Why doesn't HN use responsive units? - <AUTHOR> HN works great on mobile, but on desktop it doesn't. Every time I open HN on my computer, I either have to make the window smaller to make the text readable or zoom.
The problem is that if I zoom, the line-width gets out of hand and it gets hard to read the comment threads.
If HN used a responsive unit instead of pt for font sizes, the site would become much more readable.
There isn't much difference in readability between 1 em and 10 pt in mobile, but there is a huge difference in desktop browsing.
To test out my ideas I've hacked together a 10 line custom css to demonstrate the concept.

  @-moz-document domain(news.ycombinator.com) {
  .comment {
 	  font-size: 1.2em;
  	  line-height: 2em; /* optional */
  }

  .title {
 	  font-size: 1em;
 	  padding: 0.25em 0.1em;
  }

  .subtext {
          font-size: 0.8em;
  }
  }
 I've also created a stylish theme on this CSS, if you want to test it or look at screenshots, you can look at: https://userstyles.org/styles/160671/minimal-hn-readable .
I think we need to tweak the HN stylesheet for desktop users. With high-dpi screens becoming more and more present in our lives, the old pt method will cause us problems. And the solution is so simple: we can just switch to em's. <comment><USER2> > The problem is that if I zoom, the line-width gets out of hand and it gets > hard to read the comment threads.

One question. On desktop, do you by chance have your browser window maximized?

If so, try an experiment. Demaximize your browser window, make it full screen height, but about 1/2 (or a bit more) screen width.

Then see if the line length goes out of hand.

If your browser is not maximized, well then this experiment will be of no benefit.

<comment><AUTHOR> > Demaximize your browser window, make it full screen height, but about 1/2 > (or a bit more) screen width.

This works, the line-width does not get out of hand. It even switches to full screen view and removes the margins.

If I use a narrower window, there is no problem. But if I use any window bigger than 1400px, the line-width becomes an issue.

I think the problem may lie in the screen specific CSS of HN, there is no custom CSS after 1349px max width:

      @media only screen and (min-width : 300px) and (max-width : 389px) {
        .comment { max-width: 270px; overflow: auto }
        pre { max-width: 200px; }
      }
      @media only screen and (min-width : 390px) and (max-width : 509px) {
        .comment { max-width: 350px; overflow: auto }
        pre { max-width: 260px; }
      }
      @media only screen and (min-width : 510px) and (max-width : 599px) {
        .comment { max-width: 460px; overflow: auto }
        pre { max-width: 340px; }
      }
      @media only screen and (min-width : 600px) and (max-width : 689px) {
        .comment { max-width: 540px; overflow: auto }
        pre { max-width: 400px; }
      }
      @media only screen and (min-width : 690px) and (max-width : 809px) {
        .comment { max-width: 620px; overflow: auto }
        pre { max-width: 460px; }
      }
      @media only screen and (min-width : 810px) and (max-width : 899px) {
        .comment { max-width: 730px; overflow: auto }
        pre { max-width: 540px; }
      }
      @media only screen and (min-width : 900px) and (max-width : 1079px) {
        .comment { max-width: 810px; overflow: auto }
        pre { max-width: 600px; }
      }
      @media only screen and (min-width : 1080px) and (max-width : 1169px) {
        .comment { max-width: 970px; overflow: auto }
        pre { max-width: 720px; }
      }
      @media only screen and (min-width : 1170px) and (max-width : 1259px) {
        .comment { max-width: 1050px; overflow: auto }
        pre { max-width: 780px; }
      }
      @media only screen and (min-width : 1260px) and (max-width : 1349px) {
        .comment { max-width: 1130px; overflow: auto }
        pre { max-width: 840px; }
      }

The interesting bit is, that if I try to load HN on responsive view in developer tools (ctrl+shift+m) and adjust the screen size to 1920x1080, the site displays without any problems, with bigger fonts and saner defaults.

But if I open HN on a regular tab with the same pixel size, fonts get super small.

The problem becomes more annoying, if you use a tiling window manager such as i3. Then you have to open another frame and adjust the size of the window.

Even on regular window managers, it is annoying to have to make the browser window smaller to browse HN.

</comment></comment><comment><USER3> HN works fine for me..like every other website. I suggest the problem is with your setup and not with HN.

<comment><AUTHOR> Could you elaborate a bit?

What is your screen resolution? Do you use text scaling?

Do you open your browser in maximized view or do you prefer smaller windows?

</comment></comment><comment><USER4> Alternatively, you can also use UserJS to modify the font size and layout of HN on your browser.

~ Khayri R.R. Woulfe

<comment><AUTHOR> I am doing this right now, but I think we can solve this issue without needing user styles.

HN looks super sharp and usable on mobile, why not achieve some usability on desktop as well. All that is required is a simple media query for browser windows larger than 1400px in width or using responsive units.</comment></comment>


Show HN: Boomerang Calendar - a smart calendar assistant in your Gmail - <AUTHOR> http://boomerangcalendar.com/beta.html

<comment><USER3> Why hasn't Google acquired this company yet? They've been doing such great work and they obviously have the right passion to make email/calendar better for the world.

<comment><USER4> Because they has been busy updating gmail design.

To me it looks like Google has stopped caring about what their customers want and is focusing instead on things that they think we want...

</comment></comment><comment><AUTHOR> Use showhn as beta code if you want to download. </comment><comment>= Hey HN, We just launched Boomerang Calendar (private beta) and would love to get your thoughts. It helps you see your availability from your inbox and streamlines scheduling meetings.

</comment><comment><USER5> Fascinated by the nascent eco-system of apps built on top of email. To PG's point in one of his essays about fixing email...I wonder if the transition to the future of email lies in using email as a protocol.

As applications are developed that better utilize some of the structured data within email, do we eventually transition to a world where very few emails under a certain threshold are read...but instead parsed for information content. Thus potentially putting the receiver back in control of the overall experience?

<comment><USER6> I think you're right about email as a protocol.

There are a couple reasons I think we'll continue to read most of our messages, though: * If the automatic parser misfires on one out of 50 messages (a really hard threshold to hit, as we've learned from building BCal), you still have to review the messages it determined you "shouldn't read" - so it's really not adding a ton of value. Just saving you the step of clicking the delete button * Deleting junk email doesn't take very long - 80% of deletions happen in under 3 seconds.

That said, there's a ton of gray area for products like Boomerang Calendar, which facilitate the interaction you'd want to take, but don't choose it for you. We're working on some of those :)

Thanks for getting my brain's gears turning!

</comment></comment><comment><USER7> I started using Boomerang last summer as I had so many emails that were getting lost in the mix. It was like having a personal assistant always reminding me to follow up.

Excited that you have moved on to a calendar assistant as well. It's definitely where I struggle the most. Looking forward to using the product.

Thanks.

<comment><USER8> Absolutely. The cool features like remind me if there is no reply in the next 2 days has been one of the many features I use everyday. I have recommended this to so many folks now.

</comment></comment><comment><USER9> This seems like a good idea, with decent gmail integration. It's certainly one of the best approaches to the meeting 'time slot suggestion' problem I've seen so far. I developed a product (meetingShed <http://www.meetingshed.com>) which aims to solve the meeting scheduling problem from another angle - <USER2> people's Google calendar data by a sharing mechanism so you don't have to send messages back and forth between people. There's advantages and disadvantages of both approaches, but this is definately an interesting implementation.

</comment><comment><USER10> Aside: Why have separate domain names for all your products? I didn't even realise you had more than just Boomerang Calendar until I read the other posts in this thread.

Even going to the about page, didn't have an obvious link to the list of products (<http://www.baydin.com/>). Just a link that says "see our other products" would be great.

<comment><AUTHOR> Thanks, amirmc. This is great feedback. We will probably point About Us to Baydin.com home page directly.

</comment></comment><comment><USER11> Doesn't work for me on latest mainstream Chrome on 10.7-- when I download, the button says "Keep" instead of "Continue" (i.e. it's treating it as a file instead of an extension). Then when it's downloaded the CRX, attempting to load it causes Chrome to try and re-download the same CRX file, bringing up a save dialog...

<comment><USER6> uh oh, that's not what's supposed to happen. Can you install other extensions? If so, please email us at email@example.com and we'll see if we can help out.

<comment><USER12> Same thing happened to me. Downloaded it instead, and tried to install and it still didn't work. OSX Lion, chrome v 19.0.1084.30

<comment><USER6> Can you send us an email as well? We tested on Lion before release this morning, and everything seemed OK on our end

</comment></comment></comment></comment><comment><USER13> WOW! Just downloaded, watched the video and tried it out. Simply brilliant. Only one extra feature request/tweak - instead of defaulting for a meeting location when using the "suggest times to meet button" could it also have an option for my conference call number as a lot of my meetings are by phone.

<comment><USER6> awesome, thanks!

we'd like to have the locations dialog remember your previous entries (and making your phone number one of those options is a great idea) in a future update.

</comment></comment><comment><USER14> Great product. But do check for broken links on the website.

The download page <http://boomerangcalendar.com/beta/download.php> link to /beta/features.html and /beta/faq.html.

</comment><comment><USER15> Boomerang for Gmail is already amazing, and this seems like an even more incredible addition to streamline email + calendar scheduling.

Awesome job guys! Keep up the good work.

<comment><USER6> Should have put the code in the post title. Sorry about that! Use the invite code 'showhn' (no quotes) to skip the line :)

</comment></comment><comment><USER16> This looks really interesting, we started developing a tool identical to this recently - had a play with it and it works well. Well done guys! it's certainly got us thinking

</comment><comment><USER17> Glad to see that you have a great set of people endorsing you guys. I can't imagine people better than Andrew Carengie, Amelia Earhart, and Noah.

<comment><AUTHOR> Anyone wants to give us a testimonial? Send me a note firstname.lastname@example.com :) You'll be in good company with Andrew Carnegie!

</comment></comment><comment><USER18> I use Boomerang for Gmail all the time, excited to see how the app can make my calendar scheduling simpler as well.

</comment><comment><USER19> Better Calendar integration with Gmail than Google can pull off? Interesting. Will definitely give this a try.

<comment><USER6> cool, let us know how it works for you!

<comment><USER20> I use Boomerang every day with Gmail and I think I would lose a lot of hair without it. Very excited to try this out.

</comment></comment></comment><comment><USER21> This is pretty incredible. Really clever. Any plans for iCal integration?

</comment><comment><USER22> I was using boomerang BEFORE it was on Hacker News.</comment>


Why do people get colds in cold weather? - <AUTHOR> http://www.quora.com/Why-do-people-get-colds-in-cold-weather?srid=3PV <comment><USER2> Because they spend more time indoors than in warmer weather.</comment>


Make Your Own iPhone/Android Apps With New App Generator - <AUTHOR> http://www.readwriteweb.com/archives/make_your_own_iphone_android_apps_with_new_generator.php <comment><USER2> if you have watched Zeitgeist you know exactly why they're investing more of "our money" into losers and a losing game.

if you haven't then i didn't say anything, i love capitalism, and don't send the black helicopters please.

<comment><USER2> hmm this comment seems to be linked to the wrong thing now.

interesting, BUT IT'S WRONG</comment></comment>


CD Projekt RED unveils their new game mod toolkit - <AUTHOR> http://icrontic.com/article/redkit-revealed-a-new-mod-toolset-for-the-witcher-2

<comment><USER2> Blogspam by a spam account. Sadly I seem to have my flagging rights taken away.</comment>


Ask HN: Sales stats for Android paid apps? - <AUTHOR>

Were any concrete sales figures ever disclosed by any Android developer? This kind of info is easy to find for iPhone (albeit mostly the freaky successes) but it seems very tough to find any commercial data from the Android Market. <comment><USER2> At an open source confrence I was at (flourish) they had an android developer which developed games. The sales were considerably lower for android apps I believe it was 10% of the sales compared to iPhone apps.

<comment><AUTHOR> That's what I was afraid of. It seems like Android is still something for the (hopefully near) future.

Let's hope Google gives it a boost somehow, don't know if they're hoping more devices hit the market.

It would be very nice for developers to have an alternative to the Apple App Store.

<comment><AUTHOR> There's a mention here that a Larva Labs app stayed at number one for a while and is now number 2 : <http://www.flourishconf.com/flourish2009/?q=node/36#hall>

If they disclosed concrete numbers, maybe we could size the Android App Market.</comment></comment></comment>


The sad state of server-side TLS session resumption implementations - <AUTHOR> https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/

<comment><AUTHOR> Small clarification: As Ryan Sleevi pointed out over Twitter, it may sound a lot like I'm giving advice and discouraging the use of session tickets. I don't want to encourage anyone to disable session tickets and make TLS so slow that they're switching back to HTTP for good. Having TLS without PFS is a lot better than having no TLS. The post was mainly written to explore options and show that there are tradeoffs to think about with current setups, especially if you're interested in going all the way and provide PFS.

</comment><comment><USER2> Hi, Apache developer here, kinda a request for feedback on how we can improve the situation:

How would people feel about automatic key rotation that required time synchronization across a cluster?

Eg, on all your webservers, you have something like this:

        SSLSessionTicketKeyFile  /var/lib/apache2/session-ticket.key
        SSLSessionTicketRotation 1hour

Internally apache would calculate `HMAC(1hour-time, $key)`, and use that for the current hour (and allow the previous hour) for session ticket signing?

If you don't specify the TicketKeyFile, it would just randomly-regenerate a key every hour.

This is not perfect. It has issues. Like if your key is leaked when using a TicketKeyFile, calculating the session ticket secret for a given time is trivial.

<comment><USER3> You can get rid of the need for close time synchronization by having it accept 3 possible values: next hour, this hour, last hour. Then there is no problem if one is a minute ahead of another.

Furthermore the idea of issuing one key and accepting multiple others should be allowed in the TicketKeyFile. As should picking up changes in the TicketKeyFile on the fly. And now key rotation is something people can set up for themselves on any schedule that they want, in any way that they want.

But a better solution for the article's problems is to combine the two approaches. Have the server save session ID/key. Now information about the key used by one session does not help you get into another one. And access to the cache on the server cannot be used to read the contents of any session.

As an aside, I am somewhat disappointed that the documentation in 2014 for [http://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslsessi...](http://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslsessioncache) recommends a solution that would force you to run your site on one server. I have been using Apache off and on since the late 90s. Other than development machines, I haven't seen an Apache site that wasn't load balanced.

</comment></comment><comment><USER4> nginx does have the minimum necessary support to handle shared session ticket keys. It would be nice if it did more for you out-of-the-box, but I'm more interested in practical solutions that work today.

You can specify _ssl_session_ticket_key_ multiple times, and the subsequent declarations are used for decryption only.

It does take some elbow grease to implement the tooling around this, and it's unlikely that many people have bothered, but they should.

      1. Generate new key on a master host (store only on tmpfs partition for extra points)
      2. Somehow get it on all of the relevant hosts securely, such as by using lsyncd
      3. Add new key to end of list of ssl_session_ticket directives
      4. Reload all nginxes that answer a particular address
      5. Move new key to top of list
      6. Reload all nginxes that answer a particular address

(after I wrote this, I noticed it was pretty similar to Twitter's idea. I guess great minds think alike.)</comment>


Show HN: Download an instant social media monitoring report - <AUTHOR>

Please review my pivot... I needed a way to let the user see the capabilities of the product instantly rather than register and try out the product over a month's trial period. So I managed to create a way to do it in a single click.
Would love your feedback
Link: http://www.nostonepr.com/ <comment><USER2> I really like the idea--a low-maintenance and (almost) hassle-free way of tracking feedback of my web projects across the internet, as opposed to supervising a multitude of individual social media accounts/platforms for data.

However, I wasn't happy with the execution or the results for 2 reasons:

1) I felt mislead with your description that I could try this out "in a single click". It's not a single click. The first click is the initial submit button ("Compile Free Report"), followed by a link to download the actual report. I automatically get turned off whenever I'm required to download something in order to try out a service/product. I think it's worse than requiring an e-mail signup, because I feel like its encroaching on my computer's security on the local level. The only reason I went through with it anyways was to provide some feedback.

I feel like you may lose a lot of users this way because you're asking them to do YOU a favor (download an unknown file from a not-yet trusted source), without even offering a reason/incentive to them to begin with. I have no idea what's in the report, or if it will even benefit me. It sounds scammy. It would be helpful if you at least included a preview of the report prior to the download link, so that I could determine the value of the report and decide if I'm interested in downloading the rest on my own accord.

2) 50% of my report is blank, and 100% of it is inaccurate. I submitted my domain willworkforamac.com . My Mixpanel and Google analytics data from the past month indicates that I've been averaging a couple hundred of unique visitors a week, from various regions among almost all continents. The report indicated I had 0 results from today to all time. Did I enter my domain in the wrong format?

And output files as pdfs? That seems to be the norm, and doc files aren't as universally compatible (I run an old version of MS Word, for example, so I was notified of format/layout deficiencies when I opened the file)</comment>


Median Wage in Mechanical Turk is $1.38 per hour - <AUTHOR> http://www.ethanzuckerman.com/blog/2010/11/02/david-rand-social-science-experiments-with-mechanical-turk/

<comment><USER2> I improved my English spelling and punctuation by doing CastingWords transcripts a few years ago. Perhaps the main motivation for some people is the actual money.

Though I'm curious how they got people from India onto the site. After all, you could only use a US credit card or Amazon credit to get paid.</comment>


Could I Trust an Accountant Who Once Stole $1.2M? - <AUTHOR> http://observer.com/2013/04/the-tax-man-skimmeth-the-1-2m/?show=all

<comment><USER2> No. I agree that people deserve a second chance, but there is no reason for him to be in the money business. He should be doing one of the other 95% of jobs that do not require it.

<comment><USER3> Exactly. Not to mention this guy had a second chance the moment he stepped out of jail and what did he immediately do? He lied about having a CPA license.

There is no reason to trust him with any money and the authors conclusion that it was worth it because he found a deduction is absurd. Any tax account should find you the same thing and she deserves anything she gets from having this guy know her (and her mother's) financial details.

</comment></comment><comment><USER4> The point of membership of a finance professional institute like the CPA is that the institute judges whether a member meets the ethics requirements or not.

Someone who claims to have membership when they could not be bothered to complete their membership training records - plus a fraud conviction - nope I would not trust them with my personal financial information.

Declaration of interests: I pay the UK equivalent of CPA (ICAEW) several hundred GBP/USD annually as certification that I'm financially trustworthy. Some of my work is figuring out how to execute fraud and then how to defeat it - so it's a bit like a white hat badge.

</comment><comment><USER5> Someone lies and steals, is "rehabilitated", and right out of jail you catch them in a major lie again and still have a spec of trust in them? Wow.

My first thought is that when this guy got out of jail, he'd have a nice job away from being able to steal large amounts of money. But greedy people like OP and the business owner let it slide for a few bucks.

I should have gone into high stakes accounting and financial work. I could have hit and run down pedestrians, stole millions of dollars, killed a girlfriend in my home, etc... and people would still let me handle their money because I could save them about 2%. No one would bat an eye. Heck, people will even defend me!

</comment><comment><AUTHOR> In 30 years, it'll be interesting to read the studies of how our capacity to give convicts a new chance has increased or decreased. Before Google, we gave people second chances because we didn't know any better. Now that it's ubiquitous, it seems almost necessary for us to recalibrate what it means for someone to have paid their debt to society.</comment>


My Favorite Robots - <AUTHOR> https://www.charlieharrington.com/robots-i-love <comment><USER2> This list looks cool! For some reason HN is too much focused on software and usually there isn't much of anything hardware.

I also enjoy making robots just for the fun of it. Here are some examples from my side:

\- Bebe: www.youtube.com/watch?v=bViFrTQ-DQ0 Bebe is my lovechild. He fulfills my paternal instincts and the best part of the day is when he runs at me affectionately with all his 28 legs. Unfortunately, Bebe is a naughty boi and he broke half of his legs when he fell from a beer pong table. He can't run nowadays.

\- micro InvaderBot: www.youtube.com/watch?v=G3a9dcDeQbc micro InvaderBot is the smaller version of InvaderBot. Not much of it is known, but it is believed that it has escaped from Dvergar facilities during Robot Uprising _.

_ robotuprising.fi This is a story based hackathon that we used to organize annually. I don't know how it will go this year due to coronavirus, but we keep the fingers crossed :)</comment>


Show HN: Rebridge v2.0 – A transparent bridge between JavaScript and Redis - <AUTHOR> https://github.com/CapacitorSet/rebridge <comment><AUTHOR> Previous thread here, about v1.0: [https://news.ycombinator.com/item?id=12723474](https://news.ycombinator.com/item?id=12723474)

v2.0 addresses some of the feedback in the previous thread, and uses Promises rather than synchronous non-blocking access.

<comment><USER2> Huh, the first one (v. 1.0) looks much more clean. What was the problem with synchronous non-blocking?

<comment><AUTHOR> It was much more difficult to understand. For whatever reason, it appears that I couldn't `splice` arrays ([https://github.com/CapacitorSet/rebridge/issues/2](https://github.com/CapacitorSet/rebridge/issues/2)), and I honestly couldn't figure out what was wrong.

There was also the issue of error handling, which is much easier with promises.

</comment></comment></comment><comment><USER3> I haven't looked at the proxy spec since playing with it several years back after it was first implemented in FF so my knowledge of how it works probably has gaps but I have a question:

Using a get returns an object which has a ._promise field? With get and set being different calls on a proxy object, could you return the promise when getting instead of an object on which you need to access the ._promise field?

</comment><comment><USER4> What is the advantage of using private subnets + NAT gateways? Aren't security groups enough to control network traffic?

<comment><USER5> Wrong post</comment></comment>


Show HN: Bitcoin Price Prediction with Tweet Analytics - <AUTHOR> https://datpaw.com/ <comment><USER2> More details about how you are doing this would be great. May be a high level diagram

<comment><AUTHOR> You can see detail information with a pie chart in "Stats" menu.

</comment></comment><comment><USER3> A fools errand.</comment>


How I "hacked" Dustin Curtis's Posterous. - <AUTHOR> I logged into my outlook, changed my email address to his email address, and sent the email to email@example.com.
Dustin mentioned in his article that he didn't require a password, and I wanted to see if he had used the confirmation skip.
Just wanted to apologise to Dustin about any inconvenience, but I do hope I opened his eyes to security a little!
EDIT: A little bit of backstory.
Dustin seems to think, that I did this because of a comment he made, on how the headers could be forged. I had not read this comment. Infact, I read his article, and using the knowledge that I picked up years ago, that you could change the outgoing email address in Outlook (Although, it was Outlook Express in them days) I changed my email to his email.
I saw his email on his website (email@example.com) and thought, "No, he wouldn't be sending his personal emails from that address, that's silly."
I checked the WHOIS on his domain, and saw another email address there. I changed my email, sent a quick "Apparently..." message, and then changed it back to my original email address. I checked his blog, and it didn't seem to work.
I then went to sign up for my own posterous, to play a bit more, and I saw that you had to authorise your posts. Then I saw how this could be disabled for convenience. A few minutes later and the post showed up.
I am a Web Developer, I have experience with bash scripting, curl, sendmail and everything else you would need to fake headers.
I did not fake headers, I changed one field in Outlook. I didn't do this maliciously, and I just did it to prove a point.
Posterous should not be using email alone to authorise posts, and they should not let you disable submission checking. <comment><USER2> Hey guys. I'm the cofounder of Posterous.

Yes, someone did figure out how to post to Dustin's site today. This security hole is now fixed.

We had a specific problem with the way we dealt with SPF records. Dustin didn't set any up, and there was a specific way that Robin Duckett's email server responded that caused us to flag it as a false negative for spoofing.

For the vast majority of users who use gmail, hotmail or other services, this was never an issue.

Since our launch on day one, we have taken email spoof detection very seriously. It's one of our core differentiators: to be able to securely post to your blog by emailing a single, easy to remember address. We don't want to do secret addresses or secret words.

Over the past 2 years, we've developed robust spoof detection ip and spend a ton of time trying to stay a step ahead of hackers. Fortunately, we've only had a few very specific, isolated cases where one of our sites was spoofed and each time we have improved our system.

Thanks for bringing this to our attention. We always need to be one step ahead of the hackers/spoofers, and we thank the Hacker News community for keeping us on our toes!

<comment><USER3> Odd, the other Posterous threads are getting buried so quickly. When a new comment is posted in any thread it appears at the top, except for these Posterous threads. Is this damage control on the part of YC?

The only other person so far to comment under the co-founder on this thread (at time of writing) is jseeba, who has had very little activity and one of the few comments he's ever made was in a thread called "Ask YC: Your favorite startups" where he said "Posterous. It just works." So jseeba doesn't do much around here in the 2 or so years he's been a member but made time to chime in for Posterous again.

<comment><USER4> This happened to me too when I submitted a link about Posterous. Not long after it made it to the front page, the subject was changed to an inaccurate and less attention-getting subject. Moderator power...

</comment></comment></comment><comment><USER5> I agree with the conclusion. Posterous could fix this problem by implementing something like The Zucchini Method ([http://www.jgc.org/antispam/03152005-2150120647b00f4af9d3443...](http://www.jgc.org/antispam/03152005-2150120647b00f4af9d3443f97783bf2.pdf) [PDF]). Basically, they could accept posts via email as long as the user included some hard to guess word (or other token) in the subject line.

<comment><USER6> or do what flickr does and give you a unique email address to send to that only you will know. you can add it to your address book so you won't have to remember it, and it's probably stronger than what most users would choose for a password.

<comment><USER7> Such considerations might be overkill for flickr/posterous but that does leave your "secret" email address in the logs of every smtp relay along the way. Its sort of equivalent to putting a password in a URL.

<comment><USER8> "smtp relay along the way"?

This isn't UUCP, the message will go from A to B across the internet backbone. There will only be SMTP relays along the way if either your email host or the receiver's email host has chosen to set things up that way. We'd have a much bigger problem with internet security if everyone's email was relayed through questionable servers as a matter of course.

<comment><USER9> Most residential DSL and cable users are prohibited from connecting to port 25, except on a special "smarthost". This machine, and anyone reading its logs, will learn your blog password.

More secure than no password, but not secure.

<comment><USER10> Fortunately most of the people who operate mail relays for ISPs are honest and responsible.

</comment></comment></comment></comment></comment></comment><comment><USER11> If Dustin were a major corporation or a politician, you'd be talking to the FBI and facing prosecution right now.

Nice hack, BTW.

<comment><AUTHOR> Hardly a hack!

<comment><USER12> it's a hack in the Bruce Schneier "easiest way to steal pancakes has nothing to do with where money changes hands" sense...

 _Our goal is to eat, without paying, at the local restaurant. And we've got a lot of options. We can eat and run. We can pay with a fake credit card, a fake check, or counterfiet cash. We can persuade another patron to leave the restraunt without eating and eat his food. We can impersonate (or actually become) a cook, a waiter, a manage, or the restraunt owner (who might actually be someone that few workers have ever met). We could snatch a plate off someone's table before he eats it, or from under the heat lamps before the waiter could get to it. We can wait at the dumpster for the busboy to throw away the leftovers. We can pull the fire alarm and sneak in after everyone evacuates. We can even try to persuade the manager that we're some kind of celebrity who deserves a free breakfast, or maybe we can find a gullible patron and tal her into paying for our food. We could mug someone, nowhere near the restraunt, and buy the pancakes. We could forge a coupon for free pancakes. And there's always the time-honored tradition of pulling a gun and shouting, "Give me all your pancakes"._

<comment><USER13> You've made this celiac crave pancakes again. Bad.

<comment><USER14> You can't tolerate glutin and you've never tried buckwheat pancakes? I find them superior to normal wheat pancakes in every way.

<comment><USER13> Don't judge me.

<comment><USER14> Sorry, my tone might have been off. What I meant was: Buckwheat pancakes don't have glutin and are amazing. If you don't know about them, give 'em a try!

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> This is a clear example of "good enough." Low security for low value targets -- if you need more you can get it. Setting a password, remembering a special email address, not posting via blackberry/mobile, all of these add friction.

EDIT: Although it is fun to think of solutions ... Posterous could mail you back a link; when you hit the link the post goes live. Then you would clearly need control of the sending address to post. And the link could just go to the new article, which you'll likely want to look at anyway.

<comment><USER16> I second. I have some flowers outside my house and they never got stolen. I think a lot of hackers overrate security just like a lot of nurses see diseases everywhere.

</comment></comment><comment><USER17> > and they should not let you disable submission checking

I realize the security implications of all of the latest Posterous musings. But the fact is if Posterous didn't allow you to disable this I'd stop using their service. Posterous knows this.

My use case for Posterous is my phone. It has a nice 8 megapixel camera, and with literally two clicks I can have a picture sent to my Posterous blog. Is it secure? Not at all. Is it extremely convenient and productive? Absolutely.

<comment><USER18> Maybe they could add a link in the confirmation email for 'never ask for confirmation to post from this location', which would whitelist that mailserver for posting without confirmation.

</comment></comment><comment><USER19> Heh. Back when alternate email protocols were still common, it was my job to help support the "smtp gateway" product for a large corporation. I got to the point where I could forge emails by typing in SMTP by hand.

This worked very well the day I played a prank on my boss - the boss had sent out an email forged to appear it came from a co-worker that was supposed to be funny but hurt the co-worker's feelings badly. Co-worker wanted revenge, so I created a "letter of resignation" that appeared to come from the boss and that appeared to have been sent to every member of our company - but was really only sent to the boss himself.

Co-worker later told me he saw the boss running from office to office trying to do "damage control" before he realized no one else had actually gotten the email.

</comment><comment><USER20> I feel like I'm missing something... Yesterday we were talking about the protections on Posterous and I posted an invitation to try to post to a Posterous I had set up (<http://news.ycombinator.com/item?id=1439376>). I got a bunch of emails from Posterous as a result of people trying to fake post to the account that I'd set up.

What's different between the way they did it and the way you did it? I'm assuming they also simply changed their email address in their mail client to try to send to my account.

<comment><USER21> > What's different between the way they did it and the way you did it?

he was successful.

seriously, though, the difference probably is that you put more time and effort into creating a posterous that was more secure. something as simple as "create it using a difficult email address" should cover most bases. something that most people likely don't do.

<comment><USER20> I put zero time into it. I created a brand new Posterous account, left everything as the default and posted the email address tied to the account here.

<comment><USER22> I believe the default requires authorizing your posts. That may be the issue.

</comment></comment></comment></comment><comment><USER23> Why we quit posterous:

We were using posterous fairly often a while back, until my friend got into an argument with the posterous founder. He (my friend) had a few beers and then wrote a stupid message, basically saying that the posterous idea in general was bad (using different words :> ).

Then posterous founder replied saying he was banning my friend. We never found out if he actually followed through- because all of us (~15 guys) stopped using it completely the next day.

We, as users, have many options when choosing where to host our data, and we want services that are useful, secure, ethical, and beautiful.

<http://charisma.posterous.com/>

This one is not ready for us.

</comment><comment><USER24> Does Posterous filter SEO spam? Otherwise this loophole seems like a perfect opportunity for SEO spam to start filtering in on lapsed accounts that still have some PageRank...

<comment><USER25> We do kill it and we're building a comprehensive spam killing system too. SEO spam is not welcome on Posterous in the least.

</comment></comment><comment><USER26> How does Posterous authenticate a message in the absence of DKIM or SPF records in DNS? The domain dustincurtis.com does not have an SPF record and DKIM is not supported by the mail host for dustincurtis.com(Google Apps for your Domain).

I assumed that Posterous did something clever using the IP address of the SMTP peer or the headers in the message. Does Posterous fallback to just checking the sender email address?

<comment><AUTHOR> > Does Posterous fallback to just checking the sender email address?

Apparently so, I didn't even change my name.

<comment><USER26> Do you use Google Apps For Your Domain? If so, that might have foiled any IP address checking because dustincurtis.com is also hosted there.

EDIT: You must not be using Google Apps for Your Domain because Google does not allow sender forging.

</comment></comment></comment><comment><USER27> All of you proposing obscure emails and other solutions, one of the reasons posterous' founders claim for their success is that they explicitly did NOT do any of those things. In fact, they're pretty clear that if they had done any of those things, posterous would have failed.

</comment><comment><USER28> Hey, you left your door unlocked so I painted this sign on it to let everyone know.

<comment><USER3> That's what happens when you don't even have a door lock to begin with, then go tell the whole world about it. (Dustin told the whole world about not having a password. Not this guy.)

</comment></comment><comment><USER29> I was thinking about implementing a posterous-like email system for calendaring, and was wondering how they authenticated the emails. I recall them getting "hacked" around launch and there being some TC article about how they responded swiftly by adding new security measures.

Just registering the "usual" smtp sender / relay and prompting the user before posting something from a different spot could help. I don't know enough about MX records yet, but matching up the domain and sending IP could be another good measure. How else can this be improved?

</comment><comment><USER30> E-mail provides no security. An e-mail can be forged simply by using telnet to connect to and SMP server (usually your ISPs) and typing the appropriate message (see wikipedia SMTP. The easiest fix for this is PGP as mentionned in previous posts. This is, however, a horrible solution since it will alienate many users (think your mother). The simplest solution that will do a good enough job is to send back an e-mail to the user with a 'preview' of his post for him to OK it since receiving e-mails is more secure.

<comment><USER31> Which provides a great way to spam people. The preview idea sucks.

SPF solves almost all of the issue. Unique mailing addresses should be available for users who want it (yeah most people can handle an address book). The absence of those is just grossly incompetent.

</comment></comment><comment><USER32> It seems like a fault that wouldn't hurt the entire system, but it may cause a dilemma similar to Facebooks design flaw, where disowned groups could be taken under control - <http://mashable.com/2009/11/10/facebook-groups-hacked/>. As with every such flaw, it's likely to start attracking spammers, and should be dealt with in some way (Facebook seems to have disabled reclaiming ownership of groups without admins?)

<comment><AUTHOR> firstname.lastname@example.com

Would half fix this problem.

<comment><USER33> or even firstname.lastname@example.com

</comment></comment></comment><comment><USER34> You could have told him instead of being a jerk - I know from experience that this doesn't work, say in the work place, where proving your point like this is vital if you want to be heard - but for regular people this is basically an attack. Worst of all you told everyone else how to do it...

Warning him would have been nice, this IS, by definition almost, malicious - regardless of how you chose to interpret the word yourself.

</comment><comment><USER35> Sending email apparently from a particular address, as described, is so simple I can't believe two things: 1, that Posterous was set up to let that happen and 2, that in 2010, the email system is still so dumb that I can send mail with any sender address that to the majority of people would be indistinguishable from mail genuinely from the sending address.

</comment><comment><USER36> Nice hack. You're going to spawn a whole new generation of hackers that uses Outlook to wreak havoc. ;)

</comment><comment><USER37> Its cute, but its not a hack.

<comment><AUTHOR> Yeah I forgot my sarcasm airquotes.

</comment></comment><comment><USER3> Why on Earth would anyone use the confirmation skip? That's basically security through obscurity. Even less so if the email address you use is known by people.

<comment><USER38> Interesting point, because it suggests that an email address that was kept private and dedicated to Posterous posting could have prevented this attack. So, is this weak security on the part of Posterous, or excellent social engineering on the part of robinduckett? At the least, It's like he simply asked the target for a password; at the most, it's like he found the spare door key in the fake 7-Up can in the garden shed.

Note: Creating a "private" email address is beyond the capabilities of 75% of the people I know, who believe that email addresses are exclusively created and assigned by ISPs or employers. I doubt that Posterous will do anything to alienate this group, who appear to be an important target audience.

<comment><USER25> Actually it was a bug, and its now fixed.

</comment></comment></comment><comment><USER31> Does Postereous not support SPF?

SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password.

Sadly SPF is grossly underused.

<comment><USER39> Sure, they could check SPF, but what if _your_ mail server doesn't support it? Reject the message?

<comment><USER31> If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.

<comment><USER40> Yeah, as soon as I saw this post I thought of SPF and DomainKeys.

Seems simple:

If your mail/DNS is setup to support either of these, then cool you don't need to confirm.

Else, you must "ok" each post.

DONE

</comment></comment></comment></comment><comment><USER41> Poll: hack Dustin Curtis's things every day? Yay? Nay?</comment>


Ask HN: What job is better than Google? - <AUTHOR> I'm currently a SWE at Google. Most of my coworkers act like there no better job (my manager has frequently said as much), and it is certainly a common story that Google is the best place to work. I am very grateful to work at such a company. Yet, I'm 24, and it's not inspiring to believe I will never have a better job or work at a better place.<p>I'm sure there are better places, somewhere in the world. What are they? What roles are better? What should I hunger for? What is a worthwhile goal? <comment><USER2> Financial independence? Living off your own project?

</comment><comment><USER3> Not working on ad tech? (Tech supporting ad-tech is the same - turtles all the way down...)</comment>


About Apple deleting Gmail messages - <AUTHOR> http://scripting.com/2015/07/24/quickFollowupReGmailProblem.html#aATPTP <comment><USER3> Sounds like a rather awful bug on Apples side, or at least a gap in their reasoning about logins to third-party services.

I'm not sure why the OP reaches for the tin-foil hat towards the end. If the gmail messages that are being deleted are actual (or borderline) spam, and don't reflect a systemic targeting of messages originating from google, then it seems a bit crazy to claim there's a conspiracy going on.

<comment><USER4> I am the OP.

In some cases the messages they've deleted have been important real emails. Not spam.

Also you're being a little dramatic in characterizing my comments. You might want to temper that, esp when you're accusing someone else of doing what you are yourself doing. ;-)

<comment><USER3> >> Also you're being a little dramatic in characterizing my comments. You might want to temper that, esp when you're accusing someone else of doing what you are yourself doing. ;-)

Fair enough :)

I didn't mean to cause offense, but to be fair the following passage:

>>>> Could it possibly be that Apple doesn't like the fact that I use GMail? Could this be marketing? A feature, not a bug?

... reads as quite paranoid. Without strong evidence of a conspiracy I'd be inclined to believe this is not a deliberate and malicious act by Apple against the user, but simply low-quality software engineering.

Also, thanks for the links to the TSR Wars, that was some good reading!

<comment><USER4> And when it comes to security, paranoid is the right approach.

As for how it "reads" to you -- that has more to do with you than me. ;-)

<comment><USER3> Quite true, on both counts :)

</comment></comment></comment></comment></comment><comment><USER5> I am putting my money on the author clicking through the popup on OS X after you login to Gmail.com offering to keep the credentials and use them within the OS. I'll try to find a copy of this screen. IIRC it is clearly different from just Safari saving passwords but it's highly likely that people will click through it.

Edit: here is the screen I am referring to: [http://photos2.appleinsidercdn.com/MLSafari2.030512.png](http://photos2.appleinsidercdn.com/MLSafari2.030512.png)

<comment><USER6> Wait, so Safari recognizes when you log into Gmail and vaguely offers to let you use Apple Mail instead, which has a history of not working well with Gmail's label and archive system? That's kind of fucked up.

<comment><USER5> It does indeed. And aside from a few less-than-sane defaults I haven't had any issues with Mail and our Google Apps account at work (though I don't add accounts this way).

</comment></comment></comment><comment><USER7> This is disturbing behaviour on the part of Apple, and I concur that there are serious issues with how intrusive both iOS and OSX are when it comes to accessing accounts and sharing details from one host to another - it seems like Apple are trying to excel at doing their customers a favor by passing these credentials between machines, but it creates more of a headache - <USER2> potential security risk - than it should.

I long for the days when sensible principles governed the implementation of these kinds of features - as it stands, as an Apple customer, I have no idea how far and wide my keychain has been dispersed around the Apple universe. Very disturbing indeed.

</comment><comment><USER8> OT, but if the OP doesn't like getting notifications on stuff on the Apple Watch, he/she can go into the Apple Watch app on the iPhone and turn off any that get annoying. Turning off email notifications was the first to happen for me :) .

</comment><comment><USER9> Heck, what I am posting is unrelated to the specific thread but every time I enter scripting.com and read some Dave Winer post I remember why I miss Userland Frontier. Wonderful piece of tech, my first exposure to RSS and XML- RPC and a wonderful world of interoperability which we basically lost now with mobile being ruled by proprietary silos and secret APIs.

</comment><comment><USER10> My Mac is only connected to Gmail to sync contacts, but when I authenticate with Google, mail is in the list of permissions. Now I'm worried this could happen to me, even though I don't have mail checked.

</comment><comment><USER4> Here's another disturbing story about Apple's attitude about security, from 2007.

[http://scripting.com/stories/2007/12/22/macsAreEvenMoreExpen...](http://scripting.com/stories/2007/12/22/macsAreEvenMoreExpensiveTh.html)

</comment><comment><USER11> Any one else seeing Chrome increasingly become more unstable on iOS?

<comment><USER4> Yes. I've written a lot about it on my blog.

[https://www.google.com/search?q=site%3Ascripting.com+google+...](https://www.google.com/search?q=site%3Ascripting.com+google+chrome&oq=site%3Ascripting.com+google+chrome&aqs=chrome..69i57j69i58.5063j1j4&sourceid=chrome&es_sm=119&ie=UTF-8)</comment></comment>


Is Safari becoming the new IE? - <AUTHOR> http://caliper.io/blog/2013/is-safari-becoming-the-new-ie/

<comment><USER2> No[1].

SPDY support would be a nice-to-have, but the problem with today's websites is that the vast majority of your resources are external; ad networks, like buttons, and so on. It's is great in the optimal case, but in the typical case it doesn't make a significant enough difference to bother supporting[2].

The other two issues (NavTiming and WebRTC) would be really useful, but for a minimum of web developers or applications, so I can understand them not focussing developer time on it. It'll come soon, but the Safari team was pretty small last time I checked so it's no surprise it's not a priority.

        [1] http://en.wikipedia.org/wiki/Betteridge's_law_of_headlines
        [2] http://www.guypo.com/technical/not-as-spdy-as-you-thought/</comment>


Google Earth now no longer works in the new Chromium Edge - <AUTHOR> https://twitter.com/zacbowden/status/1123692335433494528 <comment><AUTHOR> Google Earth joins the growing list of Google services that either don't work or warn of not working in Chromium based Edge.

<comment><USER2> Google has already addressed this. If you are going to post about this it seems remis to not include something about their explanation.

<comment><AUTHOR> Care to provide some kind of link?

<comment><USER3> Google Earth for the web doesn't work for any version of Chromium. It has only ever been supported on Google Chrome because it is a Native Client based Chrome App.

When development of the web version began the only options for running C/C++ code in the browser were Native Client and asm.js. asm.js was not performant enough for the task. Shortly after release of the web version Google announced it would be ported to the now available WebAssembly at which point it would gain cross browser support.

Last year Google demonstrated an in development WebAssembly version running on Chrome and Firefox. There has been no word on when the WebAssembly version will be released but Native Client Chrome App support is currently scheduled to be removed from Chrome on all platforms except ChromeOS in Q2 2019 which hopefully bodes well that a release will be soon. Of course the date for removal of support was originally scheduled for 2018 so further slippage is possible.</comment></comment></comment></comment>


Restoring a polyphonic synthesizer from 1940 - <AUTHOR> http://www.discretesynthesizers.com/nova/intro.htm

<comment><USER2> If nothing else, you should listen to the recordings at the bottom of the page. Ranks among the best analog sounds I've heard.</comment>


Indian American teen invents wondrous 20-sec charger - <AUTHOR> http://www.indianexpress.com/news/indian-american-teen-eesha-khare-invents-20second-charger/1118420/

<comment><USER2> Incase anyone is interested in the actual research, rather than just the media hype about this, check out: [http://ce.sysu.edu.cn/UploadFiles/electrochemistry/2012/3/20...](http://ce.sysu.edu.cn/UploadFiles/electrochemistry/2012/3/201238.pdf) . It's a Chinese paper which talks about Hydrogenated TIO2-PANI as superconductors (Which is what this kid based her _presentation_ off.

</comment><comment><USER3> The only first-hand info I was able to find up to now, anybody has more?

[http://www.intel.com/content/www/us/en/education/competition...](http://www.intel.com/content/www/us/en/education/competitions/international- science-and-engineering-fair/winners.html)

</comment><comment><USER4> I'm so sick of this bogus story.

<comment><USER5> Why do you think it's a bogus story?

<comment><USER6> Because supercaps aren't new and don't have the energy density of conventional lithium batteries, so they're completely impractical for use in something like a cell phone, unless you fancy carrying around a power pack in a backpack.

The fact that the device has only been tested on an LED (which will draw ~40mW) and is being heralded as a cure for slow-charging chemical battery packs which will draw something like 30x that and have to store something like 5.2 watt-hours of juice should be a pretty solid giveaway.</comment></comment></comment>


Artificial Intelligence Has a 'Sea of Dudes' Problem - <AUTHOR> http://www.bloomberg.com/news/articles/2016-06-23/artificial-intelligence-has-a-sea-of-dudes-problem <comment><USER2> Relentlessness and fearlessness are inherently masculine words? So if I want to find candidates with the qualities of relentlessness and fearlessness, I need gender neutral synonyms for these now... Bloomberg I think this is getting out of hand.

<comment><USER3> Without taking gender into account, the word relentlessness sounds more like a negative trait than a positive one. They're someone who's unwilling to deviate from their plan of action, because their plan is to just head straight for the goal.

I'd go with dauntlessness, someone who's dauntless won't let an obstacle stop them, but will go around it instead of through it.

<comment><USER2> That's dodging the issue though... the issue was that relentless is apparently masculine. What if they say the same thing about dauntless?

I don't think relentless has to be as mindless as you say. Someone who gets in the zone and attacks a hard problem 20 different ways until they solve it is relentless in my books.

</comment></comment></comment><comment><USER4> ...and the females seem to be "a lake of Asians" no?

</comment><comment><USER5> It's possible that adding women will fix some things, but that's just one binary aspect of human diversity. The diversity within a team will always be multiple magnitudes smaller than the diversity of the world.

There are already plenty of problems with accents and speech recognition. I recall people's issues with the Sony voice control game Lifeline where people had to fake a Japanese accent to get it to accept commands: [https://www.youtube.com/watch?v=_7TacvYrnjI](https://www.youtube.com/watch?v=_7TacvYrnjI)

Adding women to whatever team made that wouldn't have fixed anything. They'd have had to go out and study other accents and factor them in.

</comment><comment><USER6> anyone else find it somewhat creepy that Siri, Cortana etc. all have female voices/names?</comment>


Show HN: Evernote for sheet music - <AUTHOR> http://www.getprimavista.com

<comment><USER2> Semi-professional musician fairly involved with sheet music here (I made [0], for instance). I was really excited to see this come up.

A few notes:

* It's not obvious at all how to get music into PrimaVista. "Evernote for sheet music" makes me think that you'll have a cute editor available. I signed up to try to find it, but it looks like it doesn't exist.

* So really it's more like "Dropbox for sheet music". That's much less of a value-add for me, but I guess searching and such could be handy.

* Even after I signed up and logged in, the index still showed large buttons for "Sign up" and "Demo".

* The Android link goes to the Play Store, but the Apple link goes to /signup.

* Using an icon of an iMac made me think there'd be a native OS X app.

* Pagination is wrong, which is a pretty serious bug: [http://i.imgur.com/YJPz0xa.jpg](http://i.imgur.com/YJPz0xa.jpg)

* From the screen shown in the above screenshot, there's no way for me to exit the modal. Neither pressing Esc nor clicking outside of it do anything. I had to resort to my browser's back button.

* The page count in the library looks very clickable (since it has the 3D appearance like a button), but in fact is not.

* I found the zooming effect jarring, but I suppose others may find it useful.

* I still don't understand how to edit the metadata for items in my library.

* I could write a separate post on everything I dislike about the upload form.

All of that said, it's easy for Show HN posts to be negative, so I wanted to congratulate you on shipping and make it clear that I think PV could be a very worthwhile product. Best of luck!

[0] - [https://github.com/tsmacdonald/first- collection/blob/master/...](https://github.com/tsmacdonald/first- collection/blob/master/releases/macdonald_collection_ebook.pdf)

<comment><AUTHOR> Thanks for the feedback!

1,2: We don't have an editor. It's more "Evernote for sheet music" than "Dropbox for sheet music" for two reasons:

a. score organization/management with cloud infrastructure.

b. image processing (importing paper scores via the phone's camera) and OCR features that we're working on (not released yet).

Which means it has intelligent features rather than just doing syncing of scores.

3: Those should probably become "Upload" and "Library" respectively.

4: That was a tough call. We wanted to communicate in the landing page that iOS devices are supported (through the web app). If we didn't put the icon, people would think that there isn't iOS support.

5: Got it.

6: Sorry about that, we fixed it.

7: We will probably add Esc as a way to exit the gallery.

8: I can see what you mean.

9: Can you elaborate? You can also try the zoom functionality in the single page view, it's different there. You can turn off split page view in the preferences page (click on your username -> Preferences).

10: You can't do it from the web app at the moment. The Android app is needed to do this (for now). Any edits done from the Android app will get synced.

11: Can you mention some of the things you dislike about the upload form?

<comment><USER2> OCR could be very exciting...I'll be interested to see how that works. That said, I'm not quite sure what the value-add would be. Full-text search isn't super-handy. Searching by musical phrase would be nice, but very hard to make user-friendly. If it automatically parsed out the title and composer that'd also be cool (especially when I upload a 64-tune collection), but from a ML perspective that's not entirely easy.

I wish the website remembered my login.

For my taste the upload form is too cutesy. The faux iPad is a bit much (and makes the site seem very tablet-centric, when in fact it works fine in any browser), there's a lot of real estate devoted to each file and yet somehow they look cluttered, showing PDF in huge letters isn't really necessary when the file extension is shown (and the hover effect makes it seem clickable when it's not), and most importantly there's no obvious way to exit the form—it was a leap of faith to just go to a new page and assume everything had been uploaded correctly. Also, "Remove file" doesn't seem to work—files removed from the upload form (that had already been uploaded) still show up in my library. And then there's no way to delete them from the Web UI.

\---

I realize I have a specific use case, but the ideal for me would be to snap a picture of a tune I have in a music book, have your OCR magic autofill the title and composer, and let me slap some tags on it. Once that happens I'll become an active user up until I have a personal crisis regarding whether I want to pay $9/month for that or not. But as it stands right now, it really does just feel like an unpolished version of Dropbox

<comment><AUTHOR> "Remove file" is a "known issue".

Your criticism is valid (thanks). I'm not sure I understand what you mean by "no obvious way to exit the form" though. Since there are progress bars and checkmarks, what else would you suggest to indicate that uploading is done? There's also a counter at the navbar.

What you described in the last paragraph is our current focus. It's not easy but we think it would be very useful.

What do you think about OMR (Optical Music Recognition)? Would you find it useful in any way? For example a use case would be to snap a picture of a score and have it played back.

</comment></comment></comment></comment><comment><USER3> If this were more like Spotify for sheet music, I'd pay for it -- instant access to music for any published song is valuable. Otherwise, I'm not sure how it's much better than dropbox and PDFs.</comment>


Theranos Statement on CMS Findings - <AUTHOR> https://theranos.com/news/posts/theranos-statement-on-cms-findings <comment><USER2> > The clinical lab is just one of Theranos' many opportunities to provide > access to high-integrity, affordable and actionable health care information, > and the company will continue to carry out its mission under the leadership > of its founder and CEO, Elizabeth Holmes.

It looks like they are still firmly in denial. Fairly incredible at this stage, it makes you wonder what it would take to get them to wake up.</comment>


Show HN: Twiverse – Find Twitter users and get more followers - <AUTHOR> https://twiverse.com <comment><USER2> This is a fantastic idea. Ignore the negativity, particularly from the "what about the men" comments.

Super cool!

<comment><AUTHOR> Thank you! I try, but it upsets me people feel this way. I made the platform to help users open their minds more, and it seems the people who should be using it are just hating on it.

<comment><USER3> As someone who has to deal with groups on the internet often (I'm a moderator here), I know how upsetting that can feel. May I offer a tip? Try to remember that the vast majority of the community isn't reacting this way. It's just that most people don't comment.

When you post to HN or elsewhere on the internet, you're broadcasting to a large crowd. Somebody somewhere is probably going to get triggered—that's just statistics. But when it's a public forum, those are the ones who show up to vent their spleen. So comment sections are weighted towards these sorts of reactions, not because they represent the community, but because it's a self- selecting, biased sample.

This leads to the community seeming a lot more negative than it is, which sucks. The only solution I know of is to give more attention to the other data you have: e.g. the upvotes, and any traffic to your site. That's a challenge, because we're hard-wired to take personal communication more seriously, and comments feel like personal communication (though really aren't).

<comment><AUTHOR> Thank you, I shall try to think more like this. Indeed I am focusing on a minority here - I had great success either way with >700 users, >4K views and $420 from supporters in just 1 day. I should be more grateful of that, instead of focusing my energy on closed-minded people.

</comment></comment></comment></comment><comment><USER4> Following like-minded profiles and hope for a follow back is one way to increase your audience. Another is to let your content speak for you.

To make this easier for the little guy I played with the thought of retweet incentivization. This could start as simple as [http://peepmore.43z.one](http://peepmore.43z.one) which I put together in an afternoon. Would be interested to hear what others think if this model.

<comment><AUTHOR> This is interesting. I'll have a look. It reminds me of my platform to find underrated content, also based on a point system (check out 5 links to submit yours. After 50 clicks, your content is archived). It's [https://exposure.cards](https://exposure.cards), if you're curious. Not sure if Twitter is against these kinds of platforms though?

</comment></comment><comment><USER5> This is awesome I've been telling Twitter to be aware of who they follow, now it's a practical solution I can throw at them.

<comment><AUTHOR> Glad you find it useful, then again in this aspect the platform would likely be lacking as it does not allow users to analyse the "diversity rate" of the users they followed. It's certainly a future planned feature, when the platform grows past its 600 users.

<comment><USER5> So far people who checked the gender ratio of their followings (using one of the existing solutions), were most likely surprised (that it's so biased).

Assuming that, I'll tell them to open their following list, unfollow some of the group they're already following a lot, and follow more from Twiverse and its categories, or if the category isn't there, follow intentionally themselves.

it'll balance it up. That's the route I went and now I have a relatively good mix. I can iterate again, and do that again, but this time using Twiverse.

</comment></comment></comment><comment><USER6> Cool project!

One minor question, how much does becoming a patron affect rankings?

<comment><AUTHOR> Thank you! When you become a patron, your profile is displayed in a category on the right sidebar and sticked on the top of every category. A patron user reported an increase of twice her usual daily followers just today, if that gives some reference of its performance. Unless you mean something else by the rankings?

</comment></comment><comment><USER7> I can easily see myself using this, going through twitter recently to prune and replace some of the accounts I follow.

One suggestion if I might? I noticed some of the imagery didn't seem to immediately 'grok' with their topics. For example "Sports" shows a photo of a bicycle propped against a wall in what looks like someone's flat, while "Arts" shows a photo of a basketball court, "Animation" showed a photography studio and the "Comedy" topic has a group shot of business suit types (albeit in a 'silly' pose).

It was a little odd, definitely nothing that breaks the platform but it may help 'discovery' to make images a bit less...ambiguous given the topic they're related to? I think sports and my mind goes to team sports and not necessarily riding a bike to work (the image looks like an average commuter bicycle versus a racing bike) so maybe that's on me to make the mental adjustment when assuming the connectedness of topics.

Otherwise, neat idea and service!

<comment><AUTHOR> Happy you see it being useful.

That's a valid suggestion. I pulled the images from Unsplash (free to use), and needless to say, there's not really an endless assortment of pictures there, so I did with what I found, sadly. It is definitely something to improve upon, maybe I will get someone to do the photography for some of the topics, or alternatively go for a design. In reality I am not exactly fond of the execution of the categories - in the end they're sort of a filter, so I could have simply created a "super-page" where you could have those interests listed as filters, and could have found users sharing more than 1 category. On top of that, currently the platform has a fixed amount of categories, and it does not allow users to add themselves to any other interest, which is a bit limiting and unfortunate. Because of that, in the future I might redo this section entirely, which could help fix the issue you raised at the same time.

Thanks for the feedback!

<comment><USER7> Ahh thank you for that bit of insight, I was wondering if you had gone through the additional trouble of maybe pulling images from each respective topic via hashtag and applied some sort of ML to decide what picture is displayed with what category.

Definitely nothing wrong with the approach you've taken though (and if nothing else, consider the above an idea if you do decide to rewrite that functionality) if it helped ship the product more quickly, like I said-it doesn't break functionality, just a passive observation that may help the user experience later down the line.

Cheers :)

</comment></comment></comment><comment><USER8> This is really interesting and I hope it does well! Are you considering refining the domains at all, like say splitting development and technology into machine learning, devops, webdev, etc?

<comment><AUTHOR> Thanks! It's something I have planned for when the platform is bigger in terms of users. Currently it has 900 (close to 1K, insane for just 2 days!), so if I split the categories more, many would be empty, making it difficult to find users in general. On top of that, more categories means more work for the users to select their desired categories. Overall it doesn't seem worth it for me currently.

What are my future plans in this regard though? When the site gets past 1K users, I will start brainstorming and developing a new way for users to select their categories. Likely through a textbox vs multiple checkboxes, where people could type the areas they are into and they would autocomplete. I'd like to also let users suggest categories, eventually maybe even let them create their own interests. Could be exciting!

</comment></comment><comment><USER9> Why is specifying gender, non-optional? I don't follow, or expect to be followed based on gender but rather by content.

<comment><AUTHOR> You can put "Other" if you don't want to disclose it, but I understand the sentiment. It could be understood as NB / Trans for example, and it could be misleading. I'll keep that in mind for a future revision.

</comment></comment><comment><USER10> Hi Toni. What is the tech stack behind Twiverse?

<comment><AUTHOR> I used PHP/HTML, CSS, Js (with jQuery) and MySQL for the database. The entire platform is hosted in a DigitalOcean droplet and managed using ServerPilot's free plan.

<comment><USER11> I love how "boring" this stack is; great job just shipping the damn thing!

<comment><AUTHOR> Thanks! Truth is I am not really a developer myself, I am actually a designer, so my knowledge might be a bit limited in this aspect. I did want to develop the website in ReactJs, but I ended up not doing it because initially it was a 1-week project I made to get accepted at a university (& it worked out), so I went for the "easiest" way possible for me, which is also the quickest.

</comment></comment></comment></comment><comment><USER12> Absolutely great idea. I saw this on Indie Hackers too. I have also played with your Product Hunt previewer. Your work ethic and output has inspired me to step my game up. Keep up the good work.

</comment><comment><USER13> How did you gather these Twitter users?

<comment><AUTHOR> As to be as compliant as possible, Twitter users have to connect their accounts manually and select multiple data in regards to their interests, gender identity, and much more, which is complemented by the data gathered from the Twitter API (language, verification status, followers, following, tweets, likes...).

</comment></comment><comment><USER14> To be a place to find users from "different backgrounds" it looks to me to only show the political bias of the author.

Correct me if I am wrong, but the only sanctioned different background seems to be "POC" (what does that even mean), "LGBTQ+" and "with disability".

The home page sports a "check 1.000 inspiring women" but not a "1.000 inspiring men". I guess only inspiring women are worth following.

But actually they don't even need to be inspiring, since they also have a "random women" section. I thought propping up some people based solely on their gender was sexist. I guess it's not when we do it for women.

Also, a fairly glaring omission in the topics seems to be religion. And I say it as a non believer. It looks like non-religious people won't be allowed to look for someone with a different background.

In the end, the site is yours, and you can of course list, or not list, whomever you please. But the claim of discovering people from "different backgrounds" seems to me disingenuous at best.

More accurate, given the current content, would be "a few, politically- sanctioned backgrounds".

<comment><USER15> Well done on slamming the 18 yr olds first product. This is very clearly the first release of a product and it is definitely targeting a slice of the functionality, but that's just good sense right.

Get it out there for people to try and give feedback on.

I appreciate the effort and thinking that has gone into a product like this.

Sure there are a whole bunch of features that I would love to see added but I'm sure that will come with time.

The fact that it targets PoC, LGBTQ+ and Women is a fantastic start. I remember an article that went around on HN a while back that analyzed the gender balance of twitter follows, and the results were not good.

Working on diversity in tech and on twitter and highlighting women over men is not sexist, it's pushing the needle back in a direction that it needs to go in.

Men are not default.

<comment><AUTHOR> Thank you. I have to admit though this is my 5th product this year, I'm on a roll, so I do accept criticism - indeed though I felt that the parent comment was just plain wrong in this case.

<comment><USER15> Oops, how presumptive of me.

</comment></comment></comment></comment><comment><USER16> How "different" a person is has little to no influence on how good their content is. Being "diverse" doesn't make you great. Being _great_ makes you great.

Instead of showing who people are upfront, show their tweets without their identities attached, and let people follow based off of that. Anything else is just a diversity virtue signal.

<comment><AUTHOR> Sounds fair. I don't like judging people by their physique and identity indeed, and I think most people would agree with me on this. Taking this into account, your point makes sense - why focus on showing different people based on their identities entirely?

There's a couple reasons as to why I believe that it makes sense in the platform. To begin with, the concept that started off this project 6 months ago was simply to make women more present in people's following lists. This was an entirely identity based project from that point, attempting to increase & amplify the voices of a particular group. Needless to say, with a concept set up & validated, I kept going in the same direction.

Secondly, while some of the filters of the platform are identity-based (ethnicity, gender, LGBTQ...) I also implemented multiple based on their background (low-income, migrants, language...) as well as based on their interests. I plan on expanding this group further, as I find it extremely valuable to better diversify our feeds. There is much more other than whether someone is a man or a woman, a person of colour, or a person with disabilities.

There is a third reason, one which I might not be too fond of, but thing is, in order to achieve diversity, people tend to prefer going about it through people, faces, and real identities. As a rather "private" and ambiguous person online, I've noticed how hard it has been for me to have recognition or validity, since all in all people can just judge me by my work and ideas. Had I gone this path with the platform, it would have likely failed, and I could have not contributed to solving this issue.

All in all, your idea is good in an ethical perspective, but when it comes to its implementation, it's absolutely useless, unless you change people's mindsets (very hard, specially because you also have to change some people's mindsets in terms of diversity already...). Then again I will see if I can implement something like this in the future, I think I might be able to figure something out. Thanks for your insight!

<comment><USER16> Your platform is not changing minds. It's reinforcing beliefs. Beliefs that say who you follow is more important than what you follow.

If a _racist_ reads some amazing tweets they find interesting and later discovers they were written by members of races they don't like, that could change a mind.

If a diversity fanatic reads some great tweets and later discovers they were _all_ from straight white males while the boring ones were from a _very_ diverse group of individuals, that could change a mind.

But if all you do is provide a way for diversity sensitive people to pad their following lists with socially approved diverse individuals, you're not changing anything. You're giving people a way to pat themselves on the back and feel like they are doing their part. You're building new cliques and organizing new armies for future social media wars.

<comment><AUTHOR> Okay, that last paragraph really got me, is that really what you think diversity-concerned people think about diversity? Filling a quota, being politically correct... I beg to differ. While it's true there's always the kind of people who are part of a "hivemind" (there's those everywhere, blame the media, trends and multiple other sources), most people are aware of the true issue behind the topic - it's a matter of putting yourself in the shoes of the minorities. The problem is simple, say you are a trans woman of colour, from a low-income background & a migrant. Do you think their opinions are taken seriously, they are socially accepted in general, people don't hold any prejudices against them, and most importantly, they have a voice? Don't you think that oftentimes, people who are not the "norm", come from backgrounds different to yours or are simply of the other sex don't get as much value or visibility as say, a white american man? Sure enough recent diversity efforts have turned that around a bit, but I still think that for several groups, almost nothing has changed. I strive to make lives better for everyone, and I think that this issue in particular, were it solved, would help a lot the underprivileged. What about their ideologies, their thoughts, what if they are terrible people? This happens, but I still support allowing them to have a "basic dignity" to work upon. Overall, I just seek equality, that is all.

<comment><USER16> I think the diversity-conscious will look at a statistic such as "80% white men, 20% everyone else" and see that as a problem to be corrected rather than as the natural outcome of a complex series of events compounded throughout many generations. Absolutely.

Straight white american males are so _boring_ , so _standard_ , so _unremarkable_ in their appearances and their backgrounds that people can't help but focus on what they are saying instead of who is saying it.

These diversity play's that highlight people's status as minorities inevitably fail because they can't divorce who a person is from what they want to say. By making us pay attention to who a person is and making us self-conscious about who we follow and don't follow we ultimately distract ourselves from what matters: content.

It would be incredibly grating if I had to be reminded someone was part of an underrepresented group every time I interacted with them, to the point that I would just stop interacting with them because of it.

 _Real_ diversity is not a conscious effort. I've seen it. A bunch of people of different backgrounds come together, work on something, and go home, and no one even realizes or comments how diverse the group is. Nor do they even care. That would be weird. As weird as being in a conference room of white men and blurting out "Hey guys! We're all straight white males!"

I'm curious what the impact on your site would be if you removed all language of diversity and simply presented the people there as interesting people to follow, not even giving the user a chance to realize you are over representing minorities and playing into their guilt of following mostly straight white males. Would your site still receive such acclaim, or would it fold like a house of cards? We'll never know. You'll never know.

</comment></comment></comment></comment></comment><comment><USER14> > I made the category for women after receiving a suggestion from a partner

You are still the one that made the decision to implement a one-sided feature, though, so you considered it worth it.

> so I don't think you are so right to call me out on the supposed wrongdoing.

The "supposed wrongodoing" is highlighting only women in the home page, which you do. It was not about not having other filters.

> Religion & political ideology were 2 filters I wanted to implement prior to > launch but I did not fearing controversy

I wonder why you thought that providing only the categories that appeal only to a minority of people [1] was going to not be controversial.

> the website's core concept is to find diverse users, as in minorities & > underprivileged group

That is not stated anywhere. The home page says clearly: "Search for Twitter users who share your interests and come from different backgrounds".

> men don't happen to be one of those groups

That is exactly the ideological bias I was calling out.

Men make the majority of

      * homeless people
      * suicides
      * people in prison (and get longer sentences for the same crimes)
      * work related deaths (and the majority of the workforce in dangerous job)
      * victims of violence and homicides
      * deaths in war

Women are overrepresented in college degrees, and are the majority in fields like medicine, education, psychology, and the humanities.

The "pay gap" is a myth, since the difference in average earning is driven mainly by life choices and not by discrimination. The same is true for the lower percentage of women in tech.

The idea that men are a "privileged" category is just ideology, like anything that prescribes a common characteristic to a broad group. And the idea that "POC" think differently that "white people" is, frankly, racist.

[1] [https://www.theatlantic.com/ideas/archive/2018/10/large- majo...](https://www.theatlantic.com/ideas/archive/2018/10/large-majorities- dislike-political-correctness/572581/)

<comment><AUTHOR> I'm sorry, I find your comment pretty ridiculous in multiple aspects, and I'm honestly surprised you truly feel this way about the platform.

What I understand from it, and the parent comment, is that you're simply stuck in the beliefs of "diversity has ruined men", men have it worse, etc. Unfortunately I might not be able to change your mind, but I hope you understand that the idea of the website was to make groups that were less easy to be found on Twitter (I'll ask, how many women, people of colour, LGBTQ+, people with disabilities and many other groups do you follow? Going to take the risk and say that not as many as men, by a big margin...).

If that upsets you that's unfortunate, I am grateful for the people who were happy with the platform and sent me awesome positive comments. If you want to have a men-centric platform, you may make it yourself, go ahead. It's ironic how you seem to be the kind of person who would have benefited from such a website, getting you out of an echo chamber and seeing multiple perspectives.

<comment><USER14> > What I understand from it, and the parent comment, is that you're simply > stuck in the beliefs of "diversity has ruined men", men have it worse, etc

No, don't put in my mouth words I never said.

I never said "diversity has ruined men". There is nothing in what I write that is even close to that. That's even a meaningless sentence for what I am concerned.

I also didn't say that men have it worse. They don't.

You are the one claming that women have it worse. They don't.

Some people have it worse, and they happen to be men and women. Some people have it better, and they also happen to be in both categories. So do people that face discrimination.

I am simply refuting is your claim that women are "underpriviledged". That is not true in any measurable way.

> If you want to have a men-centric platform

I don't. Where did I say that?

I only said that you provide narrow, politically-correct categories. The opposite of that is not reversing them and privilege another group. The opposite of that is to give everyone equal treatment, which you don't.

> I'll ask, how many women, people of colour, LGBTQ+, people with disabilities > and many other groups do you follow?

Why should that even matter? Do you want to follow more women? Great, go on. Do you want to make a site for people that want to follow your specifically discriminatory categories? Please, have a go. But don't claim it's something else.

The ratio between the men and women I follow on Twitter, for what matters (which is 0) is pretty even. I follow them because they are individuials that have something interesting to say, not because of their gender or their skin color.

Why should I follow more (or less) people of color? Do you think they are different from white people? Do they all think the same to justify me following them just based on their skin color? Isn't that racist?

LGBTQ+ people and disabled people are a small percentage of the overall population. Why do you think they should have a higher number in the people I follow? And again, do they think differently from people not in those groups?

You can discriminate all you want, but you can't seat on the side of the "underrepresented".

<comment><USER17> >You are the one claming that women have it worse. They don't.

I don't see anybody arguing this. The most popular Twitter accounts are of white men, so someone built a tool to find the Twitter feeds of not white men.

By definition the app is to help find underrepresented people (on Twitter).

I'll be honest, your comment comes off as extraordinarily angry for what we're talking about here (someone made an app to help showcase certain minority Twitter accounts). Nobody's suggested the United States Constitution should be rewritten. Nobody's made value statements. So where's all this (I'm seeing) anger coming from?

<comment><USER18> FWIW - that's factually untrue, white men are actually a minority of the largest twitter accounts: [https://friendorfollow.com/twitter/most- followers/](https://friendorfollow.com/twitter/most-followers/).

There's nothing intrinsically wrong with showcasing accounts from underrepresented groups in technology or otherwise. The anger comes from being able to claim what is and what isn't diversity.

Women / people of color are underrepresented on executive management and boards of directors in tech. Guess what? So are Republicans... even moreso than the former. But diversity, as politically defined, only seeks to help the former.

That said, to the OP, great site, great design, and great video.

<comment><USER19> _white men are actually a minority of the largest twitter accounts_

Sure, but those are all celebrities. People who get on Twitter and follow mostly celebrities don't need this tool. But if your Twitter interest is mostly about an area of, say, software development and you start following popular people who tweet about it, you're likely to end up following 90% (made up number) white men unless you go out of your way to prevent it.

</comment></comment></comment></comment></comment></comment><comment><USER14> What if the person that needs to open her mind is you in this case? Did it occur to you that that might be also a possibility?

<comment><USER3> You already made your point at length and with considerable energy, I would even say aggression, elsewhere in the thread. Now you're hounding someone. That's not cool. Please stop now.

We detached this subthread from [https://news.ycombinator.com/item?id=18522177](https://news.ycombinator.com/item?id=18522177) and marked it off-topic.

</comment></comment><comment><USER20> By default the Bio is collapsed. So I am supposed to follow people because of their gender, sexual orientation or disability, in order to have a more diverse Twitter feed?

That is some major virtue signalling right there. If that is how you define diversity for yourself you are mistaken. I can surround myself with 50 POC and 20 LGBTQ+ people and still gain no diversity of thoughts.

IMHO it would be far better if you handpicked people, asked them questions (short interview via Twitter) and then portrayed their profile on your website. Of course you should select users by some algorithm that optimally doesn't adhere to your pretty obvious political bias.

<comment><USER17> >I can surround myself with 50 POC and 20 LGBTQ+ people and still gain no diversity of thoughts.

If you only ever follow one certain demographic, this tool could be useful to find some other demographics to mix in. You may not get difference of, say, political opinions, but you will absolutely get different _perspective_ on things.

Wanting to have gay people on your Twitter, specifically, doesn't nullify the fact that there's diversity amongst white males. Nobody's community is being threatened by this app. It's just a way to mix it up.</comment></comment>


Ask HN: Java or .NET for a new big enterprise system? - <AUTHOR> I work at a company that has a big (in development for about 7 years) and critical system developed in PHP (PHP 5.3 without frameworks and a few base libraries (AdoDB, NuSoap, Smarty)). It is a monolithic application with many SOAP webservices, a big MySQL database (main table has 33M rows) and a number of background services (crontabs running some shellscripts that calls a php program). We want to improve that base (the technical debit is already really big) or develop a better one if economically viable.
Other facts: - we use the PHPStorm IDE (so IntelliJ is an option here if we are talking about Java), but I believe that Visual Studio or Eclipse are both really capable. - the system needs to be reliable AND easy to maintain (rapid development is desirable but is a minor feature compared to the availability and maintainability of the system); - we use version control (GIT) and Continuous Integration (Bamboo and Stash from Atlassian)
About Java:
 - what are the best production monitoring tools for a JVM in production? Does .NET have something comparable?
 - about interface: it is more productive to use JSF for interface (Java) or it is best to use a framework like Spring Boot?
 - does Hibernate scales? It is a pretty vague question, I know (we actually use plain SQL without abstractions in our system)
 - application servers: is Glassfish ready for production or it is better to use something more "robust" like jBoss?
 - anyone has some experience with Oracle Cloud or another Cloud to host Java apps?
About .NET:
 - is Visual Studio it REALLY good compared to all other IDEs?
 - Scalability: Stackoverflow uses the .NET stack. Are there any other big sites that uses it?
 - Price: Are the current licensing prices on Windows Server affordable for medium companies?
 - Future: does .NET have a future that we can trust looking forward 10, 12 years ahead?
Any feedback, experience or consideration is really appreciated and will impact our decision. <comment><USER2> Personally I'd say .NET, but I've got a windows development background.

On many angles (open-source project count, speed of most-optimized code, etc) I think Java is clearly ahead - however on many other angles, I think .NET wins.

C# is a much nicer language to program with, having all kinds of nice things like type inference, async/await, generics that work properly, proper closures, anonymous types, LINQ, and other things that Java doesn't have, and probably never will.

I also think the memory and disk footprint of a .NET server application is likely to be a lot lower than that of Java - In my company we have some REST api's written in C# running on windows, and some comparable REST api's written in java, and the C# ones consume about 100MB of RAM compared to over 1GB for the Java ones. The java programmers tell me this is a side effect of the open source project culture - A typical .NET service might pull in half a dozen third party libraries whereas a java service might pull in dozens.

.NET Core running on linux I find to be _really_ interesting - it's just as fast as the windows one, if not faster, and uses a comparable amount of memory (I.E. still heaps less than java) - I'd go with that if I were starting today. Yes it's very new, but remember the core parts have been battle-tested in .NET for windows for over a decade, so it's not _that_ new. Also if you're developing a big new enterprise system I'd guess your timelines are in the multi-year range. .NET core is going to have a long time to mature before you need it for production critical systems.

Looking further ahead, to be honest I like the look of .NET more than Java as well. C# 7 ships very soon with a bunch of nice language level features, and microsoft are really pushing forward with .NET core and making a lot of improvements. Java on the other hand is moving a lot more slowly, and since Oracle purchased sun there has been a lot of noise in the java OSS community about Oracle abandoning large parts of it and basically letting it fall to bitrot.

P.S. As much as I like Visual Studio, IntelliJ is a lot better... Just make sure you've got heaps of RAM :-)

</comment><comment><USER3> That depends on dev current skill in each language. Both languages are very similar. But .net is far better ^^

Comments pointing out that java is open sourced and has multiple libraries and tools written by community makes my giggle XD. Most of .net world is open sourced now. Just check github. Believe or not, but .net also plenty tools/libs, which in my opinion are far better. In .net world there is usually, one outstanding piece of code which has a lot of love from community, while in Java there are sometimes dozens for same thing and it is just personal choice to pick one of them.This sometimes a big problem, because it harder to find employees with expertise of these particular(sometimes very niche) tools your company use in every project.

Eclipse and NetBeans compared to Visual Studio are just advanced notepad. Creating and debugging a new project is just 1-2 clicks. Deploying? 2-3 click and it is hosted in azure cloud.

There is a lot of support from Microsoft Microsoft care. Microsoft listen. Microsoft has program for new companies (bizspark). It gives the access for all MS software for free. As far as I know. Orcacle can only give you a law sue and don't give a damn at all about community. All MS product are based on .net used by millions There is now way it disappear any soon.

Windows Licensing costs comes to none if you host your apps in azure cloud which is great for any size of company, but small and medium benefit most. Moving our client app to azure saves him 30k euro per year.

</comment><comment><USER4> Out of those two choices, Java easily wins. The open source tools & libraries for it make .NET's pale in comparison.

Regarding frameworks/strategy, I'd recommend you try to go vanilla java for as long as possible and stay away from all the frameworks you mentioned, like JSF, Spring Boot, Hibernate, JBoss, etc. Because dependencies.

AFAIK, none of the ones you mentioned offer a really compelling value proposition, but they will all bring along their constraints. That is unless they you have some really specific requirement in mind to justify adopting one of them.

For general stuff like REST or M2M you might want to look at DropWizard or grpc. If you want to go shopping for replacement libs, here is a list of some general libs that someone made: [https://github.com/akullpp/awesome- java](https://github.com/akullpp/awesome-java) You could also try doing a general search on github.

<comment><USER5> I can not agree. Java does well in some aspects of your request and .Net is better in others.

Java does a longer history with Open source, but .Net Open source projects are growing. .NET now targets Linux and Android.

.Net is much easier to get working out of the box, but Java may have cheaper toolset.

It really depends upon your target team - if you are in Silicon valley, then Java. NYC, then .Net

</comment></comment><comment><USER6> I would consider Java more due to pricing, community, and long term stability. I'm not criticizing .NET on those areas. My experience has showed that. By the way, feel free to email me. I don't mind bouncing off ideas with you. :)

PS. Not trying to sell you anything. Just happy to help.</comment>


Interpreting popify.me test results of yesterdays HN exposure - <AUTHOR> http://codeartists.posterous.com/interpreting-popify-test-results-of-hn-exposu

<comment><AUTHOR> This is a little back favor to the community of HN which helped a lot with feedback yesterday. Thank you all for helping, this post describes our experience with testing the Popify site.

</comment><comment><USER2> What about returning users ? Do you see any traffic today ? This should be a little viral too if ppl start puttin oupons on their webpages ?

What technology do you use ?

<comment><USER3> We use PHP/HipHop/Redis and nothing else. The server can do 1500req/sec.

The traffic today is about 30 users per hour without additional exposure. We'll do a proper PR campaign in a few days but have some user requests to implement right now.

</comment></comment><comment><USER3> It is also a story how these things should not be done. We locked ourselves out of HN with noprocrast when needed to answer the comments here.</comment>