallman recommends writing GNU packages in C (so that users don't need to acquire and install all kinds of dependencies, and not just them). I certainly think again about installing something when I see that the software is written in Java or Python, mostly because I don't like to bloat my system.

<comment><USER10> What actual concrete problem do you have with 'bloat' due to languages such as perl?

</comment></comment><comment><USER11> "I prefer virtualenv based setups for development"

I'm a _casual_ python user and I find virtualenv to be very helpful.

</comment><comment><USER12> The design of this blog is so good that I almost didn't notice how good it is.

<comment><USER13> (author here)

D'aw, thanks so much. I really appreciate that. I identify as a OS-level hacker, and very focused on _code_ , not _design_ , so it means a lot to hear such kind words when I put a bit of effort into it.

Thank you!

<comment><USER14> It was really confusing trying to see how you did the large letters at the start of the paragraphs because Firefox's inspector didn't show the css rules for :first-character since the DOM element selected was the <p>.

</comment></comment></comment><comment><USER15> I think I agree with the blog post in its entirety, as a fellow Pythonista / Debianite. The Debian packages that are released always seem to be top-notch, stable, and fit for production. (Let's forget the OpenSSL incident, shall we?) I don't fear that the new version is going to break my currently installed software, and I'm not worried about dependencies somehow having been missed causing havoc. It just works.

(And when it doesn't, it's because I did something deep within dpkg/apt I should not have.)

I can't say I've always had the same experience with other distributions which is the reason why I moved to Debian in the first place. Truthfully, I can't ramble any specific scenarios off from the top of my head.

Any time I've had an issue with a Debian software package, the bug threads have always been constructive with proponents for both sides explaining why it should be one way over the other. Eventually, the best decision is made (even if I personally disagree).

However, the sacrifice for this stability is the fact packages can become a bit 'stale' when it comes to new versions. I don't mind sacrifices like this. And if you need newer stuff, that's why backports exist.

If you want the latest and the greatest use pip. But for the love of all things, couple your pip usage with a virtual environment. Hell, even if you aren't using pip get in the habit of using a venv.

My only bad experience with virtualenvs was a recent Python security update (related to /dev/random). The system libraries changed, the Python executable in the venv did not, sadness ensued. Even then, once I figured out the issue, it was a quick fix. Just re-init the virtualenv, and it fixed it for me. No need to move code around.

In short, if I want a stable system I don't need to babysit, I go with Debian. I trust the people maintaining the packages. I use virtualenvs for 90% of my Python development, and use pip inside of those venvs.

Hasn't failed me, yet. Probably shouldn't jinx myself...

</comment><comment><USER16> In my opinion package management is a non-solution. It doesn't solve many obvious problems (all your software is tied inside release cycles, tied to shared libraries and you can't have multiple versions of the same package installed), plus it operates under assumptions that don't even make sense anymore (we're not distributing 3rd party software bundled in floppy disks anymore to tie dependencies together).

Installing applications as containerized packages (e.g., Gobolinux, OS X .app) should be the norm. Both apt and pip get it wrong because they don't solve any of the above problems by themselves (hopefully you can use pip+virtualenv to achieve containerization, and more recently, LXC).

<comment><USER17> So your point is that there should be no shared dependencies, or centralized collections of trusted software?

<comment><USER16> > So your point is that there should be no shared dependencies

You can have both, where it makes sense, instead of everything being shared by default (e.g., you can provide all your software a base OpenSSL version). See how FreeBSD solves that with jails and sharedfs.

> or centralized collections of trusted software?

All you need for that is app signing (e.g., App Store). You can still update apps independently, there's no dependency management.

</comment></comment></comment><comment><USER18> The background of this post is a thread on the debian-python mailing list, relative to a new PEP:

[http://lists.debian.org/debian- python/2013/09/msg00049.html](http://lists.debian.org/debian- python/2013/09/msg00049.html)

</comment><comment><USER19> Or do what I did: give up on Python packaging and use Go or a JVM based language that produce single artifact deployables.

I have been in this Python mess far too long. Now I just make a .war file or tell Go to compile for my target platform. Both result in single files that can be deployed without post-processing, installing/compiling dependencies or whatever ... it simplifies things for everyone. Developers, CI, packagers, ops, security folks.

<comment><USER20> > or tell Go to compile for my target platform

JFTR: the absolutely same is possible in Python.

<comment><USER21> what is the py2exe equivalent for linux /OSX ?

<comment><USER22> py2pp for the Mac. It appears there is a py2deb and py2rpm for Linux, and I imagine users of Arch, Slack, etc. would be expected to download a .tgz and `setup.py install` it.

<comment><USER19> Yeah py2deb or py2rpm are great. Now do the same for all your dependencies. And their dependencies. And their dependencies. And their ...

Single artifact does not mean 'your code'. It means 'the whole damn project including all dependencies recursively'.

Think myapp-1.0.war that contains all dependent JAR files. Drop it in a container and it runs. Or your Go compiled tool that is one single static executable that has no reference to external code or libraries. Run it and it works.

I know how I can package my own Python code. I am not too worried about that. I am however really tired of packaging the whole thing every time. And then dealing with stupid things like python packages that need a C compiler to build. Or specific patches to dependent C libraries. Or specific versions of things that some distro might not have. Or dependencies for which I need a newer version than the OS provides. Or .. sigh .. there are so many stupid gotchas that are complete time wasters to deal with.

<comment><USER23> The main thing you need to understand is that "source code" vs. "single deployable artifact" are impossible to evaluate without considering platform requirements.

Source code is very compatible across many architectures and operating systems but needs compilation, configuration, and dependencies. Binaries are highly compatible with a single platform and work out of the box. However they are not very compatible with any other platform.

The downside is that if you want any feature not provided by the JVM's abstraction layer, at the very least you are in the exact same boat as a python developer.

</comment></comment></comment></comment></comment></comment><comment><USER24> Debian set a bad precedent with their tightly-integrated approach to packaging perl. Users and developers (not unreasonably) expected python to work the same way, with pypi/apt interoperating just like cpan/apt.

</comment><comment><USER25> More background on Python's packaging methods and history: [http://aosabook.org/en/packaging.html](http://aosabook.org/en/packaging.html)

I'd also add that native packages tend to be far more repeatable when you have to deploy and update a lot of systems in any environment.

Note that with tools like fpm or other similar quick and dirty package generation tools, in general don't have to stick to the upstream system's development guidelines, but you get the benefits of using the native package tools.

</comment><comment><USER26> My post on this topic, which is in agreement with this post. [http://peterlyons.com/problog/2012/09/managing-per- project-i...](http://peterlyons.com/problog/2012/09/managing-per-project- interpreters-and-the-path)

</comment><comment><USER27> I like to get the best of both pip and the distro's native package manager ...

[https://github.com/jordansissel/fpm](https://github.com/jordansissel/fpm)

</comment><comment><USER28> well-written (and -typeset) article, although i think there is probably less controversy around this than the tone of the article suggests?

anyway, side note: switched from nm-applet to wicd-client and haven't looked back.

<comment><USER13> (author here)

Thanks! Pairing the fonts took a little while, and fiddling with it took a bit of time - so thank you! :)

Yeah. The goal here isn't to stir the pot in the middle of a massive flame- war, but it's the sort of thing where I see a _part_ of one of these viewpoints now and again.

The hope here is that this can be something that will be given out when someone expresses a viewpoint that starts to stir up this same-old flame again, as well as make people think a bit more seriously about issues regarding integration between language (and native) package managers (on both sides).

</comment></comment><comment><USER29> virtualenv and pip for your own project and use the package to satisfy requirements of installed programs.

</comment><comment><USER30> interesting that debian and perl have come to the same impasse as debian and ruby.</comment>


Do I have to do a startup in my area of experience? - <AUTHOR>

I work in financial technology in my day job but lot of startup ideas that I get are not necessarily related to financial tech. I have heard/read that you should usually try something in an area where you know what you are doing. Now I know there are exceptions or outliers. But in general, what do you guys suggest? For example, lets say hypothetically I might have an idea around CRM but no experience whatsoever. Would you ever jump into a startup like that ? Of course, I would commit more than 100% if I do but the question is: should I? <comment><USER2> No. You have to work on a problem you know exists. That usually requires some at least indirect experience in the domain, but it doesn't mean the domain has to be your main area of expertise.

For example, if you work in finance and notice that the company you work for can't find a teleconferencing service that does what they need, it would be fine to start a startup to build that.

<comment><AUTHOR> Well put. That clears my mind block. Thanks.

<comment><USER3> start from what you know. You'll find that the deeper you get, the more you learn about other areas too

</comment></comment></comment><comment><USER4> In general I think that working in an area you have experience in makes things smoother especially in the beginning. You know the pain points without having to do any research and have some initial "instinct" that points you toward potential solutions.

However, I strongly believe the most important thing for an early-stage start up is passion around the space/solving the pain points. The main reason is that working in a start-up is really hard and, at times, soul-draining. If you hit that depression phase and you aren't 100% committed to solving the problem you'll never pull out of the death spiral.

That being said, if you're passionate, you don't have to be an expert as long as you commit to becoming an expert quickly. Tons of breakthroughs happen when intelligent novices enter a space without the preconceptions of the existing leaders.

<comment><AUTHOR> good pointers. Thanks

</comment></comment><comment><USER5> I say no, because you would need to employ someone with the experience and this employee might tell you about existing solutions for the problem you are trying to solve and you might find that the competition in the market is harsh. Though you can always learn and gather experience from the area your problem is at, but this takes more time and money than finding someone else to do the work for you and you might still run into the same problem of existing solutions.

But then again if you know little bit about the field and can do your market research before continuing further to gain experience or to employ someone go ahead and do the market research for your business idea then you know if your idea is worthy of going forward.

</comment><comment><USER6> Same sort of situation here. Used to study aerospace engineering in college, then transferred to a new school to study music technology. Met a great co- founder and we'd been working on a startup specifically centered around the arts, but it fell apart as the school year came to an end.

Now that summer has started, we've begun work on a different startup (a new type of search engine, sort of...), but it's kind of new territory. We're pretty confident we're aiming at a fairly large target audience, but still scared as this is completely outside our area of expertise.

</comment><comment><USER7> You get to choose whatever kind of startup you (and your founders) want. At the end of the day, all that really matters is whether or not you can build a business off of your idea, not whether you have relevant experience.

</comment><comment><USER8> Sometimes it might be good to have no experience. It could make it easier for you to see the status quo from a fresh perspective. It could also mean that you end up reinventing failed solutions, though.

</comment><comment><USER9> you should do what you have a passion for doing.

do you have a 100% passion for CRM?

<comment><AUTHOR> CRM was just a hypothetical example I was using. So no. not really CRM. But I am passionate about learning and teaching. Got a few ideas bouncing and even working on a side project related to learning.

<comment><USER9> there may be other factors in your life, but i think if you have a real passion it's certainly worth exploring!

</comment></comment></comment><comment><USER10> No. You need to be able to execute in your area of interest.</comment>


Google this: Search giant is second-most valuable tech company - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-google-this-search-giant-is-second-most-valuable-tech-company-20121001,0,1649005.story

<comment><AUTHOR> Excerpt from above: "Google surpassed Microsoft to become the second-most valuable technology company. Only its chief rival, Apple, is more valuable than Google among technology companies."</comment>


So Long Polygons.  It's been a blast. - <AUTHOR> http://www.youtube.com/watch?v=Q-ATtrImCx4&ttl=1 Unlimited Detail is a new technology for making realtime 3D graphics.  Unlimited Detail is different from existing 3D graphics systems because it can process unlimited point cloud data in real time, giving the highest level of geometry ever seen. <comment><USER2> The discussion on reddit about this technology is interesting, especially if you're not familiar with how this is accomplished: [http://www.reddit.com/r/gaming/comments/bbg9c/unlimited_deta...](http://www.reddit.com/r/gaming/comments/bbg9c/unlimited_detail_the_end_of_poligon_based/)

Apparently there are drawbacks to this rendering approach, although this company has claimed to have solved them. I'd be interested to hear from anybody here what experience they have with this type of rendering.

<comment><USER3> I'm not too experienced with voxel rendering, but I'm familiar with the general problem.

The most visible ways that nvidia and ati are tackling the LOD problem is on- GPU tessellation. This means using a mathematically smooth surface (such as beziers or nurbs), and approximating it with polygons at the appropriate level for each frame. This means that if your lettuce is far away, it gets few polys (or culled). If it's 20% of your screen, it gets lots more. You can avoid popping artifacts because it's the same surface, just approximated differently, and it's not too tricky to get approximations that blend smoothly into each other.

If you need more detail that doesn't need to be animated, toss on a displacement map at relatively low memory cost.

True volumetric modeling works best for things that have lots of branching and void spaces, like dandelions.

Displaced surfaces work for lots of interesting things. See Mudbox and ZBrush galleries:

Mudbox [http://usa.autodesk.com/adsk/servlet/pc/index?siteID=123112&...](http://usa.autodesk.com/adsk/servlet/pc/index?siteID=123112&id=13587084&linkID=13552502)

ZBrush <http://www.zbrushcentral.com/featured2col.php>

</comment></comment><comment><USER4> this was posted a day or so ago here:

<http://news.ycombinator.com/item?id=1179970>

</comment><comment><USER5> The vibe of this and their accompanying website is plain weird.

Either they're hoaxing clowns or they have no idea how to communicate in a way that appears legit!

<comment><USER6> Lines like

"The result is a perfect pure bug free 3D engine that gives Unlimited Geometry running super fast, and it's all done in software."

Set off my bullshit detector immediately. I hope this is real, but I'd love to see maybe.. some sort of OpenGL extension, or demo app. I can understand wanting to be secretive, but he's got nothing to show at the moment but a lot of talk.

</comment></comment><comment><USER7> There used to be this fantastic game called Outcast on the PC (<http://en.wikipedia.org/wiki/Outcast_%28video_game%29>) That used Voxels too. The resolution was limited because of the processing power required but the graphics were impressive for the time.

Hoping one day that GOG (<http://www.gog.com>) has it.

<comment><USER8> According to the Wikipedia article about Outcast:

 _Although Outcast is often cited as a forerunner of voxel technology, this is somewhat misleading. The game does not actually model three-dimensional volumes of voxels. Instead, it models the ground as a surface, which may be seen as being made up of voxels. The ground is decorated with objects that are modeled using texturemapped polygons._

From what I see it was not a true point voxel system, but rather a ray tracing algorithm that was only used for the ground. Animated objects were still rendered using polygons.

</comment></comment><comment><USER9> Assuming this is legit, yes you can do animation with it. Probably with a minimal performance hit.

Keep all your sprite models separate from the main. For each sprite rotate the camera so you're viewing it from the same relative position you would be in the game, render it and put it to the right spot on the screen. As you do this for every object, you should be able to skip pixels you've already drawn. Once all the objects are up, draw the background and again skip all the pixels you've already done.

So again, if this works it should be able to do animations in a single pass, with just a little per-sprite overhead. (and they could well have overcome that too.)

</comment><comment><USER10> I'm still waiting to see how you're meant to animate a point sprite model.

<comment><USER11> The animation UI at 1:45 looks very austere, with the typography resembling a DOS app. I wonder why would that be.

<comment><USER10> I was aiming more at not being able to do the deformation required for facial animation or skeletal animation beyond rigging some prims together. To my knowledge it can't be done with this rendering technique.

Every model created for this is, for all intent and purpose, a piece of rock.

</comment></comment></comment><comment><USER12> As others have said looks like some sort of voxel raycaster. I wrote one a couple years back that got to about 1FPS w/o too much optimization so it's pretty conceivable that with better optimization and faster hardware you could go much faster. The big problem with building scenes like this is that the datasets get really big really fast. There's a lot of interesting work happening in the area, in particular id's upcoming stuff and the GigaVoxels project.

<http://www.youtube.com/watch?v=HScYuRhgEJw> <http://www.youtube.com/watch?v=VpEpAFGplnI> <http://artis.imag.fr/Publications/2009/CNLE09/>

</comment><comment><USER13> Sounds a lot like a raycaster engine (i.e. what was used in the orignal 1992 Wolfenstein 3D), except in 3-dimensions instead of 2.

<http://en.wikipedia.org/wiki/Ray_casting>

<comment><USER14> I was going to say the same thing. That or some kind of fast search variant of something like a geoindex used on geospatial servers.

</comment></comment><comment><USER15> So is it essentially "indexing" point data like Google indexes content?

As someone mentioned, this makes me think animation or changing stuff in real time would be difficult (since the indexing part of it is slow) but I don't have much background in this area.

<comment><USER9> No time to find a link, But I recently read an article about google tweaking their index from a once a month task to something they can do in 10 seconds. (though obviously they are also throwing hardware at that problem.)

</comment></comment><comment><USER8> There is absolutely nothing new in this movie compared to the one which was submitted a couple days ago. Even the description that supposedly goes into more detail about how it works is cut and paste from the Unlimited Detail site.

</comment><comment><USER16> Hey makes perfect sense, why calculate for any point that is not visible.

I wonder if physics calculations play into this.

<comment><USER17> This happens with polygonal renders, too - it's called occlusion culling.

The problem is that point clouds can't be easily animated, and forget about applying physics to them, which makes them fairly useless for realtime gaming.

<comment><USER18> What about for rendering 'virtual reality,' Quicktime3D type environments? Like to give people virtual tours over the web.

<comment><USER19> Games and graphics look great nowadays, the need to do something just for the tech is not a real driver. Why would someone invest the time in this and static when they can also add interactivity? Until it can do interactivity, real-time, lighting, animation, collision detection/physics, etc better, faster and stronger, it will not take the market for graphics.

<comment><USER18> Well one thing I was thinking about is this 'laser-scan' technology for modelling real world objects. Perhaps the appeal of a quick, light, easy method of rendering detailed environments (albeit static) will prove very popular. Usually when I see static 3D demos on television (for instance on Grand Designs, a new-build architecture show, or computerized replays in soccer), they meet the bare minimum in aesthetic appeal.</comment></comment></comment></comment></comment>


Gif2png 3.0: Code Ported to Go - <AUTHOR> http://www.catb.org/esr/gif2png/ <comment> martin-t I'd like to point out the previous version written in C might have multiple vulnerabilities. The author has shown complete disregard for security, closed issues reporting them [1-3] and tried to make fuzzing harder [4].

[1]: [https://gitlab.com/esr/gif2png/issues/5](https://gitlab.com/esr/gif2png/issues/5) [2]: [https://gitlab.com/esr/gif2png/issues/6](https://gitlab.com/esr/gif2png/issues/6) [3]: [https://gitlab.com/esr/gif2png/issues/7](https://gitlab.com/esr/gif2png/issues/7) [4]: [https://gitlab.com/esr/gif2png/commit/a8a761561b2a071e7452a0...](https://gitlab.com/esr/gif2png/commit/a8a761561b2a071e7452a00868efd5bdf795c443)

He also seems to think (potential) UB is an issue with the optimizer instead of his code as indicated by this comment: [https://gitlab.com/esr/gif2png/issues/1#note_150727440](https://gitlab.com/esr/gif2png/issues/1#note_150727440)</comment>


Google quietly rolls out a car insurance price comparison service in France - <AUTHOR> http://thenextweb.com/google/2013/08/05/google-quietly-rolls-out-a-car-insurance-price-comparison-service-for-drivers-in-france/

<comment><USER2> They've been doing this for at least a week in the UK, since I was directed to them by moneysavingexpert.com when I renewed my car insurance last week.</comment>


Using Machine Learning to Name Malware - <AUTHOR> http://lqdc.github.io/using-machine-learning-to-name-malware.html

<comment><USER2> Really, is this just consensus? I'd be more interested if it were analysing the malware to name it, not what the various labs are calling it.

This malware definitely _isn 't_ called kkrunchy. .kkrunchy is farbrausch's perfectly good executable packer for their 64k/etc demos. It is not malware, and it doesn't obfuscate (that wastes bytes!). ryg would probably be disappointed people are using it to wrap crappy hosts-file malware, and every AV should have a library of depackers handy anyway - the AVs detecting it as a generic are being disappointingly 1990s-era dumb.

People did the same with fsg and even UPX, of course, as well as a various commercial packers/obfuscators. I think the relinker generation of crunchers (crinkler, MEW, etc) tend to even have "please do not pack malware with this" licences as a result.

<comment><AUTHOR> It's consensus but it takes account how popular the name is elsewhere and tries to pick a more hipster name. If 5 AVs say this is the family for this malware and you don't see that family much elsewhere, then that would be picked as a family. That way you get rid of all the "Agent" type families etc unless there is nothing better.

Would have been cooler if the content was also taken into account.

Regarding packers I agree, but it is kind of the same situation with every other packer, including Themida and VMProtect. So some AVs decided to call it by the name of the packer since they probably see a lot of malware packed with that packer and not much else.</comment></comment>


Paul Krugman on S&P and the USA "It's a strange situation." - <AUTHOR> http://krugman.blogs.nytimes.com/2011/08/05/sp-and-the-usa/?smid=tw-NytimesKrugman&seid=auto

<comment><USER2> Krugman has long ago given up any pretense of neutrality, and fails to outline any reason this downgrade doesn't make sense. Every metric you could come up with indicates the US is more likely to default now then say... 10 years ago. The road to this has been a long time coming, and both parties share responsibility.</comment>


How to swear in Swedish - <AUTHOR> http://www.everything2.com/title/How+to+swear+in+Swedish

<comment><USER2> Alot of those sentences and words are wrong or just outdated.

For example: "Har du piss i huvudet, eller?" I've never heard anyone say that in my life, if someone by chance would use it. Sure by the tone its used by, the person who hear it will know the meaning of it. But at the same time don't really care because of the time-line it actually was used, the person using it wouldn't be perceived as a threat.

Sure the Swedish has a unique way of swearing and insults. But the most frequently used like, "shit/skit" and idiot. Both are also frequently used in the English language with the exact same meaning.

</comment><comment><USER3> Go to reddit. flagged.

<comment><USER3> Who gives a shit about Swedish anyway...</comment></comment>


Welcome to yahoo - Sign in with Google or Facebook account - <AUTHOR> http://i.imgur.com/jSZxHlR.png

<comment><USER2> Clickable: [https://login.yahoo.com/config/login](https://login.yahoo.com/config/login)</comment>


Nodej - node.js on the JVM - <AUTHOR> https://github.com/projectodd/nodej <comment><USER2> Interesting. I wonder how much work it would be to port this to AppEngine. Then, you could host node.js apps from Google's infrastructure.</comment>


OpenCL-capable 50 GFLOPs compact development board - alok-g http://www.extremetech.com/computing/146765-amd-launches-gizmo-explorer-an-overpriced-raspberry-pi-competitor

<comment><AUTHOR> This looks more interesting as a competitor to the Parallella than the Raspberry Pi.</comment>


Red Pens and Invisible Ink: Editors do their work behind the scenes - <AUTHOR> http://www.slate.com/articles/arts/books/2017/05/the_delicate_author_editor_relationship_as_seen_in_the_insect_dialogues.html <comment><USER2> Where have I heard a quote along the lines of "a writer is someone who isn't good enough at writing to become an editor"? I've been looking for the source without finding it.

<comment><USER3> Not sure. A lot of writers hate editors. But I would say "good editors know why they are bad writers."

<comment><USER4> A lot of writers hate editors, it's true.

But almost all of them desperately need to be edited.

</comment></comment></comment><comment><USER5> If you found this interesting, here are some really insightful tributes to and stories about Bob Silvers of the New York Review of Books -- a world-class editor who passed away recently: [http://www.nybooks.com/articles/2017/05/11/robert-silvers- tr...](http://www.nybooks.com/articles/2017/05/11/robert-silvers-tributes/)

</comment><comment><USER6> > At time of Browne's second interment, the vicar recorded the age of the > deceased as "317 years."

That's the last line from the Cabinet magazine that is mentioned.

</comment><comment><USER7> Much of this relationship exists in one form or another with coding, though perhaps a little inverted, with writers and architects. When you're writing alone for yourself, publishing or not, you can with certitude feel 100% ownership. The second you open the door just a crack to another set of eyes, that question is less certain. Add in individual egos and you have the cocktail that endlessly spawns "creative differences"</comment>


Signs Of Evolution In Modern Man - <AUTHOR> http://listverse.com/science/top-10-signs-of-evolution-in-modern-man/ <comment><USER2> The last item mentions that the little toe is useless, which I don't think is true. I recall hearing about people who've lost that toe, and still needed physical therapy to learn how to walk properly without it. We can't do much with the toe itself, but we still depend on it for load balancing.</comment>


Expertise and passion - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2008/12/expertise-and-p.html

<comment><USER2> I'd always hire a person for his passion.</comment>


Why Developers Should Not Use MacBook Pro - <AUTHOR> https://hackernoon.com/why-developers-should-not-use-macbook-pro-3b6a4aeeee64 <comment><USER2> I used Linux a long time ago and issues I had were not the large cases described here, but little things that wear down my soul like: \- where did the program get installed? \- how to I uninstall the program? \- where is x file(s) \- what is the command for this? \- why do I need a command? \- i updated the OS and it won't reboot. Now what? \- I updated it and now it won't connect to the printer. Now what?

The issues were boundless. While Mac isn't what it used to be, it's still awesome for so many little things that I no longer even care to think about and for that reason I'm not inclined to switch. I don't even like using Windows at all anymore and it's not an issue of preference, the do of my caring regarding preference are behind me. Now it's just a simple issue of general irritation and performance at work.

Just my two cents as an older dev.</comment>


Show HN: ShelfLife, a social commerce platform for collectors - <AUTHOR> http://www.shelflife.net/?utm_source=hackernews&utm_medium=post&utm_campaign=showcase_shelflife

<comment><USER2> "Blocked, category games"

I think perhaps it's matching on *lflife and making some assumptions?

<comment><AUTHOR> What's blocking you? A corporate firewall?

</comment></comment><comment><AUTHOR> ShelfLife co-founder here. We're aiming to document to every collectible ever made, and provide collectors with the best tools for buying, selling, and tracking their collections.

<comment><USER3> Awesome site, I've had this idea many times I hope it takes off.

Question: How general will catalogs be? I collect keychains, will something this general be supported?

<comment><AUTHOR> Thanks! Nearly anything can be catalogued, provided there's information available for it (E.g. manufacturer, release date, etc), and it's not something like the sweater that your grandmother knitted you.

<comment><USER3> Ehh that might be hard for keychains. Thanks for the info!

</comment></comment></comment></comment><comment><USER4> Have to check out the Canadian version of DD. Site looks promising but lacked the few things I am interested in. Hope it takes off and I encounter it again.

<comment><AUTHOR> What do you collect that isn't on ShelfLife yet? There might be a curator working on it right now.</comment></comment>


SVG Is The Future Of Application Development - <AUTHOR> http://www.sitepoint.com/blogs/2008/12/22/svg-is-the-future-of-application-development/ <comment><USER2> I don't follow any line of thinking that presumes widespread adoption of anything on the basis of HTML/CSS/JS being inconvenient or impure. As if that has ever stopped us. Time has shown that the collective energy of a million developers butting their heads up against those limitations is enough to keep things moving forward an inch at a time. The web is a messy and inconsistent place and will undoubtedly remain so for a long time to come.

As for Silverlight and AIR, well, they might taste like pumpkin pie, but I wouldn't know, etc.

( p.s. for anybody using WebKit nightlies: <http://webkit.org/blog- files/animation-demo.svg> )

</comment><comment><USER3> Considering the standard has been in development (<http://en.wikipedia.org/wiki/Svg>) since 1999 (10 years ??) this is a sad state... the future of app development?

The article thankfully mentions IE exactly once. Microsoft does not officially support SVG, you need a plugin.

Even Chrome does not support the SVG 1.1 standard fully, as per the wikipedia article.

Browsers need a standard, natively supported graphics library sigh...

<comment><USER4> The raphael library he writes about looks interesting, it uses vml for internet explorer and svg elsewhere.

I had never heard about vml. According to wikipedia it is used by google maps as a replacement for svg in ie. That surprised me too: svg is actually being used by a very useful site.

</comment></comment><comment><USER5> I tried using SVG many years ago - but had to give up due to its lack of adoption and support by browsers. What finally killed it for me was Adobe announcing they were dropping development and support for their (aging) SVG viewer.

So I looked around - and turned to Silverlight, which is unusual for me as I normally avoid Microsoft technology on the philosphical principle that it will be closed, proprietary, idiosyncratic, designed for someone with a very strange view of reality and incredibly inconsistent from one version to the next. But \- Silverlight is XML - no nasty binary objects in the nackground, \- it implements .NET - which is close to a language standard and could easily become one \- it looks like the sort of thing that wold not be too hard for other platforms to implement \- and Microsoft might out their resources behind making it a wide-support platform \- and did I mention that it's pure XML. How cool is that!

SVG is ok, but very awkward to use in applications, and it was designed in a world where the verb 'to gooogle' did not exist.

</comment><comment><USER6> One context in which I've tested SVG is together with XUL, running on Firefox. The combination is brilliant for complex UI and makes you wish it was more widely supported.

<comment><USER7> Got a screenshot or something public? I think XUL is interesting and would love to do some app development with it, but I keep coming back to worse is better and HTML is good enough.

<comment><USER6> I've not got anything I made that I could point you at without a bit of work, although I was originally inspired to try the combination by an article [1] in German magazine c't. Source code for the example from the article is downloadable. [2] It's a simple calendar/timetable app, and they've built the calendar display in SVG, and the rest of the UI in XUL. It uses PHP & MySQL server side and should hopefully make some sense even if you don't know German.

[1] <http://www.heise.de/kiosk/archiv/ct/2008/5/202_kiosk>

[2] ftp://ftp.heise.de/pub/ct/listings/0805-202.zip

</comment></comment></comment><comment><USER8> I'm still hoping someone will release a solid SVG renderer written in Flash or Flex. There are a few projects that are most of the way there, but it would be really neat to have a feature complete one for SVG Tiny which allowed you to reliably render SVG graphics in IE.

</comment><comment><USER9> Check out the capabilities of the specification.

<http://www.w3.org/TR/SVGMobile12/>

It appears I just discovered a valuable, free, resource with untapped potential.

Happy Hacking!

<comment><USER10> SVG itself has no good implementations. Does SVG mobile?

Writing a specification with awesome capabilities is a lot easier than writing the software.

<comment><USER9> <http://code.google.com/p/svgfig/>

I just found this one.

Cheers!

</comment></comment></comment><comment><USER11> worthwhile comment by jonathansnook: "The problem with the current state of HTML is that it's elements for interactivity are quite limited without JavaScript. We have a limited set of form elements and then we fall back to the page request/response of old.

This is a problem that SVG does not solve. Sure, it might make certain presentation elements easier to create but that's more of a CSS issue than an HTML issue.

This is something that HTML5 is trying to address with additional input types. We'll still need JavaScript though to mimic more common complex desktop interactions like tree structures and tri-state inputs."

<comment><USER12> A more pressing problem with SVG is that it is like every other W3C standard: bloated, unwieldy, and obfuscated. Not to mention that SVG does not have all the capabilities of PS. PS is a complete turing complete language specialized for drawing vector graphics. SVG is more restricted and certainly slower to work with, not as well supported, and very very verbose.

<comment><USER13> > [...] and very very verbose

it's possible to write compact SVG. For example, it has a simple and very compact sub-language for specifying paths (with one-letter commands): <http://www.w3.org/TR/SVG/paths.html#PathDataBNF>

What do you mean by 'not as well supported'? SVG is supported by Firefox, Opera and Webkit (Safari / Chrome). I'm not aware of any Browser that supports Postscript.

As for turing complete: SVG is fully scriptable with Javascript, which is turing complete and built-in in every browser.

<comment><USER12> Every linux box in existence supports PS, very well. So does every PDF reader. That covers over 80% of all computers. Extending this support could be done through a plugin. Compare this to the fact that IE does _not_ support SVG and PS is a far better standard to work with in terms of vector drawing.

As to the turing completeness of SVG, how efficiently can JS transform vectors in comparison to PS. Not very fast.

Also, nobody wants to draw just paths.

<comment><USER14> "So does every PDF reader."

I don't think every PDF reader supports PostScript very well. Is that what you meant to say?

</comment></comment></comment></comment></comment><comment><USER15> if you need to support technology that brakes combaticility because you think thats the future and thats what stands between you and your productivity or success you may as well use flash which happens to be available today and cross platform.

</comment><comment><USER16> I'm looking forward doing more Silverlight + C# than anything else.

<comment><USER17> Ditto. And in the business world, like it or not, desktop applications are often still a factor. The promise of building Silverlight web pages in C# and being able to reuse them in a WPF desktop application is exciting.</comment></comment>


Python CoffeeScript directory watcher for cross-platform compiling - <AUTHOR> https://github.com/danenania/CoffeeScriptConverter

<comment><USER2> Thank you!

I am going to try this out at work where I am forced to use a windows desktop.</comment>


Apache HTTP DoS tool released - <AUTHOR> http://isc.sans.org/diary.html?storyid=6601 <comment><USER2> Put a reverse proxy in front. You should do this anyway. Modem and other pokey connections effectively do the same as this DOS.

<http://joshua.schachter.org/2008/01/proxy.html>

</comment><comment><USER3> There's really nothing new about this sort of depletion attack, and it's easy to launch in dozens of different ways in a line or two of code. (As far as a 'tool' to do it, I think the 'ab' benchmarking utility _bundled with Apache_ suffices.)

In response, you block/throttle origin IPs, and decrease timeouts so zombie connections are dropped more quickly, and increase the capacity to serve or shake-off troublesome connections without locking out legitimate traffic. An inbound reverse proxy, as joshu suggests, often makes this easier -- and keeps such enforcement cruft from complicating the primary server.

<comment><USER4> I think ab will send a full set of headers and not tie the server connection indefinitely.

<comment><USER3> Yes, but with concurrency/repetition/keep-alive, you can still tie up essentially all of the connections. (And it's plenty easy to open any number of hanging connections without 'ab', too -- a few lines of shell script, at most.)

</comment></comment></comment><comment><USER5> More info about this attack is available on <http://ha.ckers.org/blog/20090617/slowloris-http-dos/>

<comment><USER6> After reading the main article and the link you provided, my interpretation/understanding is:

* The idea is to trick the web server into keeping a connection open and waiting for data, e.g. by keeping on sending pointless headers, not sending enough (< content-length bytes of) data in the body, etc. Unlike a SYN flood or so, this doesn't require much traffic from the attacker.

* The reason this works is that apache has a limit of one thread or process per active connection, and there is typically an upper bound on

* The way to fix this once and for all in apache et al would be to handle socket I/O asynchronously, thus lifting the 1:1 ratio of connections to threads/processes.

Is that accurate? I'm mostly curious so that I can try to avoid any such pitfalls in any server software I might write.

One way to fix this in apache without breaking too many existing modules and extensions might be to use fibers to hide the asynchronicity and schedule them in the "blocking" I/O functions which would actually use non-blocking I/O underneath. (I don't actually know the apache architecture, so I might be wrong about the blocking I/O)

<comment><USER7> > I'm mostly curious so that I can try to avoid any such pitfalls in any > server software I might write.

If you start a thread for each connection, you're doing it wrong.

</comment></comment></comment><comment><USER8> So... you basically just hold open all the TCP connections at once? How anticlimactic.

<comment><USER4> Yes, but since it's Apache, anything like this is big news.

<comment><USER9> It was big news 10 years ago (literally, 2001ish) when these kind of attacks were initially discussed. Nowadays it's more of a big yawn as the script kiddies rediscover old playgrounds.

<comment><USER10> 10 years ago was literally, 1999ish.

<comment><USER9> Well, I _know_ I have seen tools released in 2001. And I'm quite sure the discussion was older than that. Anyways, put 8 years if you want, this isn't news either way.

</comment></comment></comment></comment></comment><comment><USER11> And this is news somehow? Color me unimpressed. First time we'd been subjected to this kind of attack was, what, a year ago? Maybe two. It's a trivial next step after the old boring flood of http get requests.

<comment><USER12> It's also not that difficult to counter. The easiest way is to just do packet inspection - if something looks wrong (repeated bad/incomplete headers), just blacklist the IP for however many minutes. Repeat ad nauseam. Any IDS worth its salt shouldn't even hiccup at this.

<comment><USER11> It's trivial to counter indeed; you don't need any packet inspection for that. The main anomaly is not in the header structure, it's in the number of sessions opened simultaneously by one host. This particular tool uses broken headers for some reasons; other ones don't. But they all open sessions excessively.

So you just use iptables connlimit match block the clients with more than e.g. 10 connections.

<comment><USER4> Actually, just blocking originating IPs would not stop a DDoS based on this. The simplest approach would be to timeout the connection if a credible set of headers is not received within a certain time.

This attack is based on the idea the attacker commands more resources than the target server. It doesn't fly very well.

<comment><USER11> Sorry, most of that is wrong :)

1\. No, it's not the simplest approach. The attacker can trivially send perfectly credible set of headers, then start receiving the response, acknowledging 1 byte per 30 minutes. It's routinely seen in the wild, too. Header-based approach completely misses the point of anomaly.

2\. Blocking originating IPs is perfectly effective as soon as all existing connections from the blocked IPs time out. Which is fairly soon.

3\. connlimit approach doesn't just block originating IPs, it prevents anyone from opening a lot of connections.

4\. In any real DDOS scenario attacker does command an order of magnitude more resources than the target servers.

[edit: formatting]

<comment><USER4> 1\. I don't think the client can acknowledge one byte per minute - I think the minimum would be one network packet. Anyway, the whole response would timeout. Apache has a config setting for that, does it (I have been using mod_proxy a lot and mod_proxy does timeout)? Perhaps, there should be a minimum bandwidth threshold that forces the connection to abort. I see your point, however. Even sending a real complete header should not prevent the request from being treated as hostile.

2\. I am not sure I got what you say. In a real DDoS attack, there should be a lot of different IP addresses and blocking thousands of them (many of whom would reset connection and come back with a different IP) would make the life of the firewall very uncomfortable.

3\. I know this has problems with proxies and firewalls with large number of computers behind them. I don't remember proposing this idea.

4\. It all depends on what is being attacked and how. I don't think any serious DDoS attacker would use this approach.

<comment><USER11> 1\. You're wrong, see rfc793. TCP flow control acknowledges streamed bytes, not packets.

2\. I just tell you what works in real life. Blocking 500 supernodes (out of 5000 machines botnet) is basically a non-issue for linux iptables on usual modern processes. Other 4500 are usually pretty tame in terms of firewall processing power.

3\. You didn't propose that, it's what we do (and what works best for these attacks). Its rate of false positives is sufficiently low. Folks behind NATs don't use sustained 4 connections per user, so it's usually a non-issue either.

4\. Well, you're wrong if you don't think so. Mitigating DDOS-es is one of the things i do for living [i'm in charge of web infrastructure of certain political opposition websites in Russia, if it rings any bells]. The scenarios i described is what actually happens.

<comment><USER4> Interesting. Acknowledging receival on two layers (packets and butes) makes little sense. Wonder why such decision was made.

About 4, are the DDoS aimed at your servers or at your office infrastructure?

<comment><USER11> They don't acknowledge packets, just bytes. It's pretty reasonable for a reliable streaming protocol.

Their DDOS attacks target our servers. For example, Russia has some issues with Estonia, opposition sites post some independent statements and news on that. Then comes DDOS.

<comment><USER4> Still, the overhead is large if it employs single byte confirmations. It turns symmetrical what could be an asymmetrical communication.

<comment><USER11> Sorry, wrong again. Stream byte acks are _way more_ effective than packet ones. Tcp endpoint can receive several packets of data and then send just one very small ack packet (you only have to send the byte stream position after the last received packet). I'm not sure what you mean by "asymmetrical", but that's probably as asymmetrical as it gets.

It's called "delayed ack" or something. Iirc, it's all described in rfc793.

<comment><USER4> What would be then the ideal way to fix Apache?

<comment><USER12> Apache doesn't need "fixing" - this is the job of a firewall or IDS or some other such anti-DDoS software. That doesn't mean they couldn't incorporate some protocol patch or use asynchronous I/O or some other crap, but the reliance shouldn't be on Apache to block this. If you're running a website important enough to DDoS, you should have a heavy duty firewall and IDS and possibly reverse proxy in place as well.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> what if we use NGINX as a reverse proxy in front of apache? could this be a good workaround?

</comment><comment><USER14> It's a pretty short code written in perl. I'd be scared if it was modified from curl or written in erlang. The author admits being corrected about the type of attack not being new but claims thats the first tool. I don't see how its new though. Whether you keep alive by incomplete requests, by valid requests or by sending post data very slowly, it doesn't seem to make a difference. Just eat up as many connections as possible.

<comment><USER3> That perl script is about 100x longer than it needs to be (even disregarding the embedded docs and ASCII graphics). This is a super-simple (and old) attack; many DoS attacks based on large amounts of traffic first cause problems by depleting this same limited pool of threads/connections.

</comment></comment><comment><USER15> woohoo!</comment>


Special Report: Bolsonaro brought in his generals to fight coronavirus - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-brazil-response-sp/special-report-bolsonaro-brought-in-his-generals-to-fight-coronavirus-brazil-is-losing-the-battle-idUSKBN2321DU <comment><AUTHOR> Couple of interesting quotes:

"When Brazil's first coronavirus case was confirmed on February 26, the Health Ministry had been preparing for nearly two months."

"'It's good that deaths are concentrated among the old," Croda recalled Vieira saying. "'That will improve our economic performance as it will reduce our pension deficit.'"</comment>


John Cochrane on University Finances - <AUTHOR> https://johnhcochrane.blogspot.com/2020/04/university-finances.html <comment><USER2> We have to look at Colleges and Universities as business models..... Some of the best run businesses in the country. All the more reason it makes sense for the NCAA to allow athletes to make $$ on endorsement deals</comment>


Australian author detained at LA airport - <AUTHOR> http://mobile.abc.net.au/news/2017-02-25/mem-fox-detained-at-los-angeles-airport-by-us-officials/8303366 <comment><AUTHOR> Mem Fox has previously visited the US 116 times and now _the author said she was unlikely to visit the United States again despite the friendliness of ordinary Americans._

 _She said the treatment of others in the airport holding room, including Iranians, Taiwanese and a Scandinavian parent with a small child, was just as poor, and all appeared to eventually have been released._

</comment><comment><USER2> This is a dupe of [https://news.ycombinator.com/item?id=13729770](https://news.ycombinator.com/item?id=13729770). Go there for larger conversation.

<comment><AUTHOR> Thanks. I would have expected the dupe detector to trigger when I tried to submit.

</comment></comment><comment><USER3> :(</comment>


Erik Naggum's library is for sale - <AUTHOR> http://twitter.com/xach/status/15202326009 <comment><USER2> Here's a direct link to the book list:

<http://www.xach.com/naggum/books/catalog.pdf>

I have to say, I'm impressed by the bookseller's professionalism. It can't have been easy to go through all the books, determine a price, and write notes on the condition. In some cases, there's even a summary and a note on the historical context of the book.

You can tell from the descriptions that some of these books are truly personal artifacts -- not just words on paper. For example, here's what it says on the m68k assembler reference: "Bumped to corners, covers very creased, dog ears, pages toned, a worn copy but pages remain clean and unmarked." You can tell that Naggum really used the book. For all the advantages of PDFs and e-readers, you still lose something.

</comment><comment><AUTHOR> I'm sorry for linking to the tweet, but Xach's livejournal appears to be killfiled here.

<comment><USER3> Why?

<comment><USER4> I seem to remember Zach posting a Hacker News exploit to his blog a long time ago. Seems a little harsh for it still to be blocked I suppose, but I would guess that's why.

EDIT: This is the post I'm thinking of: <http://xach.livejournal.com/214252.html>

<comment><USER3> Ouch. I'm a little drunk and wiriting with the iPhone keyboard on a cta blue line train, but Xach's suggested fix (sha1(k, msg)) has a horrible vulnerability in it.

</comment></comment></comment></comment><comment><USER5> Oh man, I miss his writing.

I wonder whether anyone will be interested in my library when I kick it? Memento Mori.

</comment><comment><USER6> Well there are only three copies of The Fountainhead in there so hurry up, don't delay.

Sarcasm aside, I should mention that it is pretty impressive that in his politics section he seems to have books from every single point of view.</comment>


Ask HN: How do we measure development productivity - <AUTHOR>

I work for a company where 99% of our products are coded in our India office. We have many teams with different areas of expertise.
We have great developers, and the ones that aren't great often leave of their own accord because they don't have the necessary skill/aptitude to grasp our business and code base.
That being said, we have a difficult time measuring productivity. Jim Collins says we need to get the right people on the bus and the wrong people off (Good to Great). I feel like we've got the right people on the bus for the most part, but each coding task that we give is so different that we're struggling to use metrics to assess productivity.
We've discussed having project managers assign arbitrary point values to each task, but we worry some developers might just game that system. How have you overcome this (we have 70 developers and will probably have 100 by the end of the year). <comment><USER2> _I work for a company where 99% of our products are coded in our India office._

First, are you working out of that office as well? If not, how can you accurately be assigned the task of figuring out which of these people are great and which suck? You wouldn't know them from Adam.

Second, define "productivity".

<comment><AUTHOR> I go over every 6 months and spend 3 weeks with my developers. It's less than ideal but it has worked for us so far (I think we recognize that productivity won't be optimal because of the distance, but we're careful with hiring to get good people).

To compensate for the lack of face time, we use GoToMeeting nightly to meet with whole teams or team members and to clarify questions. Each team there has a team lead who we want to involve in this measurement process, although we're still debating how best to do this (hence my post).

That leads me to define productivity -> we want our developers improving over time, getting more complex tasks done in less time as they progress. We're concerned that we're experiencing a plateau in productivity, but we're not sure (also leading me to post here).

<comment><USER2> _I go over every 6 months and spend 3 weeks with my developers._

In what other situation has this level of contracted, limited involvement actually worked? Generals with Soldiers? Coaches with Players? Parents with Kids? Teachers with Students?

If you can find a single like relationship that is similar and has worked demonstrably, please raise it. Until then, I'd ask what is so special about your situation that would mean that it isn't the expected norm...

 _It's less than ideal but it has worked for us so far_

Except that you are stating here that you are unable to measure which programmers are more effective than others. That doesn't seem like it's working to me.

Most managers, myself included, can tell you immediately by name who their best programmers are. When you see them day in and day out there is no way you can't do this. It's human nature.

You're asking for a methodology, but the solution isn't your lack of one, it's your lack of involvement. It is either for you to get more involved, or to relinquish this particular task to the person who is in a better position to make the call. If that person is in place and cannot make the call, you've got an issue with their performance, not your team's.

Good luck.</comment></comment></comment>