What sort of Internet fanatic are you? (Myers-Briggs version) - <AUTHOR> http://www.hyperorg.com/blogger/2010/06/14/what-sort-of-internet-fanatic-are-you-myers-briggs-version/

<comment><USER2> ETH--Except the T (Technodeterminists) portion where I would further refine it to say it is not the Net per-se that brings about transformations, but the people (us in here) who conceptualize it and build it for the end users.</comment>


Silicon Valley is the Only Place for Startups (based on PG article)  - <AUTHOR> http://www.marketingpilgrim.com/2007/10/silicon-valley-is-the-only-place-for-startups.html <comment><USER2> Argh. I never said SV was the only place for startups, just that all other things being equal it was the best.

<comment><USER3> Not that it matters, but the first sentence of the article says "only place...if you want to have the very best chance..."

"I don't care who writes the editorials if I get to write the headlines" is a relevant quote I heard a long time ago. I've looked but haven't found a cite for it.

<comment><USER4> I haven't found a citation either, but the name of William Randolph Hearst comes to mind.</comment></comment></comment>


Cheran: A town that threw out police, politicians and gangsters - <AUTHOR> http://www.bbc.com/news/magazine-37612083?utm_content=buffer3736b <comment><USER2> As a former "left-anarchist" I'm familiar with this sort of story. We had similar stories of left-anarchist utopias from (1) pirates (2) partisans in the Spanish civil war and (3) various "workers collectives" throughout history. None of them lasted and most collapsed due to _internal_ problems not being crushed by the nation state.

What has been shown to work in the long run, is Western democracy.

<comment><USER3> That is a very skewed view of history. The Roman Empire lasted around 400 years. The British Empire controlled the world for almost 300 years (and the monarchy is still in place after almost 1000 years), and those are only two examples. The US was _founded_ in 1776, The French Revolution, that gave birth to the modern Western Democracy concept happened around 1790, that is at most 240 years, and it only became predominant after WWI, so around 100 years. Although in my opinion superior (or maybe i'm just biased), western democracy is not assured to work in the long run, many countries after adopting it have gone back to monarchies or dictatorships. And after all, all forms of government that preceded it have been replaced.

<comment><USER4> Democracies are demanding the political leaders to limit their power both in mandate time-span and share of it by seeking consensus among parties with different views. This forces the governance to be moderate by design compared to chosen moderation of other forms of government. However, this presents itself as an attack surface from external powers. Political interference is way easier. Also, to be in democracy leadership role, considering its power limitations, may be quite frustrating if you want to get results quickly. This alone is enough to explain a few of relapses to dictatorships through power encroachment by ambitious political leaders. Add in here other political context deficiencies like weak political opposition and dirty (as in crime- like) measures of rivalry, and you get the idea. The populace may live "content" by various degrees in many forms of governance, but this is not what is supposed to comprise a defining differentiation. The real difference lies in the inherent ability to cope with various challenges (that have to be dealt with on political levels), my favorite of which is change in all of its forms. All forms of governance have benefits and drawbacks and employing the right one is tricky, it's an ongoing experiment that humans are yet to learn from.

<comment><USER3> We are in agreement then, democracies can fall for lots of reasons. They also have the potential to be very successful.

My point is democracy as it stands today is very young and if you only compare it against the failed attempts of Communism you will miss almost all of civilized human history.

<comment><USER5> Yeah that makes sense, but it seems fair to argue that relative to other forms of government, a properly balanced democracy which offsets the functions of government tends to be more stable and last longer than competing alternatives such as dictatorships or communism.

<comment><USER4> Dictatorship (or totalitarianism, my preferred term for it) is not assured to be unstable. If done right, the totalitarian regimes manage to periodically weed out the internal threats, including dissidence, and thus keep the remaining masses content, a trick employed at least since the dawn of written history with Ancient Egyptian police[1]. As I see it, the totalitarian political system however, being one of the most rigid of all, is more prone to corruption than others. (You may think of the pun about power tending to corrupt and absolute dictatorial power - absolute corruption, but I'm more about the precarious ability to react to different form of corruption.) The communism's main idea is to please the majority, which happens to be the mass of mediocre, at the expense of the the ambitious minority, the needs of which are taking a back seat. This makes communism a lesser environment for development, but it's not in itself a destabilizing factor.

[1] [http://www.reshafim.org.il/ad/egypt/law_and_order/police.htm](http://www.reshafim.org.il/ad/egypt/law_and_order/police.htm)

</comment></comment></comment></comment></comment></comment><comment><USER6> When reading stories like these, I sometimes wonder how happy these modified- subsistence-living folk are.

They will likely never see most places beyond their small farming-community town, probably won't do air/train/ship travel and they probably will never see even $X00,000 in net-worth.

But sometimes it seems that they are probably happier than the rest of us. Sitting in our cubicles, working 80 hours per week for 40-hour/week jobs, just to earn that little more money or get a slightly better job-title.

While they enjoy the land, the openness and live directly next to nature, the rest of us just "consume".

We eat, cohabit and slog away the valuable asset of time, just to repeat this cycle. We site behind keyboards, spending "10,000" hours mastering things that don't matter as much as the food we need from these kinds of people (who seem like farmers). We create pointless profiles and indulge in the gamification of these centralized ad-monsters, who steal our time through artificial "likes", "retweets", "upvotes", "stars", etc.

Granted, these people are homogenous and can make a system like this work. I just hope that the poison of alcoholism doesn't ruin them and what they're attempting to do in a country that is somewhat ravaged by drugs/cartels (or pointed out to be by the centralized mass-media cartel).

<comment><USER7> > But sometimes it seems that they are probably happier than the rest of us.

I remember one episode of Anthony Bourdain from years ago. He was in some South American country in a village and he went along to gather some yucca with a local farmer. Saying how great these people live in communion with nature and so on. And the farmer looks at him and says something to the effect of "you can have this, how about a trade". Meaning "you get to farm yucca and I go to live in your apartment in New York".

Not sure what my point even is, but I think it is about choice. It is ok if they end up living and doing that by choice, but if they are forced by circumstance they might feel trapped. We can go and start farming and living like this (I would certainly fail there quickly). But if they want to, they can't come and sit in cubicles and get paid for it.

<comment><USER8> it is not about living in NYC vs Mexican jungle. it is about living in Mexican jungle _with_ or _without_ gangsters/politicians/police. who knows, maybe we should try that too.

<comment><USER7> Sorry, I did diverge from the topic at hand. I didn't respond directly to the article but rather, the GP's comment made me remember something from a show I saw a while ago. So I wasn't talking specifically about Cheran but rather about the idea of how it might be nice to live a simple life like they do, and that often the simple part might be not as simple.

<comment><USER8> \- you are right, GP digressed first

\- our lives may not look that "sophisticated" to someone who travels to Monaco in private plane on a whim; all our "sophistication" is only in our heads

\- generally speaking, i was amazed how defensive most people in this thread became, when they faced the fact that somewhere _really_ far away in Mexican jungle _some_ people dared to chose to live without gangsters/police/politicians; people here are almost offended by that possibility and started coming up with poorly designed straw man arguments (like GP) just to take attention away from the subject

<comment><USER7> > i was amazed how defensive most people in this thread became,

I should have prefaced it with that I really admire what they did. When we protest in the West we go out and draw large sign and march in front of the White House. Then we go home to our warm beds. Or we write angry messages on the internet from the comfort of our own homes.

I think what these people did is the real form of protest.

<comment><USER8> "what these people did is the real form of protest"

yes! and personally i would say, that they returned to normal.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is all interesting food for thought. I can't say I am thrilled by what that town is doing, but I can imagine it is better than the _status quo ante_.

It makes you wonder if the nation-state model of government has been extended into places where earlier, tribal models would have been less bad. And Mexico isn't even much of a failure.

Here is the kind of thing that makes me quesy:

 _Its ban on political parties, meanwhile, has been upheld by the courts, which have confirmed its right not to participate in local, state or federal elections._

OK, I see why they have the ban. But it also to curtails the right of the individual citizens to vote. Should any collective really have that right in a democracy?

</comment><comment><USER10> Commenters who are framing this story in left/right/utopian politics are missing the point and not letting the brutality of the situation sink in enough to suppress their need to grind philosophical axes. It is a shame that apparently no Mexican HN visitors have come by to set them straight or perhaps they turned away in disgust at all the blather. I am just an ignorant gringo who has been briefly to Michoacan and heard talks by Cheran villagers at a conference, but anyone can see that these are heroic apolitical indigenous people who have invented a functioning government on the fly and under fire. One aspect that I have not seen mentioned outside of the talks I heard (and I am sorry that I could not quickly find a reference) is that early on they realized that choosing corruptible leaders would be fatal, and they came up with an unusual rule requiring that leaders be godparents - (a double filter as it requires unusual trustworthiness to be asked to raise children in the event of parental death and unusual generosity to accept.)

</comment><comment><USER11> > Political parties were banned - and still are - because they were deemed to > have caused divisions between people.

What an insightful thing to do.

<comment><USER12> Indeed, the North Koreans are proof!

<comment><USER11> NK actually has 4 political parties and independants.

</comment></comment></comment><comment><USER13> I admire this community banding together to kick out the (rather corrupt, if I understand Mexico) police, politicians and gangsters. It would be nice if most Americans would self govern at the same level, be we seem to have too many differences to be able to pull that off outside of the stray small town.

</comment><comment><USER14> Reminds me of the autodefensas, as depicted in the excellent documentary Cartel Land

[https://en.m.wikipedia.org/wiki/Cartel_Land](https://en.m.wikipedia.org/wiki/Cartel_Land)

</comment><comment><USER15> If they threw out lawyers and insurance companies, hell I'd move there :P

<comment><USER16> I doubt there are any lawyers or insurance companies in Cheran. I also doubt you'd want to live there. They did what they did out of a necessity most of us would rather not have.

</comment></comment><comment><USER17> _" It makes me want to cry remembering that day," says Margarita. "It was like a horror movie - but it was the best thing we could have done."_

Just reading the article almost brought me to tears, too.

</comment><comment><USER18> > _Every vehicle is stopped, its occupants questioned about where they have > come from and where they are going._

This is great and all, but it's not truly consistent with an American style of democracy which respects the rights of individuals to travel freely.

It's easy to imagine what would happen to any US city/county/region which set up a check point with the sole purpose of asking those questions of every person who passed through it.

<comment><USER3> Almost every country in the world does this. The US certainly does at every border. In fact, in the US you could be stoped and searched almost anywhere if police think they have even a hint of probable cause, and if they don't and just don't like you they might even create it.

<comment><USER18> Countries yes. But, in the OP, it's about a local region within Mexico. The checkpoints are created not by the federal government in Mexico, but by some people in a local region.

My point was that, within the US, a city/county/regional government would ultimately not be allowed to do this.

My comment was not about the US Federal government.

As for DUI checkpoints, though they are conducted by local law enforcement, such checkpoints do not ask people the same questions as the checkpoints in the original story and they do not exhaustively stop and check everyone on all the roads leading into a region.

So, I'm not seeing a serious criticism of my original comment.</comment></comment></comment>


Ask HN: How did you escape your 9 to 5 job? - <AUTHOR> I'm 26, single, and I work as a developer, I like the technical side of my job, the benefits of it, but I always see it as a temporary thing, and escaping the cube farm is a key for my ultimate happiness. Alongside my job, I tried some side projects, worked as a freelancer for a while, but never reached the point where I can quit, and recently I started losing my enthusiasm about the whole idea, but I'm still trying.<p>So I guess I'm interested to hear from those who were in the same boat that I am in right now, how did you escape your job? At what point in your career? And what are the risks and obstacles you have faced during your journey? Thanks. <comment><USER2> Become a contractor and work remotely. Search patio11 comments / threads on HN about it. This probably isn't something you do overnight, but create a plan, and hopefully in a year or two you'll be in a place to make it happen.

Maybe check out the monthly who's hiring threads posted on HN too and see what type of jobs are remote and what type of skills they are looking for. Adapt your skill set to fit their needs. Working remote is probably the easiest way to do what you are asking. Starting a company is many many time harder and you'll be working 9am-9pm 7 days a week.

It's not like you really escape the 9-5 working remotely, but you just have more flexibility with your time and location. You need to want it bad and be self-motivated. Find a way or make one.

<comment><USER3> This is very much the case. You will have to put in more work to start so you can expect flexibility in some spots but to ultimately be working more than you would in a 9-5 job

</comment></comment><comment><USER4> There are multiple options, and which one you choose is heavily dependent on your goals. And your goals will change over time.

I have done remote work, done consulting, worked less-than-full time as normal employee... depends what you want:

1\. Freelance/consulting. This requires an additional set of skills, marketing and sales.

2\. Create your own product. Even more emphasis on marketing, and another whole set of skills.

3\. Early retirement. Reduce expenses as much as possible, invest proceeds.

4\. A good job. Depending on your goals this may be less-than-full-time, or work from home, or remote work.

\---

A basic skill set you need to achieve any of these:

* Ability to work independently. If you need to be told exactly what to do at work none of the above are feasible except maybe early retirement. Beyond that, in demand valuable skills.

* Savings in the bank. If you are living paycheck to paycheck you have no negotiating ability.

* Negotiation skills, so you can negotiate what you need.

I'm working on a book on the subject, which isn't ready yet, but here's an excerpt: [https://codewithoutrules.com/2016/09/16/sane- workweek/](https://codewithoutrules.com/2016/09/16/sane-workweek/)

</comment><comment><USER3> Hi I am 25 years old and quit my job about a year ago started doing freelance work and starting my own company. I too saw my job as temporary so I decided to take my work life (most of our lives if you think about it) into my own hands. I think pulling that trigger gave me motivation and forced me to push myself much further than I would have ever been pushed in my old job.

A couple things I would recommend, do your research first and have a decent Idea of what you want to do after leaving. Think about how you are going to make it work and understand things may be slow in the beginning. I recommend having atleast a years worth of money saved up and expect to burn through a good portion of that before money starts flowing in regularly.

I worked my ass of for the first year and am still doing so. There have been frustrating times and epic times but each time I remember I wouldn't trade my decision and the experience for anything else.

I am now starting to build a freelance development firm and feel very confident about doing so because of what I have learned since quitting my job.

If you are a highly motivated person. I do recommend going out on your own at some point in your career.

<comment><USER5> So the canonical question in these sorts of situations is "how do you build your client base" and the canonical answer is "network, talk to past coworkers/bosses."

That being said, as someone a bit older than you and hoping to follow your same path, I've utterly failed at building a sufficient network to go freelance, and I'm amazed that you've managed to accomplish this so quickly. Do you have any tips for someone floundering in that part of the process? (I have lots of friendly ex-coworkers, but only one or two in the position or with the resources to actually spend money on me, most working for bigCos that already hire out contract work primarily to large agencies)

<comment><USER3> Lately I have been finding that is the most common question I receive.

To start I do a fair amount of networking from friends, past co-workers, CEOS I have worked for and so on. This part is continuous and you can reasonably expect to be doing it for as long as you are working.

I advertise with a website and my vision to almost everyone, even though they may not be in the position to hire me, they may come across someone who is and remember that they met an enthusiastic contractor who they know could do the work. This will pay off long term as people will start contacting you.

Lay down a vision for yourself and for your services. Where do you see contracting taking you? What can you provide to companies? Do you want to grow into a team of contractors? Do you want to only contract alone? What kind of contracting will you focus on to start, and what kind will you do further down your road map? These questions will help you strive to your long term goals and help you be more targeted in your short term goals. When you get going, don't forget to take time, take one day off from work and dedicate it to reflect on these questions and re-paint the picture so that it stays up to date with you and your goals.

Target one customer at a time to start. If you can live off of one small contract job, do it and do it well. References and Quotes are everything to start. These will help you land new customers and will become proof points. It also grows your network by large margins!

Be patient, it is expected to take a long time and a lot of effort to grow a network. I have met and worked with people that have spent their whole lives building their networks where most of their work is still focusing on that network.

I found it helpful to find a friend or co-worker that shares in your vision and is willing to share the journey with you side by side. This has not only validated decisions but kept me from losing enthusiasm too.

A good many things have lined up for me so far. It has helped that I know a few people in the recruiting industry and I have been able to gain insight from them about jobs around the country and how they work with customers and what customers are looking for. The job I left also has provided some opportunities for work as a co-worker of mine and me were valuable to the company and they wanted more work from us post leaving. The other option is to of course join a starting firm that is just starting out and enjoy doing the contract work with them and for their customers. Maybe its 1099 work maybe its W2 work but remember that if you take this option, learn as much as you possibly can from them and when you are feeling confident, take it on yourself.

<comment><USER5> Significantly more actionable of a braindump than many prior answers I've seen, thank you for the motivation and direction to push harder on this :)

<comment><USER3> No problem, I hope it helps and motivates you! Love to see developers take it upon themselves.

</comment></comment></comment></comment></comment><comment><USER6> One potential path is to gain FI, then you can do whatever you want. It can happen pretty fast on a dev's income.

My current favorite early retirement blog: [http://www.mrmoneymustache.com/](http://www.mrmoneymustache.com/)

<comment><USER7> FI: Financial Independence

<comment><USER8> Thank you!

</comment></comment></comment><comment><USER9> I wanted to escape the usual 9-5 for a long time but never got to finish a side project from scratch even though my /projects folder had many unfinished ones.

So I changed strategy and started looking for an existing side project that was bringing in at least some revenue (to prove customer and market validation). I found one such gem and bought it (thanks to some savings I had)

Since then, I have not looked back and now finally trying to actually work on my own new project that I am building from scratch. I am a lot wiser now so I know what to focus on :)

<comment><USER10> Can you share any resources about how to buy/where to find existing side projects that are profitable or at least have potential to be profitable?

</comment></comment><comment><USER11> It may not fit your case, but I quit from a previous job on a startup and I'm now teaching web and mobile development in a local technical university. Some people do not like to teach other people, but I like it mostly because it forces me to think things throughly, and I learn a lot about the inner details of things..

</comment><comment><USER12> Well, I think that the most important question you need to as yourself is why do you want to be free from the cube? Unfortunately, happiness might not be enough of a motive. Getting free would talk you plenty of work, giving up some fun things you do right now for the possibility of a great future. The problem here is if you WHY is not strong enough, it will be easy to give up and not complete the small actions you need to complete daily to stick to your goal. Once you have your why strong enough ( usually, this means that it's for a greater cause than just benefiting yourself) then you can focus on the strategy to get you there.

</comment><comment><USER13> Asked for regular hour contract with flexible hours wherever I go.

My first employer did this: Core hours were 10am to 2pm, and everything around that could be scheduled at the discretion of manager and employee.

Just carried that as a habit and example. As a people manager, lead by example. I've gone back to individual contributer so some days don't visit the office. Don't need to make the distinction of work at home vs. work in office, make it a bond on deliverables between yourself and your employer.

That doesn't not mean working until midnight or later because a deadline is imminent and I need to get the PPT perfect, but that's more a personal choice on quality.

</comment><comment><USER14> Just do it.

Can you save up $5k? Then you can live for a year in some parts of the world and work remotely :-).

If you fail, you would have traveled at least.

<comment><USER7> $5K seems immensely optimistic for a year, even if you exclude airfare. Do you have any links/blogs where people were able to pull that off?

<comment><USER15> Yes one can live with US $5k in a small city in India for a year, but not including the air fair to get here.

<comment><USER16> unless you're planning on living near poverty levels, to recreate US lifestyle in India you will need min. $1k/month (INR 70k).

<comment><USER17> I live in Bangalore spending Rs 20k a month. I live in 1 BHK with my wife and give Rs 10k in rent. Other expanses are around 10k or less.

One can have lavish lifestyle in Rs. 70k per month.

If you see yearly expanses , It will come at around $5000 , equivalent to Rs 350000</comment></comment></comment></comment></comment>


Snap CFO Tim Stone Is Resigning - <AUTHOR> https://techcrunch.com/2019/01/15/snap-cfo-tim-stone-is-resigning/ <comment><USER2> While Snap's poor product decisions and failing business are constantly called out in the media, what I don't see covered as much about the company is that their executives managed to massively enrich themselves by paying themselves huge bonuses right before the IPO and subsequent stock collapse.

Their "Chief Strategy Officer" Imran Khan: $100M+

[https://www.businessinsider.com/snap-ceo-evan-spiegel-cfo- im...](https://www.businessinsider.com/snap-ceo-evan-spiegel-cfo-imran-khan- big-stock-award-bonuses-2017-2018-2)

CEO Evan Spiegel": $637M+ (3rd highest CEO payout ever) [https://techcrunch.com/2018/02/22/snap-ceo-evan-spiegel- got-...](https://techcrunch.com/2018/02/22/snap-ceo-evan-spiegel- got-a-637-million-bonus-last-year/)

I'm surprised there hasn't been an investor lawsuit/class action yet. The whole thing seems like a massive pump and dump scam.

<comment><USER3> My understanding is that Evan's bonus was agreed upon years in advance when Snapchat turned down FB's various offers. The investors, represented by the board, wanted him to go for a large, somewhat risky, IPO instead of taking a sure thing and incentivized Evan to do so.

<comment><USER4> If true, this should be in their S-1 SEC filing right?

<comment><USER2> It is in their S-1 (page 135): [https://www.sec.gov/Archives/edgar/data/1564408/000119312517...](https://www.sec.gov/Archives/edgar/data/1564408/000119312517029199/d270216ds1.htm#rom270216_13)

What's interesting is that these execs, including the founder/CEO got renegotiated packages just before the IPO.

</comment></comment></comment></comment><comment><USER5> Snap is the living dead now. No users left after boneheaded redesign, all their ads running are promoting their competitors, employees I know are basically pulling the copper wire out of the walls.

Abandon ship!

Also, will somebody please make a simple private picture app for grown-ups? I'd love to be able to share stuff with my sig other/parents/grandparents - and that's it. I can't recommend SnapChat in the state it's in now.

<comment><USER6> I have about 10 family members on an Apple Photos shared album, whatever the latest name is. iCloud, probably. Not cross-platform though, obviously.

<comment><USER7> I'm pretty sure Apple still lets people consult iCloud photo albums through a website.

<comment><USER8> Yes - but it's a public site for anyone with the link.

</comment></comment></comment></comment><comment><USER9> They're a public company whose income over the last several quarters is consistently near or less than the negative inverse of their revenue. You don't need an MBA to know that even by bubble standards that ain't good.

They would literally have a more profitable business selling dollar bills for a quarter.

<comment> gamma-male An income cannot be negative

<comment><USER10> I think yours is a pretty accurate summary of OP

</comment></comment></comment><comment><USER11> My wife, who is obsessed with clickbait and loves buying nonsense-products from ads, recently quit Snapchat to use Instagram exclusively. That was my signal to double-down on SNAP puts. Straight to the bank!

<comment><USER12> > My wife, who is obsessed with clickbait and loves buying nonsense-products > from ads

Have you ever confronted her about that? Such behavior would be hard for me to tolerate, especially if it meant money out the window.

<comment><USER13> I couldnt care less about my SO's web browsing habits. Maybe I'm different.

</comment></comment></comment><comment><USER14> Prediction: Snap's stock price will tumble down over the next two years to around $1, at which point it will be acquired by Verizon Media.

</comment><comment><USER15> Is Snap actually dying? I recall there were similar news for Apple, Facebook(debatable on their current state) etc, but they rebounded back up.

Maybe this is the time to buy low and make it big (when everyone is doubting them). It'll be interesting to see.

<comment><USER16> They released a horrendous UI redesign and user count has been dropping for two quarters in a row now. IG's Stories feature (basically a snapchat clone) has 2x the active users of Snap and IG as a whole has over 5x the active users, and they are still growing while Snap is shrinking.

They've been operating for over 7 years and have yet to turn a single quarterly profit. With negative growth the past two quarters it's looking increasingly unlikely they'll ever be profitable.

</comment></comment><comment><USER17> I can't believe an app that is primarily meant for sharing nudity and more recently brand whoring had an IPO.

Oh I forgot about adding weird furry ears to photos for some reason.

</comment><comment><USER18> 1 year cliff, non-news

Still bad news for Snap confidence, of course

edit: didn't make it 1 year, whoops hope they got the golden parachute negotiated in

<comment><USER19> Useless comment.

Lasted 8 months at Snap, 20 years at Amazon. Something is clearly wrong with Snap, and it's their CEO.

<comment><USER20> I'm gonna have to agree with you on that. Successful 20 year veteran execs don't make big leaps lightly. Pulling the plug this quick is a very bad sign and you can't really blame "creative differences" or disagreements over control. In a public company the CFO role is well-defined and not subject to much creative opinion.

At a certain point you gotta start blaming the guy at the top.</comment></comment></comment>


Ask HN: Anyone got unused servers? - <AUTHOR> hello everyone!
Does anyone have some unused server with a very powerful CPU and at least 8GB of RAM?
I'd like to do some video encoding but I don't have the resources to buy my own servers, being unemployed highschool student.
However if anyone has unused digitalocean / aws (elastic transcoder) credits, or on any transcoding service I'd like to borrow them to do some encoding.
They should have at least 120GB HDD and at least 20 Mbps internet. I'm not planning to DDoS people, or to send spam, or mine bitcoin, I just want to run ffmpeg -i something.avi -c:v h264 -c:a libfdk_aac -q:v 26 -b:a 96K something_else.mp4.
In return, I can do a project for you, work for you (PHP, MySQL, Node.JS, Web design skills), be eternally grateful.
If someone doesn't think this belongs here, delete it, I'm not sure who to ask. <comment><USER2> I have resources, but they're not accessible to/from the internet directly.

If you want, upload your source file to mega.nz or something and give me a ffmpeg command to type in. As long as it's legal/not copyrighted/etc.</comment>


Xip.io: Wildcard DNS for Everyone - <AUTHOR> http://xip.io/ <comment><USER2> Just a heads up that services like these won't work behind security-aware DNS recursive resolvers (like OpenDNS) or routers (like Google Wifi) that block DNS rebinding attacks.

[https://en.wikipedia.org/wiki/DNS_rebinding](https://en.wikipedia.org/wiki/DNS_rebinding)

[https://support.google.com/wifi/answer/9144137?hl=en](https://support.google.com/wifi/answer/9144137?hl=en)

<comment><USER3> Are you sure? I think these dns names are deterministic, they never change, for example www.10.0.0.1.xip.io will always resolve to 10.0.0.1 - and I don't think there is a mode where a name could resolve to different ipv4 addresses at different times.

EDIT: I experimentally confirmed that opendns and google dns, which claim to block dns rebinding attacks, do not block xip.io or subdomains thereof

<comment><USER4> It depends on the implementation of the DNS rebinding protection.

I have just checked, and my pfSense firewall (which claims to block DNS rebinding) blocks local addresses from resolving through xip.io (tested with loopback and several RFC1918. All blocked, regardless of whether they match the subnet in use). External addresses (e.g. 22.214.171.124.xip.io) resolve fine.

<comment><USER5> I see this too, with Unbound. Using Cloudflare over TLS as my upstream resolver.

</comment></comment></comment></comment><comment><USER6> We've used this before, and it seems to be catastrophically unreliable.We had development projects on a internal development reverse proxy that we wanted to specify with a name, and found that it quite often broke down. It could be their DNS relay, or some other network event, but at least once a week, it would simply timeout.

I would kill to be able to specify wildcards in /etc/hosts file. That seems to be the sweet-spot.

<comment><USER7> This is so absolutely trivial to implement, why would anyone use their service in the first place?

<comment><USER8> I agree. If you're using it for development within your company, you should just configure your own. There are a number of open source DNS resolvers (some mentioned in these comments) that can be configured to do this.

</comment></comment></comment><comment><USER9> [https://nip.io](https://nip.io) is another option

</comment><comment><USER10> Oh, I remember that one !

Personally I just set up (dev machine is always running some Debian or derivatives) Traefik as a reverse proxy and set up local dev websites/app with *.localhost. I don't bother adding localhost self-signed certs to FF though (never really could make it work anyway). Easier to click "yes, trust that certificate for that localhost subdomain).

</comment><comment><USER11> Nice idea, shame it does not work with IPv6.

dig 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.xip.io. in aaaa

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

<comment><USER12> I've been running a similar service for the past few years on continuous.pw, which supports both ipv4 and ipv6.

Examples:

7f000001.ip.continuous.pw has address 127.0.0.1

fc00.ip6.continuous.pw has IPv6 address fc00::

fc0014c0000001abcde.ip6.continuous.pw has IPv6 address fc00:14c0:0:1ab:cde0::

Sources available at [https://github.com/continuouspw/continuous- dns/tree/master/p...](https://github.com/continuouspw/continuous- dns/tree/master/playbooks/files)

</comment></comment><comment><USER13> What's the advantage over just typing the IP into the browser bar?

<comment><USER14> I know my corporate firewalls do not allow connections to bare ip addresses. This allows me to bypass that check for things I haven't assigned names to already.

<comment><USER15> this makes no sense -- all tcp connections are already to the "bare ip address". dns lookup happens independently of the ip connection. in the case of a browser, your browser asks the local resolver (or with doh, remote nameserver) what the ip is for a given domain, then connects to that ip. I suppose it's possible your network has some strange setup that pokes holes through the firewall based on dns requests, but that would be obscenely expensive both computationally and financially.

<comment><USER16> He probably means his corporate _proxy servers_ , not firewalls.

<comment><USER14> indeed, sorry.

</comment></comment></comment></comment></comment><comment><USER17> Interestingly enough, Plex is running something very similar to this to support SSL for all of their users. a-b-c-d.guid.plex.direct will resolve to a.b.c.d. (Where guid is replaced with a guid, without dashes.)

<comment><USER18> [https://blog.filippo.io/how-plex-is-doing-https-for-all- its-...](https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/)

</comment></comment><comment><USER19> Quick PSA: You can do this yourself on cloudflare. I've got a sub-domain of my web site, "localhost.my.site". That resolves to localhost. I also added a wildcard, "*.localhost.my.site", which also resolves to localhost. It's pretty easy to do, and a handy trick. I figure some one probably turned this into a blog post, but this way you don't have to rely on some one else's stuff going down. I also use it for my local domain, cause I don't want to bother running a local DNS server.

<comment><USER14> that only resolves to localhost though..

Also allows you to set up vhosts if your quickie server is stood up behind something like nginx.

</comment></comment><comment><USER20> "How does it work?

xip.io runs a custom DNS server on the public Internet."

Is there a way to provide wildcard DNS without sending internal LAN IP addresses to a closed source "custom DNS server" over the public Internet?

Yes. If you are a djbdns^1 user, and you wanted all subdomains of xip.io to resolve to 10.0.0.1:

       # Assuming _dnscache and _tinydns are the configuration folders and tinydns listens on 127.0.0.1

       cat << eof > _tinydns/root/data
       .xip.io.
       &*.xip.io:127.0.0.1
       =*.xip.io.:10.0.0.1
       eof

       cd _tinydns/root
       make
       cd -

       echo 127.0.0.1 > _dnscache/root/servers/xip.io

If you are an unbound user, you can put dnscache in front of unbound:

       # Assuming unbound listens on 10.0.0.2

       echo > _dnscache/env/FORWARDONLY
       echo 10.0.0.2 > _dnscache/root/servers/@

1 [http://cr.yp.to/djbdns.html](http://cr.yp.to/djbdns.html)

</comment><comment><USER21> I used this and lvh.me a lot in the past to share WIP work or test webhooks but nowadays that has all since been replaced by ngrok.

</comment><comment><USER22> Next up, TLS certs for the random hostnames?

Are there security implications to this?

</comment><comment><USER23> Unlike ngrok his doesn't "expose" anything. Its just a lazy way to add DNS to a test environment.

If you already have a cloud provider, why would you leverage this instead of just creating real DNS records w/ reasonable TTLs?

</comment><comment><USER24> This service is super useful, I use it to test the custom domains feature in my app.

</comment><comment><USER25> Is this still written in Bash?

<comment><USER2> Yes, fronted by PowerDNS.

[https://github.com/basecamp/xip-pdns/blob/master/bin/xip- pdn...](https://github.com/basecamp/xip-pdns/blob/master/bin/xip-pdns)

</comment></comment><comment><USER26> Cool idea. I use dnsmasq locally but seems like this would work well too.

</comment><comment><USER27> why will we need such service? If we have to include the detailed IP address in the URL, why not direct access use IP address itself?

</comment><comment><USER28> anyone else get a HTTP 105 while trying to access xip.io ? (ERR_NAME_NOT_RESOLVED)

<comment><USER29> Error 105 is an internal Chrome DNS-related error code, not an HTTP code.

HTTP 1xx codes are informational, not error, codes, and 105 doesn't exist.</comment></comment>


Kerberos protocol compromised - <AUTHOR> http://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/ <comment><USER2> Isn't it that only Windows implementation of Kerberos is broken, not the whole protocol?</comment>


1 in 200 San Franciscans Sleep on the Streets - <AUTHOR> http://www.motherjones.com/politics/2016/06/san-francisco-homelessness-charts-data-causes <comment><USER2> They listed several ancillary factors that could lead to homelessness, and yet the article fails to mention the very largest reason for homelessness in SF: an egregiously stubborn refusal to increase the supply of housing, for the last 30 years! This problem wasn't created overnight. CA environmentalists, lobbyist, NIMBYs and other progressives(actually highly conservative), have been working hard to create laws that prevent the increased supply of housing. It's just so sad that so many people don't understand the truth and the real reason behind these things. Lack of housing supply affects everyone: the spillover effects are massive: putting a strain on public transportation, the roads, the surrounding housing areas, etc.

SF alone, spends 240 million dollars a year, just on combating homelessness, and yet, it's not going to go very far, as long as housing costs are sky high and the supply is way too low.

the solution: We really need a drastic increase in supply of housing. They need to get rid of all height restrictions and work with developers to eliminate every last law that prevents more supply. Then, provide legal protection against NIMBYs. Then, 1 line item at a time, they need to look at the cost of housing to find out why it's so high and start making cuts, eliminating all the laws that result in such high housing costs. I know it sounds drastic, but, we're in a state of emergency here. No one wants to acknowledge that.

<comment><USER3> SF's homelessness is not all home-grown, though. People with minimal resources drift there from across the US because it's amenable, for reasons like: a perception that it is a free-and-easy or at least somewhat accommodating place, the possibility of a chance to improve one's situation among the overall prosperity, a climate that won't kill you, etc. Are there not stats on this?

</comment></comment><comment><USER4> One night I got a passenger who needed a carseat. She was at her kid's state- subsidized daycare, had missed the last bus home, and was too exhausted to walk her infant home.

After the preliminary questions, I thought to ask, "Are you on food stamps?"

Passenger: "No, cash assistance."

Me: "What? Everyone says that food stamps are _much_ easier to get than cash assistance. You should really look into that again."

I only charged her $2, instead of the $9 that was on the meter. As I drove away I got a txt message, "Thanks, I appreciated that." Aww...

Some time later she told me that she originally wasn't eligible for food stamps because the women's shelter who got her set up on public assistance provided meals. After she got her apartment, she was eligible.

In Arizona, cash assistance is barely anything at all. The government's outlay for the apartment is certainly substantial... Probably better that they pay the bill, rather than just give her a bigger pile of cash.

I have lots more to say about this one, when I figure out how to say it gracefully.

</comment><comment><USER5> I don't know.

The article talks of 4,400 people, which is roughly (865,000/200=4,325) correct but references this article here:

[http://projects.sfchronicle.com/sf- homeless/numbers/](http://projects.sfchronicle.com/sf-homeless/numbers/)

where the number of people is counted/estimated as any among:

6,686

6,775

9,975

and the "curious" (I cannot understand its meaning):

"Friedenbach estimates there are closer to 13,000 homeless people in the city over the course of an entire year."

The 1/200 is already an extremely high ratio, but 7,000 or 10,000 would make double that at around 1/100!</comment>


WriteWith Makes Group Blogging Easier - <AUTHOR> http://blogs.business2.com/beta/2007/04/writewith_makes.html <comment><USER2> I had a quick demo and as a substitute word processor I was _underwhelmed_. There are little things that bugged me like the clunky spell check, the lame privacy details that don't let you remove your documents (even if you leave) the monitoring of your documents. If you upload a file (in my case a OpenOffice doc) it misses grabbing the title from the document itself. They also missed the _print_ functionality. I don't want to download a doc to have to print it. [0]

If you've created a document and want to edit with others it looks ok. I _did_ like the way the worked with the screen (lots of whitespace), revised documents, the input parser for various documents, the atom feed. The fact you could export the data in various formats and support for UTF-8. I missed the point of it being a collaborative blog tool. That certainly is a useful feature but not a killer.

Then I took into account the fact it's a new product. Bare minimum to get launched. It's not going to be used for corporates for security & privacy reasons. But if you have to create something with someone else in a different location it will get usage.

That's from a user perspective. From an application perspective it's slick & I wonder how they got such a service up and running so fast. [1] It does not take the radical steps of say Rael's stickit, [2] making little affordances as the user enters data, remembering it and getting the application to help you. [3] I also miss an API. But it's early days.

I wonder how they intend to make money off it? Expanded functionality, number of documents you can create, edit. Guess there is plenty of scope for this.

Reference

[0] This little step is something found in Word if you don't supply a title, word uses the document title.

[1] Now I remember reading the writenow story, 'Writewith: who, what, why, when, where and how?'

<http://blog.writewith.com/2007/04/11/writewith-who-what-why-when-where-and- how/>

[2] Rael Dornfest's stikkit, "values of n, stikkit which is exploring new ways of 'organization and collaboration.'"

<http://www.valuesofn.com/blog>

[3] values of n, "A presciently-timed vote of confidence"

<http://www.valuesofn.com/blog/2007/03/presciently-timed-vote-of- confidence.html>

<comment><USER3> Now _this_ is exactly the kind of criticism we like to see. Thanks so much for your comments, bootload. Thanks for the compliments on the parts you liked. We're with you on the blogging - it's a big part of writewith, but we're making a tool that's useful any time you're working on something with other people.

The stuff you found underwhelming is mostly near the top of our to-do list, but hearing what people want definitely helps us prioritize.

I'm not sure I understand what you mean about privacy details. We actually do let you delete your documents, if you go to the home page, and nobody can see what's happening in a document unless you invite them in. If there are other privacy features you want, we'd love to hear about it (get us at email@example.com)

Oh, and we do try to extract titles, but we might be missing some. If you're comfortable sending us a document where that didn't work, we'll take a look.

<comment><USER2> ' _... I'm not sure I understand what you mean about privacy details. We actually do let you delete your documents ...'_

Hi Phil.

I just tried a simple set of tasks of an old file that I had (open office) and worked on it as I would each week. I remember reading your article a while ago on how you started, so I'm not surprised its so polished. Re-reading the original parent article I missed the collaborative blogging bit.

So I took some time and tried some more stuff and it works fine. I wouldn't go overboard on the 'underwhelming bits' I mentioned (spelling - because real- time could hit you on the server & you could optomise. eg: Firefox 2 with spelling included on the textboxes). So what I found, was pretty factual for a single user working on a document.

_'... I'm not sure I understand what you mean about privacy details ...'_

The privacy deletion bit, I mentioned happened when I did a bit of a poke around in your licensing files [0]. It states you keep a copy but remove the viewing capability, but not remove the file. This could be a problem for users (it would for me) but I don't know.

 _'... but we're making a tool that's useful any time you're working on something with other people ...'_

I didn't get to do this bit. I assume you differentiate the users additions to documents? Can 2 users work at the same time?

 _'... If there are other privacy features you want, we'd love to hear about it (get us at firstname.lastname@example.com) ...'_

I'll add it to the todo list I have, can't promise ... gotta work on my product as well :) One thing I will add is, check flickr for the way they license their text/images (creative content).

Regs PR

Reference

[0] writewith, legal privacy, 'Your Preferences: ... If you close your Unimedia account, we will remove your name and other personally identifiable information from our publicly viewable data. Content posted by you may remain on Writewith.com ...' ~ I interpret this as you can keep a copy of content!

<http://writewith.com/legal/privacy></comment></comment></comment>


Links are a Contract/API - <AUTHOR> http://blog.moovweb.com/2012/08/links/

<comment><USER2> Good XKCD on this topic. <http://xkcd.com/869/>

</comment><comment><USER3> I had occassion to visit the CBS network website to try to find out the topics of 60 minutes show. I got mobile jailed and they tried to have me download a mobile app. So I didn't watch 60 minutes

</comment><comment><USER4> So.. in case you haven't noticed..

This post is a clever little advertisement disguised as a blogpost/story. The submitter and author are the same person, selling services for moovweb, which solves the issue characterized in the advert.

</comment><comment><USER5> You can't claim that links are a contract. At best maintaining links is a courtesy and one you should not rely on.

Having said that I can see why this is annoying and a clear thinking business should allow manual override.

<comment><USER6> The word "contract" is just a metaphor. Your customer is going to treat a broken link as a broken promise, whether or not you actually made one.

</comment></comment><comment><USER3> I wish the airline had been mentioned. I don't think leaving their name out will ensure that the site is improved.

Also it is ironic that we are discussing this on Hacker News.

<comment><USER4>
       Unknown or expired link.

</comment></comment><comment><USER7> Mobile browsers can help matters by letting you override the user agent (e.g., with a desktop user agent), to stop sites from redirecting you to their horrible mobile versions.</comment>


Hangouts Chat, Google's Slack competitor, comes out of beta - <AUTHOR> https://techcrunch.com/2018/02/28/hangout-chat-googles-slack-competitor-comes-out-of-beta/ <comment><USER2> Is it Hangouts Chat now? I thought it was Hangouts Meet. Or was it just Meet? Or was Meet the one that replaced Allo?

Sorry, this could be the best chat app yet, I just can't take Google seriously for messaging apps anymore. I just finished archiving all my chat logs from Google Talk and Hangouts (from Takeout) and shutting it down. I use Discord now, exclusively; for person-to-person, group DMs, managed servers (company, gaming, etc), voice, video, everything. Happy with it. It even has slack- compatible webhooks.

Hey, did you know there's no way to remove a contact from Hangouts? Once you add them, they're there forever unless you block them. Because that's how you build good messaging apps, right?

<comment><USER3> I agree. That ship has sailed long ago for me. I actually liked Google Talk, when it was incorporated to your email. Then they came out with something called Hangouts that does GodKnowsWhat.

</comment></comment><comment><USER4> Google really only suceeds in building extremely technical products that are much better functionally than competitors. This technology & functional advantage nets them the runway to get the UX people to fix the glaring interface issues before competitors have a working product. Examples: search, gmail, maps. They have never really been able to do a classic strategy of copying or implementing a mundane piece of software.

Like, chat for google should be easy. A social network should have been easy. A product search/market place should have been easy.

This product will be a terrible addition to the unintelligible quagmire that is chat.

</comment><comment><USER5> Even the product lead of G Suite at Google is aware of how crazy it is ([https://twitter.com/happyinwater/status/969092575687729153](https://twitter.com/happyinwater/status/969092575687729153)). I hope this implies they're doing something about all this mess.

<comment><USER6> They're aware of it far longer, this post is from 2015:

[https://plus.google.com/+MayurKamat/posts/T1FNqgAWzgE](https://plus.google.com/+MayurKamat/posts/T1FNqgAWzgE)

<comment><USER5> Just a side note but I remember seeing this then and found out that Mayur left Google after making these comments (July 2015).

</comment></comment></comment><comment><USER7> My team tried it when it was invite only. We hated it. We just tried it again and hated it.

Also to the other posters point, we have Gapps and I have hangouts app and meetings app on my devices. WTH? Get all this sorted to a single app please google.

</comment><comment><USER8> Bring back XMPP or Matrix cross-compatibility, so we can set up our own server when the service disappears, or just give up, Google.

Nobody trusts you to keep a product running anymore.

</comment><comment><USER9> I am using this and it's disconnected from the current Hangouts that we use for our business. The groups are reflected, but messages are not. Strange choice in my opinion. They could have revamped Hangouts for Gsuite.</comment>


BountySource suspended from GitHub - <AUTHOR> https://github.com/bountysource/core/issues/1147 <comment><USER2> Explanation in this comment: [https://github.com/bountysource/core/issues/1147#issuecommen...](https://github.com/bountysource/core/issues/1147#issuecomment-345923247)

      On July 27, we reached out to Bountysource in response to a complaint we
      received from a user. During our investigation and discussions with members of
      your team, we found that your organization does not have a mechanism for
      responding to removal requests from users, which is required by our Terms of
      Service. Specifically, Bountysource does not "respond promptly to complaints,
      removal requests, and 'do not contact' requests from GitHub or GitHub Users."
      Over two months later, you have not made any changes to your platform in
      response to our requests.

      Therefore, we have suspended your application until you create a process for
      actively responding to all personal information removal requests, including
      those related to projects and issues. In order for us to remove the
      suspension, we would ask to see two things:

      1. Confirmation from you that you have a process in place for responding to
      takedown requests about all areas of your website.

      2. Inclusion of a public notice to your users stating how to request the
      removal of information. That notice can be included in your documentation or
      other legal notices.

      Once you have that process and public notice in place, we'll be happy to
      review your site and consider lifting the suspension.

Sounds like it's (hopefully) not permanent.

<comment><USER3> As someone who does _not_ want BountySource involved in their open source projects, I applaud GitHub for this move. IMO BountySource is a borderline bad actor. It was a pain in the ass to get them to remove my projects from their platform and then they only "sort of" did.

<comment><USER4> Since reading comprehension is apparently a challenge:

Accusation

> IMO BountySource is a borderline bad actor.

Elaboration

> It was a pain in the ass to get them to remove my projects from their > platform and then they only "sort of" did.

Sir_Cmpwn has no further obligation to elaborate even further on the detail given, though there might be a benefit to explaining what "'sort of' did" means.

Edit: looks like he did here anyway -- [https://news.ycombinator.com/item?id=15748433](https://news.ycombinator.com/item?id=15748433)

<comment><USER5> Elaboration is more of a quantitative thing than qualitative, though. It's always possible to elaborate further, and there's no harm in asking to do so. And I found that his further elaboration was helpful:

"I could also clarify that BountySource is opt-out: by default they're accepting bounties for projects that did not agree to having a bounty program."

I originally assumed you had to register your project on BountySource, and they were just making it difficult to de-register something that had already been added.

Making this thing opt-out only, and apparently making opting out difficult, is really bad behavior, and I completely agree with his characterization.

<comment><USER6> I'm not sure I got all that. Could you elaborate further, please?

</comment></comment></comment></comment></comment><comment><USER7> Straight from the comments: "Even with a $25 bounty attached to it, nothing is happening"

That is why I detest BountySource. FOSS users already have a ridiculous feeling of entitlement. Let them "sponsor" a bug fix at one-one-hundredth the going rate, and that obnoxious sense of entitlement gets dialed up to eleven.

<comment><USER8> I honestly think FOSS is one of the biggest problems in IT. It sounds weird, but hear me out. Beware, kind of a rant coming.

The reason I think it is one of the biggest problems is it devalues developers and the development process. We created a system in which we make software look like it's so simple you can just have it.

Look at your development toolchain and then think about how many of the major components are free. Things that you rely on heavily. In PHP, we have composer, it's great nearly every PHP developer will use it at least once a week. They created a service that will improve the reliability and reduce the dependency on Github. They offer it for $10 a month per user. Nearly everyone said it was too expensive and didn't bring any value to be worth $10 a month for something they will constantly use. Especially on CI.

If the development community literally doesn't value the cost of software, why would anyone else?

The average person, if they want to create a website, will end up using something free such as WordPress to create and maintain their website for free. They can get lots of extensions for free and will nearly always be able to do everything they want for free. Now, why would you if you're the average person who wants a company website think $3,000 is a reasonable price. You can literally make a website yourself and just pay for hosting. You may think this is hyperbole, but how many Web Agencies have serious problems with people not paying compared to car mechanics?

Many people will not spend $5 on a very good, very professional, high-end iPhone app because it's too expensive. Again, where this come from? The number of people who just created free apps and put them up on App Store. I know people who don't pay for any apps on their phones.

So in conclusion, we have a general disappreciation for software. We have many multi-million if not multi-billion dollar applications that are built nearly all of free open source applications. Software that we really need to do our jobs and we have zero warranty on. Think about this for a minute some of these companies using these libraries, etc probably wouldn't hire someone to wire their building if it didn't have a warranty. But the libraries underpinning their software is free, so if that is free, why would you pay your developers that much money. Think about it, for a highly skilled profession, we are at the low end of the pay scale. Accountants, engineers, etc generally all seem to get paid more. Why? Because of FOSS.

<comment><USER9> Isn't the barrier to entry much lower than any of the professions you mentioned?

Many professions have professional certifications that artificially limits the supply and drives up their prices. (Professional Engineer, CPA, Bar exams, etc.)

<comment><USER8> > Many professions have professional certifications that artificially limits > the supply and drives up their prices.

We're literally in a profession where companies hire teams of recruiters to get developers. Majority of companies are looking for developers constantly. Whereas with the other professions, there are no supply problems, in fact, there are too many people becoming qualified that people have trouble getting jobs. Also, we have the barrier to entry the y don't have, the serious lack of junior positions, a massive demand for mid/senior positions.

Supply and demand, says we should be getting paid more. In realitiy, I get paid pretty well compared to my friends in other fields, but I am aware of the serious discrepancy in salaries.

But mainly my main gripe is there is no real support provided for major parts of my toolchain because we just give it away. Companies are literally struggling to come up with good software because everyone expects it for free.

<comment><USER9> I think the disconnect is that those teams of recruiters are trying to get experienced developers, not just someone who can sling some code together.

A lot of FOSS starts as an amateur's project and buds into the full scale projects we see while the maintainers are also growing as software engineers with the project. People start FOSS projects and give them away because the initial market value tends to be negligible until the project has had time to mature and be fleshed out. Something like Linux had almost zero market value _years_ into the project, its still just a "toy" to the market.

Just the way I see things, but I can understand your viewpoint as well.

</comment></comment></comment></comment></comment><comment><USER10> Why would anyone put mission-critical features like login in the hands of a 3rd party in the first place?

Not to mention that OAUTH itself is crap ([https://hueniverse.com/oauth-2-0-and-the-road-to- hell-8eec45...](https://hueniverse.com/oauth-2-0-and-the-road-to- hell-8eec45921529)), and should be avoided.

</comment><comment><USER11> Quite sad to see it go. I do hope there will be other, more successful attempts at making OSS sustainable.

<comment><USER12> There is BitHub, although it's slightly different and doesn't focus on sponsoring particular bugs.

[https://signal.org/blog/bithub/](https://signal.org/blog/bithub/)

<comment><USER11> It seems this only accepts Bitcoin.

Bitcoin still has a lot of friction which would lower the potential income of OSS developers.

I would rather prefer something which can accept atleast a Bank transfer...

</comment></comment></comment><comment><USER13> Tried it a few times now and then and it was pretty much dead. No wonder they didn't replied to Github.</comment>


Show HN: Lean Domain Search's New Brandable Domain Names Section - <AUTHOR> http://www.leandomainsearch.com/brandable

<comment><AUTHOR> Hey guys -- a little over four years ago I launched my first web app, Domain Pigeon, on HackerNews [1]. Domain Pigeon helped you find available brandable .com domain names and was somewhat popular here back in the day.

Lean Domain Search is my follow-up to Domain Pigeon however instead of helping you find brandable domain names, it has historically only helped you find keyword-based domain names. With the launch of this new section today, I'm taking it back to its roots with a section dedicated towards finding quality available brandable domain names, something that I think a lot of people are interested in.

There's more info on the blog [2]. I'd love to get your feedback -- thanks!

[1] <https://news.ycombinator.com/item?id=456471>

[2] [http://www.leandomainsearch.com/blog/36-introducing-lean- dom...](http://www.leandomainsearch.com/blog/36-introducing-lean-domain- search-s-new-brandable-domain-names-section)</comment>


"moving planets to habitable zones", does this make sense? - <AUTHOR> http://www.augmentedmadness.com/moving-planets-to-habitable-zones

<comment><USER2> shall we ever need this, i m not sure. exoplanets will be enough maybe.</comment>


One year later, are these the best ways to discover your APIs? - <AUTHOR> http://nordicapis.com/api-discovery-11-ways-to-find-apis/ <comment><AUTHOR> API Harmony was just added to the list - not just discovering the API but also relating the API to usage, SDKs, discussions, and other relevant information a developer may be looking for.

<comment><USER2> There are many great options in the list but with the state of industry and the large number of APIs coming out each year Google is still a great place to start!

Curious if folks perform their initial search on any of the sites above or if Google is the one that lands you there?</comment></comment>


IoT Security Anti-Patterns - <AUTHOR> https://blog.cloudflare.com/iot-security-anti-patterns/ <comment><USER2> > With the device in their possession they can extract software from the > embedded system chip on the device to obtain the software running on it. By > reverse engineering this software they can learn secrets in the memory of > the onboard microcontroller.

Hoping to keep secrets from a physical attacker on a general purpose microcontroller is an excellent example of an IoT security anti-pattern. It's a shame the author missed the wider point.

<comment><USER3> Can you really protect the device software if the hardware encryption element is separate from the microcontroller? Wouldn't it be trivial to sniff the decrypted cypher text of the software with a logic analyzer on the pin between the microcontroller and encryption ASIC even if you can't get the actual key out of it?

</comment></comment><comment><USER4> > _Anti-pattern: HTTP Pub /Sub_

So what is the alternative? He is not seriously advocating polling, is he?

<comment><USER5> My guess is that no, it's not about pub/sub specifically, but rather that "you" can address & subscribe arbitrary hosts anywhere on the internet via a naive implementation.

Segregating your 'dumb' controller/sensor nodes and restricting their ability to talk elsewhere via routing, firewalling or proxies would reduce the risk of a single crappy device leaking onto the internet. At the cost of some centralisation of control in your gateway/router/whatever, of course. And you still need some form of crypto on your local network to protect against local/physical attackers.

Is it a coincidence that this post comes a few days after CF announces a "private network for IoT"[1]? My wirelessly-enabled Crystal Ball says no. I wonder if it's because the IoT is itself a big enough pie with current attention on (lack of) security, or if it's more to protect their main business from Mirai N+1/DDoSoT or whatever.

[1] [https://blog.cloudflare.com/orbit/](https://blog.cloudflare.com/orbit/)

</comment></comment><comment><USER6> Is security engineering at the level of black box art, or is it at the level of sound engineering principles that once followed will result in secure system? Everybody is talking about security, but are there some rules to follow or is it a jungle of black hat hackers trying to ruin your IoT devices?

<comment><USER7> Since there is no security panacea -- _all_ systems are vulnerable given enough attention and focused skill -- it seems more of an art than a science. Like all software engineering, proper security requires careful balancing of tradeoffs and prioritization of security mitigations.

Just like you design software with the end user in mind, you should design security systems with the attacker in mind. Just like you prioritize features for by your expected user personas, you should prioritize security measures by your expected attacker personas. And just like you always want to cover the "basics" of UX, you always want to cover the "basics" of security.

First you should take care of the "low hanging fruit," meaning you should implement industry best practices at all levels of the stack. Hopefully this is sufficient to mostly mitigate any threats of getting caught in widely targeted attacks, like mass scans for Wordpress vulnerabilities.

Unfortunately, implementing security best practices is only the beginning of defending against motivated attackers focused specifically on you as a target.

Once you've taken care of the easy wins, you have to balance the tradeoffs of engineering effort and complexity required to make certain mitigations. In practice, this means that what your security system will look like largely depends on the question: What is your threat model?

If you are an IoT vendor, your threat model is becoming a node in a botnet. That means you need to defend against a focused attacker reverse engineering your product to find a vulnerability that can be used to root the device remotely. Unfortunately this is basically impossible to defend against, but you can make their job much more difficult with binary obfuscation, symbol stripping, aslr, etc. Your best hope at that point is the attacker gets frustrated and decides to target some other product.

If you're a search engine ( _cough cough_ ) your threat model may be people scraping your search results (as hypocritical as that is...) In that case your first priority might be catching bots and serving up captchas.

Point is, your "security engineering" largely depends on your domain and threat model, just like "traditional" software engineering depends on domain and user base.

(That said, IANASecurityProfessional ;) )

<comment><USER6> Thanks for the lovely (and elaborate) write-up!

</comment></comment></comment><comment><USER8> There is a cost to implementing SSL on many of these chips and it often results in either paying more or not having features. Even the esp8266 had issues with size. I wonder if using an proper HMAC without data encryption would be sufficient for non-sensitive items like dumb data loggers or even control.

<comment><USER9> With IoT, one generally has control of the devices, so one can distribute their own keys without having to "trust" the authorities. In that case, something like libsodium could handle the communication between devices.

<comment><USER8> The library doesn't always fit, let alone larger keychains. This gets you encryption but means you have less room for the software that pays. This is the balance. Also, many of the IoT devices have a few hundred bytes of ram and a few kilo bytes of flash, so public key may be out of the question. It is changing, there are devices like the esp32 that can fit a lot more along with providing wifi/bluetooth

</comment></comment></comment><comment><USER10> I don't get why anyone would want a device connected to the internet at all, in the first place.

<comment><USER11> I don't think rejecting a technology entirely is the best way to avoid abuse. I get that some of these devices are a little silly, i.e. WiFi-connected toasters, but a lot of IoT devices have great potential for making the world a better place. For example, the FitBit and other health trackers can do wonders for helping people get healthier, and devices like Bluetooth-enabled glucose monitors can even save lives.

This idea that we shouldn't even consider connecting tools to the internet because the internet is scary and dangerous feels like a knee-jerk reaction to me. I believe there is a right way to build these tools where the risk added is minimal to non-existent. Refusing to pursue this tech at all because some people do it wrong just feels like ludditism to me.

Imagine what would have happened if people abandoned computer technology after the first few viruses were discovered.

<comment><USER5> I think it's hard to dispute that networked sensors/controllers can have tangible benefits.

My issue with the current trend is that 'IoT'/Internet-enabled is a way to both sell a product, and then effectively rent access to it via the 'cloud' interface. If you stop paying, your device is (mostly) useless. If they stop supporting it, your device is (mostly) useless. The actual whereabouts of any data produced by your device is probably unknown, as is its security and usage.

It's the same tired old "If you're not paying..., you're the product", except that _you 're actually paying_.

Many of these abuses are much harder to do if you don't expose your exciting new Thing of Internet directly to the entire global communications infrastructure, but then we're back in the bad old days where people had to use software that wasn't a thin client in a browser[1].

I'd really _really_ like a LAN of Things, or a VPN of Things, that still functions after your service has gone bankrupt or sold their souls to Oracle or something. But of businesses, especially those riding the wave of 'your data is feedstock to our deep-learning quantum magic pixies, and we'd never _ever_ sell it all for a cheap buck[2]' would find it much trickier if that sweet sweet data wasn't coming their way.

Development & distribution, as well as actually charging for for things, become harder problems though, which means everyone wants to head to the promised land of *aaS, where A/B unicorns frolic in the fields and green/blue munchkins guide your clueless users down the yellow brick upgrade pipeline.

[1] Only mostly sarcastic. [2] unless someone offered</comment></comment></comment>


Show HN: A notes app with only one page - <AUTHOR> https://play.google.com/store/apps/details?id=com.hamandeggs.jot <comment><USER2> "We're sorry, the requested URL was not found on this server."</comment>


Kiruna, Forever Changing - <AUTHOR> https://placesjournal.org/article/kiruna-forever-changing <comment><USER2> The moving of Kiruna is so fascinating. The whole city is so very dependent on the mine, and if they don't move it the mining will stop, and the city would probably shrink dramatically / die.

But on the other hand it's an extremely complicated process to move a whole city. I think it started in 2004 or something, and back then you could barley notice the fences far away (at least as just a visitor). But every year I've been there they have moved closer, cordoning off bigger and bigger parts, and this summer they were just up against the city center.

It will take many decades before most shops/amenities/people have moved to the new city, and in the transitional period both the old and new will be bad. Who wants to be the first shop-owner to move to the new, almost empty city?

And there are many interesting power balances. According to Swedish law the mining company is supposed to pay for all damages made due to mining. But the devil is in the details. How much should people get compensated for their old homes? There's no fair market value for a house in a city which is about to be demolished. Building a new house to modern standard/code is probably more expensive than what the old house is "worth", etc.

Not to talk about all the non-financial losses of seeing your whole neighbourhood, where you might have lived for your whole life, just disappear.

<comment><USER3> Out of curiosity, do you have a personal connection to the town?

> It will take many decades before most shops/amenities/people have moved to > the new city, and in the transitional period both the old and new will be > bad. Who wants to be the first shop-owner to move to the new, almost empty > city?

I don't doubt that there's going to be pain. When I briefly visited the town some time ago, though, it seemed to me like the larger stores were maybe a couple of kilometers from the town center anyway. I'm not sure a couple of kilometers will stop people from going into those.

A smaller shop might of course be more in a pinch for a while, as could a pub or a restaurant.

Of course someone with a personal take would probably know better.

What interests me perhaps even more is the personal attachment people might have to the existing neighbourhoods, buildings and locations, and the non- financial loss of those, as you said. The town did seem to have some kind of an atmosphere of its own, although that could of course be entirely in my mind, not in those of the people actually living there.

</comment></comment><comment><USER4> In a few decades they will have fully-automated mining robots. Then there won't be any need for the city. Only reason they live there now is because miners are better paid than most engineers.

</comment><comment><USER5> I went to Kiruna on a hike through Abisko park (Kungsleden trail).

The town looked "old" but the infrastructure looked new.</comment>