Open-sourcing Magma to extend mobile networks - <AUTHOR> https://code.fb.com/open-source/magma/ <comment><USER2> Facebook internally considers the social network to be their major asset, not their technology. This is very different from other companies, for example Google who build proprietary technology, and generally keeps them that way, but may give away things other than core technology.

Any investment in open technologies or internal (which can be publicly released) technology which make the network effect stronger is considered important.

(I'm an ex-FB engineer and program manager)

</comment><comment><USER3> Seems to be only the IP side. You have to glue the gateway to yr physical infrastructure yourself.

Looks like more of "MVNO in a box" than an infrastructure software for a company with real network.

Is FB "seeding the field" before going into mobile networks themselves?

I noticed that FB and mobile phone companies offering "free facebook" are all in a borderline antagonistic relationship because messenger kills their revenue, and they want to bill FB an arm and a leg for that.

They may well be planning to sideline physical network owners with that, by propping MVNOs, and forcing physical network operators to turn into plain ISPs.

<comment><USER4> MVNOs are usually on tight margins, and they usually don't have much bargaining power against their parent network. So it's not unlikely for a network to price in some anti-messenger effects.

And from personal experience, there are hundreds of ways for an operator to screw you over technically without ever breaching a contract. 2 week delays between answering support emails? Standard. 1 month to add an IP to their firewall? It happens. Letting you know 3 days before a certificate expires? Why would they ever let you know before then?

<comment><USER5> Google Fi seems to be doing OK. I have been wondering why Internet Giant don't innovate in this space for a long time. Majority of the Internet is now Mobile, Google owns the Edge DC for Data Processing. Network for Traffics, it could essentially be the backend of these MVNO and let the parent Network do the Last Mile Work, Telecom Infrastructure, Leasing etc.

As for Apple it could provide Visual Voicemail ( Yes I like that feature ) and other type of Added Value Services. As well we iTunes Credit within Monthly Bill payment.

And yet as far as I can see, most ISP or MNO don't care about your route performance, nor does it care about any Services that improve User Experience. On one hand they don't want to be Dumb Pipe, on the other they are actively acting like one. And not a very good one either.

</comment></comment></comment><comment><USER6> More news from WMC: [https://code.fb.com/connectivity/mobile-world- congress-2019/](https://code.fb.com/connectivity/mobile-world-congress-2019/)

</comment><comment><USER7> Anyone got a link to the repo?

<comment><USER8> [https://github.com/facebookincubator/magma](https://github.com/facebookincubator/magma)

<comment><USER7> Thanks Jim!

</comment></comment></comment><comment><USER9> As they've said in their post, this is really for carriers. On the surface it sounds great. But are there any guarantees that Facebook won't insert code in there eventually to start doing analysis of everyone's internet traffic on those networks? Or giving wholesale surveillance data to the governments in some of these countries?

We've seen that companies like Facebook are like out-of-control drug addicts when it comes to our data, even sucking up data about people's menstrual cycles without their knowledge.

They always wrap this kind of stuff in "changing the world" rubbish language. But we see time and again that behind the shallow marketing, are nefarious motives.

<comment><USER10> >> But are there any guarantees that Facebook won't insert code

Kinda hard to "insert code" into an open source product without everyone knowing.</comment></comment>


Ask HN: Do any netbooks still exist? - <AUTHOR>

I guess I missed the boat here.  It seems everyone stopped making netbooks, and now I could really do with one.  The only thing I can find is made by Asus - http://www.amazon.com/ASUS-1015E-DS01-10-1-Inch-Laptop-Black/dp/B00BQH8QTI - but it uses a (power hungry) Celeron.  Asus have other (Atom) versions on their site, but they all seem to be unavailable (at least for online purchase).  Anyone have any suggestions?  I want something that is cheap and small, with keyboard, for travel. <comment><USER2> It depends where you live. There are certainly new netbooks available in the UK from, for example, Amazon.co.uk. Asus and perhaps others still supply them in markets where there is demand, but I guess those are mostly poor countries.

Asus Eee PC X101CH 10.1-inch Netbook (Purple) - (Intel Atom N2600 1.6GHz, 1GB RAM, 320GB HDD, LAN, WLAN, Webcam, Integrated Graphics, Windows 7 Starter) First available 30 Oct 2012 [http://www.amazon.co.uk/Asus-X101CH-10-1-inch- Netbook-Purple...](http://www.amazon.co.uk/Asus-X101CH-10-1-inch-Netbook- Purple/dp/B00A15DDKS/)

However, the netbook specification is very limited (by Intel and Microsoft), and you get better screen resolution and more memory by buying a very slow laptop. This very slow laptop may even be called a "netbook". However, if it uses an AMD chip (ie not an Atom), then it is not bound by Intel's netbook specification.

This is basically a netbook with an Atom-speed AMD CPU:

Acer Aspire V5-121 11.6-inch Laptop (Blue) - (AMD C70 1GHz Processor, 2GB RAM, 320GB HDD, LAN, WLAN, Webcam, Integrated Graphics, Windows 8) First available 17 April 2013 [http://www.amazon.co.uk/Acer-Aspire-V5-121-11-6-inch- Laptop/...](http://www.amazon.co.uk/Acer-Aspire-V5-121-11-6-inch- Laptop/dp/B00CFHP6FU/)

The price difference is £13 ($21) which gets you Windows 8 instead of Windows 7 Starter, and 2GB instead of 1GB of memory. Weight is the same (998g vs 1kg).

Microsoft basically killed the netbook market when it stopped selling Windows XP Ultra Low Cost PC edition for peanuts ($15 or less). Windows 7 Starter was offered very grudgingly at much higher cost, and I suspect most netbook buyers would prefer XP.

All the OEMs knew this was coming. Microsoft said the ULCPC offering would be "available until the later of June 30, 2010, or one year after general availability of the next version of Windows." (ie Windows 7) [http://www.microsoft.com/en- us/news/features/2008/apr08/04-0...](http://www.microsoft.com/en- us/news/features/2008/apr08/04-03xpeos.aspx)

<comment><USER3> Silly computer manufacturers still haven't figured out that they can preload Ubuntu for $0 per device... :P

<comment><USER4> Silly customers won't buy them, unfortunately. It has to be Windows7 or OSX, everything else seems to be a deal breaker.

No offence here, i'm a linux user myself. Everywhere i go and look all i can see are macbook{air,pro} and i can't really understand why anyone would go with such a cage.

<comment><USER5> How is it a cage? What can't you run if you owning a Macbook {air,pro}? (Especially with VirtualBox + Linux on it(!)).

</comment></comment></comment></comment><comment><USER6> A used 11" macbook air also fits your requirements. It runs windows or linux just as well as mac os x

[http://www.ebay.com/itm/Apple-MacBook-Air-11-120GB- Flash-4GB...](http://www.ebay.com/itm/Apple-MacBook-Air-11-120GB-Flash-4GB- RAM-1-6-GHz-Intel-Core-2-Duo- Late-2010-/181201945728?pt=Apple_Laptops&hash=item2a307a4480)

</comment><comment><USER7> Don't write the Celeron 847 off - it is actually quite efficient! Sandy Bridge has quite good (not Haswell good) idle power consumption, and it's performance is much better than Atom.

And if you're running Linux, you need to avoid the Atom N2xxx at all costs, the graphics are useless. The C847 graphics are good for desktop use (but not for anything more than light gaming)

If you're worried about battery life and heat, trade out the HD for an SSD right away. I did that with an Acer Chromebook and it's quite nice - and the trade will probably make up for any increased CPU power draw at idle.

</comment><comment><USER8> What about a Chromebook? The Samsung version costs $250 (and there is an Acer model for $199).

[http://www.google.com/intl/en/chrome/devices/](http://www.google.com/intl/en/chrome/devices/)

<comment><AUTHOR> the ubuntu on chromebook thread is what made me ask here, but the chromebook isn't a 10" screen, is it? i thought it was much larger. but i will check your link - i didn't realise there were multiple models.

[update: the acer and samsung are 11.6" and i can find a bunch of similar notebooks with that size screen. what i really wanted was a 10" screen. but thanks!]

<comment><USER9> Okay, if you want 10" screen that's a bit hard to find, but "netbooks" were never limited to 10" screens (11.6" was a fairly common screen size for products sold as netbooks.)

The role seems largely to have been taken over by Chromebooks -- Microsoft never really wanted the market to exist and the hardware vendors seem to prefer having an OS vendor to work with. But among notebooks (including ones that are similar to netbooks, whether they are sold as "netbooks" or not) 10" screen size seems to have died off because at that size, the preference is for tablets (possibly with keyboard cases to let them be used like a netbook) rather than traditional notebook form factor.

</comment></comment></comment><comment><USER10> I have an HP Mini that I absolutely adore. I've upgraded it to Windows 8 (thus losing the limitations of the Starter Edition 7). I also upgraded the ram to 2 GB which was cheap.

I started using it to do wearable computing experiments and found that the self-protection system of the hard drive would go into action whenever I went faster than a slow walk, so I replaced the HDD with a SSD.

The new Windows 8 store and all of those apps don't work on it because the screen size is too small, but the desktop is fine for web browsing, Cygwin, etc.

If I fold the machine up and use it to play music, do GPS navigation and some other data collection in the car, it runs 6-7 hours. I get 4-5 hours of tablet-like service if I use it to watch video. Even though the screen is not HD resolution it plays HD files just fine.

</comment><comment><USER11> There are bound to be overstock netbooks that never sold available on ebay. But if you're asking does anyone make them anymore, No. Tablets killed them.

<comment><USER12> > No. Tablets killed them.

I'd argue that Microsoft and Intel killed them with their arbitrary restrictions on what could be a netbook.[1] I imagine they realized netbooks would put a huge dent in their sales of more expensive systems, so they effectively put a stop to them. I'm sure tablets didn't help at all, but the limits kept netbooks just below the edge of usefulness in many cases. So they developed the reputation of being slow and people stopped buying them.

[1] [http://www.itexaminer.com/microsoft-adds-to-atoms- restrictio...](http://www.itexaminer.com/microsoft-adds-to-atoms- restrictions.aspx)

<comment><USER13> I highly doubt that had much, if anything, do with the netbook's decline. From the beginning it was just a cheap, small laptop. Tablets are as cheap, smaller, and run operating systems that are designed for low-power systems, so they feel faster. The few people (e.g. me) who actually wanted a keyboard moved on to low-end ultrabooks.

<comment><USER14> MSFT certainly didn't help. For example, a lot of netbooks were packaged with Windows 7 Starter, a seriously limited version of Windows.

I'm skeptical that the hardware couldn't handle full Windows (because Starter also provided an Anytime Upgrade option), so it seems likely this was an intentional decision to reduce the features of netbooks at the software level, in order to avoid cannibalizing larger PC's and laptops.

EDIT: link to feature limitations for W7 Starter: [http://answers.microsoft.com/en- us/windows/forum/windows_7-w...](http://answers.microsoft.com/en- us/windows/forum/windows_7-windows_install/windows-7-starter-what-are-the- limitations/422801d5-89de-494d-8cc1-6f4fc21c2ac0)

<comment><USER2> The netbook manufacturers were free to install a full copy of Windows 7 or Ubuntu or anything else they wanted (except Mac OS X, obviously).

They didn't want to install a full copy of Windows 7 because they would have had to pay the full price for it (after the usual discounts etc).

After much argument, they came up with a compromise that had acceptable functionality (to Microsoft) at an acceptable price (to the OEMs).

So Microsoft was helping, rather than "not helping".

But you're right: the aim was to sell netbooks without having too big an impact on more profitable sales of laptops.

</comment></comment></comment></comment></comment><comment><USER15> I'm still using my 5 year old Acer Aspire One, and I've seen them for sale in a few of the big box stores. I paid $99 for mine. (Intel Atom N270, 1GB RAM, 160GB hdd, built-in 3G modem, WiFi)

I've been really happy with this netbook, and the price was unbeatable.

[https://www.google.com/search?q=Acer+Aspire+One+for+sale](https://www.google.com/search?q=Acer+Aspire+One+for+sale)

</comment><comment><USER16> I think most new "netbooks" have been converted into 11.6 form factor to include a proper full sized keyboard. The only real reason netbooks had 10" displays was because intel required it when purchasing an atom (along with their 2gb memory limit). Atoms haven't gotten any real architectural (IPC) changes since their release and Intel has been repositioning the brand/hardware towards tablet/phone devices. Since manufacturers have been freed from the 10" constraint, such most manufacturers have been building larger screened low end laptops which is really what the market wants. As such you might want to reconsider your options. Depending on the architecture of the Celeron, it may actually be faster and more battery efficient than an Atom. The options seem to be:

1/ Deal with an extra inch of real estate

2/ Buy a 7/10" tablet & add a keyboard. Some like the Asus transformer pad includes a keyboard dock. You can also try rooting/chrooting a linux distro onto the tablet all the bells and whistles.

3/ Buy used from e-bay

<comment><USER17> An extra inch of screen diagonal is great, of course. But it usually means an extra inch of notebook. They should just take the old netbook form factor and build in a screen that goes to the edge (keeping the bezel very thin).

Also, I think vendors used the switch from 10" netbooks to what we have now to raise the price tag unproportionally.

They could probably build something with a touch screen, detachable keyboard, HD video playback, all day battery life, that could run circles around every netbook, and sell it at around $350 (or even cheaper without touchscreen, and with a fixed keyboard). Instead, they slap in a i7 and 8 Gigs of RAM, that most people won't use anyway, and sell it for twice as an "ulrabook", because there's more money in "premium"...

</comment></comment><comment><USER18> The tablet has pretty much taken over the netbook niche, it seems, so your options are fairly limited.

I have a Sony Vaio E series 11.6" that I take around, but it's not a great option. For what I do on the road (email, some VS work and Photoshop), it's OK. Unfortunately, it too seems to be going out.

You can still get a fairly decent Acer :

[http://www.amazon.com/B007582KGM](http://www.amazon.com/B007582KGM)

      Acer AOD270-1375 10.1" Netbook (Intel Atom Processor N2600, 1GB DDR3 SDRAM, 320GB hard drive

Or Asus (still with Celeron): [http://www.amazon.com/B00COQK8QY](http://www.amazon.com/B00COQK8QY)

      Intel Celeron 847 1.1 GHz 2 GB DDR3 10.1-Inch Screen and Ubuntu

</comment><comment><USER19> Yep, my girlfriend's mother still has one. It's... slower than you'd want, unless you're used to a pentium 4.

</comment><comment><USER20> Instead of worrying about how power hungry the CPU is, worry about the actual battery life numbers. The 1015E gets more battery life than some other netbooks, and maybe less than others.

</comment><comment><USER3> I actually just recently looked in to the 1015E, and I almost bought one but then decided to get a Samsung Chromebook. My top requirements were battery life, portability, and at least a 1366x768 screen (so that ruled out most 10" systems). The Chromebook is working out really well; its 7-hour battery life is awesome. The 1015E probably would have been OK too, but its battery life wouldn't have been as great. Kudos to Asus at least for loading Ubuntu on the 1015E-DS02.

</comment><comment><USER21> As the Chromebooks are too big, UK ebay shows plenty of second hand and some new/refurbished 10" netbooks (usually 1024 by 600) around with XP.

Linux works fine on most makes. I have a Samsung NC10 with mechanical hard drive and a surprisingly good keyboard that just chugs away endlessly, but the NC10 seems to develop screen 'jitters' as the hinges age.

</comment><comment><USER22> There are still a few netbooks available on amazon. For example this Acer 10". [http://www.amazon.com/Acer-AOD270-1375-Netbook-Processor- Esp...](http://www.amazon.com/Acer-AOD270-1375-Netbook-Processor- Espresso/dp/B007582KGM/ref=sr_1_2?ie=UTF8&qid=1377441864&sr=8-2&keywords=netbook)

</comment><comment><USER23> These might help:

[http://www.reddit.com/r/netbooks](http://www.reddit.com/r/netbooks)

[http://www.reddit.com/r/suggestalaptop](http://www.reddit.com/r/suggestalaptop)

</comment><comment><USER24> I am pretty sure I have seen a 10-inch netbook recently (less than one/two months ago), maybe on Engadget.

Otherwise there is still the tablet/keyboard combo.

I liked the netbook form factor; I am still using my Samsung n220 everyday.

</comment><comment><USER25> Check Sony vaio pro 11. It's weight is even less than 1kg with 11.6" full HD display.

[http://www.sony.co.in/product/svp11213sn](http://www.sony.co.in/product/svp11213sn)

</comment><comment><USER26> I'd like to try Lenovo Yoga: [http://shop.lenovo.com/us/en/laptops/ideapad/yoga/yoga-11s/](http://shop.lenovo.com/us/en/laptops/ideapad/yoga/yoga-11s/)

</comment><comment><USER11> Somewhere in Redmond, someone is gnashing their teeth, muttering, "Why isn't anyone mentioning Surface?" [typo edit]

<comment><USER17> Because the Surface RT 474 € with a keyboard cover+, and it only runs silly Metro apps, making it useless for many people.

(+ Quick check on Amazon Germany (where I live), probably cheaper in the US but still around $450.)

</comment></comment><comment><USER27> Get an hp mini. I have a 210 and i love it. Running ubuntu in case you want to know.

I'm writing this comment on my mini.

</comment><comment><USER28> Plenty of netbooks for sale in Asia.

</comment><comment><USER29> Maybe android tablet + ubuntu + keyboard?

</comment><comment><USER30> iPad with a keyboard-case?

<comment><USER31> The iPad is a consumption device, not good for work. Even with a keyboard, most available applications are geared towards touchscreen and consumption. I much prefer laptops for this reason: they run a desktop OS.

</comment></comment><comment><USER32> Acer One?

<comment><USER21> OP wants 10" screen. The Acer _Aspire_ One that I can see seems to be an 11.6" screen machine.

<comment><USER15> The Acer Aspire One comes in different sizes and configurations.

[https://www.google.com/search?q=Acer+Aspire+One+for+sale](https://www.google.com/search?q=Acer+Aspire+One+for+sale)</comment></comment></comment>


Free e-course–Marketing for designers - <AUTHOR> https://www.invisionapp.com/ecourses/marketing-for-designers <comment><USER2> Oh yeah, I think I got this garbage email in my inbox and realized I have to unsubscribe from their 50 mailing lists.</comment>


John Carmack: React has turned out to be a bigger win than I expected - <AUTHOR> https://twitter.com/ID_AA_Carmack/status/844902854171262977 <comment><USER2> What's the general sentiment towards React here on HN?

In my experience, working with JSX and combining different technologies has turned my productivity into mush. I can pump out massive features much more quickly with more vanilla technologies. But maybe that's because I haven't been patient enough with the learning curve...</comment>


Google Is Bringing Electronic IDs to Android - <AUTHOR> https://venturebeat.com/2019/05/09/google-is-bringing-electronic-ids-to-android/ <comment><USER2> This is a terrible idea. The last thing I want is for an advertising company that makes its living off personal data that they gather about me to be able to reliably link that data to my real identity.

I think that in general embedding legally-empowered digital IDs (in the form of certificates, not pictures of physical ID cards, mind you) in mobile phones is a good idea, but it ceases to be a good idea when your phone and your OS are made by an advertising company with clear incentives to gather data about you, and a solid history of doing so.

<comment><USER3> They already have a payments platform and app store that requires a linking, which is more than adequate for highly targeted advertising.

I really think that civic engagement and petitioning law makers to protect our privacy is the main tool we have to get out of these impending messes.

<comment><USER4> You can use the app store without setting up payments.

<comment><USER5> You can't use the app store meaningfully without setting up payments.

<comment><USER4> Downloading free apps isn't meaningful?

<comment><USER6> Sure it is. I am convinced that a is temporary state too.

Enjoy while you can.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's weird to see all these crutches and half-assed fixes instead of lobbying and other work done to fix the ID situation in the US. It's really unfathomable to me how big of a problem identity theft and unauthorized access to digital systems for a regular citizen is. Especially compared to what for example Estonia has built, where I really do not have to worry about that issue - I have to have my ID card (or my mobile-ID) or I don't have access. Basically mandatory 2FA everywhere important, since about 2002, in my humble opinion it should be about time the US properly fixed the issue.

<comment><USER8> There's a very vocal minority that views any attempt by the government to make any ID proof that the New World Order exists. There's also a pretty decent sized part of the Evangelical movement that sees those IDs as potentially the literal "mark of the beast" from revelations.

Additionally a part of the Republican strategy is to disenfranchise via selectively reducing access to valid existing IDs while cranking up voting requirements of those IDs.

This combo basically means that both Republicans as a whole and the Blue Dogs see it as politically nonviable, which is more than a majority at the federal level.

<comment><USER7> > Additionally a part of the Republican strategy is to disenfranchise via > selectively reducing access to valid existing IDs while cranking up voting > requirements of those IDs.

Can't the goverment provide the IDs to those who are less well off for free- of-charge?

<comment><USER9> Many states, if not all, provide a free non-drivers ID card.

<comment><USER10> Definitely not all. Minnesota's at least is paid. As a non-driver, I decided to skip renewing mine recently and get a passport card instead.

</comment></comment></comment></comment></comment><comment><USER11> I wonder about the due process implications for this at, say, a traffic stop. If you hand a police officer your phone to show them your driver's license, is that implicit consent to search your phone? Will the ID-showing mode be special in that it will allow the holder to see the ID, but the rest of the phone will remain locked?

I like that they're looking for ways to make it so you still have access to ID documents even when the battery is drained to the point that the phone cannot boot, but overall I'd still want to carry a physical card as a backup. And if I'm doing that, I'm just going to use the physical card in most situations where I need it.

<comment><USER12> They mentioned there are ways to access the ID in different ways if needed, i.e. you could allow NFC'ing the ID even if the phone battery is dead, so they will probably have a way to access the ID without unlocking your phone entirely.

Kind of like how you double-tap the power button to turn on the phone camera, but you can't access the phone's photos without unlocking.

<comment><USER13> This is great to hear. Would suck to get a ticket for driving without a license if your phone was dead.

</comment></comment></comment><comment><USER14> Completely off-topic: If you scroll down past the linked article and onto the next article, the URL automatically changes (from _/ google-is-bringing- electronic-ids-to-android_ to _/ cisco-open-sources-mindmeld-conversational- ai-platform_).

I've never seen this type of behavior from a web page before.

<comment><USER15> If you curios how it's done check here:

[https://infinite-scroll.com/](https://infinite-scroll.com/)

<comment><USER14> Interesting. I'm wondering what the benefit of infinite scrolling would be for the site owner. Wouldn't an article site like this want the user to click as many links within the site as possible to re-generate ads?

<comment><USER16> I don't think ALL of the ads are generated when you load the original page. The ads corresponding to the second article are loaded when the second article loads.

</comment></comment></comment></comment><comment><USER17> _> Google would likely launch this functionality with Pixel devices first and then convince other Android makers to play ball. We're easily a few years away from people using their Android devices as IDs._

Any Android announcement that seems useful or valuable is always several years away for most of the Android devices in use.

I read another article about "Project Mainline", which is about getting security fixes quicker to devices directly from Google. That one also had a similar statement.

If Google spent a little less effort on tracking and advertising, and more on making the platform secure and consistent across more devices, that'd be good for everybody (since low priced phones are mostly Android, and are used by people who cannot or do not want to spend a lot of money).

This [1] is an old talk by Christopher Soghoian that still rings true today (with added privacy goofs by Google revealed in the meantime).

[1]: [https://www.ted.com/talks/christopher_soghoian_your_smartpho...](https://www.ted.com/talks/christopher_soghoian_your_smartphone_is_a_civil_rights_issue)

</comment><comment><USER18> Gov issued electronic identification should be treated the same as electronic voting. It's a bad idea. Goes right to kill switches "internet id" etc.

</comment><comment><USER19> I get that Google is very powerful and it lives off of our data and I get how this may be construed as an attack on our privacy but the amount of misinformation and conspiracy theories I am seeing on this thread is appalling. First, Google is just implementing an electronic ID standard that will work as a replacement for traditional paper ID cards. They are also working on a mechanism to display the ID card even when the phone doesn't have enough power to boot.

I don't get the concerns about it being mandatory because you can't expect everyone to have the same set of IDs and besides it's just a convenience feature like storing our membership cards or our emergency contact information in a wallet.

There is justifiable concern over the privacy aspect as we don't know if the IDs are stored locally on the device or if it's synced to the cloud. It will be troubling if it's the latter but criticising Google about this even before the feature has been finalized and released seems perplexing to me.

</comment><comment><USER20> Great, more tech that relies on hardware keystores that will refuse to work after I unlock my bootloader and it blows an e-fuse.

</comment><comment><USER21> This sounds great at first. But I am really concerned about its impact on subscription services and blocking. If economics of it plays right, the apps would now have access to a confirmed unique ID for a device that would allow them to lock support of the service to not only just the number of devices(which is fine) but also the device itself. I am aware that apps can currently use multiple sources to get unique IDs like MAC and others. But they can be spoofed, this if it works would be secured from those concerns.

Maybe(most probably) I am completely wrong in this line of thought. But would love to hear the thoughts of HN folks on this.

<comment><USER14> > the apps would now have access to a confirmed unique ID for a device that > would allow them to lock support of the service to not only just the number > of devices(which is fine) but also the device itself.

I'm not sure I understand the concern. Could you give an example?

</comment></comment><comment><USER22> I think it will be something like this app [https://play.google.com/store/apps/details?id=nl.innovalor.n...](https://play.google.com/store/apps/details?id=nl.innovalor.nfciddocshowcase)

</comment><comment><USER23> With features like these, I imagine secure Android devices with prompt software patches will become even more important in the future (whether or not the people using them realize).

</comment><comment><USER24> Meanwhile in Europe, my phone is already a secure electronic ID equivalent to a government ID card, as a plain old Android app.

</comment><comment><USER25> would be interesting to see what the counterfit measures are. could a kid with photoshop buy beer with their phone? or would there have to be some kind of corresponding tech on the POS to verify the ID? that sounds peachy.

</comment><comment><USER26> Is there a way to opt out of this or should I buy an iPhone?

<comment><USER27> Most likely, it will be added as a per-app permission like everything else. Like location and contact information, there will be apps that use dark patterns which ask for this by default and just bank on enough people being lazy enough to just click through when they install FlappyBirdsGo2020.

Google will shrug its shoulders and blame its users for not being responsible and for 'bad actors' who were in no way enabled by the Goog's primary objective of maximizing its stock price.

</comment></comment><comment> crooked-v Cool. How long until they shut it down with one-month notice? If it was Apple I'd feel reasonably confident that it would be around for at least a couple of years, but even in the ID/payment space alone Google has kept rotating through different "wallet" solutions multiple times.</comment>


Apple Still Holds the Keys to Its Cloud Service, but Reluctantly - <AUTHOR> http://www.nytimes.com/2016/02/22/technology/apple-still-holds-the-keys-to-its-cloud-service-but-reluctantly.html <comment><USER2> You can still back up your data on your computer encrypted. Something the article failed to mention.</comment>


The Secret Shame of Middle-Class Americans - <AUTHOR> http://www.theatlantic.com/magazine/archive/2016/05/my-secret-shame/476415/?single_page=true <comment><USER2> Reading the comments section on the Atlantic site was depressing. Judging other people's choices without understanding psychology or human nature seems to be a time-honoured American sport.

The author's whole point is that he belongs to a large category of people with the same affliction. If the socioeconomic system of a developed and very wealthy country leads to this outcome for 47% of its people, the proper response is not to nitpick the author's life choices. I find this sort of hypocrisy is strongest from the notionally conservative types who claim to be excellent financial planners and managers of money. I'd like to see them hold up a mirror to their own financial choices for thirty seconds. It turns out we're all idiots because we spend on things we find important and subjectively value--things others don't value and don't find important, and will call you an idiot for prioritising.

"A decent shot at a good station in life--but only if you've been an inscrutably perfect angel" is not too different than the promise offered to us back home in my native USSR. Supposedly, American capitalism is supposed to be an improvement over that.

Finally, the author did not recommend a specific policy response, such as taxing the rich and redistributing their wealth his way. If anything, it seems that his professed ethos would lead him to turn that down. So, I don't know why the Trumpers are out in full force acting like someone's proposing to tax them and give their money to this guy.

</comment><comment><USER3> I wonder how much financial illiteracy is really a contributor to people's poor financial situations. I'm much more interested in personal finance than the average person (I took a class at university, enjoy pf blogs like mr money mustache) but I still struggle with having the self discipline to adhere to correct spending behaviors. As an american, you're constantly being assaulted by marketing to get you to buy stuff, it eventually starts to effect you.</comment>


Will JetBrains ever make a free WebStorm Community edition? - <AUTHOR> https://intellij-support.jetbrains.com/hc/en-us/community/posts/360006724940/comments/360001437059 <comment><USER2> TL;DR: Unlikely.

"The only product that is better than VS Code is WebStorm, but sadly you have to pay for it" \- TANSTAAFL. Perhaps it is better because the team doesn't waste time grovelling for donations, or maintaining two separate versions?</comment>


Ask HN: Generating content and Bringing Users to website - <AUTHOR>

When you build a website (for example, a site to connect sellers with buyers) which mostly relies on user generated content, how do you tackle with the below situation?<p>"User will not be coming to your site when there's less/no content. But, Content will not be generated when there's less/no user."<p>What would be the approaches to grow content/user base? <comment><USER3> If the content/information exists elsewhere but just needs aggregation, you need to massage/import in order for it to be useful to you future users - <USER2> take the plunge and import it so that users will find your service useful, even if this costs you some money up front!

If it's a matter of requiring users to generate your content for your site (like www.reddit.com), then definitely as other users have said... fake it.

</comment><comment><USER4> This kind of questions gets asked a lot here. The common response is "Fake it." Follow reddit's lead and generate content yourself until others catch on. You also might try mechanical turk, though I have no experience with this myself. Also, post a link. You'll get better advice if you supply more detail about your site or the actual site to look at.

<comment><AUTHOR> The live site is not ready yet. Since, the problem seems to be more generic, I posted the question here.

If the same topic had been discussed in old threads, can you please share the link? I would be interested to read that discussion too!

</comment></comment><comment><USER5> Sign a few sellers, and give really good offers for them to use your site. Then help those sellers advertise. Do it again. & Again

Keep building the snowball until it's big. It's not easy, but that's one possible one. It should much much easier nowadays with all the social networks, but nothing is easy. Just a lot of hard work and convincing.

</comment><comment><USER6> I asked a similar question on LinkedIn few months back and got some good replies. Here is the link to that discussion -

[http://www.linkedin.com/answers/startups-small- businesses/st...](http://www.linkedin.com/answers/startups-small- businesses/st..).

I think it may help you.

</comment><comment><USER7> I recently gathered a few links, mostly to previous discussions on the topic, in a post here that you might find helpful:

<http://news.ycombinator.com/item?id=2126209>

I actually have a track record of promoting conversation traction in online forums. But I don't know how those principles would be applied to the kind of site you are asking about. I am interested in getting a better understanding of such things in part because while I seem perfectly capable of increasing traffic (and thus membership) on someone else's discussion board where there is already a certain number of members (but discussion is anemic), my own email lists and websites lack traffic (and members). :-/</comment>


Benchmarking PostgreSQL in AWS, GCP, Azure, DO and UpCloud - <AUTHOR> http://blog.aiven.io/2017/12/postgresql-cloud-performance.html <comment><USER2> Time and time again, Google just blows AWS out of the a water. Results like these make me wonder when Amazon will stop resting on their laurels.

</comment><comment><AUTHOR> We compare PostgreSQL 10 performance in two regions for all five IAAS providers with a couple of VM sizes. Local NVMe SSDs are also compared to network disks in AWS and GCP.</comment>


Choosing a GPU for state-of-the-art Deep Learning - <AUTHOR> https://lambdalabs.com/blog/choosing-a-gpu-for-deep-learning/ <comment><USER2> There may be a new SOTA which outperforms on a CPU

[https://news.ycombinator.com/item?id=22501965](https://news.ycombinator.com/item?id=22501965)

[https://news.ycombinator.com/item?id=22502131](https://news.ycombinator.com/item?id=22502131)</comment>


No more curtains thanks to next generation window technology - <AUTHOR> http://www.reuters.com/article/us-tuneable-windows-tracked-idUSKCN0XA1K9?feedType=RSS&feedName=scienceNews&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+reuters%2FscienceNews+%28Reuters+Science+News%29 <comment><USER2> _> The team uses elastomer rubber coated with nanowires that adheres to glass to scatter light when voltage is applied_

Does that mean the window permanently requires electricity to stay opaque? Two things immediately come to mind:

1\. My electricity bill

2\. Blackout

I think I'll stick to curtains. They work all the time and don't require electricity.</comment>


History of Apache Storm and Lessons Learned - <AUTHOR> http://nathanmarz.com/blog/history-of-apache-storm-and-lessons-learned.html <comment><USER2> I think I get the concept (and it's interesting); but I'm a bit baffled by the terminology:

> That led me to the idea of "spouts" and "bolts" – a spout produces brand new > streams, and a bolt takes in streams as input and produces streams as > output.

Spout I can grasp; why "bolt"? Why these two, together? I'd have really appreciated an extra sentence or two here as to why he chose these terms -- naming is so crucial, and the fact that both "spouts" and "bolts" sound like sources/producers to me (one of water, another of electricity...?) made it harder to grasp how Storm works.

<comment><USER3> I always assumed that "bolt" refers to the threaded fasteners, not electrical bolts. The analogy they are going for is that they are the components responsible for "bolting" spouts together (although, the mixing of metaphors bothers me a little bit... why are we using bolts to fasten fluids together?)

To be super clear about it, a "topology" in Storm is a directed acyclical graph. The nodes are called "bolts" and the edges are called "spouts".

<comment><USER4> > a "topology" in Storm is a directed acyclical graph. The nodes are called > "bolts" and the edges are called spouts"

Not really. Edges are streams and nodes are either spouts or bolts. Spouts have no predecessors and inject external data into the system. Bolts gather one or more input streams and produce zero or more output streams.

These names are a bit confusing, but only during the very first steps of a project. Quickly every developers grasp the concepts.

I have nevertheless a concern regarding spouts and bolts. In practice, when a topology is refactored, bolts have frequently to be transformed into spouts. This occurs when a topology is split in two to ease deployment; and when a persistent queue is added along a stream. This highlights that the distinction between spouts and bolts is bit artificial.

</comment></comment></comment><comment><USER5> Great read.

An aside: when Nathan started work on Storm, there was a competing streaming platform being worked on inside Yahoo, called "S4". It had many similarities to Storm, and some key differences.

It is still in the incubator: [http://incubator.apache.org/s4/](http://incubator.apache.org/s4/) (I have no connection with S4, just know some people who worked on it)

<comment><USER6> The key advantage Storm brought to the table was, as briefly mentioned in the article, the at-least once processing guarantee Storm offers thanks to its efficient tracking of tuples and their descendants (see [https://storm.incubator.apache.org/documentation/Guaranteein...](https://storm.incubator.apache.org/documentation/Guaranteeing- message-processing.html)). To my knowledge S4 offers no such guarantees. I think this made Storm more attractive for many use-cases, it did for me.

</comment></comment><comment><USER7> I've been using Storm for a few years in production. Thanks for all the hard work Nathan.

You and Kyle Kingsbury are two "younger" guys that I always enjoy reading whatever you write.

</comment><comment><USER8> How does it compare to Apache Kafka? (I haven't used either.)

<comment><USER9> Kafka is a high performance, persistent message queue.

Storm is distributed stream processing.

The two work together very well. Often, a server will publish messages to Kafka (or another queue), which are then read and processed by Storm.

<comment><USER10> Interesting question and response. I haven't used either but read about both systems independently. A bit more googling and I found:

[http://www.slideshare.net/gschmutz/kafka- andstromeventproces...](http://www.slideshare.net/gschmutz/kafka- andstromeventprocessinginrealtime)

Slides 42 and 43 describe an architecture with all three ... hadoop, storm and kafka. Seems like a beast and I don't have applications but pretty cool combo of technologies.

<comment><USER11> [http://manning.com/marz/](http://manning.com/marz/) \- this is often the trifecta used in the "lambda architecture", coined by nathan marz. This is also the system they built @ backtype to do their real-time analytics system.

<comment><USER12> Also worth checking out [http://radar.oreilly.com/2014/07/questioning-the- lambda-arch...](http://radar.oreilly.com/2014/07/questioning-the-lambda- architecture.html) from Jay Kreps, who's part of the Kafka braintrust.

</comment></comment></comment></comment></comment><comment><USER13> Nice read. At my previous job we used storm for all sorts of cool things. It worked great and it was a pleasure to be the one at the company that got to really cozy up with it. Deployment (with or without storm-deploy) was also well thought out.

</comment><comment><USER14> I've seen Samza's documentation comparing itself to Storm, I wonder what the reverse-perspective is...

<comment><USER15> As I understood it Samza ties in with Hadoop/HBase, so if you already have that, it might be easier (or even possible at all) to integrate, whereas Storm has nothing to do with with that and only does stream processing.

<comment><USER16> Samza can run on a Hadoop 2 cluster using YARN. As far as I know, there is no other connection to Hadoop or HBase.

</comment></comment></comment><comment><USER17> Looks like we overloaded the site...</comment>


Do Most Entrepreneurs Drink Hard to Cope WithStress or Was It Just Me? - <AUTHOR> https://medium.com/better-humans/me-and-frank-sinatra-disagree-on-this-now-65fe686969e5#.fd6tp7fr6 <comment><USER2> I consider myself an entrepreneur and I drink a lot to deal with stress. It's either - go to the gym and be healthy, or drink. Luckily I go to the gym enough to offset weight gain and the like, but I drink a lot....

</comment><comment><USER3> Title: Me and Frank Sinatra Disagree on This Now</comment>


Perfect 'Get Lucky' with Mario Paint - <AUTHOR> http://www.wired.com/underwire/2013/09/monday-jam-get-lucky-mario-paint/

<comment><USER2> This is not Mario Paint (a SNES game) but Mario Paint _Composer_ (a PC clone). The original Mario Paint had a lot of limitations (confined to C major, max 3 notes chords, less voices, etc.). This makes Composer more of a fancy MIDI editor/player.

<comment><USER3> Yes, this is no more impressive than any other MIDI tune.

<comment><USER4> It's MIDI with limitations and cute cartoon characters that tap into our nostalgia. I say it's a fair hack to show off!

</comment></comment></comment><comment><USER5> This is pretty fun -- the meows and barks are the best part of the composition.

</comment><comment><USER6> Ok? I guess it's time to find a new news aggregation.

<comment><USER7> We can flag articles that we believe don't belong on the site.</comment></comment>


Ask HN: Lost $10k as my email was hacked. Any ways to recover it? - <AUTHOR> I have suffered a loss of $10k due to an extremely unbelievable case of my client's as well as my own email domain was hacked.
–----
So, I run a very small pharma export company in India. I have a client in Ontario, Canada with whom I have been doing regular business.
2 weeks ago I got an order worth $10000 from them. So as usual I dispatched the material to them and then raised the invoice with my bank details from my email address called "abcde@mydomain .com".
Now on the next day my client received an email from "firstname.lastname@example.com" stating that there is a change in invoice and revised invoice is again sent which had bank account details of a UK bank account.
Now an email like "email@example.com" doesn't exist at all.
My client asked me for a confirmation email again but this email never reached me. So the client made the payment and the money is already deducted from his account.
Also, what makes this even more strange is that I received a fake email from my client's company with 3-4 times about not asking for payment as it will be delayed.
I got this email from an email address like "email@example.com" instead of "email@example.com".
Now $10000 in an extremely huge amount for survival of my company. I want to know what are my options and is there any way of recovering it. <comment><USER2> I'm surprised I'm the first person to point this out, but you have not lost any money, your client has.

You sent the goods to the client, and they have yet to remit the payment to you. So they still owe you the money and you should insist they pay it.

Granted, they're not going to like that, but the reality is they sent payment due to you to some other person. That's something _they_ did not something you did.

They may be in a position to take steps to recover the payment they sent to someone else, given the banks involved and so on, and they should try to do it. But that's not something you're really in a position to be involved in, you didn't have anything to do with it and aren't a party to the fraudulent transaction.

In the meantime they should return the goods or send you the payment they owe.

<comment><USER3> > my client received an email from "email@example.com" stating that there is > a change in invoice and revised invoice is again sent which had bank account > details of a UK bank account.

Emails sent from your domain usually constitute valid contracts. If you're letting other people send emails from your domain because you don't have SPF configured then there's a good chance a court would either rule that you've allowed them to enter into a legally binding contract on your behalf, or else that you were negligent and owe the $10,000 back in damages.

That's why you need to take away the email addresses of people who no longer work for your company, so that they can't enter into contracts on your behalf.

That said no one should ever wire money based on anything they receive via email. So if the sender email had SPF but the recipient just didn't see it flagged because it was in SOFTFAIL mode or whatever, then it's probably the client's fault at that point.

<comment><USER2> That's highly doubtful.

I think it would maybe be arguable if someone actually hacked the OP's account and the emails really did come from their outbox, but spoofed email is a different thing entirely.

It seems more equivalent as a legal precedent to someone sending a forged letter from a nonexistent employee on similar looking letterhead. Or maybe someone showing up at the door and collecting payment wearing a stolen or counterfeit uniform.

If you think of it in legal terms, in a lawsuit say, the client would have to acknowledge the existence of a contract and an obligation to pay the supplier, and then somehow make an argument that a spoofed email from a third party that the supplier had no awareness of, that never entered the posession or control of the supplier at all, somehow invalidates that contract, or proves that the client has satisfied their obligation.

That's quite a stretch.

Arguing negligence on the part of the supplier still wouldn't do anything to satisfy the payment obligation, at best it would seem to be a counter-claim, saying they they suffered a loss because of the suppliers negligence, but then that's a separate tort and the burden of proof would be on them.

<comment><USER3> > It seems more equivalent as a legal precedent to someone sending a forged > letter from a nonexistent employee on similar looking letterhead.

Well that's the question I guess, if you don't have SPF enabled is it like what you said, or is it more like allowing random people to come into your office at night and send out whatever they want on your actual company letterhead?

I don't know if there is legal precedent there or what a judge would rule, but it doesn't strike me as being completely obvious that this is a simple cut- and-dried case where the client still owes the full amount of the original payment.

<comment><USER2> It's not like having someone come into your office at night if it's a spoofed email. It's just someone figuring out what your letterhead looks like.

Either way though the client owes the original payment. That's not in dispute. Legal issues don't work in some holistic "who do you think should have the money" way, there are specific causes of action.

The first thing a court would ask is does the client owe the money, and is the obligation satisfied. The first answer is yes the second one is no, the client never sent the supplier the money. Nobody claims they did. Period.

Then the client would have a cause of action for negligence, due to someone else spoofing their email. Who wins that one? I don't know but you'd have to look for some precedent and claim that the supplier was actually the proximate cause for some third party defrauding you. Maybe but it's a pretty tenuous argument and you'd have to demonstrate clear causality.

</comment></comment></comment></comment></comment><comment><USER4> Your email did not get hacked most likely. Your client got tricked. They spoofed an email with your domain, but the reply-to email was their own (the attacker). So the client thinks they responded to you, but they responded to the fake address. Also, generally when they do this, they spoof the body and the conversation of the email.

Most likely, your client's emails were compromised in this case. Ask them to forward you the original email received as an attachment, and the reply-email as an attachment.

Your client likely has to reach out to their banking institution. Most companies have safeguards against this on their end when sending money, specifically, when accounts change they get on the phone with someone using their Vendor list, not the communication from the email. Also, having multiple parties authorize a transfer.

<comment><USER5> I agree. A few (10? 20?) years ago it was very easy to spoof email and send an email "from" firstname.lastname@example.com if you wish. The original email specification has almost no security features. Now, most of the email servers will sign the outgoing email, and if you receive an email with the signature gmail and others big webmail providers will show a big warning.

So, to understand the problem it is very important to get a copy of all the complete emails with all the hidden headers that have the automatic signatures of the servers the email passed through. (See [https://www.google.com/search?q=email+headers](https://www.google.com/search?q=email+headers) )

With the emails headers it is posible to see if your server was hacked or if the sender field was spoofed.

</comment></comment><comment><USER6> This is very common issue; I've personally helped a company after they lost much more than this, and had to help prove to insurance/govt agencies/etc. Turn on DKIM, DMARC, and SPF records for your mail domain. Also, never send invoices over email that contain any payment terms (eg: accounts, addresses to mail check to, etc) they should always be in some sort of protected portal. Tell every customer never to accept payment term details from you over email, phone, etc. If you or your client has insurance, start documenting every part of your case with screenshots into a file, and document everything you know NOW, including timestamps, etc.

EDIT: Also, I'd suggest taking orders via a secured portal, and also autheticating large orders by calling a number for a client you already have (never trust their website, or an email from them). Unfortunately, you're out of luck that money.

<comment><AUTHOR> Is there anyway to recover that money?

<comment><USER7> They need to file a police report, and get in touch with their bank. It's likely the money has already been transferred to a different bank, but the corresponding bank might still be able to freeze the account if it is still sitting there.

Then again, it might be transferred again as well. Money is hard to trace if it moves through different jurisdictions, as every country has different banking and privacy laws. Your client might very well hit a dead end for such a (in the grand scheme of things) small amount of money.

</comment></comment></comment><comment><USER8> If I'm reading your story correctly, it matches up with a tactic my clients have been seeing more lately. The scammer has already accessed your account because you fell for a phishing scam, typed your email credentials into a fake login site for a fake Office 365 or Dropbox page or something.

Now the scammers are watching your email closely waiting for the opportunity to do this. Waiting for you to send an invoice to your client, so they can jump in and send a revised invoice with their own payment details on it.

This can happen with intrusion into your email box, or your clients'. Hard to say exactly from your story. But either case, someone's mailbox was accessed by the intruder. A similar scam is possible by just using similar domain names, but in such a case you wouldn't know precise details of the invoices. You can just send a random fake invoice and hope the mark pays it or provides payment details in some way.

One thing worth noting in your story is that you aren't out $10,000. Your client is the one who paid the money to the wrong party. They are the ones who need to work with their banks and reverse the payment. It's not your fault that they paid the wrong person.

<comment><USER9> > The scammer has already accessed your account because you fell for a > phishing scam

> It's not your fault that they paid the wrong person.

How is this not the OP's fault? It's absolutely their fault - the fault that lead to their email being compromised

<comment><USER8> I stated in the next paragraph that the situation could just as easily be reversed. We do not have any way to know in this situation whose mailbox was accessed, the OP, or their client.

<comment><USER10> If OP's mail was hacked, the attacker wouldn't have needed to use a confusingly-similar email address ("firstname.lastname@example.com" instead of "firstname.lastname@example.com"). They could have used OP's actual address.

<comment><USER8> Good theory but not necessarily true. The attacker might still wish to use a spoofed domain to ensure that they get delivery of all replies.

In cases where Gmail and Office 365 accounts get hacked like this, the attacker will enable email forwarding to an address they can monitor for replies, and delete replies from the clients so that the compromised person does not see them. I am not sure if you can do this easily with a godaddy mailbox.

</comment></comment></comment></comment></comment><comment><USER11> Immediately contact all the banks involved and report the fraud. They should be able to reverse the transaction.

<comment><USER12> I can confirm this. Something similar happened to an acquaintance, although the amount was even higher. They immediately called the police, and the transaction was reversed. When the thieves tried to withdraw cash, they were able to catch them. This happened in China, although the transaction was international.

</comment></comment><comment><USER13> Your client got defrauded, arguably through no fault of your own. They never paid you, so they still owe you. Good luck with this approach, though. IANAL

Edit: I see CPLX has said it much better than I in the meantime. Note that it's not at all clear that the hack happened on your end, rather than your client's (or perhaps at some intermediate ISP).

</comment><comment><USER14> Banking standards _here in the EU_ impose a 13 months period during which the sender (order sender) can ask for a full refund. Check your local rules. This has to be talked about with the respective banks involved (that of your client + the one that received payment), as I believe you can't do anything anymore.

Next time, use more than one communication channel (Facebook, phone, signal, telegram, whatsapp... anything, really)

You should also see with your domain registrar and mail provider what happened.

<comment><USER15> > Banking standards here in the EU impose a 13 months period during which the > sender (order sender) can ask for a full refund

Is this really true? Do EU bank transactions really take 13 months to fully clear?

<comment><USER14> No, they don't take 13 months to clear. The idea is to protect the payer (the one losing money) from either their human error, or an unlawful debit.

See [https://www.europeanpaymentscouncil.eu/what-we-do/sepa- direc...](https://www.europeanpaymentscouncil.eu/what-we-do/sepa-direct-debit) .

<comment><USER16> Is that for "direct debit" only or all transactions?

</comment></comment></comment></comment><comment><USER17> Just so you know, the Reply All podcasts takes on (and helps solve) cases just like these.

</comment><comment><USER18> My two cent: any business should have ALSO a phone number, perhaps not immediately reachable, but still a phone number. Perhaps also a fax number, old but still useful in emergency.

<comment><USER19> Hear hear.

If I can't reach flesh on a phone during business hours, I do my business with somebody else. No exceptions. A friend was trusting money and login details to a site with no mailing address or phone number and I pointed this out. He was suddenly aghast, another who did the same shrugged, I shuddered. Some people insist on learning the hard way.

</comment></comment><comment><USER20> here in the US, we have the financial fraud kill chain for transfers greater than 50,000 dollars. Other countries have used it as well. you may wish to contact the CSIS for methods they use to short-circuit these transactions.

[https://rmacounts.com/uncategorized/financial-fraud-kill- cha...](https://rmacounts.com/uncategorized/financial-fraud-kill-chain/)

</comment><comment><USER21> A couple of humble suggestions:

1\. Get/Hire someone to do a proper analysis of the "breach". This may require your client's cooperation.

2\. Regardless of whose fault that was, try to improve the process to protect yourself and your clients in the future (e.g. email signing, confirmation via a different channel, different way of collecting payments etc.)

<comment><USER22> have you ever done this? a proper analysis will cost more than the money lost, and is itself not recoverable.

</comment></comment><comment><USER23> This is fairly common fraud in the UK. See this for background:

[https://www.theguardian.com/money/2018/oct/18/banks-to- check...](https://www.theguardian.com/money/2018/oct/18/banks-to-check- account-names-to-beat-transfer)

</comment><comment><USER22> one important thing you didn't state, was this $10k order typical for them, or especially outsized. another important thing, you didn't state how any discussion to date has already gone with the client.

anyway, no matter, you are in india, the client/customer is in canada? the amount is only $10,000 and you are a "very" small company? you have no practical recourse.

i'd even give small odds that the client is in fact scamming you.

regardless, good luck but in the face of an uncooperative client, you're out of luck.

many of the arguments here are around legal correctness, who is at fault, etc. but they fail to take into account that you are too small and the amount is too small and across international borders, for you to do anything about it. now if the amount were $100,000 you'd be able to pursue it.

</comment><comment><USER24> You need to speak to the bank regulators an consider talking the press

In the UK the Daily Telegraph finance team they have been covering this in their weekend issues and have had some success in getting things changed here.

</comment><comment><USER25> I wonder if a _client_ has ever set up a scam like this.

They send a fake-looking email to themselves (using existing invoices as a template), then feign ignorance and refuse to pay for goods/services because "we sent the money, not our fault you didn't get it".

Even better that they'd send a few emails saying "we're working on paying you, don't bug us about it" \-- payments are harder to collect as time passes for a number of reasons (in my experience).

<comment><USER12> As others have pointed out, it's the client's fault if they have been duped. Although for sure, they'll try to put the onus on the seller, and will claim the seller has been hacked etc..

</comment></comment><comment><AUTHOR> Email headers of the fake email I received are below. Can anyone identify anything out it?

\</comment><comment>-

Received: (qmail 30963 invoked by uid 30297); 16 Oct 2018 19:04:18 -0000

Received: from unknown (HELO sg2plibsmtp01-1.prod.sin2.secureserver.net) ([188.8.131.52])

              (envelope-sender <firstname.lastname@example.com>)

              by sg2plsmtp19-01-25.prod.sin2.secureserver.net (qmail-1.03) with SMTP

              for <firstname.lastname@example.com>; 16 Oct 2018 19:04:18 -0000

Received: from se1-lax1.servconfig.com ([22.214.171.124])

                   by bizsmtp with ESMTP

                   id CUdcgdXtBUMdaCUdegyEaT; Tue, 16 Oct 2018 12:04:18 -0700

Received: from res203.servconfig.com ([188.8.131.52])

                   by se1-lax1.servconfig.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)

                   (Exim 4.89)

                   (envelope-from <firstname.lastname@example.com>)

                   id 1gCUdY-0005Jd-Kn; Tue, 16 Oct 2018 15:04:16 -0400

Received: from [::1] (port=46403 helo=res203.servconfig.com)

                   by res203.servconfig.com with esmtpa (Exim 4.91)

                   (envelope-from <firstname.lastname@example.com>)

                   id 1gCUdY-00GWW5-7H; Tue, 16 Oct 2018 12:04:12 -0700

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_cb44418026f16861773c2073108229cd"

Date: Tue, 16 Oct 2018 12:04:12 -0700

From: Kyle <email@example.com>

To: Reema<firstname.lastname@example.com>

Cc: 'mail' <firstname.lastname@example.com>

Subject: RE: pharma zonisamide

Reply-To: Kyle <email@example.com>

Mail-Reply-To: Kyle <firstname.lastname@example.com>

Message-ID: <firstname.lastname@example.com>

X-Sender: email@example.com

User-Agent: Roundcube Webmail/1.3.3

X-Get-Message-Sender-Via: res203.servconfig.com: authenticated_id: firstname.lastname@example.com

X-Authenticated-Sender: res203.servconfig.com: email@example.com

X-Originating-IP: 126.96.36.199

X-SpamExperts-Domain: res203.servconfig.com

X-SpamExperts-Username: 126.96.36.199

Authentication-Results: servconfig.com; auth=pass email@example.com

X-SpamExperts-Outgoing-Class: unsure

X-SpamExperts-Outgoing-Evidence: Combined (0.35)

X-Recommended-Action: accept

X-Filter-ID: EX5BVjFpneJeBchSMxfU5rwL/g85tQulnBE8gPHu3/F602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx

q3u0UDjvO73ACdMYEFGu+gF5O7WstgsinfpazlJl1tCn592ZdmdEXY8S/zCkg36vZ3GfohIs0UGl

z8CJSOMrvzx9TVg3RkVXN8poxUmHw7z8Cv3zSk4rk5hzVqcRQipB56OduRZxKuP+q8NuOKfRBnSy

EKI1nLnoREI39Ng7w+jWwVgutjGnTGAA1gLIPnzkgagc0cD3QuccXSndMw0FQ8jqfUr8AYYpMlsI

IQUIsICEfKR4uJdogE2eQHlogxUcYs0rxQ+mI9H9Xex/9Lq8f02pgNORt7R9OjAEo9UzDH0ARpN0

wUZt3fvT7ao3SadG2ABiWXtkF0i/CT5LMFdUTCs59oTfl5U/c8+QAw6oOeWTc8nT5GWcPd0rEuGj

FyZoidhtHm+WobglkKcTLdh5JwRD9s9xE+dH789QVPIx9duafGFU3kR9F9u9KyBXj+FNLU1SvJx5

/9jlDHh8k6TTdHl8m1/8O/8FS0gu/BXEFm6f2M41IWv/Qw0zmRSx+YTH48mhNBhct/JFBLt+LA62

e0Pg9eDnrJN9b+G2BSscQzbFMcfSu4J7ix6iCoZ5CaKPMqg2RgTcAelen7CXsT6fZe+0gbPIz96e

qtNrhqU0j58VnbXM/vIJoxTw4G77xMwEh26uoYRpiF4am0X83e22zM8wHY/QU2XjdKVHj6Omz2pU

52OZqldRRmxkB/4b3LJEbiGaRFZKY17WKvlei/52nCwh3EKwhLPN528N6lMd564J8QyHtUdRVUYN

O3udn1JlHoAi4F0jBWcShbww79KoIp0Sgs8f/ZTrGlUY2jbf3Q54l9HRkQvIejKclyAbTmc6f/07

0aI4MKggmD9XUhkU65ggFOIOfY0If3FAzbmaNBxeMIrqE6TxR86t2EiC6GwMws7GvvozwLzzGiRR

EvmQrtvSbV4fnBHAY64qloNFm00WuJU2Ru5B4WNJiz4C8c3Na3gFdtxXZg==

X-Report-Abuse-To: firstname.lastname@example.com

X-CMAE-Envelope: MS4wfGTkLN5Q3Etz9Wkc3k/s+48X4HLNxcMTgPNW9dd3KWT52iaJK7tSMbsyZjm0/hi9J87LipDUTpWV2p/qyIS3IuuXa62TTzrOmM1SRoaJXZY91Lfa/lzj

i8Jb2TdRHL58hBIRNSmmPIf9tFZ8lSpapy/8CF5h3TDIczyZlwy+0j+T7U+zeMfEALDdLQAg1NCO7Q==

X-Nonspam: None

<comment><USER26> Do you recognize this domain?

> authenticated_id: firstname.lastname@example.com

<comment><AUTHOR> No. This is some unknown email address.

<comment><USER27> [https://b2bpk.com/company/ma-kamil- pharma-57113.html](https://b2bpk.com/company/ma-kamil-pharma-57113.html)

Weird that the domain points to another Pharma company operating from Karachi, Pakistan. Maybe contacting them to find out who "Shahrukh" is might be a good first step.

EDIT: Looks like 0898 found more details [https://news.ycombinator.com/item?id=18310807](https://news.ycombinator.com/item?id=18310807)

</comment></comment></comment></comment><comment><USER28> Maybe this is a dumb question, but have you talked to your customer about this? Such issues are covered by insurance plans that are common for US companies. It may be as simple as your customer makes a police report and then provide it to their insurance. Then 60 days later they get a check and pay you.

</comment><comment><USER26> Your case is really similar to this attack (`How a fraudster got $12 million out of a Canadian university: They just asked for it`): [https://news.ycombinator.com/item?id=18186433](https://news.ycombinator.com/item?id=18186433)

</comment><comment><USER29> you or your client using Google's Gsuite as email service provider?

cause the same thing happened to one of client in Chennai, India.

but they client didnt tranfer the funds since he found that the bank account the fake guy sent was new to them. so the client called orginal company back and reported it.

</comment><comment><USER30> Unless I am missing something I dont see a hack here, just some spoofed emails.

<comment><AUTHOR> It's not just a random spoof email. Someone was aware of the entire conversation and send a spoof email at the exact situation resulting in my loss.

<comment><USER30> Doesnt mean you were hacked could be an inside job by someone at either organization or could be a hack on the other company's email. If your email provider has any sort of activity log like gmail does you might want to review those, or if you run your own there should be access logs on the server.

</comment></comment></comment><comment><USER31> For a similar recent case, see

[https://news.ycombinator.com/item?id=18318226](https://news.ycombinator.com/item?id=18318226)

</comment><comment><USER32> Make sure you have set up SPF, DKIM and DMARC. Also use email certificate.

</comment><comment><USER33> An interesting case, I have never heard of this type of fraud

</comment><comment><USER34> Maybe your business partner is trying to scam you.

</comment><comment><USER35> You didnt lose 10K, your client did.</comment>


Show HN: HackerTray – Minimalist HN app that sits in your system tray - <AUTHOR> https://github.com/captn3m0/hackertray <comment><AUTHOR> The last Show HN on this was 7 years ago[0], and I did a Python 3 release today, thought I might repost.

Updates in today's release:

\- Adds support for --firefox auto, picks the default firefox profile automatically

\- Upgrades to Python 3.0. Python 2 is no longer supported

\- Switches from PyGtk to PyGObject.

\- AppIndicator is no longer supported, because it is Python 2 only

\- Removed mixpanel tracking.

I'm thanking my 7-year-younger-self for adding automatic version checks, so hopefully the few people who were using it still will get notified automatically.

[0]: [https://news.ycombinator.com/item?id=6819042](https://news.ycombinator.com/item?id=6819042)</comment>


Sigfox Coverage Map (LPWAN Dedicated to the IoT) - <AUTHOR> http://sigfox.com/en/#!/connected-world/sigfox-network-operator <comment><USER2> Looks pretty nice actually ;)</comment>


SimplCommerce: Simple, cross-platform, modularized ecommerce system on .NET Core - <AUTHOR> https://github.com/simplcommerce/SimplCommerce <comment><USER2> This is great! Congratulations on shipping!! You should add "Show HN " prefix to your title, since this looks like a show and tell.

I checked out the demo site and the Admin Dashboard. Seems to have everything needed to host an ecommerce site... except, I didn't find any payment gateway integration. Even checked [http://demo.simplcommerce.com/Admin#/configuration](http://demo.simplcommerce.com/Admin#/configuration) and didn't find it.

Any plans to integrate payment gateway or API (ex Stripe ) in the near future, or was I not looking in the right place?

Thank you! P.S. Any recommendations for hosting this? Can this be deployed on Amazon Lambda? Or will I need Azure? How about traditional hosts like DiscountASP.Net? Any pro and cons you are aware of?

<comment><USER3> My first thought was to check the source for how they're handling credit card data, payments, and gateways. I can't find any of it... Skipping those bits makes ecommerce _a lot_ easier to build!

I second parent's suggestion here though, Stripe API is a great place to start.

<comment><USER2> Yep, I looked at the Repo on Github and it lists Payments on their roadmap after v1.0.0.

[https://github.com/simplcommerce/SimplCommerce/wiki/Roadmap](https://github.com/simplcommerce/SimplCommerce/wiki/Roadmap)

</comment></comment></comment><comment><USER4> Great stuff, I love seeing what people are building with .NET Core. I feel like I'm getting much closer to the point that I could confidently commit to building a greenfields project for a client in it.

Are there any parts of the project you could highlight as being much harder or easier as a result of building it in .NET Core over, say, .NET 4.6?

<comment><USER5> I've been trying to port an existing .NET 4.6 ASP.NET project to .NET Core. So far there are 2 major problems:

1\. entity framework core code first does not support table per type inheritance, which makes database migration necessary

2\. some libraries do not support .NET Core yet

<comment><USER6> Adopting and porting to .NET Core will become a ton easier, later this year. .NET Core 2.0 will add a ton of .NET Framework APIs.

These APIs are almost entirely coming from .NET Standard 2.0. See the jump in APIs in this table[1].

We often get asked if this is going against the promise of a light-weight development platform. Answer: not really. The new APIs are not being added to a single library, but several, including new ones. We will be updating our publishing tools to make it easier publish apps w/only the libraries you need. We are also looking at going one step further, which is publishing only the IL you need (intra-assembly optimization).

I am spending the week presenting at two Microsoft conferences in Europe (Milan, Amsterdam). I heard very similar feedback on EF yesterday in Milan. I will be passing this off to the EF team.

FYI: I'm a .NET Core team member.

[1] [https://github.com/dotnet/standard/blob/master/docs/faq.md#i...](https://github.com/dotnet/standard/blob/master/docs/faq.md#if- there-is-no-breaking-change-why-call-it-net-standard-20).

</comment></comment></comment><comment><USER7> I recently stumbled on QOR ([http://getqor.com](http://getqor.com) \- [https://github.com/qor/qor](https://github.com/qor/qor)), which is a set of libs in Go that you can quickly build a webshop with. QOR seems to use a combination of vanilla-JS and jQuery, where SimplCommerce uses Angular.

Good to see these efforts, as some of the more popular open source e-commerce systems are showing their age (often aggravated by the underlying languages/ecosystems showing their age as well).

</comment><comment><USER8> the platform, also listed at [https://www.ecommwar.com/](https://www.ecommwar.com/)

there are almost all open-source ecommerce platforms

<comment><USER9> Nice find. I'm still trying to find a good on-prem solution after Lemonstand v1 went abandonware.

</comment></comment><comment><USER10> Very useful info for me! I'm just planning to build a website to sell my handmade jewelry. I've been selling my designer's clothing through Etsy and Vinted. I guess that my business will benefit from a separate website. I gonna use a wordpress ecommerce theme (from this resource - [https://www.templatemonster.com/wordpress-ecommerce- themes/](https://www.templatemonster.com/wordpress-ecommerce-themes/) )

</comment><comment><USER11> As a .NET developer it's nice to see projects like these. On the other hand I had looked at this a while back and my impression of the data model (specifically the Product class) was not great.

[https://github.com/simplcommerce/SimplCommerce/blob/master/s...](https://github.com/simplcommerce/SimplCommerce/blob/master/src/Modules/SimplCommerce.Module.Catalog/Models/Product.cs)

Price, OldPrice, SpecialPrice, special price start and end dates properties are less than ideal for any non-trivial implementation. Prices should be driven by policies, not defined in the product itself (IMO.)

<comment><USER12> It's "super simple". There's one pricing policy and it's hardcoded. As layers of abstraction are added in support of richer features, so too is complexity and hence "not-so super simple".

</comment></comment><comment><USER13> i am about to start a e-commerce website. i was going to use nopcommerce but they will move to .net core in next release which is far away and i really wonder which would be better to improve me also maintain the website with minimum effort.

</comment><comment><USER14> I'm always pleased to see ecommerce thats more simple than Magento et al.

Good luck!

</comment><comment><USER15> I really like this! I'll keep an eye on it for now :)

</comment><comment><USER16> Well done, I will follow this.</comment>


Ask HN: How to market large scale open source hosting? - <AUTHOR> TL;DR How to market www.datacenterlight.ch non intrusively to Open Source hackers?
Hello,
here is Nico, FOSS hacker and CEO of ungleich.ch, a small Swiss Open Source company.
We have the Swiss wide unique possibility to offer really affordable VM hosting in the midst of the mountains of Switzerland, because we can host our servers in old factory halls.
Thus we save a lot of energy and money and want to give this price advantage to our customers.
We love that our software stack is 100% open source, running with locally produced water power and omitting active cooling (because it is cold enough).
That said, with our low margin want to address a substantial amount of customers and mainly those who love Open Source like we do.
Running a browser with adblocker myself and hating unsolicited advertising, blinky gifs, etc. I wonder about your opinion:
How do you think we should market our product? <comment><USER2> Disclosure: I work on Google Cloud.

You should probably redo this as a Show HN. In that spirit, some feedback on your landing page:

\- People have lots of reasons behind why they choose an infrastructure provider. Yours seems mostly "goodwill" (both from an environmental and OSS standpoint). Call that out in a "Why Datacenter Light?" Page or section.

\- You mention (both here and on the landing page) your open-source stack. Can you say more? Is it KVM based? Do you use Kubernetes? The HN crowd and your target audience (OSS people looking for a box in Switzerland) would appreciate it. A basic set of bullet points would go a long way (and/or a Git repo!).

\- Moreover an engineering blog on how you stood this up would likely get lots of interest from HN. How'd you find this factory? Why'd you choose whatever bits you did for a hypervisor? Enough of that content spreads around and you're suddenly looking at customers.

\- Most directly, you presumably think of yourself as an alternative to VPS providers and Digital Ocean in particular. I'll caution that DO has had to gain "real cloud provider" services like load balancing, object storage, remote block storage and so on. Which of those do you (plan to) offer?

\- While I don't think it's the most important thing you probably want a different name for this offering. Datacenter Light is fairly generic thing (and non-Swiss-German speakers won't know what your umbrella company name means, but you needn't change that).

\- Finally, sponsor small events that most directly fit your target audience. My _assumption_ is that you are starting this in Switzerland not only because you live there but because you believe in the current security climate that other people want to host there. There are lots of great ways to spend $500 to host a beer gathering at an important conference and turn that into interest and word of mouth.

Best of luck!

<comment><AUTHOR> Oh and I forgot to name the most important tool that we use: emacs

<comment><USER3> _You_ use emacs, you octopus, not me!!!

Um, I don't want to go here.

(Disclaimer: He's my boss, so I am allowed to make fun of him and say that I don't use emacs. I hope.)

<comment><AUTHOR> I think we should have an emacs workshop in the near future - maybe even with the help of preek ;-)

<comment><USER4> Count me in^^</comment></comment></comment></comment></comment>


Eric S Raymond's lessons for creating good open source software - <AUTHOR> https://hackernoon.com/lessons-for-creating-good-open-source-software-1b7bbbc13b13#.4oo5cai6f <comment><USER2> Guy copy/pastes from the Wikipedia page of catb into medium, adds his github project at the bottom and submits to HN.</comment>


The 2nd largest registrar stores passwords in cleartext - <AUTHOR> http://i.imgur.com/Z7cjG.png

<comment><USER2> You're probably right. They could just be emailing the password in plaintext on account creation and never storing it that way, though that's also pretty bad.</comment>


Unusual and physical methods for finding prime numbers - <AUTHOR> http://empslocal.ex.ac.uk/people/staff/mrwatkin/zeta/unusual.htm

<comment><USER2> Beyond Wolfram's example, prime numbers have been generated by Conway's Game of Life: [https://www.youtube.com/watch?v=68nEX5CEmZE](https://www.youtube.com/watch?v=68nEX5CEmZE)

</comment><comment><USER3> Fascinating stuff here.

Perhaps the biology section might have cited this unusual source of primes

[http://alpha61.com/primenumbershittingbear/](http://alpha61.com/primenumbershittingbear/)</comment>


The Software Developer's Sketchbook - <AUTHOR> http://prog21.dadgum.com/202.html <comment><USER2> Chaim Gingold has a great essay that expands on related ideas, at [http://www.levitylab.com/blog/2011/01/catastrophic- prototypi...](http://www.levitylab.com/blog/2011/01/catastrophic-prototyping- and-other-stories/)

In particular, the following remarks from Gingold's essay complement the OP well: "My hard drive was full of failures. Twelve years after learning to program, I looked back on all my software: none of it was finished, and what was, wasn't ambitious enough. The projects that started out ambitiously always seemed to fall back to earth, like failed rockets lacking the power to propel their own weight into orbit. Sure, there were interesting ideas in there, lots of wacky toys, and I had even attempted a few large projects, but none of them ever came together like the cool games and software I had always admired.

Sure, I had become a pretty good programmer, and learned to make cool stuff, but clearly none of it would ever amount to anything. I just didn't have what it took.

I went to graduate school at Georgia Tech, and read some Chris Crawford. I learned that he had the same problem. But he didn't think of it as failure. For him, this was an organic part of the development process. The failures filling his hard drive were actually "prototypes" that helped him decide which ideas were worth pursuing. For each good idea, there were a large number of stupid ones that didn't work out. Failing, for this successful designer, was a way to find the good ideas. The revelation hit me like a ton of bricks. Maybe I had a chance after all... Master artists like Escher or Van Gogh don't just sit down and crank out a finished piece. Artists create numerous sketches and studies before they undertake finished paintings, let alone masterpieces... All of my software failures, which I was now thinking about as prototypes, sketches, and studies, had taught me a thing or two about design and programming. If you want to learn to draw, you have to make a ton of bad drawings first. The difference between practice and failure is simply a matter of attitude."

These ideas are, of course, not new, but Gingold has thought about them deeply and distilled them sharply. The essay as a whole goes much further than the above excerpt, and is well worth reading.

<comment><USER3> Oh yeah. "The difference between practice and failure is simply a matter of attitude." Nothing is more true.

I recently pulled out some code from over 20 years ago, an experiment in mixing fuzzy logic and Conway's Life that... didn't exactly work out. But it had some intriguing results. Was it a "failure"? Not in the least: it produced results that were intriguing enough for me to remember two decades later, even though it never "came to anything" in the meantime.

That said, I do like the word "failure", and I'm happy to say, "My hard drive is full of failures!" It just sounds better than "practice" and it challenges anyone I say it to. What can they say in reply?

The world is full of little people desperately attempting to tear you down. When you say, "My hard drive is full of failures" they have nothing to come back with. They know you've _actually done something_ , which is more than they have. So go forth and embrace your failures. They prove you're alive, and doing something interesting with your life.

My attitude is in part informed by this quote: "One word characterized the most strenuous of the efforts for the advancement of science that I have made perseveringly during fifty-five years; that word is FAILURE" \-- Sir William Thomson. If Lord Kelvin can fail, so can I, damnit!

<comment><USER4> One of my favorite quotes: _" Success is the process of going from failure to failure without loss of enthusiasm."_ I like it because it highlights that failure is a point event, while success is a process, a trajectory. So comparing the two is fallacious. It is possible for both to coexist.

</comment></comment></comment><comment><USER5> For me, that is my ~/git/scratch repo (formerly ~/hg/scratch).

I have a lot of experiments in there: different approaches to parsing; R/OCaml/Lua experiments; tests for interactions between Unix signals, processes, and threads; etc.

One thing I've also found useful is: whenever you see a neat code snippet on Hacker News or a blog, download the code, and write a shell script to build and demo it. You don't even have to understand it thoroughly the first time around. But when you come across something related in the future, your brain will remind you of it, and you will have a little shell script you forgot about to puzzle through :) It takes like 10 minutes each time.

I have 141 different subdirs; probably half are my own and half are demos I learned something from (or hopefully will in the future).

<comment><USER6> What do you mean by "write a shell script to build and demo it"? Pardon my ignorance.

<comment><USER7> For many projects, I set up scripts for building (if necessary), running, deployment, etc. That way, when I return to it later I don't have to remember (or take the time to Google) the incantation to run some obscure framework that I haven't worked with in a few years. At the very least, I put some instructions in a readme.

Not sure if that's what chubot meant, though.

</comment></comment></comment><comment><USER8> Can anyone recommend books to read on topics along the lines of this article. Basically, tips for programmers trying to bite off more than they can chew (but sort of have to, given the problem at hand)?

</comment><comment><USER9> "To become the expert, you need more projects. They can be smaller, experimental, and even be isolated parts of a non-existent larger app."

This is so true. A lot of the 'experienced' people I've met in the industry with 10 or 15 years behind them have done nothing but their jobs in that time to practice their art, and their 'experience' is therefore of such low quality that an exceptionally good junior with a few hobby projects behind them can outclass them even in their own specialist area.

<comment><USER10> This is so laughable and a little typical of HN.

I've worked with guys that have done nothing other than Spring and Hibernate for nearly a decade and they know those platforms inside and out. There's just no way someone junior with a few hobby projects are running rings around those guys in their areas.

However, if you take something new, or something these guys haven't used, then yea.... rings could be run. Other than that, I don't think so.

<comment><USER9> I dunno, I've experienced this a lot, although to be fair, with much larger areas of expertise than a particular product. I was thinking more about 'graphics', 'AI' or at the language level like 'C' or 'Java'.

I'll trust my experience over guesswork.

</comment></comment></comment><comment><USER11> Although I agree with the conclusion (have several small projects in addition to a "big" one), I think the intro is off.

> It takes ten-thousand hours to master your field, so the story goes, except > that programming is too broad of a field.

If you've put in ten-thousand hours into the field of programming, you'll not need to put in another ten-thousand if you switch from, say, a vector-drawing tool to a music composition software. Yeah, you might miss some stuff like everything related to audio - but picking up the concepts and one or two related APIs should be two or three orders of magnitude quicker than "I'm learning to program".

Learning new concepts and APIs is meta-skill, and one will become better at it the more different concepts and APIs one has used.

You'll also need domain knowledge, of course. Again, working with domain experts and users is a meta-skill that you may want to train (or you may depend on someone in your team to do most of that for you, e.g. a Product Owner).

So, if someone has "mastered programming", she should be able to be dropped into an unknown domain and have the skill to identify and pick up the parts she is missing in a fraction of the time it took to "master programming". Mastery of a skill means the switching costs between domains is significantly reduced, but not zero. Same is true for a carpenter: Building a ship is different from building a house or a bridge, yet a master of carpentry will be able to pick up the skill of building a ship more quickly than, say, a master of programming would.

Most fields are too broad to know "everything" about, that is not specific about programming.

</comment><comment><USER12> "Ideas are more important than code" \-- Unknown

Therefore, I'd rather have a sketchbook for ideas :)

<comment><USER13> Yes and no. Ideas solidify through code, and then form a solid basis for new ideas. If you never reduce an idea to code it becomes too hard to build one idea on top of another.

</comment></comment><comment><USER14> His "sketchbook" sounds an awful lot like a REPL to me.

<comment><USER15> The difference here is that the code you wrote in the REPL dies with the REPL.

A REPL is more of a "scratchpad", to stay in the family of metaphors being used. Scratchpads and sketchbooks serve similar purposes, but the latter generally is used for things intended to have a bit more permanence and also to be capable of re-visiting.

In any case, I'm pretty sure the main point here is "you need to write a lot of varied code if you want to become an expert at software development".

<comment><USER14> I was thinking along the lines of SLIME, where your evaluated code is preserved by the editor. Sorry for being unclear. Been a long time since I used a raw REPL.

<comment><USER15> There's still a useful distinction to be made -- the "sketchbook" talked about is the collection of stuff you've done over some longer period of time that you can look through / look back on. It's not a description of a tool, although as you noted the language used in the last paragraph of the post is very similar to the language people use to describe the use of a REPL.

I'm a fellow emacs user, I use SLIME-like functionality practically every day. My "sketchbooks" are my ~/workspace folder and my github account. I have some older "sketchbooks" in the form of tarballs of my ~/workspace folders from old machines.

I thought that basically everyone who wrote software had similar collections of little projects, finished and un-finished, until about a year ago when it came up in discussion with a few other devs who didn't.</comment></comment></comment></comment>


GiftAMeme – Give someone a meme :) - <AUTHOR> http://giftameme.com <comment><USER2> i liked it until i saw the fingerprinting & popup advertising script on the page (a pretty shitty thing to do to your users)

things like this make me even more glad i switched off javascript by default (the site even worked fine without it)</comment>