Show HN: Music sharing site that allows listeners to support artists - <AUTHOR> https://soundrat.com/ <comment><AUTHOR> Hey HN

I listen to a lot of music from small and independent artists. People who just do music for the fun and love of it.

I have always wished there was a simple way for me to show my appreciation for their work and support their projects. Sure I can buy their digital music (which I do!) but I was hoping to support them in a more personal way.

That's why I created SoundRat. On SoundRat anyone can upload their own music and let their fans listen to it without requiring listeners to have an account or pay for something up front. Fans can stand out and support their favorite artists through payments. When sending a payment they can attach a personal message to the artist and supporters get some "perks" such as being able to download songs and get access to lyrics.

I was planning to highlight some more artists and add a couple more feature before announcing the website. However, seeing as Spotify recently announced their way of letting fans support artists (US & UK only) I thought I shouldn't wait longer.

Let's be upfront about the most important points of the terms and conditions:

\- Artists own their music. I only need the right to host the music.

\- SoundRat takes 6% on all payments. This is used to pay for the servers. I believe this is a fair number

I have been working on SoundRat for the past few months and doing it learned a lot from audio encoding to payment integration (It is way easier to accept payments than processing payouts to users!)

I hope to offer artists a different way of sharing their music and connect with their fans.

Let me know what you think!

<comment><USER2> > SoundRat takes 6% on all payments. This is used to pay for the servers. I > believe this is a fair number

If you really want to be fairer than the competition, be transparent about costs and profit margin. Just stating that 6% seems fair reeks of rent- seeking. This might not be what musicians and fans want, and it won't differentiate your service from Spotify.

> perks […] get access to lyrics.

You will need to come up with better perks than that. The lyrics for any moderately popular song can be found on-line at a click.

<comment><AUTHOR> Thanks for your feedback. I believe 6% is lower than selling on iTunes, Bandcamp and co. With this number I do not think I can run this (any time soon) as a full time business but that is not my goal right now. I hope to use this percentage to cover some or all of the costs.

I did this for fun and for my interest in listening and discovering small artists.

<comment><USER3> > _I hope to use this percentage to cover some or all of the costs._

I don't think the commenter above was trying to make out that 6% is not fair, just that they'd like to see the breakdown of this percentage covering some or all of the costs.

iTunes, Bandcamp and co. might not offer that breakdown, so you're definitely not worse, but it would be a really nice differentiator.

<comment><USER4> I disagree about the breakdown. I think the vast majority of people are going to go with their gut feel in whether or not the cut sounds reasonable. Reasonable and fair being the goal but evaluation of what is reason and fair from consumers is almost always subjective. The breakdown is going to change when features of the service change, maybe quality is upped and costs rise or a host of other things change. I think from a marketing perspective "this is less than anyone else takes and it allows us to provide the service" is enough.

</comment></comment></comment></comment></comment><comment><USER5> Maybe you think it's a bit too late to change it but: I'm not sure about the name! Rats don't have a great connotation with most people. Even SoundMouse is a bit friendlier.

<comment><USER6> Came here to say this as well. Have a look through the link below and see if any definitions accurately describe your service:

[https://www.urbandictionary.com/define.php?term=rat](https://www.urbandictionary.com/define.php?term=rat)

</comment></comment><comment><USER7> This is terrible branding. At first I thought it was called soundART, which would be a million times better. Hell, I'm pretty sure you could get away with switching those two letters and nobody would notice. Rebrand ASAP! How many artist are really going to want their own personal brand to be associated with the term rat?

<comment><USER6> Exactly, who trusts a rat?

<comment><USER8> Certainly nobody whose life is a 90s mafia movie!

</comment></comment></comment><comment><USER9> Well done site, simple layout, stuff just works the way you want it to.

Except: I liked it enough to trying clicking on the icons 'For Fans' and 'For Artists' to see the details: nothing. These days, I'd be very unlikely to register _for anything_ without having seen them first.

<comment><AUTHOR> Hey you can browse the platform without registering. The "discover artist" button takes you to [https://soundrat.com/discover](https://soundrat.com/discover) where you can listen to some of the highlighted artists. Or you can also click on any artist profile on the landing page.

You can do and see most features without an account. Hope this helps

</comment></comment><comment><USER10> How does this differ from SoundCloud's newly added feature to support artists directly?

<comment><USER11> This is actually the perfect time to launch a competitor, since SoundCloud recently announced it is no longer free for artists. You now need to pay if you want to publish more than 15 tracks. I would link to a public announcement but I don't think they made any, they just emailed artists directly.

[https://www.reddit.com/r/WeAreTheMusicMakers/comments/e51gwn...](https://www.reddit.com/r/WeAreTheMusicMakers/comments/e51gwn/soundcloud_implementing_15_track_upload_limit_for/)

</comment></comment><comment><USER12> How would you deal with bad actors? Someone who just uploads the latest Adele album onto soundrat to enable it to be fully streamed for free?

</comment><comment><USER13> That reminds me of hearo.fm, except it features decentralized music streaming micropayments between artists and fans

</comment><comment><USER14> I would suggest losing the large picture and move up info 'for artists' to above the fold.

<comment><USER2> And make it _For Artists_ instead of _For Artist_. (And have people proofread your texts.)

<comment><AUTHOR> Can't believe I didn't notice this before. Thanks I fixed it :)

</comment></comment></comment><comment><USER15> How does this compare to Bandcamp.com? Bandcamp is fan-fucking-tastic.

</comment><comment><USER16> > Listen to your favorite music for free on any device.

Do you plan on adding a paywall when a listener has heard a song a certain amount? I'm a huge fan of Bandcamp, and I love that I hit a paywall when I've heard an album a certain number of times. Reminds me that there's an artist behind the music and that I obviously like the album enough to buy it. Often I'll buy the album on Bandcamp but then find it on my streaming service and listen to it there (easier for adding to playlists, etc).

<comment><AUTHOR> One of my core points is that listeners can enjoy the music for free and without requiring to sign up for something. I do not see myself enforcing a paywall after a certain number of plays on a song or album.

However, I could see adding a notification or achievement after listening to an artists music a lot. This way we could remind the user to support the artists work.

<comment><USER16> A notification seems like it would be a great idea. Users could ignore it and carry on with with the free listening premise. But the very existence of the platform seems to be based on the fact that listeners will choose to support artists, so a notification to support will probably appreciated and heeded by listeners.

</comment></comment></comment><comment><USER17> Ah, memories of the old mp3.com days.</comment>


App 'Censorship' Has German Tabloid Fighting Mad - <AUTHOR> http://www.spiegel.de/international/germany/0,1518,679976,00.html <comment><USER2> Heh American phone, American morals I guess. Germany should make a phone and we could have all the scheisse porn apps we would ever need. Germany would just ban all the violent apps and WWII strategy games instead.

<comment><USER3> Actually, they already _do_ : try to find an original version of Castle Wolfenstein. For all the press freedom we have over here (Germany), swastikas are still a big no-no.

</comment></comment><comment><USER4> Oh, for the love of...

OK, Bild, you don't like that Apple's new policy is screwing with your promo app, I get it. But can we cut the "freedom of the press" bull crap. Not that I should expect rationality and perspective from a tabloid rag, but is it even worth the energy to get into that argument - does anyone who matters buy that line?

<comment><USER5> I do. The case is certainly not as clear cut as Bild claims but Bild might have a subtler point.

After all Apple does censor (if censorship is defined as checking content before publishing and rejecting certain content based on certain criteria) - but that certainly doesn't have to be a problem. After all editors in chief censor, too (using that same definition).

We have no problem with that because there are several competing newspapers which create ample pluralism without any need to intervene when editors in chief censor.

We (i.e. Germany) don't rely on that when it comes to broadcasting. That's why we have public broadcasting institutions. They were created because it was believed that merely private broadcasting is unable to create ample pluralism. Too few frequencies, too expensive equipment - a technolgy to which only a select few have access. Not enough for a democratic society. Or so it was thought.

This is not to claim that any of those views (i.e. private competition among newspapers creates ample pluralism, the same won't work with broadcasting and public broadcasting can solve that problem) are correct, it's just to say that we traditonally have no problem treating media organisations differently than, say, manufacturers of toys.

It's a valid argument to have whether Apple should be allowed to freely censor or not. Ok, maybe not right now (the App Store is still somewhat unimportant and far from having any kind of monopoly on paid media content), but at least in principle the discussion is not without merit.</comment></comment>


NetNewsWire 4 (Beta) - <AUTHOR> http://netnewswireapp.com/

<comment><USER2> I friggin' love NetNewsWire and am glad they've figured out a non-Google syncing solution.</comment>


What is wrong with amqp? - <AUTHOR> http://www.imatix.com/articles:whats-wrong-with-amqp <comment><USER2> My answer, as someone who recently switched an AMQP backend to using redis for queues and pub/sub broadcast: AMQP is wrong the same way RDBMSes or Java are "wrong." It's too heavy, too slow, or too complex for a great-many use cases.

There's a long tradition that seems to be (mercifully) fading of ornately engineered solutions being developed for the most demanding of problem domains, and then subsequently being universally adopted for projects large and small because if "it's good enough for the enterprise, it's good enough for me". It's a variation of the "nobody ever got fired..." mentality.

The truth is that something with a radically reduced feature set, that's simpler to use and understand, is really all that's needed to meet a whole lot of "real world" use cases.

Read the AMQP-0.8 spec sometime. It's rather complex given that a _huge_ percentage of users just want a set of features something like:

1\. A namespace to name queues 2\. The ability to put things on and pull things off in FIFO order 3\. The ability to persist those things on daemon start/stop (maybe) 4\. Pub/sub style broadcast behavior with lossy messaging (maybe)

So redis, as an example: antirez (half-accidentally) got a lot of attention from weary queueing-system wanderers by implementing a majority of these capabilities with just a few redis commands--(l,r)push and (l,r)pop. Redis was so close to a simple, but full replacement for what they actually do with ActiveMQ, Rabbit, etc, that they begged for B(L,R)POP on many keys and PUB/SUB. And that pretty much covers it.

Of course, redis is just one of a number of other project/protocols are stealing attention from AMQP systems, like ZeroMQ, beanstalkd, etc.

But the larger trend is like Linux::"UNIX", Ruby::Java, MongoDB::Postgres, etc. Despite the hell-and-damnation warnings often bandied about by the enterprisey experts, you really can build a wide array of very useful things using these "toy" tools.

<comment><USER3> If your AMQP broker is slow, you're using the wrong broker.

We do something like 1.2 million cluster durable messages per second through RHM on Intel SSDs.

Once you add all the necessary stuff to your hacky ZeroMQ/Redis/beanstalkd implementation, you'll end up with a poorly designed implementation of a decent AMQP broker.

If you don't need persistance, durability or clustering, then by all means, use whatever works for you.

<comment><USER4> is RHM MRG?

</comment></comment></comment><comment><AUTHOR> The great thing about this piece is that it not only offers a very specific critique of AMQP but also a lot of useful general advice on building complex systems as layers of simpler systems.

In a sense it's Worse is Better all over again (<http://en.wikipedia.org/wiki/Worse_is_better>), which is a lesson we seem to keep re-learning in the software industry.

</comment><comment><USER5> What is ampq? [http://en.wikipedia.org/wiki/Advanced_Message_Queuing_Protoc...](http://en.wikipedia.org/wiki/Advanced_Message_Queuing_Protocol)

</comment><comment><USER6> 2 words: too complicated. Beanstalkd FTW!

</comment><comment><USER7> I understand and partially agree that AMQP is a bit complicated. Much like XML is a complicated version of JSON.

However, I can personally vouch that this 'complexity' once somewhat mastered can be used to create messaging schemes in no time. What's so complex about it? You have exchanges, queues, and bindings. With a bit of practice, it's fairly simple to grasp the concepts.

"AMQP is quite unusual in that it starts low on the stack, building on protocols like TCP rather than HTTP"

This person has obviously never built anything truly high performance. Using HTTP would add a lot of latency, and he complains about message speed? Sure 0MQ is the fastest, but with RabbitMQ you get <1ms latency.

"People who today read the AMQP specifications tend to make one main complaint: the protocol is too complex."

I wonder how many of these people actually use it. He goes into a bunch of useless analogies but doesn't actually discuss WHAT'S complex about it. (Usage wise, NOT implementation wise.)

A protocol doesn't HAVE to evolve. JSON being an example. But, in the end, AMQP isn't perfect, but it can still be used to build good software.

This person knows very little about building messaging software, and he admits it himself. I'd take his complaints with a huge grain of salt.

You can use something like protobuf to get really fast de-serialization if you really want encoding.

<comment><USER8> > This person knows very little about building messaging software, and he > admits it himself. I'd take his complaints with a huge grain of salt.

The author of the article is the main author of AMQP/0.8 and OpenAMQ, and the founder of the company that produces ØMQ.

<comment><USER7> Which surprises me given those comments.

He himself admits not to be a messaging expert.

<comment><USER9> He's being humble.

<comment><USER7> Well, he makes a LOT of false or illogical statements in this article.

Not something I'd expect from someone like that. </comment></comment></comment></comment></comment>


Ask HN: If you were starting a new service, where would you host it? - <AUTHOR>

There are so many options these days in the cloud, I was curious what the consensus is here on HN, if you have any pros or cons of specific services I'd love to hear that too.  Rackspace Cloud?  EC2?  Something else? <comment><USER2> Linode has been good for us. Reasonably priced and an easy interface for managing instances. If you need your own hardware then Newservers is good as well since you pay for dedicated hardware on per hour rate.

</comment><comment><USER3> I used to use Slicehost but now start all my new projects on Linode, which I've found to have a faster network pipe and to be a better value at the $20 price point.

Here's a useful survey of where different YCombinator start-ups host: <http://jpf.github.com/domain-profiler/ycombinator.html?2010>

</comment><comment><USER4> I'm also very happy with Linode. Similar enough to regular hosting that it's quick to set up (no worries about AMIs, etc), cheap, fast, and there are always plenty of extra instances available should you need to scale quickly.

</comment><comment><USER5> I have tried the Rackspace Cloud, but I prefer the VPS solution from Linode (<http://linode.com>).

</comment><comment><USER6> I switched from a shady VPS host that wasn't suitable for any real hosting to Linode a few months ago.

My site only gets ~10k hits per day (a lot less stress than many other services), but it's been rock solid so far.

</comment><comment><USER7> Another vote for Linode here. Have used Amazon EC2 as well, but for the price you can't beat Linode. Their documentation is awesome and their support is extremely helpful in answering questions.

</comment><comment><USER8> Another vote for linode here. I have three VPSs there and their host never went down. The network is never lagged and the only time I opened a support ticket was to ask if I could donate my account from a deal from appsumo to a friend.

</comment><comment><USER9> I've had great luck with both heroku and slicehost. I am trying out Duostack now, and it looks pretty awesome so far.

</comment><comment><USER10> Does anyone have a good tutorial link to switching from a regular vps host to something like amazon ec2 or linode?

<comment><USER11> This works for switching to Linode: [http://library.linode.com/linode- platform/migration/migrate-...](http://library.linode.com/linode- platform/migration/migrate-server-to-linode)</comment></comment>


Show HN: A hacky app to draw or plot things - <AUTHOR> https://github.com/victorqribeiro/mycanvas <comment><AUTHOR> Hi everyone, the other day I was trying to come up with a way to find the Fermat point of a triangle, and I think better with visuals. I needed a quick way of plotting points and drawing lines so I came up with this very very hacky way of exposing a canvas as an app.

<comment><USER2> I just use the interactive mode of Ghostscript when I want stuff like that. (Just type "gs" by itself for interactive mode with graphics.)

<comment><AUTHOR> I guess I never used Ghostscript, I'll take a look. But anyways, I made this one especially for when I'm on the phone. Usually when I'm on a boring situation or place and I'm thinking about something I like to draft the idea. For that purpose I made [https://github.com/victorqribeiro/myConsole](https://github.com/victorqribeiro/myConsole) where I can write JavaScript and now I made this one, that exposes a canvas</comment></comment></comment>


The Tetuan Valley mindset - <AUTHOR> http://eu.techcrunch.com/2011/04/28/guest-post-the-mindset-of-tetuan-valley/

<comment><USER2> Amazed at all the progress we are making on startup front across Europe and how much has happened during last 12 months. Seedcamp, StartupBootcamp, Garage48, Tetuan Valley, TechHub, Techcrunch Europe and many others have become household names across startups on our continent. Many startups also making waves across the world and US market.

Can't wait for the next 12 months!

</comment><comment><USER3> This is really huge!!! I think is one of the greatest venture labs in Spain!! The main difference: okuri team and Tetuan Vally students!! They are always willing to help you, pushing you to the next level!!! I think we all feel like if we were at home!!!

Thanks okuri!!!

</comment><comment><USER4> Great to see you in TC talking about Tetuan Valley. Keep growing!

</comment><comment><USER5> TV rocks!

</comment><comment><USER6> Great job you are doing there!</comment>


Cryptocurrency YouTuber Ian Balina hacked out of $2M during a livestream - <AUTHOR> https://thenextweb.com/hardfork/2018/04/16/crypto-youtuber-hacked-out-of-2-million-during-a-livestream <comment><USER2> At the risk of sounding pedantic, can we not use the term crypto for cryptocurrency or blockchain related stuff?

Crypto already has a well defined meaning that is in common use, which is related to cryptography, not cryptocurrency.

Edit: Post title was changed to use the full word "cryptocurrency", great :)

<comment><USER3> As much as I agree (and I upvoted you), I do think that ship has sailed.

Same as hacker has different meanings when used here on HN and on most news articles.

<comment><USER4> I'm fine with it being a shibboleth for people deeply embedded in the cryptocurrency world, whereas for people in the wider world of software engineering (and hopefully the world at large) we stick with the original meaning.

It's also worth saying the prefix doesn't really make sense. "crypto"-"graphy" means hidden writing. "crypto"-"currency" means hidden currency, and nothing about Bitcoin, Ethereum, etc. is hidden.

</comment></comment></comment><comment><USER5> The livestream had nothing to do with it. Here's how he says he thinks he was hacked (from the bottom of the article):

"This is how I think I got hacked. My college email was listed as a recovery email to my Gmail. I remember getting an email about it being compromised, and tried to follow up with my college security to get it resolved, but wasn't able to get it handled in fast manner and gave up on it thinking it was just an old email.

I kept text versions of my private keys stored in my Evernote, as encrypted text files with passwords. I think they hacked my email using my college email, and then hacked my Evernote."

<comment><USER6> The time stamps of the purported transfer took place during his livestream so the headline ("during a livestream") is correct

<comment><USER5> Yes, understood, but it seemed to me like an irrelevant and misleading detail, as if he accidentally revealed his passwords or some other security detail on camera.

<comment><USER7> It seems like a very interesting detail considering that we don't know how it was done.

Maybe the last (seemingly innocent) clue (or just confidence of previous clues) the hacker needed was present. Or maybe it was just the hacker wanting a distraction (though I could think of better ones...) or doing it for fun.

</comment></comment></comment></comment><comment><USER8> I think its an exit scam. He will not be able to sell coins without upsetting his following, because he sells and then announced it on his channels. This will be followed a major dump and his followers will lose significant value during this dump.

Perfect cover up to liquidate his assets while covering his ass. No person seriously into crypto (especially with his amounts) does not keep it in a hardware wallet.

<comment><USER9> Back in my day when we made wallets on air-blocked computers, that had the single purpose of just generating wallets.

Not sure if I would trust hardware wallets//online wallets in the same way.

The other benefit to this is if you misplace a wallet, and find it years later it's like finding cash in your dress pants you don't really wear all the time.

<comment><USER10> > The other benefit to this is if you misplace a wallet, and find it years > later it's like finding cash in your dress pants you don't really wear all > the time.

There were also some who accidentally threw their old computers / hard drives away.

[https://www.independent.co.uk/life-style/gadgets-and- tech/ne...](https://www.independent.co.uk/life-style/gadgets-and- tech/news/bitcoin-value-james-howells-newport-landfill-hard-drive-campbell- simpson-laszlo-hanyecz-a8091371.html)

</comment></comment></comment><comment><USER11> I thought Gmail required a phone number as well when 2FA is configured and someone is trying to recover their account. Otherwise it would be to easy to bypass. But maybe the dude just likes to live dangerous by keeping his millions in a cleartext evernote file.

<comment><USER12> While they do make you add a phone number to the account first when enabling 2FA you can remove it afterwards though (iirc) you have to remember to not just remove the number as an auth method but also remove it as a recovery method.

Failing to do so opens you up to getting your phone account transferred to a different phone/sim and using that to do the recovery process to gain access to the account.

</comment></comment><comment><USER13> Sounds like a great marketing hack / donation scam quite honestly.

<comment><USER14> A comment on the article also raises a valid point:

> _Could it be that he made it up to avoid taxes? Perhaps we 'll never know_

<comment><USER13> Yea I ignored that one thinking the IRS would just laugh but I suppose a naive crypto youtuber might try such a thing.

</comment></comment></comment><comment><USER15> Lots of talk about this being setup and a way to get out of taxes (which are apparently due tomorrow in the US). Any chance this could be the case?

<comment><USER16> Aren't you taxed on money you lost?

<comment><USER17> Nope. Offsetting losses is therefor a very commonly used loophole. Hence the speculation.

<comment><USER18> True. He'd just better be very careful to have an explanation when he starts cashing in the 'lost' funds... or titrate them very slowly into his lifestyle. Tax Evasion is often caught not only by transactions, but by inexplicably high lifestyle.

</comment></comment></comment></comment><comment><USER19> >I kept text versions of my private keys stored in my Evernote, as encrypted text files with passwords. I think they hacked my email using my college email, and then hacked my Evernote.

>Storing private keys for wallets worth $2,000,000 online...

A fool and his money are soon parted.

</comment><comment><USER20> Keys kept in plaintext on Evernote.

<comment><USER21> From the article: "I kept text versions of my private keys stored in my Evernote, as encrypted text files with passwords."

<comment><USER22> Don't worry he encrypted them with a winzip password

<comment><USER23> I used GnuPG, is that good enough (assuming a 16 char random password)?

<comment><USER24> If you have a lot of money in your cryptocurrency wallet you should at least consider using a hardware GnuPG "smartcard" like nitrokey or yubikey. This way even if they get your passphrase they still need access to your hardware token (and vice-versa). There are also hardware wallets specifically meant for cryptocurrencies which I suppose have the advantage of not requiring you to decrypt your wallet on your drive before you make a transaction.

<comment><USER25> I'd embed them into QR codes, print them out on high quality acid-free paper and put them in a fire safe.

I don't trust anything electronic to store data in the _long_ term, I do trust that a QR code will be readable in 50 years _even if you have to decode it by hand_ (or at least write a program to do it) (in a temperature controlled safe with no UV I'd expect laser toner to last 50 years).

Other methods I can think of would be etching the QR code into a stable material (glass for example).

That said I stay miles away from cryptocurrencies, I find the technology interesting but the actual 'market' hilarious.

</comment></comment></comment></comment></comment></comment><comment><USER26> not to lack compassion, but lolol</comment>


Hacker News for Applied Mathematicians - <AUTHOR>

Hi, I'm a student who's currently studying computer science and thinking about a double major in applied math.<p>I'm fairly interested in applied math, and I'm wondering if there are any Hacker News style forums for applied mathematicians (where people talk about applied math, the various industries that applied mathematicians work in, etc..). I realize that this is kind of vague, but it would be great if people could list some forums that seem to fit the description of hacker news for applied mathematicians. <comment><USER2> There is a Q&A style site

[http://scicomp.stackexchange.com/](http://scicomp.stackexchange.com/)

<comment><AUTHOR> That website looks good. Thanks!</comment></comment>


New Firefox security technology blocks Web attacks, Mozilla claims - <AUTHOR> http://www.computerworld.com/s/article/9138918/New_Firefox_security_technology_blocks_Web_attacks_Mozilla_claims <comment><USER2> Up next: New attack bypasses Firefox security technology, security researcher claims.

I do infosec for a living. I can say with 100% certainty that the good guys are in a constant state of playing catch-up with the bad guys. The only thing we can hope for is to minimize the amount of time that serious vulnerabilities remain exposed, in hopes that it's fixed before someone creates yet another point-and-crack tool for the skiddies.

<comment><USER3> Without saying why CSP is particularly susceptable to cat-and-mouse attacks, this comment doesn't have a lot of content. Do you have more thoughts to share about it?

<comment><USER2> Some big problems: It requires people to use firefox or for other vendors to adopt CSP, and it only works for sites that integrate it. Until it comes under attack, it's hard to say whether or not it'll fall victim to the cat-and-mouse thing or simply fail to gain traction. I haven't seen CSP in action, so my comment was tongue-in-cheek.

</comment></comment></comment><comment><USER3> I don't really get CSP. Without changing anything in the browser, application developers --- the only people who can really use CSP --- can already create policies that say where dynamic code should or shouldn't be allowed.

The problem is that modern web apps are riddled with places that need enough dynamicism that blunt filtering won't work.

<comment><USER4> I don't think I understand what you're objecting to. The way I read it, CSP is lock-down by default (if the header is sent across to opt into it), with the application developer being responsible for providing a whitelist of where code and data can be loaded from. How can you do something similar today without still taking care to escape all inputs, etc.?

[http://people.mozilla.org/~bsterne/content-security- policy/d...](http://people.mozilla.org/~bsterne/content-security- policy/details.html)

<comment><USER3> The libraries people use to "escape all inputs, etc" are providing effectively the same functionality as CSP is, but that's not my real concern.

My real concern is, despite the fact that developers have the ability to set policies about what regions on the page can contain dynamic content, "policy" is generally too brittle to describe what people need to put on pages in real- world apps.

<comment><USER5> I don't see anything in the spec about setting "regions" of dynamic content: <https://wiki.mozilla.org/Security/CSP/Spec>

I understand how you could think that was what was involved, as I got the same impression from the article and also thought that was dumb. However, that's not what is going on. You shut down broad classes of functionality entirely, and are required to provide all legit Javascript through <script> tags, which furthermore must come from your whitelisted sources.

(Actually, there are some other modes too; consult the spec for details. However, I expect this is the one people will be talking about.)

The article isn't exactly wrong, but it doesn't accurately convey what is going on, either. Basically, if you can discipline yourself well enough to only use included files (which isn't a terrible style anyhow), then this allows you to ensure that you won't execute injected content.

Is this something that you should be correctly escaping? Yes, absolutely. I am a huge advocate of that in my workplace. But I would certainly take advantage of this extra layer of protection, too, rather than rely on everybody in my company getting it all absolutely right, all the time. The problem with something like escaping is that you make one little error and you lose everything. This goes a long way towards mitigating that.

I haven't done a lot of thinking about this, but it looks good; in general, voluntarily discarding privileges you don't intend to use is a good security practice.

<comment><USER3> It's my fault for being imprecise, but I'm saying, developers can already designate regions of their output as "XSS-safe" or "script-free", without a browser extension.

<comment><USER5> Actually, I tend to agree with your point in the other comment you made in this thread, asking who will actually use it. As one of the few who care in my company, I am both the only one who might set this up, and one of the few who are careful with my encoding in the first place. It does seem an awfully narrow target of people who can't/won't encode correctly, but will do this thing which will also be hard.

Still, I might use it, contingent on broader support and some burn-in time to ensure that it doesn't somehow create some sort of huge hole itself.

</comment></comment></comment></comment></comment></comment><comment><USER2> Also, it seems Computerworld believes it's similar to NoScript (which I use) whereas it really seems more like RequestPolicy (which I also use, but wouldn't wish upon anyone that's not equal parts sophisticated and paranoid)

</comment><comment><USER6> Speaking of Mozilla security what is ex-Mozilla security chief Window Snyder upto? IIRC she used to work for Matasano previously but if she has started a new startup I'd like to keep an eye on that!

<comment><USER3> She'll be out here in a week for our crypto-for-penetration-testers class, so I'm happy to ask her.</comment></comment>


DST leads to cyberloafing - <AUTHOR> http://www.physorg.com/news250334932.html <comment><AUTHOR> One more reason to switch to Universal Zebra Time!</comment>


Social network searches could be a hacker's dream - <AUTHOR> http://www.usatoday.com/tech/news/2009-12-14-searchsecurity14_ST_N.htm?loc=interstitialskip

<comment><USER2> Article discusses "spammers and cybercriminals" but uses the word "hackers". Fucking disgusting.

(Had to repost with a new account because my old one is invisible for some reason.)</comment>


Ask HN: What sit/stand desk should I buy for home? - <AUTHOR> Title says it all, I'm setting up a home office and am going to buy myself a nice sit/stand desk. <comment><USER2> I'll go against the grain here.

I think moving is better than just standing. I'd get a treadmill desk.

Lifespan Fitness makes a treadmill that goes under a desk, and then you can use whatever desk you want.

In my configuration, I have a desk I bought from a local vendor. It has a motor that raises and lowers the desk, and I mount a VESA arm to the middle of the desk. On the right side, I have the treadmill. On the left side, I have a chair. I alternate between the two positions.

Here's a picture: [https://www.dropbox.com/s/089qqvaa7j5ob77/office_setup.jpg?d...](https://www.dropbox.com/s/089qqvaa7j5ob77/office_setup.jpg?dl=0)

I make use of the Pomodoro Technique while I'm working... so I'm typically walking for 25 minute cycles, then 5 minute breaks between. A long break every 4 cycles, and I sit down for all the breaks.

</comment><comment><USER3> I bought a Jarvis Standing Desk[1] when I transition to a 100% remote job. I love my desk and I love the motorized feature. You can select from various widths with various adding. It's not cheap but it has been worth every penny to me.

[1] [https://www.fully.com/jarvis-standing- desk.html](https://www.fully.com/jarvis-standing-desk.html)

</comment><comment><USER4> I have an Autonomous.ai motorized sit/stand desk. It is much more sturdier and stable than similar desks from IKEA.

<comment><USER5> Bumping this. I also have an Autonomous desk and it's amazing. Super solid and also relatively cheap. I'm also pleased by the fact of having 4 stored settings so I don't have to manually adjust each time.

</comment></comment><comment><USER6> IKEA has a great desk the Bekant</comment>


What Foursquare can learn from Trulia & Yelp to become a $100mn company - <AUTHOR> http://blog.crunched.com/3-things-foursquare-should-learn-from-trulia-and-yelp-to-get-to-100m-in-revenue/

<comment><USER2> I'm surprised foursquare has such a small sales team.</comment>


Israeli firm helping FBI to open encrypted iPhone - <AUTHOR> http://uk.reuters.com/article/us-apple-encryption-cellebrite-idUKKCN0WP17J <comment><USER2> Apparently, they signed a ~15k$ contract with Cellebrite, when they said that they might have found another way to hack the phone. [https://twitter.com/zenalbatross/status/712653715317108736](https://twitter.com/zenalbatross/status/712653715317108736)</comment>


ArsDigita: From Start-Up to Bust-Up - <AUTHOR> http://waxy.org/random/arsdigita/

<comment><USER2> There are various alternative accounts of ArsDigita's history on the web from people who worked there. Here's one: <http://michael.yoon.org/arsdigita>

In a nutshell, Yoon claims that Philip Greenspun played a significant part in his own company's downfall.

<comment><USER3> Great read, I had previously only seen Greenspun's, but a lot of it didn't ring true, it's good to see some clarification.

</comment></comment><comment><USER4> 1\. [2001]

2\. What he's up to these days: <http://blogs.law.harvard.edu/philg/>

3\. One specific is helping with patent litigation (see comments at [http://blogs.law.harvard.edu/philg/2011/08/16/anyone- have-a-...](http://blogs.law.harvard.edu/philg/2011/08/16/anyone-have-a-copy- of-arsdigita-community-system-from-prior-to-september-1999/))

</comment><comment><USER5> The remnants of ArsDigita were acquired in the end by Red Hat. For a time the (Java rewrite of) ACS was sold to a few places, but I don't think it is active today.

I consulted on ACS/Java for about 6 months. It was a great example of the Second System Effect. Incredibly over-engineered. Slow. Baroque. Obscure.

Wikipedia says of the Second System Effect "tendency [..] to have elephantine, feature-laden monstrosities as their successors". Whoever wrote that must have been thinking of ACS/Java.

</comment><comment><USER6> I heard about these guys after seeing this site:

<http://aduni.org/>

Learned lots of useful things for my theory of computation class.

<comment><USER7> You might also enjoy my own account of ArsDigita University:

<http://aduni.org/~tomh/rants/aduni_five_years_later.html>

Nice to hear the ToC lectures are still being used 10 years later.

</comment></comment><comment><USER8> For those interested, there's another account of the ArsDigita story via interviews with Phillip Greenspun in Jessica Livington's Founders at Work.</comment>


Springboard application deadline (UK seed accelerator) - <AUTHOR> http://springboard.com/call-for-applications-20-february/

<comment><USER4> A lot of the comments here and the actual website is devoid of any advice you'd actually find valuable if you were interested in applying to these kinds of programmes.

Here are my two cents on what to look for (I don't know the answers)

* Who are the partners behind the fund, what have they done in the past (pre-investor) and what is their core skill (tech, product, marketing, sales, operations)

* Who have you previously invested in, and where are they now?

* Who are the limited partners of the fund - did any VCs/rockstars/partners invest?

* Why are you superior to Y Combinator? Startup accelerators are very popular now. They generally have the same mentors, the same deal terms, the same investors come demo day, the same "industry connections", whats your USP? (some good answers here might be specific domain knowledge of partners, a strong alumni, and so on)

I am always bullish when sites list such an array of mentors because being a mentor is generally high upside (fame/feel good/networking/karma) and very little downside - no skin in the game, as it were.

A buddy of mine once told me that equity was "quick to give away, impossible to reclaim" - you're giving these guys a significant % of your company, be sure they're good - and there is nothing wrong in applying for dumb money. Just don't tell _them_ that.

<comment><USER5> Hi Peter

Good to speak again. Many points well made.

1\. Springboard is funded by 9 angel investors and NESTA, all of whom have invested equal sums. All are very active investors and are seeking to find more deals to invest in. We believe through the mentors involved we cover all the key areas that a startup would need to consider. Where gaps exist we will active seek to plug these gaps.

2\. Red Gate ran Springboard historically in a different format. Correct me if I am wrong - since you worked alongside the teams - but of the four teams involved - one received funding and two have gone on to YC. Under Difference Engine, 5 of the 9 teams have been funded, including a team who received angel funding and has gone to SV and one who has received £750k in funding.

3\. All of the investors can be found within the mentor group, but they have for personal reasons not disclose their identity. Cumulatively, the investors have had exits in excess of several billion dollars.

4\. I would not be so bold as to suggest we are superior to YC - the grand- daddy of accelerator programmes. The major issue in Europe is the lack of these resources. We are seeking to address a deficiency in the market and we have a proven track record.

5\. Interestingly most of my mentors are massively busy and for them to take at least a full day out of their diary is a significant commitment for them. None of my mentors get paid and give freely of their time.

6\. I personally don't think that 6% is a significant %. Do we believe that we can add at least 6% value to your business by taking part. Absolutely, many times over.

It would be good for you to clarify what you mean by dumb money - <USER2> alongside the programme mentors for the 13 weeks is quite the opposite - <USER3> insight, guidance, contacts and introductions is invaluable.

Happy to discuss this further offline, if you need further information. As you know - you can get me on jon at springboard dot com.

</comment></comment><comment><AUTHOR> Springboard review by profquail (and agmiklas) <http://news.ycombinator.com/item?id=2123670>

Some previous discussion about Springboard <http://news.ycombinator.com/item?id=1921166>

<comment><USER4> TidePowerd didn't give up any equity for Springboard money (it was the previous fund)

<comment><USER5> Peter

To make the programme sustainable in the longer term, unfortunately it has been necessary to adopt a similar model to YC and TechStars. I am sure you agree that the provision of similar programmes should be encouraged.

</comment></comment></comment><comment><USER6> There are a lot of suspiciously low-karma and recently created accounts commenting on this.

<comment><AUTHOR> I guess some of the mentors on the program didn't have HN accounts before.

Is low-karma by itself suspicious? When I checked, some of commenters' accounts are 1000+ days old.

<comment><USER7> It's only suspicious because the comments are essentially non-specific praise and add no actual value to the reader. They look like cheap shills; if they are in fact shills, that's not exactly inspiring to potential applicants.

There's nothing wrong with promoting the programme here, of course, the weird comments just seem... weird.

<comment><USER8> I made one such comment below, whose main point was "I am participating in this". I thought it would be useful for readers to know this is a real programme with real mentors and not, for instance, some kind of scam. (I don't know anything about the investors, so didn't comment on that aspect.)

My karma is indeed low - no time for big contributions - but I'd hoped some folks would know me from youDevise's sponsorship of HN meetups in London.

If mine wasn't a useful comment or led to confusion, I apologise.

<comment><USER7> First of all: _I am one of the people you are trying to reach with this sort of programme._ My comments are intended as feedback on how you present yourselves, I'm not trying to to imply anything about the quality of the programme or the people involved. I certainly didn't come into this discussion with any kind of negative bias.

If I'm giving up equity, especially for relatively little money, I want to know I'm getting a good deal. pclark's comments on this thread are basically spot-on in this regard, so I don't need to add much. These concerns do need to be addressed though.

 _I thought it would be useful for readers to know this is a real programme with real mentors and not, for instance, some kind of scam._

It's good to know that it isn't a scam, though that's kind of a minimum requirement. I'm curious about the alignment of interests between investors (who presumably own the equity the startups are giving up) and mentors (who seem to be doing the leg work).

Quoting your comment elsewhere: " _I am helping these guys out as a mentor. Seems like a good idea._ "

With all due respect, that doesn't sound overly enthusiastic. From your comment above, it sounds like you don't receive equity. Do Springboard pay you? If not, what's in it for you, other than karmic retribution and a CV bullet point? Why allow Springboard to advertise using your name?

These questions may seem nosy, but I think they are legitimate concerns. I'm trying to understand the "product" here.

<comment><USER8> I don't run the programme and am not particularly trying to "reach" you. Just think it is of interest to the HN community and worth an upvote and brief comment.

I don't receive equity and don't have anything to do with the investors in the programme. I do expect to make contacts with interesting people who have an entrepreneurial bent - generally, people I meet like this help me learn things my team and I can use, and sometimes they help me find people I can hire. Those are two of my main missions as CTO of youDevise.

Springboard don't pay me. I'm not aware they're advertising using my name, but if they were I'd ask them to include my company's name too, which would help us to get better known and (I hope) attract more smart people to apply for jobs with us.

Edit: They _are_ advertising with my name! <http://springboard.com/douglas- squirrel/> The bio's a bit tired but it does mention my company, which is good enough for me.

<comment><USER7> Helpful information, thank you!

 _I don't run the programme and am not particularly trying to "reach" you._

I realise that; my questions aren't necessarily directed at you specifically.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Guys,

My name is Paul. I am CEO and Founder of a company called Screenreach (screenreach.com) which was on a programme called The Difference Engine which was basically the trial run for Springboard.

So I can speak from first hand experience of being on the programme and what I actually got from it. When we entered the programme we started with a technology. We used the programme to help accelerate the business and to really help put meat behind the areas where we were lacking.

Over the 13 weeks we effectively went from a technology to a business that was investor ready. At the end of the process, we started to put a team behind Screenreach (one of my mentors joined us fulltime), 2 days after the process finished we raised £250,000 from an angel who also joined us as our chairman and we really have gone from strength to strength.

We are now expanding, just raised another round and have a really strong management team behind us.

The programme really helped us achieve this and as it says on the tin, accelerated us through the process.

Happy to discuss further with anyone who wants to know more, just drop me a line.

Paul

</comment><comment><USER10> Are there any previous participants in this programme willing to say a few words about the experience?

<comment><USER11> The team behind SpringBoard ran the Difference Engine for a few sessions (<http://thedifferenceengine.eu>) which due to the lack of public sector funding is closing this year.

Unlike The Difference Engine, SpringBoard has private sector funding. My understanding is that this is the first intake for SpringBoard.

<comment><USER5> For an example of the impact which the programme can have check out ScreenReach who took part in the Difference Engine a programme I have historically run.

[http://eu.techcrunch.com/2011/01/27/screenreach- raises-50000...](http://eu.techcrunch.com/2011/01/27/screenreach- raises-500000-for-its-screach-app-and-platform-for-smartphones/)

</comment></comment></comment><comment><USER12> They are totally open to collaborate with diverse incubation programs allover Europe. It was great to have Jon Bradford in Timisoara (Romania) Software Business Incubator, one week ago, facilitating his meetings with regional startups and potential investors.

<comment><USER13> At least this comment is legit guys, Jon Bradford _has_ been in Timisoara, and Radu Ticiu was a host.

Startup incubators are picking up pace in Europe, so don't be surprised if you get people coming to HN because of them. Make sure they're welcome!

</comment></comment><comment><USER7> The timing of the deadline strikes me as very odd. Is there a good reason to make it 5-6 weeks before YC's? What if a startup applies to both? Why should you choose Springboard over YC or any other accelerator? With so many mentors, who has what stake in the startup? I don't see any of these questions answered, and they're just what comes to mind immediately. Surely these are very important pieces of information for applicants.

<comment><USER5> Phil

I am humbled to think that we can compete with Paul and his investors (including their $150k). Seriously, we announced the deadline in mid November when we launched. PS if you know any YC applicants who would like to apply - send them my way.

</comment></comment><comment><USER14> If it's anything like some of the other tech accelerators that some of the mentors have been involved with, Springboard is looking freakin awesome.

</comment><comment><USER15> This is an important program for the UK as it is one of the few mentor programs available. If you're a startup check it out.

</comment><comment><USER16> Its a great initiative for Europe, it is what is needed to advance the ecosystem further here in Europe.

</comment><comment><USER5> I really look forward to working some great teams over the next few months.

</comment><comment><USER8> I am helping these guys out as a mentor. Seems like a good idea.

</comment><comment><USER17> Great news for the UK tech scene!</comment>


Taming the Asynchronous Beast with CSP in JavaScript - <AUTHOR> http://jlongster.com/Taming-the-Asynchronous-Beast-with-CSP-in-JavaScript <comment><USER2> He mentions using CSP with JavaScript:

> It's safe to say that it's becoming quite popular (and validated) and I > think we need to try it out in JavaScript.

To be clear, and he mentions that Clojure has core.async, it's been done in JavaScript (if you will) already via ClojureScript.

David Nolen has done a series of posts on it starting at [1].

[1] -- [http://swannodette.github.io/2013/07/12/communicating- sequen...](http://swannodette.github.io/2013/07/12/communicating-sequential- processes/)

EDIT: And I should have finished reading the post before posting this. He does mention David Nolen's series of posts on ClojureScript and core.async

</comment><comment><USER3> What would be nice as an addendum to this, especially with the likes of browserify and webpack for node and the browser would be a syntax to start an async channel in a new process/webworker...

        var ch = new echan('moduleName');

Where the moduleName would be a module that exports a single function that receives two channels.. in, and out for a request/response pattern. An "easy" level of abstraction here where the request/response is only going to pass what works with JSON.stringify/parse, removing circular references.

It could work really well for worker handlers... It only needs to be an abstraction around the csp interfaces, as well as the current implementations for web workers and forked processes in node.js

More advanced scenarios could use 0mq for passing a worker to multiple processes... all of that said, it's just an idea.

I think where this lines up very cleanly is as a means of communication with React and flux.

</comment><comment><USER4> I translated the pingpong example to use events instead of CSP. [https://gist.github.com/aynik/94c9f3d01139986d2b91](https://gist.github.com/aynik/94c9f3d01139986d2b91)

</comment><comment><USER5> Even mentioned transducers, cool! But, I was hoping for a treatment of CSP and react/flux. jlongster teased us about that here[1]. Maybe the next post in the series? (plz?)

1\. [https://justin.harmonize.fm/development/2014/08/05/om-and- fl...](https://justin.harmonize.fm/development/2014/08/05/om-and- flux.html#comment-1532327194)

</comment><comment><USER6> My understanding of Javascript is that it is essentially single-threaded. Maybe I am mistaken, but if that is indeed the case, how does something like JS-CSP or Clojurescript's core.async accomplish concurrency? Has there been a change in the underlying Javascript? Is it just using tricks to make single- thread act like multi-thread?

<comment><USER7> Say you have:

      function one() {
        console.log("one");
        setTimeout(one, 1000);
      }

      function two() {
        console.log("two");
        setTimeout(two, 2000);
      }

      one();
      two();

They are executing concurrently, but never in parallel (since javascript is single threaded).

Now, how do you coordinate them if you need to? This is what CSP helps you do.

<comment><USER8> I've spent a fair amount of time in core.async, and I feel like I'm on the edge of enlightenment here, but I don't quite understand how CSP helps with this example. Is the point that you can take multiple puts off the channel in one go? That's the only thing I can think of.

Maybe you could present the CSP alternative, and a basic example use case?

* edit: I guess a basic example is a sliding-buffer that only keeps, and thus only reacts to, the last mouse event. Is this on the right track?

<comment><USER7> The example was more about showing that concurrency and threads are not synonymous, but you can imagine one of the functions producing a stream of values and the other waiting for and consuming them.

In vanilla javascript, you have to resort to breaking your code up into callbacks, which looks trivial in a two function example but becomes unwieldy once you add a few layers and do error handling.

With CSP you organize your code around channels according to the code's logic, rather than according to the needs of coordination. This makes things like error handling and reasoning about your logic much simpler.

<comment><USER8> I totally agree that it helps with callback hell / reasoning, but I think your argument was more about coordination. Hence the sliding buffer example - something that would be very, very hard to /coordinate/ with callbacks.

</comment></comment></comment></comment></comment><comment><USER9> Why doesn't he state what CSP is upfront, requiring the reader to visit Wikipedia to know what it is?

Buzz words and acronyms are getting out of hand on the web.

</comment><comment><USER10> How does this compare to FRP style ?

<comment><AUTHOR> It's more general than FRP so is better at stuff like simple async coordination (what most people use promises for). But you can easy do FRP- style stuff on top of channels, which is basically what transducers are. So they are closely related, but have different roots.

<comment><USER11> Rather than saying that CSP is more general, I'd say CSP is more provides you a more low level constructs. In FRP signals are the key concept that represent value that changes over time. Signals have a pushed based interface that's kind of why it's reactive. FRP typically provides pure functional interface, meaning you never put values or emit events, you just have control flow structures that allow you define transformations over base signals. FRP signals can be easily implemented via CSP channels, but not other way round, that's because CSP channels are push based for the producer side and pull based from the consumer side.

If I had to make an analogy channels would be queues while signals would be an observable variable.

</comment></comment></comment><comment><USER12> You've got to wonder why exactly we still (in 2014) have to contort ourselves around a single threaded model. So that we end up with this level of complexity.

JavaScript is great with data but is becoming a monstrosity when it comes to concurrency.

Can we all stop and have a deep look at how other languages deal with concurrency. I have (like many of you) used many different languages and have played with several different concurrency models. The bottom line for me is that multiple threads + concurrency frameworks (i.e. no exposed concurrency primitives) are still the best solution.

I appreciate JavaScript is trying to avoid deadlocking etc. but in modern concurrency frameworks this just isn't an issue.

Seriously we're now contorting ourselves around dogma. Please browser folk, come up with a decent solution to save us all of this.

VOTED DOWN FOR HERESY :-)

<comment><USER13> It's not clear to me that you actually read the article since a large part of it is about elegantly dealing with streams of UI events such as mouse movement without resorting to callbacks. Not sure how multithreading even applies here. But if you want to talk about multithreading the model described is exactly the one embraced by a new up and coming language called Go - it's users love this stuff precisely because it's more readable than writing code with explicit threads and concurrent queues.

<comment><USER12> So I'll avoid the potential language flame war as best as I can.

It is the sync on async part I am talking about (see code snippet in sub thread). The layering of synchronous constructs on an asynchronous model which only exists to support the single threaded browser model is getting very convoluted. That's the part I'm talking about.

It is perfectly reasonable and trivial to support a multithreaded model in the browser if the multi-threaded code does not alter shared state. Which obviously is the intention of Web Workers and in there case there state seems to be primarily the DOM, I just feel that this is the direction we and browser developers should be looking into more and where the effort needs to be. And that Web Workers are part of the story not the story.

In my experience concurrency can be kept to a remarkably simple level if either the developer or the language/framework author are willing to follow some simple constraints. In my ideal world:

         var x= concurrent(function(x) {
             return doSomething(x);
         })(1000);

Would execute the function without any closure or access to globals (like the DOM). Now we have no shared state, so we could run this function in a parallel thread. Now add back access to stateless resources like HTTP requests and we're rocking and rolling.

Web Workers just seem to be a heavy handed approach to achieving this.

If there is a framework or method available to achieve this and I have missed it out of ignorance please someone correct me and show how this can be done simply. My goal is to have simpler code not to win an argument.

</comment></comment></comment><comment><USER14> funny, i read that as CPS and it still made sense.

<comment><USER15> Same here.</comment></comment>


Candy Button Paper - old but good. - <AUTHOR> http://xkcd.com/205/

<comment><USER2> I used to love that stuff.</comment>


PAX Will Now Have "Diversity Lounges", Penny Arcade Says - <AUTHOR> http://kotaku.com/pax-will-now-have-diversity-lounges-penny-arcade-say-1485455044?utm_campaign=Socialflow_Kotaku_Facebook&utm_source=Kotaku_Facebook&utm_medium=Socialflow <comment><USER2> Someone explain how this is different to pyCon's well received feminist lounges?

Safe(r) space + discussion of issues. What's not to like.</comment>


OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products  - <AUTHOR> http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed <comment><USER2> Some HP Storage appliances (SAN) like the MSA P2000 G3 is also vulnerable.

Everything is suspect. We are a HP shop and I wonder if the switches are affected too, but we are too stupid to have them configured with SSL.

APC UPS, HVAC, etc.

This all goes to show: make sure that you have a special management network separate from the rest of your infrastructure that is only accessible for sysadmins, through a trusted console server.

</comment><comment><USER3> I am by no means even competent at network security; I am curious why articles like [http://online.wsj.com/news/articles/SB1000142405270230387360...](http://online.wsj.com/news/articles/SB10001424052702303873604579493963847851346) seem to imply companies will have to physically replace network gear?

I would think software updates would allow the code to be updated.

Even if somehow they were worried the attacker has gained access and done things that might be a security problem can't you essentially reset the software and start from scratch if you couldn't trust you could find changes that were made, accounts added…? Maybe that shows how naive I am about network hardware?

<comment><USER4> I can't read the article but it's possibly because there is a _LOT_ of EoL network gear still out there that won't be getting updated software.

<comment><USER5> The bug has "only" been present for 3 years. I think no enterprise appliance new enough to ship with an affected OpenSSL version is old enough to be EoL.

<comment><USER4> You're probably right, but what about pre-existing kit that received an update that included the b0rked version of SSL and went EoL since?

I haven't kept up on what version of FreeBSD is being used as the basis of JunOS nowadays but I would not be surprised to hear of EoL Juniper kit that included the flawed code. (I have no evidence that JunOS includes OpenSSL code but I assume that it does.)

</comment></comment></comment></comment><comment><USER6> Can somebody more familiar with Cisco products look at the list and break this down a bit? Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through?

Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?

<comment><USER7> That depends, can the routers be accessed remotely over WAN?

If so an admin password might pop up in memory scans allowing a compromise. From there remote software can be downloaded to the router, potentially allowing snooping/mirroring of traffic.

But it's likely most of the them (ie the important ones) are behind local firewalls and VPNs.

<comment><USER8> Except, uh, their VPN client software :)

And a lot of their WebEx, VoIP and VTC, which will be accessible either entirely within the organization, or on public networks.

Looks like most of their actual routers and stuff are _not_ affected, which is unsurprising -- they SSH, not SSL, and it's unlikely they'd be running OpenSSL 1.0.1.</comment></comment></comment>


Bell cuts phone service to family struggling to pay surprise $1,800 bill - <AUTHOR> https://www.cbc.ca/news/business/bell-phone-service-wireless-code-family-bill-1.5035728 <comment><USER2> I've often wondered why there aren't laws against predatory pricing.

Things like unknowingly racking up $2,000 in cell phone charges, or $3,000 in overdraft charges of $50 each for 60 different tiny transactions when you had no idea you were over the limit.

I get that it would be hard to craft a law that worked effectively in all cases, but something as simple as for any recurring billing relationship with a consumer, any time a period's accrued billing reaches double their previous period, the consumer cannot be on the hook for additional charges unless the account holder (not user) authorizes them up to a new amount? (And for the first period, whenever it goes over, say, an average national user's spending.)

It would be up to the utility to suspend service temporarily in the meantime or not... but you could never be stuck with a surprise horrible bill because you didn't understand your iPhone was sucking up data in another country without you realizing.

I've actually used a monthly automatic pre-paid SIM card on my iPhone for years (in NYC), because it's cheaper and I know it's impossible to accrue surprise charges.

<comment><USER3> > Things like unknowingly racking up $2,000 in cell phone charges, or $3,000 > in overdraft charges of $50 each for 60 different tiny transactions when you > had no idea you were over the limit.

Was this predatory, though? Every phone contract I've signed for is pretty explicit about things like text message cost, data costs, etc.

From my perspective it seems more likely the parent's either didn't communicate that info to their daughter, or the daughter just did it anyway - both of which are parenting problems and not phone company problems.

Not to say the phone company handled it well, but the parent's signed the contract, too, so they should've had some idea.

EDIT: Now that I think about it more, I wonder if having the family on a business plan isn't part of the reason the phone company's being so stubborn about it?

<comment><USER4> When the price charged for a thing is completely unrelated to the cost of that thing, it's going to be hard for people to intuit what they will pay for their usage of that thing - both adults and kids.

<comment><USER3> But there's no need to use intuition because the prices are spelled out in the contract.

You probably don't try to intuit the price of other products, so why would you in this case?

<comment><USER4> People don't refer to contracts often, and we intuit costs all the time. We have many services and utilities which are pay-for-what-you-use, such as gas, electric and internet. I don't know how much it's going to cost me to turn on my tv, but I have an intuition it's not enough to prevent me from doing so. I don't look at the price of most of my groceries. I just do a mental "looks about right" at the final total before paying it.

And none of this applies to a 14-year-old, who no one should expect to read a contract to figure out that normal use of a device will cost thousands of dollars a month.

</comment></comment></comment></comment></comment><comment><USER5> Assuming ≤10,000 text messages, that's around $1,350 per MB.

Regardless of the rightness or wrongness of the actions of the family in question, that seems somewhat perverse.

<comment><USER6> I found their rate card.

[https://support.bell.ca/Mobility/Rate_plans_features/What- ar...](https://support.bell.ca/Mobility/Rate_plans_features/What-are-Bell- Mobilitys-current-pay-per-use-rates)

Canada to US is $.40 per message sent. US to Canada is $.30 per message received.

So $.70 per two way exchange with her American friends and an $1800 bill means she had around 2600 text exchanges. Over a month that's 86 a day.

<comment><USER7> That's a domestic tariff. The article say they were on a small business contract, which is a different section of the website.

<comment><USER6> Yeah I found that later but it's .35 to send and .35 to receive so the result ended up exactly the same.

There is an error though - the bill was $2000 to begin with and $1800 after Bell gave a discount. So it was actually around 95 messages sent and 95 messages received per day.

It's interesting some people say that's a normal amount of texting for a business. Maybe for some businesses. I doubt his bricklaying business used that many, which is probably why he went for the cheapest plan he could get. They also have things like 500 texts for $5 or $7, in addition to the $12 extra for unlimited. If one doesn't make texts very often, saving the $5 or $12 can make sense. My own mobile plan charges around 11 cents per text since I don't pay for unlimited and that works for me since I do at most a dozen texts a year. I don't think these rates of .35 and such are unreasonable at all for someone who basically never texts and wants to save $12 a month. But it is a rip off that they don't just have a ceiling. Doesn't have to be at $12. Could be $100. Like the "max rate" at parking garages, so you can still get your car back. Bell obviously intentionally doesn't have a max rate coupled with intransigence regarding the contract because they regularly catch people with this scheme. Unfortunately there's no law preventing Bell's scheme at present and the guy signed a contract so he's stuck.

</comment></comment></comment></comment><comment><USER8> Charging for texts is such a scam, but this is exactly why when I was a teenager I was on a pre-paid plan. My parents knew I wasn't responsible enough yet to understand how charges work, and that the phone company wouldn't care.

<comment><USER9> That's what I did to my kids for exactly that reason.

No way I'm giving teenagers a blank check, no matter how reassuring or enticing the vendors make the deals look.

Disclosure: I worked at a place tha did format, print and mail for other companies, including wireless, back in the day. Maybe not everyone is aware how these bills spin up.

</comment></comment><comment><USER10> Bell does this because they know they can get away with it. With barely any competition - and the other 2 companies act the exact same way - they know that people will be pissed but nobody will change carriers.

There was a large bit of media last year about cost caps and limitations. But, hey, that only covers part of your bill since Texting is a different "service". This is how Bell gets away with it. They may finally back off now that this has hit the national/international news but it shouldn't need to reach that point.

How is the teenager supposed to know her text is going to the US or is being sent from the US? Maybe she knows where her friends are and maybe she doesn't. In any case this can happen to absolutely anybody at any time. I don't know where my friends may be located at every moment of the day (I guess they take vacations sometimes). And with the constant barrage of spam I doubt I would even believe a random message telling me to pay up.

</comment><comment><USER11> What causes a company to charge these obscene rates? Is it some loophole in "transit" costs? I am thinking something similar to the "inbound revenue" received by "free phone conference" services - these "last mile" providers have special agreements higher costs, etc..

<comment><USER7> It's a business contract. Companies seem to be a lot more hardnosed with these things about openly segmenting their offerings, and being somewhat cruel about it. I bet there's one where you can send literally 1m international texts a month for free, for example, and it costs, like, $2.50/mo more.

But these people didn't pay for that one. And so here they are.

As a business owner you are expected to be a bit more on top of this stuff.

</comment></comment><comment><USER12> I had something like this happen with my data plan during a power outage, and Verizon called me, switched me over to a flat rate plan that covered the charge, and backdated it to eliminate the ridiculous fees.

<comment><USER13> A lot of people complain about Verizon but it is pretty good about that stuff. If you go over they will typically give you an opportunity to upgrade instead of paying the (often higher) overage fees. They even SMS you about it when you near your limit so it's not like some secret phone number you need to know to call.

</comment></comment><comment><USER14> Bell have every right to stick to their guns, but it seems like a really dumb decision.

Is $1800 really worth the negative press and focussing legislators on a part of the business that was not included in prior legislations?

</comment><comment><USER15> This seems like something that Bell's Loyalty and Retention could have taken care of. I know with Telus they'll often prorate for overages --- though, I've never had anything close to this level.

So while this is on the parents, it seems silly to potentially lose a long- term client that will be paying well over that over the course of their contracts.

</comment><comment><USER16> I have been living in the US for one and a half year now, I'm still using my French phone contract in roaming because it's cheaper than using a local one (20€/mo, data limited to 25GB in roaming).

<comment><USER17> With which company?

</comment></comment><comment><USER18> So very tired of this victim narrative. Simply refuse to pay the bill and sign up for another cell service.

<comment><USER19> And then the company sends it to collections, ruins your credit rating and you get harassed by collectors.

</comment></comment><comment><USER3> Honestly it's hard for me to feel very sympathetic to either side here.

If the unlimited CA->USA texting is $12, the phone company should ask them to sign up for it, and charge them $100 penalty and be done with it.

But on the other hand why aren't the parents keeping an eye on what their daughter's doing with her phone?

<comment><USER20> Monitoring who I was texting would've been a huge breach of trust when I was a kid.

<comment><USER3> I didn't have a cell phone until I was able to pay for my own, but I know exactly how my dad would have responded to that: "If you don't like it, pay for it yourself." And then maybe would have added something about being responsible for me until I move out.

<comment><USER21> Almost all children are given a cell phone well before the age when they can pay for it themselves nowadays. Most American children are given a cell phone by age 7.

Whether that's a good idea or not, it's hardly something unusual or worth comment on its own.

<comment><USER3> I'm well aware, and it doesn't change my opinion.

Until the kid gets their own, its the parent's responsibility to pay the bill and make sure it's being used appropriately.

</comment></comment></comment></comment></comment><comment><USER22> Is this the same Bell that got split in the US for anti-trust reasons?

</comment><comment><USER23> Thankfully iMessage and soon RCS will be replacing these wasteful services.

<comment><USER24> RCS is carrier-controlled, so the scum will find a way to charge outrageous prices for it.

iMessage, Signal, Telegram, hell even WhatsApp are good because they give carriers what they deserve, aka a middle finger.

<comment><USER23> I guess I wasn't paying attention because I have no plan to ever use RCS. iMessage and Telegram for me.

</comment></comment></comment><comment><USER25> Bell could have done a better job notifying them of the overages and helping them with a plan to pay but besides that I don't see the problem. They agreed to the plan terms when they signed the contract. They need to pay their bills.

<comment><USER26> $12 for unlimited texting if they did it in advance. It's perverse.

</comment></comment><comment><USER27> I don't believe people's unwillingness or inability to read and understand the contracts they sign constitutes predatory business practices. Unless they were misled when signing the contract, I don't see why this is a problem. Not only are there other phone services you can use if you didn't like this pricing structure, you can also just use a non-sms based messenger, like signal or whatsapp.

<comment><USER28> Telco contracts are not (ever?) written in language parseable by non-technical people. In addition, the people selling these contracts are incentivized to mislead customers in order to make sales.

While you can make the argument that what Bell is doing is legal, the point of this discussion is to engage with the possibility that maybe it shouldn't be.

</comment></comment><comment><USER6> The company made multiple attempts to inform them of the problem, and they ignored it all. But they have a lot of excuses for ignoring each and every one of them. Business plan and the teen is on it. Not a good idea. Don't know the texting charges? Don't know the teen is sending thousands of texts or to who? Parents were totally negligent and should pay the full bill, and get the teen to reimburse them. Sounds like the parents realized they messed up since they were trying hard to pay this bill. But knowing there was a huge current problem and it involved the line they depend on for their business, they should have been on top of it. By the time they said they weren't checking their spam folder they already knew that they weren't getting updates on the texts about overages from their teen. When you're in trouble on something like this you need to be on top of it and not just ignore emails and texts. If you have your spam filter set up so it's deleting critical emails necessary for the existence of your business, that's your own fault as well.

All this said their texting charges must be absolutely exorbitant and this company is certainly ripping people off. But I bet their fees are disclosed in the contract, and for a business service that contract should have been read.

Undoubtedly they have internet service also and most of the texts could have been sent for free. There's dozens of services that will send texts for free. Hopefully the teen will learn to use them, or get her friends to use Facetime etc. Expensive lesson but getting off of fee based SMS text asap is going to save them money in the long run.

<comment><USER29> > Parents were totally negligent and should pay the full bill, and get the > teen to reimburse them.

That's just awful. You're a terrible person.

<comment><USER30> That's a bit much. He's not wrong, and you disagree with his posting. That doesn't make him a terrible person, and certainly doesn't make you a better person for opposing it.

So, please, leave insulting people out of the thread.</comment></comment></comment>


Alex Payne — Why I Don't Allow Comments, and More on Everything Buckets - <AUTHOR> http://al3x.net/2009/02/24/why-no-comments-more-everything-buckets.html <comment><USER2> Going without comments can be beneficial, I agree. But one issue: If you don't enable comments _or_ trackbacks, how is your audience expected to follow the discussion?

<comment><USER3> Everything Buckets.

</comment></comment><comment><USER4> He makes some good points. But don't let a few bad users spoil it for everyone. Not everybody has a blog or a way to get there opinion heard.

<comment><USER5> That would be my point. I mean, when did it become considered "hard" to ignore trolls?

Also I have a rule of not making a blog post unless I have at least a few paragraphs to write on a subject. So his "no comments" stance limits discussion in that way as well.

I hate to say it but I've found most of these "hit and run"" trolls usually leave comments that, while rude, have a grain of truth to them. They're usually saying the thing that bloggers, who tend to worry about their reputation in the blogosphere, won't say.

All in all I think the whole "no comments" stance is unwise if you actually want a true debate.</comment></comment>


How long do neutrons live? Physicists close in on decades-old puzzle - <AUTHOR> https://www.nature.com/articles/d41586-019-01203-9 <comment><USER2> Perhaps someone more knowledgeable can weigh in-- I'm just speculating from a lay perspective. The bottle configuration likely means less states are available due to the confines of the system, and these states are higher energy. I'm thinking something like the Casimir effect, where the boundaries of the system impose conditions that limit the total number of states. Could this explain the discrepancy? Something that could potentially corroborate this idea is comparing those boundary conditions. Do neutrons in larger "bottles" decay slower, and neutrons in smaller "bottles" decay into protons even faster?

</comment><comment><USER3> I have been fascinated by neutrons for quite some time. I'd not heard of neutron bottles before. Researching about how ultra cold neutrons are trapped was quite interesting, as I had not thought it possible that they could be held in any sort of container.</comment>


Ask HN: What are some must know xcode / obj-c topics / libraries? - <AUTHOR>

I'm trying to step up my iOS game to be competent + have the ability to use the appropriate libraries / tools when building any type of iOS app.
Some topics + tools that I've already used w/ obj-c + xcode:
-auto-layouts
-cocoapods
-afnetworking

  -post / get

 -fmdb
-json handling
-location manager
-mantle
-RNCryptor
-singletons
-blocks
-Segues
-kiwi testing
-spritebuilder
What are some other must know topics / libraries / tools (e.g. webview optimization tips, running an app in the background etc..)? <comment><USER2> \- Grand Central Dispatch (GCD)</comment>


The Predator That Makes Great White Sharks Flee in Fear - <AUTHOR> https://www.theatlantic.com/science/archive/2019/04/great-white-sharks-flee-killer-whales/587563/ <comment><USER2> I had a bad experience with a killer whale when I was returning to San Diego from Catalina Island in my rather small Columbia 22 sailboat (this was around 1977).

A killer whale jumped out of the water to the level of the top of my mast 4 times. Each time it landed horizontally right next to my boat, almost tipping the boat over with the splash/wave it created. I laid down in the bottom of the cockpit reaching up to steer my boat and I told my girlfriend to go below decks and lay on the floor to keep our weight as low in the boat as possible. At the top of the 4 jumps out of the water, I saw a black beady little eye staring down at me.

I was very relieved when it left the area.

EDIT: I bought a bigger sailboat

<comment><USER3> 15' jump height on a killer whale. [https://www.reference.com/science/high- can-killer-whale-jump...](https://www.reference.com/science/high-can-killer- whale-jump-out-water-137a4e6554eee183)

This Columbia 22 has a mast height over 30'. [http://www.sailingtexas.com/scolumbia22103.html](http://www.sailingtexas.com/scolumbia22103.html)

I don't sail, so I have nothing to prove, but something doesn't feel quite right about this story.

<comment><USER4> Sailing stories always become a little more dramatic with each retelling. An orca 15 feet above you on a small boat would be awesome and terrifying in a way units of measure cannot express.

<comment><USER3> And also never seen before nor since.

</comment></comment></comment></comment><comment><USER5> >> "Lions, for example, do not eat a lot of impala, but impala fear lions more than any other predator on the landscape except humans,"

Probably explains why lions don't eat many impala.

</comment><comment><USER6> Orcas are one of the most amazing animals in my opinion. They are extremely intelligent and family oriented. There are some great video captures of Orcas attacking great white sharks by flipping the shark upside down which puts the shark into paralysis and then they simply kill the shark without any resistance. The whole encounter doesn't last more than a few seconds this is how precise and smart these animals are.

Many people are probably familiar with some documentaries where we can see Orcas hunt in groups to create artificial waves in order to wipe seals off the ice plates in the Arctic.

I personally was lucky to see Orcas patrol the coastline in Argentina where Orcas come extremely close to the shore and beach themselves in order to catch one of the many sea lions which relax there in false sense of security. Once they get the sea lion they wait for the next wave to help them back into the water. It's just amazing and one of the best spots on earth to witness something truly remarkable. The spot is very popular for whales to come and mate/give birth too so it's well worth to go there for a short break!

If anyone ever visits Argentina make sure to stop by "Valdes Peninsula" and get a car rental for 1 or 2 days so you can explore the peninsula yourself and with a bit of luck spot some Orcas!

<comment><USER7> regarding their familial bonds, they are one of three mammals to undergo menopause, the other two being humans and pilot whales. since orca pods are matriarchal, this further indicates strong bonds and the fact that the older female orcas retire from reproduction duties to share that with the younger females but maintain their leadership roles rather than just dying.

</comment></comment><comment><USER8> Orcas eating just the sharks liver is interesting, they have been known to eat only the tongue of whales, leaving the rest of the carcass. I'm guessing for similar reasons, tongue being tasty and highly nutritious to them.

This known behavior was used by whalers who had a pact with a group of orca in Eden, South Wales. In exchange for helping the whalers hunt baleen whales, the whalers would leave the tongue of the whale to the orcas. [https://en.wikipedia.org/wiki/Killer_whales_of_Eden,_New_Sou...](https://en.wikipedia.org/wiki/Killer_whales_of_Eden,_New_South_Wales)

</comment><comment><USER9> I wonder if lifeboats couldn't carry a little device that sounds (or smells) like a killer whale. Maybe sharks are never really that much of a problem.

<comment><USER10> There has been a number of experiments that tried to isolate chemicals produced by the decaying shark flesh to repel sharks. The theory goes that sharks will avoid the smell of dead sharks, so a few groups I've tried to isolate those compounds to create a shark repellent. Not sure if any of them were fully successful.

In the case of the Farallon Islands it might be that once Great Whites can smell that the orcas have eaten one of their own they know it's time to escape.

I've seen at least one documentary where smaller sharks disperse when they hear the calls of orcas. Seems like it could at least be somewhat effective in areas where orcas regularly prey on sharks.

</comment></comment><comment><USER11> That's amazing that the Orcas have evolved to know how to precisely extract and consume just the liver of (at least) one specific species in the ocean that they probably don't consume often

<comment><USER12> It's probably a learned (and taught) behavior, not an evolved instinctive one. Orcas exhibit complex behaviors that vary from population to population, much like human cultures: [https://www.smithsonianmag.com/science- nature/understanding-...](https://www.smithsonianmag.com/science- nature/understanding-orca-culture-12494696/)

<comment><USER13> They learn all sorts of stuff - [https://blogs.scientificamerican.com/running- ponies/the-lege...](https://blogs.scientificamerican.com/running-ponies/the- legend-of-old-tom-and-the-gruesome-law-of-the-tongue/)

<comment><USER14> What a wonderful and sad article.

</comment></comment></comment></comment><comment><USER15> Make sure to read the last sentence. I did not expect that.

<comment><USER16> Someone's going to read that in the archives in 10 years and they'll either be scratching their heads wondering what it is - or singing along.

<comment><USER15> I'm sure 2030's kids will watch dad memes or something to get educated on internet history.

</comment></comment></comment><comment><USER17> The obvious question is, do white sharks of similar size flee from Orcas or ones of smaller size? Otherwise, there's nothing surprising here. There's examples of Elephants fleeing from large prides of Lions, Lions fleeing from large packs of hyenas, etc. Similarly a small solitary Orca will likely flee from a group or a single, much larger, white shark.

</comment><comment><USER18> "One of the whales rammed and killed the shark, and the duo proceeded to eat its liver" \- is it hard to get a nice Chianti near the Farallon Islands?

</comment><comment><USER19> Damn that was a sneaky way to get baby shark stuck in my head.

<comment><USER20> oh no. not on here also.....

</comment></comment><comment><USER21> Clickbait title. Actual title should be: [Orcas] Can Make Great White Sharks Flee in Fear

<comment><USER22> Seems innocuous to me. It doesn't give false impressions in the way so many article titles do these days, just a hook for finding out what the predator is.

<comment><USER23> > just a hook for finding out what the predator is

That's the problem - click baiting and hiding information.

<comment><USER24> Headlines don't need to be this expressive to avoid being clickbait.

</comment></comment></comment></comment><comment><USER25> ERR_TOO_MANY_REDIRECTS

</comment><comment><USER26> I was hoping article was about a new John McAfee kink.

[https://twitter.com/officialmcafee/status/107986342045807411...](https://twitter.com/officialmcafee/status/1079863420458074112?lang=en)</comment>


Zeta Components in Apache: is PHP finally getting an ecosystem? - <AUTHOR> http://bergie.iki.fi/blog/php-finally_getting_an_ecosystem/

<comment><AUTHOR> Most interesting libraries in the PHP space happen in framework-specific ecosystems with little interoperability. Having a generic PHP library ecosystem under Apache Software Foundation governance could be the solution to this problem.</comment>