Let Me Get That Door for You: Remote Root Vulnerability in HID Door Controllers - <AUTHOR> http://blog.trendmicro.com/let-get-door-remote-root-vulnerability-hid-door-controllers/ <comment><USER2> I think it's rather ironic that this was published by Trend Micro, a company that has had at least two critical vulnerabilities in their own "security" solution:

[https://bugs.chromium.org/p/project- zero/issues/detail?id=69...](https://bugs.chromium.org/p/project- zero/issues/detail?id=693) [https://bugs.chromium.org/p/project- zero/issues/detail?id=77...](https://bugs.chromium.org/p/project- zero/issues/detail?id=773)

I realize that the two teams are probably unrelated, but maybe it would be worth verifying that their "security" software is indeed, you know, secure.

<comment><USER3> Google has had security vulns too. Do you find it "ironic"[^1] that Tavis would disclose vulns in other companies software?

[^1]: You really should look up the definition of this word.

<comment><USER2> > Google has had security vulns too. Do you find it "ironic"[^1] that Tavis > would disclose vulns in other companies software?

No, the thing in this instance is that a) Trend Micro is a dedicated "security" company and b) the vulnerabilities in its software were especially negligent.

> You really should look up the definition of this word.

One definition I found was "happening in the opposite way to what is expected, and typically causing wry amusement because of this". Considering that, I'm quite happy with my usage of the word. That said, English is not my first language and I often see people nitpicking about this particular word. My feeling is that people understood me just fine despite of it.

<comment><USER3> You expected an antivirus company to write perfect code and not have any vulns? That is hilarious.

Look up Fireye vs. ERNW. You will love that one.

<comment><USER4> > You expected an antivirus company to write perfect code and not have any > vulns?

no. But I expect them to have their shit together well enough to not be the laughing stock of the internet because of how amateurish their flaws are (come on - unauthenticated remote accessible JS shell with full local machine access? This didn't even happen to microsoft in the 90ies)

AV programs are by definition in an utterly exposed spot on your machine: They run in a privileged account and they intercept all reads and writes to the disk. They also unpack every archive, parse every file, check every single byte written. An AV program is opening every mail attachment, practically inspecting and sometimes even partially running every trojan on your machine, even those you blatantly ignore as being spam.

For an application in such an exposed point on your machine, I expect them to _at least_ follow current security-best-practices, tough honestly, I would wish they would go far beyond that due to the immense risk they subject themselves to.

And then we have trend micro, an AV program, which opens a remote accessible RPC endpoint which can be used by everyone. This is the exact opposite of what I'm expecting them to be doing.

<comment><USER3> I did not realize that Trend Micro was held to such a high standard. My (uninformed) opinion of them was that they were nowhere close to best of breed.

But more importantly, it seems like there is a difference between the way things are and the way you think things ought to be. Look at all of the AV industry bugs from google's project zero:

Avast (9): [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=label%3AProduct- Avast&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids)

Comodo (9): [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=label%3AVendor- Comodo&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids)

ESET (3): [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=label%3AVendor- ESET&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids)

FireEye (2): [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=label%3AVendor- FireEye&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=ids)

Kaspersky [you will love the archive unpacking vulns] (15): [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=label%3AVendor-Kaspersky)

malwarebytes (1): [https://bugs.chromium.org/p/project- zero/issues/detail?id=71...](https://bugs.chromium.org/p/project- zero/issues/detail?id=714)

All in one list: [https://bugs.chromium.org/p/project- zero/issues/list?can=1&q...](https://bugs.chromium.org/p/project- zero/issues/list?can=1&q=label%3AVendor-Comodo%2CVendor-Kaspersky%2CVendor- ESET%2CVendor-AVAST%2CVendor-FireEye%2CVendor- TrendMicro&sort=severity&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary+Severity&cells=ids)

<comment><USER4> > I did not realize that Trend Micro was held to such a high standard

nope. Not Trend Micro. All of them. And as long as they are failing as spectacularly as you're pointing out here, my recommendation is to not use AV software and instead use whitelisting of allowed applications.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I can't be the only one who thought HID was Human Interface Device, the category of USB device, at first.

<comment><USER6> It's the same as with the RSA company - another confusing name.

<comment><USER7> Quit bringing up the Renaissance Society of America!

</comment></comment></comment><comment><USER8> And I thought that the exploit they used in Mr. Robot to remotely unlock all doors in a building at once was far fetched! This is basically exactly it.

</comment><comment><USER9> The concept of programming by string substitution really needs to die, and operating systems need to stop enabling it with functions like system(). Any time you have to think about "sanitizing" strings, terrible mistakes are going to happen.

<comment><USER6> That's what we've got from switching from Lisp machines to x86 and C.

It's funny how the 'stitching strings together' problem was solved 50 years ago and the modern web still didn't get the memo.

<comment><USER10> I don't think anyone got the memo in any industry. Also if Lisp would be more popular in the industry I'm sure that we would find similar vulnerabilities as well.

<comment><USER6> No doubt about vulnerabilities. But I'm not talking about vulnerabilities, but about a particular kind of stupid behaviour that creates an immense _class_ of vulnerabilities. Stitching, parsing and reparsing strings is not the right way to handle _structured_ data. We knew that for almost half the century, we had tools for doing it properly since about the same time, and yet most popular frameworks, tools and even Unix itself are stuck deep in that mistake.

<comment><USER11> On that note, using powershell for a while really made me wish Unix would move to something beyond mere pipes. I love the Unix command line, but sharing structured data seamlessly is simply better

<comment><USER12> What makes powershell's system better? I've never used it

<comment><USER6> You pass around .NET objects instead of plaintext. Which means information you work on retains its metadata even after lots of piping, and you don't have to invent ad-hoc sed/awk-based microparsers that will break on another machine anyway (be it because of different locale or different command implementation). You operate on objects, and in the end - if you're printing to e.g. terminal - you decide how to display the data.

A simple example - equivalent of ls -la with sorting by size: Get-ChildItem | Sort-Object length. You can sort like that because each entry returned by Get- ChildItem is in fact an object. In case of files, it's an object of type System.IO.FileInfo. Some of available properties are:

        Attributes                Property       System.IO.FileAttributes Attributes {get;set;}
        CreationTime              Property       datetime CreationTime {get;set;}
        CreationTimeUtc           Property       datetime CreationTimeUtc {get;set;}
        Directory                 Property       System.IO.DirectoryInfo Directory {get;}
        DirectoryName             Property       string DirectoryName {get;}
        Exists                    Property       bool Exists {get;}
        Extension                 Property       string Extension {get;}
        FullName                  Property       string FullName {get;}
        IsReadOnly                Property       bool IsReadOnly {get;set;}
        LastAccessTime            Property       datetime LastAccessTime {get;set;}
        LastAccessTimeUtc         Property       datetime LastAccessTimeUtc {get;set;}
        LastWriteTime             Property       datetime LastWriteTime {get;set;}
        LastWriteTimeUtc          Property       datetime LastWriteTimeUtc {get;set;}
        Length                    Property       long Length {get;}
        Name                      Property       string Name {get;}
        BaseName                  ScriptProperty System.Object BaseName {get=if ($this.Extension.Length -gt 0){$this.Name.Re...
        VersionInfo               ScriptProperty System.Object VersionInfo {get=[System.Diagnostics.FileVersionInfo]::GetVer...

You can sort by any of these. And each object has even more _methods_ available, like Delete(), Encrypt() or SetAccessControl().

Examples of formatting: [https://technet.microsoft.com/en- us/library/dd347677.aspx](https://technet.microsoft.com/en- us/library/dd347677.aspx).

<comment><USER12> Coming from Unix, this seems super unintuitive, but that's probably just my background. Do you find it tough to figure out what you need to do?

<comment><USER6> You have to learn a few things, just like you have to learn them on Unix. You need to familiarize yourself with some basic cmdlets like Get-ChildItem or Format-Table or Sort-Object, etc. Just like you need to learn about ls or grep or the test syntax under Unix.

PowerShell is pretty discoverable though (not as discoverable as one may be used to in Lisp ecosystem, but still). For instance, I can fetch the list of properties like the one I pasted in my previous comment by using: Get- ChildItem somefile | Get-Member. It's roughly equivalent to ls filename | <something that would describe the file's properties if the result wasn't plaintext>.

Personally, I do find cmdlets a bit cumbersome to type in even with TAB- completion, but fortunately PowerShell defines a lot of aliases - like (again, I'm just copying what I found after typing "alias"):

        CommandType     Name
        </comment></comment></comment></comment></comment></comment></comment></comment></comment><comment>-----     ----
        (...)
        Alias           cat -> Get-Content
        Alias           cd -> Set-Location
        Alias           chdir -> Set-Location
        Alias           clear -> Clear-Host
        Alias           cp -> Copy-Item
        Alias           diff -> Compare-Object
        Alias           dnsn -> Disconnect-PSSession
        Alias           echo -> Write-Output
        Alias           kill -> Stop-Process
        Alias           ls -> Get-ChildItem
        Alias           man -> help
        Alias           mount -> New-PSDrive
        Alias           pushd -> Push-Location
        Alias           pwd -> Get-Location
        Alias           rm -> Remove-Item
        Alias           tee -> Tee-Object
        (...)

So e.g. ls | Get-Member works too.

The cmdlets however are often more powerful than their bash/Unix equivalent and - again - they work with objects, which you can always inspect if you're not sure what properties and methods they expose.

</comment><comment><USER13> It's a really stupid bug, and a somewhat dangerous vulnerability, but hopefully places like airports have IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down.

On average, my guess is that small businesses are more vulnerable to this, but that's mitigated by them being less likely to be targeted by a hack this sophisticated.

That being said, incompetence can be found everywhere, and obviously it's important for the vulnerability to be fixed.

<comment><USER14> >IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down.

The problem here is that the way this stuff has grown through the past 50+ years is that IT does "computers" and facilities does "physical security." These realms of responsibility have been seperate, but now are really IT.

Now that everything is tcp/ip, well, everything is "computers" now but many organizations struggle with this. IT departments aren't given these responsibilities and old school bureaucrats and rent-seekers don't want to give this to IT. So a lot of these largely blue collar types just call in some vendor who they can't judge nor can they question in regards to technical topics (yeah networking, PoE devices, IoT, remote connectivity, etc is a bit different than running analog doorbell cable that clicks doors open).

I had this fight recently at work. It was a political shitstorm about IT replacing the old school phone system with a proper VOIP system and to take over physical security keycards. This fight only ended when the VP in charge of those things retired. These people don't want to modernize and if they do, they'll do their best not to do it with IT. They'll just call some shit vendor who will take them for a ride and security will absolutely not be a concern. Of course that'll be easy to hack. No one is auditing this, setting up vlans, applying patches, auditing products before buying them, etc. We're in this ugly transition stage where everything is going to be a 'smart' device, but the people who are used to dumb devices are still employed. They can't be retrained and they don't want to be. Until these people retire, expect more stupidly simple physical security exploits.

This is going to be at anything government or union run. The protectionism, corruption, incompetence, etc will stymy any attempt at best practices, so no surprise to see airports in this article.

<comment><USER13> It's fair enough to note that IT may not own these systems, but they still have to interact with IT infrastructure at some point. But you're also right that politics can make things much more difficult than they should be.

The article doesn't specifically state that any airports or other sites are vulnerable, just that they could be.

<comment><USER14> You'd think so, but 'building operations' just buys their own internet line and off they go. These large organizations are all silo'd. I suspect we're blaming IT for a lot of things they have no jurisdiction over.

In fact, have you seen some of these automation sites? They're geared towards tradespeople and not towards IT. They know who their customers are.

</comment></comment></comment></comment><comment><USER15> This is an astonishing level of incompetence for "A worldwide trusted provider of Secure Identity Solutions". Isn't there any competition in that market, or pressure to be scrutinized for certification/suitability for government contracts etc.?

<comment><USER6> > _Isn 't there any competition in that market_

Whether there is or there isn't, it doesn't matter. People buying these systems are usually not competent enough to evaluate security issues, and companies do their best to hide information about such incidents while spending tons of money on marketing. Competition doesn't solve those issues when its the salesmen who control information flow to customer (or in other words, it pretty much never solves those issues).

<comment><USER15> > _Competition doesn 't solve those issues when its the salesmen who control > information flow to customer_

Wouldn't a competent competitor aim to point out flaws in such products and claim they're doing it better? Unless security is just a buzzword and not a real feature in this market, that is...

<comment><USER16> >not a real feature in this market

Entirely possible. I'd guess that most of these systems replace mechanical locks wide open to anyone with the right tools and a few hours of lockpicking training. In retrofits it's common for the mechanical lock to _still be there_ as an override, so bumping/picking may still be the weakest link.

Most are probably also deployed next to windows which are vulnerable to rocks, and on doors which wouldn't stand up to a crowbar or boot.

Access control is mostly about deterring casual users and bounding/monitoring/revoking the access of legitimate employees. Systems designed to stand up to teams of security experts are something else entirely.

</comment></comment></comment></comment><comment><USER17> Nearly all door controllers are broken. I hope someone comes out with a secure alternative soon but fear that the cost of installation that comes with these devices will prevent many people from upgrading.

<comment><USER18> There were secure alternatives available several years ago. Unfortunately the industry is moving from code running on bare metal to having the main panels and now the door controllers run a full embedded OS. The complexity of how everthing interacts now has increased exponentialy so your attack surface is now much larger. All for easier initial development.

</comment></comment><comment><USER19> And if you found that interesting, you'll possibly find this slideshow, a 2012 presentation by Brad Antoniewicz of Foundstone, interesting as well.

* [https://github.com/brad-anton/VertX/blob/master/Attacking%20...](https://github.com/brad-anton/VertX/blob/master/Attacking%20Proximity%20Card%20Access%20Systems-v0.1.pdf)

"Linux on a cris". Passwordless regular user, no shadow passwords, root with a crackable password, and a telnet server enabled.

</comment><comment><USER16> Sad as this is, realize that the cheap mechanical locks it replaced weren't much better. The attacks aren't necessarily harder, just different and more familiar to us. Bumping and picking can be pretty trivial to people well- versed in locksmithing just like obvious vulnerabilities are trivial to those of us well-versed in software.

</comment><comment><USER20> Headlines like this just reinforce my feeling that the "Internet of Things" concept is bad/premature. Maybe I'm pessimistic, but it strikes me as "Let's take this network technology that we've yet to make reliably secure or private and put it in everything!"

</comment><comment><USER21> At the past two office I've worked at, sliding a belt through the glass door to activate the motion sensor works pretty well for when you leave your badge at your desk. ;)

</comment><comment><USER22> _Discoveryd then builds up a path to /mnt/apps/bin/blink and calls system() to run the blink program with that number as an argument._

I have a feeling this is similar to the left-pad debacle... a whole separate binary just to blink an LED? "Blink n times" should be nothing more than a loop with two delays and presumably a write to a GPIO device in the middle. Unwarranted complexity strikes again.

Does anyone recognise the architecture? "JSR" and "MOVE.D" brings up some PDP-11(?) docs, which doesn't seem right.

<comment><USER6> It feels ok for me. It's kind of the Unix way, with all the /bin/true, /bin/false, /dev/zero, etc. That /mnt/apps/bin/blink may just be exactly that "loop with two delays and presumably a write to a GPIO device in the middle", written in C or even hand-written in ASM.

<comment><USER23> The problem isn't 'blink'. The problem is calling it via system() _and_ handing unsanitized user input to system().

<comment><USER22> That's too narrow in scope. The fact that they decided to make such a trivial function an externally invoked binary is also a large contributing factor, and should not be overlooked. There would otherwise be no need to use system(), "sanitize" user input, etc.

</comment></comment></comment></comment><comment><USER24> Trend Micro has such a slimey leadership team that it is hard for me to see anything they do in a positive light. They desperately need to rebrand.</comment>


Turn Off Cortana Completely in Windows 10 Anniversary Update - <AUTHOR> http://www.zdnet.com/article/windows-10-tip-turn-off-cortana-completely/ <comment><USER2> Cortana is yet another feature, that you wouldn't turn on, if it was off by default.

I don't truly understand the goal of Cortana, other than "Apple has Siri". Some of the person assistant features seems handy, but do you really need to talk to your computer? The only place where it seems like something I'd need is when cooking and want to look up a recipe.

Microsoft efforts would have been better spend improving the built in search.

<comment><USER3> You don't need to talk to use Cortana. I had Cortana disabled until the Anniversary Update came. If you don't agree to letting it see your emails/calendar/personal stuff, it will become a limited version of itself (in fact, it didn't prompt me about it until I actively tried to do something that needed it). I was OK with letting that limited version enabled, and thought I would still not use even that.

A few days ago, however, I had to set a five minutes timer. It was much easier to press the Windows key and type "set a timer for five minutes" than to go search for whatever app is responsible for timers. I find the "grandma- friendly command line" part of Cortana much more useful than the voice control part, and I can see why it comes enabled by default. I mainly use Linux and wish I had something like that in my KDE desktop (the Alt+F2 command bar is similar, but nowhere close).

<comment><USER4> You can do some of that online. Please forgive the LMGTFY link, since I'm really just trying to demonstrate a feature of Google's search engine:

[http://lmgtfy.com/?q=5+minute+timer](http://lmgtfy.com/?q=5+minute+timer)

<comment><USER3> Yeah, but I don't have Google mapped to a keyboard key, but even if I did, googling for "5 minute timer" (and similar variants, like "1 minute timer" or "30 seconds timer") yields the usual search results for me. At least Cortana is (at least since the Anniversary Update) consistent with what features it offers to each user, unlike Google which will randomly not present those built-in tools. And since I can't try it, I'm wondering: to use Google's timer, do I need to leave the tab open until it ends? Because in that case it's nowhere as nice as Cortana, which just goes into background...

<comment><USER5> I just tried it, and it seems to me like it shows the timer only on google.com, not on the Google-domain for my country, so maybe that was a factor. The other comment pointed out more inconsistencies, though, so might really just be Google's algorithm judging at random who's allowed to get a timer and who not.

DuckDuckGo's implementation [0] seems more robust to me, but if you don't use it as your default search engine, it's probably easier anyways to just click on the first link in the Google search results (or use Cortana obviously).

And yeah, you do need to leave the tab open until it ends. I don't see that as that big of a flaw as you do, since most people have a browser open all the time anyways, but yeah, whatever floats your boat. Certainly isn't terrible to have another option for it.

[0] [https://duckduckgo.com/?q=5+minute+timer](https://duckduckgo.com/?q=5+minute+timer)

<comment><USER3> Indeed DuckDuckGo's timer appears to be quite nice, I have it as my main search engine but didn't notice it had that. It's probably a recent addition. I agree that having to keep a browser tab open is not much of an issue, but for longer timers (hours) that can be an issue (although for that case, alarms are better suited... but then you need an alarm app, and while Cortana and Google Now will AFAIK set the alarm on their respective platforms, DuckDuckGo has no "platform" to do it...).

</comment></comment></comment></comment></comment></comment><comment><USER6> Great, now we just need walkthroughs to turn off all the other hidden features. How do I disable the feature where it's recording my games all the time, invisibly, just in case I push a hotkey to save it? I've also heard that it sends screenshots back to MS every few seconds and at this point that doesn't even seem like a crazy conspiracy theory.

<comment><USER7> Load the XBox app, go into settings, slide the slider.

Yes it is a stupid default, no it is not sending screenshots back to Microsoft.

<comment><USER6> Thanks. Do you know of a way to do this without an Xbox account?

Edit: Also in the general tab, disable "share clips and screenshots by default". That's not as bad as automatically taking screenshots, but it's still awful.

<comment><USER7> Run Powershell and execute this command:

Get-AppxPackage _xboxapp_ | Remove-AppxPackage

</comment></comment></comment></comment><comment><USER8> I wouldn't bother. I'm pre-update and have turned it off when I installed Windows 10.

Yet App history shows a cpu usage of 0:07:25 and network transfer of 1.5MB for Cortana.

</comment><comment><USER9> Has anybody found a way to fully disable the lockscreen? I don't wanna upgrade unless I can fully disable it. I've tested a couple of solutions on another PC, but it seems like it doesnt work on reboot or on the first boot.

<comment><USER6> \- Mods: Why don't I have a delete button for this post? I have a delete button for my other post.

<comment><USER9> Sorry, I didn't say it properly - by completly disabling I meant the fact that even with some of the tweaks the lockscreen kept appearing before the login screen(e.g. after reboot). But I wanna keep the login screen while disabling the lockscreen.

<comment><USER10> I've done it with a registry edit. It's such an irritating and pointless "feature"

[http://www.laptopmag.com/articles/disable-lock-screen- window...](http://www.laptopmag.com/articles/disable-lock-screen-windows-10)

<comment><USER9> Doesnt work for me in the anniversary update with w10 pro

</comment></comment></comment></comment></comment><comment><USER11> I simply use MSMG Toolkit over at MDL forums, remove all the packages I don't want prior to installing from ISO.

No cortana (warning: no start menu searching either), no modern apps (you can intergrate calc.exe), no store, defender, remove alot of telemetry, one drive, etc.

<comment><USER12> You don't trust Microsoft--who wrote the kernel and many of the drivers you're using--but trust some random .exe from a forum?

<comment><USER11> It's a readable .bat file, and all the executable dependencies are either from microsoft (dism, etc) or offer source code and/or hashing.

At some point you have to trust something, whether it be your software or your hardware.

Besides the telemetry stuff, it's not a trust issue. I just don't have a need for any of the packages I remove. I don't need cortana and search, I don't need Windows Defender and it's cloud features, I don't need onedrive, xbox, modern apps, etc. It's my choice, so I remove them.

</comment></comment></comment><comment><USER13> It seems the HN crowd (and zdnet and EFF) are all missing a very important point: with the anniversary update (rolled out last week) Cortana is now much much less intrusive. For example, you don't need to have GPS enabled att all time in order to use Cortana.

So all in all, Microsoft seems to be on the right track regarding privacy. It is not moving very fast but at least it is moving to the right direction.

</comment><comment><USER14> Cortana would have been far more often used if it was isolated to controlling the OS, which i find it cannot do (well?).

Had there been another voice activated software to do searches on the internet, like Samada, people would have utilized it better.

</comment><comment><USER15> I would have used an Android/iOS style dictation key on my Windows tablet virtual keyboard.

That's the one thing I wanted from Windows 10. But no. They gave me this useless Cortana bullshit that can only search with Bing.

</comment><comment><USER16> why turn it off when you can uninstall COMPLETELY?

Windows10ReTweaker [http://win10epicfail.proboards.com/thread/100/interested- par...](http://win10epicfail.proboards.com/thread/100/interested- participating-tweaker-development-test)</comment>


We All Have 'Trust Issues' - <AUTHOR> https://medium.com/s/trustissues/we-all-have-trust-issues-b72205a59b3c <comment><USER2>
      The blockchain boom suggests we don't trust the foundations of our financial system.

No, a mistrust of the financial system would result in precious metals and other extra-systemic assets going up in price.</comment>


Excruciating New Credit Cards Finally Give Apple Pay a Problem to Solve - <AUTHOR> http://www.wired.com/2016/02/long-checkout-lines-finally-give-apple-pay-a-problem-to-solve/ <comment><USER2> Doesn't solve anything. Every time I try to use Apple Pay with my chipped card, the machine at CVS tells me that I need to insert my card into the chip reader. Absolute fail. Why does the Verifone machine at CVS knows my Apple Pay card has a chip? Why even offer NFC if I need to use my physical card anyway?

</comment><comment><USER3> Funny, we've had chip-and-pin cards in Canada for ages (which are a bit slower than swipe-and-sign but significantly more secure) and now can also pay with the card using NFC proximity readers (which are very fast). We've never had problems with either.

Sounds to me like run-of-the-mill problems with the switch rather than issues with the underlying tech.

<comment><USER2> It's significantly slower here. I'd say over 5x slower. If swiping takes less than a second, the chip takes 5 seconds. I'd also blame the implementation.

</comment></comment><comment><USER4> I was in Spain last fall, where NFC/Apple Pay worked great but was not available to locals.

It was really funny, as I'd just tap my phone on their CC machine and they would act like I was some sort of sorcerer or something.

</comment><comment><USER5> This happened to me at Target with a discover card. They did not accept NFC. My solution was to stop shopping there.

</comment><comment><USER6> Is there something intrinsic to EMV that makes it slow? Or just bad implementations of the readers?</comment>


Show HN: Open First Google Result – Chrome Extension - <AUTHOR> https://chrome.google.com/webstore/detail/open-first-result/gjnjcllfalbogkiimgehiinpmedadlii

<comment><AUTHOR> Hi, the few lines of code on this extension are open-source (Apache v2 license), and you can download it all from here: [https://www.dropbox.com/s/5ffnnzlbaspp94p/open_first_result_...](https://www.dropbox.com/s/5ffnnzlbaspp94p/open_first_result_chrome_extension.zip)</comment>


Lessons Learned: First 6 Months Running a Software Consultancy - <AUTHOR> http://reefpoints.dockyard.com/opinion/2012/06/21/lessons-learned-six-month-of-running-dockyard.html

<comment> mck- Thanks for sharing - wonderfully insightful post

>> I've changed from the "anything goes" type boss to the "I'm going to be the asshole" over the past six months.

Is this really, absolutely necessary? I'm not sure I could/would.. but that might change once I get on with my start-up? I'm always for doing things differenly -- there are enough companies that "thrive" on a-hole management.

<comment><AUTHOR> Maybe "I'm going to be the asshole" is too strong. I meant to say that I'm the guy that says "no" to things. I'm going to be tough on people about code quality and process because that is what we are selling our clients. I would hope that my employees don't think I'm an asshole but at times I realize I get annoyed and just say "this is how we're doing it"

<comment> mck- Haha, thanks for clarifying, I see what you mean now..

Still sounds a little like micro-management (though you'd say quality assurance), which a lot of people (perhaps including yourself?) might find annoying (well, I do)

How do you find the balance there?

</comment></comment></comment><comment><USER2> I'd like to add something to the mix for any up-and-coming consultancies around the world, especially in parts of the world with weak currencies. If you're struggling to find clients locally, you can always try your hand at reaching out to consultancies [with the philosophy of DockYard] that have a floor rate for client work. If something like $25k would do well for you but doesn't qualify a client for the bigger consultancy, try to form relationships to be an entity they can refer these potential clients to.</comment>


Ask HN: Do you have a side project to sell? - <AUTHOR>

A lot of the auction sites out there don't have great listings or are selling highly profitable businesses.
I'd be interested to hear about any smaller projects, sites or apps that you are no longer actively maintaining. I've recently finished up a project and have some spare time to start something new.
I know a lot of people here often don't have time to maintain projects once they move onto bigger things. Maybe you have a specific price in mind or perhaps you'd rather see it go to someone to someone who will carry it on.
I'm particularly interested in apps that produce printable products or digital downloads. <comment><USER2> GuessTheAge.net, it's a guessing portal for people who want to know their "real" age by letting people guessing it anonymous. It's build with PHP, MySQL, jQuery & Bootstrap. Domain, unique design, source is ready for a new owner.

</comment><comment><USER3> I usually do sites and get tired of them and have little knowledge about marketing them.

Currently, looking at selling ampoll.com. I probably just want too much but I'd rather just not sell if the selling price would make me feel shame towards myself :)

</comment><comment><USER4> streamjoy.tv, its a streaming movie search engine, gets data from amazon, imdb ratings, itunes, used to be able to get netflix data.

<comment><USER5> Do you mean you want to sell the domain? Because streamjoy.tv doesn't seem to have anything going on at the moment.

<comment><USER4> I took it offline but I can enable it again.

What I would like to sell is the code base that interfaces with 6 APIs. The code base downloads and keeps refreshed a copy of the movie database, and it cross references each movie with Amazon Instant Video, iTunes and Netflix (no public API access anymore, but access could probably be obtained)

It also checks each movies IMDB rating and populates the DB with that.

The DB is searchable with elasticsearch.

Its a small code base in Python, with Flask for the search frontend and MongoDB for the data.

Its a streaming movie search engine, it tells you where you can find any movie online.

The links are affiliate links and you will earn whenever anyone that clicks through to Amazon buys anything on Amazon in the next 24 hours.

The sales I have gotten from Amazon were not even for movie purchases, but just other purchases people made. With traffic this would be a good revenue stream.

I am currently immersed in another project and hence haven't had time to continue with streamjoy, but my idea for the next pivot was to create Tinder for streaming movies.

I envision a Tinder like swipe interface for choosing a movie to watch. You would swipe right or left. This would let one quickly filter movies down to ones one is interested in.

The swipe rights would go into a maybe queue, and the swipe lefts wouldn't be seen again.

Picking a streaming movie to watch is a frustrating thing experienced by millions.

I would love for someone to make money from streamjoy. Email me at firstname.lastname@example.com if you are interested.</comment></comment></comment>


Your landlord turns your apartment into a smart home. Now what? - <AUTHOR> https://www.cnet.com/news/your-landlord-turns-your-apartment-into-a-smart-home-now-what/ <comment><USER2> > Chief Technology Officer Jeremy Warren said in a statement that it allows > customers to opt out of marketing.

I don't understand why this shit should exist at all. If you're a smart home company your objective is to serve the client (the property manager) who in turn wants the technology to benefit the homeowner. Why is "marketing" even involved?

<comment><USER3> Because the user is the product. It's a data mining operation wrapped in a deceptive package.

<comment><USER2> We should have regulation to prevent that. There's nothing wrong with ad- sponsored products but they should be clearly labelled as such. As it stands this is fraud.

<comment><USER3> I sincerely disagree. To see why, try writing down a proposed law. One will quickly find it's the new "cookie warning" (thanks EU!).

Consider the proposed "ad-sponsored" label that is required to be on the product. Say you want to sell a product, initially you promise to keep your users data and not sell it, therefore you sell your product legally (in the jurstiction with this new law) without the "ad-sponsored" label.

Later on, you are not doing well financially, and that database is worth money. Company B makes an offer to buy your company.

Is company B bound by your past actions? Nope, nor can they be; that's how mistakes get fixed. You could have instead created a contract with each of your clients, but you didnt. If you had, the client would have the ability to control you, and you may not even be able to sell your company, or it might not be worth anything due to the N contracts involved.

Then consider the pointless regulatary enforcement system required. How would one even approach that? Forced registration of every company that happens to get some customer data? It's a endless cycle, that creates no value, and costs the taxpayers money.

A law requiring some specific action is almost always the wrong reaction.

The only general solution compatiable with a free society is for people to become aware of the value of their data and who they hand it to.

In this specific case, property rights should fix it. Either you get to break your contract because the owner breaches it by installing a camera in your livingroom, or do it from the renters rights side. Best left up to the states so you get a market of ideas.

</comment></comment></comment></comment><comment><USER4> As things currently are, I think the only realistic option in that scenario is to find another place to live.</comment>


Jtalk: a Smalltalk implementation that runs on the JavaScript runtime. - <AUTHOR> http://jtalk-project.org/ <comment><USER2> A few notes:

a. this is awesome

b. the "documentation" link halfway down the homepage goes to an anchor tag that doesn't exist, rather than the actual documentation page. At first I thought there just were no docs, and I was disappointed.

c. After reading through the docs, I can see how to create cool classes but am not sure how to instantiate them on the page. Is there a Smalltalk image-style system to marshall instances to disc and back? That would be fantastic.

I have so many other ideas for wonderful things this could do. Breakpoints in event handlers to let you change the code without reloading the page. Including less/scss with view classes and live editing of that on the page.

But there are also lots of challenges. To get good performance you will need to have access to lots of front-end-specific tricks, like event delegation, spreading long computations out with timers, etc.

In sum, then, super-exciting, hope to see more docs and details soon, let us know how we can help. Can someone comment on the status of server-side ST frameworks if I wanted to try a small, all-ST webapp?

<comment><USER3> As to the all-ST webapp, there are three frameworks you may want to check out, these are Seaside, AidaWeb and Iliad.

If you allow me to be a bit biased, I'd recommend you to first check Iliad (iliadproject.org/), as IMO it's the one that'll give you the most impressive results in the shortest possible learning time. And I'd work on Pharo (pharo- project.org), as it's the most complete open source and free ST implementation out there. Again, in my humble biased opinion.

To get started, check this out: <http://www.asmalltalkbytheseaside.com/iliad_en.pdf>

These slides are based on a presentation given by Nicolas Petton, Iliad's author, at the 2010 edition of the European Smalltalk Users Group conference.

You can watch the whole talk, «Web Development in Iliad», right here: <http://esug2010.objectfusion.fr/tuesday.html> Hope it helped! :)

<comment><USER2> Thanks!

</comment></comment></comment><comment><USER4> Anyone who's used <http://clamato.net/> want to compare the two?

<comment><USER5> Not much of a comparison, but JTalk aims for code compatibility with Pharo Smalltalk, whereas Clamato is a distinct dialect. Perhaps partly because of this, I felt able to work with immediately in a way I never did with Clamato, or any other in-browser Smalltalk-like software I've seen. My past experience with Smalltalk transfers well into JTalk, not so well into Clamato.

When I first ran JTalk (months back), one of the expressions I tried was to get the sum of even numbers between 1 and 5, and it doesn't work, because JTalk is missing various things, like 'even' and 'odd'. I had a Pharo Smalltalk system to hand, and was able to look up the implementation for 'even', and deeper requirements like '//' (divide without remainder), and type them into the browser until I got the answer.

Since then, JTalk now has the very beginnings of exception handling. When Smalltalk is asked to evaluate a non-existent method, it raises a MessageNotUnderstood (MNU) exception. It's interesting to think about the idea of having a web service running on Pharo, which answer chunks of it's own source code, and JTalk's MNU behaviour being to send out an http request to try to load that source code, and then continue running. (I don't know nearly enough about Javascript or JTalk internals - this may be wildly impractical.)

In any case, the idea of code compatibility between front-end and back-end is very appealing: re-use domain model classes, write input validation in one place and have it run in both places, and such.

(I seem to have gone off on a tangent. Hopefully an interesting one.)

<comment><USER4> Thanks! One thing I'd really like to see myself is an in-browser environment like this for a capability language like Newspeak or E.

<comment><USER6> AFAIK Newspeak is written in Smalltalk. I wonder if it's possible to run it on (or port it to) JTalk.

<comment><USER7> newspeak was being ported to javascript, but it sounds like they may have given up because of limitations of javascript: [http://gbracha.blogspot.com/2011/03/truthiness-is-out- there....](http://gbracha.blogspot.com/2011/03/truthiness-is-out-there.html)</comment></comment></comment></comment></comment>


On the Benefits of Cutting Your Own Hair - <AUTHOR> https://medium.com/@dconrad/on-the-benefits-of-cutting-your-own-hair-2ff7b9c06c26 <comment><USER2> I tried to cut my own bangs once and it was not cute. I'm sticking to a professional. But if you can do it, more power to ya

<comment><AUTHOR> Maybe if you keep trying you'll get it right. :)</comment></comment>


Sockets in a Bind: Troubleshooting Port Exhaustion in Heroku's Routing Layer - <AUTHOR> https://engineering.heroku.com/blogs/2017-03-30-sockets-in-a-bind/ <comment><USER2> The linked article does a much better job of explaining the problem. Just read this one: [https://idea.popcount.org/2014-04-03-bind-before- connect/](https://idea.popcount.org/2014-04-03-bind-before-connect/)

</comment><comment><USER3> That C code has a buffer overflow. Also they call atoi unnecessarily in each loop iteration.

</comment><comment><USER4> A better solution would be relatively new socket option:

IP_BIND_ADDRESS_NO_PORT

[https://www.mail- email@example.com/msg66879...](https://www.mail- email@example.com/msg66879.html)

</comment><comment><USER5> This type of thing would not have been an issue 15 years ago. This is Richard Stevens socket programming 101.</comment>


Nils John Nilsson has left us - <AUTHOR> https://en.wikipedia.org/wiki/Nils_John_Nilsson <comment><AUTHOR> Quoting from Wikipedia:

 _Nils John Nilsson was an American computer scientist. He was one of the founding researchers in the discipline of artificial intelligence. He was the first Kumagai Professor of Engineering (Emeritus) in Computer Science at Stanford University, a position that he held since the chair was established in 1990 until his death. He was particularly famous for his contributions to search, planning, knowledge representation, and robotics._

 _His research was based mainly on the premise that intelligence is based on knowledge that must be represented explicitly._</comment>


Introducing Teletype for Atom: Code collaboratively in real time - <AUTHOR> https://github.com/blog/2468-introducing-teletype-for-atom-code-collaboratively-in-real-time <comment><USER2> Now someone needs to add sound effects of an ASR-33 Teletype...

</comment><comment><AUTHOR> I thought the timing of this was interesting given Visual Studio Live Share today.</comment>


Ask HN: would you give us feedback about our saas directory ? - <AUTHOR> http://www.kingapi.com

<comment><USER2> Implement the standard "community" things like rating, tags and comments. Make it sortable by paid/freemium. Create a "suggest a service" form to replace the email adress, and put up some contact information. I like the overall design, but maybe the logo "style" seems a bit out of place.

<comment><AUTHOR> Yeah the logo is a bit cheesy :)

Thanks for the suggestions - we will definitely put a form and allow to filter on paid/freemium.

Community stuff is also on our list for later on.

Thanks!

<comment><USER3> Honestly I liked the logo, but I'm not crazy about the font it uses.

<comment><AUTHOR> Not sure it's really readable, having a second look. Maybe switching to a more common font will be better here. Thanks for the note.

</comment></comment></comment></comment><comment><USER4> A couple of UI things:

1) Can you make it so I can click anywhere on the box instead of just the company title?

2) Putting the item I selected at the top of the list is OK, but unexpected. I would expect these links to go to a profile page or directly to the website.

Example: <http://www.kingapi.com/billing?selected=cheddargetter>

3) Make real links to the website, instead of doing the Javascript redirect. Otherwise I can't open the links in a new tab or see the target in the status bar.

Otherwise, the site is nice. I like the presentation and the list of services is high quality.

<comment><USER5> I second point 2, it just seemed weird. As well it wasn't very pronounced (ie it was on top of the list, but maybe it was just sorted funny? Didn't feel like I came to the page to see that).

Definitely agree on using a single profile page.

<comment><AUTHOR> It doesn't 'feel' well, I agree.

We will put some kind of profile page later on, for the mean time I'm just going to redirect to the website directly, it's just more clear.

Thanks!

</comment></comment></comment><comment><USER6> shorten the width a little, I have to side scroll on my netbook. Annoying. Also, I can't open a link by middle-clicking it with my mouse. Annoying as well.

Otherwise, pretty nice idea.

<comment><AUTHOR> good point, thanks - I'll see if we can fix this!

</comment></comment><comment><AUTHOR> A few months back we were looking for a place that would keep track of saas building-blocks that we find useful to build applications (we = Sébastien Gruhier and me).

So we finally decided to build this little directory and put it online.

We're working on adding more content to it as we go.

Please note I'm aware other HNers are working on similar stuff! We just happened to work on this during the last couple of months, it was time we release it :)

Any feedback will be most welcome!

<comment><USER7> I'm going to guess you know about: <http://www.programmableweb.com/apis/directory>

I like your UI much better, however.

<comment><AUTHOR> Well no actually! I didn't know about this one. Thanks for the link!

</comment></comment></comment><comment><USER8> I like the idea to have a place to catalog API-based solutions. It would be interesting to have folks vote for popular APIs.

<comment><AUTHOR> I'll see how we can implement a useful vote feature.

</comment></comment><comment><USER9> Get rid of the shadows on the screenshots, ahte it when sites aren't represented the way the really look.

Add language or markets and filters for them.

<comment><AUTHOR> shadows: we tried without first but we didn't like it. I may try with less shadow later on though :)

language/markets - what do you mean more precisely ?

</comment></comment><comment><USER10> Looks pretty good. However, I suspect your real challenge will be keeping the signal to noise ratio high.

<comment><AUTHOR> Spot on - based on my previous experience (with <http://learnivore.com>), selection is the key.

I hope we will manage to keep a good selection up there.

</comment></comment><comment><USER11> I love the design; I'll be watching it as you add more services.

<comment><AUTHOR> Thank you - you'll want to follow <http://twitter.com/kingofapi> for updates - I'll push each new site registered there.

<comment><USER12> Register kingofapi.com as well please before I do :)

<comment><AUTHOR> well - I just did it, but just because you were threatening :)

It would be good to get the twitter kingapi name, but no luck so far!

</comment></comment></comment></comment><comment><USER13> middle click / control click does not work.

I do not know how others browse, but among my friends it is common to middle click when having a list of things to checkout.</comment>


Edupreneurs are a Good Bet to End the Reign of the Kleptobankers - <AUTHOR> http://edupreneursvkleptobankers.wordpress.com/

<comment><USER2> Clayton nails it down pretty good. For more about education and technology you can read this issue of this science magazine [http://www.sciencemag.org/content/vol323/issue5910/index.dtl...](http://www.sciencemag.org/content/vol323/issue5910/index.dtl?etoc)

The interesting thing in the science mag was this video <http://www.sciencemag.org/cgi/content/full/323/5910/53b> in which they blamed standardized tests for ruining american education. Funny thing is none of them are doing anything to solve the problem.</comment>


When the Hospital Fires the Bullet - <AUTHOR> http://www.nytimes.com/2016/02/14/us/hospital-guns-mental-health.html <comment><AUTHOR> As someone who has been hospitalized with delusional bipolar disorder this upsets me to no end. I used to think the right thing to do if you were delusional or suicidal was to go to the hospital. I don't know anymore.</comment>


An Interview with the Guy Who Sleeps in a Different Place on Campus Every Night - <AUTHOR> http://wesleying.org/2013/03/01/an-interview-with-the-guy-who-sleeps-in-a-different-place-on-campus-every-night/

<comment><USER2> Turns out this is a personal lifestyle choice as his parents have actually paid for a room for him.

Meanwhile, there really are homeless students in the US.

 _"In 2009, 47,204 college students applying for financial aid checked a box that identified themselves as homeless."_ [http://www.huffingtonpost.com/2011/01/03/homeless-college- st...](http://www.huffingtonpost.com/2011/01/03/homeless-college- students_1_n_802844.html)

 _"I have had homeless students before. In fact, when the recession began to rear its ugly head the number of students in our high school who lived in shelters grew and grew and grew... Whenever I found out that a student was homeless, the puzzle pieces suddenly fit together -- the fatigue, the sudden weight loss, the increasingly dirtiness of their clothing or unkempt elements of their personal self. "Oh..." I would think, "That's what's going on.""_ [http://www.huffingtonpost.com/lori-ungemah/homeless-in- colle...](http://www.huffingtonpost.com/lori-ungemah/homeless-in- college_b_2271926.html)

Of course, there are also homeless people who aren't even students trying to live on campus too.

 _"The library at Cambridge University's largest college has been playing host to a mysterious user with a collection of supermarket bags, vague claims of doing a doctorate on religion and a habit of dozing off. The unexpected visitor was the subject of speculation at St John's College over several weeks, according to students, before he was asked to leave by staff after failing to show that he was entitled to use the library or the college's other ancient premises."_ [http://www.guardian.co.uk/education/2013/feb/27/homeless- man...](http://www.guardian.co.uk/education/2013/feb/27/homeless-man- cambridge-library-weeks)

</comment><comment><USER3> It's an interestingly unique lifestyle, and I'm sure for his station in life and personal philosophy it's the lifestyle he needs.

There is one thing that kind of rubbed me the wrong way.

 _There's this parental lifeline that fulfills all of our physical needs_

Sleeping around on a college campus still makes use of things the campus provides. Everything is still provided to him, a bed and shower are the easiest campus amenities to find elsewhere. In college, the campus was my home, the dorm was lockable storage with a bed. His lifestyle is just a slightly more adventitious version of one I saw dozens fo times: entering your dormroom 2 times a semester because you're really living in your girlfrined's dormroom.

</comment><comment><USER4> So some ignoramus has mom and dad money pay for his apartment while he needlessly mooches off others because, in his own words, "I'm trying to be the change I need to see". He sounds like a dumb shithead.

Edit: to anyone who downvotes without explanation: you are a coward.

<comment><USER5> Edit: Never mind.

<comment><USER4> Is that you, voluntarily-homeless-college student? If so, I have some bad news: a doctor commented on your present lifestyle and has a rather dire warning (you're going nuts):

 _While it's certainly possible that Riel is just a little quirky and enjoys a different type of routine, unfortunately the pattern of behavior described here is often seen during the first presentation of schizophrenia. Schizophrenia is more common in males and classically presents in the early- to-mid 20's. It would not, early in its course, necessarily be accompanied by seriously impaired academic functioning. I would urge Riel's friends and classmates to be vigilant for signs of disorganized or paranoid thought, speech, and behavior._</comment></comment></comment>


Arduino Comes to iOS: Program the LightBlue Bean from Your iPhone/iPad - <AUTHOR> https://punchthrough.com/bean/bean-ios-loader/

<comment><USER2> Part of me wonders why you'd want to program on an iPad. But it also feels like the kind of thing I'm being close minded about. Does anyone have good stories of this working well or being nice in some way I don't anticipate?

<comment><USER3> Acgourley, good point. It's very useful when making small changes to an application in the field. The Dropbox integration makes it easy to write a sketch on your computer and then to modify it on-the-go with iOS. One example: If you have Bean sensors throughout a large space, it's easier to visit the installed sensors, interact with, and update them using the mobile device.

</comment></comment><comment><USER4> Also, the promo code beanhack10 will give you 10% off any Bean purchases :)</comment>


Swisscom Hits 1GBps Mobile Data Transfer in European First - <AUTHOR> http://www.mobileeurope.co.uk/press-wire/swisscom-hits-1gbps-in-european-first <comment><USER2> So GBps or Gbps? article mentions both. Don't think first one is even a thing...</comment>


Ask HN:  Looking for feedback on my spare time project,  Booklends.com - <AUTHOR> http://www.booklends.com

<comment><AUTHOR> Before people ask, yes I do know about the other sites that are very similar to this.

I got the idea around New Years and have been building it in my spare time. Even after other Kindle book lending sites launched, I figured I may as well finish mine anyway!

Edit: Wow HN, you killed it! I'm upgrading the Linode now. If you can't get through, just try again later, thanks!

<comment><USER2> anything different about your site? Are you targeting a specific niche to get more of a certain type fo book or anything?

BTW, congrats on completing something, always a learning experience to get anything out there I think.

<comment><AUTHOR> Thanks! Yeah I learned lots working on this project. I've got a bunch of other things planned too.

There's nothing intentionally different about my site from the other ebook lending sites. I did try to make it as simple as possible. I have a feeling that there is space for a handful of sites like this, since Amazon did sell millions of Kindles this past holiday season. People may segregate themselves into communities of other like-minded readers.

Actually you don't need a Kindle device to borrow or lend the eBooks. You can read the books on your computer or other device (iOS, Android, Blackberry, etc).

<comment><USER2> I don't know much about the competitor sites so am asking out of interest as opposed to any professed insight (although I did buy my wife a kndle for Chrsitmas). It seems a smart approach (if it's not being done already) would be to pick a specific niche and become the 'kindle lending site of X'. That way you can get a reputation for having the most books about X available to lend at any moment. What that would ne I don't know. Or maybe look into book clubs, a lot of book clubs must read the same books a lot of the time, maybe seeding with a few copies of books from some celeb endorsed list could kick start a book club lending site?

</comment></comment></comment></comment><comment><USER3> I would make the Sign Up button big, bold, and colorful. Check out the download button on this page: <http://www.phonegap.com/> (just an example, I'm not affiliated with them). See how it's big and colorful and really stands out. Also note that your logo shouldn't be larger than your call to action button. I have to search for yours.

<comment><AUTHOR> That's one of the first things I want to fix when I get time.

I actually want to use the 'fancy buttons' gem (<https://github.com/imathis/fancy-buttons>) but I would have to switch the site over to using compass for my stylesheets.

Which isn't a bad thing, just not something I want to spend time on this week.

<comment><USER4> Coworker of mine wrote this: <http://ubuwaits.github.com/css3-buttons/> (no need for sass/compass)

</comment></comment></comment><comment><USER5> Change your copy to "Log In" and "Sign up Now". Make the links stand out more.

Lending Kindle books is non-obvious. Make an FAQ or a walkthrough. Make the copy something like this: "Don't know how to lend or borrow books on your Kindle? Find out" The "Find out" part should be a button. Then once you're done with your explanation, make another call to action, "Get started today!"

Get people engaged with your content on the front page. Look at Amazon's book section. They don't just start off by just listing books #1 to a billion. Put in some lists or categories, like top 10 books. Spotlight some popular books on the front page.

Replace the "Find" link with "Browse" or "Explore", and make it stand out more. Put a search bar on every page.

Put more decision-making information in the rows. Import the star ratings, user reviews, and some content information from Amazon.

</comment><comment><USER6> In Chrome, on your sign up and log in pages, the https has a red slash through it warning that the page contains unencrypted resources.

</comment><comment><USER7> From a user perspective, I'd like some signs that people are actually using the site and lending books before signing up. Maybe consider featuring user activity on the front page (seed it with some friends if need be) and seeing how that changes your conversion ratio.

</comment><comment><USER8> Did we kill it? I'm getting:

      Ruby (Rack) application could not be started
      Failed to connect to a master node at localhost:27017 (Mongo::ConnectionFailure)

<comment><AUTHOR> haha yes, you killed it :) It's back up now on a more powerful VPS, thanks for being patient..

Edit: By the way, if you get the "We're sorry but something went wrong" 500 message, that's just because Amazon's API isn't responding. It's limited to a (kinda low) 2000 queries/hour, and even though I do cache the most common searches, being on the front page of HN pushes it over that limit..

</comment></comment><comment><USER9> If this gets traction, how long until Amazon blocks your referral account? I hope they don't, but isn't this the most recent precedent?</comment>


Be still my beating heart - <AUTHOR> http://donmelton.com/2015/12/06/be-still-my-beating-heart/ <comment><USER2> See also episode 08 of the Melton podcast from iMore.

[https://itunes.apple.com/us/podcast/melton/id928565652](https://itunes.apple.com/us/podcast/melton/id928565652)</comment>


Good software engineering book on threading - <AUTHOR> Can people suggest good software engineering books on Threading, concurrency and/or parallelism?<p>I'm looking for something more applied than theoretical. Ideally samples shouldn't be in Java :) <comment><USER2> [http://www.amazon.com/Java-Concurrency-Practice-Brian- Goetz/...](http://www.amazon.com/Java-Concurrency-Practice-Brian- Goetz/dp/0321349601)

</comment><comment><USER3> [http://learnyousomeerlang.com/](http://learnyousomeerlang.com/)</comment>


Ask HN: How to earn respect for you and your startup? - <AUTHOR>

Normally: You need a lot of traction, big investors and a famous team member to gain respect from the average early adopter. But are there any other ways to get people respect you and your product? <comment><USER2> When we did our startup, we didn't think of anything like that. We didn't even start with the intention of doing a startup. We made a tool that solved our own needs. Eventually others found a need for the same thing and adopted it because of a want or need for what we developed. Respect wasn't needed.

Later, respect was earned through the commitment to improve, the excellent customer service, and numerous things we did to engage with the community and help users out. Don't focus on getting respect. Focus on solving a need or want for the users.

</comment><comment><USER3> We had zero clients, no investors, and my dog was my only other team member (and neither of us are famous to my knowledge). I built a product that would solve a problem, and Black & Decker was my first customer. They didn't give a shit about the amount of respect we garnered in the startup or business community. They didn't care about the volume of other users we had, our investors, or the fame of our team - they just wanted a need met at a price that made sense to them.

And that's what we did.

</comment><comment><USER4> I'm a firm believer that if your product solves a genuine problem, people will respect you/it.

</comment><comment><USER5> Being genuine about 'hey! I am trying to solve a problem' helps (instead of putting up a made-up garb of 'we are the best').

Plus, focus on product is what brings respect - look around us : most of the companies we respect are because of the product quality which translates into great features, dependable support etc.</comment>


Don't Be Evil, but Don't Be Saint Entrepreneur Either - <AUTHOR> https://medium.com/@jproco/dont-be-evil-but-don-t-be-saint-entrepreneur-either-c8b488c0a2f0 <comment><USER2> thanks for posting this!</comment>


Finding a D21 drone in an aircraft graveyard - <AUTHOR> https://theaviationist.com/2018/06/08/the-time-i-found-a-formerly-top-secret-d-21-supersonic-drone-in-the-arizona-desert/ <comment><USER2> Anything related to SR-71 is amazing, especially this D21 drone that rode on top of a modified blackbird at Mach 3!!!

</comment><comment><USER3> I'm a bit confused by this story. He says he found it 'abandoned' in the backlot of some AZ aircraft graveyard in 2009, but it was actually loaned to the Pima Air Museum in ... 1993.

[https://flic.kr/p/nHrFJm](https://flic.kr/p/nHrFJm)

It was on their lot, it just wasn't on display at that time. Probably because there were already eight others ( plus some wrecakge ) on display around the USA... Despite its secrecy it's not a rarity.

Also the serial he states is incorrect, 90-0533 is a USAF C-17A transport; the 90 indicates the Fiscal Year in which the procurement was authorised. That D-21's serial was just a non-standard 533. Like a lot of the A-12 / SR project things weren't always booked and accounted like they should have been.

<comment><USER4> There's also a D-21 out for all to see at Blackbird Air Park in Palmdale (which has plenty of other awesome stuff as well, such as an A-12/SR-71 - don't remember which airframe - wind tunnel model).

</comment></comment><comment><USER5> Is this a similar concept as the cancelled Soviet Lavochkin La-350 ramjet cruise missile design of the 50's, which was based on ideas of a German Dr. Wolf Trommsdorf (who was working for the Russians after the WW2)?

[https://en.wikipedia.org/wiki/Burya](https://en.wikipedia.org/wiki/Burya)

edit: a bit more info (German only, sorry) [http://www.fliegerrevuex.aero/mach-35-interkontinentalflugko...](http://www.fliegerrevuex.aero/mach-35-interkontinentalflugkoerper- der-luftwaffe-1944/)

</comment><comment><USER6> There's a well preserved one mounted on the M-21 at the Museum of Flight in Seattle.

[http://www.museumofflight.org/aircraft/lockheed-d-21b-drone](http://www.museumofflight.org/aircraft/lockheed-d-21b-drone)

It seems the drone had been moved to that back lot at some point. The last time I was at Pima that drone was in a hanger with other unmanned aircraft.</comment>


Estonia is a place for independent minds - <AUTHOR> https://estonia.ee/ <comment><USER2> I think the winning move would be to establish English as the second official language. Hell, the EU should adopt English as the main language. I believe one of the growth factors of many Eastern and Central European countries is the widespread proficiency in it. I was impressed to find many interviews of Estonian politicians speaking it fluently.

(I'm not a native speaker and I've never nor do I currently live in an English speaking country, I just think this is the best and most practical way to start decreasing fragmentation in the EU market).

<comment><USER3> Might be a hard sell to convince the EU to switch to English as the English are leaving.

<comment><USER4> In fact it's an easier sell, isn't it? You're not adopting a language of one of the 4 major members, you're adopting the first language of a small member on the periphery (Ireland) that happens to be a second language of so many Europeans that no other European language comes close.

</comment></comment></comment><comment><USER5> Far and away the best government website I've ever seen.

I've heard of Estonian e-residency before, but have never met anyone who actually took advantage of it. I'd be interested to know people's personal experiences with the program.

<comment><USER6> From what I've read it seems to be geared towards people with an online business who wants access to the EU financial markets.

I'd love to see them consider granting visas for digital nomads. Most people don't know that it's technically illegal to work on a tourist visa (even remotely).

It would be really cool to have a _legal_ way to draw a paycheck from one's home country while exploring the EU.

Estonia would benefit from such an arrangement since your tax residency would be Estonian (and thus you'd pay taxes on the salary you draw to the Estonian government) - all without taking away any jobs from EU citizens, and even creating a few. (Ex: paying for hotels/apts, restaurants, evenings out etc)

<comment><USER7> That would be cool, we could even make our own little neighborhood or something in some city.

</comment></comment></comment><comment><AUTHOR> HN hug of death.

[https://web.archive.org/web/20190416183148/https://estonia.e...](https://web.archive.org/web/20190416183148/https://estonia.ee/)

</comment><comment><USER8> The link is down for me :(

</comment><comment><USER9> [https://e-estonia.com/](https://e-estonia.com/) I like this site even more. With such projects as Reporting 3.0, Healthcare 4.0, Industry 4.0 you can see how the country is run as a startup.

Estonia also has Startup Visa, which helps non-EU founders to start their startup in Estonia ([https://www.startupestonia.ee/visa](https://www.startupestonia.ee/visa)).

</comment><comment><USER10> Independent minds, but not websties that can handle HN...

</comment><comment><USER11> HN effect? Site's not loading for me.

</comment><comment><USER12> Ah yes, Estonia, that great place that have 6% of their population who are stateless citizens based on ethnic politics, which strips those people who lived their entire life there of their EU citizen rights as well.

<comment><USER13> Could you provide some references?

<comment><USER14> Anecdotally, I can say that there is a strong distrust of Russians stemming from the various occupation of Baltic states as recently as 1991. [1]

[1] Source: My wife's estonian grandparents

<comment><USER15> I wouldn't say this is necessarily true in younger generations. I grew up with kids from Russian families in school & kindergarten and the distrust of Russians instilled in you by your parents quickly fades.

Older generations are a bit more problematic in this regard. I would say there's a general hate towards older Russians that still can't speak Estonian, even from younger generations.

However, I would say Russians are generally disadvantaged in Estonia and that's a big source of issues. In my childhood, younger Russians tended to be poorer and therefore were more involved in various criminal activities. Most of my friends and I were afraid of Russians in our area, as they liked to pick fights and generally mess with you.</comment></comment></comment></comment>


How Facebook and Google could disrupt the subscription model for news - <AUTHOR> https://mondaynote.com/how-facebook-and-google-could-disrupt-the-subscription-model-for-news-d94e7aa7fcb6 <comment><USER3> tl;dr -- Surveillance-based dynamic pricing for news articles., i.e. "making the world a worse place."

I don't know anyone who does not loathe booking a flight, and I shudder at the millions of dollars spent by the airlines tweaking ticket prices, by websites wading through that gaming, and by those sites advertising to get clicks. Maybe this is the future of employment[1], but it sounds grim to me.

[1] [http://quotes.liberty- tree.ca/quote/john_maynard_keynes_quot...](http://quotes.liberty- tree.ca/quote/john_maynard_keynes_quote_657c)

<comment><USER4> Mark my words--This is the future of all Retail: Personalized pricing determined by big data's prediction of your ability and willingness to pay. And yes, it will be awful. "Log in to view the price of this item, sucka!"

<comment><USER5> Well, surely, they'll also have a generic guest price.

Those who want to avoid the friction of logging in can pay a little extra (or maybe less sometimes) for the right to do so.

<comment><USER6> ?

I think the incentives behind your assumptions wont match ground reality incentives to firms.

So They wont keep a guest price, they'll keep a bait price.

The rest of the time price discovery and visibility will be governed by their information of your financial state and habits (maybe just habits, if you have credit).

</comment></comment></comment></comment><comment><USER7> I welcome alternative business models. The current trend is destroying quality news organizations and leaving consumers wanting.

Another option is the pay what you want model. This would be a lot easier to implement and would eliminate the possible backlash.

This morning I investigated the WSJ. After the intro period discount expires it's about $400 a year - a lot more than it's worth to me. Instead of getting $100 or even $200 from me they get nothing.

Pay by the article services like Blendle show promise, but they really need to work on the interface.

<comment><USER8> Pay-By-Article is, I believed, feared by publishers and journalists because they see how often the number of clicks and comments diverges from the perceived importance of stories.

Once pay-by-article is the driving force of everything, it will be incredibly hard for these organisations to resist the urge to cheat here and there. Send a writer and a photographer to Tajikistan for two months to report on the election? For the same price, you can get 120 "analysis" pieces on the effect of social media in the presidential election.

Instead, I'd be happy to see "casual" online subscriptions: I believe there's many people like me who read lots of sources at medium depth. There should be a range of the number of monthly article views (anywhere from 30 to 200 I would say) where the publication is important enough for a reader to commit to spending some money, but not important enough to warrant a full subscription.

Ideally, the publishers would band together and create an actual "netflix of news" with such packages for the top-50+ publications worldwide. There must be a huge untapped market of avid news consumers currently underserved by the market.

Why hasn't it happened? I can only guess that the publishers are weary of relinquishing the reader relationship to any middleman. I think we're approaching the point where they'll either have to do it themselves, or these behemoths (google, fb, Apple) will do it for them.

<comment><USER9> This idea is great, provided they get together and support one subscription spanning numerous publications. I'd like to read _some_ of The Economist, Harper's, Vanity Fair, etc but am not interested enough to buy a full subscription.

If they don't do something like this, it might be the end of them. The internet is good in so many ways, but it also causes a lot of problems.

<comment><USER6> Its already the end of them.

The WSJ, venerable and Wall street lauded (as in everyone reads it), got bought by Murdoch's empire.

And Murdoch largely manages to support his empire by selling attention grabbing material.

Its long since over.

Buying individual articles will be another nail in the coffin - the internet has provided competitive advantage to people focusing on hacking click and attention. The best way to do this is to play to the gallery and the human hind brain.

People act more frequently on their emotions than they act on their reason.

\----

Worse - people are already building products and apps that use behavioral/skinnerian reward schemas to keep people engaged. So all the high minded discussion is redundant - the NYT cannot write an article which competes with attention heroin.

<comment><USER10> People do make the conscious decision to consume more wholesome experiences than heroin every day though, even if heroin was in front of them next to their food/drink/work day.

NYT has already carved out a profitable niche selling access to plain old long form journalism, it's one of the few success stories

<comment><USER6> Thats if people know they are imbibing heroin. I dont think half the people on HN itself are aware that most mobile games are designed and sold as differently themed skinner boxes.

What hope do normal people have to even be aware? And That's something ubiquitous and only recently being questioned and condemned by people in the industry.

Awareness of the pitfalls of simple apps is an issue. Forget the really insidious stuff being made by people with the intention to deceive and manipulate.

\</comment></comment></comment></comment></comment></comment><comment>

Holding up NYT as a survivor is telling.

The websites and newspapers that remain today are a small fraction of the Print Media industry which was thriving in 1985.

Holding these few existences as successes, ignores the huge survivorship bias baked into the example.

NYT was already a massive name, and worked very very hard to adapt to the new medium. It was one of the few magazines which attempted - very early on - <USER2> build interesting HTML/multi media articles. They tried making subscriptions work, a move widely derided at the time as a sure shot to failure. (if people forget, once upon a time subscriptions and pay walls were considered sure shots to failure on the web).

The powers and membership of the fourth estate has been vastly eroded, and the ability of people to get past a persons defences, or to build an echo chamber has been significantly enhanced.

The recent American elections were a low throughput event, but it showed how simply tweeting allows someone to significantly take advantage of (a particular) group think.

</comment><comment><USER11> I canceled all my subscriptions. I would happily pay 1 organization good money for subscriptions to the top 6-10 papers. I'm really surprised they haven't tried this yet.

<comment><USER12> Try Blendle[1]. Disclaimer I use their service and like it.

They let you fill your "wallet" with money which doesn't expire, and then they give you access to a bunch of different newspapers on a per-story basis for a variable amount of money per story based on the newspaper. So if you were spending $20/month on a NYT subscription you can put $20/Month into your Blendle account and read the stories of interest on the Times, WSJ, Post, Economist, etc and often have money left over. They have a generous "don't like it and we'll refund your money" which is quick and simple to use (I've used this probably half a dozen times when the article turned out to be just fluff). The articles have no additional advertising, render well on mobile or desktop or tablet. I dropped my NYT and WSJ subscriptions and read them on Blendle, that has cost me significantly less than the combined subscription rates.

[1] [https://blendle.com/](https://blendle.com/)

<comment><USER13> Glad you shared. I found OP frustrating in that the core problem of digital publishing for profit doesn't seem to be the inability to price the content correctly but rather publishers' inability to deliver a product that customers would even pay for.

When a Google News search reveals multiple copies of near identical stories (let's say NYT, a wire service, and a local paper using a wire service), the value proposition to a user of paying for one newspaper is generally low.

Never made sense to me why the Netflix model (that Blendle seems closest to cracking right now) was never applied to accessing good journalism in one place.

</comment></comment></comment><comment><USER14> The TL;DR is that a tech company with enough information about its users could charge them "dynamically" based on what it thinks they would pay for news.

Should books/music/movies/tv cost more to those who can afford to pay more as well?

<comment><USER8> Airlines are notorious for this. One-day return? Business traveller! Hit him! Searching flights on a Saturday afternoon? Private travel – let's discount. High-DPI display? Did someone say "discount"? I meant "this counts" – as a good reason to raise your prices.

</comment></comment><comment><USER15> Until I read this comment section I didn't know Blendle existed. It physically disturbs me. Literally, as in I have this pit in my stomach.

If it takes off, it will kill journalism, at least on the Internet. I don't think I'm exaggerating much. The New York Times, Wall Street Journal, and the like would suddenly have a tremendous pressure to write clickbaity articles at the expense of substantive ones. I presume they would be fact-checked clickbaity articles, but clickbait nonetheless.

This type of business model is all but certainly not fit for traditional news content. What do you think will get to the top, top 10 lists - or more informative but ultimately less widely exciting news stories?

On a side note, L2 did a short Winners & Losers segment about how news companies made huge mistakes in the online world. It's an interesting little watch:

[https://youtu.be/YbolmT6s5Xc](https://youtu.be/YbolmT6s5Xc)

<comment> the-dude > tremendous pressure to write clickbaity articles a

Au contraire : if you don't like the article, Blendle has a very fast and easy way to reclaim your money.

So this will actually encourage better journalism.

<comment><USER15> Users won't do this en masse. They're betting on it.

</comment></comment></comment><comment><USER16> I cannot imagine such a product/feature could exist on the market. This makes Microsoft's anti-trust issues with IE look like a joke in comparison.

</comment><comment><USER17> So if I use a VPN to spoof an IP from a potentially depressed area (say, Detroit), with this system I'll get a 70% discount on my NYT subscription?

<comment><USER4> Presumably at some point you will need to pay, which, if they're smart, is tied to your real identity, so they'll hit you with your real non-Detroit price when you log in.

<comment><USER18> There's a hidden opportunity in there for poor people acting as subscription brokers.

<comment><USER4> Hidden only until the machine learns their pattern.

</comment></comment></comment></comment><comment><USER19> Related conversation from the Facebook co-founder Dustin Moskovitz and early product manager Dave Morin: [https://twitter.com/moskov/status/831631451011452928](https://twitter.com/moskov/status/831631451011452928)

</comment><comment><USER20> I think Google really doesn't want a closed system (like Amazon) for news. It is in their interest to keep the web as open as possible. Therefore, I'm hoping that Google can come up with a good open solution.

</comment><comment><USER21> In a less static market than aviation people wouldn't put up with it. Also it's pure evil.</comment>


Ask HN: Do you actually click "Get Started" on landing pages? - <AUTHOR>

I've been thinking about landing pages lately, and something occurred to me about my own behaviour.
When I'm on a typical product landing page, I instinctively avoid clicking any obvious call to action item, especially something like "Get Started".
Does anyone else do this? Do you often get to a landing page and feel like you can't figure out what to do next, because the idea of clicking "get started" honestly doesn't occur to you? <comment><USER2> Direct quote from patio11: [http://www.kalzumeus.com/2011/12/01/inaugural- kalzumeus-podc...](http://www.kalzumeus.com/2011/12/01/inaugural-kalzumeus- podcast-japan-startups-ab-testing-and-more/)

> _People make fun of me. I've been saying this stuff about A /B testing and > whatnot for years. I make buttons bigger and it almost always works better. > One of the English as a second language folks in one of my forums was > talking one day and he's like, "I know Patrick loves his big, orange, > pancake buttons." Big, orange, pancake button is my keyword for this now > because big, orange, pancake buttons really effing work. Go ahead._

</comment><comment><USER3> To answer your question, for me it really depends on the site and the product/service. I usually will dig around on the site to make sure it is what I am looking for and then click a get started button if I like what I see. As someone else pointed out if the individual viewing the page is your target audience and they are hesitant to click a "get started" button, the page and/or site failed in conveying the value of the product/service.

There is a lot of psychology that goes into the wording of buttons, and while you may tell yourself "oh that would never work for me", the truth is that subconsciously it probably does work and you just don't realize it sometimes.

I have always found these two articles informative (actually the whole CopyHackers site is a pretty good resource in general):

[http://copyhackers.com/2012/11/how-to-find-and-eliminate- fri...](http://copyhackers.com/2012/11/how-to-find-and-eliminate-friction- words-in-your-web-copy/)

[http://copyhackers.com/optimize-your-business-online- trainin...](http://copyhackers.com/optimize-your-business-online- training/calls-to-action/)

<comment><AUTHOR> Actually that copyhackers site raises another good example, of where I start to suspect I must be just weird.

When that little nag element popped up in the bottom corner, I couldn't read the rest of the article. I stopped reading to try to remove it, but I couldn't. It was then really distracting, so I gave up just closed the tab.

Copyhackers _must_ be A/B testing their site to death...So the percentage of people who have a similar reaction must be pretty small.

<comment><USER3> It's interesting you bring that up. I hate those newsletter signup popups that appear on sites. With that said, I can attest that they do actually work and surprisingly really well. My first experience with them I figured people would signup and then unsubscribe fairly quickly. However, the complete opposite ended up happening. We got tons of signup, people stuck around, and shared our content more than ever before. Needless to say, as much as I personally hate them, I will use them on future projects.

</comment></comment></comment><comment><USER4> I wrote about the common "Sign Up" buttons you see in the top-right corner of nearly every SaaS site: [http://www.gkogan.co/blog/stop-asking-me-to-sign- up/](http://www.gkogan.co/blog/stop-asking-me-to-sign-up/)

Every time I test a more prominent and specific button, it wins in terms of clicks or signups. So an indirect answer to your question is: "It usually works."

Does it win in terms of better customers? Not always. Which is why it's important to measure beyond just clicks.

> Does anyone else do this? Do you often get to a landing page and feel like > you can't figure out what to do next, because the idea of clicking "get > started" honestly doesn't occur to you?

If you're the target audience and you're hesitant to click "Get Started," then the landing page failed.

This is why I do usability tests in which I watch participants interact with a page and tell me what confuses them. You won't know those things from quantitative metrics.

</comment><comment><USER5> Does it matter what you think about the buttons? No. It matters what your target audience thinks. A/B test FTW.

</comment><comment><USER6> I almost always want to see a prominent video or screenshots first (or for developer libs/services an examples page). So I'll look for that link before clicking any big buttons.

When I see "Get started" I usually think "sign up" so it's not going to be the first thing I click.

<comment><AUTHOR> This sounds right to me — I feel like you have to sell me before you try to convert me.

But everyone puts the conversion button first...so maybe my intuition about what works for me is wrong. Or maybe I'm just weird.

</comment></comment><comment><USER7> I always want to learn more about whatever it is first, before I dive in. So I'll look at FAQ's, or something to that extent first. I get offended by those which assume I'll sign on before learning what exactly I'm signing up for.

</comment><comment><USER8> Yes, all the time. I feel like as soon as I press the button, I'll turn into a prospective customer from a bystander and a nasty salesperson will start talking to me about all the awesome things about the product. So I recline.

</comment><comment><USER9> Actually, I think that having "Get Started" in any application/Website means that this app/website doesn't have a User friendly interface and failed in explaining its value.

</comment><comment><USER10> Get Started is so nondescript. I usually avoid it.

</comment><comment><USER11> [ ALL OTHER AVENUES ARE EXHUASTED ]

</comment><comment><USER12> I don't click them but many people do. This is easily demonstrated through A/B testing.

Dave Johnson, President of Working Software told me the reason that so many advertisements say "BUY NOW! DON'T DELAY" is "because it works".

      "Ask my mother why she likes advertising." -- Karen Salzman

       "Why do you like advertising?" -- Me

       "It tells me what to buy."

I swear I'm not making this up.

For me, just about the most effective call to action I've ever seen is a developer blog linked from here at HN. At the end of each article it said "Read This Next" then linked another technical article.

I read every article on that guy's site.

I find it helpful that someone notes the "Reading Time" at the top of each of his developer blogs; I plan to add that.

<comment><AUTHOR> Out of interest, was it this: [http://prog21.dadgum.com/](http://prog21.dadgum.com/) ?

Because if so, I had a very similar experience. I also find material that has a lot of interesting in-text self-links will suck me in, ala TV Tropes, Wikipedia, etc.</comment></comment>


How to automate your finances and feel good about money - <AUTHOR> https://medium.com/the-mission/how-to-automate-your-finances-and-feel-good-about-money-538d73c79548 <comment><USER2> My first girlfriend really had her act together financially and got me setup on something like this 15 years ago. I thank her for it to this day, but this looks so much nicer as an app than my hand rolled Excel spreadsheets based on her advice!

<comment><AUTHOR> You should try it out, I'd love to know if it works as well for you as the spreadsheet version you're using!</comment></comment>