Ask HN: Can you do TDD in a complex product (data science, AI, etc)? - <AUTHOR> I have been considering introducing TDD in my startup . We do a fair bit of non-trivial work in our Python/Flask APIs : credit scoring, accounting, workflows, etc
I'm wondering if TDD is even a good idea ? Can one get to a stage where writing testcases is as easy as writing specs or whiteboarding ?
Or does TDD become one of "those processes that founders shoved down our throat" ?
There was a very interesting discussion about this a few years back on HN - https://news.ycombinator.com/item?id=2240595
P.S. A lot of responses I get are "whatever works for your team". Fair enough. But I'm looking for fairly opinionated answers - how do you do it ? And what would you do better ?
what's your mental model around writing tests ? Do you write tests after every function, every commit , every day ? When you are building a new product (and maybe hacking stuff together in the middle of the night), would you still write tests before moving forward ? <comment><USER3> I like TDD, it's pretty useful in many cases, but... you may be starting this the wrong way around.

Your question is "should I use this testing technique?". A better question to start with is "what am I trying to achieve with testing?" Once you know your goal you can find a relevant testing technique to achieve it. Your goals will likely be different for different parts of your product and codebase.

Notice this means different organizations and products (or same product at different times in its lifecycle) will have different forms of testing, because they have different goals and resources.

To help with the decision process of choosing testing goals I've come up with a model, of different goals and the kinds of testing that are useful for each. I'm going to be giving this as a talk at PyCon in May, but have an essay version written up: [https://codewithoutrules.com/2017/03/26/why-how-test- softwar...](https://codewithoutrules.com/2017/03/26/why-how-test-software/)

Since choice of testing strategy is situation-specific it's very hard to give a general answer without understanding the specifics - ping me (itamar at codewithoutrules dot com) if you'd like to talk over your specific situation.

</comment><comment><USER4> Here is a good link from Robert C Martin (author of clean code) for the question : How doeas the presence of neural nets impact the deve lifecycle in Agile environment [http://blog.cleancoder.com/uncle- bob/2017/03/16/DrCalvin.htm...](http://blog.cleancoder.com/uncle- bob/2017/03/16/DrCalvin.html)

</comment><comment><USER5> I generally write tests for the initial/main functionality up-front - <USER2> just a simple call to some func that's currently just stubbed, assert that it does the right thing (e.g. "I want to call my new code like this... and get back this..."). Then implement enough code to make that pass, and perhaps modify/expand the test during that process (exercising edge cases perhaps, or adding more functionality - depends on the project).

Then I might write a whole bunch of related code, fleshing out other parts which rely on the primary part (that I know works well enough for now), perhaps without writing tests first. But if I do that, I will then go back and write more tests until I get 100% coverage later. Undoubtedly you will find corner cases that you didn't cater for when you exercise the code in tests.

It's not done until all my code has 100% coverage, and all the main entry points, important data structs, tricky bits, etc, have documentation of some kind. But I might implement a fair chunk of the code before implementing full tests.

So: some tests up-front (because it makes coding easier), and the remainder of the tests (for full coverage) have higher priority than writing documentation on my list of todos.

In no particular order, I've written non-trivial amounts of Go, Javascript, C#, Python, Java, C/C++, ...

— But your question is not specific enough because the process can vary a lot, depending on what you're coding (e.g. I don't bother writing tests for bash scripts: they usually either work, or they don't), and who / what it is for. e.g. the above process works great if you're building a library (and if you're not building a library, it can help to try and break apart the project into some library-like pieces).

Obviously the above would be somewhat different if I were doing TDD for a web- app, but I'd still apply the same process to the bits and pieces that make up the app behind the scenes - and then have to also consider front-end testing if appropriate.

</comment><comment><USER6> Not specifically to data science or AI projects, generally test coverage is very important, otherwise how would you ensure that the functionality works as expected and handle error/unexpected conditions?

But TDD approach or writing test cases after the implementation is upto the individual developer/team's preference. Initially TDD approach would be very difficult for freshers or devs who don't have TDD experience, but in the long run, it would help.

</comment><comment><USER7> In the context of 'my startup' the decision to implement or not implement TDD or microservices or ReactJS is properly made on the basis of business value. Does TDD/microservices/ReactJS make money or improve the odds of survival or provide a competitive advantage or will it create drag on the business?

Good luck.

<comment><USER3> This is good advice... but it's hard to follow if you don't understand the costs of particular forms of testing, or what benefits they provide. This was part of the motivation for creating the model I referenced in a comment above.

<comment><USER7> Your earlier question does not make a business case and Markham's answer might be somewhat similar to mine here (unsurprisingly perhaps since I sort of recycle things I read on Hacker News when it comes to startup specific advice and my own experience when it comes ordinary business advice). This sort of falls in the category of both: there is a startup component (survival) and a general business component (YAGNI based cash flow).

The tricky thing about TDD is that Uncle Bob packages it up with morals and ethics and craftsmanship. It's probably a big reason why he is a successful consultant in addition to having coding chops...and I don't disagree with his moral and ethical opinions but they are about writing code rather than running a business and here the important decision is running a business and that's what Markham emphasizes and emphasizes particularly well in his reply to Cooper's response.

I'd put it this way, the first order benefit of TDD is confidence that refactoring will pass fewer regressions to production. But a successful startup does not depend on refactorings because growth drives rearchitecting and pivoting and those mean that many/much/all existing tests may become irrelevant. Riffing a bit, it might be that in a startup the way to determine the benefit of tests is do they get the company to the point where those tests become irrelevant more quickly? Most startups default on technical debt by either running out of money or by throwing out the code base because they acquire different operating parameters due to scale.

<comment><USER3> Right, so in my model, there's four goals you might have for testing: understanding users, understanding runtime behavior (of your software), correct functionality, stable functionality. Which set you choose depends on business goals.

In a startup environment your goal is often understanding users (does anyone care about this product/feature? is it usable?) followed by correctness. And as you say, stability isn't an immediate concern if you're rewriting everything every two weeks, which is the case for many layers of code.

"I'd put it this way, the first order benefit of TDD is confidence that refactoring will pass fewer regressions to production." \- I'd say automated tests, including unit tests and therefore TDD, only give you stable functionality. Not correctness, since only a human can determine that (see essay for fleshed out argument - [https://codewithoutrules.com/2017/03/26/why- how-test-softwar...](https://codewithoutrules.com/2017/03/26/why-how-test- software/), section on "What means of testing can you use?").

But unit tests (and thus TDD) for code that _isn 't_ going to be a stable is actually a negative, because you're trying to enforce stability on something that keeps changing.

\--

Could you link to the Cooper/Markham discussion?

<comment><USER7> Cooper and Markham were at the top of the link in the question. {edit: I have been mistaking you for the OP sandGorgon}

\--

I can see how A/B testing might help with understanding users, but to me, A/B testing is orthogonal to Test Driven Development and early on A/B testing would probably not have enough test cases to generate deep statistically significant insights due to small sample sizes and the need to make gross movements rather than fine tuning a working process.

\--

For Uncle Bob, TDD is a business process because he is selling consulting at some hourly/weekly/monthly rate. His client base will tend to be looking at improving stable business processes not those taking a spin of startup roulette. For a technology startup, what gets developed in house will tend to be strategic in the sense that it has a big effect on the company's velocity. Getting 'there' in three months is more than eight times as good as getting there in two years.

<comment><USER3> Ah, thanks, will read through.

A/B testing is orthogonal to TDD, yes, and that's really the point: there's many forms of testing (usability testing, testing user interest, as well as A/B testing) whose goal is completely different than verifying a specification. Often they are useful when creating the specification.

And maintaining stable software is very different than spinning up new product, yes. So you need to start with business goals, work down to testing goals, and _then_ choose testing techniques based on those.</comment></comment></comment></comment></comment></comment>


Failed $4.4 billion bid for Nortel patents comes back to haunt Google&Friends - <AUTHOR> http://www.fosspatents.com/2013/11/failed-44-billion-bid-for-nortel.html

<comment><USER2> Florian Müller is not an independent voice. He was/is a consultant for Microsoft and Oracle. Also he was wrong in his predictions when Oracle sued Google and I hope he wrong now too.

Too bad that Groklaw had to shut down in August. We still need a reasonable voice on the other side.

</comment><comment><USER3> So just b/c Google's $4.4 billion dollar bid lost to Microsoft & Apple's combined $4.5 billion bid, MS and Apple now have the right to extort Google?

Does anyone else see what's wrong with this picture?</comment>


Apple, Google have trained their virtual assistants to rebut 'All lives matter' - <AUTHOR> https://www.businessinsider.com/siri-google-assistant-rebut-all-lives-matter-2020-6 <comment><USER2> Turning off all of my digital "assistants." I don't want corporate mission statements and policies fed to me by an appliance. Politics and religion are best avoided in conversations with mixed company, there's no reason for a machine I use to play a song or take a reminder to express opinions at all.

</comment><comment><AUTHOR> Original title was too long. It was:

Apple and Google have trained their virtual assistants to rebut 'All lives matter'

</comment><comment><USER3> Unexpected, but certainly welcome.</comment>


Ask HN: Have ideas, not the skill (Yet) - <AUTHOR>

So I've been watching HN for a while now (2..3 months) and I'm just amazed at the amount of wisdom (good and bad) that floats around here. Big names.
I think it's pretty obvious that by having an account here I'm interested in startups and creating my own startups. I even have a few ideas in the back of my head (things I've attempted to do and only imagined).
The problem is that I simply don't have the skill or knowledge. I try to work on my projects but ultimately I realize that I won't be able to finish them on my own (yet).
So here's my question to Hacker News: Should I just ram through and keep hacking away on the projects or should I take my ideas to people who can do them/like them and sit back and watch?
Side question: If the latter, where should I present my ideas and how? <comment><USER2> It'll probably be most rewarding long-term to keep hacking away at them, especially if you've already taken the first step to begin.

If you're getting stuck at specific blocks, it's likely that you'll be able to find some resource to get you through it.

<comment><AUTHOR> Right now the most difficult part is login stuff. <form> bull crap is bullcrap. :P

</comment></comment><comment><USER3> It depends on what you want to do with your ideas.

If you want to just give them away and see where it gets you, then go with that option.

If you want to pay somebody or share the development of a project with somebody, then find that person, and do that.

If you absolutely must get something done, then do it yourself.

That is how I got started in programming. Every programmer I spoke to about a project told me it couldn't be done. I didn't believe them, so I learned how to code, and built it myself.

It worked as a program, but failed as a business. Now I have the skills to not only build my own projects, but to help others.

<comment><AUTHOR> That...doesn't answer my question(s) at all.

 _Should I just ram through and keep hacking away on the projects or should I take my ideas to people who can do them/like them and sit back and watch?_

 _If the latter, where should I present my ideas and how?_

You pretty much just restated my post in statement form.

</comment></comment><comment><USER4> You should do neither. If you present good ideas to people that can execute them when you can't, why wouldn't they just take them? You should just be patient, take a passive note for some additional months. Write out your ideas on paper. Write down your skills. Depending on your age, consider going to university or getting work to bring up your skills. Once you are able to execute a significant portion of the work, then and only then is it time to move forward.

</comment><comment><USER5> Do it yourself, and learn the skills along the way.

\- If your idea doesn't work, you will at least have new skills to show for your time.

\- No-one will be as passionate or committed to your idea as you.

\- There are a lot of ideas out there. The ones that succeed are the ones which are backed by passion and commitment.

</comment><comment><USER6> If you enjoy programming, keep doing it and learn it.

If you don't, make friends with someone who does. And develop other skills along the way.

Once you've made friends/networked with some people, you can present your ideas to them and see if they're interested in working with you.

</comment><comment><AUTHOR> _post script_ Most of my ideas usually involve having see X service and writing down a bullet list of ways to improve it/make it easier. IE UX/UI stuff.

</comment><comment><USER7> Alternately: Spend some time wondering what you are "missing" and try to find a means to get that. For me, my health issues are a major obstacle. So getting well is my first priority. I have some secondary issues I am also working on, but I am clear that nothing will work as long as that personal issue remains a show-stopper.</comment>


Ask HN: Startup infrastructure setup - <AUTHOR>

I am about to launch my startup (Thanks to HN and PG). We did all legal activity. Now time for execution, but first thing we need to consider office set up, we already have some small space where we can setup our office. I am seeking advice for office infrastructure setup for 6-7 people.
I list down following items<p>-Backup
-PCs
-Servers
-Hosting solutions
-Chair, Table
-Source Code versioning
-Online Meetings
-Mail Hosting
-Printers
-Networks
-White board
-Office stationary
-Internet<p>Please suggest if I miss anything also please advice what all I have to taken care before buying/arranging these items. <comment><USER3> Most people here are guessing and have no clue.

Get furniture at a local university for almost free: <http://www.purchase.umd.edu/ttrader/> for example.

\- Hosting: Doesn't matter at first. Get a VPS, or use Amazon EC2. Do not buy any hardware and do not lease rack space. Don't get anything you have to physically touch yourself.

\- Developer workstations: Convince everyone to use their own computer. If they won't do that, find someone else. Anybody worth a damn at a startup is already going to be more comfortable with their own setup, so it is a red flag if they expect you to buy them a computer. If they just can't afford a computer, buy them the cheapest macbook and a cheap 24" LCD, and upgrade the memory yourself. Make sure they sign something committing them to give the laptop back when their employment ends.

\- Make sure someone knowledgeable is in charge of making the development and build environment totally automated on every platform you intend to have people developing on, which is usually linux and osx. If someone wants to develop on windows tell them no, getting a development environment working is too painful and would waste significant time to set up (unless you are on windows specifically, then the reverse). Setting up the development environment should only require running a single script and waiting awhile for it to complete. This will be done lots of times in the next couple of years, don't make people waste a bunch of time on it. Also, when the build environment changes, you need to have a script to run to update everyone's environment. This can simply wipe and recreate it, but it shouldn't take more than 5 minutes or so to do any updates after the initial install. Don't let the guy in charge of the development environment script say 'oh, it works on macs, you just have to edit this file when it is done and change this value' or crap like that, just get it down to running that one command, because every change is (time to apply change) * (number of people) of time lost. If everyone is working in the same place, you can avoid having copies of the database on everyone's laptop, and as people break the development database your DBA can learn the value of constraints and limited user accounts that will thwart attacks and data corruption later. Otherwise, there needs to be a sql script to run to transition the database from the old state to the new state whenever there is a schema change. Don't bother with automatic tools that try to do this, they do not work. Make sure everyone can access an up to date dump of the development database (if there is one) in a pinch to fix their dev environment.

\- Office space: Could easily become a huge expense. If one of the founders has a house, convert their garage by installing a stand-alone air conditioning unit and some extension cords. Make sure you have a signed lease for the space, and you are paying the house owner for the use (even if 'payment' is just iou's from future profits). Remove every single thing from the garage, buy 6 gallons of light colored paint and paint it, and do a great job, multiple coats. Make every employee help. Buy lamps and throw rugs from ikea and make it livable. If you can't get a garage, and one of the founders has a multi-room apartment, convert their living room if it is large enough, and otherwise this is like the garage. Write up explicit rules for the use of anything other than the garage/living room, and make sure everyone but the owner of the home sticks to the same rules (either everyone can wander around the house or nobody can, I would say nobody). Obviously you will have to allow access for everyone to a single bathroom, and preferably a shower. Make sure everyone takes turns cleaning the bathroom. Buy smoke detectors. Buy a bunch of big pillows, bean bag chairs, or other super cheap furniture, and set up a carpeted pow-wow area where people can chat, whiteboard, or just take their laptop for a change of pace. This will also become the nap area for people who start to basically live in the office. If you can't get a garage and you can't get a room in a home and you can't get a basement, maybe you should rethink things until you come up with a cheap-nearly-free space to use.

\- Do not allow Televisions or video game systems. Set up a firewall that blocks common time waster websites like HN, reddit, facebook, etc. Adopt the philosophy that if you are in the office you are working or resting, and if you need to relax or take a break, you leave and go somewhere else. This both avoids time wasting and helps people leave and get some air instead of getting into unhealthy exhaustion. Discourage people from working at home or at coffee shops, and so on, get them in that office if they are working, and chase them out regularly to do leisure activities or sleep when you see they are getting burned out. Make people wear headphones, even if they think they can get everyone to agree about what they are listening to, odds are there will be people who are not assertive and will say ok, but then get distracted or annoyed.

So, all in all, you should spend about $2000 setting up your office for around 8-10 people. If someone has a garage, maybe toss them $500 per month to use it, plus utilities.

For the rest of the stuff, use gmail, and either github or local version control if you have someone who is an ace at setting it up and managing it.

Cost breakdown: \- Paint: $200 \- Extension cords: $50 \- Smoke detectors: $50 (CO detector if you use any gas heater in the winter) \- Fire extinguisher: $30 \- Small fridge: $100 \- Carpets: $300 \- Desks and tables and chairs: $500 (get cinder blocks and thick plywood if you can't get anything else for very cheap, and put a table cloth over it) \- Lamps: $200 (you should have about 1 per person, do not allow incandescent lights as you have too much computers and people in the space heating it up already) \- AC: $600, get a powerful one that does heat too if you are in an area that needs that \- Big fan: $50 - good when it is nice out and you want to open the garage door

So that adds up to around $2000. In a few weeks you can spend more money, but once you spend it it is gone forever.

Do not lease office space in an office building until you can be (more) profitable with that expense.

<comment><USER4> Hosting and rackspace matter a WHOLE lot if computers are central to your business. Would a bank get started without a vault? Can you build a house without a foundation?

The point is as cheap as possible... not as cheap as cheap...

If you're going to end up with a lot of servers: get into rackspace NOW and develop a relationship with the datacenter. If computers are at the center of your business then you owe it to your business to house them with the same care you would your employees.

Or, you could grow it ad-hoc and deal with serious downtime and expansion issues later and attendant costs. Choice is yours. I would consider how well you like stress before deciding.

Convincing people to use their own computers is epic fail if you have intellectual property issues (or think you might in the future.) If your employee is going to sign an NDA under no circumstances should you allow them to use their own computers.

Also, varying degrees of attention are paid to things like vulnerabilities and stability as well as standards. If your relying upon yourself to do IT, then you're automatically setting yourself up for connecting ten different computers in 15 different ways. This does not scale.

Then of course, you'll have the hotshot programmer who'll set up his own sourcecode repository and you'll have no end of headaches getting the two repositories to agree. If you're going to rely on computers with minimal IT staff then you need to go cookie-cutter approach in the beginning and set up definitive rules like "a server is a server" and "a desktop is not a server".

<comment><USER3> There is no reason to own your own servers. Putting them in EC2 saves you lots of money and more importantly time, and allows for scalability which would be almost impossible with physical servers. Additionally, there is no large up front cost, it requires no physical presence at a data center to manage, and there are no hardware issues to resolve, be it failed drives, UPS fiddling to keep power use evenly distributed, it goes on forever. The advice given in the parent post is, frankly, uninformed (or at the very least 5 years out of date).

For a startup, you don't want to blow a bunch of cash up front because you don't know what your requirements are going to be in the long run. It is very common to blow a bunch of cash on equipment and have it sit idle until it is obsolete, or realize later that it is not what you needed.

Finally, an NDA does basically nothing for you. 'Great ideas' are worthless, and most source code is worthless as well. It's all about execution. If you had every line of source code ever written for youtube.com you would have no advantage whatsoever, it would get you nowhere. Companies that do create code that is very valueable can often give it away for free, see danga interactive and memcached, or the reams of code facebook and google give out, and these are not open source companies.

Very, very occasionally certain very difficult problems will be solved, and that code is valuable (for example, suppose fedex developed software that routed packages with 10% greater efficiency than anyone else could achieve) but here again the code is worthless, the algorithm is what is valuable. The algorithm can be patented, so here again, the code itself is worthless to competitors. Example: Adaptive Replacement Cache

"Also, varying degrees of attention are paid to things like vulnerabilities and stability as well as standards. If your relying upon yourself to do IT, then you're automatically setting yourself up for connecting ten different computers in 15 different ways. This does not scale." -- This doesn't mean anything as far as I can tell. I honestly cannot figure out what your point was here, or if there was one beyond fitting as many words commonly used in technology discussions in a single paragraph.

If you can't figure out source control, you might as well give up now. It is a basic, entry level task in software development.

"... rules like "a server is a server" and "a desktop is not a server"." -- Yep, you've lost me. Either you are saying something super obvious, equivalent to "a door is not a window", or you are speaking the gibberish.

</comment></comment></comment><comment><USER5> Criteria 1: Cheap (don't spend too much at this stage)

Criteria 2: Easy (your time is better spent on other things)

Criteria 3: Portable (if successful, you will move to a larger/better office. If not, you will sell this stuff to someone else. Either way, keep it portable)

I wouldn't overthink this right now. Do whatever is most efficient for _you_. Make sure you have an easy, touch-free, reliable way of making off-site backups of your source code (presumably the only real thing of "value" right now).

For things I have been involved in, I do my own hosting. All servers are linux. Email, web, svn, etc., all setup on linux boxes and backed up to other remote linux boxes. I have been doing iterations of that for 15 years now. It just happens, it takes me no effort. It might take you a solid month and still not work right, in which case that is the wrong approach for YOU.

Check craigslist for furniture. Start with used office furniture. As a rule of thumb, for offices I have built out, it will cost you $1,000/cubicle (used cubicle, chair, labor/install/setup). This is most likely too expensive, especially if you can get a $200 chair and a simple desk someplace else. Just make sure the furniture is workable. I worked at one place that had really nice chairs and really basic desks (tables really), no storage for books, no room to spread things out. It sucked.

</comment><comment><USER6> Use Google Apps for Domains for your email and calendar. No need, IMO, to run your own mail server. We are currently 10 employees and have no physical servers. We have 1 Linode that is our build server and source repository, and we use Google Apps for everything else.

Source control: Subversion hosted on a Linode we manage

Email and calendaring: Google Apps for Domains

Online meetings: GoTo Meeting or WebEx

Conference calls between < 5 people: Skype

Web server: Hosted on a Linode we manage

Build server: Hosted on a Linode we manage

Internet, White Boards, Printers, Network: We get that from the office we share

</comment><comment><USER7> Here are some random thoughts:

Don't have your source code repository just in the office. I would strongly suggest to use a distributed system like git or hg while also keeping a master repo on something like a 6 USD/month rackspacecloud server.

I move backups to Amazon S3. I simply export databases and repositorities, then tar, bzip and pgp them and then upload them with a timestamp in the name to Amazon S3. With the right tools on unix this is almost a online-liner. And it costs a couple of dollars to just upload and store stuff.

Laser printers are really cheap these days. Toners are expensive. But really, just print the 'formal' stuff. Letters, contracts, etc. Nobody prints source code anymore I think.

Network: go wireless if you can. Preferably 11n. Less infrastructure needed. Get a wireless router with USB to hookup the printer.

Chairs: let people choose their own. Within a certain budget. I find it highly personal. Specially if you plan to use them 10+ hours a day :-)

<comment><USER8> I dunno about that wireless recommendation - I can't STAND wireless for anything heavy-duty. If I need to be transferring files of a reasonable size (which seems to always happen during development - ISOs for virtual machines, packages, art assets), I hate being constrained by wireless speeds. Plus, depending on your building, you can get weird spots that are perfect for desks, but shite for wireless, with the poor schlepp stuck in that office getting just about the same bandwidth as he would with a tin can and string.

It's probably a good idea to start with it (keeps you from having to do all that cable-laying, yeah), but put it on the "to replace asap" list.

<comment><USER9> "I dunno about that wireless recommendation"

At this stage in the game, I would recommend wireless, because you can add more comptuers without running a lot of cable. Of course the servers should be wired.

</comment></comment></comment><comment><USER4> If you are going to have servers, backups and other items that are both mission critical and environmentally sensitive then you need space that is air conditioned, expandable, properly sized for power and lockable. Unless you are both a licensed electrician and a trained HVAC engineer I guarantee you that whatever assumptions you have about servers and their power loads, heat signatures and space requirements are wrong.

Unless you are planning on hiring full time IT staff, you probably don't want to build your own datacenter. If you think you are going to get much much bigger (server wise) then you might want to look into buying a small (but expandable) amount of rackspace in a datacenter. This will place all server infrastructure issues at somebody elses feet.

If you think that you'll buy three or four servers and not expand beyond that for the life of the business, it's probably a good idea to simply modify a large closet (> 150 sf) for AC, UPS, power, etc... But if you think you are ever going to have more servers then that you need to think about expansion now.

If the servers are critical to your business then you'll thank me later...

<comment><USER4> Also, if you're not permanently ensconced in your present office space, having space in a data center means a move without moving your servers (except, of course, for the network portion) It is as close to painless move as you can get...

</comment></comment><comment><USER10> For whiteboards, just buy a 4' x 8' showerboard panel from Home Depot, or Lowes. It's a thin piece of board treated with melamine, a perfect, cheap surface for whiteboard writing.

<http://www.kk.org/cooltools/archives/000679.php> \- You could cover your walls with this stuff for cheap.

</comment><comment><USER11> I've asked a similar question over here at serverfault.com [http://serverfault.com/questions/47914/tools-servers- service...](http://serverfault.com/questions/47914/tools-servers-services-to- run-a-web-startup-office)

 _"For a dev who doubles up as a sysadmin in small web startup, what services/servers/devices do you recommend running? I am also open to best- practices suggestions

To get the ball rolling- here are some of what I have.

• OSSIM suite

• Pingdom to verify stage and production status(I have custom scripts hooked to a paid SMS gateway)

• OpenDns

• SVN server (Linux).

• Backup server (Linux).

• Mail's on Google apps. (prioritizing LDAP integration)

…………. "_

</comment><comment><USER9> I've worked briefly for two startups since 2007. While both are still going strong, they both wasted money (in my opinion) on the following things:

Apple hardware (including 30 inch cinema displays), Herman Miller Aeron Chairs, and Glass Desks

<comment><USER4> I've been at jobs with small monitors and crappy chairs and I've been at jobs with small monitors and good chairs. I've also been at jobs with good large monitors and crappy chairs. If you offered me the choice of an Aeron Chair and a 30" cinema display, I'll take the chair. For software and network engineering related tasks, the single biggest enhancement of productivity is a good comfortable chair. The Aeron chair fits this bill.

But that doesn't, per se, mean that a good solid monitor isn't also a help. After 20 years in IT, I'd rate Apple in the top three for monitor quality.

<comment><USER9> I didn't say the Apple monitors weren't sexy! But $1800 is a big chunk of change for a startup. I have 2 22" samsung LCDs that cost $200 each back in 2007. Those are a much better investment in my opinion. My chair is an Office Depot task chair - $24 with $10 rebate in 2001. The chair comes with a warning: "not for multi-shift use"

<comment><USER4> Quite. As I said, Apple, in terms of quality, is in the top three. I would rate Samsung in the top one...

</comment></comment></comment></comment><comment><USER12> ikea or craigslist for all the chairs and tables. backups I would use s3 like everyone recommended. for pcs, let everyone use their own laptops. versioning - github. online meetings - skype. mail hosting - google apps. printers - <USER2> low end that can handle internet or wifi. whiteboard - get ideapaint and paint the walls with the stuff. stationary??? wut for!</comment>


Efficient Use of PostgreSQL Indexes - <AUTHOR> https://devcenter.heroku.com/articles/postgresql-indexes <comment><USER2> Using gist indices for exclusion constraints (added in pg 9.0) can be pretty useful also.

The Postgres docs show a simple example that enforces the constraint "no two rows in the table contain overlapping circles" (&& is the overlaps operator for geometric types):

      CREATE TABLE circles (
        c circle,
        EXCLUDE USING gist (c WITH &&)
      );

[http://www.postgresql.org/docs/9.1/static/ddl- constraints.ht...](http://www.postgresql.org/docs/9.1/static/ddl- constraints.html#DDL-CONSTRAINTS-EXCLUSION)</comment>


Upcoming Tech IPOs Will Mint Hundreds of Overnight Millionaires - <AUTHOR> https://gizmodo.com/upcoming-tech-ipos-will-mint-hundreds-of-overnight-mill-1832889859 <comment><USER2> I think thats pretty obvious. Hopefully this will stimulate the economy.</comment>


Qt 5.1.1 Released - <AUTHOR> http://blog.qt.digia.com/blog/2013/08/28/qt-5-1-1-released/

<comment><USER2> I don't know much about Qt and the changelog seems short...what is the relevant about this release ?

<comment><USER3> It's only a point release - from 5.1 to 5.1.1 - this is usually just minor tweaks and fixes.

No idea why this is posted to HN. The 5.0 to 5.1 release was much much meatier and I don't recall seeing that posted.

<comment><USER4> FYI: [https://news.ycombinator.com/item?id=5984223](https://news.ycombinator.com/item?id=5984223)</comment></comment></comment>


Show HN: hangnest.com - <AUTHOR>

Hangnest allows groups of travellers to connect with other groups of travellers in the cities they visit while travelling.<p>What do you think? Feedback are welcome. <comment><USER2> Clickable [http://hangnest.com](http://hangnest.com)

Sadly, this is all behind a facebook login. So can't give any review of your product without creating an account and spending time learning your system.

Please, put up a page that shows what you're accomplishing, what the user can expect to get when they login. It will get you much further.</comment>


Why not DANE in browsers - <AUTHOR> https://www.imperialviolet.org/2015/01/17/notdane.html

<comment><AUTHOR> The meatiest bit of this article, which is great:

Attackers control connectivity. Connectivity is expensive. Connectivity is also unreliable: captive portals, proxies, and firewalls break it. These factors make OCSP certificate revocation unworkable. For similar reasons, they make DANE's ostensible safeguard against malicious CAs unworkable. In practice, DANE would probably only be usable as an _additional_ CA; it would not be able to effectively overrule any of the 1482 existing CAs.

<comment><USER2> Slightly off-topic: Could you please add RSS support to your "blog"? I'm sure others, besides me, would love to me notified of new entries. Thanks!

</comment></comment><comment><USER3> The fact that TXT records don't work for some people shouldn't stop us. Anything that isn't currently widely used is broken for lots of people, because that's how networks are administered. Once it gets deployed and people start complaining, any specific network problem will get fixed.

Delaying proper network security because it won't currently work for a few percent of people seems like a recipe for never getting there.

<comment><AUTHOR> It's a cost-benefit issue. Do you believe DNSSEC is so valuable that it's worth (a) breaking connectivity for a significant number of people and (b) incurring the expense of replacing/upgrading the middleboxes that are breaking connectivity? If so, why?

<comment><USER3> I don't have a strong opinion on DNSSEC itself. It seems like it might be a good idea for email, at least.

I don't have much sympathy for network admins who block TXT records because it doesn't currently seem to break anything. TXT records are part of the spec, and if some of them have configured something to block them, that's not a good reason for everyone to not have secure systems.

</comment></comment></comment><comment><USER4> I'm reading these blogged opinions on DNSSEC and DANE and I notice that they never state the problem(s) that these "solutions" are meant to address. At least not explicitly.

Somehow I doubt it, but if by chance there is only one true problem being addressed and that problem is simply how do we authenticate another computer as being who we believe her to be, then my second question is: what is wrong with SSH authentication?

<comment><USER5> > what is wrong with SSH authentication?

You need some secure, out-of-band, communication means to transfer the key fingerprint to be able to verify it. The whole aim of the CA structure is so I don't need to somehow find a secure means to contact Amazon to verify their key fingerprint prior to first connecting to their website.

<comment><USER4> What if I do not want to transfer the key over an insecure network of computer networks that are trivial to tamper with?

What if I would prefer to look up or obtain the key via some other means (that I deem more trustworthy that the internet)?

<comment><USER6> What key are you referring to here? The CA's root certificate?

</comment></comment></comment></comment><comment><USER7> I'm using the browser plugin available at [https://www.dnssec- validator.cz/](https://www.dnssec-validator.cz/) to validate dnssec/dane.

</comment><comment><USER8> Thomas: Would you agree that DNSSEC is a solution looking for a problem?

<comment><USER9> There are a lot of real problems that DNSSEC can help solve.

However, it is important to note that DNSSEC and DANE are two different things. Much of the recent discussion here has lumped them together.

<comment><AUTHOR> What would those problems be?

<comment><USER9> Broadly? General MITM, Kaminsky, etc.

DANE as an application of DNSSEC is interesting (and based on the recent string of editorials, contentious as well). Using DANE to constrain CAs could add an additional layer of protection against a rogue CA. Using it as an additional CA could help facilitate moving towards "HTTPS-everywhere".

The takeaway of course in implementing it in any manner is that it is just another layer, not a panacea.

Outside of DANE, there are other applications such as IPSECKEY and SSHFP that have utility.

<comment><AUTHOR> How does securing DNS lookups solve the MITM problem if the underlying traffic remains unencrypted? If you encrypt the traffic, you don't need secure DNS anymore.

<comment><USER10> That depends on what your trust model is. Somebody is resolving the DNS query, and then the result gets transmitted to you. If all you're worried about the result being MITM'd during transit, then encryption is sufficient. You can set up DNSCrypt to deal with this today [1].

But often the provider resolving the query is itself untrustworthy. Most providers these days (including OpenDNS) redirect invalid queries to their own landing pages (which poisons caches and has other bad effects). Providers may "censor" certain domains. Or be subverted by state-level actors (see: Belgacom). In DNSSEC, the root of trust is the administrator of the DNS root zone (e.g., Verisign, whom you're probably already trusting anyway).

[1] But encryption is not a panacea. As soon as you visit the address(es) returned, someone will get a pretty good idea what you looked up.

<comment><USER11> > Most providers these days (including OpenDNS) redirect invalid queries to > their own landing pages

OpenDNS stopped doing this on June 6 2014:

[http://blog.opendns.com/2014/05/29/no-more- ads/](http://blog.opendns.com/2014/05/29/no-more-ads/)

<comment><USER12> OpenDNS could still turn ads on again at any time. And the censorship and subversion arguments are still valid.</comment></comment></comment></comment></comment></comment></comment></comment>


Show HN: Create pronounceable random passwords using Orthography rules - <AUTHOR> https://nousrandom.net/passwordmaker/orthgraphicpasswords.html <comment><AUTHOR> The goal is not to create words that are in the dictionary. A concept is to create a batch of passwords, then look down the list to find one that CLICKS with your brain. You can change the default number of passwords created to very large numbers. Simply look down the list until you find one that works for you.

It is likely that combinations will create difficult to pronounce or remember. Such is why you should create a batch and then choose one that works for you.

I do not want to start adding too many creation rules as doing such can make it easier for a hacker to eliminate possibilities.

Another way to use it is just click your browser refresh when viewing the results page. A new set of passwords will be generated. If you do not see one that works for you, just refresh again until you find one that does. If you are generating multiple words per password, nothing prevents you from mixing and matching from multiple entries to create your own.

I have a blog post that discusses how I modified the algorithm. Originally I used 3 to 5 letter orthographies and the results were not much better than random characters. You can read my discussion on my blog

[http://www.nousmind.com/blog/2016/08/25/changes-made-to- the-...](http://www.nousmind.com/blog/2016/08/25/changes-made-to-the- orthography-password-creator/)

</comment><comment><USER2> This is a clever idea. I really don't want this to come off as discouraging because I love stuff like this.

That said...

This shows the limitations of relying on orthography as a proxy for phonetics, especially in a language like English where the spelling is such a disaster.

In my mind, "eoptoesw" and "quwyh" are not pronounceable as English.

And is "twutinn" pronounced too-tin or am I supposed to pronounce the "w" somehow? And if I remember my password is too-tin, how do I know it wasn't _spelled_ tootin or twotin or twotinn or tutinn or tutin or...

At the very least, you should consider which consonant clusters can occur at the beginning, middle and end of words. They can't all occur everywhere. Then I'd try to eliminate as many homophones as possible. That might get you a lot closer to truly pronounceable and non-ambiguous passwords.</comment>


Peacetime CEO/Wartime CEO - <AUTHOR> http://bhorowitz.com/2011/04/15/peacetime-ceowartime-ceo/ <comment><USER2> Agreed that Google's facing a serious threat and that a CEO approaches things differently in that situation than when everything's booming. I'm not sure about the peacetime/wartime stuff though. First of all if you want to use military analogies, Google has been at war with Microsoft since 2005 or earlier, and with Apple for a few years as well; now they've got another major front with Facebook -- and they're losing. It's a very different situation than Intel's, so the CEO may need to have different skills and attitude.

And then the list of differences between a wartime and peacetime CEO is just silly. "Peacetime CEO spends time defining the culture. Wartime CEO lets the war define the culture" ... hmm, seems to me that George Washington, Abe Lincoln, Winston Churchill all did a lot of culture defining, and so did Andy Grove.

It's interesting though to look at the list in light of his self-description that "One could easily argue that I failed as a peacetime CEO, but succeeded as a wartime one." To me it seems like he's describing the CEO he became, and arguing that it was optimal to become that way because they were at war. And quite possibly it _was_ optimal for him and his company in that situation. But going from there to "these are the characteristics a CEO needs when at peace/at war" is over-generalizing.

<comment><USER3> I agree that FB is a threat to Google, but the notion that Google is loosing just due to the inane valuations and hype Facebook has received seems a bit far fetched.

<comment><USER2> Facebook's got over 500,000,000 users. None of Google's social efforts so far have been particularly successful and some have been disastrous. So even though I agree Facebook's over-hyped and the valuations are optimistic, I still think Google's losing in social.

<comment><USER3> Theres a big difference between losing in social and losing.

Remember when MS was losing the internet?

Edit: Fixed the loosing typos. Not a native speaker here - so I'll blame the spellchecker :)

<comment><USER4> Aaaargh. _Lose_. The misused "loose" has come out of nowhere in the last 5 years, and for some reason really annoys me.

<comment><USER5> This, this, and again this.

</comment></comment></comment></comment></comment></comment><comment><USER6> There are some insights in this article. In fact modern time companies were originally formed in a very similar way as military units. Although in military when losing a battle, an incompetent general can lose his army and/or his life, a CEO failed a company likely still took a nice package away.

<comment><USER2> agreed. there's a lot you can learn from "business as war" analogies -- when I was doing competitive strategy at Microsoft I worked a lot with Robert Greene, who sent me an early copy of a chapter from his "33 strategies of war" about how FDR got his allies into key positions throughout the government in order to transform things organizationally. It was extremely useful, and books like Robert's and Sun Tzu's should be mandatory reading for anybody doing strategy at a large company (or small company that wants to grow large).

But yeah, the analogy breaks down at some point. Yes, there are billions of dollars at stake here ... but in the real world, soldiers put their lives on the line and civilians get caught up as collateral damage.

<comment><USER7> For example, after some research I think it greatly contributes to MS's anti- trust crimes.

<comment><USER2> In the 1990s it may well have helped contribute to an attitude where nobody stopped to think whether business practices are anti-competitive.

It also contributed to some really horrible software. At one point in the early 2000s I was meeting with Windows architects about one highly-vulnerable part of IE that was causing all kinds of security grief, and the challenges of rewriting it because its API was badly crafted. Somebody explained it like this: "You've got to understand the history. We took a lot of short cuts because we wrote it during a war."

</comment></comment></comment></comment><comment><USER8> Peactime CEO = don't screw up a good thing by taking chances.

Wartime CEO = Take the chances necessary to have a good thing.

</comment><comment><USER9> I imagine being a wartime CEO is going to get increasingly more challenging for public relations since the company is already so dominant. Even here on HN, people don't see the urgency of Google's situation. It's not enough to be on top. You've got to be way ahead.

</comment><comment><USER10> Doesn't just apply to huge companies--startups need a wartime mentality.

<comment><USER11> I'm not sure about that. Many startups are either creating markets, or going after brand new markets. Expanding / educating the market is more important than destroying your competitor in these cases. I find it ridiculous when two tiny startups in a market that the mainstream doesn't even know exists start bashing each other. That energy is better spent expending the market.

</comment></comment><comment><USER12> Today I learned, CEOs are like dictators or other leaders who dominate other people. More democracy please.

</comment><comment><USER13> Apart from a CEO shift, what evidence if any exists that Page will be a Wartime CEO? The analogy with Jobs looks baseless to me, Google is making huge profits and with 6000 new employees coming in 2011 they are hardly in a war. Obviously they have their challenges, like being late in the social game, but their core product is still unendangered.

The whole text, while captivating and well written, feels like a plastered on narrative.

<comment><USER14> About 7 years ago Google was the rising star, and there were stories all over the place about them poaching employees from the previous generation of tech companies (ie Microsoft). Now Facebook is the "star" and you hear about Google making outlandish salary offers to keep the best and brightest on board. While Google is not at the level of stagnation and decay that Microsoft is in, one doesn't have to really look too deeply to see that Google doesn't "get" social and that's the world we live in.

I guess the TL;DR is: You don't have to be at the doorstep of "war" to move in that direction. I guess Page sees it on the horizon and is moving to prepare now, instead of when it's upon them.

<comment><USER15> While I agree that Facebook is commonly perceived as "star which smart people gravitate towards nowadays", I really fail to see why that is.

Did suddenly all the techies buy in the "social" buzzword? I don't really think so: what infrastructural and, in general, technical challenges would Facebook be facing which aren't faced at Google too?

I tend to perceive Google as the technical innovator, bringing magic (1 gB email??? watching the world from above??? and free???) to the real world, whereas Facebook, despite it's cool API and Cassandra, is just vendor lock in.

But I digress: maybe the problem is that Google's already solved the problem leaving no space for new ideas?

Why would Facebook appeal more smart techies?

<comment><USER16> Agreed. It's hard to see Facebook's vision for the future. Is it their notion that privacy is overrated? Google is organizing the world's information like it said it would.

Most of the draw of Facebook is their 500mil users. I see popularity more than greatness. Google has and continues to do amazing things (unfortunately none of them in social).

Google moving into "social" is like a nerd learning to dance. With enough work they can do it. They'll be awkward at first. Facebook is hosting the dance because they have the biggest house. Facebook is good but mostly because it's the biggest. They don't offer many reasons for users or advertisers to be there other than "everyone else is". They can still become a lesser version of their current glory a la Myspace.

</comment></comment></comment></comment><comment><USER17> brilliant</comment>


France Set to Roll Out Nationwide Facial Recognition ID Program - <AUTHOR> https://www.bloomberg.com/news/articles/2019-10-03/french-liberte-tested-by-nationwide-facial-recognition-id-plan <comment><USER2> This is a rather poor and click-baity article.

According to the French government's page on this system [1] (in French):

The system is an app that generates login details to allow online access to (public?) services.

You install the app on your smartphone. It uses NFC (I suppose) to read your picture (also other details?) from your passport's chip, and stores it locally on the phone. It then uses this to perform facial recognition using the phone camera in order to identify the phone's user. No biometric data leave the phone according to [1].

The stated aim is to allow people to conduct administrative tasks (forms, applications) fully online where it is not currently possible because a "hard ID check" is required. It will not be compulsory.

It sounds a bit like Apple's Face ID but backed by official documents (passports) and with the government's seal of approval, some sort of passport check performed by your smartphone.

[1] [https://www.interieur.gouv.fr/Actualites/L-actu-du- Ministere...](https://www.interieur.gouv.fr/Actualites/L-actu-du- Ministere/Alicem-la-premiere-solution-d-identite-numerique-regalienne- securisee)

As an aside comment, in France most people have a passport, and everyone has an ID card, which requires having photo and fingerprints taken. So this does not give the government anything that they don't already have (or could have) and it seems that they took precautions to avoid unnecessary transmissions of biometric data.

<comment><USER3> I'm french, I've heard of this biometric thing, and so far it doesn't seem people are really scared of this, so... yeah, it sounds click-baity.

French people are very sensitive to their rights and liberties, and are very quick to organize protests. Many steps were taken to monitor potential terrorists since the Paris attacks, and those were not well received, but politically it was hard to not implement those measures.

I might be a little patriot, but generally the french state does a good job, mainly because french citizens and voters are forcing the government to have pretty high standards.

<comment><USER4> > French people are very sensitive to their rights and liberties

Oh really, like the non-existing demonstrations against the increase of surveillance in the past 10 years?

<comment><USER5> Surveillance by which country?

<comment><USER4> Well first and foremost the French government.

</comment></comment></comment></comment></comment><comment><USER6> These things always start with an innocuous purpose.

The French national DNA database initially was a sexual assault database, to be able to identify rapists. Now your DNA is collected even if you are arrested in a demonstration and never charged.

It is like laws. When a new law is on the table, the question is never about the reasonable use of that law, it is all about how it can be abused in the worst possible case, because that always ends up happening sooner or later.

<comment><USER2> This system reads the data from your passport (which the government collected when you applied for one and stored there) and store them on your phone. Software then uses facial recognition to check that the person holding the phone matches the picture from your passport.

Hardly 1984...

<comment><USER6> If you build a system you can query for any face and get the identity, it will not take very long for someone asking for it to be used to identify violent criminals. Then terrorists at airport gates. Then demonstrators. etc.

<comment><USER7> This app doesn't provide the government any new information (it uses ID the government already issue) nor invent any new technology (face recognition already exists). If French government - or any government for that matter - wished to do what you described then this app wouldn't be the proverbial gateway drug to that point. In fact, the entire point of passports _is to_ identify people at airport gates and other national borders.

<comment><USER8> > This app doesn't provide the government any new information

> wished to do what you described then this app wouldn't be the proverbial > gateway drug to that point.

It's not about "gateway drug" \- it's about taking small, incremental steps to get from point A to point B such that you don't realize it, and each action is a small change from the previous. This is widely known as Salami Slicing[0], though I like to call it "slow boiling a frog."

This is the same tactic I use to slowly bring errant teams and projects up-to- code at work, start off slow with a build server, add in pass-fail rules, add in style rules, add in test requirements, add in code review to ensure these things are up to snuff and before you know it we have a nice compliant project, whereas if I walked in on Day 0 and laid down the law there is guaranteed revolt.

[0] - [https://en.wikipedia.org/wiki/Salami_slicing](https://en.wikipedia.org/wiki/Salami_slicing)

<comment><USER9> But it's not an incremental step. The French government already had that database. This is just using the data _they already had_ in a new way.

<comment><USER8> > But it's not an incremental step. The French government already had that > database. This is just using the data they already had in a new way.

Yes, it is a new, small, incremental step!

This is introducing a new procedure, a procedure they can change later to move the needle forward.

This is the whole point, doing small incremental steps. Each of which appears rather banal and unobjectionable.

That you don't care is proof it works!

<comment><USER9> Anything can change later, even removing a procedure could be a prelude to adding a new, more invasive one.

An incremental step requires an increment. Nothing gets incremented here. The French government already had this data, and already used it to biometrically identify people. The only thing this inches toward is to a reduction in the number of public functionaries. This is the automated checkout system for State services, nothing more.

<comment><USER8> > Nothing gets incremented here.

People's expectations and willingnesses are moved forward. Overton Window.

> This is the automated checkout system for State services, nothing more.

Look beyond the superficial, at larger issues.

Anyone can shoot any idea down by reducing it to a simple, innocuous sounding concept to make the other look ridiculous.

Claiming "there's nothing here" is wrong, saying "I recognize the potential for bad, but choose to accept that risk" is a different story.

<comment><USER10> > Anyone can shoot any idea down by reducing it to a simple, innocuous > sounding concept to make the other look ridiculous.

Just as anyone can argue that any change to process is salami slicing even when nothing of any real value is being incremented.

I do understand your concern and I think healthy skepticism is a good thing. I'm just not convinced your so arguments are consistent with the facts being presented.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Android only? I'm sure it'll get an iOS version too, but what about people who don't have smartphones? In Denmark we're seeing more and more public services move to Apps. It used to be that there was an offline version, like in the case of our "NemID", but now we're talking about digital only drivers licenses and social security cards.

The private sector had long embraced mobile apps, and it's really hard to buy tickets, do banking and so on without a smartphone, but now we're truly locking people into their mobile devices. And these devices aren't free, I mean, it's not just going to be "Android" only, it's going to be "google play" or "Apple store" only. I'm not sure that's very democratic.

Don't get me wrong, I'll absolutely use these things and I currently use most of the available ones with great satisfaction, but it does concern me if we're locking public services into privately owned ecosystems.

<comment><USER12> The information at [1] (in French) clearly states that alternative methods remain available. Here is the translation of an excerpt:

"Creating an Alicem account is not mandatory. Users remain free of using available alternatives: \- account creation on the specific service [Translator's note: this identification method is destined at the national SSO that is only one way of logging in the various public services] \- other electronic identification methods on FranceConnect [Translator's note: FranceConnect is the name of this SSO. This includes at least fiscal number + password and social security number + password and maybe other methods] \- traditional physical administrative procedures"

I am not necessarily a fan of this identification method and for myself I consider it less secure than a sufficiently strong, properly stored and regularly updates password. Still, the argument of locking the users or making the smartphone mandatory does not stand.

As for the collected biometric data, it is collected from the passport's chip, so technically the administration is already in possession of this data, there is nothing new here.

I see this as completely independent from facial recognition surveillance (hence mandatory), which in my opinion we must fight against.

[1] [https://www.interieur.gouv.fr/Actualites/L-actu-du- Ministere...](https://www.interieur.gouv.fr/Actualites/L-actu-du- Ministere/Alicem-la-premiere-solution-d-identite-numerique-regalienne- securisee)

</comment></comment><comment><USER13> Don't worry, if capgemini or accenture win the project (as they often do), the project will never work

/s (but no so sarcastic either)

<comment><USER14> Oh, Capgemini! Had to work with one of their SDKs once. Oh my. Wish I hadn't.

But maybe we could suggest them to pick, say... Steria? Louvois was such a success[^1]

Reminds me of [https://projectfailures.wordpress.com/2008/06/24/project- fro...](https://projectfailures.wordpress.com/2008/06/24/project-from-hell/)

[1]: [http://en.rfi.fr/africa/20140404-faulty-software-robs- french...](http://en.rfi.fr/africa/20140404-faulty-software-robs-french-car- troops-bonuses)

</comment></comment><comment><USER15> >France says the ID system won't be used to keep tabs on residents. Unlike in China and Singapore, the country won't be integrating the facial recognition biometric into citizens' identity databases

That's what they all say but once the systems exists the temptation is there to use it and each successive bunch of authoritarians will use it a little bit more. They don't even need to be more than a small minority of government to do it so long as they do it in small incremental steps (integrating it with more and more government functions).

<comment><USER16> Don't see why this is getting downvoted. The list of examples is just too long. Germany recently changed their laws to allow easier access to registered information. It went from "we'll only use it for those pedo-bio-nuclear- terrorism cases that we keep telling you about" to "well but also for organized crime" to now supposedly "well or copyright infringement or petty theft".

</comment></comment><comment><USER17> One day we will regret this computer revolution in ways that we currently can't begin to imagine.

<comment><USER18> I would say quite a few sci-fi authors have done a good job on this ...

<comment><USER19> My favorite author in that genre is Daniel Suarez, who makes some scarily accurate thrillers. It's not all 100% realistic, but as someone who is often annoyed at the deus ex machina[1] of other (science) fiction, this is really great. The author is a former software engineer, so I guess they know quite well how technology works in general.

[1] [https://en.wikipedia.org/wiki/Deus_ex_machina](https://en.wikipedia.org/wiki/Deus_ex_machina)

<comment><USER18> That is one of my favourites as well, World of Warcraft meets the Real World in a way that, while not necessarily believable, did not cause retinae detachment from extreme eye-rolling.

</comment></comment></comment></comment><comment><USER20> It's not stated clearly in the official publication but it seems that their medium term goal, beyond using this on government websites, is to also allow private companies access to the tool.

It'd be pretty useful as a way to standardize the way various companies do identity verification online.

I'm honestly pleasantly surprised to see such a thing coming directly from our government, as it can be sometimes quite outdated.

</comment><comment><USER21> Why not have banks act as identity providers?

We have this in Poland and it works great - as a contractor I have to send certain tax documents every month and I only ever authenticate via my bank and associated 2FA.

The other method stopped working after I lost the password and discovered that reset didn't actually send an email like it should have.

<comment><USER16> Turns out there's no guarantee that any particular private bank has to offer you their service, so there are some people who simply don't have a bank account. If you're gonna do anything to do with official papers, you have to be at 100% (not 99.999...%) coverage. Which IMHO is just one more reason why this kind of thing is dead on arrival, given that it requires a smartphone.

</comment></comment><comment><USER22> > "It took a hacker just over an hour to break into a "secure" government > messaging app this year, raising concerns about the state's security > standards."

Can stop reading right there, considering that the messaging app was in beta, and the fix was quickly rolled out - so everything worked as designed, _for once_ \- this is the equivalent of

> "It took a hacker just over an hour to break into a computer, raising > concerns about the security standards of people that use computers."

</comment><comment><USER23> I don't know much about infosec but I know enough to see that this tool is not ready. It's really scary. Also the fact that it's not discussed much, here in France. It's the first time I've heard of it. From a country that has had a government agency for protecting digital liberties since 1978 (which made laws about what data you can and cannot keep as a software provider) it's a big change of direction.

<comment><USER24> What is scary about it, though? It's really just adding a new way of authenticating on government websites. I like the idea of how it works, but I don't find it very secure, compared to Belgium's chip and pin system for example (this application is the equivalent to Belgium's itsme, which I use often enough).

However it's probably the best we can do in France since we don't want to have a centralised citizens database.

<comment><USER25> itsme has me really scared about it's security, especially since they are so handwavy about it. I browsed their site for a long time before enrolling, but didn't find anything useful.

<comment><USER24> What were your concerns about it?

</comment></comment></comment></comment><comment><USER26> So if police or someone can get your phone they can just point the phone to your face and get access to all info ?

<comment><USER27> No, the app just compare the face in front of the camera with the photo saved in the NFC chip in your passport. So that the government agrees that the user of the phone and the passport are the same person. Once this is done, the photo is destroyed as well as the comparaison. It's an app that does what every custom officer do when you cross a border.

</comment></comment><comment><USER28> EU already have a EU-wide identity database with passport photos. This is how EU automatic border gates work.

</comment><comment><USER29> We have essentially the same thing in the UK, called Gov Verify.

[https://www.gov.uk/government/publications/introducing- govuk...](https://www.gov.uk/government/publications/introducing-govuk- verify/introducing-govuk-verify)

</comment><comment><USER30> [http://archive.is/ZyZOf](http://archive.is/ZyZOf)

</comment><comment><USER31> Wasn't gait recognition much better?

</comment><comment><USER32> Can we give french citizens the benefit of the doubt here. Living there I can tell you the resident are much quicker to point out these new systems as fascist than, say, Americans.

Even in Paris, the number of surveillance cameras was dramatically lower than London. The police would tout the crime fighting advantages of having these cameras in certain areas, someone would write an opinion on Nazi occupied Paris, the camera talk would go dormant for a few more years. New director arrives and wants to install cameras in certain areas...

<comment><USER16> First, I think the argument is not against how French _citizens_ deal with this, but how the government is pushing this stuff to begin with.

Second, I'd like to agree with you, I really would. BUT: After the charlie hebdo and bataclan attacks, seeing...

* completely unopposed état "d'urgence" being prolonged for TWO YEARS when the real urgency was over within a few days * the way that it was abused [1], and largely not discussed let alone really opposed in public or by my relatively tech savvy colleagues and friends in private conversation * how some of the most outrageous parts have been made into regular law now * how we still have military patrolling everywhere * bag checks at university lecture halls (seen yesterday) * the vigipirate logo (which looks like straight out of a dystopian scifi comic [2]) plastered all over town * the kindergarden on my way to work still being surrounded with concrete barriers blocking the parking, to ostensibly (and practically completely irrelevantly, given the geometry of the place) block a car from driving through the fence

after all of that, I have little to no confidence that France is any less prone to a slide into totalitarianism than any other country. :(

[1]: [https://wiki.laquadrature.net/%C3%89tat_urgence/Recensement](https://wiki.laquadrature.net/%C3%89tat_urgence/Recensement) [2]: [https://en.wikipedia.org/wiki/Vigipirate#/media/File:Vigipir...](https://en.wikipedia.org/wiki/Vigipirate#/media/File:Vigipirate_2014.svg)

</comment></comment><comment><USER33> And so... it has come to this.

</comment><comment><USER34> > Saying it wants to make the state more efficient,

That is bold. Normally when governments want to destroy your privacy they claim they want to combat terrorism or something more horrible. They are going with making their processes more efficient?

<comment><USER35> I think the goal, as explained by other comments, is to allow to do thing remotely with your smartphone, instead of having to go to the city hall/administration building.</comment></comment>


AngularJS Bootstrap Spring – Startup App - <AUTHOR> https://github.com/Rob-Leggett/angular_bootstrap_spring <comment><USER2> This seems similar to JHipster:

Hipster is a Yeoman generator, used to create a Spring Boot + AngularJS project. Goal Our goal is to generate for you a complete and modern Web app, unifying:

A high-performance and robust Java stack on the server side with Spring Boot A sleek, modern, mobile-first front-end with AngularJS and Bootstrap A powerful workflow to build your application with Yeoman, Bower, Gulp and Maven

<comment><USER3> I love what you guys are trying to do with JHipster, but the generated code is just so... bloated. Example: I saw you generate an Async queue as a .java file. Surely this could be done as a shared library, rather?

</comment></comment><comment><USER4> Note: this is using Angular 1.4.

<comment><AUTHOR> Have now upgraded it to use AngularJS 1.6.1

</comment></comment><comment><USER5> What I find odd about this project is that it uses maven to build the client (or at least a maven plugin that in turn executes grunt/gulp/whatever). Does anyone have experience with that? Is it any good?

<comment><USER6> Had some experience with it in BigCorp™. I don't love it, but it works. It's just a plugin that will install node (and npm), run `npm instal` and then run the specified gulp task.

The good part is that it's not that bad to fit within the company infrastructure, particularly if it's a BigCorp kind of thing. It's interesting because it allows you to play well with CI processes and quality rules - I'm thinking about tests here. With this kind of setup, you can make the front-end build fail if e.g. code coverage drops below a given threshold, using the same setup you use for other components.

The boring part is that it's yet another place to put config info. A particularly ugly one which reeks of over-engineering IMHO. Also it's XML; XML isn't quite the song of the front-end people, at least config-wise. :)

</comment></comment><comment><USER7> What is the significance of this?

<comment><USER8> from the authors blog "Folks have been asking me if I knew of any good examples of a J2EE web application that utilizes the following technologies: Angular JS, Bootstrap, Spring 4, Spring Security 4 and Hibernate 5.2.4, and after searching around I decided that it would be best to create an example project that would demonstrate the integration of all these technologies as well as describe some of the specifics."

<comment><USER7> ah, cool. I clicked on it because i was hoping it was a good Angular2/Spring seed project

<comment><USER9> For the love of god, just use the official angular-cli.

</comment></comment></comment></comment><comment><USER10> You should have a look at Spring Boot, which makes the Spring backend much easier to bootstrap/customize.

[https://start.spring.io](https://start.spring.io) is your fastest way to production using Java/Spring

<comment><AUTHOR> Agree with that also, this was written 4 years ago when spring boot wasn't as popular.</comment></comment>


Mineception – MINECRAFT IN MINECRAFT - <AUTHOR> http://www.planetminecraft.com/project/mineception---minecraft-in-minecraft/

<comment><USER2> I don't play minecraft... So I have no idea how this is "cool" or "neat"

The comments in TFA show a lot of enthusiasm.

Can anyone explain?

<comment><USER3> Minecraft has a very basic "electronics" system called redstone that allows you to create basic structures like AND/OR/XOR gates with various wire, torches (devices that power other things), switches and buttons. What they did is take this basic system and make a game that runs within the game using them.

There are some mods for the game that give easier access to higher level structures (single block gates, for example), so it may have used those but I can't tell from this page.</comment></comment>


Announcing Git Integration for Atom and GitHub Desktop Beta - <AUTHOR> https://github.com/blog/2362-announcing-git-integration-for-atom-and-github-desktop-beta <comment><USER2> Where is the Linux version?

These are the types of applications that make me want to break down a buy a Mac.

<comment><USER3> Well... it's open source and Electron works on Linux. Give it some time, perhaps some enterprising soul will submit a tested patch to get it running on Linux. Not sure if it's widely known or not, but there are only a handful of people at GitHub who use Linux as their primary OS. Better to ship a tested version than to guess that it works for people.</comment></comment>


And Here It Is: The New Google Reader Revealed - <AUTHOR> http://techcrunch.com/2011/10/31/and-here-it-is-the-new-google-reader-revealed/ <comment><USER2> Adding a full 20px of vertical padding to each item in a list sure looks pretty, but it's cut the number of items visible on the page by ~50%. For a tool designed for skimming large amounts of information it seems to cut efficiency rather than improve it.

Can any UI people provide a good reason for this change? (More white space = faster skimming/more comprehension?)

<comment><USER3> You assume that skimming is a primary use case. That is not how i use google reader (if there is a feed that i consistently do not want to read i unsubscribe). Maybe they were optimizing for my use case, where you read everything (or close to it).

<comment><USER4> For example, I have Hacker News in my rss feeds. I certainly never read everything or even close to that. As a fellow HN user, surely you are not interested in every article here?

<comment><USER5> Why are you using an RSS reader (even worse, one that tracks unread counts), then?

<comment><USER4> Because it is a very good aggregation of almost everything on the internet I care about. I can have feeds for tumblr accounts, youtube accounts, twitter accounts and whole subreddits and without actually having an account in any one of them or actually having to go to them everyday.

This ties in with my complaint with Reader removing social features. I don't want to go to G+ everyday to see my friends' shares when previously I could stay in the only ``social'' network I care about.

</comment></comment></comment></comment></comment><comment><USER6> So the only way to share something privately is to first publicly +1 it?

Ah, apparently you can click "share" in the black bar at the top and it will let you directly share the currently selected item in reader with specific circles. That's not very discoverable.

<comment><USER7> I agree, that is a poor choice to have as the only way to share something. An easy fix would be to add a link on each item as a kind of synonym for the Share button in the G+ bar. That said, the problem is a pretty minor one given the extent of the redesign. I'm rather happy with the new Reader myself.

</comment></comment><comment><USER8> The new UI seems to waste a lot of the screen with whitespace, to the point where I feel like it is an unintended bug (this is in the 'Expanded' view)...and it seems like you can no longer resize anything on the page?

</comment><comment><USER9> Contrary to most people here, I really like the new layout. I'm trying to move to web-apps for most of my daily needs, and I specifically decided that the old Google Reader wasn't good enough.

This feels much more like a native app, rather than something that 1999 forgot. Form may not equal function, but it sure influences function.

</comment><comment><USER10> im sorry but: fuck everything about this.

google reader was the site where i've learned the most in the internet by sharing and reading other people's comments and notes. it was a truly content based social network

it was fun

it was great

it is gone

<comment><USER11> I totally disagree. The old social functions were totally opaque, irrational, and hard to control.

The new system allows you to share with select groups, or publicly, in a very granular way.

Just because you got used to an old, broken way of doing things doesn't mean that it was better. I can't believe the amount of collective bitching about this long-overdue overhaul.

<comment><USER10> > The old social functions were totally opaque, irrational, and hard to > control.

They were not. I've been using them (with a group of +100 people, almost of all of them "Computer Illiterate") for 4 to 5 years.

</comment></comment></comment><comment><USER4> They sacrificed usability to make a lot of GReader users use G+ begrudgingly. Now, instead of being able to see a nice feed counter for friends' shares, I would have to go to G+ in another tab to do what I was previously able to in the very same tab.

Reader integrating into G+? Why is this relationship not mutual?

Edit: And the concept of "+1" being to "give it your stamp of approval" does not exactly suit the majority of my shares...

For one, I shared a particular article called "New in Reader: a fresh design, and Google+ sharing".

</comment><comment><USER12> I dislike how there is no visual difference between read and unread items.

<comment><USER9> But there is a visual difference. Unread items have a bold title and a white background.

</comment></comment><comment><USER13> It's horrible...

Removal of sharing completely fucks up the workflow I use to send things to pinboard

<comment><USER14> Well, from Google's point of view, that is a feature :)

</comment></comment><comment><USER15> If for a few days I've been nervous that my free Apps account still does not have Google+, now I'm glad. Because that means, that I won't get new Google Reader, since it is useless (and probably won't work) without Google+.

Oh, wait. They could switch my reader to new version, and then it wouldn't work, because I don't have Google+. Oh. Waiting.

Or I'm just giving in to mass of people, who are not glad with the product, which is not yet shipped.

Update: I have new version of Reader. And no social stuff. <http://laacz.lv/tmp/oops-google-reader.png>. Sweet, Google...

</comment><comment><USER16> The New Google Reader is ugly and has fewer features. Hardly what I would call an upgrade.

</comment><comment><USER17> what is this all about, tablet and smartphone again? maybe this 20px space is more handy with phone, but i'm very confused about pc.

I can't use this with a laptop, can I?

<comment><USER18> The worst thing about these new designs is - they are LESS USABLE on Android tablet than before!

I wanted to write an article about how all the new interfaces (Google Groups, Google Docs, Google Translate) work LESS on Android tablet than the old ones, but I have no time for that.

Plus, I feel like I am the only person in the world with an Android tablet anyway.

<comment><USER3> why don't you just use the app?

<comment><USER18> Which app do you mean?

Plus, I personally dislike having a separate app for every second service, when I have a browser.

In an ideal world, that would be all I need.

<comment><USER3> I meant the Google Reader app: [https://market.android.com/details?id=com.google.android.app...](https://market.android.com/details?id=com.google.android.apps.reader&hl=en)

</comment></comment></comment></comment></comment><comment><USER19> Is there a way to get your old shared items back? I'm feeling a betrayed having all those interesting links and comments taken away from me.

<comment><USER20> You can get your shared items (and a few other things) as JSON here: <http://www.google.com/reader/settings?display=import>

This isn't very useful to the average user, but I'm sure any HN reader can handle this.

</comment></comment><comment><USER21> sigh. I'm now looking at <http://tt-rss.org/>

</comment><comment><USER22> ok nice looking and all but still not API T_T</comment>


Emerging web 2.0 design trends - <AUTHOR> http://www.boagworld.com/archives/2007/07/emerging_design_trends.html <comment><USER2> Emerging?

Anyways, some additional sources

[http://www.smashingmagazine.com/2006/09/03/webdesign- trends-...](http://www.smashingmagazine.com/2006/09/03/webdesign-trends- badges-tag-clouds-enormous-fonts/)

[http://www.cre8d-design.com/blog/2006/01/12/web-20-design- tr...](http://www.cre8d-design.com/blog/2006/01/12/web-20-design-trends/)

<http://www.digital-web.com/articles/web_2_for_designers/>

</comment><comment><USER3> Some interesting ideas here. Most of them I tried to implement in my blog when I redesigned it recently, but I had never considered having an optional third panel that disappears once the screen size decreases past a certain point.

Personally I think that focus on content is the most important aspect of design, so I'm glad that the article points it out, though I am loathe to refer to it as a 'trend'.

<comment><USER4> I looked at your blog, and I have to say that I have never seen a page resize like that ever before.

<comment><USER3> Well, thank you for keeping the comment neutral, I can go salvage my pride somewhere now. :)</comment></comment></comment>


OpenWrt in a WiFi card reader (2017) - <AUTHOR> https://phasenoise.livejournal.com/1500.html <comment><USER2> Reminds me of these SD cards running Linux

[https://hackaday.com/2016/06/30/transcend-wifi-sd-card- is-a-...](https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-tiny- linux-server/)

Edit also, there was picture frames at one point with bluetooth that ran linux that were hacked, I made a video years ago, funny to look back on

[https://www.youtube.com/watch?v=FEP0i1zteVM](https://www.youtube.com/watch?v=FEP0i1zteVM)

</comment><comment><USER3> In reference to the other discussion recently about whether there were still new big-endian machines being made...

[https://news.ycombinator.com/item?id=16187939](https://news.ycombinator.com/item?id=16187939)

....the SoC in this contains a Big-Endian MIPS core.

</comment><comment><USER4> If you want a small, USB-powered wifi device running OpenWRT, and you don't need the card reader, you might have a better time with a NEXX WT3020F[0].

[0] [http://www.dx.com/p/NEXX-WT3020F-Portable-Mini-300Mbps- Wirel...](http://www.dx.com/p/NEXX-WT3020F-Portable-Mini-300Mbps-Wireless- WiFi-Router-80211-bgn-Repeater-Bridge-with-USB-Flash-Drive-White-916493691)

</comment><comment><USER5> I use one of these running LEDE.

For the original porting work done on OpenWRT, check this link: [https://wiki.hackerspace.pl/projects:zsun-wifi-card- reader](https://wiki.hackerspace.pl/projects:zsun-wifi-card-reader)

For more recent work done to get up-to-date LEDE builds running on the device, check [https://forum.lede-project.org/t/supporting-zsun-wifi- card-r...](https://forum.lede-project.org/t/supporting-zsun-wifi-card- reader-16mb-flash-64mb-ram-ar9331/2142)

<comment><USER6> I heard LEDE and Openwrt just re-merged the other day.

<comment><USER5> That's true, but the port work described in this post is older (predating the fork of LEDE and OpenWRT), and the latest work regarding these zsun devices are more recent (but they haven't been upstreamed into LEDE, and so haven't been merged back into OpenWRT, either).

So the state of the art for these devices is a couple of months old LEDE builds.

</comment></comment></comment><comment><USER7> Awesome! And this device is even cheaper in China (59 RMB, or about 10 USD, including domestic shipping): [http://www.dwntme.com/h.Z0L1EYw](http://www.dwntme.com/h.Z0L1EYw)

<comment><USER8> it's only about 12 dollars on aliexpress to the US, with most of that being shipping.

<comment><USER9> The DX link has apparently dropped to $9.91

</comment></comment></comment><comment><USER10> > the hardware supports multiple simultaneous wireless interfaces!

This seems to be a somewhat rare feature... I might get one just to try this.

Does anyone know of other cards that support something like this? Is there a difference between being able to associate with multiple APs and being able to _host_ multiple APs (or some combination of both)?

</comment><comment><USER11> I've been trying to do this for a while, OpenWRT runs but the performance is sub-optimal, maybe it's just me or my impatience (or I got a flaky device) but it freezes a lot.

<comment><USER12> You might have a flaky device and/or configuration. Some chipsets and devices aren't as stable, but OpenWrt usually maintains a good compatibility list.

</comment></comment><comment><USER13> Then there is the vocore2; cheaper and not a repurposed consumer device.

</comment><comment><USER14> AliExpress link if someone wants it delivered in the US: [https://www.aliexpress.com/item/Smart-Expansion-ZSUN-Wifi- Ca...](https://www.aliexpress.com/item/Smart-Expansion-ZSUN-Wifi-Card-Reader- Wireless-Adapter-Support-2TB-TF-SD-Card-Wireless-Storage-For/32833243622.html)

</comment><comment><USER15> It seems like a very good alternative hardware for the same purposes as USB Armory, for a fraction of the price.

I wonder how soon a nice security-oriented package set will emerge. I suppose the USB interface should work as a USB-connected NIC, offering https / ssh / u2f access to the host on the card.

</comment><comment><USER16> The main issue would be the antenna. Wifi's wavelength is 12cm.

<comment><USER17> .. which means that a quarter-wave antenna is 3cm, which looks like the metal thing just visible at top right of the PCB extending behind it.

There are loads of devices with tiny WiFi antennae that work fine.

<comment><USER18> Correct, better photo: [https://www.hackup.net/wp-content/gallery/zsun- wifi-2/zsun13...](https://www.hackup.net/wp-content/gallery/zsun- wifi-2/zsun13.jpg)

</comment></comment></comment><comment><USER19> You could set up a little mesh network using them. Very cool.</comment>