React Redux 6.0 released - <AUTHOR> https://github.com/reduxjs/react-redux/releases/tag/v6.0.0 <comment><USER2> Hah, beat me to posting this!

I'm a Redux maintainer. I'm really excited about the changes in this release. They're primarily internal, but it should help React-Redux work a lot better with React's changes down the road.

In case anyone's wondering, this _should_ be a drop-in release for most users. Just bump your package version and update. If you do run into any problems, please file an issue!

I recently wrote a blog post that goes into more details on how the implementation has evolved over time, and why we changed several aspects of behavior for this release:

[https://blog.isquaredsoftware.com/2018/11/react-redux- histor...](https://blog.isquaredsoftware.com/2018/11/react-redux-history- implementation/)

If anyone's got questions, ask away!

<comment><USER3> I'm curious about the direction react redux will take with the new hook api. What will the react redux hooks will look like? Will that be something that lands soon in an alpha?

<comment><USER2> Yeah, @tlrobinson linked our issue discussing it.

The big blocker for us shipping a `useRedux()` hook is that there's currently no way for a function component to bail out of re-rendering once it starts, and calling `useContext()` subscribes that function component to _any_ update of the context value. The React team has an issue tracking that ([https://github.com/facebook/react/issues/14110](https://github.com/facebook/react/issues/14110) ), and as far as I know that's something they intend to include before 16.7 goes final.

Once that's available, we can look at implementing an official `useRedux()` hook, and ship it in a future release.

That same release would likely also rewrite the guts of `connect` to actually use hooks internally as well. I already threw together a proof-of-concept PR that does this ([https://github.com/reduxjs/react- redux/pull/1065](https://github.com/reduxjs/react-redux/pull/1065) ).

</comment></comment></comment><comment><USER2> Since it's a Redux-related thread, I'll toss out one other sub-thread to let people know what we're working on, and ask for feedback.

We've already completely revamped the React-Redux docs [0]. They're now published as a separate site, and we're writing all-new content, like guides on how to best use `connect`. There's plenty more topics we plan to cover, but it's a big improvement already.

Meanwhile, we're also working on a new build setup for the Redux core docs. Once that's ready, we'll turn our attention to actually revamping the actual Redux docs content and structure. (There's an existing issue if you'd like some info on some of the plans [1]).

So, with that in mind, I'd specifically like to ask:

\- What do you think are the biggest strengths and weakness of the current Redux docs at [https://redux.js.org](https://redux.js.org) ?

\- What topics do we do well?

\- What is not covered, or explained poorly?

\- What would be the biggest improvements we can make to the docs structure and content?

I'd appreciate any constructive feedback people can offer.

Finally, we've got a new `redux-starter-kit` package [2] that can help simplify common use cases like store setup, writing reducers, immutable update logic, and even creating "slices" of your store automatically. I'd encourage people to try it out. I talked some about this package in my recent ReactBoston talk on "The State of Redux" [3]. We'll be emphasizing this package when we rework the tutorials and other parts of the docs in the near future.

[0] [https://react-redux.js.org](https://react-redux.js.org)

[1] [https://github.com/reduxjs/redux/issues/2590](https://github.com/reduxjs/redux/issues/2590)

[2] [https://github.com/reduxjs/redux-starter- kit](https://github.com/reduxjs/redux-starter-kit)

[3] [https://blog.isquaredsoftware.com/2018/10/presentation- state...](https://blog.isquaredsoftware.com/2018/10/presentation-state-of- redux/)

<comment><USER4> Thanks for the great Redux docs. I was not able to find any solid information on how to use Redux with typescript in the docs. Since redux now comes with typescript types (I think), it would be nice to have documentation around how to use them and any best practices to follow and pitfalls to avoid.

<comment><USER2> We've got a work-in-progress PR on adding a docs page to discuss using TS with Redux: [https://github.com/reduxjs/redux/pull/3201](https://github.com/reduxjs/redux/pull/3201) . But, neither Tim nor I use TS ourselves (yet), so we're not experts and don't have the expertise to write this ourselves, or maintain the typings. That's gotta come from the community.

The React-Redux typings are separate, in Definitely Typed. We're considering moving the Redux typings over there as well.

</comment></comment></comment><comment><USER5> Huh. My coworkers have been talking about React's context API as an alternative/replacement for Redux and that the industry is generally "moving away from using Redux." Is this at all true/valid? I've been skeptical since I like Redux a lot and haven't been able to understand how Context is a true replacement for Redux given what I have read.

<comment> oh-kumudo Vote for Mobx to replace Redux. Having done so, not missed a bit.

<comment><USER6> Agreed. State lifecycle is all the same but Mobx automates 2/3rds of the tedious work and is much more natural to use.

<comment> oh-kumudo Not to mention that the API is very intuitive and programmer friendly. For me, using Mobx doesn't force me to write things its own way, but instead enables me to write things MY way, but just hook it up with Mobx when needed. It is a more of a library than a framework, a guest not a intruder.

While with Redux, not that I am bitching about it, it first states that I need to accept several principles before I can better appreciate it. Then here comes all the middlewares, like redux-saga/redux-thunk and the list goes on. As a causal, meaning I am not writing js fulltime but do use it in some non- trivial situtation when needed, I feel it quite heavy and burdensome, making hesitant to adopt it unless being asked to.

</comment></comment></comment></comment><comment><USER7> I used Redux in a major project, and really appreciated using a fairly standardized framework that translates between projects with support including Redux DevTools. However, all the boilerplate was a big drawback. There are scattered solutions, but adopting one takes away from the mainstream appeal of Redux. Is there any hope of a standard way to "reduce" some of the boilerplate?

<comment><USER2> Yes, absolutely! Per my other comment in this thread [0], please check out our `redux-starter-kit` package [1]. I'd appreciate any feedback on whether or not it helps you, and what other capabilities would be beneficial to include.

Lots of people throw around the word "boilerplate", but everyone seems to mean something different by it [2]. Can you clarify what _specific_ things you mean by that?

[0] [https://news.ycombinator.com/item?id=18605421](https://news.ycombinator.com/item?id=18605421)

[1] [https://github.com/reduxjs/redux-starter- kit](https://github.com/reduxjs/redux-starter-kit)

[2] [https://github.com/reduxjs/redux/issues/2295](https://github.com/reduxjs/redux/issues/2295)

<comment><USER7> redux-start-kit looks great. It's been over a year since I've bootstrapped a redux project, but I'd definitely use it next time.

One area that I always felt "there has to be a better way" was defining action names. Typing the same thing twice, as insignificant as it is in the grand scheme. I saw a few libraries that had answers for this, but none were "standard."

Well outside the scope, but it would be nice to easily use action names as navigators via an editor extension. Rekit is doing some really interesting work to use Redux as the way to access an application.

</comment></comment></comment><comment><USER8> It would be nice to see benchmarks between the versions.

I am assuming that this should be faster since it uses react's "proper" API?

<comment><USER2> We did do a lot of benchmarking during the development of v6, and have a standalone benchmarks repo that you can clone yourself [0].

Unfortunately, while I'd also hoped that v6 would be faster for the same reasons, it's a lot more complicated than that. I wrote about the performance implications of the changes specifically in my "implementation" blog post [1].

If you do see performance issues with v6 in your own production apps, please file an issue and let us know.

[0] [https://github.com/reduxjs/react-redux- benchmarks](https://github.com/reduxjs/react-redux-benchmarks)

[1] [https://blog.isquaredsoftware.com/2018/11/react-redux- histor...](https://blog.isquaredsoftware.com/2018/11/react-redux-history- implementation/#performance-implications)

</comment></comment><comment><USER9> No.</comment>


Debunking myths about artificial intelligence - <AUTHOR> http://arstechnica.com/information-technology/2015/12/demystifying-artificial-intelligence-no-the-singularity-is-not-just-around-the-corner/ <comment><USER2> The author hasn't taken the time to read the arguments for AI risk. First, citing Kurzweil as a proponent of AI risk is very odd. Kurzweil thinks AI is the bees knees and doesn't see much risk in it AFAICT. Second, neither Bostrom, MIRI, nor the Future of Life institute claim Moore's law will continue indefinitely or in any way endorse Kurzweil's work.

As for his other comments on AI risk, here's what I wrote last year on a similar thread:

Nobody is afraid of today's AI algorithms. But if we make machines that are smarter than us and have desires, they will influence the future to achieve their desires. If these desires conflict with our own, things will not end well for the dumber party.

As we really have no idea what we, collectively, think of as a moral terminal goal, and less so how to formalize this, there is no reason to expect the first AIs to have goals that correspond to what we want. If AIs self-replicate in a competitive ecology, what would be selected for would be agents millions of times more intelligent than us who use their intellects only to make more copies of themselves - using all available resources including those we need to survive. I'd recommend this summary of the arguments: [https://medium.com/@LyleCantor/russell-bostrom-and-the- risk-...](https://medium.com/@LyleCantor/russell-bostrom-and-the-risk-of- ai-45f69c9ee204#.shqn6fqa4)

<comment><USER3> Don't these arguments kind of assume a few things though? Like, 'strong' AI being implemented into things that really don't need it? I mean, the paperclip example in the Medium article... did that factory ever need AI involved? Couldn't a simple computer program no more advanced than those of today do the exact same job... without the risk of all that 'thinking and making copies of itself' stuff?

Maybe I'm being naive here, but you don't need strong AI in everything.

And they also kind of assume that there's only one AI at a time (what if two factories are run by AIs designed to build different things, and they both end up in this sort of situation at the same time?), that everything is connected to the internet in some way, that humanity couldn't simply wipe out anything that poses a threat (and no, an AI in a factory environment wouldn't get access to anything that would allow for nuclear/chemical/biological weapons). Just seems like a lot of this speculation is based around a society that's making tons of careless mistakes one after another. But maybe I'm missing something here.

<comment><USER4> Don't focus on one scenario leading to disaster. There are many scenarios pointing roughly in the same direction. Here's the argument in its shortest form:

The current situation, where unmodified humans are the smartest creatures around and call the shots, is unstable. It could go several different ways depending on the desires and quirks of the first superhuman intelligence to appear. It could happen via math-based AI, nature-imitating AI, self-improving mind uploads, biological intelligence amplification, or other means. We're making fast progress on all these fronts, so I'd be surprised if at least one of those didn't happen within the next century, possibly much sooner. Since it's an arms race between many competing organizations, it's unrealistic to expect that all superhuman intelligences will be kept powerless. So one way or another, it will happen. How do we ensure that humanity and its values survive the transition?

<comment><USER5> > How do we ensure that humanity and its values survive the transition?

I think a better question is do we deserve to.

<comment><USER6> Which of the people you know personally do you think deserve death?

</comment></comment></comment></comment></comment><comment><USER7> Very weak article.

It prepends several statements with "myth:" and does very little to debunk them.

Example: _AI won 't spin out of control because Moore's laws is nearing its end._

First, is it really? Just because we can't move electrons reliably much faster through much smaller sizes? What's stopping new materials, spintronics, photonics and what have you to take us to the next decades? I've been hearing the end to Moore's laws is "coming real soon" since I was a kid. Lots of clever explanations guaranteeing there was no way we could move past 200nm or so due to physical size of the wavelength used in lithography. And yet here we are using crazy stuff like phase shifting masks and interference patterns routinely.

Second, the brain seems to be a very slow and massively parallel machine, so maybe transistors are plenty small and fast already, we just need to ditch the Von Neumann architecture.

Third, we only need a single strong AI to emerge for it to be a problem. I don't see the clouds from these megacorps getting smaller any day.

I don't really know what I'm talking about, of course, but it takes stronger arguments than _because quantum tunnelling and the speed of light_ to make this case.

<comment><USER8> The fundamental driver behind Moore's Law is shrinking the circuits. The problem is that the circuits are made up of atoms that deliver electrons, and electrical circuits fundamentally _cannot_ go smaller than a single atom, because electricity is movement of electrons between atoms.

We could, in theory, use other technology (some sort of photon-based computer?) to get smaller (and therefore faster) computers, but that wouldn't have the Moore's law mechanism.

<comment><USER9> Though, aren't there also plenty of other mechanisms that affect it? For example increasing speed of manufacturing procedures and improving knowledge about how to design complex systems. The end seems to be extremely dense blocks or spheres of highly optimized computation substrate, where each atom sits very precisely at the right place. But the state of the art is merely a few layers of crude photo-lithography. Imagine nanobots being programmed to move atoms around to assemble 3D circuits at the 10nm scale. I think this is where we are heading, and this will likely grant a couple of decades of continuing exponential progress. And by then our computation power will be insane. An equivalent of the simplest human brain models will likely fit into pea.

</comment></comment></comment><comment><USER10> The arrogance of the subtext that machine intelligence is nothing like human intelligence and therefore inherently inferior and nothing to be afraid of is more disturbing than the prospect of artificial intelligence gone awry as it reminds us how far awry natural intelligence goes routinely.

<comment><USER11> I find it equally arrogant to believe that humans will achieve strong AI any time in the near future.

<comment><USER12> I'm not convinced we are any closer to creating human-level AI than we were before we invented computers..

<comment><USER11> We are closer, but we are still far, far away.

</comment></comment></comment></comment><comment><USER13> It's understandable that many people see the disconnect between fears about strong AI and the much more limited capabilities of AI today, and think that the fears must be overblown. However, this article takes that gut reaction and uses it to justify labeling the views of many prominent philosophers and AI researchers as simply a "myth", without even beginning to address their arguments. I strongly recommend reading Superintelligence, by Nick Bostrom.

</comment><comment><USER14> That article is so naive and misinformed that I was seriously wondering if it was a prank. I suppose it's a nice read if you want to see someone obliviously ramble about things entirely unrelated to the actual arguments for AI risk scenarios.

</comment><comment><USER15> Found this a little ironic, in a funny way - the article was written in association with IBM. Funny enough, the movie 2001 which the article images are from, is hinting to IBM but in an obscured way. For example, the name HAL is IBM shifted one char to the left and you can even see IBM logo on some machines in the movie.

Besides from that I think unless IBM knows the future and all unknowns, we cannot really be sure what will come out of AI. Which is why we should be very careful with it.

<comment><USER3> No, the point about HAL 9000 being named after IBM isn't true:

[http://www.visual-memory.co.uk/faq/index.html#slot7](http://www.visual- memory.co.uk/faq/index.html#slot7)

The video game company HAL Laboratory (maker of the Kirby series)... they did name their company so each letter was one before IBM:

[http://www.nintendolife.com/news/2012/11/iwata_explains_wher...](http://www.nintendolife.com/news/2012/11/iwata_explains_where_the_name_hal_laboratory_came_from)

<comment><USER15> Thanks, I stand corrected. It was a fun theory though and it will probably not go away anytime soon.

Kubrick himself claimed HAL stood for "heuristic and algorithmic" according to this article:

[http://www.slate.com/blogs/browbeat/2013/01/07/hal_9000_ibm_...](http://www.slate.com/blogs/browbeat/2013/01/07/hal_9000_ibm_theory_stanley_kubrick_letters_shed_new_light_on_old_debate.html)

</comment></comment></comment><comment><USER16> Jabbering and laughably geriatric Rupert Goodwin groans 'Get off my lawn!'; spilling his senility swill all over the singularitarian sycophants.

A stalwart moore's law mooter masterminds against the myths of demon-summoning Musk the martian overpopulator and makes mockery of Hawking the Ad-hock Spock- talker.

A luddite weasel word windbag from linearland soothsays naysayers with another numbingly nominal caveat-riddled AI narrow now and forever 'nuffsaid.

An obstinate bunghole spelunker debunks from his spooge-buttered AI winter dunce bunker.

From unsupervised pulpit comes a sump-pumping ass-pastor's anti-diluvian Deepmind denuding diatribe defusing the delinquent debut of an indocile data detonation.

<comment><USER17> Ok, we are still safe. As parent demonstrates, machines still can't even compose coherent text. Nice try, robot slave!

</comment></comment><comment><USER18> The only argument about strong AI not being a threat in this article is that it is difficult to make computers fast enough.</comment>


Ember and Data Down, Actions Up - <AUTHOR> http://www.jeffreyjurgajtis.com/2016/03/19/ember-data-down-actions-up.html <comment><USER2> I can't find the reference but I find the circular way of thinking about dataflow to be a good model. The human triggers inputs, which go through logic which goes through the view and then ends up back at the human. While this may be obvious, if you can keep the data going in only that direction then everything gets easier. I saw this in relation to reactiveX.</comment>


JSModem for JSLinux - <AUTHOR> https://github.com/ewiger/jsmodem

<comment><USER2> What would you use this for?

<comment><USER3> Perhaps to start a single-user BBS directly in your web browser? Then you just distribute your IP address to your friends, and they can dial in (one at a time, of course) to chat with the sysop and upload new warez onto your enormous 60-megabyte hard disk.

A lot of JavaScript and HTML5 demos are about replicating 20-year-old computing experiences.</comment></comment>


Why aren't you using GitHub? - <AUTHOR> http://www.valdyas.org/fading/index.cgi/2015/05/29#no-github <comment><USER3> Kind of telling that of the other comments I see here so far, nobody seems to be addressing what the article is about: because they don't trust github, a for-profit company who hides their source code, to not some day pull a Sourceforge.

We had this discussion in the GNU project. The basic conclusion I could see was that simply using github as a place to host the repo like Linus does with Linux is not a problem. In typical GNU fashion, the biggest problem people saw was with the non-free javascript that entails from using the github web interface. Some also were concerned with whole SaSS problem with github, were they tie you up with wikis, bug trackers, pull requests and a lot of other things around just git hosting that are difficult to transplant to another service.

<comment><USER4>
        they tie you up with wikis, bug trackers, pull
        requests and a lot of other things around just
        git hosting that are difficult to transplant to
        another service.

Are you saying that some people say GitHub should be avoided for GNU projects because it's too useful?

<comment><USER5> "tie you up" might have been better written as "lock you in". Those tools can certainly be made available through other means via free (as in freedom) software. It takes work in doing so and that's what Github is selling - <USER2> and convenience.

Github has obviously done a great job of making these tools useful and approachable. The point about having ultimate control over that data though is valid. Github might be able to mitigate some of these concerns with something like Google's "Data Liberation Front", providing a contractual agreement with users to make their data easily exportable if they choose to do so. Of course, even that may not be enough for some projects and for them it's a totally valid option to avoid github (and similar closed SaaS options).

<comment><USER6> GitLab CEO here, we want to give people options to prevent lock in. GitLab CE already has a one click importer for all your GitHub.com repo's and issues. We're working on automatically importing your pull requests and wiki's too.

<comment><USER7> Do you provide an export function as well, to prevent lock in?

</comment></comment></comment></comment></comment><comment><USER8> I don't use Github because their pricing model for hobby projects sucks. Bitbucket's model of only charging for projects that have more than 5 users makes much more sense.

Also, I don't like monocultures.

<comment><USER9> Talking about monocultures : [https://twitter.com/mjackson/status/604325015333412864](https://twitter.com/mjackson/status/604325015333412864)

That tweet explain that there are numerous cool projects on codepen that you can explore.

</comment></comment><comment><USER10> Github's payment plans don't work out well for a team that's doing lots of small repositories.

My team is pretty small (5 devs) and we easily have 150+ repositories for different packages that all get wrapped into our main product. Github charges per private repository and 125 repositories maxes out github's organizational plans. Hence, we are currently on bitbucket.

The team also didn't want to have to make a business justification everytime someone wanted to fork a repository or throw something together experimental. We would rather just be free to create as many repositories as we please and not have to concern ourselves with the question of whether it should be a public or private repo.

<comment><USER11> You don't have to pay for private forks.

<comment><USER12> What does that matter? They still have over 150 repositories.

<comment><USER13> It matters because he specifically mentions that the team "didn't want to have to make a business justification everytime someone wanted to fork a repository".

<comment><USER14> They wouldn't have to, if they were on Github's maxed-out plan already. There is no higher tier. They're already paying the most. (hypothetically)

<comment><USER12> The maxed out organizational plan ($200/mo) is still only 125 private repositories.

GitHub is just not financially feasible for small organizations with many small, private repos. For small teams like mine (3 + an occasional contractor) that have close to 200 repositories of closed-source code, $200/mo is laughable, particularly when we can host all of that on BitBucket for _free_ because we never go above 5 users.

</comment></comment></comment></comment></comment></comment><comment><USER15> I don't use Github because of their unacceptable TOS. They reserve the right to delete my account and all content for any reason, at any time, without giving prior notification.

Who can operate a real business with that hanging over your head? Seems very foolish to me.

</comment><comment><USER16> Page is down, but my answer to the title is that I don't (always) use github because it's really, really easy to set up a private repo on the Debian VPS I'm renting anyway.

Edit: For those who don't know:

On the server:

mkdir ~/whatever.git

cd ~/whatever.git

git init --bare

On your local machine:

git clone email@example.com:~/whatever.git

That's it. Admittedly you are now responsible for backups, but hopefully you back up your server anyway. And of course you don't get the snazzy web interface but I don't imagine most of us use that much anyway.

<comment><USER17> Sorry, is there an easy way to backup a server (e.g. Debian)? Do you use the provider's "backup your instance" feature? How can you be confident that they'll never close your account and lose ypur backups, for example based on an assumption that something you're doing isn't legit?

<comment><USER16> I use [http://duplicity.nongnu.org](http://duplicity.nongnu.org) to back up my data (not the whole server). I don't know if it's necessarily the best thing these days, but it works OK.

I think the risk of losing my VPS, my working copy and my backups at the same time is acceptably low, given that the world would not end if my git repos disappeared anyway.

</comment></comment></comment><comment><USER5> Server seems to be having issues. Google cache:

[http://webcache.googleusercontent.com/search?q=cache:Y9Z0KT1...](http://webcache.googleusercontent.com/search?q=cache:Y9Z0KT1Z5e8J:www.valdyas.org/fading/index.cgi/2015/05/29&hl=en&gl=us&strip=1)

<comment><USER18> Yeah, my poor blosxom instance running on an ancient ideapad I got for free at a meego conference in Dublin isn't made for loads like ycombinator causes. It's got a load average of over 150 now. The moment my screen session started getting slow, I thought -- someone posted this on ycombinator...

<comment><AUTHOR> Hey boud, sorry for getting your server hammered. Your blog is now getting points on the strength of the title alone.

<comment><USER18> Well, it's down now. I guess I'll bring it up again tomorrow or so.

</comment></comment></comment></comment><comment><USER5> Reading the article, I don't think this was meant as a question to the group here. The question/title feeds into the article explaining why they don't use github. Perhaps a more forum-friendly title would have been "Why We Don't Use Github." I'd be curious to hear people's thoughts on the statements made in the article (see posts with cache link if you can't load it).

</comment><comment><USER19> 1) Because I prefer Mercurial.

2) Because Bitbucket gives me a free academic plan.

</comment><comment><USER20> Because I been using Bitbucket for the past five years and I have no compelling reason to switch.

</comment><comment><USER21> Google Cache: [http://webcache.googleusercontent.com/search?q=cache:Y9Z0KT1...](http://webcache.googleusercontent.com/search?q=cache:Y9Z0KT1Z5e8J:www.valdyas.org/fading/index.cgi/2015/05/29+&cd=1&hl=en&ct=clnk&gl=us)

1) Private repos are too expensive from a value standpoint. Its a $200/month service [ [https://github.com/pricing](https://github.com/pricing) ] for what I can get for $50/month worth of VM time internally.

2) I prefer to support open source projects.

<comment><USER5> Regarding #2. Do you choose to pay some amount to the OSS project(s) you use for this? (seriously asking, not meaning to sound like a jerk here)

<comment><USER21> [https://about.gitlab.com/pricing/](https://about.gitlab.com/pricing/)

Yeah, for work. Not for my side projects.

</comment></comment></comment><comment><USER22> I strongly prefer Mercurial. Github, Inc. seems like a decent company, and I like the UI.

But hg roxx. :-)

<comment><USER23> Why? Are there any technical reasons or is it just the nerd-within wich pushes into the "less popular" choice?

<comment><USER22> sure, a number of reasons.

hg interface makes _sense_. there's clear distinction in semantics between commands and flags. that is not the case with git. git demands being a wizard to be excellent; hg doesn't.

hg repos typically are clones of each other: it takes work to not have all changesets replicated everywhere. the implication of that is that there's no forgetting branches; ergo, there's no confusion about what piece of the dag is pushed and what isn't. it's all pushed.

hg branches are 'true' branches, as opposed to refs. I could go into depth into how that plays out in better ways than git, but that's more of an actual essay.

hg extensions give hg more power - if you really want to get complicated, it's not unbelievably difficult.

hg project makes certain guarantees about stability of interface; tooling is easy to develop around that. tooling makes life better, often.

as a general rule of thumb, the hg project and experience adopts a principled way of choices; this flows out into the code and experience. it's a very clean and "better is better" way of working.

</comment></comment></comment><comment><USER24> Free private repos.

</comment><comment> vezzy-fnord GitHub's issue tracker is pretty bare bones. I always thought that was sort of reflective of its culture.

I'm also not too keen on the entire gamification aspect that GH places on you. I find it gratuitous.

When it comes to layout and design, I think cgit is the leader, though GH is a close second perhaps.

</comment><comment><USER25> Incidentally, for anyone who like's GitHub's features and workflow but not GitHub the organization itself, GitLab ([https://about.gitlab.com/](https://about.gitlab.com/)) has an open-source and self-hostable CE version that's very much "well-executed GitHub clone", with a paid (but still self-hostable) EE version with stuff like extended LDAP/Active Directory and JIRA integration.

</comment><comment><USER26> I agree with the article, and the stated reasons, but a little nitpick:

"And Github's business model is exactly what SourceForge's was."

I don't think that's actually true, is it? Githubs business model is based on enterprise customers, which to my knowledge, SourceForge wasn't. Not that that diminishes the point.

</comment><comment><USER27> Free private repositories; Although I'm using GitHub to host two OSS projects.

</comment><comment><USER28> I actually prefer the cgit interface. It's fast and simple. I just don't trust myself to run a server and do backups, etc. for something as important as source code.

</comment><comment><USER29> Pricing plans for small teams with many repos and because the pull request review sucks compared to Bitbucket.

</comment><comment><USER30> They have a tendency to remove repos that they don't agree with ideologically.

</comment><comment><USER31> I don't use it because I am a one man show. I don't have a need for it.

</comment><comment><USER32> For convenience or in case you can't visit Google or something, here's the text of the article from Google cache as the origin server is down [mirror for the ctrl+f folks]

\---

Why aren't you using github?

Is a question we, Krita developers, get asked a lot. As in, many times a week. Some people are confused enough that they think that github is somehow the "official" place to put git repositories -- more official than projects.kde.org, phabricator.kde.org, git.gnome.org or where-ever else. Github, after all, is so much more convenient: you only need a github account or login with your social media account. It's so much more social, it's so cosy, and no worries about licensing either! So refreshing and modern.

So much better than, say, SourceForge ever was! Evil SourceForge, having failed to make a business out of hosting commercial software development projects is now descending to wrapping existing free software Windows installers in malware-distributing, ad-laden installer wrappers.

The thing is, though, Github might be the cool place to hack on code these days, the favourite place to host your projects: that is exactly what SourceForge was, too, back in the days. And Github's business model is exactly what SourceForge's was. And if that isn't a warning against giving your first- born children in the hands of a big, faceless, profit-oriented, venture- capital-backed company, then I don't know what is!

And yes, I have heard the arguments. Github is so familiar, so convenient, you can always remove your project (until Github decides to resurrect it, of course), it's git, so you're not losing your code revision history! But what about other artefacts: wiki, documents, bugs, tasks? Maybe you can export them now, I haven't checked, but what will you import it into?

I've spent over ten years of my life on Krita. I care about Krita. I don't want to run that sort of risk. One thing I've learned in the course of a mis- spent professional life is that you always should keep the core of your business in your own hands. You shouldn't outsource that!

So, one big reason for not moving Krita's development to github is that I simply do not trust them.

That's a negative reason, but there are also positive reasons. And they all have to do with KDE.

I know that a lot of people like to bitch about KDE -- they like to bitch about the layout of the forum, the performance of the repo browser, the size of the libraries, the releases of new versions of the Plasma Desktop, about fifteen year old conflicts with the FSF (which somehow proves to them that KDE isn't trustworthy...) The fact is that especially in the Linux world, a bunch of people decided ages ago they didn't like KDE, it wasn't their tribe and they apparently find it enjoyable to kick like a mule everytime we do something.

Well, shucks to them.

Then there are people for whom the free software world is a strange place. You don't see something like Corel Painter being hosted together with a bunch of other software on a bigger entity's website. It's confusing! But it's still strange, to many people, to see that Krita shares a bug tracker, a forum, a mailing list platform, a git repository platform with a bunch of other projects that they aren't interested in.

Well, I see that as a learning moment

And not as a hint that we should separate out and... Start using using github? Which would also mean sharing infra with a bunch of other projects, but without any sense of community?

Because that is what make KDE valuable for Krita: the community. KDE is a big community of people who are making free software for end users. All kinds of free software, a wild variety. But KDE as a community is extremely open. Anyone can get a KDE identity, and it doesn't take a lot of effort to actually get commit access to all the source code, to all projects. Once in, you can work on everything.

All the pieces needed to develop software are here: websites, forums, wiki's, bug trackers, repo hosting, mailing lists, continuous-integration, file hosting, todo management, calendaring, collaborative editing, file hosting. The system admin team does an incredible job keeping it all up and running, and the best thing is: we own it. We, the community, own our platforms and our data. We cannot be forced by a venture capitalist to monetize our projects by adding malware installers. We own our stuff, which means we can trust our stuff.

And we can improve our platform: try to improve a closed-source, company-owned platform like github! So suggestions for improvement are welcome: we're now looking into phabricator, which is a very nice platform giving a lot of the advantages of github (but with some weird limitations: it very clearly wasn't made for hosting hundreds of git repos and hundreds of projects!), we're looking into question-and-answers websites. Recently, the continuous integration system got improved a whole bunch. All awesome deveopments!

But moving development to github? Bad idea.

</comment><comment><USER33> Basically, they don't want to. I don't see any relevant argument made on this text.

<comment><USER34> Not how I read that.

>So, one big reason for not moving Krita's development to github is that I simply do not trust them.

>We cannot be forced by a venture capitalist to monetize our projects by adding malware installers. We own our stuff, which means we can trust our stuff.

Whether you agree or disagree, they did in fact make an argument.</comment></comment>


Chinese Boy with Ability to See in Pitch Black Stuns Medics - <AUTHOR> http://www.whydontyoutrythis.com/2013/08/chinese-boy-with-ability-to-see-in-pitch-black-stuns-medics.html?m=1

<comment><USER2> This is perfect nonsense -- it's false.

<comment><USER3> I agree that all the reading-in-the-dark ability is fake (or at least extremely exaggerated). Someone posted a skeptical link with more info in another thread about the same boy. [http://www.livescience.com/18209-china- cat-eyed-boy-night-vi...](http://www.livescience.com/18209-china-cat-eyed-boy- night-vision.html)

It's very difficult to debunk completely this kind of "discoveries" but a very big red flag is the lack of independent confirmation. In particular they site as a source an article from "worldrecordacademy". (I prefer to not even paste the link here). After reading that I am even more convinced that this is not legit. (If it were confirmed at least by the Guinness World Records, I would start to look for more information, but still be very skeptical.)

<comment><USER2> > It's very difficult to debunk completely this kind of "discoveries"

Sometimes true, but this one is easy. There are too many impossible claims packed into a single account. By itself, the claim that the boy can function without any source of light in a completely dark environment falsifies the account.

Also, in science, the default assumption is that it's false (null hypothesis) and the entire burden of evidence rests with the claimants to offer evidence.

> but a very big red flag is the lack of independent confirmation.

Not very important by itself. Any number of astrologers will independently confirm the accounts of other astrologers, and Bigfoot investigators back each other up all the time. And psychologists are famous for circling the wagons when confronted by skeptics.

> After reading that I am even more convinced that this is not legit.

Again, it's not up to the scientific skeptics to doubt and disprove. It's up to the claimants to offer evidence. The burden of evidence rests entirely with those making extraordinary claims.

<comment><USER3> I agree that this is fake and that _they_ should give indisputable evidence to convince me that this is true.

The problem is how to explain this to the non scientific people. Most people can't understand the difference between the scientific evidence behind quantum entanglement and Bigfoot. Everything that is in a newspaper is true.

The problem is that pseudoscientific news gets rehashed. It's a nice (false) story and I'm afraid it will get resubmitted from different sources until one of them gets 50+ upvotes, and we both will be unhappy. I only hope this story is not nice enough, or not technology related enough.

From another point of view: How do a layman reading the newspaper evaluate if a story is "true"? It's a good sign that the story the source is someone from a well known university. It's a bad sign that the only source is a video in Youtube. The problem is that this is very close to an appeal to authority argument, and the second problem is that for an advertisement it's enough to put an actor with a lab coat to backup the claims.

And even if you have a scientific background, you can't retest every result, so you must evaluate and weight the sources. Is this published in a well known journal? Is this against some well known result? Have anyone reproduced the experiment? Is there a strike of similar claims that were proved wrong/fake/scams? Have you ever measured the mass of one electron? Do the neutrinos have mass?

<comment><USER2> > The problem is how to explain this to the non scientific people. Most people > can't understand the difference between the scientific evidence behind > quantum entanglement and Bigfoot. Everything that is in a newspaper is true.

Yes, sad but true. That's a problem with education -- the kind of education that tells people _what_ to think but doesn't teach _how_ to think. And in a society like this one, the skepticism necessary for science comes into conflict with its diametric opposite, religious faith.

> It's a good sign that the story the source is someone from a well known > university.

No, that's false -- if that were true it would replace understanding with an empty respect for authority, but authority has no standing in science. "Science is the organized skepticism in the reliability of expert opinion." — Richard Feynman

In science, evidence means everything, reputation means nothing. The greatest amount of scientific eminence is trumped by the smallest amount of scientific evidence.

It's important to understand the role of the null hypothesis in scientific thinking. The null hypothesis is a precept that assumes a claim is false until evidence forces us to a different conclusion. This contradicts the more common unscientific outlook, in which things are true unless proven false.

> And even if you have a scientific background, you can't retest every result, > so you must evaluate and weight the sources.

But without a direct understanding of a claim and its background, educated people don't just abandon skepticism, they remain skeptical of everything they can't personally investigate. The motto of the Royal Society, the world's oldest scientific society, is "Nullius in Verba" \-- don't take anyone's word for it.</comment></comment></comment></comment></comment>


Facebook fan page removed 2x (Once for blocking Facebook tracking) - <AUTHOR> http://www.quora.com/What-tech-news-sources-could-I-enlist-to-assist-with-getting-a-Facebook-business-fan-page-back

<comment><AUTHOR> I consult with Getcocoon.com and work on their social media accounts as well as blog for them. Facebook has become a HUGE pita lately with fan page censorship...

I have great instincts and noticed strange things happening prior to the first fan page removal. 1- You can't login and start to get messages that your account is currently unavailable due to site issues. 2- they do not send an email or reason why your fan page was removed. 3- your fan page still shows up in facebook search but you can't access it. So today I posted about "Facebook Application permissions and how to take control of them." The same three steps I listed above occurred again...

The Cocoon Firefox plug-in is all about Internet security and privacy and has options to block 3d party ad servers and Facebook tracking - obviously this does not play well with Facebook.

Cocoon had under 300 fans - so they could easily squash the page(s.) I need people like you to help (I'm not sure how yet) but I know you have big voices and potentially big feet - to move this post ahead so that it gets noticed.

Can you help out?</comment>


On doppelgängers and perception - <AUTHOR> https://aeon.co/ideas/havent-we-met-before-on-doppelgangers-and-perception <comment><USER2> I got word from a colleague at a conference that my doppelgänger was afoot. Next time I went to the same conference, I met him and we took pics together. As I was watching him give his talk and he was in profile, it was really strange to feel _that totally looks like me up there_. Chilling.

<comment><USER3> I got mine from my mom when she was in Abu Dhabi, she cannot believe her eyes when she sees him, she said even his mannerism is mostly the same as mine. The guy seemingly disturbed by my mom's observation and left the place.

I'm from Indonesia.

</comment></comment><comment><USER4> One look at the picture provided convinces me that one's chances of finding one's Double, even in a see of millions of people, is probably negligibly small. Those people are not "dead ringer"s for each other.

<comment><USER5> Seems like something that would be solvable by technology. Facebook has a dataset of what billions of people look like, they could probably find 2 or 3 who look exactly like me

<comment><USER6> The women profiled here set up a website for it: [http://www.twinstrangers.com/](http://www.twinstrangers.com/)

<comment><USER7> One could upload celebrity headshots and find their doppelgangers here</comment></comment></comment></comment>


15 Ultimate Features of Chrome 6 - <AUTHOR> http://tech18.com/15-ultimate-features-chrome6.html <comment><USER2> Integrated PDF viewer is a very nice addition. I always liked how my preferred Linux browser, Konqueror, had Okular to integrate with.</comment>


Show HN: Wordpress Scoreboard Plugin - <AUTHOR> http://jumboboard.com

<comment><AUTHOR> Just wanted to share my first wordpress plugin, it's called JumboBoard. I've always loved sports blogging, but could never find a tool to help me showcase custom scoreboards on my site(s), usually wordpress. So I came up with the idea to build a Wordpress Scoreboard Plugin that allows me to showcase, share, and create scoreboards for my site.

Would love feedback, thoughts. Thanks HN!</comment>


Ask HN: How do you handle support during weekends and holidays? - <AUTHOR>

Hello,
A few months ago I started a startup creating social games all by myself as a tryout, without creating a company. I currently have 300.000+ users and development has halted since I do support all day. So I decided it's time to create a company and hire at least two full-time support employees.
I'm currently doing all the support myself and it's turning into 16-17 hour marathon each day. Luckily, most users are in the same timezone, so they sleep at the same time I do. I want to split this 16 hours into two shifts, so I can cover everything with 2 people. However, I cannot ask employees to work 7-day weeks, so I'm considering what is the best approach.
One idea is to have employees do the support Monday-Friday and I would still cover weekends. Another is to tell them to work each Saturday+Sunday and have some other two days free instead. Or I could hire a third support person and make some combination but then someone would not work full time.
I'm looking for advice from someone who had a similar experience. Say you have small team and need to do 24x7 support, how did you handle it? Should I still do any support myself, or focus on developing features and fixing bugs only? How to handle support work on weekends?  What did you try and how did it work?
Thanks. <comment><USER2> Consider outsourcing your customer support to a company that specializes in it.

If you just hire two full-time employees, you're still going to be picking up the slack on weekends or when someone gets sick, goes on vacation, or resigns.

A vendor that specializes in customer service will be able to train multiple employees on your product and rotate them as necessary to give you 16/7 or 24/7 coverage if that is what you need.

Set the goal of having your customer service vendor handle 100% of first-line support inquiries. They should have a manual that tells them what to do in any conceivable situation that could arise.

Obviously, it's a lot of work to write this manual, or even to think up/research all of the possible problems a customer might have. Start by just identifying the top 4 or 5 issues and writing down what you currently do when someone has that issue.

Give this info to the CS vendor and tell them that it is their job to maintain the manual and to contact you whenever a situation arises that is not covered by the manual. When they call you, tell them what to do, and insist that they record this in the manual and handle all future situations of that type in the same way.

You should never do customer support unless either you _like_ doing it, or because you are concerned about getting out of touch with your customers' wants, needs, and desires.

And if you really want your business to grow, you should find someone else to write code and fix bugs for you, too.

You're not a developer anymore. You're an entrepreneur. Yes, you can be both, but you can't simultaneously be _excellent_ at both.

You've figured out how to get 300,000 users for your games, and you're apparently making enough money to pay for employees, which is phenomenal. Wouldn't all of that talent and skill that you have be better spent identifying new products to create, new ways to monetize your existing products, strategic partnerships you could form, new ways to get customers, etc.?

An excellent book on this subject is "The E-Myth Revisited" by Michael Gerber. He talks about how a business needs three personalities: a technician, a manager, and an entrepreneur. Most people who start businesses get stuck in the "technician" role all day and keep working _in_ their business instead of _on_ their business. A successful, sustainable business has employees who do most (or all) of the day-to-day work and supervision, with the founder/leader free to think and act strategically.

<comment><AUTHOR> Great advice. I guess I really have more to think about here than just "how to handle support". Thanks Brian.

</comment></comment><comment><USER3> Reach out to your most active users and ask them if they want to help moderate for you.

Give them premium content or even just cool badges that other users can see in exchange.

Make it personal. Email them and ask for their advice. Listen to it even if you don't implement it all. People love to help and they love to be heard. If you do it right they'll like your game even more.

<comment><AUTHOR> Not a bad idea. Although, in my case, support also involves support regarding user payments, so it's a little bit sensitive issue to allow users to even access this data for other players. I'll have to think about this. Maybe just provide support for payments myself, and leave rest to most engaged users. Thanks.

</comment></comment><comment><USER4> I have one full-time CS employee and he works 39 hours(ish) per week during weekdays and one hourish over the weekend. That was in the job description and we talked about it during interviews. It was a deal breaker, for me, if the candidate was unable to commit an hour over the time between "Friday and the next work day" to manage answering tickets and helping customers.

But going from zero employees of any kind to two full-time CS employees so that you can save time is foolhardy, at least in the short term. If you think you have no time to code now, just wait until you have employees yet have no training plan/manual for them to follow. I'd suggest you find one "all around" person and have them do CS as part of their job. The other parts of their job are various admin duties - mail, filing receipts, etc. If you find that, after 3-6 months, you need another employee, then you have a built-in trainer for the new person.

</comment><comment><USER5> Personally I think 24x7 support for something that is not "Mission Critical" is overkill. Unless you are a hosting company, Point of Sale, or payment processor, I think 24x7 support is a lot to ask. How many times have you got a support request over a weekend or at midnight that "had" to be answered immediately and could not wait until the morning. I think on holidays and weekends it would be nice if someone just checked the support Q for any emergencies and let the rest wait until the next business day. Most businesses are not 24x7 and I would not expect a support request for a game sent on Saturday to be answered that day.

[edit]

Also good practice to not do any code deploys on Fridays or day before a holdiay

<comment><AUTHOR> Well, we do support for payments as well (part of payments goes through Fortumo, and it is their requirement that we handle support), so I guess this counts as "payment processing"?

</comment></comment><comment><USER6> I guess I'm confused why you need 24x7 support for a "social game". What would happen if it took 48 hours to respond? Very few companies that I deal with respond much quicker than that.

<comment><AUTHOR> Well, the game is highly competitive on a daily basis, so players would get mad. I also run public Facebook pages for these games, and if I do not answer some stuff for hours, mayhem happens. It is not in English, otherwise I would given links to see for yourself.

I also believe that prompt support and solving customers problems within a short period of time would mean a lot to users. If you are in a middle of highly addictive game and you get stuck because of our error, you might cool down and not be in the same mood to play it next time.</comment></comment>


(debunked) PayPal vulnerability allows access to any account within 30 seconds - <AUTHOR> http://thenextweb.com/industry/2011/06/16/paypal-vulnerability-allows-access-to-any-account-within-30-seconds/

<comment><USER2> Appears this is a non-issue. For those who have been following. Matt Langley (the person who "discovered" the issue) has been posting updates here:

[http://namesake.com/conversation/mattlangley/i-just- accident...](http://namesake.com/conversation/mattlangley/i-just-accidental- hacked-paypal-it-took-30-seconds-and-i-had-total-access-to-someone-elses- account-im-shocked-what-does-the-community-think-of-the-total-lack-of- security-measurer-used-by-paypal-basically-they-gave-me-access-to-someones- bank)

Relevant post:

 _"It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address._

 _Cheeky bugger. I'm gonna have to ask them to close it down or at least change the email address._

 _but I guess I owe you all an apology"_ \- Matt Langley

edit: someone else posted this too.

so, some commentary. This should have been verified before posting, as it has caused some trouble for people who delinked their account etc. That said, I understand the rapid news cycle of blogging, though with something this potentially serious, I would think it would need to be verified.

Side note, first time I'd seen Namesake and it's kinda cool. Wish I could search.

<comment><USER3> When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have email@example.com, then emails to firstname.lastname@example.com will also go to you, and firstname.lastname@example.com will also go to you.

What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails.

There is no vulnerability. Only stupid people signing up with other peoples' emails.

<comment><USER4> But there continue to be reports that GMail has some issues with the dots where firstname.lastname@example.com and email@example.com can be two different accounts:

[http://www.google.com/support/forum/p/gmail/thread?tid=60cbf...](http://www.google.com/support/forum/p/gmail/thread?tid=60cbf54a7bea10b0&hl=en) [http://www.google.com/support/forum/p/gmail/thread?tid=2d9f3...](http://www.google.com/support/forum/p/gmail/thread?tid=2d9f38bf10a53893&hl=en)

<comment><USER5> This is just people that don't know how GMail works.

Quoting your first link:

> I receive internal business emails addressed to this other guy and when I > email him back, it comes back to me.

It obviously will come back to him, because the guy is emailing himself.

</comment></comment></comment></comment><comment><USER6> I don't have any information about this other than what's in the article. However, as a proactively paranoid precaution, I've chosen to temporarily de- associate my company's bank account from its paypal account, just to make it impossible for an attacker to drain those funds.

I know that if this does turn out to be a legit security issue, Paypal's engineers will soon deploy a fix, after which I will just re-associate it.

The procedure is:

      1) log into your paypal account
      2) click "profile"
      3) Click on "My Money"; or if you don't see that, look for the subheading "Financial Information" and click "Bank accounts"
      4) You should see a link for the bank account; select it
      5) click "Remove"
      6) *confirm* on the next screen (be sure to click that "confirm remove" button)
      7) See the confirmation message

That's it. Depending on your Paypal balance, you may want to try transferring funds into the account before dissociating. [EDIT: Or maybe not, sounds like it could block the disassociation procedure - check the comments below.] I don't know if you can do both in sequence quickly; fortunately our paypal balance happened to be really low today.

<comment><USER7> I'm actually more afraid of delinking then relinking a bank account setting off some kind of red flag at PayPal's risk department than losing the balance of a bank account. PayPal's the preferred way to pay for millions of people, losing access to it forever as a business may be worth more than my current linked assets.

<comment><USER8> Man, I seriously hope I never find my business relying so heavily on another business that I mistrust that much. That would keep me awake at night.

<comment><USER7> Oh it does. And it always happens when you least expect it. I had my main source of income disappear overnight twice.

Once was when 5 chargebacks came in on one day early in a month from a set of 5 credit card payments made by a single scammer; that put my account over some chargeback percentage level allowed by my merchant account provider and they terminated me on the spot after years of service. I had to ask dozens of customers with monthly subscriptions to sign up again with another payment provider, not all of them did.

The second time Google decided it would no longer allow AdWords ads for an entire category of (perfectly legal, non-scammy) services and suspended all ads in that category, including mine. Overnight my largest source of customers is gone and is never coming back. There's still Bing/Yahoo! but nobody quite matches the reach of Google for online advertising.

At this point I plan backups for the loss of every possible business relationship just to keep myself sane... while praying I never have to switch to the backups because there's obviously a reason they're the backup and not the primary.

</comment></comment></comment></comment><comment><USER9> Updated. Doesn't looks like a huge issue, although obviously needs to be fixed;

"It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address."

From [http://namesake.com/conversation/mattlangley/i-just- accident...](http://namesake.com/conversation/mattlangley/i-just-accidental- hacked-paypal-it-took-30-seconds-and-i-had-total-access-to-someone-elses- account-im-shocked-what-does-the-community-think-of-the-total-lack-of- security-measurer-used-by-paypal-basically-they-gave-me-access-to-someones- bank)

</comment><comment><USER7> Mr. Langley posted screenshots and additional information on Namesake earlier today:

[http://namesake.com/conversation/mattlangley/i-just- accident...](http://namesake.com/conversation/mattlangley/i-just-accidental- hacked-paypal-it-took-30-seconds-and-i-had-total-access-to-someone-elses- account-im-shocked-what-does-the-community-think-of-the-total-lack-of- security-measurer-used-by-paypal-basically-they-gave-me-access-to-someones- bank)

Among other interesting tidbits: "All users are potentially vulnerable, but users of free email services are the most vulnerable, for reasons that I won't divulge until Paypal have fixed it."

<comment><USER10> That implies that it's easier to get the password change email sent to an address with a different local part at the same domain than to a completely different domain.

<comment><USER11> He also noted:

      @Alex Khomenko told me in another place, that there may be
      a secondary authentication on password changes from the
      forgotten password link, in the US PayPal. If true and
      currently in place this would mean that the US is not
      vulnerable, although they may still have the email bug

He said he doesn't use PayPal himself and that he only requested a change password link when he was trying to contact them about "effective spam". Perhaps he supplied them with one of his email addresses and it happened to have a counterpart at a different subdomain (like firstname.lastname@example.com vs firstname.lastname@example.com)?

EDIT: Formatting.

</comment></comment></comment><comment><USER12> For US accounts, PayPal requires a person to verify the security question on the account if one was set or the credit/debit card number before being able to change the password.

</comment><comment><USER13> This is rather scary.

Surely my bank would notify me though if my credit card started getting hammered. I don't suppose I'm the target thieves would be looking for though, it'd be those with large balances sitting in their account.

The article is rather light on details though, I wonder just how true it really is. That said, they have nothing to gain (other than impressions) for running it.

</comment><comment><USER14> It would be great if the article had a proof of concept (or at least a more detailed explanation). I don't feel like doing it myself to verify if it's true, and put my account at risk at the same time.

<comment><USER15> There's no reason to publicly describe the attack. Even if you weren't planning on being evil, it would be incredibly easy to abuse.

</comment></comment><comment><USER16> This is Zee from The Next Web. Just woken up to this and have personally spoken to Matt Langley the person in question who - after some convincing - explained the entire process to me.

It is indeed not a massive security vulnerability but a much smaller one. We're updating our piece as we speak and can only apologise that we published before being absolutely sure of the level of the treat.

</comment><comment><USER17> At least no one can say that PayPal is ever lax on security. This vulnerability, if it exists, could be more of an honest developer mistake.

I was recently travelling abroad, and decided to buy Glyphish icons to finish an app I was working on. This proved to be tough. Upon logging in to my PayPal account, I got locked out.

"We want to check with you to make sure that no one has logged in to your account without your permission."

My account now states that it is "limited" and has some drivel about me having to send my driver license/passport/etc. copies to re-enable my account. I understand that this is all in the name of security, but really, I wish they didn't use such heavy-handed one-size-fits-all measures.

</comment><comment><USER16> So this is the gist...There is a small vulnerability because Gmail allows you to include dots in your email address, it essentially allows anyone to create multiple Paypal accounts with the same email address because Paypal recognises the inclusion of a dot as a separate email address entirely. It's seems like a flaw but not a massive security vulnerability.

Also Paypal also doesn't appear to verify email addresses on registration so anyone can create multiple accounts for the same person without any need to click a confirmation link in a verification email. Again, a flaw but not a massive security vulnerability as far as we can tell.

<comment><USER3> It's not true and it's not a 'vulnerability'.

When you sign up for a gmail address, all dot variations of the email address belong to you. So if you have email@example.com, then emails to firstname.lastname@example.com will also go to you, and firstname.lastname@example.com will also go to you.

What happened to the OP is that somebody signed up using a variation of his email. Obviously, if I signed up at paypal with YOUR email address, you'd start receiving MY paypal emails.

There is no vulnerability. Only stupid people signing up with other peoples' emails.

</comment></comment><comment><USER18> Next time you _think_ you discovered a gigantic easily exploitable security hole in a mature service that has been around for 10+ years, please think again and research it a lot more before you make a fuss about it. It's possible, of course - but not very damn _likely_. It's much more likely you are confused. I tried to tell Matt Langley that yesterday on Quora, but he didn't quite buy it, and now he's drinking one big mug of mea culpa. Hopefully this thing will blow over soon, but as a former employee it pains me to see PayPal having to debunk this in social media this morning.

</comment><comment><USER19> Update: "It seems that the 'victim' had opened an account using an email address of mine, with extra characters thrown in, which Gmail ignores and accepts as the same email address, so it was gmail which uncorrupted the email address and sent the emails to me, not Paypal. I had previously reported an account set-up with fraudulent email address to Paypal many times in the past, but only yesterday noticed that the email address was different to mine, in a way which on any other email system in the world would be a different email address."

</comment><comment><USER20> Seeing how he and the guy he hacked are both on gmail, I would guess that this might be a case of "mjfoo is the same as m.j.foo", or a gmail account that had been deleted before, but is still associated with a Paypal account. Paypal exist because of fraud detection and working security. If they had singe stupid bug like unescaped wildcards or something, that would be quite a shadow cast on their one main selling point.

</comment><comment><USER21> I suspect it may have to do with RFC 822 arcana. There are a lot of ways to encode the same email address.

</comment><comment><USER22> Just how serious is this? Is this just some guy who stumbled on a hack and can't repeat it? Or is this some fundamental flaw in Paypals security.

In other words, do I need to worry about my Paypal account? My account is link to a checking account and cc.

</comment><comment><USER23> Mind changing the title of this thread?

</comment><comment><USER24> The post has been updated to state that this was debunked, though there are no details.

</comment><comment><USER25> may be using that exploit i'd finally be able to get back access to my account that i set up with my previous work email address and forgot to update before i left the company and lost the access to the email address.

<comment><USER26> Heh. You should suggest that to paypal's tech support so we can get a bugfix in faster. They might care a great deal more about you getting your stranded money back than crackers stealing users cash...

</comment></comment><comment><USER27> Well done, PayPal. Well done. The one thing that I don't need compromised... :(

</comment><comment><USER28> NOTE: According to the source, this has now been debunked.

</comment><comment><USER29> Don't Panic!

<comment><USER29> Having slept on it, I would like to point out that I did gain complete control of someone else's account, viewed their personal information, and could have conducted transactions against any credit card or bank details they had set- up.

The reason its a non-issue is that this only happened because they set up the account with an email address they did not control, but that only became apparent later by which time this has got away from me.

</comment></comment><comment><USER30> Well, at least Mr Francis Tan and thenextweb.com won't have to worry about their accounts' safety anymore... since they will definitely get frozen ASAP.

</comment><comment><USER31> Seems to be fixed, if not I'm missing something and need to wipe my account. Can anyone verify?

<comment><USER7> How do you know if this is fixed or not? The article didn't provide any details about the exploit beyond saying there's a bug in the e-mail system for password recovery.

<comment><USER31> Well, the article said "any paypal account", and I can't get it to send a reset token to an unauthorized email, so at the least it seems that either the claim was wrong, or they fixed it.

<comment><USER26> "It's a bug in their email system that _corrupts_ email addresses."

If you submit just the right from data you can probably corrupt the address in a predictable way. I don't think they mean just entering in a bogus address somewhere.

<comment><USER29> Yup, nail on the head. And this post scared the begeezes out of me, because it was so close. You had me on the phone to Paypal Australia within seconds. Cost me a fortune.

Luckily, I was completely wrong, and all is well. Sorry for anyone who panicked. I wasn't expecting it to get published so quickly without further discussion. I didn't even provide the screen shots at that time. It's all rather embarrassing. Mr Zee Kane took charge when he woke up and we worked through it once I got some key movers to endorse him. I didn't want to spread the apparent weakness to those who might take advantage of it. I was hasty in following advise to make it more widely known, and they were hasty to publish straight away without further discussion.

The account I was given access to was set-up against an email synonym I didn't know about, and Paypal never bothered to verify the email address. It's not my account though, someone else's name, address, and other details. A bit nefarious but not a security issue unless you plan to open a account with someone else's email address. Now, I'm not sure who's the hacker and who's the victim! I plan to request that Paypal disable the account, or at least remove my email from it, and if they refuse I will change the email myself.</comment></comment></comment></comment></comment>


Code Spaces data and backups deleted by hackers - <AUTHOR> http://www.codespaces.com/?hackernews <comment><USER11> Leaving aside the obviously deficient sysadmin work here: the timeline of the story doesn't add up. I can only hope this explanation is not accurate.

You find notes in your AWS control panel saying you should contact some Hotmail address. OK. So the first thing you do is reach out to that address and take the time to communicate intricate extortion details? Only after that you think maybe it's a good idea to start changing passwords, and right then the other party takes action and deletes all the things?

If that's what actually happened then I'm afraid something like this was bound to happen sooner or later.

<comment><USER12> I feel that a lot of people here are being unnecessarily harsh. It was all a bit of a silly mistake in hindsight but Code Spaces was a very new service I'm not even certain it had secured funding yet.

The timeline looks to me like email address shows up. Check email address. Email address contains extortion details. Try to change passwords. Hacker gets in again and again while deleting stuff. Cannot get rid of hacker. Do not have money. Within 12 hours everything is gone.

<comment><USER13> They have existed for a number of years[0]. Even still, being a new service is no excuse for such poor handling of OpSec.

[0]: [https://twitter.com/CodeSpaces/status/265757401368637440](https://twitter.com/CodeSpaces/status/265757401368637440)

</comment></comment></comment><comment><USER14> Is it possible to 'lock' your amazon control panel to a specific set of IP addresses?

In the payment world it is a fairly common feature to use a block-by-default strategy for such crucial controls.

Hosting your project management and your sources with other companies always did feel strange to me. I can see how it works well for open source project and git (after all, every repo is a complete copy) but to host the master of a subversion repo 'in the cloud' and to have your project management in the cloud feels uneasy to me.

If this or something like it would happen to github and all the github issues would be lost that would be a fairly major disaster.

You never know how solid the infrastructure and solutions chosen behind a nice looking web front are until it goes down, and this one went down hard.

Condolences to the _users_ of codespaces.com, they are the ones who lost most in all this.

From codespaces backup page:

" Real Time Backups Backup

All your Source Code is backed up in real time, so that in the unlikely event of a system break down your data is safe.

Not only do we Back Up your data we also give you access to our backup up data via the Code Spaces Admin console so you can keep your own copies.

Whenever you make a change we make a backup."

So much for that I guess, if it is spinning and online _it is not a backup_.

<comment><USER15> > So much for that I guess, if it is spinning and online it is not a backup.

True, although with S3, you can make backups very difficult to remove:

[http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelet...](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMFADelete.html)

"If a bucket's versioning configuration is MFA Delete enabled, the bucket owner must include the x-amz-mfa request header in requests to permanently delete an object version or change the versioning state of the bucket. The header's value is the concatenation of your authentication device's serial number, a space, and the authentication code displayed on it. If you do not include this request header, the request fails."

<comment><USER14> Yes, so all it takes then if for amazon to either be buggy or to fail for some reason. You can't really outsource responsibility for stuff like backups. They should be under your control and yours alone, and they should not live in the same DC or with the same provider where you store the rest of your data.

And when you've made your backup you take it offline so that no matter what you can get back in business.

<comment><USER15> Okay then. Where would these backups go? S3 is easy to backup to. Tarsnap is nice. Rsync.net works as well. But these are all online backup options.

If you're advocating offloading to physical media, you need someone who is going to religiously do it (execute code, pull to removable flash drive/SATA dock), and the more up to date you want your backups to be, the more tedious it becomes.

How much are you willing to spend to have AWS Export send you a physical SATA drive nightly?

<comment><USER16> > Where would these backups go?

Why not to a big disk sitting on a computer in your house?

The server doesn't push to it, the home computer pulls from the server (via a cron job or something). That way an attacked can come in from somewhere else. It doesn't have to be perfect, and it shouldn't be your _only_ backup. But having something like that is great for catastrophes like this.

<comment><USER17> and then your house burns down, floods, is robbed.

<comment><USER14> One of the basic premises behind a solid backup strategy is that if disaster hits that it does not hit simultaneously in all places. If that does happen then I think you have different problems to contend with than trying to restore your backups.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> That's extraordinary .. but it does drive home the distinction between "backup" and "online second copy of your data". Proper backups should be offline when not in use.

<comment><USER16> > Proper backups should be offline when not in use.

I'm not sure I'd go that far, but I'd say that backups on the same service as the data aren't a good idea. It would smart of use a different cloud provider for the backups and (depending on the size of the operation), even a disk sitting in someone's house somewhere, just in case.

<comment><USER19> That's why I have a Mini on the bookshelf that SSH's into an EC2 instance (IP restricted) during a 1 hour window each night when the router is set to open and copies that day's PGP'd backups over. Then it goes back to sleep to wake on schedule the following night. Not the same as a tape in a vault, but it's my _last resort_.

</comment></comment></comment><comment><USER20> All I can say is this:

If you can delete it with a single control panel, it doesn't count as an offsite back. Fire the devops

<comment><USER15> DevOps here.

There are some things you aren't going to expect (compromise of your AWS console). This could have been solved by having MFA enabled, as well as having the app push backups in realtime, versioned with delete protection, to S3 buckets under the control of another account (write access, but no delete access).

Show of hands how many people here are doing it this way.

<comment><USER21> Seriously, if your root account and all full admin accounts aren't using MFA you're just asking for it. Also if you're not using purpose specific access keys, you're just asking for it. If the first thing you do isn't calling AWS support, wow...

<comment><USER22> Couldn't agree more. Everything under a single platform, no MFA, no (real) _offsite_ backup, and on top of that they spent 12 hours _corresponding_ with the attacker, instead of immediately calling Amazon to ask their help to shut down everything, while they still had time?

I'm sorry, but this is a succession of things _not_ to do in terms of system operations. Probably the team never managed mission critical platforms before, and hopefully they now learned the lesson.

<comment><USER14> How many companies have not yet learned that lesson? There are probably a lot of codespaces on AWS. My reasoning is that if you make it so that a developer can set up a virtual datacenter but does not have the background of actually running such an installation then you're going to have to assume that it is probably quite fragile.

Software people tend to make all kinds of assumptions about hardware that do not work out in practice.

<comment><USER22> That the problem with the recent "DevOps" trend. Lots of people coming from a "Dev" background, but no real "Ops".

And now that spinning up a couple of servers on AWS and creating snapshots on- the-fly are so easy, it gives the false impression that you don't need much to act as a sysadmin.

</comment></comment></comment></comment></comment></comment><comment><USER23> They ran a code hosting service and they had _no_ offsite backups?

Wow, just wow.

<comment><USER24> From their homepage "We offer Rock Solid, Secure .. hosting". Perhaps not so rock solid...

</comment></comment><comment><USER25> Saw this earlier today. That's rough. Obviously they had some problems with their architecture (backups shouldn't be able to be deleted like that), but it's still pretty messed up. I hope they catch the guy. I won't help Code Spaces, but whoever it was deserves to be caught.

<comment><USER26> s/I/It/

<comment><USER27> It hope they catch the guy?

<comment><USER28>
        I won't help Code Spaces

s/I/It/

        It won't help Code Spaces

</comment></comment></comment></comment><comment><USER29> From the Amazon RDS documentation:

When the backup retention changes to a non-zero value, the first backup occurs immediately. Changing the backup retention period to 0 turns off automatic backups for the DB instance, and deletes all existing automated backups for the instance.

[http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overvi...](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.BackingUpAndRestoringAmazonRDSInstances.html)

<comment><USER14> > and deletes all existing automated backups for the instance.

That could do with some sort of gracetime, both against shoot-in-your-foot scenarios and bad guys.

</comment></comment><comment><USER30> while I feel bad for thoer customers, I have no remorse for the creators. Stupid and mediocre managment of their code...not to mention...how does a code hosting service not understand the difference between a backup and an off-site backup? how could they delete an account and not notice (or bother to check) the other created accounts? No notification on account access creation? So mamy mediocre mistakes...

</comment><comment><USER31> Seems to be down so cache: [http://webcache.googleusercontent.com/search?q=cache:qpjW4k2...](http://webcache.googleusercontent.com/search?q=cache:qpjW4k253l0J:www.codespaces.com/+&cd=1&hl=en&ct=clnk&gl=us)

"We are experiencing massive demand on our support capacity, we are going to get to everyone it will just take time. Code Spaces : Is Down!

Dear Customers,

On Tuesday the 17th of June 2014 we received a well orchestrated DDOS against our servers, this happens quite often and we normally overcome them in a way that is transparent to the Code Spaces community. On this occasion however the DDOS was just the start.

An unauthorised person who at this point who is still unknown (All we can say is that we have no reason to think its anyone who is or was employed with Code Spaces) had gained access to our Amazon EC2 control panel and had left a number of messages for us to contact them using a hotmail address

Reaching out to the address started a chain of events that revolved arount the person trying to extort a large fee in order to resolve the DDOS.

Upon realisation that somebody had access to our control panel we started to investigate how access had been gained and what access that person had to the data in our systems, it became clear that so far no machine access had been achieved due to the intruder not having our Private Keys.

At this point we took action to take control back of our panel by changing passwords, however the intruder had prepared for this and had already created a number of backup logins to the panel and upon seeing us make the attempted recovery of the account he proceeded to randomly delete artifacts from the panel. We finally managed to get our panel access back but not before he had removed all EBS snapshots, S3 buckets, all AMI's, some EBS instances and several machine instances.

In summary, most of our data, backups, machine configurations and offsite backups were either partially or completely deleted.

This took place over a 12 hour period which I have condensed into this very brief explanation, which I will elaborate on more once we have managed our customers needs.

Data Status

All svn repositories that had the following url structure have been deleted from our live EBS's and all backups and snapshots have been deleted: [https://[ACCOUNT].codesapces.com/svn/[REPONAME]](https://\[ACCOUNT\].codesapces.com/svn/\[REPONAME\])

All Svn repositoies using the following url format are still available for export but all backups and snapshots have been deleted: [https://svn.codespaces.com/[ACCOUNT]/[REPONAME]](https://svn.codespaces.com/\[ACCOUNT\]/\[REPONAME\])

All Git repositories are available for export but all backups and snapshots have been deleted

All Code Spaces machines have been deleted except some old svn nodes and one git node.

All EBS volumes containing database files have been deleted as have all snapshots and backups.

Code Spaces Status

Code Spaces will not be able to operate beyond this point, the cost of resolving this issue to date and the expected cost of refunding customers who have been left without the service they paid for will put Code Spaces in a irreversible position both financially and in terms of on going credibility.

As such at this point in time we have no alternative but to cease trading and concentrate on supporting our affected customers in exporting any remaining data they have left with us.

All that we can say at this point is how sorry we are to both our customers and to the people who make a living at Code Spaces for the chain of events that lead us here.

In order to get any remaining data exported please email us at support[at]codespaces.com with your account url and we will endeavour to process the request as soon as possible.

On behalf of everyone at Code Spaces, please accept our sincere apologies for the inconvenience this has caused to you, and ask for your understanding during this time! We hope that one day we will be able to and reinstate the service and credibility that Code Spaces once had!"

<comment><USER32> Thanks for the cache just getting to this.

Edited because someone didn't like my original tone. Was a bit rushed to be honest.

Few things seem off about this:

\- Offsite backups were also deleted, I don't think they had offsite backups, or at least backups you could legitimately say were "off site."

\- EC2 has two factor auth, why you wouldn't use this for your business I don't know. [1]

\- Corresponding with extortionist is a really dumb move. It would be better time spent locking things down - contacting amazon directly to get an account lock / getting your ducks in a row.

[1] [http://aws.amazon.com/iam/details/mfa/](http://aws.amazon.com/iam/details/mfa/)

<comment><USER14> There is something about this whole story that feels weird, I can't name it but it is as if this isn't the whole story.

<comment><USER33> Probably because of the part where they say this isn't the whole story: "This took place over a 12 hour period which I have condensed into this very brief explanation, which I will elaborate on more once we have managed our customers needs."

<comment><USER14> That could be it. But there is a certain dissonance about this whole thing, I try to imagine myself in the same situation and the whole thing weirds me out. How could this mysterious hacker have known they had no other backups? Have they talked to LE at all at this point? Why not string the guy along, buy time, _immediately_ alert amazon to lock the account completely?

So many questions. Anyway, they'll be updating this sooner or later, I just can't help but feel a bit weirded out by some of the things in there (and things that should be in there that are not).

This is most likely just my professional paranoia acting up. And of course it is easy enough to be back-seat driver here, I'd hate to be in their shoes, no matter how they got there.

<comment><USER34> > How could this mysterious hacker have known they had no other backups?

I don't think we can infer that he knew that. It seems more likely to me that he expected the outcome of deleting all their Amazon stuff he could reach would be that they would be down for a day or two as they reconfigured everything and then restored from offsite backups, costing them overtime or comp time for their IT guys, a few disgruntled customers who leave, a few more disgruntled customers they have to placate with freebies, and making them more likely to pay next time an extortionist comes around.

I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company.

He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up.

For instance, here are some examples for 18 USC 1030(a)(5), which covers causing damage or loss on a computer via unauthorized access, assuming no other factors that increase the sentence:

           LOSS    MONTHS           FINE

           $10k       0-6    $ 1k  - <USER2>
           $30k      6-12    $ 2k  - <USER3>
           $70k     10-16    $ 3k  - <USER4>
          $120k     15-21    $ 4k  - <USER5>
          $200k     21-27    $ 5k  - <USER6>
          $400k     27-33    $ 6k  - <USER7>
         $1,000k    33-41    $ 7.5k- 75k
         $2,500k    41-51    $ 7.5k- 75k
         $7,000k    51-63    $10k - <USER8>
        $20,000k    63-78    $12.5k-125k
        $50,000k    78-97    $12.5k-125k
       $100,000k    97-121   $15k - <USER9>
       $200,000k   121-151   $17.5- 175k
       $400,000k   151-188   $17.5- 175k
       above that  188-235   $20k - <USER10>

Trying to cost someone a few thousand dollars worth of damage and instead killing their $10 million dollar company, for instance, changes it from 6 months tops to 5 years minimum. Ouch.

<comment><USER14> > I would not at all be surprised if the extortionist is very surprised that > they did not have other backups and his actions have probably killed the > company. > He's probably also somewhat worried, as this probably knocks the > monetary damages up enough to (1) make it much more likely that this will > get some serious law enforcement attention, and (2) if he is ever caught and > convicted greatly increase his sentence and/or fine by moving the severity > level of the offense way up.

That's plausible. It makes some sense that if you destroy something that you should be responsible for that. At the same time, even for a hacker the assumption that there would be back-ups would be a fairly logical one, though I'd hate to be in a position of fielding that defense.

<comment><USER35> If I throw a rock into your garage, and knock over your precariously balanced anvil onto a Lamborghini, that's 100% on me.

[http://en.wikipedia.org/wiki/Eggshell_skull](http://en.wikipedia.org/wiki/Eggshell_skull)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Reminds me of LiveJournal's dead harddrive induced closure. When will startups learn how it's done?

<comment><USER36> When did that happen? I was under the impression that LiveJournal was still around however it was mostly popular in Russia. Any links to that?

<comment><USER37> Definitely still around. My wife uses it daily and is part of several communities.

</comment></comment></comment><comment><USER38> Why is it possible to destroy an entire enterprise by compromising an Amazon account? Where the fuck is their 2FA? What about a cooling off period before committing changes like deleting all of your storage? Amazon's infrastructure seems to be built without essential safeguards.

<comment><USER39> Amazon has extremely tight security, including 2fa, fine-grained IAM permissions, instance security groups, VPC, and more.

The fact that Code Space's didn't bother to use them is their own problem, not a failing on Amazon's side.

Additionally, storing all of your backups with the same service as your production environment was outright moronic.

</comment></comment><comment><USER28> Another point for distributed version control systems. If the server hosting my repository exploded I'd have the entire repo on my computer.

Why hosted subversion is a thing, I don't know. It's a horrendous experience once you introduce any latency between the client and server.

</comment><comment><USER40> How the hell would you let the faith of your entire enterprise data in the hand of Amazon? Offsite/offline backup are mandatory especially when you deal with this kind of data.

<comment><USER19> Real companies don't. I know a major video provider in Cambridge that replicates everything to S3 and Google Cloud storage for this very reason. Now, neither has ever gone down for them, but if you've got to stay up, you have a resilient architecture.

</comment></comment><comment><USER41> Does anyone know of noteworthy projects that were hosted there?

<comment><USER42> Without naming names I know of at least one company who were using it for their main svn repo. I am hoping they have come out of this relatively unscathed. I am not with them anymore and last I heard they were switching to git so perhaps they have managed to dodge this bullet.

</comment></comment><comment><USER43> Cloud kicks ass. Totally secure along with the high-level fellowship of paladins^Wadmins.

</comment><comment><USER44> When will these cloud people learn that storing a so called _backup_ in the same place or under the same domain or root account as the original data is a _copy_ not an actual backup.

</comment><comment><USER45> offsite backups != offline backups

</comment><comment><USER46> Either that or the "hacker" pressed the "Close Account" button in the EC2 panel.

</comment><comment><USER47> Am I the only one feeling cheated when people post referral / tracking links?

<comment><USER28> The ?hackernews in the URL is to work around HN's duplicate URL detection. It could have been ?lulz and had the same effect.</comment></comment>


Programming the Parallax Propeller with PropGCC - <AUTHOR> http://zacharyvoase.com/2013/03/24/propgcc/

<comment><USER2> Awesome. I haven't touched my propeller in months because the spin toolchain was finicky, just got a test program loaded in minutes.

Awesome.</comment>