Builders Build Startups. Recruiters Don't. - <AUTHOR> http://blog.underdog.io/post/83433492110/builders-build-startups-recruiters-dont

<comment><USER2> I hate when I get emails from recruiters that say "Looks like you're a great javascripter. We have this awesome front-end position for you." Though if they understood my github and linkedin accounts at all they'd see that everything is node.js, ruby, java, etc. If getting away from the "classic" form of recruiting would cut that down I'd be thrilled! And now as an employer I don't want someone spamming candidates on my behalf in such an annoying way as well.

<comment><USER3> That's exactly what we're saying (I am part of the team that works on underdog.io). The status quo is a complete mess.

</comment></comment><comment><USER4> Them's fighting words.

<comment><AUTHOR> What?</comment></comment>


Elon Musk Takes Customer Complaint on Twitter from Idea to Execution in 6 Days - <AUTHOR> http://www.inc.com/justin-bariso/elon-musk-takes-customer-complaint-on-twitter-from-idea-to-execution-in-6-days.html <comment><USER2> When they tried this with parents who were late picking up their children from daycare, it actually made them later - since now as long as they could afford it they didn't feel bad about paying.

Similarly, maybe those Tesla owners won't mind paying $0.40/minute for convenient parking.

[http://freakonomics.com/2013/10/23/what-makes-people-do- what...](http://freakonomics.com/2013/10/23/what-makes-people-do-what-they- do/)

</comment><comment><USER3> This article (which is now in the original story) says otherwise - [https://electrek.co/2017/01/09/tesla-feedback-loop-elon- musk...](https://electrek.co/2017/01/09/tesla-feedback-loop-elon-musk- complaint-twitter/)

</comment><comment><USER4> Kind of sounds like they had this in the pipeline, and rolled it out after the tweet. But hey, the tweet is a good way to turn this into a "Elon Musk is great at customer service" story rather than a "Tesla suddenly rolls out new fee" one.

</comment><comment><USER5> Previously: [https://news.ycombinator.com/item?id=13258882](https://news.ycombinator.com/item?id=13258882)</comment>


Do It Now  - <AUTHOR> http://www.stevepavlina.com/articles/do-it-now.htm

<comment><USER2> Before taking anything in this article literally, you should be aware this is the same guy who claims ghosts give him gambling advice:

 _Several people have asked if I'm still able to connect with my recently departed friend Ron who died in a car accident on August 14th. The answer is yes. He's been hanging around often. The connection is so strong that I don't have to meditate or anything. I just think of him and can instantly converse with him. I've never experienced such a strong connection before._

Seriously, read the whole thing[1], he claims his ghost friend helps him win at blackjack.

[1] [http://www.stevepavlina.com/blog/2008/08/can-spirits-help- yo...](http://www.stevepavlina.com/blog/2008/08/can-spirits-help-you-win-at- gambling-a-las-vegas-field-test/)

<comment><USER3> Sorry, but what does that have to do with the validity of the original post? So the guy talks to some imaginary being? Guess what, billions of other people do that too! It's called religion. Yeah, I admit it is kind of strange but that's a just an ad hominem attack. I actually found the article interesting.

<comment><USER2> It's beyond strange, it's credibility damaging. How can you trust anything written by a guy who claims dead people take up residence in water bottles?

 _Then Ron [his dead friend] says to me, "Put the water bottle back on the table. It makes it easier for me to see."

And wouldn't you know it? As soon as I return the bottle to the table, I start winning again — fast._

All I'm saying is this guy isn't a credible source. He makes fantastic claims with no evidence, and people should be aware of that.

<comment><USER4> I agree this guy comes off as a crackpot and that damages his credibility.

But you have to admit he is unusually self-aware for a crackpot:

 _If you haven't concluded by now that I'm totally nuts, this post should push you over the edge._

<comment><USER5> Most crackpots are quite aware of the public, and expert, opinion on their ideas and use that to strategically undermine criticism by acknowledging at upfront. Drawing attention to criticism lowers the chance that someone will be influenced by that criticism: "if the crackpot himself draws attention to the argument, surely it can't be any good?"

The fallacy here is that acknowledging some opinion exists in no way implies you have have seriously considered it; let alone have refuted it.

</comment></comment></comment></comment></comment><comment><USER6> The fact that this bogus story has 61 points and is on HN's coveted home page is just unbelievable. Are you kidding me!?

From Wikipedia:

 _Pavlina was a student at University of California, Berkeley in the early nineties. He performed extremely poorly in his studies, because he devoted his time to shoplifting. Pavlina claims he then went on to earn two degrees (computer science and math) from California State University, Northridge in three semesters (also incorporating advanced placement credits for courses he had taken in high school)._

1\. He's claiming this and it's never been proven, despite how easy it is to actually prove. If he truly did this and people didn't believe him, he can simply show proof. (if you read the post, just like he showed proof to the people that doubted how many classes he was taking).

2\. IF it is true, then it's widely fudged. The guy had APs and (bad apparently) college credit. This "3 semesters" claim is akin to someone going to school for a couple of years, accumulating a lot of credit, transferring to another school and graduating in 1.5 years. Seriously not that impressive.

\----

There are great blogs with successful students that went to extraordinary lengths in college. But this just isn't one of them. He also seems to be someone who got rich by talking about how to get rich; excuse me for not admiring that.

\---

Aside from all that, here's the really important point I came to HN to make: _instead of a 'do it now' attitude, don't rush it_ Seriously.

College is a few years of your life and an amazing experience. Our society has this issue of rushing things and making races out of events that weren't meant for that. This reminds me of Norvig's rant on books with titles like "Learn Advanced Java in 24 Hours".

Challenging oneself with more classes in college is one thing; taking so much that you couldn't possibly retain such knowledge is another. Slow down, concentrate, and actually learn the material. College isn't a race; it's a journey. I say make the most of it.

Take that rant however you want. As a recent college-dropout (start of 4th year), a lot of the celebrated and arbitrary things in college (from how many classes you're taking to how many majors you're studying to how fast you're finishing college) just don't seem that interesting 99% of the time.

</comment><comment><USER7> I have to agree that my best semesters in college were the ones that I overcommitted myself (22-23 credits). I actually found the lack of downtime a way to stay focused and move from one project to the next. Likewise, my worst performing semesters were the ones where I only attempted 12 credits. I would find that having large breaks of time would cause me to get comfortable wasting time and then it would take moving a mountain to get me back into the groove.

During my 2 semesters of intense credits, I was able to have a social life too, but that consisted of eating with classmates during our study sessions and spending several hours in the library.

The only thing I regret from that experience was that I didn't challenge myself sooner.

</comment><comment> wes-exp As soon as I read his tale of accomplishing seemingly impossible feats, I figured he must be selling something.

Scrolled to the bottom of the page, and sure enough, it is so.

<comment><USER8> Your point is...? You don't agree with selling things for money? His story is untrue because of unrelated fact X?

<comment> wes-exp I guess my point is that when a story sounds too good to be true, you have to consider the source.

</comment></comment></comment><comment><USER9> Despite the questionability of this guy's reputation and the outlandishness of some of his claims, this is actually a decent article about time management. I've worked with a lot of people in both academia and startup land who would do well to read this. Here are my thoughts on some of his best points.

 _"Every activity has an opportunity cost."_

I'm dumbfounded by the number of entrepreneurs and engineers I run into who don't understand the concept of opportunity cost. If you aren't consciously aware that every month you spend doing X is a month you _didn't_ spend doing Y, then you're going to be very inefficient. A startup is a race against the clock (your diminishing bank account), so inefficiency can mean death.

 _"Work all the time you work."_

One of the unofficial mottos of MIT was "work hard, play hard". In other words, when you're working, _work_ , and when you're not, _don't_. The most miserable students were those who attempted to study while hanging out, watching movies, etc. They'd spend entire days in a half-work half-play state, which of course results in _no_ work getting done, and less-than-satisfactory entertainment as well. I should know -- that was me for a year. There are some pretty good techniques for breaking this habit, but first you have to be consciously aware that you actually have this problem.

 _"People who succeed also fail a great deal."_

This is cliche, I know. But it's some of the most misunderstood advice of all time. People only think of it on a macro level, because the examples are always of the form, "Person X failed at starting 3 companies before he created SuperSuccessfulMegaCorp!" But I think it's more important to understand this advice on a micro level. For example, I used to be an incredibly shitty web designer, but now I'd say I'm pretty good at it. What changed?

When I first started, I would make a design, it would suck, and I'd say, "I suck." Then I would release my shitty design and move on to something else. Nowadays when I make a design, it still sucks... but instead of releasing it, I start tinkering with it. It continues to suck. I fail for hours and hours. At some point, I usually lose confidence in myself. But I keep working and, on a consistent basis, I always manage to "stumble upon" a great-looking design. So learning to fail is, in essence, learning to be a perfectionist. I think this is a useful skill for any creative profession (writing, coding, designing, etc).

</comment><comment><USER10> My experience is honestly the opposite. I found my best semesters were when I narrowed the number of courses I had down. I focused on doing a few things very well and it worked out.

I also wonder how the author handled pre-requisites. During the third semester wouldn't he be taking courses like linear algebra, differential equations, compilers and artificial intelligence at the same time? I am quite impressed that someone can absorb all that course material while working a 40-hour a week job.

</comment><comment><USER11> Useful insight, among others in this article:

"I believe that the real purpose of planning is simply so that you remain convinced that a possible path exists."

This guy is crazy, but in the awesome kind of way.

</comment><comment><USER12> Isn't this the same guy that started the polyphasic sleep fiasco?

<comment><USER13> Same guy that says ghosts helped him win at gambling.

Same guy that wanted an open relationship.

Same guy that sells talks to get rich but got rich selling talks.

The guy is poison.

</comment></comment><comment><USER14> How I wish Universities here didn't enforce 75% minimum attendance...

</comment><comment><USER15> This man is now my hero.

Seriously though, I'm graduating a year early with a single B.S. (mathematics) and I thought I was doing well -- but I'm not much more busy than an average student (mathematics has low credit requirement).

I'm tempted to try to slam through the requirements super fast now -- especially since, as a regular student, I only have about two hours of homework a week.

However, my college has various requirements (e.g. so-called colloquium, a thesis, a "comprehensive" course) that are only offered at specific intervals. It's designed to allow graduation in four years. I wonder if this is a relatively new phenomenon?

edit: after a little research I see that I would end up paying about the same amount even if I cut off an extra semester, since my college charges $875 per credit over 24 a semester -- I would be taking about 30. Since it doesn't save me much money, I don't see the point. That idea ended quickly.

<comment><USER16> Two hours of homework a week? My God. I had more than 2 hours of homework per day per class when I was in college -- 7 days a week! I also majored in math. Amazing what a difference the school one attends can make, apparently.

<comment><USER17> It also depends on how much time you're willing to spend on homework. Several of my CS classes have conducted surveys on how long homework take; in every case, there was a significant spread with a long tail (some people spent 10+ hours on what took others 1).

</comment></comment></comment><comment><USER18> For serious college advice I would highly recommend Cal Newport's blog Study Hacks. He is currently a postdoc at MIT and has three books on high- school/college advice published.

The blog has a wealth of information: <http://calnewport.com/blog/>

<comment><USER19> You are a hero among men.

</comment></comment><comment><USER20> 2 degrees, 3 semesters, _and_ a fulltime job? Sorry, but it's impossible combination. The possible ones are: 1 degree, 4 semesters, full time job (because some obligatory courses are only in summer or winter), 2 degrees, 6 semesters, half time job or 2 degrees, 5 semesters, no job. Currently I'm doing a 2 degrees, 6 semesters, no job -- graduating from CS in regular time and from Math one year early, and while I work like crazy, I think that if I planned better, I could have passed all required courses by the end of this semester. But even now, I have 2.5 times as much weekly courses than people pursuing a single degree in a regular way. Cutting the time required for me in _half_ , _while_ having full time job in last semester, is completely insane.

</comment><comment><USER21> I'm quite new to Steve Pavlina writings. So I've checked with Wikipedia to get an idea on his claims.

He already got college credits from high school and studying at Berkeley, this important detail is nowhere found in the article.

I've also found that most of the advice sounds great but is hard to impossible to apply.

He appears to be exceptionally clever but a term paper on math and engineering problems are not written with a 12h marathon on the weekend, at least not on my university.

Can anyone recommend serious advice?

<comment><USER22> Check out my buddy Scott H Young's site (ScottHYoung dot com) for some serious, and tested, study hacking.

He's currently doing a year-long experiment where he's attempting to complete a 4-year MIT Computer Science course in 12 months.

<comment><USER23> Oh, pfft. I looked him up and he doesn't even go to MIT. Anyone can cover the freely available material in a year if they did nothing else. However their level of retention would be ridiculously low. Testing would prove this but self study conveniently lacks this.

<comment><USER22> Actually, he's taking full MIT exams to test himself.

</comment></comment></comment></comment><comment><USER24> While I'm in awe, for some reason the math doesn't seem to work. For example, in the last term he claims 8 hours/day of classes (13 hours on Thursday), plus a 40hr/week job, plus 30 minutes/day of running. Then there's transit time to/from work and classes, and eating - no fast food since he became a lacto- ovo vegetarian: shopping and food prep for a specialized diet like that must have been time consuming.

Still it's one of those "if it's 80% true it's still amazing" stories.

</comment><comment><USER25> Utter bullshit. I can't think of a single university that would even offer its full curriculum of courses necessary to graduate in 3 semesters without conflicts.

</comment><comment><USER26> Like he said, you need to know what your goal is. College wasn't just about the degree for me. I'm glad I didn't try to rush it.

</comment><comment><USER27> You know, on occasion this news site walks a fine line between actual motivation and the kind of platitudes and motivational rhetoric you'd expect from a minor cult. Seriously, here's a quote from the article:

"Understand that failure is not the opposite of success. Failure is an essential part of success. Once you succeed, no one will remember your failures anyway."

Thank you, oh pyramidal guru of total bullshit.

<comment><USER28> Do you know how many failed pitches and pilots are behind every TV show you've ever watched? How many awful first novels are hidden behind the good ones? How many bad drawings every artist produced on the way from being "that kid who likes to draw" to "a master"?

You do, indeed, have to fail a lot on the way to success, unless you get very very very lucky.</comment></comment>


Twitter's Ad Crackdown Alienates Developers… Again (w/ HN Quotes) - <AUTHOR> http://mashable.com/2010/05/24/twitter-ad-ban/ <comment><USER2> Why do they have to link back to us...

<comment><AUTHOR> It's the journalistic requirement to attribute quotes/opinions.</comment></comment>


Accurate and Infinite Prime Prediction from Novel Quasi-Prime Analytical - <AUTHOR> https://arxiv.org/abs/1903.08570 <comment><USER2> What does HN community think of this? Real?</comment>


How to choose a domain name - <AUTHOR> http://swombat.com/2011/4/14/domain-names <comment><USER2> Domain name choosing advice from "swombat.com"?

Quite a good summary piece nonetheless.

<comment><USER3> Hey, what's wrong with swombat? ;-)

Anyway, as I say in the article, the domain must be appropriate to the audience. If you were building a SaaS startup, daringfireball.net would probably be a terrible domain name.

<comment><USER4> ok, can you help me understand what kind of appropriate audience is for "swombat" ?

<comment><USER5> Swombat's his handle and the site is essentially a blog. It doesn't strike me as odd that his domain is the same as his username.

One might argue that the appropriate audience is HN, given that swombat is active around here and a lot of people recognize his handle.

</comment></comment></comment></comment><comment><USER6> The "rules" for a good domain are not hard - eg, not exhaustive and in no particular order:

\- pronounceable,

\- memorable

\- spellable (by a muppet)

\- contextual (eg somewhat related to you or your product)

The hard part is coming up with a domain name that meets those rules and is not already taken. This gets harder every day.

My particular bugbear of late is the (mostly) recent trend towards .co (columbia) names for those that missed out on the .com name they wanted. Just means if you want to catch this traffic you need to register yet another duplicate name for your site!

</comment><comment><USER7> I find that 2 syllables is also extremely memorable. Just think how many companies don't use two syllables and imagine how memorable they are. There is a reason why many names don't go over just two.

<comment><USER8> I'm skeptical. I don't really see anything inherently less memorable about Blackwater, Microsoft, or Coca-Cola than Pepsi, Apple, or Dropbox.

<comment><USER9> Over two syllables, not under two.

</comment></comment></comment><comment><USER10> Remember when eBay launched their would-be "Craigslist killer" and called it Kijiji? _That_ was a bad domain name.

</comment><comment><USER11> Make sure it isn't a US controlled name.

</comment><comment><USER12> granttree is a pretty bad name IMHO. I doubt non-native english speakers can understand it. Probably wouldn't pass the phone test. Biggest problem is the double T (and you don't own grantree.co.uk to catch that).

<comment><USER3> We do own grantree.co.uk, and so long as you enunciate properly (grANT-Tree) people can hear it fine, in our experience. The key is to emphasize the ANT and separate it from the next T. Otherwise people sometimes hear Grunt-ree or something.

<comment><USER13> Doesn't this confusion alone make it a bad name?

<comment><USER3> It's worth the positive associations of the name, imho. Everyone "gets" GrantTree and likes it.

</comment></comment></comment></comment><comment><USER14> Take a look at these good (or successful) domains:

yahoo google facebook ...

Pattern? "dboule o"! :)</comment>


Show HN: WinMerge for synching SQL Servers to version-controlled scripts - <AUTHOR> http://servantt.com/?hn <comment><AUTHOR> Servantt is the WinMerge for comparing SQL Server Databases to Version- Controlled Scripts.

It allows you to:

      - Reverse-engineer your Database objects into a standard
        and logical structure in file system
      - Compare Database objects to the Scripts folder
      - Differences can be either applied to the Database (updating objects)
        or to the Scripts.
      - In a single click you can launch WinMerge
        and easily compare the Scripts to the Database

It supports and encourages best-practices in software development:

      - Keeping Database objects under version-control
      - Removing access rights from developers
        on production environments
      - DBA review of changes in procedures/views for performance
        bottlenecks and naming standards
      - Naming objects using fully qualified identifiers
        and correct delimiters

Any suggestions (or criticisms) are welcome.</comment>


Amazon Asked by States to Produce Data on Worker Safety, Deaths - <AUTHOR> https://www.bloomberg.com/news/articles/2020-05-12/amazon-asked-by-states-to-produce-data-on-worker-safety-deaths <comment><AUTHOR> 'Amazon.com Inc. is being asked by several U.S. states to provide information about health and safety measures following the death of a number of workers from coronavirus-related illnesses.

'Led by Massachusetts Attorney General Maura Healey, 13 states on Tuesday sent a letter to the company expressing concern about recent media reports of "inadequate safety measures and sick leave policies, insufficient data about infections and deaths among their workers, and retaliation against workers who call attention to unsafe workplace conditions."

'The states ask Amazon and its Whole Foods subsidiary to provide details of health and safety measures they have adopted, compliance with state paid sick leave laws and data about worker infections and deaths. The same states sent a letter to Amazon in March urging it to improve its sick leave policies.'</comment>


Show HN: Eul – a lightweight native desktop client for Slack, Skype, Facebook - alex-e https://eul.im/home?hn <comment> alex-e Hi,

eul is a very lightweight and fast native desktop client for Skype, Slack, Gmail, HipChat, VK, Facebook, Jabber, Telegram, and Signal. Right now only the first four are supported, and the rest should be done by the end of September.

Why did I create this? To solve two big problems I see with the current IM solutions: there are too many of them, and the clients are ridiculously bloated for what they are built to do. For example, everyone knows what a huge resource hog the Skype client is. Even the Telegram client, which is supposed to be lightweight, is using 1.3 GB of RAM on my desktop right now.

I'm obsessed with performance. The entire application is about 4 MB, and it's never going to be more than 10 MB. In fact there are still many things to optimize. It's native, so you don't need to download a 100 MB browser just to use your IM client. eul can display thousands of messages in one conversation without the constant page fetching. The scrolling is instant and smooth. You can jump to any message without waiting. I've tested it with 50 000 messages in one chat. No lags, instant scrolling to any point, instant search. That should be enough for most :)

This is a beta release. Some essential features are still missing (for example, images and other attachments are not supported yet). Automatic updates will be released every day. There's a built in contact form, please use it to submit bugs and suggestions.

Looking forward to your feedback.

Thanks

</comment><comment><AUTHOR> I will try it thank you, The optimisation of performance is important for me too. Are you planning Line integration?

<comment> alex-e The more services the better. But not right now.</comment></comment>


Take the Great British Intelligence Test: How Clever Are You? - <AUTHOR> https://www.bbc.co.uk/news/health-50896542 <comment><AUTHOR> "Clever" has different meanings in British and American usage. In the US it describes a particular ability to solve tricky problems and come up with innovative solutions, whereas in the UK it describes more general overall intelligence.

</comment><comment><USER2> Just took this test, a little hungover from last night. Did awfully in some areas, particularly memory and emotional recognition. But I got in the top 5% for the last challenge (mental rotation). It seems very easy to "game" that test, by picking out particular features (for example, spotting green, blue and black squares lined up) and then matching them to the possible answers. In most cases there was only one match. As such, I didn't really have to do any mental rotation at all.</comment>


DoH Privacy Enhancement: Do Not Set the User-Agent Header for DoH Requests - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=1543201#c4 <comment><USER2> I don't see a benefit of the built in DoH in firefox since it is shifting the trust from my existing DNS provider to cloudflare[1] (based in the US).

Today I discovered that I couldn't just kill the disqus.com requests with my usual method by sink-holing them in /etc/hosts because for some reason firefox ignored the /etc/hosts file. While Chrome seemed to work fine and local dig requests also returned

      disqus.com.  0 IN A 0.0.0.0

I was left dumbstruck.

I was able to override this in the about:config as described in [1].

I really don't like how mozilla ignors what is defined in /etc/nsswitsch.conf because this breaks all the blacklisting rules a user had set up themselves. At least they should have produced a huge warning telling users that this ignores any local blacklists that are in place.

[1] [https://ungleich.ch/en-us/cms/blog/2019/09/11/turn-off- doh-f...](https://ungleich.ch/en-us/cms/blog/2019/09/11/turn-off-doh-firefox/)

<comment><USER3> Firefox is doing the correct thing here. Firefox cannot read /etc/hosts without breaking some applications since NSS is a series of black-box modules that Firefox can't assume work any particular way. There's nothing special about /etc/hosts on a modern Linux system.

The files module on your system could read /etc/dns or the blarg module could read /etc/hosts but in JSON format.

The thing you're annoyed about is that Firefox _with DoH enabled_ doesn't use NSS at all when performing requests but there is absolutely no way that Firefox can do both -- it either can send requests through the NSS gauntlet and use whatever it returns or not use it at all -- "respecting /etc/nsswitch.conf" is impossible to do correctly.

Linux systems don't provide the right facilities to supplement application level DNS in the way you want. If you want to do DNS in your app you must ignore libc DNS.

<comment><USER4> Firefox should not be ignoring libc DNS without prompting.

</comment></comment></comment><comment><USER5> I'm glad this happened. I feel like it is one of those "if you don't do it now, you won't be able to do it later." As more DoH implementations spring up, at least one of them will require the User-Agent for no reason.

Plus it is useless, may allow hacky discrimination, and wastes bytes.

<comment><USER6> I wonder if the best approach might be to specify the precise request format required for DoH and actively deny requests with extra information.

'Thou shalt provide exactly this, no more and no less'

Depends on whether we want to consider later 'improvements' to be silent extensions or an entirely new protocol version. Given how easily abused HTTP headers have been in the past, might be worth the inertia to limit extensibility by design in order to limit MITM tracking.

But MITM middleboxes will of course start to rely on that...

I suppose that if TLS is broken for this part of the system you're rather screwed anyway, but defence in depth is always worth considering.

<comment><USER7> What's the point of using HTTP for DNS if you aren't going to use its abilities?

<comment><USER5> Its raison d'être is largely to mitigate the issues that limited DoT's (DNS over TLS) widespread adoption, specifically "Middlebox Bypass."

Meaning if you connect to a public WiFi network, many will only allow captive DNS and block other protocols including DoT. DoH is difficult to distinguish from other HTTPS traffic and is more likely to successfully resolve (since they cannot block HTTPS and still be useful).

Therefore you've created a secure, flexible, and reliable DNS replacement with only mild technical downsides on modern hardware (a lot of the complaints are ideological or relate to specific incompatibilities with existing solutions like the lack of HOSTS file support in the initial offerings).

So I guess, everything I just said is "the point." Rather than trying to use every single possible combination of HTTP headers.

<comment><USER8> DoH as a protocol has no issues with HOSTS files. The issue is browsers implementing DoH instead of operating systems. If browsers stayed in their lane, and let operating systems implement DoH, compliant with corporate IT design and systems like the HOSTS file, everything would be fine.

Microsoft has already committed to implement DoH in Windows itself. Browsers just need to stop trying to be their own DNS clients.

<comment><USER9> Mozilla's operating system bombed horribly, so the only leverage they have is with the browser.

<comment><USER8> Why is a browser developer trying to apply "leverage"? In that, we've already located the problem.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> To save everyone else from googling, DoH is DNS over HTTPS.

<comment><USER11> Not to be confused with DNS over TLS (DoT)

</comment></comment><comment><USER12> I feel like User-Agent in general is not well suited to the modern web. Most browsers pretend to be some version of Mozilla or Netscape. And most things that scrape sites like Apple's messaging app pretend to be something equally outdated. Deprecating User-Agent seems like the best course of action in the long run.

<comment><USER13> I'd be OK with getting rid of User-Agent if some kind of "capabilities supported" header were added. Something like

      Agent-Capabilities: 1; 97464bde5d94a54f6e199309489a4b60

where the 97464bde5d94a54f6e199309489a4b60 is a set of bit flags in hex, each representing some feature, and the 1 before the semicolon is a version number for the bit definitions. The assignment of these flags would have to be standardized. When new versions of HTML, CSS, or JavaScript are standardized, that would include assigning bits for their new features, and bumping the bit definition version number.

You might say that it is better to do run-time checks on the client for features you want, and have the client then load workarounds if necessary for missing features, and that indeed is a good way to go in many cases (maybe even most cases).

That method, though, only works going forward. Sometimes I want to know what capabilities past visitors to my site have had. For example, I'm going to be redoing some pages at work and want to know if I can require certain CSS and JavaScript and HTML features.

I could make a list of the features I want to use, add some JavaScript to those pages to test for those, and send the results back to the server...and then I'd have to wait weeks or months or longer to get a good idea of what the consequences would be of requiring those features.

With User-Agent strings, all I had to do was pull up the site logs. Our shopping cart logs the User-Agent string, and page flow through the cart. It was an easy matter to pull up the last 18 months of those logs, and write a script to find all the successful orders and make a table showing how many there were for each browser. (I limited it to successful orders, because those would almost certainly all be real people in regular browsers that are reasonably honest about the User-Agents). I could then look up the features I was interested in on [https://caniuse.com/](https://caniuse.com/) and see which of the features were not on browsers that we still get significant traffic through.

Dropping User-Agent without adding something to allow that kind of analysis, such as Agent-Capabilities, would be very annoying.

</comment></comment><comment><USER14> The Cloudflare TRR endpoint is mapped to a subdomain that indicates the user agent, i.e., browser, was distributed by Mozilla: mozilla.cloudflare-dns.com. The IP address for the subdomain is the same as for cloudflare-dns.com. Would this subdomain be leaked in SNI.^1 Presumably it serves to enable someone, maybe Cloudflare, to track queries as coming from Firefox.

Will the endpoints for other TRRs have special subdomains.

Perhaps another "privacy enhancement" would be to avoid using a browser- specific subdomain.

1\. ESNI is still experimental and if I am not mistaken it is disabled by default in Firefox.

<comment><USER15> That's still better than sending the entire UA, though, which includes OS and browser version numbers.

</comment></comment><comment><USER16> Just curious, would your employers let you use DoH? I was told to stop using it.

<comment><USER17> Employers are typically not afraid of the protocol, but afraid of not being able to control it. Companies can run their own filtered DoH just like they can with DNS.

</comment></comment><comment><USER18> > Instead of setting it to an arbitrary string it would be great if the UA > header was not set at all.

Didn't someone post his experience getting more expensive flights because he used a Mac?

Yes! Please, take UA out.

<comment><USER19> Are we sure this wasn't a session cookie that just happened to pick experiment A or experiment B?

The user agent isn't very important. What we should start being worried about is that ISPs are now offering API access that maps your IP address to your phone number and demographic information. (Verizon does this right now, but you can opt out in your account settings.)

Maybe all those VPN providers have a point. Delete the user agent, share an IP with thousands of people, and maybe you can browse in peace.

<comment><USER20> Then you get stuck in ReCaptcha hell because you are not "human".

</comment></comment></comment><comment><USER21> It's all bout money encapsulated by "security" marketing buzzword. Yes, DoH is an improvement over old plaintext UDP DNS. But why should I used a nobody service over Cloudflare or Google that update their databases within seconds all over the world and rarely if ever faced a downtime?

<comment><AUTHOR> > It's all bout money encapsulated by "security" marketing buzzword. Yes, DoH > is an improvement over old plaintext UDP DNS. But why should I used a nobody > service over Cloudflare or Google that update their databases within seconds > all over the world and rarely if ever faced a downtime?

It is not so straightforward as always being an improvement. For example, a user can be uniquely identified through session resumption session ID whereas with plaintext UDP behind a firewall with many others doing lookups unique identification of a user can be close to impossible.

<comment><USER21> Yes, that's a one more reason to trust Cloudflare and Google over a nobody service since their motives with their free DNS services (including DoH and DNS over TLS) relate more to having up-to-date synchronization, load balancing, etc.. with the servers they host themselves. Spying on users via DNS queries by Cloudflare or Google is kind of a joke that can bait only the ignorant. Cloudflare terminates TLS connections and even issues TLS certs and can "theoretically" see every sensitive data that can compromise both businesses and users and yet they are trusted by countless public companies and startups alike. The same thing if not more for Google for their own ervices or their GCP business.

</comment></comment></comment><comment><USER22> What if there's a bug in Mozilla's implementation at some point and DoH servers have to return a slightly different response for certain versions of Firefox? How will they achieve that?

<comment><USER23> Then Mozilla need to fix their implementation. If the client is bugged you don't fix the bug in the server.

<comment><USER22> Welcome to the real world.</comment></comment></comment>


Building Your Own WotsApp Using SwiftUI, Combine, Notifications, CloudKit - <AUTHOR> https://medium.com/better-programming/building-your-own-wotsapp-part-7-47b9b66b3db4 <comment><USER2> Somethings up with your code indentation, you might want to fix it.</comment>


World's Oldest Fossils Now Appear to Be Squished Rocks - <AUTHOR> https://www.quantamagazine.org/worlds-oldest-fossils-now-appear-to-be-squished-rocks-20181022/ <comment><USER2> Url changed from [http://nautil.us/blog/worlds-oldest-fossils-now-appear-to- be...](http://nautil.us/blog/worlds-oldest-fossils-now-appear-to-be-squished- rocks), which points to this.

</comment><comment><USER3> That sure was a lot of words to once again raise the question, "Why hasn't the LHC found what we thought it would?" And I never did get to the point, if there even was any, that the headline about squished rocks led me to click.

The article kind of answers itself, when it talks about dark matter. It's a placeholder for what we don't know. We work off what we do know, and have confirmed through scientific rigor. From this, we have math models that show us where we think things should be. But we haven't found them. And we keep beating our heads into the wall that the LHC hasn't found them, so who do we blame?

I just feel like it doesn't work that way. Eureka moments and scientific breakthroughs have never been a product of budget and man hours. You have a question, you do your research, you come with your answer based on your information, and you test. And with a machine the scale of the LHC, tests aren't as simple as a baking soda volcano in your kitchen. And with the kind of questions we're asking, maybe the LHC isn't the machine that will find the answers, no matter how many people we throw at it and particles we shoot through it.

So, from my (completely amateur and unqualified) understanding, either the question we're asking is wrong, the methods and devices of the test are flawed, or the hypothesis itself is wrong and no one wants to accept what that means to particle physics.

But even if the only thing that comes out of the LHC is confirmation and understanding of the Higgs, that's more than plenty enough to satisfy me. I'm just so exhausted by all of these articles railing against the LHC. I get it, you're mad at progress in the scientific community, but don't take it out on the equipment. It's done more than well enough, so far.

<comment><USER2> The article is quite informative about the ongoing work on fossils and (unless I missed it?) doesn't mention the LHC, so this comment seems somehow off topic.

Edit: ah, I think I see. There was an article about the LHC underneath the fossil article on the originally submitted page ([http://nautil.us/blog/worlds-oldest-fossils-now-appear-to- be...](http://nautil.us/blog/worlds-oldest-fossils-now-appear-to-be-squished- rocks)).

<comment><USER3> Well that explains it. I wanted exciting new news in the world of squashed rocks, dammit.</comment></comment></comment>


Occupy LA arrest experience by Family Guy writer - <AUTHOR> http://myoccupylaarrest.blogspot.com/

<comment><USER2> Last I checked the Dep of Homeland Security was teaching the police how to "deal" with the protesters. So there you go. The police has also become very militarized in the last few years, which is probably one of the fundamental reasons why the police reacts like this against their own non-violent citizens, too. In their minds these citizens are the "enemy".

</comment><comment><USER3> The Exiled had a writer arrested too, who ironically fled Soviet Russia to avoid being detained as a subversive: [http://exiledonline.com/alert-exiled- editor-yasha-levine-arr...](http://exiledonline.com/alert-exiled-editor-yasha- levine-arrested-jailed-during-police-attack-on-occupy-la/)

</comment><comment><USER4> so... why didn't they leave when asked too? They had plenty of opportunity over the last couple weeks to obey the law.

why do they think they have the right to deny access to people who don't want to be involved with the OWS people?

why do they think they have the right to tear up a public space?

why do they think they don't have to obey the laws?

why do you support these do nothing idiots?

<comment><USER3> "why do you support these do nothing idiots?"

You don't need to agree with the Occupy movement to think that the indiscriminate use of chemical weapons, violent detention and militarized tactics against US citizens exercising their right to free assembly is outright wrong and sets a disturbing precedent.

</comment></comment><comment><USER5> Eazy-E was right: <http://www.youtube.com/watch?v=UfMXROZ9qvo>

</comment><comment><USER6> The time has come when people will start shooting cops.</comment>


Oracle is reportedly in talks to buy TikTok's US business - <AUTHOR> https://www.theverge.com/2020/8/18/21373225/oracle-tiktok-us-business-acquisition-ellison-trump <comment><USER2> Oracle is the definition of evil. Period.

</comment><comment><USER3> Is Oracle the executioner in the IT world?

</comment><comment><USER4> Oracle, the kiss of death....</comment>


Square to Investors: $1 Billion Valuation? Make It $2 Billion. - <AUTHOR> http://techcrunch.com/2011/06/17/square-to-investors-1-billion-valuation-thats-so-last-week-make-it-2-billion/ Getting frothy! <comment><USER2> It's strange to me that you're not a "big deal" anymore unless you have a valuation in the Billions of dollars.

Not saying square isn't valuable (they're my favorite new company, and the one that I think will go the farthest), just making an observation.

<comment><USER3> Perceptions (and valuations) have shifted a lot in recent years, and, as the article points out, the "Billion dollar club" is getting crowded.

YouTube was bought for $1.6B after all. That was a _huge_ deal then. When Zuckerberg refused the $1B offer from Yahoo!, that was also a pretty big deal. Now we see a few young companies at these valuations, so, the perception is different.

<comment><USER4> You might ask, what objectively changed since those days when $1B was considered a huge deal? If not a lot, then we're in a bubble.

<comment><USER5> Much of the new billion dollar club is special in that it actually has the kind of revenue and revenue growth to at least sort of justify the valuation. It sounds like Airbnb, Dropbox, and Square have serious profits with trends suggesting that they'll be even bigger soon. These startups look more like PayPal, which was a 1.5B acquisition where Ebay totally and unsurprisingly got their money's worth, rather than a social site with no revenue. (Did YouTube have any revenue when they were bought? And I think Facebook had ads, but they were still losing money fast when they were offered 1B.)

Even though it's looking like YouTube will pan out for Google, it's a lot more obvious that Square has the potential to be worth billions than that YouTube did.

</comment></comment></comment></comment><comment><USER6> The sad reality is that if it wasn't Dorsey behind this it would have to prove itself like any other business.

My guess is that you haven't solved payment if you have to get additional hardware. and even if that get solved what is to hinder Apple and Google from offering it natively which it should be.

<comment><USER7> Did you see Card Case? No hardware, apart from your mobile phone required: <http://squareup.com/cardcase>

</comment></comment><comment><USER8> Now Square just has to figure out a way to disrupt the market for ATM machines in "Cash Only" businesses. There are dozens of local business in Square's own San Francisco that, even given a novel payment solution like Square, refuse to accept credit cards and opt instead to host on-premise ATM machines.

</comment><comment><USER9> Many of these deals may have special terms as well. At a minimum VCs will get 1x and at times 2x or 3x of the first money made. That way, VCs can protect their downside while investing in some of the companies that have the biggest potential.

That being said, these valuations are still quite high.

</comment><comment><USER10> about that bubble ...

<comment><USER11> Normally I'd agree. Spotify for $1B? Jesus.

But, assuming you believe Square can pull off what they're trying to pull off... a billion-dollar valuation is not hard to justify. I mean, these guys could be bigger than PayPal, all things executed correctly that is.

<comment><USER10> Agreed, there's huge potential upside if it all goes well. PayPal was acquired for $1.5B. A $2B for Square (at its very early stage, with a part-time CEO) seems pretty bubblicious to me.

<comment><USER12> I would have to disagree with the comparison of PayPal and Square. I find that there are similarities, but there are much more profits to be found in enabling businesses to bypass the hardship of being able to process cards (which can be both time consuming and costly). I think the valuation of Square to be reasonable, considering that in that they are early-stage and are already processing three million dollars per day (which is increasing). Though the valuation of Spotify at one billion dollars is just plain ridiculous.

</comment></comment></comment></comment><comment><USER13> This is pretty ridiculous given that Square's market is a tiny fraction of retail, its distribution model is expensive, and it doesn't solve any of the problems with the payment industry. Granted, I'm a competitor, but $2 billion? Even $1 billion is absurd.

Sigh.

<comment><USER14> You do realize "retail" is a multi-trillion dollar segment, right?

<comment><USER13> Yes. That's why I'm in it covering the 99.99% of cases that Square's 0.01% solution misses.

<comment><USER15> Investors aren't looking at what Square's offering now; they're looking at what Square can reasonably offer in the future, soon enough that their investment is "worth it". Square may only address 0.01% of the market now, but they might have a realistic plan for addressing 0.1% or 1% or 10% of the market, making them a billion to multi-billion dollar company.

If Square is able to convince investors that they've got mass market appeal then they can justify a multi-billion dollar valuation. Considering Visa invested an undisclosed amount in Square, they may actually have reason to command such a large valuation.

</comment></comment></comment></comment><comment><USER16> I think techcrunch writers are following the "AOL Way" of writing articles. (Although the occurrence of 5 foursquare articles in a day has stopped recently) I guess they're under pressure to sell their massively overpriced/slightly useful conference.

Jack Dorsey pantless in Paris? Who knew.</comment>


For Startups, Perspective is Crucial - <AUTHOR> http://www.markevans.ca/2013/10/15/perspective/ <comment><USER2> Really helpful comments. Thanks.</comment>


Ubuntu 9.04 includes native ARM port - <AUTHOR> http://www.geek.com/articles/mobile/ubuntu-904-due-april-23-include-native-arm-port-20090414/ <comment><USER2> Here's instructions on how to run it on an ARM beagleboard:

<http://elinux.org/BeagleBoardUbuntu>

<http://beagleboard.org/>

</comment><comment><USER3> To give a good idea of ARM performance in practical situations (so you know what to expect), the resident ffmpeg ARM guru did benches with Cortex A8 and A9 for H.264 decoding without assembly optimizations.

With a Core 2 reference at 1.0, a Pentium 4 at 0.38 in terms of performance per clock. The Cortex A8 is 0.28 and the Cortex A9 is 0.4. The difference there is mostly the out-of-order execution added in the A9.

</comment><comment><USER4> Can anyone point to some more info on this? I was excited to hear about it when it was first announced but it seems to have gone awfully quiet.

Are the ARM developers just not big bloggers? It seems there's a fair amount of work in bringing up a distro to target the various ARM hardware out there so it would be good to hear an overview from someone in the know.

</comment><comment><USER5> I'd be interested if it would run on my slug/NSLU2, though I suspect the RAM requirements are a bit too much...

edit: I take that back: <https://wiki.edubuntu.org/ARM/NSLU2>

</comment><comment><USER6> I eagerly anticipate the first port of Ubuntu to the iPhone.

</comment><comment><USER7> This is exciting as a disruption of the 86 series CPU (Intel Pentium etc).</comment>


Free Movies Online: Great Classics, Indies, Noir, Westerns, etc - <AUTHOR> http://www.openculture.com/freemoviesonline <comment><USER2> As an alternative you can also use [https://www.justwatch.com/us/movies?monetization_types=free,...](https://www.justwatch.com/us/movies?monetization_types=free,ads) and find a lot of free and legal content in a nice to browse interface.

Disclaimer: I work there

<comment><USER3> Except for viewers residing outside of the US.

Edit: Ok, I used dewey's link above which doesn't make it obvious you can change the country you're viewing from and then be presented with content for the UK. So for the UK it'd be:

[https://www.justwatch.com/uk/movies?monetization_types=free,...](https://www.justwatch.com/uk/movies?monetization_types=free,ads)

To be honest pretty much every movie I tried here was either:

\- Free with Amazon Prime (you need a paid subscription)

\- Available on BBC iPlayer (you need a paid TV License)

\- Available on BFI player (subscription based. Also good luck getting their shitty player to work even on a bog standard Windows 10 OS with Chrome, Firefox or IE - even with every plugin turned off - even NowTV makes a better fist of this, and they still insist on you downloading a separate player if you want to watch on Windows.)

\- Free but Ads - mostly provided by tubi.tv which at the moment is unavailable for EU users due to GDPR.

Ok, maybe I could subscribe to a VPN, but meh.

So I kinda think my assertion still stands.

<comment><USER2> It's also available in a bunch of other countries: [https://www.justwatch.com/](https://www.justwatch.com/) \- maybe your's is listed too?

<comment><USER3> See my reply above.

</comment></comment></comment></comment><comment><USER4> I appreciate the link, but it seems to have the same issue that most of the web suffer from: discoverability and curation.

+1,000 free movies might be great, but with such great numbers I need something more than a list in alphabetical order. As much as we need more content we need better ways to organise and categorise it.

</comment><comment><USER5> Have had great success using Kanopy ([https://kanopy.com](https://kanopy.com)). Works with a lot of educational institutions and libraries (notably for me, the New York Public Library).

<comment><USER6> I also have access to Kanopy at my local library, but it appears I need to create a Kanopy account in addition to logging into my library system with my library card. I don't approve of turning over PII to a "free" service I've already paid for.

</comment></comment><comment><USER7> I wonder on what basis these are free. For example, I clicked through to see "Hardware wars", but that video had been taken down due to a copyright claim.

<comment><USER8> The only site I know is actually open would be [https://archive.org/](https://archive.org/), is this site another clone/fork?

<comment><USER9> This is basically a link farm.

</comment></comment></comment><comment><USER10> Do yourself a favor and try finding a proper screening of the silents, with live music, instead of consuming them on a home system. It's worth the wait.

<comment><USER11> The best is the enemy of the good.

Or are you saying that the optimal mix is to rewatch Sopranos most of the time and watch a classic silent once per decade?

<comment><USER12> As someone who has watched silents with live music I can attest that the experience can be great (or not, depends a lot on musician(s) and music) and you should definitely go for it when given opportunity. However, I completely disagree with the idea that movie will somehow be sullied or even ruined if you watch it first on your own TV.

</comment></comment></comment><comment><USER13> Unfortunately, a few of the YouTube links have been taken down (e.g. Ivan's Childhood, Hamlet).

</comment><comment><USER14> Youtube took down their account

<comment><USER15> Youtube's definition of "infringing copyright" is far wider reaching than the actual legal definition.

<comment><USER16> YouTube's definition of copyright infringement is "someone claims it is". That's literally it, they are not actually checking the potential infringement (neither claim to do it for that matter).

There are repercussions for failing to take action after a valid claim but none for taking action after a bogus claim. So there is an incentive to take material down fast after any claim but no incentive for due diligence and claim validation before or after the takedown.</comment></comment></comment>


Ask HN: I want to build an electronic wearable, where do I start? - <AUTHOR> I'm a software developer, and I barely know nothing about electronics. Where do I start to bootstrap this project ? My current plan is to learn and try to build a prototype, then setup a kickstarter. Any advices welcome! Thanks <comment><USER3> "I'm a software developer, and I barely know nothing about electronics."

That sounds like a familiar recipe for disaster. Most hardware based Kickstarters fail. Even successful ones deliver very late and over budget. I work in electronics and wouldn't do it.

You really need to find someone with experience in bringing products to market. Hardware mass production is extremely difficult and expensive (from prototyping to final layout to component sourcing to quality control) and that's before you get to stocking and delivery. That all requires a lot of investment, time and understanding of the underlying systems.

<comment><USER4> Second this: there are a thousand things that can go wrong and irrevokably cost money. You need to get that production expertise in somehow, either by hiring or consultancy.

It's possible to learn a lot from people like Bunnie Huang, such as his "Chumby" product which he blogged the development of.

<comment><AUTHOR> Thanks, I'll check on this guy and his project

</comment></comment></comment><comment><USER5> I'm sure it's doable, just be aware that it will take a lot longer and cost a lot more money than you expect.

When your hardware project is "done" \- that is, it works as you'd like, maybe you've made a handful of them - you're only really 30% of the way. First you need to test it - EMC testing can be painful and unless you really designed it carefully you'll probably need to redesign parts of it.

One you've got past that, you need to manufacture it. To get a project to volume manufacture means you need to work out all the little details - <USER2> will you program it, how will you test it, how much stock do you hold, who builds it. You'll probably find there's things you overlooked, or a part you can't buy any more, and you have to do a board respin.

When you see polished products on Kickstarter that manage to ship in the schedule they initially proposed, that's because they've already done all of this. They've probably spent 6 or 7 figures to get to that point.

I'm not saying you shouldn't do it (and there are paths you could take which aren't so onerous, like maybe making just a circuit board which you sell mainly to the hacker community) - I find the whole process really enjoyable. It's just that it's a lot of work and can be very, very capital intensive. Plan things carefully and be realistic, not optimistic about costs and schedule.

<comment><AUTHOR> Thanks for your reply, very insightful. I will try to wrap my head around the first steps (like prototyping, and trying to find the right components), and see where it goes from there.

</comment></comment><comment><USER6> I'm an ex hardware design engineer turned software dev. My advise. Pick the chip that suits your requirements, get a development board and get the software running. Then when you have a non wearable prototype that dies all the things you can hand it off to a design engineer with the "now make it tiny" remit

<comment><AUTHOR> That's what I see as the simple first step, indeed :) Thanks for the input

</comment></comment><comment><USER7> This reminds me of the management at my old company. They wasted a fortune trying to develop wearables by tasking people with little or no product development background with the bulk of the work and then spending another fortune on consultants to make it pretty. What they ended up with looked like a Knick off pipboy from fallout.

That executive is on 'special projects' now.

</comment><comment><USER8> Find someone on aliexpress who's already making the product you want to make, contact them and ask them to OEM a version with your software.

<comment><USER9> Coming from someone who is a hardware/firmware engineer, that's also what I'd do.

Developing hardware is hard and costly. If you are looking to create a consumer-based product, this would be especially true. There's no way you'd be able to manufacture your product as cheap as getting a manufacturer to supply you with a OEM version of their product, let alone having to amortise the R&D cost spent in developing it! And generally speaking, the cost is the bottom line in a consumer-based product.

This is what the Wyze Cam does. They've created a really nice product, but there's no way they'd be able to sell it for $25 had they also developed and manufactured the hardware themselves.

</comment></comment><comment><USER10> I would start looking at haptics with wearable hardware devices, eg. [https://www.frontiersin.org/articles/10.3389/frobt.2017.0004...](https://www.frontiersin.org/articles/10.3389/frobt.2017.00042/full) [https://lofelt.com/](https://lofelt.com/) [https://www.ultrahaptics.com/](https://www.ultrahaptics.com/) You get the idea and down the rabbit hole you go. please let us all know how it turns out thxs. Myself always wondered about remote touch possibilities.

<comment><AUTHOR> Bookmarked! Will explore this asap :) Thanks

</comment></comment><comment><USER11> You have a lot to learn. Go to adafruit, buy an arduino and play around with it. Then, see how you feel. Think about how annoying it is to handle returns from angry consumers or if a kid eats your product. :)

<comment><AUTHOR> Thanks for the link, I didn't know adafruit :) Will explore it asap

</comment></comment><comment><USER12> Focus on your safety and health first.

Any wearable needs a power source, and any prototype is going to involve wires and breadboards that are not by default hermetically sealed. In the event your moist skin provides a lower-resistance path for the voltages involved, you might find your project (and self) dead.

Lithium batteries are extremely unforgiving, as well. Try to stick to a single cell, and if you need to put in multiple cells, put safety circuits on them.

It wasn't long ago (January 29th) where a man was killed when his e-cigarette exploded and part of it shredded his carotid artery.

Edward Thorp's 1961 wearable roulette cheating device started arcing when the young women wearing it started to glisten a bit too much in the sultry Vegas casinos.

I'm sure your prototype will be way cooler if it doesn't cost you an eye (safety glasses), your skin (from burns or explosions), or body parts of your intrepid friends and loved ones.

<comment><AUTHOR> I did not think about that :( That's sound advice!

</comment></comment><comment><USER13> Depends on how complex your idea is. You could do something like arduino for the POC and then hire a real hardware engineer for the post prototype. You will need some basic soldering skills and electronics knowledge for the POC.

There are a lot of dev kits available for more advanced processors, if you need something more powerful than an arduino. Using them is pretty much the same as an arduino, a lot of the time.

You'll likely have trouble with fabrication of whatever it is you are making. Hardware is very difficult and you'll probably end up with low yields on the first things that you make, even with an experienced HW engineer. So make sure you account for that extra cost.

</comment><comment><USER14> I suggest you reach out to some local makerspace/meetup or tinkerers who have some experience doing this. I did something similar and a local provided me with conductive thread and fabric and I even got to borrow an arduino set from him.

<comment><AUTHOR> That's actually a very good idea! There some fablabs in my local area, I will dig this way, thanks

</comment></comment><comment><USER15> I'm currently going through something similar: trying to create a hardware prototype for a tablet-like device. Even getting a board that supports eDP is a pain, and there is very little information out there that explains whether the panels are compatible with anything. I decided to just buy a RockPro64 + some generic LCD panel with an eDP hoping it will just work, but my confidence isn't high and I'm not sure where I'll go if it doesn't work.

I also couldn't find a place with people who know this stuff that could help me. It seems that getting software help is so much easier. Does anyone have any suggestions?

<comment><USER16> Just in case this fits what you are looking for as a starting point: [https://blog.adafruit.com/2019/02/06/new-product-kano- comput...](https://blog.adafruit.com/2019/02/06/new-product-kano-computer-kit- with-touch-screen/)

<comment><USER15> Thanks, but one of my specific goals is to get a screen that is at least 15" in size. Funnily enough I just realised that the LCD panel I bought didn't come with an eDP cable... so now I need to find that as well :(

</comment></comment></comment><comment><USER17> Depends what you're trying to measure. You really only need an Arduino/Raspberry Pi and some input device (sensor). For example, if you want a "brain wave wearable", simply connect an EEG to the Pi via RS-232 and process the data. It's really just a 4 step process:

1\. Acquire MCU (Pi, Arduino, etc.) 2\. Acquire sensor (Heartrate, EEG, etc.) 3\. Program processor/UI (Python/C++) 4\. 3D print enclosure

Make a dope marketing video and $$. Send me a PM if you want help, I've launched a wearable (it failed but there were lessons learned).

<comment><AUTHOR> Thanks for the feedback. My product will be even simplier, in that I don't need sensors, but it has to programmable somehow

</comment></comment><comment><USER18> My experience: I had some fun off and on with Arduinos but they tended to have excessive power consumption for the kinds of wearables I wanted to build and maybe productionise. So I switched to ultra low energy ARM Cortex SOCs like the STM32 from ST Micro. It was way harder than I was expecting (re-learning C was the easy bit!), but still good fun controlling clocks, DMA and other features in order to boost battery life from hours on an Arduino to days and weeks. I was toying with putting it into production but as I started to learn more it quickly became clear with only weekends and occasional weekdat it'd take me a lifetime to achieve that dream unless I had a bucket load of money with which to outsource. Your mileage may vary but maybe do it anyway just for the interest factor; if nothing else I feel I've lifted the curtain on how all these magical devices around us function :)

PS: STM's private (but free) Udemy courses were a great help getting me started. The written documentation online is aimed largely at professional electronic engineers and not so much at newbie hobbyists!

</comment><comment><USER19> > Any advices welcome!

It isn't realistic that you are going to develop a product from nothing in your spare time. If you don't know anything about hardware, chances are your idea isn't even any good. You didn't even ask a proper question, presumably because that would ruin the fantasy. Are you telling me you can't google how to make a prototype?

Yes, that sounds pessimistic. So I will give you the real advice. If you actually want to bootstrap a hardware project in you spare time, do something that is realistic. Do an add-on board for an arduino or a raspberry pi, or something with an esp8266 that you design yourself and sell in small quantity on e.g. tindie.

How long is that going to take you? Depending on your software experience, maybe a hundred active hours. How many hours would be realistic on average every week your spare time, maybe five? So around six months if you include holidays. Now you can imagine how long your original idea would take.

</comment><comment><USER20> Some more resources for you to consider.

[https://create.arduino.cc/projecthub](https://create.arduino.cc/projecthub)

[https://www.hackster.io/projects](https://www.hackster.io/projects)

<comment><AUTHOR> Thank you, will explore that asap :)

</comment></comment><comment><USER21> Ignore the people who are not answering your question and putting you down. You can absolutely do this. Find an EE guy on guru or some other place in the u.s. and get on a phone call ( not email). That's how you get started.

</comment><comment><USER22> I'm also very interested in mixing hardware and software and my friend currently ordered an arduino starter kit that we will work on together. I don't really have a product in mind, just exploring what is possible with hardware.

</comment><comment> yc-kraln For anyone (like OP) that's looking for help with a hardware project, I'm happy to advise. I have lots of experience bringing projects to market, both from an EE side and from the manufacturing side.

<comment><AUTHOR> Thanks for that, will sure get in touch once I figured out first steps to advance on this project!

</comment></comment><comment><USER23> Do an MBA -> Join a big hardware company -> Pitch your wearable to them -> become product lead.

Realize, that a software developer's role in this kind of product, is literally the least critical aspect of it.

<comment><AUTHOR> Well, I'll try to keep up with my software career and explore the hardware side as a toy project for now :)

</comment></comment><comment><USER24> Check out the Contextual Electronics courses.

[https://contextualelectronics.com/course- types/](https://contextualelectronics.com/course-types/)

<comment><AUTHOR> Thanks, will check this out asap!

</comment></comment><comment><USER25> I am in a somewhat similar position : I want to build a linux distro powered phone (postmarketos and/or ubports should be able to boot), and I have no idea where to start. Maybe I'll start by booting up the OS on a raspberry pi and get all the components working on a brick sized prototype and then see if it's possible to use the pi compute module to use as a base for the phone. Any ideas/suggestions are welcome.

<comment><USER26> Your tool chain is important out of the gates. I'd suggest picking a general ecosystem/SoC provider, engage with their sales, and acquire a development platform.

</comment></comment><comment><USER27> what sort of wearable? a watch? google glass like? fitbit like? what do you envision it doing?

perhaps look at some of the open source wearables for inspiration [1] [2] etc.

[1] [https://openhomeautomation.net/open-source-wearable- platform...](https://openhomeautomation.net/open-source-wearable-platforms- review)

[2] [https://www.hexiwear.com/](https://www.hexiwear.com/)

<comment><AUTHOR> Thanks for the resources, I didn't event know there was open source wearables! Will check asap

</comment></comment><comment><USER28> Since you're a software developer why not just start by buying 9usd wearables and reprogram it, bluetooth with colored or black and white screen, heart rate sensor and accelerometer built in.

Lots of people have been doing that and adding new features. Hardware is hard if you don't have the experience.

</comment><comment><USER29> I have no idea if this guy is any good (I believe the "hardware product" he brought to market was a simple stick-on LED front light for tv remote controls or something like that), but he now consults on exactly this, and his blog/email posts are certainly extremely interesting and plausible:

[https://predictabledesigns.com/](https://predictabledesigns.com/)

tldr: it's a huge jump (like 90%++ of the effort) from even a polished prototype, to a ship-able box, let alone one sitting on a shelf in Walmart etc

disclosure: I merely subscribe to his email newsletter, but I too have some h/w ideas I'd love to make into products.

<comment><AUTHOR> Will check this out! Thanks for the link</comment></comment>


Ask HN: What's the current consensus on Wifi and safety for humans? - <AUTHOR> Every once in a while, the issue of Wifi and other EMF comes up. As someone with small kids, I revisit this every once in a while.
It's practically impossible to isolate one's environment now, especially if living in an urban centre.
A quick search of Pubmed:
(1) Environmental Radiofrequency Electromagnetic Fields Exposure at Home, Mobile and Cordless Phone Use, and Sleep Problems in 7-Year-Old Children. (2) Modeled and Perceived Exposure to Radiofrequency Electromagnetic Fields From Mobile-Phone Base Stations and the Development of Symptoms Over Time in a General Population Cohort. (3) Mobile phone radiation causes brain tumors and should be classified as a probable human carcinogen (2A) (review). (4) Outdoor and indoor sources of residential radiofrequency electromagnetic fields, personal cell phone and cordless phone use, and cognitive function in 5-6 years old children.
Any subject matter experts here who can provide an update on this topic? <comment><USER2> I hate the word consensus.

There is no evidence that WiFi or radiation in similar frequencies dangerous (unless there is a lot of it, like inside a microwave cooker).

There are some isolated articles that are not reproducible. Even the Em-drive got finally published. One article is not enough to prove something.

The conclusion of the first article (1) is [https://www.ncbi.nlm.nih.gov/pubmed/26509676](https://www.ncbi.nlm.nih.gov/pubmed/26509676)

> _CONCLUSION: Given the different results across the evaluated RF-EMF > exposure sources and the observed association between mobile phone use and > the negative control sleep scale, our study does not support the hypothesis > that it is the exposure to RF-EMF that is detrimental to sleep quality in > 7-year old children, but potentially other factors that are related to > mobile phone usage._</comment>


JWTs: A secure and stateless way to implement authentication - <AUTHOR> https://medium.com/@bryanmanuele/sessionless-authentication-using-jwts-with-node-express-passport-js-69b059e4b22c <comment><AUTHOR> This article serves as a rebuttal to [http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt- fo...](http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for- sessions/). It deconstructs each criticism presented and explains why JWTs are a secure and elegant solution to authentication. It also goes over how one would go about implementing authentication securely using JWTs with Node + Express + Passport.js.

<comment><USER3> The biggest criticism from the original article is that you are unable to revoke jwt individually. This was not debunked nor mentioned (unless I blind and didn't see it, in which case I apologize).

<comment><USER4> There's nothing really stopping you from revoking a JWT individually - <USER2> keep the `jti` (or any arbitrary claim) in memcached/redis/etc and check it. Obviously it's no longer stateless and gives up some of the benefits of a JWT, but it's a solution if revocation is a business requirement.

Like everything, there's no silver bullet (JWT vs random string token) - business requirements dictate which makes sense.

<comment><USER5> In system designs, have always kept "add revoked jtis to an expiring cache" in the back pocket. Keeping in mind that it might be needed.

Turns out that just deleting JWTs from the client and letting them expire naturally (10 mins) has always been good enough so far.

<comment><USER3> The example from the criticism post cites the permission revocation issue, which isn't solvable in jwt (without using serverside state, in which case you negate the advantages of jwt).

making the expiration short works to some degree, but then you'd be forced to constantly update the token.

As for deleting the jwt from the client - that's not trustworthy enough, since the client controls themselves, you can't be sure that a deleted jwt is really deleted!

<comment><USER5> Ah sorry I think I need to be clearer with where I am coming from. Some of the statements I've made rely on implementation decisions which are not universal but I believe are common and well known in jwt based session designs.

Usually I work with web applications which have some server side state but where bits are made stateless where sensible. So for example, user records exist but we can save a db/redis call per request with stateless sessions.

To address your points:

It's fairly easy to do jwt refresh (usually client driven with a timer) which lets you keep individual jwt lifetimes short. The refresh endpoint can sometimes be stateless.

This means that an inactive timeout happens by default but a hard limit on maximum session lifetime (e.g. can refresh for up to 24h say) needs to be implemented at the application level (you can also do this statelessly).

There's design impact using stateless sessions but it's usually positive in my experience. When you ditch state in server side sessions, you have to figure out where to put it. Take say, "last search filter" or something. Traditionally you might have stored that in server side session storage, deserializing on every request. Using JWTs you will tend to either offload that to client JS or expose it as a "real" resource tied to the user record.

If you use public key signed sessions you can also decouple the "auth" part of your app from the jwt consumers in a fairly principled way (e.g. in microservices arch most services then don't have the ability to issue sessions, in fact your auth service can be in say its own aws account etc).

It's not quite true that you negate all the benefit of using jwts with a stateful "revocation" cache.

The key difference is that it is likely that the number of sessions actually revoked in the last 10 minutes tends to be rather small compared to total concurrent active sessions. This is faster and cheaper to store and search.

But 90% of the time you don't actually need to build a revocation cache.

Usually there are two reasons to "revoke" a jwt in a webapp, the first would be to do a "hard" user initiated logout. This means that the user is explicitly asking for their session to be invalidated on the server side. The second would be to allow an admin to terminate a specific user session.

Often when an admin locks a user out it's better to actually implement that at the level of the user record rather than mucking about with specific sessions. Permission revocation also happens at the level of the user record.

In the logout case, the trust issue you mention is not an issue because the client itself is requesting invalidation.

Generally the security difference between having the client simply delete its copy of the jwt and actually doing hard invalidation on the server is fairly minimal. May be a requirement for some projects though.

I think a lot of these "to jwt or not to jwt" posts suffer from all-or-nothing thinking, real apps can pick and choose along a spectrum of options.</comment></comment></comment></comment></comment></comment>


Ohio is investing in hyperloop studies. Why? - <AUTHOR> https://slate.com/business/2018/03/ohio-is-investing-in-hyperloop-studies-why.html <comment><USER2> I want some of what these people are smoking! Until you've built a prototype you have...nothing. Don't _tell_ me it's feasible, _show_ me. While you're showing me a functional prototype let's discuss the costs involved with scaling-out the technology. That will lead us to feasibility - how much are people going to have to pay for a ticket and are they going to be willing to pay it? How will the cost and experiences compare to airfare? If it's not substantially cheaper then why would I choose something untested and potentially more dangerous?</comment>


The liveliest mind in New York - <AUTHOR> http://nymag.com/news/features/64626/

<comment><AUTHOR> An article about Tony Judt, a historian of contemporary Europe. He was diagnosed with ALS in 2008.

The article is longish, and the details of his work may not interest you, but his attitude towards his work, intellectual integrity and life & death are well worth reading.</comment>