On VBScript - <AUTHOR> https://googleprojectzero.blogspot.com/2018/12/on-vbscript.html <comment><USER2> > Windows 10 Fall Creators Update, Microsoft disabled VBScript execution in > Internet Explorer in the Internet Zone and the Restricted Sites Zone by > default

I'm very surprised this hasn't been done a decade ago.

<comment><USER3> At this point, it's probably safe to assume that _every_ feature in Windows that hasn't been touched for the last decade has severe security problems. And it's not only Microsoft -- maybe their approach to backwards compatibility makes them especially vulnerable, but similar things have happened in the free software ecosystem as well. It's basically a very insidious form of bitrot.

So what's the lesson here? Aggressively remove old features, as you suggest? Rewrite everything every few years? Software has become way too complex to closely audit everything forever...

<comment><USER4> Security only works properly when applied to all layers.

It is very educative to read about security models on Multitics, ClearPath, System 360/370, OS/400 among many other similar systems, their attack vectors, and what we ended up getting by having winner takes it all with UNIX based systems.

This year we celebrated 30 years of Morris worm.

<comment><USER5> > This year we celebrated 30 years of Morris worm.

Wow. That was one hell of a night. Melted down our university computer labs, packed with desperate undergrads trying to complete and turn in their projects before midnight deadline...

<comment><USER6> > Melted down our university computer labs

How did admins manage to disinfect servers? It should have been a hell of fun for them, provided it was the first pandemic ever.

<comment><USER5> [https://news.ycombinator.com/item?id=5302924](https://news.ycombinator.com/item?id=5302924)

Hard reboot with email server disabled.

</comment></comment></comment></comment></comment></comment><comment><USER7> VB's evaluation order, in which the left side of an assignment is evaluated before the right side, seems like a terrible idea. In most languages including C and C++, it's specified that the RHS is evaluated first. Since, of course, the RHS might have a side effect on the location of the LHS.

Is there some advantage to LHS-first that I can't think of?

<comment><USER8> Interesting, my intuition is the opposite: that left-to-right evaluation is clearly the better approach. I just tested a few languages and it turns out that there's no clear agreed-upon answer, but LHS first seems to be more common at least for recent languages:

LHS first: JavaScript, Java, Go, C#, Swift, PHP, Ruby

RHS first: C++, Python, Rust

I ran this sort of code for all of them:

        def lhs(): print "LHS"; return 0
        def rhs(): print "RHS"; return 0
        a = [0]
        a[lhs()] = rhs()

"=" is syntactically just a binary operator, so I expect it to behave like other binary operators (and AFAIK all other binary operators evaluate left-to- right in almost all languages). It's special because the LHS evaluates to an assignable reference rather than to a value, but nothing stops you from evaluating the left side in full before starting to evaluate the right side. As with every binary operator, it's possible to write code such that the evaluation of one side affects the result of evaluating the other side, but of course that sort of code is really fragile anyway.

<comment><USER9> And this is why I tend to use a slightly smaller subset of some of the features that C-family languages support, along with an abundance of brackets.

If I remember rightly, there is the example:

        a = {-1, -1}
        x = 0
        a[++x] = x
        print(a[0] + " " + a[1])

Depending on the language (and sometimes even if you have optimizations set for those that compile to binaries), you'll get a different answer.

I always love (read sarcasm) to see awesome code, such as:

        z = a & b > c | d

or:

        z = a > b ? c < d ? e : f : g ? h : i

And then of course, the statement: "my code doesn't need comments because the code comments itself"...

<comment><USER10> Don't do that. The behavior is explicitly undefined in C. [http://c-faq.com/expr/seqpoints.html](http://c-faq.com/expr/seqpoints.html)

<comment><USER11> Don't do what, precisely? He listed several examples.

And I think he's agreeing with you, he's just sarcastic.

<comment><USER10> He said, "this is why I tend to use a slightly smaller subset of some of the features that C-family languages support, along with an abundance of brackets."

C does not support his first example. The standard states that the behavior is undefined.

<comment><USER9> > If I remember rightly [..]

You're probably not wrong, but I specifically remember there was something you could do in order to trick the compiler to allow modification on the left hand side to happen. It could possibly be by having two variable names referencing the same variable - for example.

Besides, the whole point was that it's usually not clever "trying to be clever". It just creates confusion. I don't personally believe the majority of people need to test the entire C spec to it's absolute boundary. A subset serves most people perfectly well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> It's crazy to me to realize that there are still people employed at Microsoft who work on VBScript. I love VBScript, lots of great memories, but I don't know anyone who uses it anymore, not even VB.Net.

<comment><USER13> VB.NET is still taught in the GCSE (secondary school) Computer Science course in the UK. My daughters are doing it now. Fortunately they are able to run it fine in Visual Studio for Mac.

I'm teaching them a bit of a Python as well, but I'm impressed with the material they're doing at school, it's all good stuff even if the language is a bit clunky. Apparently they will be using Java for the International Baccalaureate in a few years.

<comment><USER14> Some schools. My eldest did python on MacOS here in UK secondary school.

<comment><USER13> Really? I didn't know that was an option. Shame, still VB.NET isn't as painful as I'd feared it might be and the important thing is the concepts. Secondary school CS is a whole world better than it was when I was their age.

Having said that I know there are concerns that by focusing on 'real' computer science the course has swung too far away from everyday practical computing skills. Personally I think schools should have a bias towards putting weight on the academic end of the vocational-academic spectrum.

I've avoided pushing Python too hard, they have enough on their plates learning VB, but I have dipped into it with them to show how it does some things differently. I don't want to make them feel resentful about learning VB, that wouldn't be constructive, so I'm learning VB along with them. I do think it's useful to understand what things are pretty fundamental, and which things can vary meaningfully between languages though.

<comment><USER14> I may be older than you :)

When I did secondary school "technology" which was the overseeing subject, we used BBC basic and 6502 assembly (some of us anyway!) to drive CNC equipment and Lego and spent half of the time with a soldering iron in hand and etching PCBs and stuff. In _business studies_ , a wholly separate subject at the time, we learned how to use spreadsheets, word processors, write letters etc on RiscOS which had just rolled out about then.

I think the education now is abysmal in comparison. Why? A weird reason. None of the technology I learned about then is relevant now. 6502 assembly is dead, BBC BASIC is dead, RiscOS is dead, all the software packages are dead, China makes my PCBs etc. The education it gave me was a mental model of computing and how to approach problems with self sufficiency.

I feel a lot of technology platforms now, including .Net (something I have been using since day one), remove all self sufficiency from you and abstract so much away that it's harmful. I see many younger staff at companies I have worked for who's education has left them with so many gaps that self sufficient problem solving is impossible.

<comment><USER13> I doubt it (the age thing). RiscOS came out while I was at University. I think you must have come into secondary school camp sci just as it started getting good. When I did it a few years earlier (started - I dropped out) they were still teaching us how core memories and punched cards used to work. They did have a few BCC micros, but hadn't started using them in teaching. Yes, I am THAT old :)

My eldest just did a test where one of the questions was to describe the fetch and execute cycle, so they do cover low level concepts in Comp Sci GCSE.

PCBs and integrated circuits is in GCSE Electronics. Robots and control systems I'm not sure about but they have that stuff and a 3D printer and laser cutter in the Design and Technology lab. I'd have been all over that stuff in my day, but my girls prefer to spend their time in the fully equipped soundproofed music studio practicing 7 Nation Army with their rock band after school. Kids these days! And this at a public school, albeit a really good one.

</comment></comment></comment></comment></comment></comment><comment><USER15> So I got downvoted last time I brought this up, but if a large corporation hasn't fuzzed their products / code, doesn't this start to border on negligence?

Bugs will of course happen, but failure to fuzz products from companies that employ tens of thousands of people seems inexcusable.

<comment><USER16> It should, but it doesn't. People haven't quite figured out that when software becomes infrastructure that software engineering should look a lot more like civil engineering.

<comment><USER4> There are a couple of countries where signing off projects as software engineer does indeed require similar validation.

Sadly we are still quite far from the ideal way.

For that we need more escalations on company lawsuits so that it actually becomes more professional.

</comment></comment></comment><comment><AUTHOR> One interesting bit: _If an attacker-controlled data is interpreted as a VBScript variable, this can result in a lot more than just infoleak and can easily be converted into a code execution. This issue is a good example of why, in general, an out-of-bounds read can be more than an infoleak: it always depends on precisely what kind of data is being read and how it is used._

How leaks can become RCE.

</comment><comment><USER17> It feels like the language got too much features and then the model got so complicated that devs could no longer correctly reason about it. I would suspect that such errors are less likely in a simple language like lisp.

Did similar exploits happen in JavaScript?

<comment><USER18> JavaScript is not hard to reason about.

<comment><USER19> Just wait a few years.

</comment></comment></comment><comment><USER20> Poor, ancient VBScript! Oh, how you would benefit from Raymond Chen's time machine...

</comment><comment><USER21> Why doesn't Internet Explorer / Microsoft sandbox VBScript like Chrome does?

</comment><comment> Digit-Al Weirdly I just get a blank page when I look at this.

<comment><USER22> Blogspot does not like it when you disable Javascript.</comment></comment>


Ask HN: What's most important when creating software? - <AUTHOR> Also, how would you the following be ordered (most important to least): clarity, brevity, elegance, correctness, simplicity, speed, robustness, and efficiency? Why? <comment><USER2> There's no way to answer that question in general. It all depends on how the software is going to be used, the goals of those who are developing it, the environment in which it is being developed and probably many other factors.

</comment><comment><USER3> Correctness is certainly the most important. If the software does the wrong thing, who cares if it's elegant, robust, fast, etc.?

<comment><USER2> I agree that correctness is usually most important but even that's relative because with the possible exception of some life critical software virtually all software has bugs and a certain bug density is essentially tolerated in the software industry.

<comment><USER3> Yes, all software has bugs, but some bugs are much more serious than others. For example, if my tax software had a bug that made it install updates very slowly, I might tolerate it. But if it had a bug that caused the wrong numbers to be sent to the IRS, I wouldn't use it no matter how beautiful and fast the software was.

Hopefully, when we make the decision to release software, the bugs we knowingly leave in the product will be merely annoying and not cause harm to the user.

</comment></comment></comment><comment><USER4> that it's a pleasure, not a chore, to use</comment>


$600 Bolognese pasta sauce - <AUTHOR> http://theqwoffboys.com/post/585799393/grange-bolognese-ii

<comment><AUTHOR> For those that don't know, Penfolds Grange is amongst the very finest red wines produced in Australia (and probably the world) - a bottle of the new current vintage goes for around $500, and aged bottles of good vintages considerably more.</comment>


Court restricts U.S. Navy use of whale-killing sonar - <AUTHOR> http://www.wired.com/2016/07/sea-will-get-lot-quieter-without-navys-whale-killing-sonar/ <comment><USER2> I haven't finished the decision yet, but from what I have read it seems the Wired reporter might have gotten a little eager to conclude that world is a quiet place for whales.

The HN submitter definitely got too excited when they paraphrased the article title. The ruling does not bar the use of LFA when there is an active military conflict. SECNAV is not going to get spend a lot of time at Woods Hole polishing an environmental impact study while the pacific fleet wonders where a couple of nuclear armed enemy subs are located.

But don't take my word or the reporters word for it. The decision is here:

[https://cdn.ca9.uscourts.gov/datastore/opinions/2016/07/15/1...](https://cdn.ca9.uscourts.gov/datastore/opinions/2016/07/15/14-16375.pdf)

For those wondering,yes, this is the latest development in the string of cases described in War of the Whales. The APA sounds kind of boring if you read the Wikipedia summary. But when you consider cases like this or what to do with DoC and ICANN it is actually pretty interesting, especially for technology or science questions.

<comment><AUTHOR> _The HN submitter definitely got too excited when they paraphrased the article title._

I submitted it and I'm certain I used the original title:

      The Sea Will Get a Lot Quieter Without the Navy's Whale-Killing Sonar

=(

<comment><USER3> You did. We changed it in an attempt to be less baity than Wired's title (in accordance with the HN guidelines). Looks like we made it inaccurate in the process. Sorry!

I've changed it again and if someone wants to suggest a more accurate and neutral title we can change it a third time.

</comment></comment></comment><comment><USER4> _communica—BLUURRRRGGGGHHHH AAAARRROOOOOO WAA WAA WAA—oh, sorry, pardon the interruption._

With this Wired finally earns itself a position in the "Dead to me" section of my /etc/hosts file. There isn't anything of value there, so I'll make sure they don't earn a click from me again.

</comment><comment><USER5> This would have no impact on other countries like Russia and China, which use similar technologies.

</comment><comment><USER6> _Or consider if one of those creatures hears the noise while diving deep. If it gets spooked and comes to the surface too fast, it will get the bends._

Correct me if I'm wrong, but i thought deep diving mammals couldn't get the bends on breath-hold because they haven't breathed compressed gas. Sure, high energy sound can damaging, but scare whales bent? please.

<comment><USER7> I don't think that matters. As the whale dives, their lungs get squished together, so the air inside them is at a higher pressure, just as it would be if you breathed from a pressure regulator. The noise pollution -> decompression sickness theory is apparently an established thing: [http://www.nature.com/scitable/blog/saltwater- science/do_wha...](http://www.nature.com/scitable/blog/saltwater- science/do_whales_suffer_from_decompression)

</comment></comment><comment><USER8> One of the linked sites goes deep on some old tests. I couldn't find any recordings of the subwoofer tones they used though. [http://staff.washington.edu/dushaw/heard/index.shtml](http://staff.washington.edu/dushaw/heard/index.shtml)

</comment><comment><USER9> What is it with this "ad blockers are bad" thing?

So wired just won a spot in my blockfile (hosts file). When platforms get their sh __t together again and make sure, ad networks won 't infect my machine with malware I might switch back to not using an ad blocker. Till then - who tries to force me get's killed from this machine.

<comment><USER10> What is it with "paying to read" is a bad thing? They have to run a business. Perhaps sites should offer the article add free for a small price? We could use a better model for the internet.

<comment><USER11> I recommend a talk from EFF's Cooper Quintin about Privacy Badger; he demonstrates all the third parties involved in many situations:

[https://media.libreplanet.org/u/libreplanet/m/ending- online-...](https://media.libreplanet.org/u/libreplanet/m/ending-online- tracking-privacy-badger-and-beyond/)

Even if you agree with the business model, it's a grim subject---a large part of the objection is in _how_ it is done, be it tracking or underhanded baiting tactics.

<comment><USER10> I didn't say it wasn't. I was proposing that we devise another solution whereby people can opt out of tracking/ads by paying to read.</comment></comment></comment></comment>


What your startup can learn from...Wal-Mart?  It's still okay to hate them, though. - <AUTHOR> http://blogs.dovetailsoftware.com/blogs/main/archive/2007/10/24/Will-Wal_2D00_Mart-IT-Lead-Or-Follow_3F00_.aspx
I've always viewed Wal-Mart as a fossil that would be harder to turn than an aircraft carrier.  But Wal-Mart has actually made some smart IT decisions that we can all learn from; big or small. <comment><USER2> Good lessons here, one should outsource the non-critical components of the business. WalMart needs to learn that lesson quickly. They have a tendency of trying to do everything in-house to "save money".</comment>


Holiday Fun: How Programming Language Fanboys See Each Others' Languages - <AUTHOR> http://www.rubyinside.com/holiday-fun-how-programming-language-fanboys-see-each-others-languages-2911.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+RubyInside+%28Ruby+Inside%29

<comment><USER2> This reminds me of a video I saw a while ago. Basically a skit with a couple of actors highlighting some flaw in each language. I remember PHP being something like: "My god, there's SQL in the HTML!." Anybody know where I can find it?

</comment><comment><USER3> I am a Ruby fanboy and I can definitely say that this is very accurate. I feel very much like The Cable Guy when I'm writing C code, not that I don't enjoy that from time to time :)

<comment><USER4> Can you explain? I have never seen the Cable Guy and I don't understand many of the pictures here.

<comment><USER5> i assume (s)he feels dumb (that's what surprised me about the link - that some languages users actually "look up" to other languages, in a sense)

</comment></comment></comment><comment><USER6> Python would just be an empty white square as seen by everybody.

Lisp would be nothing but parentheses as seen by outsiders.

Lisp-fanboys would see everything else as rube-goldberg machines.

</comment><comment><USER7> Bah, there's no Python.

<comment><USER8> Yeah... as long as we know the truth though.

</comment></comment><comment><USER9> Classic!

I am a php guy and I am sad to see the truth to our column :(

I wish the php community could get it's __* together.

<comment><USER10> you forgot to escape your sql inputs.

. . .

;-)

</comment></comment><comment><USER11> I don't get it.

<comment><USER12> Must be a LISP programmer?

</comment></comment><comment><USER13> During the last few years I've seen a lot of language wars and FUD from certain communities. It makes me feel so damn _old_. I thought most people grew out of things like that after high school, when they've changed environments a few times.

<comment><USER14> And you might also think people grew out of watching soap operas, sci-fi movies, Dungeons and Dragons, or what not, but no.. we're human and there are plenty of grown up folks engaging in silly activities that aren't hurting anyone else. Let them alone. Humans, for the most part, like drama and humor.

I can only thank god I'm not growing up if it results in a life so dull that you can't be a little childish and poke fun at things.

Anyway, while I'm here.. someone else added a column for Haskell: <http://i.imgur.com/hF6mS.jpg>

<comment><USER13> Seriously, don't you think there is enough of that pathetic shit on Reddit, slashdot, etc? Do you really want language flame wars and FUD campaigns _everywhere_?

But this cartoon was quite innocent in its stupidity, certainly.</comment></comment></comment>


Why won't RSA name China, the 'nation-state' that hacked them? - <AUTHOR> http://www.itworld.com/security/212557/rsa-refuses-name-china-culprit-behind-secureid-attack

<comment><USER2> This makes me angry! This is has some semblance of blackmail or a protection scheme like in gangs and the mafia - you know they're crooked, but you gotta pay up or they're going to come back and break your legs. I'm stretching the analogy a tad but you get the point. As the article says, "economic (and political) diplomacy...and yet, China is getting away with it because if you don't 'play ball' with them and start the blame game, you can kiss my economic market goodbye.

We need to do better at innovating newer security measures and start thinking outside the box so as tip the balance of cyber offense and defense dominance in our favor...</comment>


Hal Finney diagnosed with ALS.  Wants to keep coding open source when paralyzed. - <AUTHOR> http://lesswrong.com/lw/1ab/dying_outside/ <comment><USER3> ALS is terrifying and brutal. The three letters still give me the shivers. This guy has a very positive and brave outlook. I wish him the very best.

I was misdiagnosed with ALS by four different doctors. I had essentially _all_ of the symptoms, so for once I couldn't really fault the doctors. I was also misdiagnosed with Parkinsons, MS, and Alzheimers earlier in the whole process - based on brain lesions, tremors, memory loss, paralysis, etc. Misdiagnosis of complex, multi-systemic diseases is much more common than one would expect. I would encourage anyone diagnosed with any of these diseases to get a fast second (or even fifth ;-) opinion before you start any treatments. Not to be in total denial, of course, but because some treatments - if wrong - <USER2> exacerbate the underlying problems. Steroids, for example, were prescribed for me at one point and they nearly killed me.

<comment><USER4> If you don't mind me asking, what was the final diagnosis? How was it discovered? And how are you coping?

<comment><USER3> It's a long, complicated story...so even my abbreviated answer will be very long. I'm going to make a new post about it, because I don't want to hijack this thread.

<http://news.ycombinator.com/item?id=868325>

</comment></comment></comment><comment><USER5> My dad died of MND (ALS in the US) five years ago. He tried to keep on coding with voice recognition software when his hands became too weak to use a keyboard, but his productivity dropped to <10% of what it was before. I ended up finishing his freelance projects off, and he never really used a computer again. He'd always been a very active person, and balanced the mental rigour of coding and database architecture with physical crafts: cooking, gardening, building etc. Being stuck in a shell of a body was never going to be enough for him unfortunately.

<comment><USER6> I'm sorry to hear of your father passing away.

Recently I have spent quite a lot of time with no right hand movement.

The impairment, pain was negligible compared to the frustration of performing everything so much slower.

</comment></comment><comment><USER7> I starting reading that with the usual sense of horror I get when reading about these kind of degenerative conditions and ended with a real sense of admiration and awe at the guy's attitude.

</comment><comment><USER8> Hal is a very brave man. Much respect.

I (just realized I) don't have that much courage. I'd probably kill myself before it got unbearable.

</comment><comment><USER9> You may also know ALS as Motor Neurone Disease (MND), particularly for those of you outside of the USA.

It runs in my family.

<comment><USER10> ALS run in my family too.

It gave me a new kind of importance and focus to living fulfilling happy life instead of goofing around (although I see goofing as an integral part of human life too) when I realized that there's a really high chance of getting ALS in twenty years.

Hal's attitude is a really admirable. However, for me, one of the key requirements of living in respirator is to ability to communicate with other people. Is living worth of it, if you are not able to communicate with outside world, and you know that you never will.

It's tough question, and in ALS, you have to make a decision when you still are able to communicate, when you still can nod or move your finger to say that I've had enough.

</comment></comment><comment><USER11> Absolutely beautiful. I wish him the best of luck, and his optimism will inspire me for months to come.

</comment><comment><USER12> Wow.</comment>


Former Uber Self-Driving Car Executive Indicted – Alleged Theft of Trade Secrets - <AUTHOR> https://www.justice.gov/usao-ndca/pr/former-uber-self-driving-car-executive-indicted-alleged-theft-trade-secrets-google <comment><USER2> Ongoing discussion here: [https://news.ycombinator.com/item?id=20812309](https://news.ycombinator.com/item?id=20812309)</comment>


Microsoft Mulling Nook Media LLC Purchase For $1 Billion - <AUTHOR> http://techcrunch.com/2013/05/08/microsoft-mulling-nook-media-llc-purchase-for-1-billion/

<comment><USER2> tl;dr -- meh. Newfound hope for Nook brand. B&N can go private. Microsoft has a shot to win at digital college textbooks. Bearish on rest.

For anyone curious about the motivations behind this -- this sale frees up B&N to take its brick and mortar stores private. The CEO Riggio (? -- name escapes me now) has been asking for different private equity groups to buy the nook ("New corp") assets for some time since he thinks the stores are much more profitable. Last quarter results only confirmed as much (Nook did horribly, brick and mortar held their own). The one piece holding up spinning off the brick and mortar business was what to do with new corp and how much of a premium to give back to shareholders. Probably more interesting is how much of the college textbook business Microsoft got in the deal (distribution rights, retail locations, etc.). The textbook business combined with the emergence of new interactive college education is arguably more strategic than the reader. Microsoft could try to compete with iBooks for the next generation of textbooks and thus require people to get Surfaces (or Win8 or whatever) for college classes. We have to wait for the SEC paperwork to see for sure. I have little confidence MS can execute on such a strategy, but it sure looks good on powerpoint. There also is a bit of bravado at play -- Microsoft needs to demonstrate to its partners and their investors it will come rescue them when needed (think Nokia and Dell).

The reality is that Amazon won the current generation of e-ink and online e-books. If color were to come to market (still just a prototype), it wouldn't be enough of a game changer. The next form factor to watch for and opportunity for someone to disrupt in e-ink is thin, flexible, and transparent e-ink -- the kind you can roll or fold up.

For tablets, Microsoft would likely adopt the Nook brand since it's slightly better known than the Surface, but otherwise they would throw all of the existing tech away. It's too dependent on Android, and Microsoft would prefer to push its own tech. It makes me wonder if Nook's announcement to open up the tablet was the GM's way of doing right by customers should Microsoft make an extreme change (this deal would have been known by the people who approved betting on Google Play for Nook).

The content play from this is questionable -- B&N is basically an American brand with most e-book sales growth happening elsewhere. Yes, Microsoft needs content in the US, but tech growth and new customers are elsewhere and this purchase doesn't really help Microsoft that much beyond what they could have gotten from the existing partnership.

</comment><comment><USER3> Will be interesting to see the direction that Microsoft takes the team. I ran the mobile apps division at BN/Nook for a few years and there are a lot of talented engineers there. It is interesting to see that the focus on hardware is being shifted more to apps on third party devices. I fought many long and hard battles arguing for investment in that direction.

</comment><comment><USER4> It's too bad this basically means the death of the e-ink Nook. It was really a much better reader than Kindle for a long time, but BN couldn't stay a step ahead and Kindle ended up running circles around them.

If Nook had just cleaned up its dictionary, bumped up the resolution on the screen, improved its frontlight (as it was the frontlight "glaze" or whatever washed out the display significantly), and kept polishing the software, they might have stood a better chance. The epub capability is a huge win too.

Oh, and they should have chopped off the tablet arm long ago. How a bookseller thought they could compete with the likes of Apple, Samsung, and MS boggles the mind.

Edit: Musing out loud here, Nook could also have seen better success by selling a hacker-friendly Nook, maybe for a much higher price. In a world of walled-garden devices, the already-strong hackability of Nook was a huge win for them and, I think, kept them relevant for longer than they would have been otherwise.

<comment><USER3> I don't think the market for a hacker-friendly Nook is as big as you think it would be.

<comment><USER4> Perhaps, but there certainly was (and still is) a not-insignificant amount of people interested in hacking both Nooks and Kindles. Sell a hackable version at a big markup to please the nerds and make some money; regular folks will find them useless or too difficult and stick to the standard offering; meanwhile the nerds will evangelize the hardware for you.

I think their big fear is people buying a hackable version and setting it up to be a generic epub reader instead of a walled-garden sales point, thus losing money on the hardware or perhaps support costs for people who messed up their devices. But hacking hardware, even if it just means transferring a .deb and restarting, is utterly beyond the kind of people who would rather just press "buy & download" and forget about it, which of course is 90% of the market anyway.

In either case a premium hackable ereader would be an interesting (though perhaps not profitable?) direction for anyone, even an indie company, to pursue.

<comment><USER3> The nook pretty much _is_ a generic ePub reader. I made sure of that when we decided to go with Adobe's ePub engine. Side-load all of the ePubs you want, hell you can use it to read library ePubs.

It is simple economics - as much as us (engineers, developers, etc) believe we are a large market, _we are not_. The overhead of creating a different SKU to serve <1% of a market is not enough. Besides, the money is not in hardware, it is in content.

</comment></comment></comment></comment><comment><USER5> > _Nook e-readers, meanwhile, do not appear to fall into the discontinuation > pile immediately. Rather, they're projected to have their own gradual, > natural decline_

How is this anything other than Embrace-Extend-Extinguish? And what does microsoft have to gain from paying $1bn for a company (that's running a loss), and then discontinuing their product?

<comment><USER6> EEE describe embracing standards, extending them with proprietary features and then using those features to drive out the software that implements the actual standard. I don't see how it applies here, even if MS buys the Nook to kill it.

</comment></comment><comment><USER7> This must be the money that MS bribed B&N with, after they they realized that their patent litigation against B&N was falling apart, and it could threaten their protection racket against other Android vendors. I guess B&N didn't have guts to reject the bribe and to fight against the troll to the end.

<comment><USER8> Wow, the MS hate really turns people stupid. Here's another way to look at it:

Amazon spends many billions and almost a decade creating a real e-book market. Apple spends many billions and almost a decade building the first "modern" tablet, and leverage their tablet dominance to create the first real competitor to Amazon's ebook monopsony. Along the way they fight off an antitrust lawsuit. Google spends billions and many years building specialized scanning infrastructure to scan every dead tree book in existence so they can index them. Along the way they fight off a lawsuit from the Authors Guild. And I'm still not sure if they have significant monetization from that.

Microsoft, which has NO ebook story for their struggling mobile ecosystem, swoops in and suddenly becomes a player in the ebook market for 1.3 billion in one year.

And people like you, mtgx and rbannfy think this means MS patents were weak. Why don't you think about how much this was _really_ worth to Microsoft and how much they actually paid for it? That might lead you to adjust your views about various aspects of "M$" besides just their patents, but I won't hold my breath.

<comment><USER9> > throwawaykf1 (...) Wow, the MS hate really turns people stupid.

And anonymity makes them brave.

No. Not really.

<comment><USER8> Way to address the points. Ad homs and downvotes are the only recourse you have left, I suppose.

<comment><USER9> Throwaway anonymous accounts are unusually resistant to ad hominem attacks. As frivolous as it may be, let's destroy your arguments one by one:

> Wow, the MS hate really turns people stupid

There is no research about that, but I'll agree hatred may cloud your judgement. In this case, however, the relationship between B&N and Microsoft is very suspicious - Microsoft tried to extort B&N who, in turn, threatened to disclose the patent list and then, miraculously, they became a strategic partner, Microsoft paid them US$300M, and the list was forgotten.

> Microsoft, which has NO ebook story for their struggling mobile ecosystem, > swoops in and suddenly becomes a player in the ebook market for 1.3 billion > in one year.

Something that makes very little sense. Microsoft's focus should be in preventing the erosion of their software ecosystem - once its share drops below a certain point and network effects stop being relevant, it's hockey stick all the way to the bottom. Having a failing e-book distribution deal that is not attached to Windows does not help that. And attaching it to Windows will only make it irrelevant.

> And people like you, mtgx and rbannfy think this means MS patents were weak.

Addressed in the first point.

<comment><USER8> You realize all of Microsoft's patents are public, right? That's the deal with patents: you publish them in order to get a temporary monopoly. There is little significant data that B&N could threaten to "disclose" that you couldn't find by doing an assignee search on the USPTO website. They may have patents assigned to shell companies, IV-style, but their negotiation power comes from having a very visible humongous portfolio, and using shell companies would just make it less visible.

Maybe B&N could "disclose" what patents MS is licensing related to Android, but you could make a good guess of those too by filtering the previous list of patents for keywords related to mobile and operating systems.

B&N had jack squat on MS in this lawsuit, which is why they made a big noise about antitrust, which of course went nowhere. I suspect you've been getting your info from Groklaw, which could explain a lot of misconceptions around here.

> Something that makes very little sense.

How does a content deal not make sense in today's world? It is exactly to prevent the "erosion" of their ecosystem. The ecosystem today is so much more than PCs. They don't want people to go somewhere else (like, say, iTunes or Amazon) to get their content, because that's a very strong lure to join another ecosystem. Every major player is out there making content deals to tie into their ecosystem, and MS is right up there with them... Except ebooks was the glaring hole in their content story. And it's not going to be attached to just Windows, but to their phone, tablet and cloud offerings too.

As to the strength of their patents, you just gotta look at who is getting injunctions and who is getting paid in the "smartphone wars". Nobody's getting any lasting injunctions, but MS has been getting paid all over. (OK, Apple got that one big win over Samsung, but it's still up in the air.)

Just for some disclosure, I've been tangentially involved in patent licensing efforts for a small firm. It is very, very difficult to get any licensing from big firms, who would prefer to role the dice in court if there's the slightest chance they can win or out-lawyer you. Given that, I find it impressive how many royalty-bearing licenses MS has managed to get in the past few years. Including, of all things, Foxconn.

</comment></comment></comment></comment></comment></comment><comment><USER10> I wish I could just use my Kobo E-Ink reader to browse my file server and read files from there. To me that would be the perfect E-Ink reader.

<comment><USER11> I'm not sure exactly what you have in mind, but a rooted Nook Simple Touch might have the functionality you are describing. See, for example, this Lifehacker post: [http://lifehacker.com/5926798/turn-your-rooted-nook-into- the...](http://lifehacker.com/5926798/turn-your-rooted-nook-into-the-ultimate- ereader-with-these-10-apps)

</comment></comment><comment><USER12> What does the future hold for E-Ink readers? They are far superior for reading but useless in general. I could see myself getting a Kindle in a few months (I have a first-gen Nook) but after that I don't think they will be relevant as tablets continue to advance.

<comment><USER4> I see them as exactly that, dedicated reading devices. Tablets are great for some folks, but others like ereaders because:

-E-ink can be stared at for long periods and in bright light; staring at a tablet screen for long periods gives many (including me) eye strain.

-Tablets usually include many other apps and internet access, which is a huge distraction when you just want to focus on reading a book. When I'm reading, I prefer to just read.

-Good tablets are much more expensive, so people might hesitate to drag them all over the place like they would a paperback.

The technology is already pretty cheap to produce, and I imagine big players like Amazon, BN, Kobo, etc. will eventually just sell them for a token few bucks and make up the remainder in walled-garden sales.

In the end their usefulness depends on what kind of reader you are. If you read for just 30 minutes a day, then a tablet will probably be fine for you. If you spend hours with a book, a dedicated reader is nice just for the e-ink.

<comment><USER13> Much longer effective battery life is also a huge deal for me personally.

</comment></comment></comment><comment><USER10> How does this effect Barnes and Noble?

<comment><USER14> I wonder, I remember talk that the Nook was the reason that barnes & noble survived when all the other rick and mortar bookshops went out of business due to Amazon.

Not sure if its true or not, wouldnt think the Nook was THAT popular.

<comment><USER15> Wonder if there physical stores business has rebounded a bit now that most of the competition has been knocked out?</comment></comment></comment>


Fixed price of Coca-Cola from 1886 to 1959 - <AUTHOR> https://en.wikipedia.org/wiki/Fixed_price_of_Coca-Cola_from_1886_to_1959 <comment><AUTHOR> Previous discussions:

[https://news.ycombinator.com/item?id=10611504](https://news.ycombinator.com/item?id=10611504)

[https://news.ycombinator.com/item?id=4788659](https://news.ycombinator.com/item?id=4788659)

[https://news.ycombinator.com/item?id=9796275](https://news.ycombinator.com/item?id=9796275)

</comment><comment><USER2> I can appreciate that inflation made the nickel price unsustainable. Can't fool an addict (my auntie only bought bottles by the case). I _laughed_ at the Pepsi comparison tests.

So, what I _could 't_ appreciate is changing the flavor and then pretending it wasn't. Hah! Haven't bought any in a decade.(Correction: tried _one_ bottle of the Mexican stuff. close; no cigar.)

</comment><comment><USER3> Back in the 70s I heard from more than one adult that you'd get your five cents back when returning the bottle.

In the non-"bottle bill" area of the US where I lived, the last time I remember bringing bottles back to the grocery was during the 1980's.</comment>


Storj Crowdsale - <AUTHOR> http://storj.io/crowdsale.html

<comment><USER2> Why does storj need 6 million dollars? What are they planning on doing with it?

One problem with Storj is that their technical contributions to the field have been very minimal, the best I can tell is that they've introduced 'BitCumulis', which is a 'modular' design for integrating multiple solutions such as those presented in MaidSAFE and ethereum. They haven't actually made any convincing contributions to the bigger problems.

From what I can tell, storj is a front-end that is waiting for other teams to solve their proof of storage and proof of bandwidth problems. And I don't understand how that calls for 9800 BTC.

<comment><USER3> For those who don't know about the MaidSAFE project, The Whitepaper (a good read): [https://github.com/maidsafe/Whitepapers/blob/master/Project-...](https://github.com/maidsafe/Whitepapers/blob/master/Project- Safe.md) here's their code: [https://github.com/maidsafe](https://github.com/maidsafe) This project is something that's quite interesting in its scope. It goes to see how successful they'll be in implementing all of this, and how robust the system would turn out (e.g. would someone lose data if 10% of the network magically disappears overnight)

<comment><USER4> IMO this deserves a lot more attention than storj. It's everything storj has, plus a whole decentralized internet infrastructure upon which other decentralized applications can be built. It seems the most logical way forward.

<comment><USER5> Same. I have tried submitting a few different pages on the site but it never seems to get any traction.

</comment></comment></comment></comment><comment><USER6> I'm working on a highly distributed coop cloud built with OpenStack and Bitcoin: [https://www.stackmonkey.com/](https://www.stackmonkey.com/). The appliance is in beta as of yesterday, but the site is still in progress.

I'm at a slightly different layer of the stack - one that might be advantageous for users wanting to run decentralized offerings like Storj and Maidsafe without having to do the deployments themselves. If any of the Storj guys are interested, we should talk. I'm also somewhat interested in the crowdfunding aspect and technology behind it.

<comment><USER7> Yeah I came across that a few weeks ago. Glad to know you are making progress. Can you contact me via firstname.lastname@example.com, and lets figure out some ways we can work directly together. Storj doesn't believe in competition, we instead want to find ways to collaborate with those in the decentralized data space.

<comment><USER6> Emailed you! Thanks!

</comment></comment></comment><comment><USER8> The whitepaper: [http://storj.io/paper/storj.pdf](http://storj.io/paper/storj.pdf)

Where can I find some precise protocol specifications? The whitepaper is full of handwaving about the critical parts (namely Proof of Resource).

<comment><USER3> I think they are mostly waiting for MaidSAFE to solve that problem, which is a group that's actually serious about the intricate technology that needs to go into this, and all the special cases (e.g. how many times do you need to replicate a chunk of data to make sure it isn't lost when people turn off their computers). See [https://github.com/maidsafe](https://github.com/maidsafe)

<comment><USER2> I've been mostly unimpressed with MaidSAFE approach to the storage problem.

They (last I checked) are approaching the problem by using quadruple redundancy, no erasure coding. This opens some attack vectors, because an attacker only needs to control 4/4 pieces, something that takes a probability of (attacker control)^4 . Their proof of storage also seems to use nonce's, which require precomputation before uploading the file, and means a limited amount of proofs before you have to fetch the file and compute a bunch of other nonce's.

The biggest problem with MaidSAFE's stuff is that it's all over the place. There's no concise document that explains proof-of-storage. Their approach seems enormously complex, which to me indicates a huge likelihood of undetected vulnerabilities (complexity is bad when you want security).

</comment></comment></comment><comment><USER9> How does this relate to Filecoin?

[http://filecoin.io/](http://filecoin.io/) [http://filecoin.io/filecoin.pdf](http://filecoin.io/filecoin.pdf)

<comment><USER8> I really couldn't find any precise information about storj but the dummy slides are showing some really different scheme for POR.

Also I think filecoin has a mistake. If it ever gets popular then it is possible that the difficulty would be quite high (in the scale of GBs). In that case you can't effectively mine only if you share at least 1 TB of your hard drive below that the expected reward for a block would be near 0. It would drive the network to centralization. The expectation reward for a block isn't linearly proportional to your shared disk space but a convex function of it.

On the other hand it would be possible to implement mining pools which could somewhat solve this problem.

</comment></comment><comment><USER10> I wish there was some way to participate in this using my NAS. I don't want to keep a PC online all the time just to service other folks' storage requests.

Sounds like a neat idea for a homebrew Synology package.

<comment><USER7> Check out some of the numbers before your decide anything: [http://blog.storj.io/post/88303701698/storj-vs-dropbox- cost](http://blog.storj.io/post/88303701698/storj-vs-dropbox-cost)

</comment></comment><comment><USER11> Why did they create their own cryptocurrency with this? Why not just pay people for their storage space in bitcoin?

<comment><USER2> They need to store things in the blockchain, namely meta-data. I think there are also a few other changes that they made to the blockchain structure that would have made it very hard to simply use Bitcoin.

I imagine that they'll at least merge-mine with Bitcoin.

<comment><USER7> This exactly. We also wanted to separate the payment protocol from the data protocol.

If sidechains or treechains become viable we plan to merge it back in to Bitcoin proper.</comment></comment></comment>


Ask HN: Do you use timetracking at your startup? - <AUTHOR>

If so, what software do you use ? If not, what project management software do you use ? <comment><USER2> At entp we used a custom-built time tracker that works a bit like twitter; you tell it what you're working on (projects are referenced with @projectname and individual tickets with #1234) and it tracks the time between status updates to that project. It shows what everyone's latest status is, so it's good for a team to get visibility into everyone.

It's open source! <https://github.com/entp/xtt>

We used it extensively when we were mainly a widely distributed consulting company (4 countries, 4 US states, 20 devs) and continued using it after we dropped the clients. It's useful to see the hard costs of building certain features and even entire apps; there's also a ton of useful data about how many hours people are pulling a week, what time we show up for work, as well as the basic "what are you working on?"

However, the dev team is pretty small right now so we have ditched the time tracking. We are moving to a new tool that we're building which focuses more on how you feel about what you're working on.

<comment><USER3> Courtney, can I contact you about your new tool ("how you feel about what you're working on")? I think there are some ideas we could share. My email is my username at gmail.

</comment></comment><comment><USER4> By "timetracking" do you mean getting people to record what they have been spending their time doing? Unless you are billing customers for time, why would you want to do that?

Far better in my opinion to focus on end results (feature X will be ready by date Y) than micromanaging progress by tracking time and assuming that this linearly corresponds to progress made.

<comment><USER2> Obsessive metrics are fun.

Knowing how long things took vs estimates is useful for determining the accuracy future estimates.

Having an absolute sense of numbers for types of projects is useful for estimating future projects of similar scope; where by absolute I mean, not, "I think it took two weeks last time we did this".

<comment><USER5> When it comes to startups I'm not sure you can prioritise things like this over actually working on your product.

Also, if you're measuring and refining your estimates, they stop being 'estimates' and become something far less useful. If you have problems with estimates being inaccurate, try not estimating.

There are far more interesting metrics to measure rather than flogging a dead horse.

<comment><USER6> I agree - time tracking on a granualar level is very high friction and ends up being a waste of time. Better to focus on things that bring more ROI, like product.

Unless your billing on an hourly basis, chances are that counting hours is too much micromanagement.

</comment></comment></comment></comment><comment><USER7> Whatever solution you choose, there are two key points:

1) Make it as frictionless as possible for the people tracking their time, or you will inevitably have people not doing it, and then someone has to hound them, and then they just put in junk data just to stop the hounding. Your "to the hour" metrics end up just being junk.

2) If you aren't actually using the data, don't make people track their time "just in case". Or at least assign it a real cost, and say, "Is this data worth 2% of my payroll to me?" In poorly run companies, this tends to be a classic example of management wasting the employees time for no reason, just because someone said they were supposed to do time tracking but management never gets around to using the data for anything.

<comment><AUTHOR> I am actually an employee of my startup, and what you described in 1) is exactly what is happening. We use dotproject which is probably one of the worst piece of software ever shipped, and the data is used but nowhere near a goal that is worth the pain.

</comment></comment><comment><USER8> My (as yet unobtained) goal is to get familiar enough with org-mode[1] and figure out a personal workflow that fits with my company, so that I can manage a planning/clocking setup along the lines of <http://doc.norang.ca/org- mode.html#Clocking>

It's complicated by a couple of factors:

* nobody else at work would be using the same system (but we don't use anything anyway)

* I don't use emacs for mail, and haven't yet got it to talk to google calendar in a sensible fashion

* my elisp is about as good as any of my other lisps, which is practically nothing.

On the plus side:

* Evidence based scheduling - I'm a crap planner, and being able to compare estimates with reality would be the first step towards fixing it.

* I could stop making up arbitrary numbers of hours worked on a given project, and actually provide some evidence.[2]

* Formalising a workflow would help keep me on track when I'm not sure what needs doing next.

* Having a tracker/agenda/scheduler/outliner all together makes for some interesting integration potential.

[1] <http://orgmode.org/> \- outliner with all sorts of extra shineys for Emacs.

[2] Less unethical than it sounds - I'm basically subtracting out the time I spend faffing around on the internet. But I suspect I'm sometimes too generous with my subtractions.

</comment><comment><USER9> I am currently using toggl (<http://www.toggl.com>). I am not using it for billing nor for monitoring employees, but for monitoring how I spend time. The purpose is to balance work between my several projects on which I work concurrently, and also to avoid procrastination and wasting time on distractions.

I spent a lot of time (pun intended), i.e. about half a day, on searching a time tracker that would fit my needs. I was not interested in features related to billing clients, and thus I found too expensive the services that seem to be most popular, like Harvest, whose pricing starts at $12 per month if one works on more than 2 projects. I would not pay more than $1 per month for a simple time tracking service. I needed a web application / service, as opposed to client software, since I work on multiple computers. Also, the ideal service that I was looking for would have an Android app such that I could track time when I'm not using a computer.

Toggl does all of these within the free plan, however it is somehow buggy - the Android app, the desktop app and the web service do not synchronize well and I am kind of forced to use just the web service through a browser.

I would be interested to find out about other apps that would do the job.

<comment><USER10> Another great app to check out is TSheets (<http://www.tsheets.com>). I have no problem clocking in from my Droid or any computer - or even by simply sending a text!

</comment></comment><comment><USER11> Used to use a very basic and dorky app called TraxTime but since the start of the year, have been using a web-app which I built myself. We call it Punch.

Company of three web developers clocking time and billing clients. Punch runs in a little Chrome window on the side of our second monitors. I can keep track of what the other guys have been, or are, working on; check our general productivity; it handles invoicing, and can give me hints on which clients are strong earners and which are a waste of time.

I don't need crazy CRM features, but have been thinking about quickly adding in a list showing neglected clients (so we can contact them and see if they have any maintenance needing to be done).

</comment><comment><USER12> If you are talking about time tracking as far as project management goes and not for how many hours to bill to client, then I don't believe in using one.

Why? In most cases you are using time tracking as a way to provide metrics for productivity or compensation. Once employees are incentivized to do a task within a certain time frame (i.e. average ticket close less than 2 hours) they will focus more on the end result (closing the ticket) rather than the actual task at hand (fixing the issue). For example in software development this can lead to developers who take shortcuts to simply fix the problem, but not necessarily fix the problem effectively (i.e. bad code).

</comment><comment><USER13> I use Freckle for myself, since I feel I'm more productive if I track what I spend my time (on the computer) doing. It's a bit like tracking your weight, wether you're on a diet or not. Just being aware of it is enough :)

</comment><comment><USER14> I use toggl, but since I've only serving private client contact at at the moment, i'm using Freshbooks for invoicing (one client = free). They have their own timetracking, so considering to use their feature instead of Toggl. Regardless I have good experience with toggl, expecially since it allows exporting to CSV/XML/PDF which allows for rapid coupling with any invoicing system or own project management tools.

</comment><comment><USER15> I'm using mite (<http://mite.yo.lk/>) for my freelance work, bit we don't use time tracking at our startup. The tech guys measure productivity by checking or crossing out squares on a squared notepad, but that's exclusively for self- assessment: How much time do I spend working productively, how much is wasted on interruptions, etc.

</comment><comment><USER16> I'm using Tomatoes (<http://tomatoes.heroku.com>)

</comment><comment><USER17> We use BaseCamp, but with some custom tools for better visualization and analysis: [http://bergie.iki.fi/blog/business_analytics_with_couchdb_an...](http://bergie.iki.fi/blog/business_analytics_with_couchdb_and_noflo/)

</comment><comment><USER18> OfficeTime is the best simple time tracking app I've found so far. (It's not a project management tool or anything like that. Just a low friction way to track time.) It does some reporting and the data can be exported.

</comment><comment><USER10> YES! I didn't and wish I had. It's worth checking out TSheets (<https://www.tsheets.com>) for tracking your time spent on several projects/clients. Good luck!

</comment><comment><USER19> We are using BriskProject, but we're not using timetracking feature, because it imposes deadlines and we're already in a lot of stress.

</comment><comment><USER20> Slimtimer - <http://slimtimer.com> \- it's pay what you want model.

</comment><comment><USER21> Setkick doesn't use anytime management software (yet), but we do a lot of project management via Podio.

</comment><comment><USER22> How does one time track thinking? Especially the one during driving, showering, eating a lunch, etc…

</comment><comment><USER23> Timetracking (external customers): toggl.com Project management: pivotaltracker.com

</comment><comment><USER24> We manage projects with Trello, and track time with our very own Paydirt.</comment>


Ask HN: Is cloud mining profitable? - <AUTHOR> <comment><USER2> It's highly profitable. AWS makes a lot of money out of people who try.

</comment><comment><USER3> The question you must ask yourself is why are miners renting their gear for other people to use? If it was profitable at the current price, they could simply mine themselves and skip the rental part.

<comment><USER4> Because they are booking a guaranteed upfront profit, and passing the risk on to the customer? Don't mine for gold, sell shovels.

<comment><USER5> Profit is hardly guaranteed considering capital costs. Disregarding that, I'm not sure shovels are the best comparison. Coin mining is pretty predictable in aggregate, unlike gold mining. If you own mining hardware, you can calculate expected income pretty reliably.

<comment><USER6> Except you cannot calculate the price of the mined coins predictably.

So renting out mining gear can either be a bet that you think crypto will decline or just a way to reduce risk. (I'm assuming up front payments. )

<comment><USER7> There are futures to hedge against that.

</comment></comment></comment></comment></comment><comment><USER8> A couple years ago, there were scripts that would watch Github commits for AWS (or other) credentials. If it found them, it would fire up instances and mine as much as possible until they were shut down.

And ROI is easy when your I is near zero..

<comment><USER9> I think it can be assumed OP isn't asking whether committing a felony is profitable.

</comment></comment><comment><USER10> Cloud mining is only profitable if you have a lot of equipment allocated to under mined coins. If a coin has a low enough difficulty you can overflow with hashing power and earn a profit depending on the difficulty and how often the coin re-targets. A coin like Aptcoin or other non-asic mineable coins can create this situation.

But mostly no. It is almost exclusively more profitable to just buy the coins.

</comment><comment><USER11> No and it never well be. Lets consider AWS. On-demand pricing, even reserve is never even going to be close, simply because there exists Amazons overhead, profit, etc. built into the cost. The only possible chance is spot instances. Spot instances start to approach a "free market". The pricing will adjust based on supply and demand. There still exists AWS overhead, as they aren't going to run them at a loss, just far less profit. If the price of say the p3 family of instances approached a profitable price point, then others would flock to using them, driving up the price, causing them to no longer be profitable. There also exist external use cases, such as AI, which can justify the computation power at a higher price point, as the value of the computation might exceed the value gained from mining.

</comment><comment><USER12> Not unless you're the one renting out the miners.

</comment><comment><USER13> Doubt it. If it was profitable the cloud mining providers would be mining for themselves instead of renting out the gear.

</comment><comment><USER14> Considering the benchmark for profitable mining is against electricity costs... It's a no from me.

</comment><comment><USER15> This investment strategy is usually dominated by the simpler strategy of just buying the coin.

</comment><comment><USER16> For who, the miner or minee?</comment>


Technical Papers Every Programmer Should Read (2011) - <AUTHOR> http://blog.fogus.me/2011/09/08/10-technical-papers-every-programmer-should-read-at-least-twice/ <comment><USER2> The name Luca Cardelli, one of the authors of one of the recommended papers, rings a bell: Modula 3 guy.

[https://en.wikipedia.org/wiki/Modula-3](https://en.wikipedia.org/wiki/Modula-3)

</comment><comment><USER3> It's 11 papers.

<comment><USER4> If you read it, he explicitly mentions that the LISP paper doesn't count.</comment></comment>


Hacking the Cable Modem - <AUTHOR> http://hackerarticles.com/hacking-the-cable-modem/ <comment><USER2> __* hackerArticles.com === > ERROR 403 FORBIDDEN errors - since Friday night 05 August 2011. Anybody else?

</comment><comment><AUTHOR> give me your feed back</comment>


Google is hiring autocompleters - <AUTHOR> http://www.google.com/intl/en/jobs/uslocations/mountain-view/autocompleter/index.html

<comment><USER2> Don't bother applying. If you haven't applied by now you'll be automatically disqualified for obviously being too slow to be an autocompleter.

</comment><comment><USER3> I applied. It only took me 1.6 seconds My keyboard caught fire, but sometimes sacrifices have to be made.

</comment><comment><USER4> Finally, an explanation I can give my girlfriend for my search history.

</comment><comment><USER5> Can't they leverage their existing technology (<http://www.google.com/technology/pigeonrank.html>) for that?

</comment><comment><USER6> this is against some kind of EOE type thing right? to make fake job listings?

</comment><comment><USER7> did they really mean (type at least 32,000 WPM)?

<comment><USER8> _did they really mean (type at least 32,000 WPM)?_

Yes, they did.

You'll note that the rate demanded from Europeans is significantly more reasonable than what is expected from Americans. That is because European labour laws don't let Google demand the kind of productivity levels that they get from Americans.

<comment><USER9> No dumb ass, it's april fools haha

<comment><USER8> It is guaranteed that someone will miss the fact that there is a joke.</comment></comment></comment></comment>


Comparing Python frameworks: A simple webapp in Flask, web.py, bottle, juno ... - <AUTHOR> http://agiliq.com/blog/2010/11/i-am-so-starving-same-web-app-in-various-python-we/ <comment><USER2> FWIW, I've been using Flask. It seems to be the one having the most traction and support these days.

But I think frameworks are not that important. I use Flask mostly for its HTTP request handling functionality. But everything else is my own (e.g., the overall setup, configuration etc).

I think what's most important is understanding that loosely coupled components are the way to go. Know how your scripting language loads and manages modules and try to get to a simple convention on how to organize your code. Minimize the use of ready-to-use extensions and just try to effing know. how. things. work. Glue code together yourself. Document religiously how you did it[1]. It'll save you a world of trouble.

The one tool that has been central to my web development work in Python is pretty much framework-agnostic: Fabric. My projects start with a single fabfile.py and and lib/ directory. I do most of the prototyping in the fabfile.py, which serves as a sort of adhoc testing sandbox[2]. And then I start adding request handlers and writing markup/css. With this approach, whether you're using Flask, webpy or Juno (my faves) is irrelevant. But sticking with Flask might give you a more enthusiastic and active community nowadays.

[1] [http://tom.preston-werner.com/2010/08/23/readme-driven- devel...](http://tom.preston-werner.com/2010/08/23/readme-driven- development.html)

[2] <http://jonasgalvez.com.br/Writings/Casual-Testing.html>

<comment><USER3> _loosely coupled components are the way to go_

I disagree. Had you added "in some situations" I wouldn't.

The point of the frameworks, which are heavily coupled components with many constraints, conventions and hidden parts of functionality is _rapid prototyping_. That means that you can go from 0 to something quickly without knowing all the details. For a large class of use-cases the ability to get something out there fast is more important than the technical debt you may incur by not knowing how everything is loaded. This is the case for a lot of new products, startups and such.

On the flipside, if you have a very solid spec of what you're building (for example, if you are re-writing an already-existing piece of software with a browser-level test suite as spec so that it is easier to scale) then loosely coupled components are likely the way to go. And yes, as soon as scale comes into question loosely coupled components that you understand well are the way to do it. This just isn't _always_ the case.

Secondly, it is not clear whether the frameworks get in your way that much. I remember reading a blogpost about a shop replacing django bit by bit until there was no django. That seems pretty cool. On the other hand, there is disqus, which used django from the get-go, I think, and haven't swapped it out, but just built a lot of tools around it. On the third hand, there is probably a lot of sites that start with loosely coupled components and keep refining. They are all valid approaches. At the time you are starting it is usually unclear how to go about it.

In general I agree that people should try to understand how their tools work, but there are only so many hours in a day, y'know?

<comment><USER2> You have a point. Let me elaborate my thoughts on Flask a bit further.

Personally, my experience is that for rapid prototyping, there's nothing better than starting with the absolute minimum possible, and with a full-blown monolithic framework, the absolute minimum is, more often than not, too much.

I prefer starting a project with a couple of files, like fabfile.py and app.py, than starting a project with a bunch of directories and tons of blueprinted configuration files. It's hard to explain why, I just feel it's a lot easier for me to evolve an idea, from a small prototype to a finished product, with this approach. I guess the cognitive signal to noise ratio is just higher that way. I know many people share this feeling, otherwise Sinatra and all these Python microframeworks wouldn't be getting so much attention.

I think a good framework is like a good government, consistent, helpful, but with self-limiting interference. I think documentation is way more important than features. I'll take a well written web development patterns guide over a framework that does it all for me under the hood any day. The thing is that Flask tries to be both. Flask's documentation is absolutely fantastic. It is no surprise, of course, since it comes from the same guys who made the Sphinx documentation builder.

I like conventions. I just don't think they ought to be mandatory. I see Flask as a genome of web applications, with pre-defined solutions and information on how to accomplish a series of things, but my application itself doesn't have to be a grown organism from the beginning, it can start small, like an embryo, and slowly grow in size. Flask gives you enough flexibility to employ conventions but also do things differently, to invent your own way, when you feel that you need to.

</comment></comment></comment><comment><USER4> Not to diminish the contribution from shabda - but what would really interest me is hearing about these frameworks from the perspective of someone who has launched and maintained a complex system, not a toy app.

<comment><AUTHOR> Probably over the next weekends, Ill do a basic blog in these frameworks.

Not complex, but should give me a chance to test the ORM, Session, Cookies etc.

<comment><USER3> I think you'll find that all of them are very similar in terms of ORM, Session, Cookies, etc -- they are, more or less, the same toolbox.

However, the devil is in the details. Once you start managing something sufficiently complex you start to see what details constrain you in bad ways and such. I'd guess that you don't get to that point until way after you launch.

</comment></comment></comment><comment><USER5> What is the point of making toy apps? Make a complex app that evolves over a period of 2 or so years, and then tell me how it went. Much of the time the framework where it is easiest to make a toy app is the one that has lots of hidden, implicit assumptions that come back to fuck you when you need the flexibility to do something that violates those assumptions.

Having dealt with python frameworks for several years and developed several complex apps, I'm not willing to use anything other than werkzeug. It's lightyears ahead of than else out there (flask is werkzeug wrapped in shit you don't need with the intention of making it more popular). Pylons is also very nice, although it tries to do too much for you, and has too much magic for my taste. The context-local request and response objects in pylons are a double edged sword that I find cuts the wrong way too often.

</comment><comment><USER6> Neat, but you should check out PEP 8 at some point. An empty line between a decorator and the decorated function (flask) is confusing, and whitespace in keyword arguments just looks off.

<http://www.python.org/dev/peps/pep-0008/>

</comment><comment><USER7> I hope there's going to be a followup discussing the strengths and pitfalls of each, along with the the original specifications of the app, so we can see where a framework imposed limitations or even provided a better approach to implementing a feature.

<comment><AUTHOR> I plan to do another set with a complexer app, and then do an actual comparison.

</comment></comment><comment><USER8> This is hardly an apples to apples comparison. Pyramid (ex-Pylons) and Django are "full-stack" frameworks with everything incuding the kitchen sink. App Engine only runs on App Engine, so probably isn't that relevant anyway. The others are (by their own descriptions) micro-frameworks, suitable for smaller applications with 10 URLs or so.

It's possible to use both in a project, for example we at Smarkets use Django for the main site (as we have tonnes of URLs and complexity), and use Flask for a RESTful API to our search engine. I wouldn't dream of swapping or comparing them: they both do their own job very well.

<comment><USER9> Just a remark.

 _The others are (by their own descriptions) micro-frameworks, suitable for smaller applications with 10 URLs or so._

I don't think the attribute _micro_ relates to the size of the projects you can create with these frameworks but rather the way they are written: Keep the core small and rely on external libraries for specific functionality.

</comment></comment><comment><USER10> What was the development time of the webapp in each of the frameworks?

<comment><AUTHOR> About 6 hours for reading on the various frameworks, about 6 hours to code.

</comment></comment><comment><USER11> I realize that scalability probably wasn't a concern when you made these demos.. but it doesn't look like any of these can handle many concurrent requests (incoming, or outgoing to facebook).

Are any of these frameworks even compatible with the event driven mechanisms like twisted, tornado, etc?

I'm having to pick up Python since a lot of the webapp infrastructure at the startup I joined is Python/Django and I haven't really liked it so far, especially since everything we do would benefit from being done in an event loop (tons of IO to background services that make web requests block)

<comment><USER12> These examples can be made to run in a completely evented style with no code changes using Eventlet. I use this for pretty much all of my projects these days: <http://eventlet.net/>

One of the most popular WSGI servers these days, gunicorn, has a simple configuration option that lets you switch on Eventlet transparently. Or you can use something like Spawning [<http://pypi.python.org/pypi/Spawning>], which is built from the ground up specifically to use Eventlet.

</comment></comment><comment><USER13> web2py deserves a place on the list. I've found it to be more productive than django.

<comment><USER14> that project's choice of name, web2py, drives me apeshit. i much preferred it when it was called gluon.

web2py both (a) sounds way way too much like web.py, which predated it, and (b) it sounds like it's a successor to it -- which it is not, and (c) sounds like it's a conversion tool of some kind (following the whole "foo2bar" pattern in program naming).

Whereas 'gluon': some small thing which binds the universe together. And it has personality!

<comment><USER13> Yeah, I also prefer gluon. It had to be changed due to a copyright issue from what I gather. That said, I could give a hoot what a framework is named if I get work done quickly with it :)

</comment></comment></comment><comment><USER15> Thanks for the post but I find the title of the link a bit confusing _"Comparing Python frameworks: A simple webapp in Flask, web.py, bottle, juno ..."_

I'm not sure what you're comparing.</comment>