Ask HN: How to Hire a Designer from Dribble? - <AUTHOR> I'm a full-stack engineer, recently built and soft-launched my side-project, but been told by several people that UI needs work.
I went to dribble and used their search *  to locate designers that "Are for Hire". But the first few I found appear to be more like Agencies, most of which don't take on a single site or app like mine, and also costs 5 to 10K min.
I want to hire an individual developer so that costs are low (I'm bootstrapped) and also I have a chance of bringing in the designer as a co-founder if things work out.
Anyone have experience with this? i.e. locating and hiring an individual designer from Dribble? How did you go about it? How did you vet them? Were you happy with your results? Costs?
[P.S. If you are a designer and would like to know more, please contact me theblogdoctor (at) gmail. ]
I'm based in San Francisco and this is the site that needs work => http://visaok.in
* Search Page I used: https://dribbble.com/designers?twitter=&dribbble=&sort=popular&for_hire=on&location=&skills=
(I understand they have a job board I can post in, but would like to avoid the 375$ for 30 days costs, as I am bootstrapped and would like to use their search page to find designers if possible :) <comment><USER2> The UI of your project does NOT need work IMO. It looks great, functional, and you should be able to bring lot's of revenue in with the current design (assuming the site solves a problem). Your time will probably be better spent doing marketing, user testing and customer interviews.

<comment><USER3> I agree it is pretty good. I wouldn't spend too much on a designer. What you may be able to do is find students who are trying to get some stuff in their portfolio and contract to them.

You don't need a lot of work, and if I were you, I'd approach it as a learning experience for both of you. You get to learn what it is like to work with a designer, what they need for future projects, what works, and what doesn't. They get some money and a working app in their portfolio.

Your site is nice and clean, easy to understand. But you'd be amazed at what a few tweaks to spacing, font, etc can do to the experience.

I'm not saying it needs to be done. I'm not saying it doesn't. If you decide you want to spruce it up, I think you'll see some benefit, but it may be quite small.

I had the ugliest site on the web back in the day, the comments from people were that the app was amazing, but the UX was aweful. I found a designer on 99 designs (or something like that). He had just started designing. We got on quite well. In a day he had improved my site by a huge margin, and within a few weeks it was on TechCrunch. I put that down to the design changes. It made the whole thing seem more real.

This was just my experience, your mileage may vary.

</comment></comment><comment><USER4> Those people are wrong. Your UI is perfectly serviceable and does not need work at this stage. Do not waste your money on polishing the very decent UI you have — it's unlikely to move the needle compared to other efforts like sales & marketing.

Source: I'm a designer.

<comment><AUTHOR> Thank you. Coming from a designer this is comforting :)

</comment></comment><comment><USER5> Quick tips:

\- Icon in the nav should be 2x the final size and scaled down for high resolutions screens. If possible use SVG as that will scale ad infinitum.

\- The search appears broken in Firefox, the culprit seems to be the "v" (down arrow). For testing several browsers I recommend [https://www.browserstack.com/](https://www.browserstack.com/)

\- You are missing the "Apply now" inside each individual job, which is IMO the best place to put it.

\- I would make the country flags a bit smaller. Maybe put them side by side in a continuous way in a more compact way.

Otherwise, as others said, it looks perfectly fine for a launch. And it also seems like a really useful service.

<comment><AUTHOR> Thank you so much. I'll get to work on this.

</comment></comment><comment><USER6> Congratulations on shipping! I rather like the UI.

Few quick thoughts

1\. I don't like navigating back to the main page to search

* Example: [http://imgur.com/XuZSrSR](http://imgur.com/XuZSrSR) (no search bar here)

2\. If a field is not populated, consider not displaying it

* Example: [http://imgur.com/9b6UIUv](http://imgur.com/9b6UIUv)

3\. Some pages don't go anywhere meaningful

* [http://visaok.in/press](http://visaok.in/press)

* Sign in / register

* [http://visaok.in/not_a_real_page](http://visaok.in/not_a_real_page) (=> [http://imgur.com/Qhue840](http://imgur.com/Qhue840))

4\. Search doesn't handle some input; I get an error page

* Example: [http://visaok.in/jobs/search?q=%3Ch1%3Etest%3C%2Fh1%3E](http://visaok.in/jobs/search?q=%3Ch1%3Etest%3C%2Fh1%3E)

<comment><AUTHOR> Thank you so much for testing this and providing screenshots. I was going to reply after fixing everything, but it's taking longer than I thought.

I've fixed 2 of the above. Doing a deploy tomorrow morning...

</comment></comment><comment><USER7> You have essentially a listing site for Visa friendly jobs.

Your UI/UX is fine.

Similar website to yours - Craigslist.com and their UI is awful.

Focus on how you'll make money, how you can improve the product offering and other things people suggested.

</comment><comment><USER8> I don't know how to hire designers from Dribbble, but I would like to suggest you few things. But first, your UI is not okay, you need to fix them.

1\. On copywriting: I don't understand your copywriting, for example: "Top Visa Sponsor Countries", "74 Jobs United States". Hmmm, what? Also, I don't understand some words, like: "sought-after" without dictionary (this is my third language). Remember, when you're writing, any words that you have to see from dictionary is the wrong words.

2\. On typography: grey text on white background is pretty, but hard to read. Why do you write them? Right, for people to read. Imagine how painful it is for people with color blind or low vision. And pay attention to hierarchy.

3\. On elements: we like to see something that looks neat. Remember: 1) Order and balance. If you use padding top 1em, it's better if you also use padding bottom 1em. 2) Space and group. Orange and apple should be in the same group. Dog and cat. Then, add space to tell people that they're not the same group: fruit and animal. Visit learndesignprinciples.com for quick read.

4\. On icons: why Facebook, Twitter, G+, and YouTube at the top? But why LinkedIn, Facebook, Twitter, and YouTube at the bottom? Why without text and with text? Remember consistency. Oh, and why hamburger menu? It's not like the cart icon that people already understand without copy.

5\. On color: looks like you use three colors for link. Hmmm? Blue, black, and grey. Why? I suggest just blue. Remember, consistency. Why blue and red buttons? Lastly, don't rely on colors, remember color blind and low vision.

Well, I can write more if you want, but I think you understand. And yes, don't spend too much money for designers. Even Buffett doesn't like to spend money to hire designer (berkshirehathaway.com). Here's my suggestions:

1\. Learn design, for fun. Because why not. I am self-taught designer. It's easier to learn design than programming. I am currently learning JavaScript, and it's hard. Design is not that hard.

2\. If you want a quick solutions: visit some wonderful websites. Then, you take the most wonderful elements (header, button, footer, etc.), combine them to your project.

For more: where to read? NNGroup, UIE, Usability Post, etc. People? Jakob Nielsen, Jared Spool, Don Norman, etc.

</comment><comment><USER9> I agree with the others, the usability is fine the way it is, I like that it's not cluttered, and it's easy to browse around.

What you really need is a good copywriter. Someone who will ask you the right questions to find out who your users are, what their pain-points and needs are, and then create copy that will pique their interest and guide them on what they should do on your site.

That will be much better money spent.

<comment><AUTHOR> Thank you. I'm planning to do blog posts and maybe youtube "explainer" videos on how to apply for and get various work visas.

<comment><USER10> That would be amazing! I'm personally trying to figure out the EU visa process and keep getting lost trying to understand the most viable way to get a job/visa. I'm definitely going to keep your site bookmarked!

</comment></comment></comment><comment><USER11> I have not tried Dribble, but I have had experience hiring designers to help me with UI.

I went through trying to outsource overseas, to using Fiverr. None of this produced good results for me as most of the people I tried could not follow a specification.

I reached out to one of the main contributors of the open source SaSS framework I was using. He agreed to do the work for me for a fixed budget. He was a bit more expensive per hour than the other options, but I got exactly what I wanted. I did not have to go back and forth regarding my specification. If you value your time to market, I would recommend this route.

</comment><comment><USER12> Finally, I get to be an "expert" on Hacker News :).

I have hired a number of great designers from dribbble some of which went on to work in places like Apple.

First step: Get Dribbble pro for $25. It'd worth it.

Step 2: first search for designers based on a similar project. In my 1st case I used keywords like "music" "Spotify" "player" etc. In yours, you can use "classifieds", "Craigslist" "Job Board" etc. People would charge lower if they are doing similar stuff they've done before, or have sampled similar ideas.

Step 3: Based on budget, filter for

A. Designers from everywhere apart from US and UK. For. Skills, people have to charge based on their living expenses and based on what they can get in their vicinity.

B. Solo Designers Available for work

South Africa, Some of Western and Eastern Europe (Holland, Belgium, Poland, Romania etc) have an abundance of great affordable designers.

Step 3: Open up a spreadsheet for up to 30 designers with style you like and put up their names and email addresses. Follow. Them so you know who you've contacted.

Step 4: Sent out individual messages. Some have their emails listed. Some you need to contact via Dribbble.

The email has to be brief an to the point. People.

My email was like this.

\-- Subject : Are you available for Freelance

Message: Hi Name.

Great work on Dribbble. Are you available for freelance? What's your rate? I have a well detailed out project that would need design help.

I hope to hear from you.

(you can add, that you're a developer so working with you will be straightforward)

\--

Quotes are high because people budget for project creep. Being clear can reduce your budget by 30%.

Step 5: Based on response rate (expect ~50%) filter out. Thank those who are beyond your budget. Sometimes they ask for the progect scope and their total may be lower. For me, I focused on people that charged max of $40/hour. I usually negotiate by showing all the wire framed pages to be designed and getting my quote.

Step 6 : Rinse and Repeat until you get what you're looking for.

Note: Your site looks very good especially as a v1. Focus on traction first. Like others have said you "maybe" need some UX work.

I'm not a designer and do product for my startup and usually do the recruiting. Feel free to contact me. (email in profile)

PS: Put your website on this thread so people can check it out.

<comment><AUTHOR> Wow, thanks for the details steps. I learnt a lot from your reply.

I got a lot of response in my inbox from designers, all with stellar portfolios! I'm making the fixes and tweaks some have suggested in this thread, and will likely hire a designer in a few weeks after I do some marketing and sales...

Here's the site: [http://visaok.in/](http://visaok.in/)

</comment></comment><comment><USER13> I really liked your website. I also think you don't need to redesign for a while.

</comment><comment><USER14> Visually, the middle content looks too bold and over the top compared with header and footer. But the UI looks intuitive. Can you share what technology stack you used (backend and frontend) to build it?

</comment><comment><USER15> I think the UI is fine, but the UX could use some work.

</comment><comment><USER16> Design looks fine to me. Got an error after clicking on 'C#' on the homepage, might want to look into that? :)

</comment><comment><USER17> You do not need a "better" design. Visually it looks just fine. Focus on the functionality and marketing instead.

</comment><comment><USER18> Have you looked on UpWork?

I don't have any experience hiring there but it may be worth a shot.

</comment><comment><USER19> Why Dribbble? Sites like Upwork seem better suited for your needs.

</comment><comment><USER20> you mean dribbble :)

<comment><AUTHOR> Yes. Just noticed the extra b.

"Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoatnt tihng is taht the frist and lsat ltteers be at the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe."

<comment><USER21> Hmmm</comment></comment></comment>


For the poor in the Ivy League, a full ride isn't always what they imagined - <AUTHOR> https://www.washingtonpost.com/local/education/for-the-poor-in-the-ivy-league-a-full-ride-isnt-always-what-they-imagined/2016/05/16/5f89972a-114d-11e6-81b4-581a5c4c42df_story.html <comment><USER2> So tell me again what is so special about Ivey league schools? I don't know about other states, but there are a good colleges in Ga which would have been much cheaper and less stressful and still could have landed them a good job.

One of the students were from GA.</comment>


Leap Motion - Say goodbye to your mouse and keyboard - <AUTHOR> http://leapmotion.com/

<comment><AUTHOR> Looks exciting, but kickstarter has taught us to be vary of products until actually delivered. Hope it lives up to expectations.

</comment><comment><USER2> I pre-ordered it, can't wait for it to arrive. Say goodbye to your mouse and keyboard is a little over stating it IMO.

<comment><AUTHOR> A little hyperbole never hurt anyone :) But yes, I do not see it replacing the keyboard.</comment></comment>


How to Start Using Microservices - <AUTHOR> https://hackernoon.com/how-to-start-using-microservices-0e1z3u47 <comment><USER2> This is complete bullshit, top to bottom.

Microservices add complexity, they don't remove it.

Monolithic architecture doesn't force tight coupling. Tight coupling doesn't depend on an architecture. Making a monolith crash-proof is easier than dealing with intermittently-functioning microservices.

Being able to change microservices without that affecting any other services is a design goal, not an architectural feature.

Microservices are not inherently more scalable than monoliths. They have to be designed that way. And monoliths can equally well be designed to be scalable (just add more instances!).

When to use microservices? When one part of your monolith can easily be broken out and run on its own server as a service, and that would improve some performance bottleneck that you need because you can see a point where it will matter in the near future. Otherwise "never".

<comment><USER3> Microservices can solve a lot of organizational problems:

1\. Fewer merge conflicts, easier branching/merging strategy. If you have 200 people checking into a monolith then it is easy to start stomping all over each other.

2\. Large changes(say upgrading to a new major version of a library for security reasons) can result in the code base being in a state of conflict hell, or just frozen, while work gets done. With microservices you can upgrade them one at a time.

3\. The build/test/deploy pipeline for any given team is shorter. Large code bases take a long time to build and run through tests. If instead everyone has to have well defined interfaces to their microservices then it is possible to test the interface points of a given microservice that is being committed to.

4\. Serious screw-ups in one part of the code don't impact code in other places. If someone starts leaking memory in one microservice, then one part of the system has degraded functionality. Worst case it is a critical microservice and your system goes down. Best case it isn't on the golden path for users and it isn't a major outage.

5\. It makes you think about deployment and configuration up front. I have seen _major_ systems (billions of dollars, systems you've used in the past) where only tribal knowledge of how to "get it running" existed. There was no formal deployment plan, and deployments could take days.

Microservices force organizations to solve deployment up front.

<comment><USER4> I've worked on a large-scale micro-service architecture and I had a great time! I don't "pick a side" of this almost idealistic argument, but I do have some pushback for you:

1) You're right that there aren't merge conflicts, but you swap out merge conflicts with interface changes. Meaning let's say programmer A is working on Microservice B that consumes from Microservice C and she changes the "what I expect from Microservice C" interface. Who changes Microservice C? In THEORY it could be whoever "owns" it, or Programmer A, but in practice sometimes it falls between the cracks.

2/4) We ended up actually writing our own Python packages that did end up being shared amongst some of the microservices. If you want to abide by DRY (not juts as dogma but you just don't want to implement the same thing twice), you do need some shared code. Maybe that "breaks" the microservice "model" and we didn't do it "right"? Maybe. But with what we did, we still did have "internal Python package" updates intended for one Microservice that effected another

This is all from my personal experience so it could be that we just didn't follow best practices or fell into some traps.

<comment><USER5> You don't change interfaces. It is that simple. There's not a paradox here.

To change your RPC protocol in a distributed system, you may add optional fields to the request but you must not add required fields nor change the semantic meaning of any field. You can add new services and methods but you must not disable one that anyone calls.

<comment><USER2> Which is surely an argument for "never start a project using microservices"?

Who knows exactly what their interfaces are going to be, across their entire project, on day 1, and gets that right every time?

<comment><USER3> > Who knows exactly what their interfaces are going to be, across their entire > project, on day 1, and gets that right every time?

Same problem exists for binary interfaces, or source code interfaces.

Or for a client system that talks to a cloud service.

Or for a cloud service that exposes APIs for other cloud services to call.

Technologies exist to version APIs. It is sad that JSON is the standard interchange format, since it is pretty miserable at this entire problem.

<comment><USER2> I agree completely, but all this is exacerbated if you have to make your interfaces immutable from the first version

<comment><USER5> They aren't immutable. You can safely add fields and you can add methods or entire services. It is easy to change microservice interfaces, you just do it in a particular way.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> How to Start Using Microservices:

1\. Write a monolith.

2\. If the project fails or doesn't really need to scale in terms of code or hardware, you don't need microservices.

3\. If the project succeeds, and the code size and team size starts to grow, start looking for parts of the monolith that make sense to encapsulate as their own services.

3a. Also look to see if some parts of the monolith need to scale more than others. This can also indicate part of the code to break out into its own microservice.

4\. Now that you have identified potential microservices, very carefully think through the API for each microservice. APIs are very difficult to change after they are widely used, so its important to get it as close to right as possible the first time. API design does not lend itself to "agile" very well.

5\. Now you are ready to create your "two pizza" teams and start implementing your microservices.

6\. Don't bother thinking about Kubernetes too much before this point. Until you really need to scale, it just adds unnecessary complexity. (But when you need it, you really need it!)

6a. Same may or may not be true for Docker, it can potentially simplify deployments, but if what you have works and isn't creating significant toil, you can always introduce it later.

<comment><USER7> For 3, I would say organize your code into modules as a first step, and make sure you get the dependencies between them flowing in the right direction.

You can do a lot with module separation and a good dependency tree within a single repo before actually requiring microservices.

</comment></comment><comment><USER8> An interesting thing to do here is to ask who wrote this and why?

> Microtica is abstracting complex cloud setup and automation on AWS

[https://microtica.com/](https://microtica.com/)

Microservices aren't necessarily a bad idea but keep in mind that the company behind this article has an incentive to encourage developers to build complex systems.

<comment><USER9> Hi sonnyp, This is Maria from Microtica. We want to bring the cloud setup and automation (which can be complex for someone new to it) closer to developers, but not encouraging microservices over monolith or any other technology or framework. It's up to them to choose. The article is meant for developers that want and need to build with microservices.

<comment><USER8> Thank you for clarifying. Then I would suggest rephrasing the following sentence

> Microservices are an alternative to the monolith approach that gives > developers the flexibility, scalability, and simplicity they need to build > complex software applications.

</comment></comment></comment><comment><USER10> I don't understand these impulsive "don't do it" reactions.

Why can't folks just assess their own situations, review/learn about possible solutions, try stuff out and then eventually go with something?

There's going to be unpleasant problems no matter what you choose. There's no silver bullet. Projects fail for many different reasons, only one of them is because of wrong "technology platform choice."

<comment><USER11> At least my personal feeling from having watched multiple projects arrive at hundreds of microservices, some of which end up amplifying inbound requests into a nearly exponential number of internal requests, the problem is that most teams have no thesis at all for when it makes sense to separate two functions, when you should make a function a service, etc. this means you get a massive amplification of cost and complexity and, honestly, not a lot of gain most of the time.

</comment></comment><comment><USER12> Three steps:

1\. Don't do microservices

2\. Don't do microservices yet

3\. Do some larger, more sensible, level of service integration

</comment><comment><USER13> > the freedom to choose the technology stack they prefer best

Might be the worst possible reasons to adopt Microservices. If your Account Management service runs in a different language then your Email service, then guess what? You now need to hire different developers to maintain each service.

Don't. Do do it for this reason, or any reason until your business demands them.

<comment><USER14> That mantra is less about using arbitrary programing languages and more about using something like redis (or some other niche/useful/existing tech) instead of recreating the wheel in python/java/node/whatever.

<comment><USER13> That doesn't require a microservice to do.

If you're breaking an app apart so one part can use redis, you have something seriously wrong in your engineering culture.

<comment><USER14> You are right of course - my example sucks. I'm trying to think of a more appropriate example, but my heart is not in it.

<comment><USER13> lol it's all good.

</comment></comment></comment></comment></comment><comment><USER15> Microservices aren't easy. But I do suggest reading up on domain driven design.

<comment><AUTHOR> We have a blog post about Domain Driven Design also: [https://microtica.com/the-concept-of-domain-driven-design- ex...](https://microtica.com/the-concept-of-domain-driven-design-explained/)

</comment></comment><comment><USER16> @ Facebook engineers: to my knowledge, Facebook still adopts a monolith architecture for their servers. How do you deal with regression in one area potentially bringing down the whole system?

<comment><USER17> never worked at facebook but the answer is 1) testing 2) rolling/canary/blue- green deploys 3) feature flags 4) having a rollback plan

</comment></comment><comment><USER18> Microservices is for scaling applications that need to handle a high volume of transactions (millions+) with the expectation of high growth in transaction volume. It became a solution for Uber and Netflix when the exploding user requests caused their monoliths to become difficult to manage/modify/deploy. An application that handles hundreds to thousands of transactions doesn't necessarily have the problem that requires the microservices solution. The main tradeoff of microservices is that it increases the complexity of software, and has a lot of moving parts that need to be done right to achieve the advantage. The hype of encourage every to-do app creator to use microservices may be an overkill. The writer of the post does have the incentive to encourage the use of microservices and the utilization of their services.

<comment><USER9> I agree with your statement, and the post explains the pros, but also the challenges of microservices. Our service does not depend on the project architecture, it can run with microservices, monoliths and hybrid systems just the same. It's in our best interest to support all variates :)

</comment></comment><comment><USER19> I love microservices. Why? Because when customer is left in the wind with a myriad of small problems, due to previous developer(s) making a simple big problem into a complex array of microservices, they then pay big bucks to me for solving. What I usually do is integrate them back into the monolith they should've been to begin with.

Consequently there are customers left in wind with a tiny problem on their monolith that could've been easily solved if the original architect would've split it in 3 or 4 parts, which I usually do at the time.

I love hypes and I love the culture HN is spreading in developers world. It means a lot of code needs me to fix it and as a freelancer I make sure to get the big money while posing as the God's gift to them clueless clients.

</comment><comment><USER20> microservices have made my life hell because we just blindly followed the herd and didn't really know what we were doing. now we have 300 lambda functions for a team of 6 !!!

<comment><USER5> If you don't know what you are doing, your life is going to be Hell regardless.

</comment></comment><comment><USER21> Adopting Microservices in two steps:

1\. Don't do it

2\. Don't do it yet</comment>


Yes, I was hacked. Hard. - <AUTHOR> http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard <comment><USER2> Damn, poor dude. The remote wipe was a pretty big asshole move.

I'm pretty curious about the initial break-in on his .mac account. I suspect that either he's misremembering and he has used the password elsewhere (and it was compromised there -- easy to happen over so many years of use), or it wasn't very strong to begin with and it got guessed after a handful of attempts.

There are a handful of takeaways from this:

\- Backups, obviously. A lot of people here so far are mentioning online backup services, but those would be just as vulnerable to this kind of attack, since they're accessible online and use an email account for password resets. Online backup services and physical offline backups solve different problems and it's a good idea to use both.

\- Since I haven't seen this mentioned anywhere else: I wonder if it's time to consider keeping a "secret" email account that's only used as the password- reset account for all of your services? Something that you never use for communication, never publish anywhere, something with its own entirely separate password.

\- Be careful about owning multiple devices from a single vendor that provides remote access and other kinds of control to those devices. Mobile devices are inherently insecure; they shouldn't carry sensitive personal information, ever. There are a lot of really good reasons for going with a single vendor, and remote wipe is a really valuable tool in case of theft, but the downside is ... well, this.

\- Use some kind of password storage mechanism. (I prefer something that's not tied in to a publicly-accessible service.) I've made a game out of memorizing horrible passwords, and can recall quite a few without any patterns or mnemonics or the like. Still, I use KeePass every day anyway.

And maybe most of all: I doubt there's a single one of us that has a moral high horse to ride on this. Everybody always has something better to do than set up a new backup system or dick around with something that will only maybe hurt them someday. I'm constantly harping on other people about backups, but only a couple of days ago got my development machine on our network backup system; I'm pretty anal about passwords, but still I'll panic pretty badly if my laptop is ever stolen, because in there, somewhere, is probably a plain text password stored in a file that I've forgotten about, and there'll be a chance that I'll forget to change that particular password if I find myself having to suddenly change every single password for everything I've got access to.

<comment><USER3> +1 for the moral high horse. Everytime something gets hacked the hacker community blames the victim for using less-than-optimal security. Well guess what? There is no foolproof system. The same reactions are seen when sites go down. 'Oh, but they should have used a distributed, redundant buzzword compliant system in a multitude of nuclear bunkers and this would never have happened'. Every system has weaknesses. And every person or team is imperfect. Sure there are lessons to learn, but lets show some sympathy and ask the persons involved what they would improve, not assume that we understand everything and dictate what they should have done.

<comment><USER4> Not having any backup is, for a technically capable user, indefensible.

<comment><USER5> How is it even possibl? iOS devices back themselves up every time they are plugged into a Mac automatically, and it's really difficult not to have a Mac backup, time machine just does it automatically whenever it feels like it. I find that within the Mac ecosphere, it's hard not to have backups.

I backup gmail with gmvault to a thumb drive, which I suppose is beyond many non technical people, but I'm sure google will figure out how to restore his account without much difficulty.

I wish I knew how this person knew how his password was compromised, it sounds reasonably secure.

<comment><USER6> I suspect a lot of people ONLY have the devices, and have not spent the extra few hundred on any kind of backup. A Time Capsule? A third-party remote backup service? An external HD? That costs MONEY!

I personally haven't plugged my iPad into my Mac in ages. Then again I've also made damn sure it's backing itself up to the cloud. I'm not sure if this is the default setting. It should be, IMHO.

(And I gotta say, it's really freeing to know that even if all my possessions are destroyed, I will have lost at most a day or so of work.)

<comment><USER7> Backing up to the cloud isn't going to help in this guys situation. The malicious user had access to his iCloud account to remote wipe his devices, they would (did?) just as easily delete his cloud backups

</comment></comment></comment></comment></comment></comment><comment><USER8> One thing that worries me about iCloud is that it puts a lot of data and services behind one single password.

Said password is therefor used a lot, with a lot of chances for interception. But most of all, it's used for trivial matters in which password typing is a nuisance (installing a cheap iPhone app), which pretty much invites people to use a weak, easy to type password.

iCloud should have multiple, completely separate forms of authentication for services like Find My Mac, instead of using the same login for wiping all your Apple hardware as you use to download Angry Birds...

<comment><USER9> Same reason why I worry about Google Accounts.

Your email, contacts, calendar, location, phone security, documents, files, music, videos, games, apps, credit card details, merchant account, search history, web app hosting, etc., all on one account.

<comment><USER10> Turn on 2-factor auth.

I thought about it and worried about it and thought about it some more, and finally did it.

And I had no problems at all - it works really well.

<comment><USER11> Dedicated attackers routinely bypass two-factor auth. If your second factor is your phone, then they simply attack via the phone carrier first.

<comment><USER12> Don't use texts for the two factor auth, use the Google's app [https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en) and print out the one time codes when prompted (for when your phone is unavailable for whatever reason).

As a bonus, you can also use it for when logging in over ssh with password [http://askubuntu.com/questions/159727/how-can-i-use-a- passco...](http://askubuntu.com/questions/159727/how-can-i-use-a-passcode- generator-for-authentication-for-remote-logins/159728#159728)

Anything can be hacked but it's a really solid system, even against a targeted attack and motivated attacker.

<comment><USER13> Thanks for the link, but could you explain why texts are non-optimal?

<comment><USER14> Phone companies are often quite stupid about letting phone numbers (with their texts) get redirected. Like you don't have to know any private information, just have a good story stupid.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> "He and Gawker's Scott Kidder then got on the phone with contacts at Google and Twitter trying to help me put the brakes on."

Of all the issues surrounding this event, this one concerns me most. Most users would not be able to escalate like this. Hosted services need to be providing this level of support to all customers 24/7/365 - or at least offer it as a premium option.

<comment><USER16> For Google Apps paid users: [http://googleenterprise.blogspot.com.au/2011/11/24-x-7-phone...](http://googleenterprise.blogspot.com.au/2011/11/24-x-7-phone- support-for-all-issues-and_14.html)

<comment><USER15> I have this - and I had reason to call it recently due to a technical issue.

In short: I'd advanced paid for a 1 year Apps account a month before the monthly billing came in to place. My credit card expired with 11 months of the contract left, but they suspended the account as that appears to be policy with new monthly billing system. I received no email asking to update the card prior to suspension. This suspended all the services it was connected to. Call centre couldn't help, account was down for 18h - they just said wait for new card to propagate.

I'm sure if a journalist from Gawker had posted this to HN it would have been resolved with more urgency.

</comment></comment></comment><comment><USER17> Everyone's focusing on the security of the password and iCloud, but I just wanted to take a second to say: fuck who did this. Yes he should have backups, but erasing someone's things is such a juvenile thing to enjoy.

Edit: Surprised to see Cloudflare is proxying their website. I understand wanting to be impartial, but I think it's fairly easy to draw the line at groups breaking the law.

<comment><USER18> _erasing someone's things is such a juvenile thing to enjoy_

I don't know what part of the world you're in, but here (in the UK) it'd actually be a criminal offense carrying a multi-year prison sentence under the Computer Misuse Act.

I'm wondering at what point the police or law enforcement get involved in the US?

<comment><USER17> Generally if the person is important enough.

This is the only case I can think of where non-classified information leaks were prosecuted: <http://en.wikipedia.org/wiki/Sarah_Palin_email_hack> (There are probably more, but I can't imagine any would actually disprove my point.)

<comment><USER18> This isn't solely about an information leak, though -- it's about willful destruction of property (i.e. all the victim's data getting vaped).

<comment><USER19> Usually the FBI is the agency that you go to with this stuff, and they usually don't help unless you can claim X hundreds of thousands of dollars in losses. Basically, they only care about rich people and corporations. Hackers are given a blank cheque so long as they only do small amounts of financially quantifiable damage.

</comment></comment></comment></comment></comment><comment><USER20> If he really hasn't used that password anywhere else and it was not based on a dictionary word, then I highly doubt OP's password was brute-forced.

Brute-forcing the iCloud password is an online attack and would probably (hopefully) be caught by apple.

What is more likely is a keylogger or similar malware at which point even a longer password would not have helped. The days where macs are free of malware are unfortunately over.

<comment><USER21> Or maybe there's a problem with the iCloud auth protocol, and it was snooped? For example, that in-app purchase hack (which involved a MITM attack after installing a custom SSL CA) revealed passwords were being sent "in the clear" inside the SSL transport.

This is just speculation.

<comment><USER22> My first impression is that either a session token or password was intercepted from iCloud either via malware or MITM. But the post mentions that the iCloud password was reset, which means the account may have been hacked via Apple ID security questions[1]

When I just did this for my own account, the first security question is your date of birth, which is easy to find for anybody via Facebook. The second was a generic security question.

These are easy to guess or to find out via social media. You could spearfish a user by sending them a free account to a web service and asking them the same security questions on registration.

The security isn't adequate, considering the data that is held behind an Apple ID. I also can't believe they have a delete feature that can not be undone.

For my own account I have done a few things. First I have a secret email address for online accounts that require higher security. These emails are unique for each service and are not published anywhere. I have also removed all of my personal information from my social accounts, such as date of birth, name of school, etc. and my security answers are always random strings.

The other option is that malware was used, or a transparent proxy. If iCloud doesn't verify the server certificate it would be straight forward to proxy the HTTPS requests. iCloud will also always send out connection attempts every x minutes, so if you accidentally connect to a public WiFI hotspot or personal network with an intercepting proxy setup, you can have your password stolen in a matter of minutes.

I am also not super-confident about two-factor auth. I noticed that with Google Apps the verification SMS messages can be read using the web interface for my telco provider. A web interface that is protected by nothing more than an email address and password with the same weak security questions.

I think it is very feasible to hack around second-factor SMS notifications by first hacking the telco provider web interface and reading then deleting the SMS alerts. You are only as secure as the weakest link in the chain.

[1] [https://iforgot.apple.com/cgi- bin/WebObjects/DSiForgot.woa/w...](https://iforgot.apple.com/cgi- bin/WebObjects/DSiForgot.woa/wa/iforgot)

<comment><USER23> Wow, I wonder if people realize just how scary this is. Security Questions are a terrible idea.

<comment><USER24> The solution is to intentionally answer the security questions wrong. For example, always spell your mother's maiden name backwards.

</comment></comment></comment></comment></comment><comment><USER25> Hi, I'm Mat Honan (the guy who was hacked). I've been in touch with the person who hacked my account. He says it wasn't brute force, or guessed. I'll publish more when I know more.

To be clear, the password was unique. I use 1password as a password manager and even double checked to make sure that I wasn't using it anywhere else.

<comment><USER26> Have you considered (temporarily) disabling comments on your blog? Many of them are quite hostile, and might as well be deleted.

<comment><USER25> They're rabid. But I think it's kind of an interesting side note at this point.

<comment><USER27> What have you done to elicit so much hate (from the hacker and the commenters)?

<comment><USER25> I genuinely don't know. The hacker said it wasn't personal. My guess is that I was a waypoint to get to Gizmodo.

</comment></comment></comment></comment></comment><comment><USER21> That's it, I'm disabling "Find my mac". I guess it wouldn't work anyways if a thief is far away from my home or work wifi. So in essence, it's a remote wipe backdoor for when the device is in my possession, and useless if it's stolen.

FileVault2 should take care of the theft problem anyways.

Too bad you can't partially-enable Find my mac for the location service, while disabling the remote wipe and lock services.

<comment><USER28> Instead of only disabling Find my Mac, please make sure your backups are functional and enabled. That way, if your machine fails or gets wiped (whether it's by you, a thief or someone with your iCloud password), you can still recover everything.

<comment><USER21> Sure. But should something like this happen, I'd prefer to not waste time having to sit through a complete reinstall before I can start damage control by changing passwords online, etc.

<comment><USER29> That's what live CDs are for. If your system gets owned, you can't trust it anymore.

<comment><USER21> I don't think getting hold of the iCloud password would let anyone "own" my mac. (The only things they should be able to do with that would be messing with my synced address book, notes and photostream - and if "find my mac" was enabled, perform a remote wipe).

</comment></comment></comment></comment></comment><comment><USER30> The hostility towards this guy in the comments is astounding. I already had low expectations for comments on blogs, but this took it to a whole new level.

<comment><USER31> Impressed by that too. It gives the impression that some of the commenters are involved with the stunt.

<comment><USER32> Honestly, it gives the impression that some of the commenters are from the internet. As sad as it is, you can kind of expect shit like that from completely disinterested parties who just want to be assholes.

<comment><USER33> It's not much different than driving - the nicest guy can turn into the worst a-hole on the road.

The internet, like a car, somehow makes people feel like they have an invincibility cloak on that lets them behave badly.

<comment><USER34> Wandering a bit OT, admittedly, but I feel obliged to push back against this notion. I know you didn't mean it this way, but I see it too often to wave away worse examples of abusive behavior, and it's just not healthy.

The "nicest guy" would not use language like "bitch" or "fag" in comments (to pull the first example I saw in that post's responses), because this implies an assumption that comparing the target to a woman or a gay man should be received as a deeply cutting insult. And this alone acts as enough of a cover for me to judge that book, really.

No, these are in fact rather horrible little people, and it wouldn't surprise me if they were in league with the perps who erased this guy's stuff for teh lulz or whatever.

<comment><USER33> Yeah, you're right, the behaviour is intensified on the Internet, probably because of a greater perceived sense of anonymity. On the road, you've got license plates, people with cameras, cops, the risk of getting into an accident, etc. to occasionally keep people in check.

But to clarify my earlier point, if the nicest guy can turn into a bad person on the road, imagine what a not-so-nice person can turn into.

</comment></comment></comment></comment></comment></comment><comment><USER35> _> >7 digit alphanumeric_

...could mean anything from _myacct1_ to _iS2xd45_

Since the password is no longer in use (only assuming), it would be interesting to know what it was - perhaps the reason that it was hacked was that it simply was easy to brute force due to common dictionary words?

Just throwing an (possibly wrong) idea out there.

<comment><USER36> That still rasies some questions. You're either implying Apple allow enough login attempts for brute force against their live web services to be possible, or that someon somehow got hold of the password hash.

Without knowing the guy, I strongly suspect a reused password that was exposed somewhere other than Apple/iCloud. Anyone want to bet against this Gizmodo guy's password being in the Gawker password dump?

<comment><USER36> I guess I owe @mat an apology here - it seems Apple's customer service was at fault, not @mat's password reuse practices…

</comment></comment></comment><comment><USER37> This is why I use two factor authentication for my email. It's a usability nightmare, but not as much of a nightmare as losing all my accounts everywhere.

<comment><USER38> Two factor is magnitudes better than password only, but it's not foolproof.

Security is only as strong as the weakest link. CloudFlare was hacked recently because the attacker was able to redirect voicemail to another account, then use the two-factor backup recovery phone option to take control of Google Authenticator.

[https://blog.cloudflare.com/the-four-critical-security- flaws...](https://blog.cloudflare.com/the-four-critical-security-flaws-that- resulte)

<comment><USER37> You can no longer recover a Google account via a voicemail message, and AT&T now allows you to lock changes to your account with a passcode. And, the people that committed this particular attack are now in jail awaiting trial.

</comment></comment></comment><comment><USER39> This is one of the reasons why I have different Apple ID for app purchases (with weaker password which I'm more comfortable to type over and over again when purchasing apps) and different for iCloud (which I need to type only once, configuring the device).

I saw many people buying their apps in public and the password input in iOS isn't really secure from bystanders. As a Gizmodo reporter he probably went to dozens of events where he was pitched to try someone's app and maybe even given App Store codes. If he used to download apps on such events that might be the source of his leaked password. Someone could simply see what password is he typing.

As long as Apple requires you to type the password with each purchase, it is wise to separate your sensitive data/services with the App Store credentials.

<comment><USER23> Never understood Apple's insistence on asking for the password all the time.

For such a customer focused company, it just seems so bad.

<comment><USER40> If you get the chance to watch a kid playing with an iPhone it's an eye opener. The 15min no auth required again window after an app purchase is the devil's time.

<comment><USER41> Airplane mode.

</comment></comment></comment></comment><comment><USER42> Well, if you will put complete remote control of all your devices behind a single, weak password.....

<comment><USER43> What difference does it make how strong the password is? It was a seven-digit alphanumeric password, right? Is iCloud going to permit up to 36^7-1 failed login attempts in a row without rate-limiting, banning, or launching missiles at the owner of the offending IP address?

Assuming the answer is no, there are only two remaining alternatives: 1) Someone targeted and keylogged him to obtain the password, in which case it doesn't matter how strong the password is; or 2) Someone hacked iCloud itself and stole their (presumably unsalted) password file.

In that case, yeah, a stronger password might've helped. Bad user. No cookie.

But if _he_ thinks he's having a rough night, consider what scenario #2 would mean to Apple. The impact of an iCloud hack would be measured in multiple billions of dollars of market capitalization.

<comment><USER35> The strength of the password is relevant in the scenario where the password was actually brute-forced through an interface. If it was _jesus01_ (or something else common - typically religious), then it may be an easy hack for the hacker.

<comment><USER35> "Brute-forced" was a bad word choice.

Typing-the-most-common-passwords-with-numbers through the interface style. Basically guessing from the top password list.

<comment><USER43> But again, why would iCloud allow that many consecutive failed login attempts without locking the account?

<comment><USER35> iCloud would surely block consecutive, failed login attempts. From the post, reading _years and years_ , opens up the possibility that it may have been something the hacker was following for some time. Therefore, he would have been blocked, but may have come back in 1 week to try again.

The possibility is a bit far-fetched, but it exists. The likelihood that this was actually the case is extremely low.

<comment><USER36> I _strongly_ suspect the iCloud web login will block brute force attempts. What I do wonder though, is if there's some other place an iCloud/AppleID login can be brute forced without appropriate rate limiting? Maybe an IAP API endpoint? Or an in app advertising endpoint? I wonder if the "check whether an IAP succeeded" API that the "just redirect you dns to my server and add my root cert" "exploit" uses is failing to block brute force attempts?

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> Every machine we have has local backup in the form of a sizable external USB drive. Some also backup to a network drive. Windows and Mac. With dozens of machines it is hard to justify paying for remote backup. Although, every time I say or think this I also think: fire, theft, earthquake. I wish there were a reasonably priced multi-machine remote backup service at an affordable price with storage measured in terabytes. One hundred gigs doesn't even begin to scratch the surface.

<comment><USER45> There is Backblaze[1]. Unlimited backup at $50/year/computer.

[1] <http://www.backblaze.com/>

<comment><USER46> My wife recently started using this. She wanted to have another source backing up her photography (being a photographer and all...), and this was highly recommended by all her friends with expensive cameras and even more expensive lenses.

I was shocked, mostly because the price was fairly inexpensive, and her lot love to spend lots of money on small things.

I take pictures with my iPhone. =/

</comment></comment></comment><comment><USER47> _My guess is they used brute force to get the password_

How can a system allow login attempts so fast and often that a 7 digit word with numbers can be hacked?

That's hundreds of thousands of attempts.

<comment><USER43> About forty billion attempts, to be specific.

It wasn't brute-forced, unless somebody got their hands on the iCloud password database.

</comment></comment><comment><USER48> Very well written story and also very educational on the faith peopl put in cloud backups. Even if you have a cloud backup/syncronised it is still worth popping over your mum's or a good freinds with a some burned DVD's or external USB drive (if you have two you can swap them every time you visit). This approach is good as a cheap offsite backup and also social at the same time.

As for linked accounts, that again is another education many of us have probably overlooked and I would say if you do have a 2-factor facility that uses SMS, maybe think about digging out an old phone and getting a PAYG SIM with a token credit and using that number. But security is a never ending drive bordering on paranoia and in that you do what is enough to help you sleep at night after reading the article.

Don't think I have seen a article doing a test on how easiy it is to recover a hacked account and how long it takes. I certainly have never seen any speed comparisions, nor consumer reviews in that area. Anybody know of any at all?

</comment><comment><USER49> Passwords: Don't try to remember them. Use a service like passpack to generate and store random ones for every account. Two pass authenticate into it.

Data: Back it up. Backup your backups. Stop fucking around. If you don't get hacked, your storage will fail.

Software: Don't install shit you don't trust. Don't trust shit you can't verify.

Passwords: Don't try to remember them!!

It's 2012, not following these simple rules is inexcusable.

<comment><USER36> Unfortunately, my AppleID password is one I _do_ need to remember - I need to use it often, and in places that 1Password won't auto fill. At least: the iCloud website login, various iDevices when using app store, and iTunes on several machines (all on the home sharing network). The alternative seems to be to have all those devices "remember" my AppleID password, which seems like a security lose.

<comment><USER10> _Unfortunately, my AppleID password is one I _do_ need to remember - I need to use it often, and in places that 1Password won't auto fill._

Write it down on a piece of paper (or use a password manager that will show your password).

Back in the 1990's "writing down passwords" was considered a huge security hole.

Now day's attack vectors have changed and it is probably more safe than using a memorable password.

 _The alternative seems to be to have all those devices "remember" my AppleID password, which seems like a security lose._

If your devices are physically safe, and iCloud has remote log-out (does it?) then this may be more safe too.

<comment><USER50> Not disagreeing with you but think of all the times you need your appleID on the go. Carrying around a piece of paper may not be feasible or ideal

<comment><USER51> The strong password has value. Credit cards and cash have value.

Write the strong password on a credit card sized bit of paper, and keep it in your wallet.

People tend to keep their wallets safe.

Most people can learn complicated passwords after a few days or weeks of use, so you can keep the paper in a safe place at home once you've learnt it.

<comment><USER31> Worst advice ever. Now you only need to lose your wallet and you're in the same situation as the article's. The old advice is still sound.

<comment><USER52> If you label the passwords you're probably doing it wrong. If someone pulls out a piece of paper that says "QWhXnLv0qzi1h1m" out of my wallet, how are they going to use it?

If you're worried about someone stealing it, just shift the password over, so it's now "mQWhXnLv0qzi1h1 > 1" on paper.

<comment><USER31> Any tech savy person knows that has a strong possibility of being a password. Grab an ID, google "your name gmail", log in.

The kind of weak encrypting scheme you can remember is easily defeatable, this is still very vulnerable even if you leave one or two letters off (which you'll have to remember in addition to the scheme). So, going back to the parent, no, this isn't safer than a password in your head.

<comment><USER53> but this isn't the password for gmail. This is the password for the password manager account. So you need to know the password manager they are using and the username to match with the password. They have to find this out within the time that we've realised we have lost our wallet and are changing the password.

Obviously this is still less secure than no password in the wallet at all, but I don't think it's "very vulnerable" as you are claiming.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER54> Hate to repurpose a cliche, but never put all of your eggs in one basket.

<comment><USER55> On the contrary.

Put all your eggs in one basket and then _watch that basket_.

</comment></comment><comment><USER56> No backup? Seriously? Wow.

What do people like for backups these days? Crashplan seems pretty damn good to me.

<comment><USER2> ...Wait, you mean, an online backup service that sends emails (and password reset requests) to an email account that can be compromised?

Hm.

<comment><USER57> Question: could an attacked delete my CrashPlan backup via the website?

It seems like they should be holding on to files for 30 days period or something. Does anyone know?

<comment><USER2> Doesn't look like they hold on to the data if you remove a computer from your CrashPlan account: [http://support.crashplan.com/doku.php/how_to/remove_a_comput...](http://support.crashplan.com/doku.php/how_to/remove_a_computer)

(I do like CrashPlan, but this seems to be common practice with data storage services.)

Removing the computers associated with a CrashPlan account and then cancelling the account looks like it'll cause a pretty big headache.

</comment></comment></comment></comment><comment><USER58> Is there some background concerning the author that I'm not aware of? Asking because some comments (at Emptyage, not here) seem unusually hostile.

</comment><comment><USER59> So via your iCloud account someone can remote wipe all your Apple devices? That seems like a questionable design. Does anyone know the rationale behind this? I guess it would be useful to deny access to your data in the case where your device is physically stolen.

Maybe there should be a significant time period (hours?) after a password change where this functionality (and any other data-destruction functionality) is disabled. Or maybe a password change should require you to re-auth every device before data remote deletion features can be used on it.

<comment><USER60> It's so that _you_ can remote wipe your own devices if you lose them, in case you have sensitive data on them. For example, my employer requires that you enable this feature if you want to get your work email on your phone.

</comment></comment><comment><USER50> Don't know if this has been mentioned yet, but Gawker was completely hacked to pieces two years ago

<http://www.wired.com/threatlevel/2010/12/gawker-hacked/>

The most visible consequence was that the entire user DB was compromised and the site rooted. But other consequences were that the hackers had cracked a large number of Gawker staff accounts and even had access to internal emails and chats.

I think it feasible that enough internal info was linked to compromise Gawker's staff for years. Some of them probably thought resetting their gawker.com account was enough, and forgetting that that password might have been used elsewhere. Also unclear is how long the hackers were snooping around before the hack was discovered...in that time, they could have download dumps of staff email and gmail accounts.

The upshot: someone out there might have several GB of personal gawker staff info. Ever email yourself your ID number to your email account? Has anyone ever emailed you credentials that you forgot in the heat of the moment? How many times does your social security number appear in your Gmail, thanks to attached billing/app files at you originated from there.

And remember that the hackers had root access to everything at Gawker, even the site source code. How positive is everyone there (remember that the owner's laughable password is one of the main reason that Gawker got crushed) that no key-loggers had been secretly installed and have been running all this time? It doesn't even require anything that sophisticated...all it takes is one security-unsavvy staff member...and this is a staff of mostly culture writers...to do something insecure.

I'm not sure if Mat was employed by Gawker all this time but even if he came after the hack, you can see how one massive data breach can have almost permanent implications within an organization.

That said, what an awful incident and thank you to him for writing a thorough account of how he coped...this is a valuable lesson to everyone and I hope they find the punks who did it.

* To underscore my point, I didn't realize that Honan is recently a former Gawker employee. Yet he had enough credentialed access for an outsider to break into Gizmodo's twitter account. I bet Gizmodo didn't think that an amicable departure of an employee was enough to warrant a password change to Twitter...but if his emails contained the password, then it's an easy hack. If I were Gawker, I would change EVERYTHING...not just gizmodo info, but all of its sister Gawker site credentials. They should assume the worst and that someone out there has all of Honan's emails, including every time he might have been emailed credentials in plaintext

 __also, Honan's current employer, Wired, should do the same. Change all the keys.

</comment><comment><USER61> Remote data wipe access to devices from cloud service. What could go wrong?

<comment><USER62> Well it's still much preferable to not being able to wipe data from stolen hardware.

<comment><USER63> Better still would be encryption that meant there was no need to wipe data from stolen hardware.

</comment></comment></comment><comment><USER64> After hearing how this attacker was able move from one linked account to the next, ultimately gaining a snow-ball effect of moving through, defacing and wiping your data, from a security standpoint i can't say i'm surprised (of course that doesn't mean i don't feel for you and wish it never happened to you). I've made several avenues available to mitigate these types of effects, none of which involve administration at Twitter like most of the world.

Now i don't mean to insult you, but one basic avenue is two physical, offline & secure back-ups of everything i have on and off of the Cloud... with no connection to any network. I do have to say that it took a little bit of time to realize i did actually have to do this because my reliance on that data crept up like a ninja! And before i knew it i had well over 30Gigs of data up there in the Cloud, not backed-up.

</comment><comment><USER65> I actually didn't even know that enabling "find my X" also enabled that remove wipe option. I just disabled it for my MacBook Pro, Undercover is a much better solution anyway: <http://www.orbicule.com/undercover/>

<comment><USER66> Do people really think these services are actually much good though?

Sure there's a few amazing stories they use for the marketing campaign, but that's about it. If you actually loose it (i.e. not stolen) then they work.

Most people that steal them though know exactly what they're doing and how to wipe them properly. Same with mobile phones etc.

I guess something is better than nothing, but really it seems to me they're selling you the same as the dream of winning lotto without mentioning the actual odds.

</comment></comment><comment><USER67> > When I set it up, _years and years ago_ , that seemed pretty secure at the > time.

If you did not change your password in those many years, an attacker had years and years of time to find or crack it. Regularly change your passwords. And use special characters.

</comment><comment><USER68> It's both better than and worse than it appeared/feared. It turns out it wasn't a password hack, it was a social hack against Apple. Looks like someone recently watched the movie Hackers and wanted to see if that stuff still works. Hint: It still works.

Update Three: I know how it was done now. Confirmed with both the hacker and Apple. It wasn't password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions. Apple has my Macbook and is trying to recover the data. I'm back in all my accounts that I know I was locked out of. Still trying to figure out where else they were.

</comment><comment><USER69> The thing I keep thinking about when reading this is how many others, perhaps thousands or more, get hacked like that but don't have his clout? No direct line to Twitter, Google, etc..

</comment><comment> at-fates-hands Once again another cautionary tale about why you should be paranoid about the security of your devices and accounts.

When securing anything, the best philosophy is to just assume you're going to get hacked and act accordingly. Linking accounts, weak passwords, and no encryption? You're just putting a target on yourself.

Best advice? Keepass, Whole disk encryption and using anonymous information is a good start. Keep your stuff and accounts in separate silos, and stay in the shadows.

</comment><comment><USER70> Regarding Google services:

When you enable Two-Factor Authentication, they give you the option of printing a "one time pad" with six codes on it. You then print this out and keep it safe somewhere. That way you can get into your account even if your phone and other contact points are compromised.

This won't do you any good if someone has deleted your google accounts or reset the 2FA system, but for more "normal" scenarios it can be a life-saver.

</comment><comment><USER71> It should also be noted that on the iCloud web site there is no link to change password. This is the url to access the "My Apple Id" page and change the global password: <https://appleid.apple.com/cgi-bin/WebObjects/MyAppleId.woa/>

</comment><comment><USER72> Probably was hacked through email, then iCloud password recovered through it.

I wish there were a special high security password recovery email mailbox, separate from routine communications mailbox, in apps. Would be really hard to get adopted, and t that point, you might as well push for something better than passwords.

</comment><comment><USER73> The online backup service advice sounds good but what about the people, like me, who have an upload speed of only 64kb/s? No Blackblaze or Crashplan for me... Neither can I upgrade my internet connection. So what to do? I have two Time Machine backups (one hourly at home and one daily at another place).

</comment><comment><USER74> I wonder _why_ the article author was (seemingly) targeted? And who else might the criminal be targeting?

Or could this be completely untargeted? That might mean that anyone with a password vulnerability is at risk of having their digital life wiped out. That seems pretty extreme for lulz.

</comment><comment><USER75> I'm amazed that Apple isn't running something to check for brute force attacks on iCloud.

<comment><USER76> As am I, considering almost weekly I used to get my iTunes account reset from failed attempts (maybe an old app or suspicious activity?).

More likely the writer erred and reused the password.

<comment><USER75> Or had his password shoulder surfed or something similar.

</comment></comment></comment><comment><USER77> Why would anyone store that much data behind one password? Apple really shouldn't give the ability to remotely destroy all data on multiple devices with a single password.

I love my MacBook and all, but I would never use such a stupidly insecure service.

</comment><comment><USER78> Wow, who would give a program like "iCloud" access such that it could wipe your mobile, tablet, and PC? I hope the author can recover his data, but it sounds like he set himself up for disaster by linking all his systems so strongly.

</comment><comment><USER79> >>They weren't able to stop the wipe on my Macbook. Or give me a pin to log into it.

I don't use a mac so this question might seem a little off.

Wouldn't disabling the computer's internet access stop his data from being entirely wiped?

<comment><USER80> Yes but he didnt realise what was happening. Ran for the computer not the wifi router.

</comment></comment><comment><USER81> Google two-factor auth doesn't work if you have IMAP or POP enabled.

<comment><USER82> In a sense it does. They provide different random 16 characters passwords for each of the client that request access to your data and does not support two- factor.

So if someone hacks your gmail password, they still cannot login via IMAP or POP, as they require different password (which you shouldn't write down or remember anyway).

</comment></comment><comment><USER83> I created <https://uncrackablepassword.com/> to generate passwords online that I don't need to remember.

</comment><comment><USER84> This article inspired me to begin using a password manager instead of putting everything in `.netrc`, `getmailrc`, and plaintext passwords everywhere else. Thanks.

</comment><comment><USER85> Personally I think all web services should be using aliases (so you don't login with the username that other people see) and pass phrases rather than passwords.

</comment><comment><USER86> That made me say thanks to Google 2-step verification.

</comment><comment><USER87> Haha, oh wow those comments on his post are horrible.

</comment><comment><USER88> The comments on that blog post make me remember all the things i hate about the Internet.

<comment><USER89> Indeed - I found the comments on the post almost as bad as the malice of the hack....

</comment></comment><comment><USER90> I hope the password wasn't:

g1zm0do

:)

<comment><USER90> Social Engineering... we never had a chance.

</comment></comment><comment><USER91> Well that sucks. Big time.

</comment><comment><USER92> why is this news?

<comment><USER66> Because it shows people the effect that someone getting your iTunes password can have, especially if you've enabled Find my X in your account?

It shows that (maybe) it's possible to brute force an Apple password?

Because it's generally interesting reading, in the same way that people like to rubberneck at car crashes. I'm not saying that's right, but it's human nature.

<comment><USER93> Specially because people are dumb enough to rely important data to third parties, instead of having it at home.

<comment><USER94> Right. Because my own laptop is not 'at home'.

<comment><USER93> Encrypt the harddisk, and backup regularly when at home.

I imagine you have to be at home some point in the day right?

For the very important data, put it in a safe.

<comment><USER94> What? My first comment was sarcastic. When I have my laptop within arm's reach at home the data is safe without relying on a third party. Except when someone installs a backdoor.

<comment><USER93> Ah, ok. Point taken.

I did not understood it like that, sorry about that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER95> Mat Honan's statement on being hacked scared me into changing every password. You'll prob feel the same way, too.

<comment><USER43> Not really. This was clearly a targeted attack, whether he realizes it or not.

A security problem, not a password problem, in other words.</comment></comment>


Stealing local files using Safari Web Share API - <AUTHOR> https://blog.redteam.pl/2020/08/stealing-local-files-using-safari-web.html <comment><USER2> "Apple replied asking not to publish the details as they plan to address the issue in the Spring 2021 security update"

Besides the fact that I'm always torn if vulnerabilities should be published if the vendor has committed to fixing them: I don't quite understand why a fix can't make it into the next big release that's around the corner (macOS Big Sur and iOS 14). Do large vendors really have such long development pipelines that changing anything is impossible for months? Or do they just have thousands of similarly serious issues and need to prioritize?

<comment><USER3> If this an accurate representation of what Apple said, they have a _security_ update planned for ~6 months from now. What else are we needlessly vulnerable to until then?

Signed, an iOS convert of 2 months :/

</comment></comment><comment><USER4> Is there a use-case where this functionality is useful and non-malicious?

It seems that the protection against this attack is being able to recognize that the file that's attached isn't the one that's intended but I think it's a mistake for the local filename and any fs metadata to be preserved when sharing by default. Sharing a file should mean sharing only the content of the that file.

<comment><USER5> I don't think there is a valid use case. It seems like they just weren't validating the resource well enough.

Reminds me of the somewhat recent mailto:?attachment=/etc/password bug reappearance [https://gitlab.freedesktop.org/xdg/xdg- utils/-/issues/177](https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177)</comment></comment>


EverythingMe is Closing Down - <AUTHOR> http://blog.everything.me/index.php/2015/11/22/everythingme-is-closing-down/ <comment><USER2> EverythingMe was a great product. Having been a long time Android user and a AOSP developer, the platform holds a tremendous promise, in my eyes.

EverythingMe tried solving the right problem. Launcher has so much potential to be smarter, yet it wasn't (then). Also, the amount of data one can get hands on must be monteziable somehow...think how valuable it is to be at the homepage of a browser... A launcher is similar, only that it absolutely dwarfs browser hompages in usage time.

I'm sure EverythingMe tried everything, but like Aviator (acquired by Yahoo!), they found out that there's no competing with Google products.

If Google has a competing app on Android, what choices have you got of beating them? They control all the keys parts on the platform (rightly or wrongly), they rule the web, they have got endless source of resources... It's a tough world out there being an Android developer. Even Facebook, with all its might, couldn't make much of its Launcher, 'Home.'

Google Now is great and all. And with custom APIs for contextual cards, in-app searching and so on, Google is making it more difficult for the competition. It's web-search type dominance all over again, but on a much much bigger scale.

</comment><comment><USER3> Looking at the picture they put on the post... Can someone please explain why a launcher needs so many employees?

<comment><USER4> Here is the answer -> They have received $35 millions in funding and... the story now looks "familiar". [https://www.crunchbase.com/organization/everythingme#/entity](https://www.crunchbase.com/organization/everythingme#/entity)

<comment><USER5> Wow. How does something like this even get $35m in funding and just burn through that over 5 years, then shutdown because they couldn't monetise?

Were the investors hoping for a Google acquisition?

In Australia I'm struggling to raise $50k for a global product with a clear monetisation and cashflow strategy.

<comment><USER4> Please do not get caught on that hook. Try to earn that 50k yourself.

<comment><USER5> Yeah I've given up on seed/accelerator/incubator over here. There's a reason why only the boring cashflow +ve enterprise startups come out of Australia. Just means I need to be juggling various different projects to bootstrap. Currently monetising a separate startup in order to fund the one I actually want to work on.

</comment></comment></comment></comment></comment><comment><USER6> From reading the post I understand that they're taking down the launcher, or that it otherwise won't work anymore. And I have to ask - why? Why just not leave it there? Is there something in it that requires Internet connection to access their servers? It's a launcher, even predictive smart whatever features should _not_ require Internet access.

<comment><USER7> The prediction is likely entirely centralized machine learning; similar to how Netflix predictions work. Tell the server <x apps installed, y location, z time of day>, get a response showing <show apps a, b, q>.

<comment><USER6> > _< x apps installed, y location, z time of day>_

This is exactly the kind of data that should not fly over the wire unless it's absolutely necessary, which in this case I believe it isn't.

I can't imagine what kind of machine learning they'd have to be using to make it not work on a phone. It doesn't take much computing power to do a decent predictor. I'm going to assume process laziness here - being used to the idea that if everything is running on your server, you can tweak stuff there and have it immediately working on everyone's (Internet-connected) endpoints. It makes sense for websites, but IMO it's a wrong approach for devices.

<comment><USER8> Big data learning. They're (probably) inferring how you do stuff based also on how other people do. In fact, there's no way to recommend apps not already installed on your phone without consulting a server.

<comment><USER6> I think I misunderstood their app's description. I thought it was about recommending things to launch _out of the things you have installed_.

EDIT: And I'd pay for a launcher that learns from my interactions with it _off-line_ , and recommends me apps based on context such as location, time of day, previously launched apps, etc. Such a thing does _not_ need "big data learning". It's an undergrad-level machine learning exercise.

<comment><USER7> You should just build it yourself as a passion project. You can probably use the launcher in the AOSP as a base.

It might be faster to just hard-code manually arranged home screens based on time of day rather than do machine learning.

</comment></comment></comment></comment></comment></comment><comment><USER9> I hope this doesn't mean that re:dash will stop getting love from the developer. It's one of the best browser-based query front-ends I've used!

[http://redash.io/](http://redash.io/)

Edit: Looks like the Github repo has changed from the EverythingMe owned one to a Redash-specific one, huzzah!

[https://github.com/getredash/redash](https://github.com/getredash/redash)

</comment><comment><USER10> Discovery for anything is always overrated</comment>


Welcome Sam, Garry, Emmett, and Justin - <AUTHOR> http://ycombinator.posterous.com/welcome-sam-garry-emmett-and-justin <comment><USER2> It's a dojo.

The most senior students teach you all the basic stances/punches/kicks/throws. The sensei helps you put it all together into a coherent fighting style.

<comment><USER3> That sounds nice. When I was training, it was: senior students teach you the basic moves, and then the teacher chases you around with a big stick telling you to move faster.

</comment></comment><comment><USER4> These sorts of additions to the YC team provide a great example of how YC will scale its model. There's so much shared knowledge and know-how among the alumni and that's what will enable YC to create hundreds of companies a year without sacrificing quality.

<comment><USER5> This kinda looks like an apprentice-ship training system! The master adviser trains up a few keen trainees, these then in turn become masters who train more apprentices etc...

Maybe it IS a pyramid scheme all along! I did have my suspicions with the recent discussion / evaluation of YC performance.

<comment><USER6> A pyramid scheme is a zero-sum game where wealth accrues up the pyramid in exchange for promises of future riches to the new recruits. YC startups thus far have been a positive sum game to the tune of $4 billion. Additionally, new YC companies aren't required to pay anyone for the things YC provides (as opposed to a pyramid scheme).

</comment></comment></comment><comment><USER7> As part of YC winter 2011 I've already had office hours with both Sam and Garry. The nice part of having so many advisors is that each advisor tends to specialize in different areas (Garry is great with design and UX and Sam has good advice on social products and fundraising).

A wider variety of expertise is super helpful for the increasingly diverse group of YC companies.

Welcome Sam, Garry, Emmett, and Justin!

</comment><comment><USER8> This move seems to indicate that the startups are having issues getting access/undivided attention from the 'senior' partners. It is great that ycombinator has become so successful but the value prop of it seems to be diminishing as it grows. If I wanted to collaborate with other founders there are plenty of meetup groups I could attend without giving up a large share of my company.

<comment><USER6> Ouch! ;) I'm probably biased but a big part of the value we've received from YC has been from access to alumni -- for example, when going out for our series A Sam was actually the most helpful out of anyone we spoke to, having just gone through the process himself (and done a killer job!). I think the view we can bring as alumni going through later stage startups is that we have immediate relevant operational experience to earlier stage startups.

<comment><USER8> that wasn't intended to diminish your personal value or expertise. I think there is a general concern that future YC batches will have less personal involvement from the people that made YC compelling.

<comment><USER9> As s2009 alumni and current class (s2011) member I don't see any trend to support that concern.

<comment><USER10> From what I've heard from people in YC, Sam, Garry, and a few other YC alums have been incredibly useful, in addition to the senior YC partners. The only bottleneck has been food distribution at events.

</comment></comment></comment></comment></comment><comment><USER11> It seems that with each session, YC takes on more and more companies. Will this extra help continue to make this a YC norm? Has there been an upper limit defined?

<comment><AUTHOR> We can handle about 20 startups per (full-time) partner. Maybe 25. So with 10 partners advising startups we could get up to 200-250 startups simultaneously. Not that we expect to anytime soon; the point is just that if there is a limit, it's not immediately in front of us.

<comment><USER12> Have you considered taking on far more teams?

You're growing from batch to batch, but if you could reach 200 startups by your estimates, why not grow even faster? Is it just a matter of "slow and steady"?

<comment><AUTHOR> Our growth is entirely a function of the growth in applications. So we don't have much choice about our growth rate. To grow faster we'd have to fund people we thought would fail, and to grow slower we'd have to reject people we thought would succeed. Either would be painful.

<comment><USER13> Was the borderline rejected application in your 1st or 2nd years indistinguishable form this year's, in terms of quality?

<comment><AUTHOR> The quality of the applicants has been slowly increasing. But we are also slowly becoming less credulous.

</comment></comment></comment></comment></comment></comment><comment><USER14> Grats Garry!

=]

</comment><comment><USER15> Four more guys! That'll really help scale to a more gender-balanced group of companies!

No insult to Sam, Garry, Emmet, and Justin who I'm sure are very talented. But given how Jessica Livingston talks about how hard it's been for Y Combinator to attract female founders and then they do something like this, I really have to wonder how much they're trying to change.

<comment><AUTHOR> I think you're insulting female founders by suggesting that their decision about whether to apply to something like YC would be determined by the gender of the partners.

Surely male applicants wouldn't be scared off if most of the YC partners were female. Why assume female applicants are any different?

<comment><USER15> It's not a matter of women being "scared off". Diversifying the people at the top is one of the key steps to getting a more diverse organization. This was an opportunity to do it. YC chose not to.

In contrast, there's 500 Startups, where Dave McClure is actively reaching out.* Which environment is likely to look more attractive to women entrepeneurs?

* [http://www.ezebis.com/venture/dave-mcclure500-startups-found...](http://www.ezebis.com/venture/dave-mcclure500-startups-founderstaking-advantage-arbitrage-of-other-investors-disinclination/)

<comment><USER16> "She got into YCombinator. She must be good." vs "She got into 500 Startups. She must be good. Or they must have tried to recruit her because of that pronoun I keep using."

This is also why affirmative action hurts the careers of people who ostensibly benefit from it, if they don't get into Harvard: at Harvard, the black/white SAT gap is fairly small. Everywhere else, it's huge, so there's a big adverse selection problem, and of course employers know about it.</comment></comment></comment></comment>


QuickVid – Imgur for Videos – Feedback Wanted - <AUTHOR>

Hi All,
For the past couple of months I've been developing a web application to freely and instantly share videos without the need for an account. Basically imgur for videos. I've finally got the working build online and you can check it out here at http://quickvid.org.
So if you ever just need to send a quick video to a friend and don't want to deal with signing into YouTube or creating an account, check it out.
Please, if you find any issues report them to me via the feedback page.
Comments, suggestions, feedback, welcome! <comment><USER2> Viddme has worked pretty well for me, what makes yours better?</comment>


The case against C (The ModulaTor, 1993) - <AUTHOR> http://www.modulaware.com/mdlt35.htm <comment><USER2> I haven't heard of Oberon and Modula-2 in a very long time. C, however, is what I use every day.

This article reminds me of the BYTE issue in the mid-90s asking "Is UNIX dead?".

Nope. Various flavours of UNIX/Linux are still going from strength-to- strength. BYTE however died badly only a few years after that issue was printed.

"Pride Goeth Before A Fall." Or perhaps "Whistling Past The Graveyard" springs to mind.</comment>


Ask HN: How many people here actually invest in cryptocurrencies and why? - <AUTHOR> <comment><USER2> If you believe that money is the communication of value and you believe that communication is an important right of human beings, then giving the power of currency to the people, without rent seeking middlemen is net positive.

If you believe that interest rates are too cheap and causing boom and bust cycles, then it could be interesting to see what a deflationary currency does, and if it does actually generate a death spiral of savings and fear of taking loans.

If you believe that everything humans value that can be digitized, is, and successfully. Books, movies, photos, music. Then it makes sense that currency would become digital in the same way. You can make it at home, you can mix it, and you can broadcast it, just like all those other things.

If you like the idea of the worlds fastest appreciating currency/commodity/whatchamacallit... How many things are out there that actually change the relationship between man and government and man and other men more than a well adopted crypto currency would?

And how many of those things can you make money on by providing liquidity?

</comment><comment><USER3> I have a little bit of BTC left - I mined several years ago when it was still feasible to make money mining on a desktop PC with a good video card as part of a mining pool. I've sold off most of it, I have a little bit left that I'm not especially motivated to sell.

I don't see putting money (as cash, or mining) in cryptocurrency as investing, but as speculating. See [http://www.thesimpledollar.com/the-intelligent- investor-inve...](http://www.thesimpledollar.com/the-intelligent-investor- investment-versus-speculation/) for a classic discussion on the difference. I don't distinguish to be pedantic, but because the word "invest" is often used to mis-characterize spending or gambling in an unreasonably positive context.

<comment><USER4> Its possible at the moment to profitably GPU mine altcoins at pools that payout in BTC, but not very. A midrange GPU like a 1060 or 480 might net you $2/day after electricity costs, and that is strongly dependent on the recent rise in BTC price.

Its nothing like years back when a $150 GPU could net you $5-10/day in BTC, directly. Of course that period didn't last long -- I dont think even this mildly-profitable altcoin-mining period will last too long either.

</comment></comment><comment><USER5> I have some play money in ethereum and will be speculating on a few ICOs. There's absolutely potential for these coins to do 10x or even 1000x. There's also potential for government interference or worse.

The money isn't meaningful and I'm 100% ok losing every dollar because I can't justify putting significant money in. That being said, I do know people who have made very significant money over the last year because everything keeps doubling.

<comment><USER6> > I have some play money in ethereum .... There's absolutely potential for > these coins to do 10x or even 1000x ....

Genuinely curious how do you know or assess that etherum or any other ICO will do well in the future ? Isn't there an equal or greater chance of the currencies collapsing ?

<comment><USER5> I wouldn't say there's an equal chance of the "currencies" collapsing. There seems to be enough momentum behind them that the only true concern I have are hacking/scams and government interference. I don't mean momentum as upward price appreciation, just adoption, transaction rates, etc.

My friends, who are more interested in the space than I am, compare where crypto is now to the beginning of the internet. We're still trying to determine who's netscape/AOL/amazon/google and to some degree, what the underlying protocols are (tcp/ip = ethereum?).

Honestly, I don't see the true value of the blockchain yet. Most of the proposed ideas could be cool, but have no value or aren't practical. What I do see, however, is increased attention in Japan and Latin America. In the US, I think it's coming into mainstream attention. And if we find one real use case that allows mainstream adoption, it will be huge and transformative.

As a former trader, I don't mind speculating on the hype, but if we're still on the "ground floor" of what crypto could one day be, a little speculation could be a huge investment one day.

<comment><USER6> It is interesting that you compare ICO to the early days of the internet. Some people will definitely get very rich on this

</comment></comment></comment></comment><comment><USER7> I don't invest in cryptocurrencies, instead I invest in the companies who are building interesting things with them. I put money in this fund: [https://fundersclub.com/theme-series-bitcoin- payments/](https://fundersclub.com/theme-series-bitcoin-payments/)

I think it is useful to sell pickaxes during this particular gold rush.

</comment><comment><USER8> I invested in 2013 I think, in BTC. I doubled my money took everything out and never looked back.

I did it as a game, because it was fun. When I realised that BTC price fluctuations keep up at night, I didn't thought it was fun anymore so I sold everything and never looked back.

I'm more mature now, have a good income from multiple sources which would allow to spend 10x times more but I didn't so far, no specific reason why.

</comment><comment><USER9> Just to kick it off — I don't.

Even as someone working in tech, or _especially_ as someone working in tech, the idea of investing in an unregulated currency concerns me too much. Besides that I'd only be willing to put a small amount < 10% of my investments into it. Anecdotally there are a lot of news stories about bitcoin wallets getting compromised — maybe it's just the press being sensationalist but you don't hear the same about more traditional investment accounts.

I'm onboard with index funds and robo advisors and most other types of financial innovation, but no cryptocurrency has done it for me yet.

<comment><AUTHOR> Thanks. Yes, I am also working in tech, specifically fin tech.

I'm not concerned about investing in cryptocurrencies since I don't invest that much. I do invest in it because I believe in the ideas of some them.

I would say my investment is probably similar to someone investing in a Kickstarter campaign.

I do however think people in hacker news are more in the safer investment side.. but that's why I asked the question in the first place.

</comment></comment><comment><USER10> 1) Some. No one should say. That'd be a dumb way to unnecessarily call attention to yourself.

2) ideology and or $$$</comment>


Timeline - A JS Library For Beautiful Timelines That Are Easy & Intuitive To Use - <AUTHOR> http://functionn.blogspot.com/2012/03/timeline-javascript-library-for.html#.T3M77BOAp3o.hackernews <comment><USER2> GPLv3 is quite limiting for a JS library. The source file[1] also has no license in the header, just a copyright.

[1] <http://veritetimeline.appspot.com/latest/timeline-min.js>

<comment><USER3> You're looking at the minimized file. In source/js/timeline.js it says:

        Verite Timeline 0.82
        Copyright 2011 Verite.co
        Designed and built by Zach Wise digitalartwork.net
        Date: February 7, 2012

        This program is free software: you can redistribute it and/or modify
        it under the terms of the GNU General Public License as published by
        the Free Software Foundation, either version 3 of the License, or
        (at your option) any later version.

        This program is distributed in the hope that it will be useful,
        but WITHOUT ANY WARRANTY; without even the implied warranty of
        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        GNU General Public License for more details.

        http://www.gnu.org/licenses/

<comment><USER4> I posted an issue on github, recommending they include a license file in the main directory and switch to LGPL. Personally, I'm a fan of MIT/BSD, but if they prefer the GPL style, then the LGPL makes sense if they want the library to be used.

<https://github.com/VeriteCo/Timeline/issues/4>

</comment></comment></comment><comment><USER5> Your blog adds no content, please post direct links. Thanks.

</comment><comment><USER6> This is gorgeous.

Thank you for making it open source.

Reminds me a lot of Simile Timeline (by MIT: <http://www.simile- widgets.org/timeline/>) but this looks so much better!

Thank you.

</comment><comment><USER7> Beautiful! I love the collapse/expand feature too.

One problem I have with the UI is that I feel the left/right arrows should ONLY be for going to different horizontal locations on the timeline, but they scroll through vertical locations as well if they are all at the same time. This was unexpected. Perhaps up/down arrows for the vertical navigation?

</comment><comment><USER8> Building something simalaar to this was the only good idea I'd been harboring forna while now, but it will be interesting to see the feedback. I couldn't figure out how flexible to make it or what features to support, or if it should accept a file-based data structure for those not wanting to program an api. I guess I don't really know the audience.

</comment><comment><USER9> Looks good from the pics but on my iPhone it makes the website impossible to use. Scrolling and pinch to zoom doesn't work.

<comment><USER10> The site with the examples, timeline.verite.co, lists iPhone compatibility as an issue.

</comment></comment><comment><USER11> Very neat. There are no examples for parsing times instead of just dates that I can see (but it appears VMM.Util.parseDate supports it). Something like a timeline for server monitoring data would be a good use of this. Also, I would hope for a little more commercially friendly license for a library like this instead of the GPL.

<comment><USER12> Exactly what I was thinking. Can't wait to plug this into our custom Opsview (nagios) pages :D

</comment></comment><comment><USER13> Very cool.

I want to create a journal/blogging app which uses this as its main user interface.

</comment><comment><USER14> Beautiful! Is anyone else slightly annoyed by the front-loaded easing when you click the arrows? (I have no idea if that is the right term, but I mean to say the fact that it starts slowly, then speeds up. I'd prefer the other way around).

</comment><comment><USER15> Vertical scrolling option? (or at least scroll wheel support?)

</comment><comment><USER16> Doesn't work very well on ChromeOS. Also, why is there no HTML "file format"?

</comment><comment><USER17> Wonderful! I can't wait to have some free time to play with this!

</comment><comment><USER18> Try the zoom buttons to experience the slickness. Very cool!

</comment><comment><USER19> beats the heck out of facebook timeline!

</comment><comment><USER20> Very neat!

</comment><comment><AUTHOR> Direct Link: <http://timeline.verite.co/></comment>


Brightbox announces easy to use cloud load balancers - <AUTHOR> http://blog.brightbox.co.uk/posts/cloud-load-balancers-beta

<comment><USER2> I love the speed you can get stuff done compared to EC2.

<comment><USER3> I'm curious, what stuff are you talking about? Admittedly, ELB's cname restriction is a little of a downer but you could always spin up an instance to act as your own LB. Also, their 3rd point of needing to rebuild an ELB is a little of a drag but it is very trivial to rebuild by hand, even faster if you have scripted it.

<comment><USER4> "but it is very trivial to rebuild by hand, even faster if you have scripted it"

trouble is, anything that is trivial by hand for you, after you've done it 20 times is tricky for Sys Admins to pick up. And if you script it, when an automated solution is already available, you could be using that time to build business logic, which I'm guessing the main point of most people's role here?

</comment></comment></comment><comment><AUTHOR> We've been using them with pizzapowered.com stuff for a while whilst they are tested internally and we've found it really simple to use

</comment><comment><USER5> I wonder about latency issues - how much is added by the typical LB setup in this case?

<comment><USER6> Patrick - negligible, it's all on the same network.

[Disclosure: I'm co-founder at Brightbox]

</comment></comment><comment><USER7> I think I'm detecting a trend.

Take an open source project (LVS perhaps, in this case?), scale it onto a bunch of servers running Xen (your own, Amazon's, doesn't really matter), wrap an API around it, and you've got the next cloud service.

<comment><USER6> @tastybites: a /little/ bit more to it than that ;) we do run the loadbalancing layer across multiple locations which is non-trivial.

[Disclosure: I'm co-founder at Brightbox]

<comment><USER7> As always, the devil's in the details. I wasn't being snarky - it's actually a great way of doing it since you're leveraging so much existing work. I'm also working on project that could be described in the same way.</comment></comment></comment>