One App Developer Responsible for 47,000 Apps in BlackBerry World? - <AUTHOR> http://www.berryreview.com/2013/08/20/one-app-developer-responsible-for-47000-apps-in-blackberry-world/

<comment><USER2> I was involved in a Blackberry portathon. They were offering USD 100 for each of the approved apps submitted at that time. This incentive surely didn't help. I remember participants there, raising concerns about 20-30 different apps by same user converting one currency to another. But it seems BB wanted quantity so badly that they are ready to compromise on the quality side. Infact they were actively promoting a 3rd party tool Blackberry app generator (or something similar). Which was just a app generator packaging single RSS feed as an app.

<comment><USER3> Whoa, 47,000 * 100 == 4,700,000

<comment><USER2> But it was only for the 48 hour period of the portathon. And IIRC their total budget was only 2,000,000.

</comment></comment></comment><comment><USER4> As a BlackBerry 10 developer, this is pretty bad. It pollutes the store with garbage apps like the Play Store. The difference with the Play Store is that there are enough good apps there that they rise above the noise. It seems like BlackBerry needs to work on getting more significant apps on the platform, and needs to work on filtering out crap like this.

I'm making what I consider to be "good" apps, but I'm just one dev. It's a really crappy problem of the fact that phones aren't selling due to lack of apps, which doesn't incentivize developers to create apps because there aren't many customers.

It's really an unfortunate problem to have that I don't have a good solution for them to get out of. It's a fantastic development platform, and a fantastic OS that really blows Android, Windows Phone, and even iOS out of the water in many ways.

I'm more excited for BlackBerry's future than ever, but I'm also more worried than ever. _sigh_

<comment><USER5> > I'm more excited for BlackBerry's future than ever, but I'm also more > worried than ever.

What exactly do you think is exciting about BB's future (as a platform)?

</comment></comment><comment><AUTHOR> According to discussions I've been reading about this [1], it seems that more than _half_ of the applications on BB App World come from just four developers: a staggering 67,500 apps.

[1] [http://forums.crackberry.com/news-rumors-f40/one-app- develop...](http://forums.crackberry.com/news-rumors-f40/one-app-developer- responsible-47-000-apps-blackberry-world-841408/index3.html#post9045550)

</comment><comment><USER6> Could it be that maybe there's some kind of quirk in the BB API that turns out to be conducive to developing BlackBerry apps in a declaritive fashion?

So like, what if you dump a bunch of API calls into a table, and then aggregate the varying permutations with a SQL query, and wrap it all up in appropriate XML markup, programatically, and the call each variant an "app"?

The reason I'm pondering this, is because I think Microsoft has a similar situation, where even something as trivial as an RSS feed might be counted among the "app" statistics:

[http://www.itworld.com/software/369727/microsoft-updates- win...](http://www.itworld.com/software/369727/microsoft-updates-windows- phone-app-studio-after-developer-projects-soar)

...and then there's also Firefox OS to consider. Where do you draw the line between an "app" and somebody's crappy web page?

<comment><USER7> That is a tricky line, indeed. Assuming [http://photos.appleinsider.com/App%20Store%20Review%20Guidel...](http://photos.appleinsider.com/App%20Store%20Review%20Guidelines%20-%20App%20Store%20Resource%20Centerai.pdf) is the real deal, Apple tries to do it with the following rules:

2.20: Developers "spamming" the App Store with many versions of similar apps will be removed from the iOS Developer Program

12.4: Apps that are simply web clippings, content aggregators, or a collection of links, may be rejected

Notice the 'may' in that last clause.

<comment><USER8> Sadly, I don't think Apple enforces these guidelines very much — the top three (by number of apps) developers in the iOS App Store are [1]:

* Libriance Inc (2,100 apps): [http://itunes.apple.com/artist/libriance-inc/id336845065?uo=...](http://itunes.apple.com/artist/libriance-inc/id336845065?uo=5)

* NTT Solmare (1,600 apps): [http://itunes.apple.com/artist/ntt-solmare/id291585690?uo=5](http://itunes.apple.com/artist/ntt-solmare/id291585690?uo=5)

* Tobit.Software (1,300 apps): [http://itunes.apple.com/artist/tobit.software/id284971906?uo...](http://itunes.apple.com/artist/tobit.software/id284971906?uo=5)

A lot of the apps for each of these companies are very similar or are basic web clips.

1 — Source: iTunes Enterprise Partner Feed dump from a month or so ago.

</comment></comment></comment><comment><USER9> I immediately thought of this site/person:

[http://www.cebeans.com/](http://www.cebeans.com/)

<comment><USER10> If that was all done by one person (heck, even a few): impressive.

</comment></comment><comment><USER11> BlackBerry needs to seriously weed out the rubbish. Besides the fact that browsing App World is a nasty experience on my 9930 (sorting is the most awkward I've ever seen), finding something I'm actually looking for is nearly impossible. I always end up browsing on my laptop and then scanning the QR code to install.

It's not style, not the call quality or even battery life that really can make or break BB. It's the available applications. If they can't get rid of the hackish nonsense, not to mention the equally unhelpful "reviews", nothing will change.

I know BB is rushing to fill this gap, but quantity over quality will tarnish the brand and make App World a joke. It looks like it's already done a lot of damage.

</comment><comment><USER12> Windows Phone has (had? Haven't used a while) the same problem. There are tons of the same apps which are basically just wrappers for the mobile version of a website (facebook, youtube etc.) in the marketplace.

<comment><USER13> I've heard the same about the Apple App store, not sure if Apple did anything to prevent that in the meantime.

Not sure if it should be prevented. In any case there will be more apps than anybody can browse manually, so all the app stores need good app discovery mechanisms anyway.

<comment><USER14> Just using UIWebView to mirror a mobile site will get your app rejected.

2.12 Apps that are not very useful, are simply web sites bundled as apps, or do not provide any lasting entertainment value may be rejected

</comment></comment></comment><comment><USER15> I wonder if he/she pulls in significant revenue. How else would they be motivated to create 47,000 apps? Perhaps there are lesser app juggernauts on the Google Play and App Store as well.

<comment><USER16> I'm guessing it will be a decent sized company, but with one account to publish the apps.

Imagine trying to support that many apps?

<comment><USER17> They don't have to support the apps, only the ones that end up with traction, hence revenue. If all 47,000 became popular then that would be a nice problem to have!

</comment></comment></comment><comment><USER18> Do they have API for app submission ? looks like this guy have automated app creation/submission.</comment>


Ask HN: Finding a job as a software developer without having a degree? - <AUTHOR> Hello,
I'm a full-stack software developer mainly experienced in PHP 7.2+ and Python 3, who has around 5 years of prior work experience, currently located in Finland. I've been trying to find a job here for the past year, but I've been unable to do so, mainly because of strong bias against applicants without university degrees in the IT space.
I was planning to move to the United Kingdom around 6 months ago, and almost immediately I was approached by multiple companies offering lucrative jobs, regardless of the fact that I do not have an official degree.
The largest project I have worked on has offered services to hundreds of thousands of users worldwide. I have the skills, but I lack the studies, leading to my issues with finding a job.
What would be the best option for me? I've been trying to look at remote job opportunities, but most require me to live in their country or travel, which is something I unfortunately can not afford.
Thanks! <comment><USER2> I initially wrote a whole bunch of words... but people vary wildly. Circumstances are different.

In my own experience I made the "world" of finding a job very small and personable. I got interested in a niche language, found the local community for language and met the other developers and business owners.

In that time I've worked with others, often remotely, that are also a part of this same programming community. It would appear to me they took a similar approach to what I had done but they did it online.

I would find programming communities that value individuals and are in need of qualified candidates. PHP/Python/Java might not be that community.

</comment><comment><USER3> Are you certain it's the lack of degree that's been the problem?

I'm running a tech recruitment startup ([https://www.toughbyte.com/](https://www.toughbyte.com/)) and am based in Helsinki, with many of our clients here. In my experience working on over a hundred positions, a relevant degree is rarely a must. Many companies mention a degree on the job ad, but are still open to interviewing candidates without one. In fact, given that many people in Finland start working alongside their studies and don't complete their degrees, the number of developers without a degree might be higher than elsewhere. At Toughbyte, we have even managed to relocate candidates without any degree to Helsinki from outside the EU.

I'd be happy to give you some feedback and advice, and maybe even suggest some companies to apply to, so feel free to drop me a line at email@example.com. As it happens, I'll also be running a workshop on how to find the ideal job as a developer at the School of Startups at Maria 01 at 3pm today, so we could also talk there in person.

</comment><comment><USER4> Sounds like you're between a rock and a hard place if the Finnish economy isn't robust enough to support software workers without degrees and you can't afford to move.

I know nothing about Finland but it sounds like you might need to get any job you can for the moment (development or otherwise) and save towards moving to the UK or the US (my personal bias).

</comment><comment><USER5> Maybe the market for web developers in your region isn't strong? If employers can't find workers with their ideal list of qualifications, then they'll cast a wider net. You might not be much better off in that market even with a degree.

Going remote opens your options, but you have far more competition.

The hustler method is to hit the streets and get to know people. Find out what problems people are trying to solve and what sort of help they need. Find places you might like to work and figure out how to talk to people there. Hit social networks such as Twitter and LinkedIn. You'll need to get creative. People are going to be much more likely to find a spot for you if you're talking to them rather than firing off applications.

And are web developers considered IT? Is PHP a fit for a company which has an IT department? You might need to find a smaller, scrappier place to work.

</comment><comment><USER6> My entire career (since 1999) I've never had a CS degree. When I did contract work it's never really been a hurdle for me. The longest I've ever gone without work was maybe 2-3 weeks. (and honestly, in the entire time, I've maybe spent a month or so on the bench)

Markets like Upwork and Freelancer are not-so-great options, but there's work there. Codementor is a great place to find work, of various nature (mentoring calls, small freelance projects, and bigger ones).

</comment><comment><USER7> In my experience, startups care very little about what degree you earned, whereas more "traditional" institutions care far more. I would advise you to focus on networking and job searching within communities that have well-funded startups, or young companies in industries that haven't matured yet.

The landscape of remote work could be promising, but unless you actually WANT a remote job, I can't recommend that you pursue one just because of your lack of a degree.

</comment><comment><USER8> In my experience it is not super hard to find remote software jobs if you are willing or able to do things like the following:

\- have a very strong social network with lots of industry connections or opportunities. This is not something I can pull off.

\- actually build some kind of demo specific to most jobs that you apply for. Basically try to figure out what they would be hiring you to work on and then start trying to make that and show them.

\- be willing to work for low rates that make you competitive with people in countries with a low cost of living.

Remote work is extremely competitive actually. And onsite jobs with large investments in the hire are also even more competitive because there are only so many jobs like that available. And with the greater investment they can be pickier.

If you want a actual high paying job, developing your social network might actually be the most effective way. Then you basically apply through your friends and avoid the normal application process.

</comment><comment><USER9> What do you mean specifically about the applications in Finland - did you apply and get rejected, or found the requirement and didn't apply? If it's the latter, I'd recommend ignoring it and see how it goes anyway. If it's the former... yeah, remote may be a way to work around that.

</comment><comment><USER10> Throwaway account.

Although I studied CS and did most of the coursework, I do not have a formal degree.

I do have public profiles, top ranked on a popular programming site, dozen open source projects and I wrote a book.

In short: I had all the time in the world for a degree, if it weren't for all the other activities I am involved in.

In the world today, you can contribute to a project easily and get hired. Building a portfolio has never been easier.

In fact, my current job came to be because of a small tool, that I put online.

And I do have hundreds of ideas for portfolio (and fun) projects, which I would be sure would get me hired at places. If I only had a few weeks or month off to get them off the ground.

In short: Find some technology or problem you are interested in and try to find a way to contribute in a friendly, and recognizable way.

</comment><comment><USER11> This is basically the first time I hear about any country with a bias against developers without university degree.

Sure there might be general immigration law blockers.

Though pretty much anywhere in Europe that I've checked or know about. At least in IT/Development, you can get a highly skilled migrant work visa without university degree.

And just to be sure - with "I can not afford moving to another country" is not money but family/personal reasons, right?

</comment><comment><USER12> I have a suggestion:

\- hop on LinkedIn

\- searching for people, look for "software remote" with the location filter set to Finland

\- find some people that have and/or hire for the kinds on jobs you want

\- do a bit of research on their company

\- reach out to them and see if they'd be willing to do an informational interview on how they got the job, and I bet some of them will refer you for interviews (ever heard the phrase if you want advice, ask for money, and if you want money, ask for advice?)

</comment><comment><USER13> Not sure if that answers your question, but I currently work at a company based in Helsinki and we are hiring, but we use .NET. In my opinion I would say that whether you are a team player or not is way more important here than an IT degree, so if you are open to starting as a frontend and willing to learn .NET please reach me out at email@example.com

</comment><comment><USER14> Starting a blog is a great way to demo your skills and ability to solve problems.

Here's a relevant article with a few other ideas: [https://daedtech.com/programming-job-without- degree/](https://daedtech.com/programming-job-without-degree/)

</comment><comment><USER15> List of Remote Jobs or Gigs Platforms

[https://docs.google.com/spreadsheets/d/1JfNAbUX_lN9K3MCNHO15...](https://docs.google.com/spreadsheets/d/1JfNAbUX_lN9K3MCNHO15GJtJ5qpk7H9Cl3xTBwv2FR8/htmlview)

</comment><comment><USER16> What stopped you from moving to the UK? If it's Brexit, consider a move to Ireland instead. While PHP is not a strong language here, Python developers are in high demand.

</comment><comment><USER17> It's not hard. Show what you've put into production or open-source work. If you see a job ad saying they require a degree, they're more than likely trying to weed away incompetent people.

</comment><comment><USER18> Reading everything on this thread... I'd mainly agree... sounds like Finland ain't the place.</comment>


Sometimes Not Working Is Work, Too - happy-go-lucky http://nymag.com/scienceofus/article/sometimes-not-working-is-work-too.html <comment><AUTHOR> It is widely debated within creative circles whether or not incubation is a necessary step for creativity and problem solving[1].

Yet repeatedly research and anecdotal data indicates that some type of break in any behavior—separated by tasks which utilize alternative forms of thinking—is beneficial.

So if you're working on a complex logical problem, jumping away for a bit to do less intense and more playful work can help spark new insights, and vice versa. 90 minute chunks of highly involved work followed by a short burst of walking, taking a shower, doodling or free writing, or simply resting can be really helpful for your mind. We shouldn't shy away from breaks as beneficial.

I wrote this back in June of last year as a reference for myself, it is not at all scientific in any way, but a reasonable analogy nonetheless: "It's like when you constantly write or say the same word for five minutes, your brain burns out on it and suddenly the word doesn't appear to make sense. Working on the same specific problem or task for any sizable amount of time means the neurons in your brain around that area of work are constantly firing." Eventually the work "doesn't make sense" and the possibility of creative thinking is greatly hindered.

Sometimes the best way to get an insight is to get away from the work.

1\. See Gary Klein's book Seeing What Other's Don't.

<comment><USER2> I take a stroll around the block a couple times a day. I'm sure people in the office think its weird that I leave so often but It's necessary for me to continue working. I need a little reset. Otherwise I feel like I'm sitting in a chair in front of a computer stuck for hours on end.

<comment><USER3> I recently started doing this because I got a new fitbit that alerts me if I have taken 250 steps in the hour. Originally I was using this as an exercise mechanism but now I am using to help my thought process. Often times it buzzes my wrist while I am just sitting there thinking. I get up, walk around the office park, have an insight or breakthrough and return to my desk more productive. I do this about 3-6 times a day. I highly suggest everyone give this a trail run to see if it helps.

</comment></comment></comment><comment><USER4> It's a pretty routine experience for me that when I am working on a problem at work, the answer comes to me while I am walking around at lunchtime. It's like you can't force it at the desk--it just has to bubble up on its own.

<comment><USER5> Back when I smoked cigarettes, it seemed like nicotine was the solution to any problem. Almost every puzzle was solved on a cig break.

<comment> rm_-rf_slash Same here, except replace cigarettes with guzzling water while walking up and down a dozen flight of stairs, and there's no problem that this method cannot solve.

<comment><USER6> I take water and coffee breaks to try and think, but for some reason most of my inspirations occur at a urinal.

<comment><USER7> But the coffee is likely the inspiration for the urinal so it still counts.

</comment></comment></comment></comment></comment><comment><USER8> Me and my partner run a small but globally oriented design consultancy.

One of the things we always try to do is to only work 3 days a week four clients. This we believe is a better use of time and money because we and our clients often need "time to think".

So far this has landed us some pretty interesting and large clients in some very interesting areas like robotics, AI, Shipping and for the VC industry and it has allowed us to focus more end developing the actual products and services rather than just producing.

<comment><USER9> If I may ask you an unrelated question: since you mentioned you run a small consultancy, how do you manage your clients' expectations about working hours etc?

In my experience (also running a small consultancy), clients expect at least 10x4, if not 8x5 coverage.

<comment><USER8> Sure.

We charge days or weeks not hours that takes care of most of the problem.

Second we are expensive which normally means we dont waste our clients time and they dont waste ours.

</comment></comment></comment><comment><USER10> Is anyone aware of any companies that proactively and explicitly encourage this stepping-away practice in their culture? Not just the "unlimited vacation" or "we have a nap room" variety -- often that's just window dressing. Any company cultures that actually take it seriously as a long-term competitive advantage?

</comment><comment><USER11> The title is a bit click-baity. The tl;dr is that rest and breaks from work are essential to sustaining effort, especially for intrinsically motivated people who have tendencies to over-work themselves.

<comment><USER12> Yes, that's the purpose of a good headline. Getting people to click on it

<comment><USER13> I agree. "Click bait" is probably best used for headlines that are catchy, but don't really represent the content of the article (so they're basically lies, like fishing baits, but for clicks).

As long as the title is catchy AND represents what you get in the article, then it is a good title and I see no reason to call it "bait" because it is not a "bait", it is real (knowledge) food.

</comment></comment></comment><comment><USER14> Not to mention the physical toll it takes on your body.

Backache, wrist injury and other rsis are equally bad as a burnout and you only feel the ramifications later on in life.</comment>


Steve Jobs on managing through the economic downturn - <AUTHOR> http://money.cnn.com/galleries/2008/fortune/0803/gallery.jobsqna.fortune/15.html

<comment><USER2> That's a sensible position to have for an established company that has a lot of cash in the bank, doesn't pay its engineers very much and has a long-term view.

However, if you're established but don't have cash, have low margins and expensive personnel, you're not in a very good position to start doing heavy R&D.

Apple doesn't reflect the state of tech startups. Lessons learned from Jobs should be taken into context.

If you don't have cash, get some by cutting everything you don't need. Build up a reserve and invest in long-term projects. Preferably ones that tie into a strategy of supplying services that other companies need but are currently supplied by companies that are going bust. Also, be pessimistic on your revenue projections.

And don't take random advice on forums as your guideline.

</comment><comment><USER3> I hate it when a perfectly reasonable article is split into 15 separate sections you need to click through. Here's a copy you can read quickly - <http://jottit.com/myvqn>

<comment><USER4> I only read 15/15 and as far as I'm concerned I don't need to read the rest of it.

There are plenty of examples of succeeding in a downturn by doing the opposite of what everyone else does. It might take a little creativity to find available resources but history shows that it can be well worth it.

If you can afford to do anything to get a step ahead of your competition while there's a lull in the action, you should.

If you're selling products that will help your customers get ahead of their competition then you might have to figure out creative ways for them to pay you. Not everyone has this flexibility but if you can make it happen you'll help your customer AND your own company move ahead while everyone else takes a time-out.

</comment></comment><comment><USER5> He's going to increase funding for R&D in the downturn. I think, we as individuals, need to keep investing in ourselves during the downturn. Build our knowledge, reputation, connections, etc.

</comment><comment><USER6> I really admire how honest Steve Jobs is with his own products:

Take the iPhone. We had a different enclosure design for this iPhone until way too close to the introduction to ever change it. And I came in one Monday morning, I said, 'I just don't love this. I can't convince myself to fall in love with this. And this is the most important product we've ever done.'

</comment><comment><USER7> Looking at the long term chart, Apple seems to get pounded extra-hard in recessions. No surprise, as they essentially sell luxury goods. Corporate- wise, it hardly matters what they do now since their balance book is (extremely) healthy, but they've got 2 years of hard times, if history is a guide.

<comment><USER8> Even worse, a luxury product (often) in a market where purchases can be deferred 12-18 months if necessary.</comment></comment>


I built a game into our B2B product - <AUTHOR> https://pragli.com/blog/why-i-built-a-game-into-our-b2b-product/ <comment><USER2> I almost didn't click on this link but I'm glad I did. It was a clever and thoughtful approach to fixing an adoption problem.

<comment><USER3> agree - this is a clever approach to solving the problem facing a whole group of applications where the "field of dreams" strategy is not going to work. Thanks for sharing.

<comment><AUTHOR> Had to Google "Field of Dreams" haha. Love the term.

Yeah classic marketing strategies of pitching value and getting an entire team to buy in is no longer going to work for communications products like these...

It's all about capturing enough single user joy to incentivize user invitation.

</comment></comment></comment><comment><USER4> Great how it started with framing the problem (and coming up with a name for it!) then went the product decision-making and how you landed at making a game

It could easily have been "we wanted to increase engagement so we made a game here's the link" but this is 10x better

<comment><AUTHOR> Haha, thanks! From what people have been telling us - naming the problem definitely helped to frame the problem better.

</comment></comment><comment><USER5> This is awesome. Do you have a sense of how many users it takes to solve the empty room problem? Is 2 enough?

<comment><AUTHOR> We see a drastic improvement in engagement when even 2 people are in the team. That's by far the best.

Of course, in longer tail usage patterns, the more users that we have, the higher engagement we normally see.

</comment></comment><comment><USER6> "Doug and I spent several hours brainstorming out-of-the-box ways to add more value to the empty office experience in Pragli."

Why not talk to your customers and ask them what they want, then spend your time building features they need? Is the empty office experience an actual problem or is it more that people are busy and don't want to use your tool. Gaming them into spending time in your product does not seem like a win.

My mistake in the past with my own startups was to spend time building features that I thought would solve problems that my customer has instead of building things they really need. This sounds exactly like one of those cases.

"Press stunt: Hire a street performer at Caltrain"

Really? You think that is how your unicorn will succeed?

</comment><comment><USER7> Does anyone recognize the task app in [https://pragli.com/blog/content/images/2019/10/image-9.png](https://pragli.com/blog/content/images/2019/10/image-9.png) ?

<comment><AUTHOR> Yep, Asana was on the right hand side and Pragli was on the left.

Made it a bit easier to screen capture!

</comment></comment><comment><USER8> Really fascinating and creative approach! I wonder why this kind of thing hasn't been tried as commonly before or is as widespread today.

<comment><AUTHOR> Thanks! Not sure - but I really think more communication and collaboration products should try out more out-of-the-box engagement features like games.

<comment><USER6> Huh? A collaboration product for a job would involve working together on your job, not playing games.

</comment></comment></comment><comment><USER9> Do you have plans to implement any of the other engagement features you mentioned? I'd be curious to see what worked best.

<comment><AUTHOR> Yes! In the article, we mentioned that we were considering collectible avatars to include into the game.

Some out-of-the-box ideas include extending our Spotify integration to audio channels so people can collaboratively play music together.

</comment></comment><comment><USER10> This is awesome, I've always felt that more onboarding experiences should feel like games.

<comment><AUTHOR> Yep - definitely helps to build up a feeling of attachment and delight to the product :)

</comment></comment><comment><USER11> That's pretty neat. Are your users engaging with the game?

<comment><AUTHOR> Thanks for the compliment! We just pushed it out, but after a few days we'll update the blog post to reveal some interesting insights.

Stay tuned :)

</comment></comment><comment><USER12> Pragli.com ceases my mobile chrome, anyone else seeing that?

<comment><AUTHOR> Eek, that's not good! Would you mind sending me a screen capture at firstname.lastname@example.com? Sorry about that!!

</comment></comment><comment><USER13> Sounds fun! Thanks for the share

<comment><AUTHOR> Of course! Stay tuned for more updates :)

</comment></comment><comment><USER14> Very good idea :D

<comment><AUTHOR> Thanks so much :) We're excited for the results.

</comment></comment><comment><USER15> Love it!</comment>


Cops Can Force You to Unlock Phone with Apple Touch ID, Judge Rules - <AUTHOR> http://www.huffingtonpost.com/2014/10/31/apple-touch-id-ruling_n_6083920.html?ncid=txtlnkusaolp00000592

<comment><USER2> Makes sense. The fun will be when we have moderately accurate methods to extract information straight out of the brain (if your password is cAt and the prosecution shows you pictures of animals and see which parts of the brain lit when you see cow, dog and cat and guess that the password is feline in nature)

Then the fifth will have a hard time.</comment>


An AI with 30 Years' Worth of Knowledge Finally Goes to Work - <AUTHOR> https://www.technologyreview.com/s/600984/an-ai-with-30-years-worth-of-knowledge-finally-goes-to-work/ <comment><USER2> I wonder two things:

1\. Price.

2\. How it differs from OpenCyc.</comment>


Stellar: How Does Your Galaxy Grow? - <AUTHOR> http://stellarsupernova.com

<comment><USER2> I was expecting the actual game, not just a video about it, but it does look interesting.

It's also worth noting that much of what is included in the game is still actively being researched. For example, we don't really know, in detail, how vigorous star formation affects the gas in galaxies – is it expelled, stirred up, removed from the system, or some combination? And what processes (supernovae, stellar winds, radiation pressure, etc.) drive that? I think we are getting close to the answers[0, 1], but it's an exciting time.

[0] [http://arxiv.org/abs/1311.2073](http://arxiv.org/abs/1311.2073)

[1] [http://arxiv.org/abs/1307.5639](http://arxiv.org/abs/1307.5639)

</comment><comment><USER3> Really cool idea, even if it is a bit hard to follow what is going on. Also I see that the game is not out and they don't seem to have published any updates anywhere in the past year.

They probably could have used the publicity a year ago.

</comment><comment><USER4> It looks like this project had funding for two developers for 6 months. They set up a web page

[http://www.stellarsupernova.com/](http://www.stellarsupernova.com/)

Which is still up, however the Twitter and Facebook pages appear to have been deleted.

This is right up my street, I'm not sure how the equations for stellar nucleosynthesis could be reduced to run in a browser, perhaps they tried to simplify too far? Or trying to gamify it was too tricky. I can't imagine many people beyond physics students will follow this.

If they've paused I wish them good luck, if the code is orphaned it'd be good to see it open sourced, I imagine there are a few people who'do like to contribute.

</comment><comment><USER5> I'm involved in some astronomy outreach/teaching activities and this looks like it'd be really useful for that, as it's hard to come up with hands-on activities about star formation and stellar evolution.</comment>


Show HN: Covid-19 Curves Visualization and Comparison - <AUTHOR> https://paul-em.github.io/covid-19-curves/ <comment><USER2> This is beautiful and easy to use. Very intuitive.</comment>


Asyncssh – Python Asyncio Client/Server Implementation of SSHv2 Protocol - <AUTHOR> https://github.com/ronf/asyncssh <comment><USER2> As Jeff and I noted on Reddit [0], the author of AsyncSSH, Ron, is very responsive and his work is high quality.

The library is already pretty feature-complete, and just last week the latest release added ssh-agent client support. [1]

[0] [https://www.reddit.com/r/Python/comments/41zycz/asyncssh_asy...](https://www.reddit.com/r/Python/comments/41zycz/asyncssh_asynchronous_ssh_for_python/)

[1] [https://github.com/ronf/asyncssh/blob/master/docs/changes.rs...](https://github.com/ronf/asyncssh/blob/master/docs/changes.rst#release-140-17-jan-2016)

</comment><comment><USER3> This is pretty cool. SSH is a perfect fit for this - in common application scenarios, most time is spent waiting for the remote host.

I like that is supports all of the modern ciphers (Paramiko, in particular, doesn't). It's also mostly feature-complete. Props to the author, this appears to be the work of a single guy!

</comment><comment><USER4> This is extremely useful to me. Seems like it can be used to secure communications between the server and the client without having to rely on autossh with SSH tunnels.

I think this can be very useful for establishing reverse SSH connections as well. Instead of having autossh keep track of the SSH session and keep it alive, one can spin up a simple script that starts and persists the connection.

</comment><comment><USER5> Awesome, I'd like to see more network protocols implemented natively in Python. The language implementations are getting better and better, and well, you're waiting for the network anyway... It also means the work together better: 1 event loop means it's easier to reason about the program execution when using multiple protocols together.

<comment><USER6> There's already lots of this. That's basically what Twisted is, for example.

</comment></comment><comment><USER7> Nice! But I wonder about the example in the readme, why the 'yield from'? Doesn't Python support 'await' as an alias for that nowadays?

<comment><USER2> `await` is Python 3.5+. AsyncSSH is compatible with Python 3.4+.

</comment></comment><comment><USER8> My concern with the server side of this would be a bug in OpenSSL (which I assume this uses) could give a hacker access to the memory space of all current connections, a feature the default forking servers don't have to worry about. It's a benefit that helped qmail remain secure for so long.

And yet I say this as a creator of an async SMTP server, so I don't think these days it is _that_ big of an issue.

<comment><USER9> I checked the source and I don't see any references to openssl.

that doesn't mean that it wont get pulled in as a dependency somewhere else.

<comment><USER10> It uses [https://cryptography.io/en/latest/](https://cryptography.io/en/latest/) , the origin of which is described at [https://lwn.net/Articles/595790/](https://lwn.net/Articles/595790/) . Under the hood that uses OpenSSL.

</comment></comment></comment><comment><USER11> Great job ! I could not resist to think & share [https://github.com/mscdex/ssh2](https://github.com/mscdex/ssh2) < SSH2 client/server implementation in nodejs (natural async flow) > piece of art

</comment><comment><USER12> Looks great.

FWIW, [https://pypi.python.org/pypi/parallel- ssh](https://pypi.python.org/pypi/parallel-ssh) will work with Python2; also does not use threads or processes.</comment>


Google confirms Java and OpenSSL crypto PRNG on Android are broken - <AUTHOR> http://android-developers.blogspot.com.au/2013/08/some-securerandom-thoughts.html <comment><USER2> Here again I will posit:

Secure programs should rely on /dev/urandom, to the exclusion of other CSPRNGs, and should specifically eschew userland CSPRNG engines even when they're seeded from /dev/urandom.

This Android bug is another in a line of bugs in userland CSPRNGs, the most famous of which was Debian's OpenSSL CSPRNG bug which gave up everyone's SSH key. CSPRNGs have bugs. When you rely on a userland CSPRNG, you're relying on two single points of failure: the userland CSPRNG and the OS's CSPRNG. Failures of _either_ aren't generally survivable.

There are people who are smarter than me (notably 'cperciva) who disagree with me on this, but this is an idea I got from DJB's NACL design paper; it's not my own crazy idea.

I got to eat dinner with Dan Bernstein the other day, by the way, and it turns out NACL is pronounced "lasagna".

<comment><USER3> Except if /dev/urandom is using a hardware based random number generator, then you have to trust that the hardware hasn't received some NSA alterations at some point during the design.

The NSA did design a random number generator that likely had a backdoor in it: [https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy](https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy)).

Here's Bruce Schneier talking about it: [https://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_...](https://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_ad.html)

Also it's in Windows (although it's not used by default but userspace programs could rely on it). [https://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_...](https://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_ad.html)

It would be possible for the NSA to go to Intel and get them to put in something in their random number generator that would let them to basically break the encryption by massively reducing the keyspace if they have the secret key.

<comment><USER4> If you don't trust the hardware, then you've already lost, no matter what algorithmic construction you are using. How are you going to trust your random number generator if 1 + 1 = 2 except when it equals NSA?

(This is one of those times where I regret HN that has twin interests in software security as an engineering science and software security as a political statement.)

<comment><USER3> > If you don't trust the hardware, then you've already lost, no matter what > algorithmic construction you are using. How are you going to trust your > random number generator if 1 + 1 = 2 except when it equals NSA?

You can verify the random number generator. If you know the algorithm and the seed values you can run it on multiple different platforms, or with a pen and paper and verify that the output is as expected and repeatable. If you have large amounts of entropy you are feeding into it, you can log it for testing purposes.

There are also apparently some EC based algorithms that can be used to fix or at lease reduce the impact of a compromised random number generator.

That might not protect against a active attack on your specific system by the NSA (they could send/embedded a magic packet that gives them total control over the CPU for example), might even be possible for it to happen on the NIC controller rather than the CPU if it has access to the system bus. At the least they could flip it into some kind of backdoor random number mode by embedding some extra data in a TLS handshake or whatever. But it should protect against widespread passive surveillance.

<comment><USER2> Reducing the impact of a CSPRNG state compromise is a basic design goal for CSPRNGs, and you don't need ECC to do it; the "NSA backdoored" RNG you're referring to is one that no system anyone knows about actually uses, for that reason.

Again: you're making a point that has nothing to do with my comment. If you don't trust RDRAND, don't use it. But you should still be using the OS's CSPRNG. Just make sure your OS isn't using RDRAND. Done and done.

</comment></comment></comment></comment></comment><comment><USER4> Since this is as good a time as any: I snidely implied that this was likely to have been due to a bug on the part of the Bitcoin community rather than a design error in the Android platform. That seemed like a reasonable guess at the time, but it was wrong, so: sorry, Bitcoin et al devs.

<comment><USER5> It was not a reasonable guess even at the time because it should have taken you all of 2 minutes to verify it is, in fact, not a reasonable guess. I don't think there is some great tragedy or mistake in being wrong about this but if you're going to gracefully admit wrongness, admit to the right kind.

You were wrong then and you could have easily known you were wrong then. This new disclosure doesn't make you righter or wronger in retrospect.

<comment><USER6> How would you verify this in 2 minutes?

<comment><USER5> The programs in question were not manually seeding the RNG, as was patio11's suggestion. The app implementors in this case don't seem to have actually done anything wrong at all.

<comment><USER6> But it took us days to arrive at this conclusion.

<comment><USER7> I believe this is the point in the discussion where people willing to do some digging indicated that the problem was most likely not in the apps:

[https://news.ycombinator.com/item?id=6195707](https://news.ycombinator.com/item?id=6195707)

It wasn't days, but I can't say for sure that it was minutes... my vote would be for hours! :)

</comment></comment></comment></comment></comment></comment><comment><USER8> "Developers who use JCA for key generation, signing or random number generation should update their applications to explicitly initialize the PRNG with entropy from /dev/urandom or /dev/random."

Really? This is what's missing?

They build a whole infrastructure for crypto and forget to do _that_?

<comment><USER9> The Sun/Oracle JVM does it, as many other JVMs.

Just Dalvik does not.

</comment></comment><comment><USER10> > Some SecureRandom Thoughts

I feel like the author of the post isn't giving this the severity that it deserves. The title makes it sound like a thought experiment, here is an example where the original title is (let's face it) shit and the editorial title here is relevant.

<comment><USER11> Agreed. The whole thing is a bit blase.

Also, anyone else find it concerning that they advocate presenting /dev/urandom as SHA1-PRNG when it isn't? I don't even see why they did this? They could have wrapped the default SecureRandom and forced it to seed bytes with /dev/urandom.

Also, why are they writing to /dev/urandom??

<comment><USER2> Presumably because some Android devices don't boot cold with a lot of entropy, so there's a virtue in helping kickstart it.

<comment><USER12> I'm a layperson when it comes to cryptography. Can you clarify how much entropy a device would need to become cryptographically secure, and the profile of an Android device that couldn't collect enough entropy quickly? E.g. most devices could collect battery %, 3G radio noise levels, wifi noise, readings from the capacitive touch sensors, accelerometer, microphone etc., yes?

<comment><USER6> > Can you clarify how much entropy a device would need to become > cryptographically secure

200 bits.

</comment></comment></comment></comment></comment><comment><USER13> needless to say, android passed its fips certification with flying colors.

just another secure mobile OS. nothing to see here, move along.

did i mention that you should never store anything of actual import on a phone?

<comment><USER14> At what point do you differentiate between a phone and a computer?

<comment><USER15> In this context: At the point where one begins to be much, much more likely to be misplaced than the other.

</comment></comment></comment><comment><USER16> Let me get this straight. Somebody spent time to hunt down the original issue with the RNG. Followed by the time required to exploit the issue. Then focused on attacking bitcoin environment in some way. Taking a total of 55 bitcoins.

That seem's like a lot of work for $5000.... Some Blackhat burning 0day for giggles?

It's also very impressive that the BT community caught them so quickly.

<comment><USER17> Part of the philosophical justification for the "full-disclosure movement" is the belief that, much like scientific discoveries, they almost never happen in a vacuum by a lone brilliant researcher.

Which is to say, that it is entirely possible (I'm not going to presuppose how likely) that this has been known about for some time, and used for other nefarious purposes in a manner that wasn't so "easily" detected (the existence of a master record of all Bitcoin transactions makes it much more likely for this to be found than people exploiting it in some random app).

It could be that somewhere right now, in dozens of coffee shops throughout Eastern Europe, South America, and Asia, a group of collective hackers, each unaware of the existence of any others, read this blog post and uttered their linguistic equivalent of "Son of a Bitch".

<comment><USER18> You forgot the coffee shops in Langley, VA.

</comment></comment></comment><comment><USER6> (cross post from other article)

I thought OpenSSL's default code already pulled from /dev/[u]random at initialization?

<comment><USER19> The short answer is yes:

The first call to ssleay_rand_bytes() (which is what RAND_bytes() calls eventually become with the default RAND_METH) will call RAND_poll(), which on Unix-but-not-OpenBSD-or-VOS will try reading ENTROPY_NEEDED (32) bytes from /dev/urandom, /dev/random, and /dev/srandom (in that order). Then, for grins, it throws getpid(), getuid(), and time() into the pool.

The longer answer is maybe:

• RAND_poll() relies on a #define named DEVRANDOM to figure out where to go looking for random devices. If DEVRANDOM is undefined, e_os.h will define it to "/dev/urandom","/dev/random","/dev/srandom". If DEVRANDOM is defined but empty, then the code in rand_unix.c's RAND_poll() ends up skipping seeding from random devices entirely and only tosses getpid(), getuid(), and time() into the pool.

• If something changes OpenSSL's default RAND_METH so it's not RAND_SSLeay(), all bets are off.

Despite staring at all of the code between Android's SecureRandom.java and their OpenSSL tree's crypto/rand directory for three hours, I can't figure out how they screwed this up.

<comment><USER6> Complexity kills.

Thank you for staring at the code for three hours BTW. :-)

<comment><USER19> As an added fun bonus, it looks like the NativeCrypto Java wrapper around OpenSSL wrongly assumes that RAND_bytes() returns 0 on failure and not-zero on success. In reality, it returns 1 on success, 0 on failure, and -1 on super ultra mega failure.

<comment><USER6> That evil API has bitten _so_ many projects.

</comment></comment></comment></comment></comment><comment><USER20> /dev/urandom is usually pseudo random, so as an initialization for SHA1PRNG random number generator it is not good enough. It seems that the suggested fix is not good enough; you need a real source of entropy - which is /dev/random.

The problem with /dev/random is that sometimes there is not enough system entropy (depending on the available hardware sources), so reading from it can block;

On smartphones they might use the radio signals as a source of entropy, get some data from the radio then MD5 the stuff; couldn't they do just that ?

<comment><USER21> /dev/urandom and /dev/random follow the same bit generation routine except that /dev/random blocks when the estimated entropy in the input pool falls too low.

The SoCs on phones often have HWRNG support, they just don't always use it, or someone forgets to actually seed their entropy pool with it because they assumed some other bit of code would, which seems to be what happened here.

</comment></comment><comment><USER22> I don't understand. Isn't seeding very fundamental? How could they forget this?

<comment><USER6> QC/QA is all about testing for repeatability. Testing for entropy means proving a negative: that the initial parameters will never repeat across all devices that will ever be booted. Entropy gathering is really really difficult to test within a normal engineering process.

</comment></comment><comment><USER23> Am I reading the patch correctly in that Android versions below 4.1 are not affected?

<comment><USER24> there are two fix: applyOpenSSLFix and installLinuxPRNGSecureRandom .

The first is only applied to jelly bean. The prng one is for all the versions.</comment></comment>


A new company promises a 5G keyboarded BlackBerry in 2021 - <AUTHOR> https://www.pcmag.com/news/new-blackberry-with-keyboard-coming-in-2021 <comment><USER2> No actual device announced, just a licensing agreement for the Blackberry brand to a Foxconn subsidiary "to deliver a new 5G BlackBerry Android smartphone with physical keyboard, in the first half of 2021 in North America and Europe".

Bad title, the original is "OnwardMobility Announces Agreements with BlackBerry and Foxconn Subsidiary FIH Mobile to Bring BlackBerry 5G Smartphones to Market" which I might summarize as "Foxconn Subsidiary Licenses Blackberry Brand".

<comment><USER3> OK, we've replaced the submitted title ("New BlackBerry with physical keyboard announced") with a substring of the article title.

This thread is pretty good though. Sometimes a lame article generates good comments.

<comment><USER4> This article includes a bit of history and context ("Who Are These People?") about the new team, [https://www.pcmag.com/news/new-blackberry-with-keyboard- comi...](https://www.pcmag.com/news/new-blackberry-with-keyboard-coming- in-2021)

 _> The maker of super-tough phones largely sells them to large business and industrial customers, but it also has products at all three major US carriers. _

<comment><USER3> Ok let's change to that from [https://www.businesswire.com/news/home/20200819005202/en/Onw...](https://www.businesswire.com/news/home/20200819005202/en/OnwardMobility- Announces-Agreements-BlackBerry-Foxconn-Subsidiary-FIH). Thanks!

</comment></comment></comment></comment><comment><USER5> Is there a name for the formula that blackberry and others follow?

1) successful consumer business

2) lose in the market so pivot to b2b

3) slow long decline

4) sell brand / assets to somebody else

5) new money results in a "hey we are going back to our roots" and launch products they originally were known for

6) finally go out of business for real, or sell remaining IP to a troll

<comment><USER6> I don't know if there is a such a term or concept but I would put these companies or products in the same category:

Motorola, IBM Thinkpad, Nokia, Sony Ericsson, Fujitsu computers

<comment><USER7> Lenovo has done a decent job with ThinkPad. I'm running an X1 Carbon and love it.

<comment><USER8> Eh, they've butchered the T and X series. Aping the Macbooks will be their downfall.

<comment><USER9> What did they do to butcher them in your opinion? I just recently picked up a new X390 and it's a great machine for the price, with better specs in just about every area than a Macbook for half the price. Only thing I would improve is the screen, 1080p doesn't cut it these days.

<comment><USER8> I've used the older T420/30/X220/30 series laptops, and they are generally regarded to be well built modular machines that can last for a long time and can be upgraded with minimal fuss. They had 2 non-soldered RAM slots, removable storage, easily swappable batteries. If anyone is looking for cheap refurbished laptops, these are usually the go to suggestions for them.

I think the among the newer Thinkpads, only T480 has these capabilities, except the swappable batteries.

</comment></comment></comment></comment></comment></comment><comment> arch-ninja God I wish BB10 was open sourced. Today the biggest problem with phones is their bloated runtimes, android being the largest offender. I want something with the form factor of the q10 running a QNX-based os I can ssh to and use rsync to copy music, contacts, and a calendar to.

<comment><USER4> BB10 had the opportunity to support security and the open web, instead of chasing the app store quagmire. WebOS is now open-source and based on OpenEmbedded, which can be minimized. Blackberry has already ported some of their special sauce to Android, they could do the same for WebOS, extracting suitable components from both BB10 and QNX/automotive.

Instead of worrying about apps (previous war), they could invest in a Rust- based browser and WebAssembly for mobile devices, building on their security strengths. Allow the 'mobile' device to dock with USB-C to a desktop display and keyboard, and you've got a WFH story for security-sensitive apps/data. They have enough proprietary security software to sell on top of WebOS.

Convert Blackberry Messenger to IETF MLS (open-standard E2E encrypted group messaging) and enable interop with Matrix and other apps/platforms that embrace MLS, while (re)creating a business identity network. By focusing on open standards and honoring their heritage in email/chat and physical UX, they could provide a usable alternative for high-end users who favor productivity and security without lock-in. Yes, BB was once the king of carrier gardens, but Apple is now a garden to be escaped, not emulated.

There may be Firefox browser engineers recently on the market, who can hit the ground running with variations of the above strategy. LG, lead developer of OSS WebOS, does not compete with QNX or Blackberry. QNX remains an undervalued gem. A hybrid OSS+proprietary model can bridge BB past & future, but it requires vision from Blackberry, not only a new brand licensee.

<comment><USER10> There developer story was way too confusing. Adobe Air just wasn't a good idea. Blackberry had been Java, and I wonder what made that a pain. The Runtime for Android was a good idea, but they really needed to pick something.

QNX is doing fine in cars, shame it never really got a chance. The 2 screen Doom and rebooting drivers over the network showed some amazing stuff.

<comment><USER11> It wasn't so much that it was Java (albeit ME without generics) it was more you didn't get an awful lot out the box.

You had to hand roll all your UI with drawing routines that scaled across various devices and handle all the touch/tracker button events yourself.

Networking was a minefield. Depending on your connection (bis/bes/tcp/WiFi) you'd have to pass various undocumented params. Think we had a modified version of some networking code a RIM employee has given us, God knows how you'd have figured it out as an indie dev.

The support and open source ecosystem wasn't really there at the time either. Just a couple of devs who were super prolific and knowledgeable on the dev forums (thanks Peter Strange, if you're about HN)

</comment></comment></comment></comment><comment><USER12> Relatedly I find it amazing that Planet Computers has found a niche and developed multiple cell phones with tiny qwerty keyboards.

[https://www.indiegogo.com/projects/astro- slide-5g-transforme...](https://www.indiegogo.com/projects/astro- slide-5g-transformer#/)

[https://store.planetcom.co.uk/](https://store.planetcom.co.uk/)

<comment><USER13> I just "finished" my first Gemini after using the hell out of it for two years straight until it finally gave up on me - it had missing keycaps, the obligatory cracked screen, dents & scratches for the last few months of its life, but still would not give up on me - until it finally went out few weeks ago.

I tried to do without a keyboard for two days, but I just can't do it, and got myself a new unit from Planet.

I guess I'm an old-skool kind of user, my primary app is termux + openssh for doing my mail and irc remotely, but the keyboard is good enough to do the occasional sysadmin and coding work - and that's not something you'd typically do on a blackberry.

I highly recommend this device. It has its flaws, but it's unike any other device available at this time.

<comment><USER14> How usable do you find the keyboard with a terminal? I had not heard about these before today but I am curious now.

Both the Gemini and the Cosmo look _almost_ perfect as a portable terminal - the only thing I can see missing is usb-c power delivery for docking.

<comment><USER13> It takes a day or two to get used to the small form factor, my left hand types with 4 fingers, right usually one or two. I was never a 10-finger-type of touchtyper anyway. Because of the limited key count somey characters are in strange places with a fn-combo, but these you just learn over time.

I find the keyboard good enough to take my phone out and write a proper business email, caps, punctuation, lingo and all. I find the keyboard good enough to reply to threads like this while waiting for the kids in the park. I find it good enough to fix a small bug in software, do basic git bookkeeping. I use it for IRC all day long.

I do _not_ find the keyboard good enough to sit down and write proper documentation, or do real coding sessions.

</comment></comment></comment></comment><comment><USER15> As someone currently with a Key1 and have stubbornly held onto physical keyboards, I am hopeful this pans out. But other phone with physical keyboards have been promised and never come to fruition

<comment><USER16> I have a Unihertz Titan and it feels like a better Blackberry than Blackberry ever was. (I only ever used Blackberries since BB10 and later.)

<comment><USER17> A Key2 is my daily, but there's a backup unlocked Titan running Lineage ready to take over if it dies. Now the question is, once this hardware becomes available will I still need it or will the Key2 power though.

Although being able to load GSIs on the Titan feels amazing!

<comment><USER18> Woah, I had no idea there was a Lineage build for the Titan! Is it available through the Lineage site?

</comment></comment></comment></comment><comment><USER19> I would be super into a phone with a physical keyboard, but I am on Google Fi and I am hesitant to switch.

I've given up on swipe typing. I have been using it for almost a decade and I still cannot type effectively with it. I am ready to go back to physical keys.

<comment><USER20> I'm amazed no company seems to be interested in filling the market niche for physical keyboards.

I swear swype typing seems to have gotten progressively worse since it's early days, I suspect as machine learning from public data is relied on more than personal mechanics.

And also as the pool of users became more diverse, especially older (fat finger users like my parents) and less tech knowledgeable (ie don't use shortcuts or "hidden" features like swiping the spacebar, etc).

I used to be able to rely on muscle memory to swipe, but now that just seems to beg for the wrong result.

I know I'd pay a premium for a blackberry or htc tilt-2 style physical keyboard.

At this point, I'd almost go back to pocket typing with a physical dialpad and T3, circa 2000 style.

<comment><USER21> The weird thing about swype typing for me is how it can swing from hugely impressive to beyond lunatic in the space of a couple of sentences.

One minute, I'm amazed when I've swyped a sentence using some of my favourite slang words [or even made up words / nicknames etc] and found it's been transcribed perfectly. The next, I'm staring in disbelief as it inserts some completely off the wall term like 'albatross' or 'dar es salaam' for a really everyday word.

</comment></comment></comment><comment><USER22> I remember a few years ago Samsung selling a keyboard case for one of it's phones [0]. If I recall the phone would detect it and scale the UI so that the keyboard wouldn't cover any important part of the screen.

Sounds like the ideal tradeoff. I've never seen one in real life however, so that tells me how big the demand for a physical keyboard is.

[0] [https://www.zdnet.com/article/samsung-keyboard-cover-for- gal...](https://www.zdnet.com/article/samsung-keyboard-cover-for- galaxy-s8-plus-a-physical-keyboard-when-you-need-it/)

<comment><USER23> I've actually been planning on getting one of those mini Bluetooth keyboards, take it out of the case, and design a custom cell phone case where the top hinges up similar to how a tackle box opens up. Still working out the details and measurements though.

<comment><USER21> Those mini BT keyboards are great for the money. I got a no-brand copy of a Rii one for £8 off eBay to replace the Apple keyboard I use to control my media server and which was gradually dying one key t a time.

I was really impressed at how the mini BT keyboard 'just worked' on my odd setup of Ubuntu running on Apple hardware. It's pretty tolerable to type on --at least for shortish stuff like web searches and naming files, etc. and it goes for a week or two on a charge.

</comment></comment></comment><comment><USER24> Been using BB10 Passport for past year as a daily driver. I wished a next gen device _with BB10_ would be available in the same format.

<comment><USER25> Can I ask what kind of apps and functionality you use on it. I have a BB Passport in my drawer and occasionally turn it on.

</comment></comment><comment><USER26> How is it possible that the key announcement of this development includes absolutely no photo of the purported keyboard?

</comment><comment><USER27> What percentage of the market for phones come with physical keyboards? I know some cling to the idea but I think the technology has progressed far enough to mostly eclipse it in every practical way, certain holdouts not withstanding, and the market reflects that.

<comment><USER28> Do people really _like_ these huge breakable touchscreens that you leave oily fingerprints on, or do they merely tolerate them? It's a damn shame that phones with smaller screens and optical touchpad don't exist any longer.

<comment><USER27> Glass and screens on modern phones are amazingly durable now. I don't even bother with screen protectors now since under normal usage they're virtually unscratchable.

<comment><USER21> It's not the scratching that's the problem. It's the shattering.

I'll take, any day, a hard plastic screen which will survive being kicked round the streets with only a bit of scuffing to show for it over a scratch- proof glass one which turns into a mosaic if it drops off my desk.

</comment></comment></comment></comment><comment><USER29> Coming before that: A Psion Series 5-inspired keyboard for PinePhone.

</comment><comment><USER24> Wondering if this is Nokia/HMD or more like previous BB/TCL.</comment>


Why web log analyzers are better than JavaScript based analytics - <AUTHOR> http://www.datalandsoftware.com/blog/2009/07/06/10-reasons-why-web-log-analyzers-are-better-than-javascript-based-analytics/

<comment><USER2> The reasons 1 by 1:

1) you don't need to edit HTML code to include scripts

The authors assert that you'd have do this by hand if you had a lot of static html. This is incorrect (you could easily insert the code using some script), but it also doesn't make sense, most larger sites (if not all these days) are dynamically constructed and adding a bit of .js is as easy as changing a footer.

2) scripts take additional time to load

This is true, but it only matters if you place your little bit of javascript in the wrong place on the page (say in the header). When positioned correctly it does not need to take more time to make the connection.

3) 'if website exists, log files exist too' (...)

This is really not always the case. Plenty of very high volume sites rely almost entirely on 3rd party analysis simply because storing and processing the logs becomes a major operation by itself.

4) 'server log files contain hits to all files, not just pages'

That's true, but for almost every practical purpose that I can think of that is a very good reason to use a tag based analysis tool rather than to go through your logs. The embedding argument the author makes is fairly easily taken care of by some cookie magic and / or a referrer check.

5) you can investigate and control bandwidth usage

Bot detection and blocking is a reason to spool your log files to a ramdisk and to analyze them in real time, to do it the next day is totally pointless. Interactive log analysis (such as the product sold by this company does) can help there, but a simple 50 line script will do the same thing just as well and can run in the background instead of requiring 'interaction'.

6) see 5

7) log files record all traffic, even if javascript is disabled

yes, but trust me on this one, almost everybody has javascript enabled these days because more and more of the web stops working if you don't have it. The biggest source of missing traffic is not people that have javascript turned off but bots.

8) you can find out about hacker attacks

True, but your sysadmin probably has a whole bunch of tools looking at the regular logs already to monitor this. Basically when all the 'regular' traffic is discarded from your logs the remainder is bots and bad guys. A real attack (such as a ddos) is actually going to work much better if you are writing log files because you're going to be writing all that totally useless logging information to the disk. Also, in my book a 'hacker' is going to go after other ports than port 80.

9) log files contain error information

This is very true, and should not be taken lightly, your server should log errors and you should poll those error logs periodically to make sure they're blank (or nearly so) in case you've got a problem on your site.

10) by using (a) log file analyzer, you don't give away your business data

well, you're not exactly giving away your business data, but the point is well taken. For most sites however the benefits of having access to fairly detailed site statistics in real time for $0 vs 'giving away of business data' is clearly in favor of giving away that data.

Google and plenty of others of course have their own agenda on what they do with 'your' data, but as long as they don't get too evil with it it looks like the number of sites that analyse via tags is going to continue to expand.

<comment><USER3> RE #10: It actually may be quite beneficial to give away your traffic data if your site doesn't have a lot of inbound links. PageRank is only one small component of your ultimate placement in Google results; high traffic sites are obviously also ranked better.

<comment><USER2> Is that true ? It sounds self-serving, after all if high traffic sites are ranked higher they become even higher traffic sites and so on...

<comment><USER3> I don't have any inside knowledge, but if you were Google, wouldn't you at least factor it into the equation?

We use Google Analytics. I noticed Google Bot, but not other buts, has increased crawl frequency steadily with our recent traffic spike, but the number of visitors from search engines is still quite low at this point. This correlation hints that Google may be using traffic data to prioritize crawl rates and it would seem a logical extension to prioritize search results.

</comment></comment></comment></comment><comment><USER4> Note that Data Land Software (host of blog) sells an "interactive web log analyzer"

</comment><comment><USER5> JS based:

      * Can record java version, flash version, other plugin info
      * Can record screen size, browser window size, color space
      * Can detect and record ad block presence

etc

Both have their uses.

<comment><USER6> Enough sites use Google Analytics wrongly (by including it at the start of the page rather than at the end of the page) that I have used AdBlock+ to block it.

Edit, since someone has downvoted this comment without offering a contrary opinion:

My comment is an argument against trusting figures on ad-blocking obtained using externally hosted javascript. If you host the analytics javascript yourself, no-one will be motivated to block you. And the reliability of statistics such as colour depth and browser window size are probably unaffected.

<comment><USER7> It is not "wrong" to put Google Analytics at the start of the page - in fact, Google _requires_ it for some GA features to work (like Event Tracking).

</comment></comment></comment><comment><USER8> Uh, the author _greatly_ underestimates the headache of filtering out bot traffic. It's bad enough that some of the fancier comment spam bots load javascript, but going through the server logs would be nuts. The "Contact Us" form would show as the most popular page, since it's constantly being assaulted by automated bot-net based attacks.

<comment><USER9> Truth, bots could really be PITA. Still, with log analysis you can remove (at least some of) them, but with JS you can't add them. Same applies to non-page files.

<comment><USER8> Removing them from the logs sounds difficult. And adding them to JS-based stats doesn't sound very useful. I don't particularly care whether Google indexes my site at 10am or 11am so long as it gets indexed. And I certainly don't care about the comment spam botnets.

<comment><USER9> Of course the hour of bot's visit is not important, but it could be important to see if it comes every day or not. Not to mention hits to images and other files.

<comment><USER10> Google's Webmaster tools show how many pages the Googlebot grabs daily and how long requests take, so you can monitor that and rest at night.

</comment></comment></comment></comment></comment><comment><USER11> I don't think anyone suggests (for serious websites) that log files should be abandoned or ignored. On the contrary, script based analytics - which do indeed offer significant value that's ignored in this article - should be considered supplemental or complementary to more traditional methods.

</comment><comment><USER12> 6\. Bots (spiders) are excluded from JavaScript based analytics

To me that is actually a benefit of JS based analytics programs. When I check Google Analytics in the morning I don't want to see how many search engine bots and scrapers hit my site the previous day. I want to know how many actual human beings used my site instead.

Also, and this is probably obvious since it's been pointed out that these people have a vested interest in log parsers, this article would better be titled as "10 Reasons Why Web Log Analyzers Should Be Used WITH JavaScript Based Analytics." I would argue most people serious about tracking traffic use both anyway but those that don't should see the benefits.

</comment><comment><USER9> I'm an author of this article - thank you all for commenting. I don't have an intention to start a flame war - both methods have pros and cons, but in this "GA craziness" people tend to forget that log analysis even exists. Hence the article. :)

And yes, Dataland Software "sells" interactive web log analyzer, but I can't really see how's that important?

<comment><USER2> Asking the provider of a service to show reasons why their product is 'better' is going to give you a fairly biased story, it is good to declare such bias up front.

Personally I found most of their 'reasons' to be fairly contrived.

I think it would be possible to come up with a much more balanced point of view than the one given in the article when comparing tag based analysis and log based analysis.

Both have their uses, some of the reasons given hold water but most of them are pretty thin.

You could make an equally unbalanced list of 10 reasons why tag based analysis is 'better'. The important thing to notice is that tag based analysis is very convenient and can give you a bunch of information that would be fairly hard for a log file based analyzer to provide.

Log file analysis has it's place though, especially when you need to dig in to locate a problem. That's when a log file analyzer is next to useless though, you are basically going to go hunting through the raw logs in order to find your evidence.

The article smacks of a business giving me reasons to buy their product in the light of free competition. (The other alternative to paid log analyzers besides tag based analysis is of course an foss implementation of such a log analyzer).

<comment><USER9> From the first paragraph of the article: "Depending on your preferences and type of the website, you might find some or all of these arguments applicable or not. In any case, everyone should be at least aware of differences in order to make a right decision."

Sorry, I'm not in a mood for a flame war...

<comment><USER13> That's substantially different from declaring up front what your biases are. No part of that sentence indicates to me that you stand to gain from convincing me your points are valid.

<comment><USER14> Oh, come on.. This article is on the company's website..

</comment></comment></comment></comment></comment><comment><USER15> One of the great things about javascript based analytics is that the cached version of your page is just as good as someone grabbing it directly. You can set long cache times on all of your pages without worrying about people viewing your site without you knowing. This more than counteracts the handful of people who have javascript turned off.

This is also particularly important for sites like heroku who have an HTML cache sitting in front of your site. If you serve pages that are cached, javascript logging is your only option.

<comment><USER2> doesn't your cache have the ability to write log data ?

<comment><USER15> Not Heroku's, and certainly not a cache in a client's browser or their network squid cache.

</comment></comment></comment><comment><USER16> Log analysis is a major PITA, specifically if you're operating a farm of web servers like we do. We use an epic shit ton of realtime stats (Woopra, Mint, GA) so we have most needs covered and have a real time view into what's going on.

We do rotate our logs up to S3, but haven't done anything with them thus far.

</comment><comment><USER17> IIRC, a while ago there used to be an analysis system that you'd place in the appropriate location in your network, and it would sniff packets and piece together its own log files. I don't recall what the advantages were supposed to be... perhaps that you could get some information on speed/latency.

<comment><USER2> the advantage would be 0 overhead on the machine serving up the data.</comment></comment>


Why was the first Kindle so ugly? Because Jeff Bezos loved his BlackBerry ... - <AUTHOR> http://venturebeat.com/2011/09/30/kindle-blackberry-influence/

<comment><USER2> So long as Amazon never include a touch-screen I'll be happy. Sony's decision to have a shiny touch screen, that got grubby, on a device used mostly for reading, was baffling.

<comment><USER3> have you not been to amazon recently? <http://www.amazon.com/kindletouch></comment></comment>