How to Validate Demand for Your Product - <AUTHOR> https://www.upupgrow.com/blog/2016/12/20/how-to-validate-demand-for-your-product <comment><USER2> I didn't write my book on how to break into consulting until I validated demand. Here were my step:

1\. Write up a table of contents

2\. Throw up a quick landing page on unbounce. This was the page I used [http://unbouncepages.com/become-a-freelance-software- consult...](http://unbouncepages.com/become-a-freelance-software-consultant/) (but I did a 1month trial of Unbounce premium so I could cname it to codeforcash.zackburt.com)

3\. Bought traffic on Reddit ads (/r/programming) and Facebook (programmers in USA). BTW, two young kids (a college student and a recent graduate) commented on my Facebook ad to bash me. The ad performed better _after_ their comments.

I got email signups from Reddit at $4.50 net Cost Per Lead and from Facebook at $6.50 net Cost Per Lead. I spent a total of $100 buying traffic before I sat down to write the book. Although there was no way that 100% of the emails would convert to sales, (ultimately, about 35%+ of them did so far), it was clear to me that there was a potentially scaleable marketing channel (once I optimized the ads to drive down cost and improved conversion rate on email -> sale). That, and people on HN constantly ask how to break into consulting, so I also intuitively believed in the market.

But these days I am reluctant to dive into anything unless I know there is a repeatable sales process. I qualify potential startups as employers or clients based on this belief – I don't want to waste my time and I don't want them to waste theirs. I've been burned WAY too many times by startups with products or services that haven't been proven to have _economic_ demand. Let people vote with their wallet not their mouth.

<comment><USER3> >But these days I am reluctant to dive into anything unless I know there is a repeatable sales process.

Exactly. If you're incapable of selling the product, it doesn't matter how much demand you think there is; you're still going to end up wasting your time.

Myself and other people in my shared office have started taking this up a level: can you find an affiliate program that involves a not-too-different product?

If so, _can_ you sell it?

The aim isn't to make money from the affiliate program directly, breaking even or running a small loss is fine; the aim is to find out whether it looks like there's a business in there _and_ you yourself are capable of marketing it _and_ you can make sales.

Superb comment BTW, thanks so much for sharing a real-world example!

<comment><USER4> I feel like you're hinting at something I felt myself after failing to find a market for a service I spent a lot of time on. That is; pivoting to selling and marketing products others have created, and away from product creation myself. If in the end it all comes down to marketing and sales, why waste time on the creation part?

I found this realization to be profoundly depressing. I'm curious if others have thought this as well?

<comment><USER5> Affiliate marketing is very different from owning and marketing your own product.

For starters, you have next to no control unless you are a major source of revenue for the merchant. This is a huge risk factor. Just ask everyone who got slaughtered on eBay's program when they decided they wouldn't pay a flat $25 CPA for new sign ups who purchased. Businesses lost major revenue overnight.

You also have lower margins and often can't use similar marketing tactics because in many programs you need to land the last click to get credit. That often rules out display, video, mobile in many cases (if the final sale happens on desktop you won't get credit), etc.

Lastly, you are competing with every other affiliate. So instead of having an affiliate program that serves as a force multiplier for your business, you are competing for table scraps, often for only 10-15% of gross revenue as commission on many programs.

So all of that said, affiliate programs can be great to vet a product space. You might get some small sense of market sizing, pricing, positioning, etc all from reviewing competitor program's terms and details.

</comment></comment></comment></comment><comment><USER6> If you like the post, I recommend you to read Start Small, Stay Small: A Developer's Guide to Launching a Startup[1] by Rob Walling.

> "Start Small, Stay Small also focuses on the single most important element > of a startup that most developers avoid: marketing. There are many great > resources for learning how to write code, organize source control, or > connect to a database. This book does not cover the technical aspects > developers already know or can learn elsewhere. It focuses on finding your > idea, testing it before you build, and getting it into the hands of your > customers."

[1]: [https://www.amazon.com/Start-Small-Stay-Developers- Launching...](https://www.amazon.com/Start-Small-Stay-Developers- Launching/dp/0615373968)

</comment><comment><USER7> Heh.

That article ends with "My online marketing course is launching soon. Buy now and get the early bird discount ($155 saving)"

Like hell it is. He is doing the classic testing of demand. No class exists, but if enough people sign up then he will create one.

<comment><USER8> Nice catch!

</comment></comment><comment><USER9> a thread with 140 points is not really a good gauge for demand

besides the n.1 issue in doing demand validation is "people will say they're interested into something but when asked to put money down very few do it"

crowdfounding is a very good way to get people to put money down, but you need a huge reach for it to be a valid metric.

other than that, it's mostly luck and bullshit.

<comment><USER4> >> a thread with 140 points is not really a good gauge for demand

It's a much stronger signal than 5 threads with zero upvotes!

</comment></comment><comment><USER10> I wish there was more detail about the pain-point-finding process. As is, simply looking for examples of current pain points is very prone to cognitive bias -- if you go looking for a pain point, you'll find one, but how do you quantify the intensity of pain and willingness to change solutions? Maybe more of an overall competition-assessment strategy (rather than a specific pain- point-search) -- if you research the current shortcomings AND high points of current solutions you'll have a much better understanding of the value your product can add.

<comment><USER11> I think you have to talk to as many people as you can about this pain point. They should not be friends or family. They need to be at best acquaintances. You want honest feedback from people who don't care about hurting your feelings, only what they need for their business.

How big of a pain is it? Does your idea solve that for them? How much would they pay for your service over what they use now? Can you make switching cost effective? ....

</comment></comment><comment><USER12> If your product can be crowdfunded on kickstarter/indiegogo I think it is a great exercise to get you to think critically about your product and validate demand.

</comment><comment><USER13> Thanks for sharing. This is really helpful. Has anyone else done this before? If so, I would love to hear other methods.

<comment><USER14> Yes I have used similar methods. In addition to using generic, relevant searches on Google, Reddit, etc., I did competitor searches looking for discussions about them. That helped me figure out which competitors were most popular. Typically people would discuss what they like or dislike about them which helped inform some product decisions. In my case there seemed to be some dissatisfaction with existing solutions and willingness to try new products which suggested there is demand.

</comment></comment><comment><USER15> I let this tab open on my Chrome and it just used 3GB of data, 97% of CPU after some time. Is somebody facing the same?

<comment><AUTHOR> Hey there, author of the post here. If anyone else gets this can you let me know? Wondering if it's the image size on the header..

If you know how to debug let me know as well :)

<comment><USER15> Thanks Mike! So, seems like it increases both disk and cpu use after some time. If the user just read the article and go out I don't think that they saw it occurring.

And thank you for the article. Simple, well written and right on point. Keep it going ;)

</comment></comment></comment><comment><USER16> Gray color fonts on gray color background. It gives too much strain to my eyes and makes text unreadable.

Please check this out : [http://contrastrebellion.com/](http://contrastrebellion.com/)

</comment><comment><USER17> I would invest in a weed ETF. How would you even go about setting that up? Let me know when it's available!

<comment><AUTHOR> Hey, thanks for the feedback! We've got a simple landing page up right now where you can sign up for early access -- cannectcapital.com

I'm trying to build a tool for analyzing cannabis stocks and choosing an investment strategy. But in the meantime I've got a Google Sheet I'm using to track them - [https://docs.google.com/spreadsheets/d/1X2cwnwmzgdRfuy0yiPo6...](https://docs.google.com/spreadsheets/d/1X2cwnwmzgdRfuy0yiPo6v-sOvAYqMXKyGqahBgHSca4/edit#gid=0)

Would love your feedback! And happy to answer any questions about it.

<comment><USER17> Put in my info. I'm doing a little bit of research on setting up an ETF. It seems like there's quite a bit of paperwork and cost involved. How close are you guys?

<comment><USER18> Huge understatement.

[https://www.sec.gov/Archives/edgar/data/1579346/000119312516...](https://www.sec.gov/Archives/edgar/data/1579346/000119312516786685/d302498ds1a.htm)

Among other things, you just need to prepare one of these simple forms and get it approved by the SEC...

A few tens of thousands of people searching doesn't even come close to the level of demand to make such a thing worthwhile.

<comment><USER19> how many would you need to make it worthwhile?

</comment></comment></comment></comment></comment><comment><USER20> Paid traffic from facebook and call to share if liked - one of method to test idea also

</comment><comment><USER21> Nice article! Good breath of fresh air from the fluffy blogs out there.</comment>


XKCD on Docker - <AUTHOR> https://xkcd.com/1988/ <comment><USER2> Ouch. The punchline is funny because in many cases it's painfully true... especially in "enterprise" land.

Don't forget to hover over the comic.

<comment><USER3> On the one hand, yes. On the other hand, I think it's making the point that this isn't necessarily a _bad_ thing, however aesthetically offensive it is.

"Enlightenment" indeed.

<comment><USER4> Exactly, I think the enlightenment in this case is being at peace with the idea that one cannot understand or fully manage everything in a technology stack.

Success does not come from achieving total understanding, but from being able to cleverly pick and choose what to manage and what to leave as a black box based on the problem before you.

</comment></comment></comment><comment><USER5> Because I can install nextcloud in a single cli line. With out it I need about 9 scripts worth of stuff (example of what I wrote to do it) [https://github.com/OhioVR/nextcloud_debian_install_scripts/t...](https://github.com/OhioVR/nextcloud_debian_install_scripts/tree/master/installation%20bash%20scripts)

If you want to learn a whole software stack, building and administration to just TRY a program ONCE I won't stop you. But there are better ways like using docker.

<comment><USER6> I use docker for my build system for this very reason, as my chain depends on a difficult to install Autodesk SDK, which requires a very specific version of Python. I don't expect it to work properly on most modern Linux distributions without virtualenv and other advanced trickery, and there's not even a chance on Windows. With Docker though, once I had the environment set up, unfamiliar newcomers on the three major platforms can then compile and run the project with minimal fuss.

(Of course, in the future I'll be working to remove that odd dependency entirely, but for now, this works.)

It helps that in my particular case, the build _target_ is an embedded platform, so I don't need to worry about native details in the final executable; hiding the environmental details in the container doesn't matter all that much.

<comment><USER7> I'd personally just prepare a small VirtualBox image with everything required to build the code, and release that instead.

</comment></comment></comment><comment><USER8> A mod may want to update the URL from the homepage to a permalink[0]. The next comic update will ruin this post.

[0]: [https://xkcd.com/1988/](https://xkcd.com/1988/)

<comment><USER9> Done. Thanks!

</comment></comment><comment><USER10> Someone needs to talk to Randall Munroe (author of xkcd) and update the explanation for this. [1] I'm not sure if the comic is taking a dig at those who use Docker or at Docker itself or both (in every case, putting together things they don't understand well but claiming to have accomplished "enlightenment").

[1]: [https://www.explainxkcd.com/wiki/index.php/1988](https://www.explainxkcd.com/wiki/index.php/1988)

<comment><USER11> My take is that it's not even really Docker-specific, but Docker users are a convenient example. There are plenty of programmers (Docker-using and otherwise) who just copy-paste code and glue together frameworks without really understanding what they're doing.

<comment><USER12> CS is a magic blackbox and/or a magic cooking book for a lot of people in the industry.

</comment></comment></comment><comment><USER13> I remember when xkcd used to be funny.

<comment><USER14> well good, your short term memory is in tact.</comment></comment>


Are we born to run? - <AUTHOR> http://www.ted.com/talks/christopher_mcdougall_are_we_born_to_run.html

<comment><USER2> McDougall doesn't present nearly as well as he writes. Read the book. Even if you're not a runner, it's enthralling.</comment>


We've dropped our minimum investment To $100 - <AUTHOR> https://wefunder.com/post/39-minimum-investment-now-100

<comment><USER2> love the console message! and congrats!

<comment><AUTHOR> Thanks!</comment></comment>


Ask HN: Studying medicine, would like to move out of the field - <AUTHOR> I am currently a fifth year medical student in Europe, working part time at a lab on cell morphology, teaching biology to high school students and freelancing doing data science in my spare time. My study record so far is great and my supervisors and I have published two papers. Doing research is enjoyable and my current supervisor is willing to strongly recommend me as a candidate for a PhD position. Of course, he would also like me to stay at the current lab.
Lately I have been thinking about alternatives to residency or a PhD program. Even though I could be a doctor, I find research and problem solving more satisfying. Yet a PhD as well as a career in academia does not seem to be financially sustainable in the long-run. Even worse, in my country research's just outright bureaucratic.
Since discovering and creating new things motivates me, I have been considering that a startup could be possible. I see multiple problems in medicine that I feel could be solved and I guess that could be a start? Also, working with R is satisfying and I have been considering about becoming a data scientist.
My question is: what other options could I explore after my master's? Has anyone else shifted out of medicine after finishing medschool? What did you do?
Thanks! <comment><USER2> Have you considered strategic/management consulting in the medical field. I know the big 4 will have specialists focusing on this - possibly related to the healthcare setup in your country - along with niche boutiques. I can't vouch for how much this would just involve powerpoint and Excel modelling bullshit in suits versus R analysis but I imagine data science skills would be extremely valuable. Also health policy if you are interested in the political side of things.

</comment><comment><USER3> How about work in big pharma for 3 years then try to leave a do a startup when you have training, knowledge, some cash and the like?</comment>


Ask HN: Would you use a service like this? - <AUTHOR>

Imagine a service that:
1. Provides you 3 NFC cards for development at no cost
2. Provides an API to those NFC cards via the web at (.02 per request)
3. Provides you with Push notifications to your server via the web (.03 per push)
4. Provides you with a square like device for reading NFC cards using your smartphone (at little, think $15-25 or NO cost) for development & $30 thereafter
5. Gives you $25 in credits for development
For those unfamiliar with NFC, it's cards/tags/stickers (3/4in x 3/4in smallest form factor) that are readable by a rfid reader in ranges less than 8inches.

    --
 Specifically, I'd like to know:
1. What sort of applications you'd build on top of this platform?
2. How do you feel about pricing?
3. Would you use the service based on these points?
4. What other questions would you have?
This is basically a follow up of this: http://news.ycombinator.com/item?id=2541266 <comment><USER2> Check out --

<http://www.touchatag.com/> <http://en.wikipedia.org/wiki/Touchatag>

I got one of their readers for free at a conference. Can do pretty much everything you're describing I believe.</comment>


Obama's NSA speech reflects American apathy - pierre-renaux http://www.bbc.co.uk/news/blogs-echochambers-25787468 <comment><AUTHOR> Not so much apathy but a lack of any way to change things. We get exactly two choices and both suck (in slightly different ways) plus media that tries to play up differences than don't make any difference. No one wants a revolution which these days is generally an exercise in self destruction. So what can you do to create change? The politicians like Obama know this only too well, the system is designed and supported to make real change unlikely or even impossible. For all we will ever know both parties collude to keep the system in place.

<comment><USER2> Guys, guys... stop giving credence to the myth that we have to keep voting for one of the corrupted parties that control the federal government. Yes, you will be stepping forward into a lonely political area, but you can and should vote for one of the other parties that haven't yet proved to be corrupt.

<comment><USER3> It's not a myth. It's mathematics. We have a winner take all voting system ("first past the post") which means a vote (or ten thousand votes) for a third party who doesn't win is exactly the same mathematically as that number of votes going to the major party candidate _least like_ the third party candidate, because that candidate's strongest opponent is the one who would have had those votes in the alternative, and the winner is defined as the candidate with more votes than the candidate than the second most votes. The candidate with the third most votes is totally irrelevant until they cease to be the candidate with the third most votes. And they can't do that, because the incentives don't work -- if a candidate from e.g. the Green party could actually win an election, the Democrats would just run that candidate on their ticket, and likewise with the Libertarians and the Republicans. Because running two viable candidates who agree on 80% of the issues against a candidate from the other major party is friendly fire -- if you have a district with 60% left-leaning voters and you run a viable Green candidate against a Democrat and a Republican, the two left-leaning candidates split the left-leaning vote and give the win to the Republican. Viable would-be third party candidates are well aware of this, which is why there are no viable third party candidates -- they have an overwhelming incentive to join a major party as soon as they achieve viability.

This is _not_ an insurmountable problem, you're just solving it in the wrong place. If you want a "third party" candidate to win then what you need is for that candidate to win a major party's primary. What is necessary is for people to stop voting for parties whatsoever and vote for candidates instead.

<comment><USER4> Third party votes are how we punish major parties. Case in point:

"if a candidate from e.g. the Green party could actually win an election, the Democrats would just run that candidate on their ticket"

If the Democrats are drifting too far to the right (i.e. the situation we have right now), then liberals need to vote third party -- until the Democrats get their act together.

<comment><USER3> Except that it doesn't work. Think about what a Democrat has to do to win if a Green candidate is taking 5% of the vote. The Democrat now has 45% of the vote against a Republican with 50%. If they move to the left to take the Green candidate's voters, the Democrat will stay at 45% and leave 55% to the Republican because moving to the left costs the Democrat votes from the middle. What the Democrats would have to do is move _to the right_ , so that they take 10% from the Republican by losing 10% to the Green and end up winning with 40% Republican, 45% Democrat and 15% Green.

</comment></comment></comment></comment></comment><comment><USER5> We are apathetic, b/c we are tired. It doesn't seem to matter how much we complain or protest anymore, most issues only seem get worse. Fact is, there is almost no accountability to the people any longer. And the powers that be know it. Worse, they have the general population divided so strongly between right and left that it almost seems like a civil war is on the verge of breaking out. Again, the powers that be know it --they actually encourage it so they can use it to do whatever they want. How much longer can we go on this way?

I'm half a mind to say we just end the charade, dissolve the federal government and replace it with a simple joint economic and security treaty between the states.

<comment><USER6> >We are apathetic, b/c we are tired.

No. Americans are apathetic because they are one of the most brainwashed peoples of the planet [1], perhaps after North Koreans. There are exceptions to this and some few Americans are very enlightened indeed.

>They have the general population divided so strongly between right and left that it almost seems like a civil war is on the verge of breaking out.

Yes - divide and rule. Think Iraq, Syria, Egypt, Libya, Nigeria(...). The same sociopaths that run US politics, own the banks, and energy giants have always thrived by creating inner conflicts within exploitable countries [2]. Meanwhile the people fight themselves instead of pushing out the imperialists.

Those that run the USA are clearly preparing for an internal civil war [3]. How it will happen and when - who knows. But i can sure tell you that the amount of US flags behind Obama in his most recent NSA speech was alarming and resembled some Nazi era nationalist/fascist appeal. Scary.

[1] [http://www.dailykos.com/story/2013/01/26/1182220/-Research-S...](http://www.dailykos.com/story/2013/01/26/1182220/-Research- Study-Explains-How-U-S-Media-Brainwashes-The-Public) [2] [http://www.globalresearch.ca/us-imperialism-and-iraqs- descen...](http://www.globalresearch.ca/us-imperialism-and-iraqs-descent-into- civil-war/5364322) [3] [http://www.veteranstoday.com/2012/10/06/homeland- security-pr...](http://www.veteranstoday.com/2012/10/06/homeland-security- preparing-for-massive-civil-war/)

<comment><USER7> You're right. This is indeed an alarming number of flags.

[http://www.slate.com/blogs/browbeat/2014/01/17/obama_nsa_spe...](http://www.slate.com/blogs/browbeat/2014/01/17/obama_nsa_speech_the_unretouched_photos.html)

</comment></comment></comment><comment><USER8> Hang on, 48% support it and 47% are against it, and that represents apathy?

There was an interview on Radio 4 a few days ago (can't find it right now, still looking) where the head of the UK committee which oversees GCHQ tried an interesting approach. He didn't defend GCHQ at all, but said that basically no one in the UK really cared about this issue so we should do nothing. The strategy seems to be to atomize the opposition (it "happens on the internet" therefore it's not real or quantifiable), ie. divide and conquer.

</comment><comment><USER9> And most of all, I can't believe he didn't just burst into endless laughs during his speech. I mean, did he really just say all that while NOT thinking "y'all some stupid mofos"?

Seriously. How can anyone take the US serious anymore.

<comment><USER10> It's not stupidity for everyone, it's just that every recourse outside of violence has been captured or gamed by those truly in power in the US. Plus the media has been captured 99.9999 percent.

And it's not bad enough for the US public to support violence, plus violence would be futile anyway against the military, no matter the number of private firearms. The elite are just waiting for enough automation in society so they can "cull" the masses they consider worthless.

<comment><USER11> _It 's not stupidity for everyone, it's just that every recourse outside of violence has been captured or gamed by those truly in power in the US._

As opposed to their elected officials telling and giving them what they want to hear? Circus and breads are not empty words, you know.

 _Plus the media has been captured 99.9999 percent._

As opposed to the media reflecting what the people want to hear?

</comment></comment></comment><comment><USER12> This "apathy" will bring consequences far worst than the spying itself; before long corporations will be able to trade and black mail using the information collected by NSA.

Call me tinfoil hat or whatever, but corporations always grab as much power as they are allowed (heck! many have been affiliated with paramilitary groups), so it will be just a natural step when american corporations start blackmailing and racketing international politicians in order to force the approval of laws on their behalf.

Plus all the other benefits that a mass surveillance can bring: Learning secrets from the international competition, learning about deals before they happen (some kind of insider trading far worse than anything we have seen so far)

</comment><comment><USER13> Didn't find any link at the site. Here is the speech( I think it is the one the article is referring to): [https://www.youtube.com/watch?v=p4MKm2uFqVQ](https://www.youtube.com/watch?v=p4MKm2uFqVQ)

</comment><comment><USER14> The Europeans care just as much or even less than the Americans. They're being told that there are no privacy protections in place for foreigners, yet, as far as I'm aware, there has been no significant decrease in Facebook or Google traffic.

If the tech giants were genuinely fearing loss of customers or users, Obama's NSA speech would have been drastically different.

</comment><comment><USER15> Speech summary: If you like your privacy, you can keep it.

</comment><comment><USER16> _There 's also the fact that liberals - the ideological faction most likely to protest these programs - have been reluctant to criticise a president from their own party._

That's not true, but not surprising coming from the bbc. The BBC needs to differentiate between leftists and liberals. Leftist regimes throughout history have always been for surveillance.

Surveillance isn't just tapping lines. It's also forced government mandates of the individual that are effective in knowing what you're up to.</comment>


Who Deserves This? (2018) - <AUTHOR> https://freeross.org/who-deserves-this/ <comment><USER2> Just in case any of you are wondering who Ross is ...

He created the Silk Road, a popular online exchange for illegal drugs, and prosecutors alleged that he paid $730K to try to kill six people. (He was not, however, charged with attempted murder. Instead, he was charged and convicted of money laundering and drug offenses.)

[https://en.wikipedia.org/wiki/Ross_Ulbricht](https://en.wikipedia.org/wiki/Ross_Ulbricht)

EDIT: I just want to make completely clear that I didn't post this info in an effort to discredit his essay's argument, which is that the U.S. prison system is in need of drastic reform. I agree wholeheartedly with that. I just wanted to give some context, because I didn't know who he was, and the "Who is Ross?" section of the freeross.org site makes it seem like he's an angelic Boy Scout philanthropist sweetheart.

<comment> cicada-3301 These 7-year-old allegations relied solely on anonymous chats NEVER proven to have been authored by Ulbricht.

It's well known now there were multiple people behind the DPR accounts AND 2 corrupt agents (now in prison) had admin access too.

Never proven, never prosecuted and dismissed "with prejudice" by the govt, meaning they can never be used against him again.

Ross was NOT accused of selling drugs or laundering money, or hacking computers. Charges based on what others listed on SR (i.e, laundering money conspiracy charge = because some users were cashing out their btc for other currencies. Hacking conspiracy = because some users listed hacking tutorials or software.)

Wikiepedia shouldn't be used as a reliable source when it comes to legal cases.

<comment><USER3> Nick Bilton did extensive research for his book American Kingpin and it all supports the theory that Ulbricht was the only DPR.

<comment><USER4> And it's a good read if anyone hasn't read it.

</comment></comment></comment></comment><comment><USER5> I've thought the punishment of Ross was extremely too harsh: life in prison without the possibility of parole. I know the government paints this picture of him as a major drug smuggler, but I think we in the tech world are smarter than that and realize creating a platform is different than selling. After all, are EBay and Amazon liable for all the counterfeit things on their page? Should Bezos go to jail?

I also think the Silk Road story would be a fascinating 2-season, 20 episode series on Netflix. Read the story linked below for a great 2 hour read.

\- [https://www.wired.com/2015/04/silk- road-1/](https://www.wired.com/2015/04/silk-road-1/)

<comment><USER6> If Bezos tried to have six people killed, then yeah, he should be in jail.

<comment> cicada-3301 Except Ross never did. False allegations used to smear him.

<comment><USER7> A document on his computer saying that he paid a supposed hitman and they ran with the cash, and chatlogs of him talking to the hitman, and an "immutable public ledger" with a record of the payment whose time and amount matches up with the note on the laptop are all ridiculous government smears. And there's nothing at all sociopathic about lying to your parents all the way until their bankruptcy in asserting your innocence.

</comment></comment></comment></comment><comment><USER8> > Imagine the worst torture you can think of that doesn't leave the victim > disabled, something you can't deny is cruel: burning, flogging — take your > pick. If the victims themselves would prefer this torture to imprisonment, > the inescapable conclusion is that prison is worse, even more cruel. I, and > every prisoner I have asked, would prefer any amount of pain and cruelty, > for a limited duration, to the years and decades we're forced to spend > here—spirits crushed, hope abandoned, relegated to irrelevance.

People will say they choose all sorts of theoretical punishments that have no chance of happening. In reality, I doubt very many people would actually go through with it if actually given the chance.

<comment><USER9> Philosophically, it's an interesting idea for discussion.

Sentence criminals to a certain amount of pain, and let them choose whether to experience it via decades of low-grade boredom, or hours/minutes/seconds of intense agony.

Personally, in an ideal world that is not this one, I think that prison serves the dual purpose of rehabilitation and removal-from-society, and that the "voluntary torture" approach serves neither end. But in our actual world, prison is only sometimes barely-rehabilitative, and I'm not sure how valuable removal from society is on its own. So... interesting discussion, at least.

<comment><USER10> Philosophically interesting, but I'm not sure it really serves all the purposes prison has. There are four widely recognized ones: retribution, discouragement of crime, protection of society (via isolation of harmful members), and rehabilitation. A short period of intense suffering, even supposing you could inflict an equivalent amount of "pain units", only addresses retribution and discouragement of crime.

<comment><USER8> As for protection of society, I don't think Ross Ulbricht would be a threat to society if he were released now. He is in prison mainly to serve as an example to others. There are probably a lot of other people like him in prison.

As for rehabilitation, I would think that in most cases it could be better accomplished via a community based program. For example, drug rehab works better in drug treatment facilities than in prison.

<comment><USER10> Sure, I'm not speaking specifically of Ross' case, but the general case of prisoners preferring a quick, extreme punishment to a drawn out, mild punishment.

I agree that Ross is not someone who is a serious reoffender risk. OTOH, justice professionals might feel differently based on his lack of contrition (this typically counts against convicts at sentencing, partly because there's a view that it says something about recidivism risk). [https://fortune.com/2015/06/01/why-a-judge-threw-the-book- at...](https://fortune.com/2015/06/01/why-a-judge-threw-the-book-at-silk- roads-founder/)

</comment></comment></comment></comment></comment><comment><USER11> The ever-interesting thing about Ulbricht – every thread devolves into a discussion on whether he "paid someone to murder someone else".

Every stitch of evidence says he did. Defenders will make two claims: 1. he was never charged – despite the fact the schemes were absolutely a part of the conspiracy charges he was convicted of or 2. the evidence was planted!

The first fact being provably untrue and the second being impossible to disprove.

Prison is a dark, and horrendous existence. I wouldn't wish it on anyone. I would spend a lifetime avoiding it. I believe in rehabilitation and remorse. I don't believe in "throwing away" people who make mistakes.

But once you've decided that the death of one person is worth less than the "value" of your business, a business specifically designed to thwart obvious laws for your own profit, I have a hard time finding sympathy for you, beyond the basic sympathy I'd extend anyone who is being forced to live with the consequences of their actions.

</comment><comment><USER12> I agree the punishment is to harsh for drug smuggling, but if he did attempt to murder six people, then it's not. He should have his day in court for attempted murder.

<comment><USER13> He had his day and the charge was dismissed and can never be brought back. In the US at least this is a done deal as far as the justice system is concerned.

</comment></comment><comment><USER14> My "favorite" thing about the case was how the feds found him buying a fake id in a "random" customs check. I'll bet you there was some parallel construction going on.

FWIW I have a hard time having sympathy for a drug kingpin hacker doing hard time. Mess with the best, die like the rest.

</comment><comment><USER15> > I don't claim that we don't need to keep some people separated from free > society.

Like people who contract the murders of other other people, in order to keep their criminal empire, with zero remorse or appreciation what they have done? Exactly.

<comment><USER16> He wasn't convicted of that, so...

<comment><USER17> Nor even charged

</comment></comment></comment><comment><USER18> Reading this, it sounds like he is not pleading not guilty, but rather saying whatever has been done but blah blah I don't deserve this. Reading into his thought process feels very dark, I may be reading too much here but there almost seems to be some subtle undertones of vengeance and encouraging (maybe his past friends) to help seek revenge to what happened to him.</comment>


Sublime Text's Plugin API: It's Python, Sort Of - <AUTHOR> https://news.floobits.com/2015/08/17/sublime-text-plugin-api-its-python-sort-of/

<comment><USER2> This is another reason for Jon to release ST as an open source project. The editor is extremely polished at this point, and now only new features and niche issues like Python modules should be added to the core codebase. I imagine that since ST is no longer growing as it was years ago, the future money flow is relatively insignificant.

Atom may have more momentum and plugins than Sublime right now, but since the core is built upon Chromium rather than Jon's custom beautiful and latency- free cross platform UI framework, it will never suit everyone's needs of performance and responsiveness. The world needs a good native, fast editor with a focus on mouse pointer editing, but only gvim is a viable (and bloated) contender.

Donations for software like this works fantastically, as I know from experience, and the increased momentum of an open source release would increase the number of commercial users willing to ethically support the project. However, if it remains proprietary, ST is still a respectable editor I will be using for the next decade.

<comment><USER3> I've been using both Atom and Sublime Text 3 "in anger" over the last two months. As good as Atom has become now that it has reached 1.x, I find that the editor I turn to is Sublime. It just works.

      subl .  and poof, it's up in a directory

      atom .  7 or 8 seconds later it's partly up...

I bought ST2 some time ago, and I'd buy ST3 if he pulled the trigger and moved it out of beta... But not if it truly is abandon-ware. I'm willing to pay for quality commercial software, and Sublime Text 3 is high-quality. But I want to know that the project hasn't been walked away from.

<comment><USER4> ST3 is still being developed, if slowly. If you use it, I'd encourage you to buy it.

<comment><USER3> As I stated, I've already purchased a license.

A license for ST2 is also a license for ST3 beta. He's stated that when ST3 is out of beta, it'll require a new license which I'll likely purchase.

There isn't anything else to buy right now except what I already have.

[https://www.sublimetext.com/buy](https://www.sublimetext.com/buy)

</comment></comment></comment></comment><comment><USER5> Glyph Lefkowitz warned about the dangers of embedding Python a long time ago:

[https://twistedmatrix.com/users/glyph/rant/extendit.html](https://twistedmatrix.com/users/glyph/rant/extendit.html)

See also this comment of his on Advogato, which he indirectly referenced in the previous article:

[http://advogato.org/article/550.html#12](http://advogato.org/article/550.html#12)

<comment><USER6> Interesting articles, though I'm not sure the critique applies here. It seems rather, ST2 ships with a separate and incomplete python environment. I don't think it 'embeds' python, does it?

<comment><USER7> Yes, Sublime Text embeds Python. The Python interpreter is initialized by the Sublime Text binary.

The issues that Floobits ran into were some of the edge-cases related to distributing a compiled version of Python to various operating systems. I wrote a top-level comment on this page about how Package Control patches these issues.

<comment><USER6> Package control is usually one of the first three things I show to people new to Sublime. It's the best damn plugin system I've ever seen. Thank you for your work, Sir!

<comment><USER8> Curious, what are the other two things? :-)

I pretty much don't consider any installation of Sublime on a new machine as "complete" until it also has Package Control.

<comment><USER6> One is almost always multi-cursors (together with regex search).

The other depends on the person. Usually one of [CMD-O + select directory, CMD-R, CMD-T]

</comment></comment></comment></comment></comment></comment><comment><USER9> Note that this is mostly an issue for Sublime Text 2. Sublime Text 3, which is in beta, has a much more consistent Python 3 embed.

Unfortunately, ST3 is in one of those death-march betas that have been ongoing for years, fragmenting the plugin space. If you write a plugin for ST, you either need to write Python that simultaneously targets Python 2 and Python 3 (possible, but restrictive), or you need to maintain two versions of your plugin.

<comment><USER7> As of earlier in the year, over 80% of Package Control users were on ST3. ST2 usage seems to be waning pretty significantly. It will be nice once package developers can use all of the goodies in Python 3 and not worry about the ancient Python 2.6.

</comment></comment><comment><USER10> So... shipped multiplatform code without testing it on Windows and Linux?

<comment><AUTHOR> We haven't had cross-platform issues with Atom, Neovim, Emacs, or IntelliJ. Sublime Text is the only editor we've had to build these workarounds for.

<comment><USER11> This whole story seems like pretty poor form. You based your business, in part, on a closed-source product, failed to test your multi-platform product on... any of the other platforms you planned on releasing it for, and then wrote up a lengthy blog post blaming the author of same closed-source product for failing to address your pet issue, as if your business being dependent upon it being fixed should somehow be his concern.

</comment></comment></comment><comment><USER12> Wait. Who in the hell releases something on multiple platforms without testing those platforms a single time?! O_o Multiple platform support has always, ALWAYS, required additional work on every project I've ever worked on. Often significant amounts.

<comment><AUTHOR> When developing a Chrome extension or Firefox add-on or Greasemonkey script, do you test it on Windows, OS X, and Linux?

Sublime Text is the only editor we've had to build platform-specific workarounds for. Atom, Emacs, Neovim, IntelliJ and ilk (PyCharm, WebStorm, etc)... none of them have these sorts of bugs. (They have other bugs, but they're consistent across platforms.) Comments such as, "You didn't test it on every platform?!" are succumbing to hindsight bias.

<comment><USER13> But you said you were hooking into the OS python modules...

<comment><AUTHOR> Originally, our plugin just used the Python bundled with Sublime Text. Only after discovering these bugs did we add work-arounds that used the system Python.

</comment></comment></comment></comment><comment><USER7> Package Control has patched these two module issues for a while, but I figured I'd give some details for those that are interested:

Sublime Text 2 on Windows has an error when importing select. It isn't that Jon didn't include select, but rather there seems to be an issue importing the select.pyd from the folder that sublime_text.exe is located in, with Python 2.6. In fact, Python 2.6 on Windows has all sorts of issues that Jon burned a lot of time trying to work around. For instance, Python 2.6 can't add sys.path entries for folders with non-ascii characters. This led to a hacky work-around where Sublime Text chdirs into each package folder and loads the Python from ".\". Package Control solves the select import by shipping the select.pyd files, but placing them in a package folder and then adding that folder to sys.path.

For Linux, Python creates a _ssl.so shared library shim that links with the system's version of OpenSSL. The downside is that different distros have different versions of OpenSSL - 0.9.x and 1.x.x. This is further compounded by the fact that Fedora has their own specially numbered version of libssl (libssl-10 instead of libssl-1.0.0). So, by distributing a compiled version of Python, there isn't a way to ship the _ssl module for Python that will actually consistently work. Jon seems to have decided to focus his energy on other issues. Package Control patches this issue also. Actually, my SFTP package was the first to patch the issue, but I spent the time to make in generally available to all packages with Package Control 3.0.

So there are two options to deal with _ssl. Jon could try to ship OpenSSL with Sublime Text, thus entering the world of being responsible for patching OpenSSL, and dealing with dynamic linking issues and all that jazz. It gets kind of gross dealing with rpath and all kinds of other work to get the shared lib to look in the current folder first rather than loading the, possibly incorrect, system version of libssl. I've gone down that path before with a project and it was not a fun time. On a side note, Sublime Text on Windows unfortunately does ship OpenSSL, so the version available to Sublime Text plugins can be out-of-date. I've been working on a cross-platform crypto library for Python that uses the OS crypto facilities, which could be a solution for this in the future.

The other option is to rely on the system version of OpenSSL, but provide _ssl.so shims for each of the different major versions of OpenSSL for each architecture. Then ssl.py would have to be patched to try each of the shims until one of them loaded properly. The upside here is that the distro is responsible for updates to OpenSSL. This general approach is what Package Control does, however I don't patch ssl.py. Instead Package Control adds a custom package that is listed alphabetically first, and thus loaded by Sublime Text first. This custom package tries importing each of the shims until it finds one that works with the version of OpenSSL on the system. If you are morbidly curious, you can see the code and shims at [https://github.com/codexns/sublime-ssl- linux](https://github.com/codexns/sublime-ssl-linux).

The end result of all of this is that for the majority of ST users, these issues are likely solved. Package Control 3.0 automatically installs these fixes, and provides mechanisms for package developers to share other compiled Python modules. Older versions of Package Control have been EOLed, and thus it is possible for package developers to rely on users having these patches in place.

<comment><USER14> Thanks a lot for this enlightening comment and for your fantastic work on Package Control. Without your work Sublime would be half as great, I feel.

I encourage everyone who paid for Sublime, a fantastic piece of software that certainly deserves it, to also donate to Package Control.

</comment></comment><comment><USER15> They developed and tested their software on Macs. Yet they offered it to Windows and Linux customers without ever doing any testing on those platforms? Isn't that like saying my React app works on IE-11 so I'm sure it must work on IE-6?

<comment><USER16> I mean, in the sense that technically when you publish anything on GitHub/npm/PyPI/RubyGems/etc. you're "offering" it to Windows and Linux users – sure. Given that the editor plugin is not a standalone software product being sold, it seems perfectly reasonable to just put it out there and then let people report issues on their platform.

</comment></comment><comment><USER17> So this relies on having a system version of python but there's no mention of that requirement anywhere in the repo...

<comment><USER4> I believe only ST 2 on OS X relies on the system python - 2.6 or whatever python happens to be in the path. Sublime 3 ships with python 3.3 on all platforms.

edit:

If you are asking about the Floobits plugin, ST 2 on OS X shells out to the system python (because of SSL).

<comment><USER18> > _Sublime 3 ships with python 3.3 on all platforms._

So does that fix that issue he says in the end is "still open", about select etc not being present on some platforms?

(I don't have Windows or GUI Linux available to check).

<comment><AUTHOR> Importing select works in Sublime Text 3 on Windows. Unfortunately, many people still use ST2, since it's the default download on the Sublime Text website. It would make my life much easier if ST3 came out of beta.

<comment><USER18> Surely if they are devs they know they're not bound to the "default download".

I've been using ST3 dev builds for what, 2 years now? Rock solid all this time on OS X (with around 10 plugins). Only had one issue (high cpu load on search IIRC), that was corrected by going back to the ST3 beta for the 2-3 days it took for it to be fixed.

<comment><AUTHOR> I'm in the same boat. I use ST3 as my primary editor and it's been quite stable.

The ST2 users are part of a significant chunk of developers who just use defaults. They use the default shell, default themes, default mail/calendar/IM client, etc. They don't toolsmith. Their motto is, "If it ain't broke, don't fix it."

Considering the annoyance of dealing with unstable software, I can't blame them... much.

</comment></comment></comment></comment></comment></comment><comment><USER19> I'm on Sublime Text 3 Build 3095, on Linux (Debian unstable) and import ssl works for me. Maybe it was fixed in a recent-ish version?</comment>


Why the Update Fever Is Bad - <AUTHOR> http://www.irrlicht3d.org/pivot/entry.php?id=1562 <comment><USER2> Software updates are a kind of project heartbeat. The content of them is less important than the signal, "this project is still alive, and maintainers are fixing issues for people". If a project does not put out updates, then users may (understandably) worry that if they have an issue, it won't get addressed promptly.

I actually don't think there is anything wrong with having time-based releases, and putting very little content in some of them. If you only fix one bug in a quarterly/bi-annual release and tweak some docs, because that's all that's needed, you have still fixed an issue for somebody, and demonstrated to all of your other users that you are still keeping your commitments, and there for them if they need you.

<comment><USER3> But on the other hand, if the software is stable and no longer needs updating why force small inconsequential changes just to appear to be maintained?

Just release when there's something to release.

<comment><USER4> There is no software without bugs.

People seem to know that. Developers sometimes do not.

<comment><USER5> There are projects that are close to bugfree, though. You can use a 3 year old version of sqlite without any difficulty. I don't know what version of "ls" or "mkdir" my machine runs, but I never worry about these simple utilities being out of date or behaving differently in release/staging. These utilities are essentially done, and 30 years from now they'll still work fine.

There is no software without bugs in the same sense that there exists no hardware that cannot fail. But you can create software that is so close to perfect that hardware failures outnumber software failures 100:1, so there is no point in pursuing perfection any further.

<comment><USER6> SQLite is not typical software. It has over 90 million lines of test code, and is run in production every day by pretty much every computer in the world.

mkdir(1) is also not typical. Excluding the copyright header comment, it's so short that it fits entirely on one screen. If I ran into a bug, I could probably find it and fix it (or write my own version) in about 3 minutes.

It is indeed possible to "create software that is so close to perfect that hardware failures outnumber software failures 100:1", but it's so time- consuming that almost nobody ever does it.

Version 1.0.1 of a free mind-mapping app may be good and useful software, but I can virtually guarantee it has bugs. I doubt even the author would claim it's only at 1.0.1 because "there is no point in pursuing perfection any further".

<comment><USER7> > mkdir(1) [...] it's so short that it fits entirely on one screen.

296 lines in the main .c file, without counting the headers and helper functions: [https://git.savannah.gnu.org/cgit/coreutils.git/tree/src/mkd...](https://git.savannah.gnu.org/cgit/coreutils.git/tree/src/mkdir.c)

<comment><USER8> And, entertainingly, it contains a FIXME! [https://git.savannah.gnu.org/cgit/coreutils.git/tree/src/mkd...](https://git.savannah.gnu.org/cgit/coreutils.git/tree/src/mkdir.c#n256)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Glad to see this being written.

"Trained" is the word I have thought of many times as well. It is perplexing to see people wanting updates.

It is possible to write finished programs that are bug-free[FN1]. But when eternal rounds of patching becomes a religion, what sort of standard are developers promoting? Every program is expected to have security holes that will need to be patched? What about not releasing software unless it is safe to begin with? Why does a liability need to be created? Solve the problems before the software is released. Not after. Can't solve them? Then do not release.

Automatic updates are also a security hazard in the same way as "antivirus", which also trained users to want updates. It is a backdoor that users are advised to leave open.

FN1. Inevitably there will be the HN commenter who repeats some meme that says all software has bugs. True perhaps if we forget about Ada and the world outside of MS Windows, but are all the bugs major ones? Consider the stuff you find at [http://cr.yp.to](http://cr.yp.to). Or many of the small UNIX utilities. I could name more selected examples. There is such a thing as finished software. With no _major_ bugs. That does not need constant updates.

<comment><USER10> > There is such a thing as finished software. With no major bugs. That does > not need constant updates.

The general attitude (both on HN and elsewhere) is that if _any_ security update exists for a product you use then you are a complete moron not to update it immediately. There is virtually no acknowledgment of any nuance on the topic in my experience.

<comment><USER11> I think this is what people officially say, because this is the "right" thing to do, and in general it makes sense. But in real life things are different. I had to support many ancient systems with no security updates for years or even decades now. For some of them some updates were available, but we didn't even have the hardware to test them on. Yes, we were gradually moving many older parts to newer systems. Nevertheless, in the case of these older machines working in isolated networks, trying to patch them was just asking for trouble. I bet many admins on HN have similar experience.

<comment><USER12> In other words, people are "virtue signaling"...

</comment></comment></comment></comment><comment><USER13> People expect their software to improve over time, and thus receive updates, and this is perfectly reasonable. Most software is never "done". If it is a small module written in a highly mature language and operating in a stable, slow moving ecosystem, then fine. In those cases, simply document that updates will be few and far between and that this is expected for the above reasons.

More likely, development simply slows down because the maintainer got lazy, moved on to other interests, or doesn't have time for other reasons. Users don't like this and they are right to worry that the maintainer may be unresponsive or that the software will not be quickly patched in the event of a security vulnerability being discovered because the software is not actively maintained.

Your software is not complete. It is merely functional. In fact, it may not even be functional, as the rest of the world moves on without you and your code rots away.

<comment><USER14> Counterpoint: I've written a lot of niche utilities over the years. Some of them are very simple, and some of them are very complex. They're specialized enough that in most cases, they are the only software that performs a specific type of work.

To my knowledge, they all still do _exactly_ what I made them to do. Are there things I would like to add to some of them if I had unlimited time? Yes. Does _not_ having time to do that mean that they've stopped doing what they were designed to do? No.

The only time I can see an argument for frequent updates being _required_ (as opposed to a bonus) is for software with direct dependencies on other things. youtube-dl, for example, or the NTDS.dit-extracting functionality in Impacket are good examples of this - they work directly with content that may change at any time, so someone needs to make sure they're compatible with the current versions of that content.

</comment></comment><comment><USER15> I stopped letting my iPhone update. I swear every update makes it slower and buggier. My old iPad which was perfectly fast and great at the time is now almost unusable after 4 iOS upgrades. It won't even play Sudoko without constant mini freezes.

<comment><USER16> People would rather use a functional but insecure tool than a broken secure one. No question. It's hard for devs to understand that for some reason.

<comment><USER17> My iOS device is noticeably laggier too, and I find it difficult to point the finger at security fixes. More likely the bloat from a load of features that nobody asked for.

</comment></comment></comment><comment><USER18> I guess if your software is stable and 'finished' enough not to be updated often then it would be good if you have an established communication channel (like a website or a GitHub page) that will periodically come out with, well, 'news updates', since it _is_ true that most users are conditioned to expect some kind of update/activity surrounding their software.

Besides any moderately complex software will probably have enough bugs to require updates now & then for years, even if no new features or added. Not only bugs but often the underlying platform changes/breaks, needing workarounds or rebuilds.

</comment><comment><USER19> This is something I see with Common Lisp libraries a lot. Many of them look abandoned, because they've had no updates in years. But they're really not: they each aimed to do one thing, they each do it well, and they don't have any more (notable) bugs. The Lisp spec doesn't change, so if a library's functional spec doesn't change … it's complete.

E.g. [https://github.com/dardoria/uuid](https://github.com/dardoria/uuid) a library to generate UUIDs: once it fulfills the spec properly, it's essentially done. This particular example _could_ contain a bug, of course, but the principle stands.

<comment><USER20> It does not even have a readme. What kind of definition of done is this?

</comment></comment><comment><USER21> I gave up on Windows about 10 years ago. I've had to use it for work sometimes, but the Windows Updates are actually destructive sometimes, and often take hours to install during business hours (especially if you happen to need to reboot before an important meeting...). I can't handle uncertainty in Software, and I think that many business are losing productivity because of this. Or maybe IT support departments are happy to keep themselves employed.

<comment><USER12> Sadly the Linux ecosystem (baring the kernel and the GNU supplied coreutils) do not seem to do any better. And from what gather, Apple is notorious for breaking things as they see fit as well. Not sure how well the BSDs do in this regard.

<comment><USER21> I am a Debian sid user, so I know well what you mean, but as long as you don't do a kernel upgrade, Linux has been extremely stable for me. This wasn't always the case. 10 years ago, Debian sid would break all the time, but I have probably had only one or two non-kernel/driver related issues in the past 5 years.

Another subtle difference is that on Linux platforms, you have more control over when/how to update, as well as visibility into exactly what is updating. I'm sure it's visible on other platforms, but I don't have to worry about rebooting my machine and having to wait 2 hours for it to come up.

Perhaps another point worth mentioning, LTS versions of Linux distros (Debian stable, or Ubuntu LTS versions) mainly get security patches, and, optionally, back ported software. That makes your OS stack super stable!

I'd put kernel upgrades into a different bucket... but most _users_ don't need to update their kernel on a daily or even yearly basis except for security patches.

Great point about coreutils too! No need to update ls and grep...

</comment></comment></comment><comment><USER22> This doesn't say much about why it's bad. Colin Percival wrote a more detailed piece on updates, their problems and considerations here: [http://www.daemonology.net/blog/2017-06-14-oil-changes- safet...](http://www.daemonology.net/blog/2017-06-14-oil-changes-safety- recalls-software-patches.html) and suggests separate channels for 'updates' vs. 'security fixes'.

 _This is something new for Microsoft: Usually they won 't break their own old software with updates, they are known for keeping up backwards compatibility at all costs._

It really isn't. Thirteen years ago: [https://www.joelonsoftware.com/2004/06/13/how-microsoft- lost...](https://www.joelonsoftware.com/2004/06/13/how-microsoft-lost-the-api- war/)

 _If you ask the users about it, they don 't even know why they want these updates. Is there a feature they are missing?_

New things are fun. Maybe there'll be a feature I don't know I'm missing until I see it. I'm hankering for you to amaze me and fix all my problems. Be my Holy Grail of (text editing, browsing, productivity, databasing, developing, life ...).

<comment><USER12> New things are fun when you are young. As you grow older you learn to appreciate stable reliable behavior.

</comment></comment><comment><USER23> With such a huge spectrum of kind of software, what applies in one kind won't necessarily be so for another.

The heartbeat argument is an obvious case. It's the same reason people look at the UI "chrome" in the screenshots in Android Play Store - if the battery indicator is from Eclair it doesn't built confidence it'll work in Nougat!

But that may apply less to a more minimalist utility (eg a command line tool)

Merely to update it so that you formally confirm that this version was tested on newer systems may be valid in some cases (although one could merely update documentation in many cases for that).

And then there is the dependency argument. Where a tool directly contains underlying packages, it builds confidence the developer won't get stuck too far behind current(ish) versions (with the greater risk of it becoming abandonware). Where the dependencies are external (ie up to the user to have installed) you do not want to be stuck on some old version, as other tools may move on, even if this super-stable software doesn't feel the need.

</comment><comment><USER24> I agree with this to a certain extent. If more care had been put into the software to start with then they should need frequent updating. And often bugs can be introduced with an update of a dependency for example, because you cannot be sure that all your dependencies are preserving backwards compatibility. Usually it goes something like this, inconsequential dependency has a security vulnerability that needs updated, that requires two other dependencies to be updated, the third one is pretty hacky and has a latent bug. Software is updated, but over the next month three more hotfixes are needed to address the bugs by the bad dependency. Thus the software lifecycle continues on. Btw, I thought this article related to this was really interesting: [https://www.siliconrepublic.com/innovation/darpa-working- on-...](https://www.siliconrepublic.com/innovation/darpa-working-on-software- that-doesnt-need-updates-for-100-years)

</comment><comment><USER25> Show them somehow it is still supported, update the minor version or something.

In general:

If I come across a 3 year old binary, and no news article about dev activity it looks "dead and unsupported". Also on GitHub, if there is no commit for 1+ year, it looks "dead and unsupported", piling up of Github issues is also a bad sign. Using "dead" binary asks for troubles down roads, when you want to use it in a few months and it stopped working.

<comment><USER26> Binaries (without external runtime dependencies) generally don't just "stop working" like that unless you change something significant about your system.

<comment><USER25> Ideally yes, but the world changed. There are a constant stream of updates for your OS, graphic card driver, etc which constantly break things left and right. If it affects a big software, even an outdated version) the user outcry will make sure it get fixed. But you better make sure not to rely on an unsupported 3 year old rather niche software if you plan to upgrade anytime soon.

</comment></comment></comment><comment><USER27> If a software is under active development, one would at least occasionally expect updates with new features and enhancements. Even if it is just in maintenance mode, there would be bug and security fixes. Not every week, but at least every couple of months. With software like iOS apps, it is a huge warning sign, if apps are not updated after OS updates or especially after new devices introduce new screen sizes. And with iOS, those apps are eventually going to stop working.

</comment><comment><USER28> It's not like we always have the choice not to upgrade, either because of security (IoT anyone?), because one of the giant's shoulder a software has been built on has gone wild or has its own security fix to deploy ([https://github.com/blog/2470-introducing-security-alerts- on-...](https://github.com/blog/2470-introducing-security-alerts-on-github)), or just because updates are automatically installed and it's too late when you realize it's broken :-/

Edit: Android devices does not suffer from this fever, btw. How good. Really. [https://danluu.com/android-updates/](https://danluu.com/android-updates/)

</comment><comment><USER29> >>> Is there a feature they are missing? A specific bug they want to have fixed? They don't know. They only want updates, because they are used to it.

A long, long time ago DJGPP 2.0 was released, and almost immediately people were asking when version 3.0 was coming out.

It was a DOS port of the GNU C compiler, so really you can't make a new version of it until the next GCC comes out. Plus, the question was, "What would the update have?"

It's not like commercial software where you need to add features every quarter so your competition doesn't leave you in the dust.

</comment><comment><USER30> > So for non-security critical software, it is sometimes better not to update > that often. This update fever is bad both for developers and users.

What software is non-security critical anymore?

<comment><USER10> > What software is non-security critical anymore?

LaTeX, MATLAB, CMake...

<comment><USER31> Terrible examples, considering that these are programming languages that people will use to run code from random sources.

"git clone foo && cmake foo" can definitely be a security problem, and not just because the code itself is untrusted.

<comment><USER32> It's not cmake's job to limit the behaviour of programs written with it.

<comment><USER33> OTOH, allocating & using memory correctly so that a maliciously-crafted Makefile can't get elevated permissions _is_.

<comment><USER34> A makefile can call whatever it wants so if you run a malicious one you're already hacked. There's nothing you can do with a cmake buffer overrun that you can't also do just by writing a normal cmake file to call out whichever malicious commands you want.

</comment></comment></comment></comment></comment></comment><comment><USER35> A lot of commenters have keyed into the product heartbeat line. Shipping updates is one common signals of a healthy product but it's not the only one. If your product has non-user-facing changes, you should try to make noise about what other people are actively building or doing with your product. Or if you're offering a service, market reliability and put time into showing stability and educating customers on why they should trust that they can build with you. You should also be working on acquiring customers if your product is in that phase. Realistically you're talking about a product that requires little to no maintenance for existing customers which should free you up to spend time getting more customers.

Any of the above is going to realistically create feature work as you work with new customers or users and find further areas for completing your product offering.

Word of caution — this work will never realistically end, or you will end. There is no end state to software. Software is the tool, the product is your user or customer community and the problems you solve together. If you're looking to build software as an end state, I see obvious problems, and your customers do too.

</comment><comment><USER36> BTW Irrlicht is great so thank you to the author for making it. CobberCube looks good too. But that is one reason someone might not update a project a lot -- they are making other stuff, for example one along the same lines that could make money. But Irrlicht works great still and still has a forum etc. so I would not complain if there weren't more updates.

Actually I wouldn't really want another update at this point, because I already have a code base built on the existing thing that does what I want and adapting to new/changed stuff would distract from developing features specific to my system.

</comment><comment><USER37> I don't know if it's just me, but I have to exert significant energy to convince (typically) new hires, that it does not really hurt anything if we use older versions of some dependencies, as long as they are stable and we are not hitting any bugs or vulnerabilities. In other words: it is not reason enough and not worth to update only because a new version was just released.

Such discussions usually end in one final argument from the new developer: "But your version is no longer maintained!"

</comment><comment><USER38> Interesting debate, updates as a product viability signal.

I can see the angle as a developer that there isn't anything new this week/month/quarter in the software. And I can see the user angle that if it hasn't been updated perhaps updates are no longer available.

That makes me wonder if an update that says the software continues to be in good shape (a non-update update) would assuage the user. Something like that could be automated and so not impact the developer.

</comment><comment><USER39> > Is there a feature they are missing? A specific bug they want to have fixed? > They don't know. They only want updates, because they are used to it.

That doesn't sound like the most charitable reading. A lot of customers expect updates to mean performance improvements or security fixes, neither of which they'd be able to ask for with any kind of specifics.

</comment><comment><USER40> Tail wagging the dog.

If it needs a fix, update it.

If you want to increase awareness, add a feature.

If people are paying a software support fee or have a contract stating a certain number of releases a year then do releases.

Otherwise why risk introducing new problems

</comment><comment><USER41> I wouldn't call myself very experienced, but software is really brittle and everything is built on top of something else, so an update triggers an update triggers an update..

<comment><USER42> But there are other ways to build software. You can make apps with very few dependencies, use stable APIs only, program defensively, make sure you properly read the docs and handle all error conditions, don't add unnecessary features, etc.

The result can be an app that requires minimal maintenance and it might work for years without any changes at all.

<comment><USER12> But doing so takes focus and diligence, something the software world is notoriously short on (likely they can always push another fix to prod, unlike with hardware).

<comment><USER17> And it wasn't always like that with software. We're used to the current situation in the age of portable devices and app stores, but I remember buying software in the 80s and 90s when most people didn't have a modem or any networking connectivity on their home machines. You went to a store, and bought software on disk or CD that came in a cardboard box shrinkwrapped in cellophane. You tried out the features, and it either worked or it didn't. And if it didn't, you were stuck - but that generally didn't happen, to my memory. Because of the lack of options when the product was on the shelves, it was tested rigorously. (Of course it would be fair to say that it would be a siloed runnable that wouldn't generally have dependencies or be required to interoperate with anything else, but the feature density would be comparable).

There was none of this "fix it in tomorrow's release" from the "just ship it duuuudes", so you didn't find obvious defects in features within minutes.

</comment></comment></comment></comment><comment><USER43> Do fake update at semi-random time. Visualize it, eg. show them a dialog with progress bar and percentage.

<comment><USER44> Thus wasting other people's time and productivity?

I'm using the Atom editor. It's kind of annoying how it pushes new updates every week. Previously used Subline Text 2 which just worked and did not have an update for years.

<comment><USER45> Sublime is a great example of users getting update fever. The forum is riddled with long "is this software dead?" threads that pop up at regular intervals.

<comment><USER46> Eventually it will be, if they stop updating it. Atom and visual studio code are overtaking it.

</comment></comment></comment></comment><comment><USER47> Excellent, well put!

</comment><comment><USER48> maybe nullupdates should be a thing.

<comment><USER49> For anyone thinking about doing this, here are some free release note templates:

"Bug fixes and stability improvements"

"Thank you for using <X>! For your benefit, we update <X> continuously. Every updates for <X> potentially includes new features, bug fixes and other improvements. Don't hesitate to reach out to noreply@<X>app.com if you have any questions or suggestions."

"Bedankt dat je <X> gebruikt! Bij het invullen van de releasenotes heeft onze stagiair niet opgelet en per ongeluk de verkeerde taal geplakt. Geen probleem. We hopen dat je van deze nieuwe versie geniet!"

(For the longest time, the Dutch Facebook Messenger app had release notes in some Scandinavian language.)

<comment><USER50> A lot of popular iOS apps are doing this, which I personally find extremely annoying.

<comment><USER51> I would reckon that the average user doesn't care for a list of specific bug fixes.</comment></comment></comment></comment>


Decluttering Your Inbox - <AUTHOR> https://www.spikenow.com/ <comment><USER2> I don't get it. Is this some content-modifying (don't want to say AI) gateway between email and some messenger? If so, how do the messages look like for the people on the email side? I don't need screenshots of a messenger app because I've seen dozens of them and they all look the same.

<comment><USER3> It's not AI...its conversational email (its your email, but looks like chat). Your email will feel like chat but the people on the other side will still see their regular email thread if they don't use Spike. Super helpful.

<comment><USER4> I second this - The messages look just the same as a regular email for people that don't use the Spike app.</comment></comment></comment>


Run Chrome Apps on Android and iOS - <AUTHOR> https://developer.chrome.com/apps/chrome_apps_on_mobile

<comment><AUTHOR> Now also with current Intel CrossWalk support: [http://blog.chromium.org/2014/09/now-with-faster-dev- workflo...](http://blog.chromium.org/2014/09/now-with-faster-dev-workflow-and- modern.html)

GitHub Project: [https://github.com/MobileChromeApps/mobile-chrome- apps](https://github.com/MobileChromeApps/mobile-chrome-apps)

Related StackOverflow answer: [http://stackoverflow.com/questions/23605751/do- mobile-chrome...](http://stackoverflow.com/questions/23605751/do-mobile- chrome-apps-run-in-chrome)

</comment><comment><USER2> So does this mean that using a combination of Cordova and the recently- available ARChon, I could theoretically run an Android app packaged as a Chrome App running inside Chrome on an Android device?</comment>


Digg Tries To Bring Back Inactive Users From The Dead - <AUTHOR> http://techcrunch.com/2010/10/06/digg-tries-to-bring-back-inactive-users-from-the-dead/

<comment><USER2> Its a feature that is about to be viral.

I got that form of email about a week ago from Imperial Conflict. An early 2000's browser game.

Here is the email: <http://pastebin.com/ch8MXh6M>

I also know of a forum that sent out that form of email recently.</comment>


Overflow error shuts down token trading - <AUTHOR> https://techcrunch.com/2018/04/25/overflow-error-shuts-down-token-trading/ <comment><USER2> 1- This is such a newb error, multiplying numbers without account for overflow. Every contract I've written, I wrote math methods to always check overflow. In my production contracts, you will not see any naked arithmetic.

2- This is such a newb error for those designing and implementing Solidity. There is never a reason for overflow to be allowed. Every operation on a number should check for overflow and underflow. Solidity and the EVM is so terribly done. I can't believe that are still going with it. I would have ditched it long ago. They are going to back in things that will later be very difficult to change.</comment>


How to Say Thanks And Improve Your Launch Day Success - <AUTHOR> http://wadefoster.net/post/46139579305/how-to-say-thanks-and-improve-your-launch-day-success/

<comment><USER2> While I agree with everything, he left out an important group to thank. It's a pretty important segment, the people who are using your product.

Here's an example of how the exchange could look:

Company: Hey We Launched! Users: Signup and begin use Company: Thanks for signing up! Anything we could do better? Users: X, Y, Z Company: We've implemented X,Y and are working hard on Z!

<comment><USER3> Excellent point and I'm a bit embarrassed not to have included them! I'm adding it to the post as we speak. :D

</comment></comment><comment><USER4> This is the sort of post I love HN for. Simple, actionable advice that has a lot of "feel good" results, but also potential upside beyond just the feel good.

Thanks for sharing it :-)

</comment><comment><AUTHOR> Thank you.</comment>


Let's help Hoefler & Frere-Jones fill these jobs. Hoping for H&FJ web fonts. - <AUTHOR> http://www.typography.com/about/careers.php

<comment><AUTHOR> Seems like the kind of jobs folks here would be all about. I would absolutely love to use their fonts online in an accessible way.</comment>