100 years of the death penalty [Interactive Graphic] - <AUTHOR> http://www.deathmap.org/

<comment><USER2> I'm against the death penalty also, but this is misleading. Just look at Central America, parts of South America and parts of Africa. There are and have been many, many killings by the government in these places for the purpose of keeping its constituents under control.

<comment><AUTHOR> Where do you get that data from? The numbers on that map are based on reports from Amnesty, so they should be pretty accurate. But if you have a better source, let us know so we can update it.</comment></comment>


Ask HN: Do you think Humans will defeat aging? If yes, when? - <AUTHOR> <comment><USER2> What's your definition of ageing? Does "prevention of organ failure" fit the goal of defeating aging? I'd bet the answer would be 'no'. I find the idea of advanced prosthetics and cybernetics to be more plausible, but they are mitigations not preventive solutions.</comment>


Stablecoins: A Holy Grail in Digital Currency - <AUTHOR> https://thecontrol.co/stablecoins-a-holy-grail-in-digital-currency-b64f3371e111 <comment><USER2> It's not decentralized if there's a trusted oracle.

So many schemes in the "blockchain" space fail to understand the core problem Bitcoin solves. Bitcoin solves trust. You can transact Bitcoin with anybody and you don't have to trust a single person, even the sending party. If someone sends you Bitcoins and the transaction is 6+ confirmations deep in the blockchain, you can be certain that you own those Bitcoins and nobody else can take them from you without your private keys. Not a bank, not a government, not a miner, not a "core dev", not a full node operator. The only necessary assumption is that 51% of the hash power is not conspiring against you.

Whenever you see a new "blockchain" scheme coming out, ask yourself who you need to trust for it to work. If the answer is not "nobody", then it is not worth any more of your time.

<comment><USER3> Replace "blockchain" with "merkel trees" and you get interesting things like certificate transparency, which is certainly "worth your time".

Hype aside, public, shared, consistent, irrevocable ledgers are useful for all sorts of things even if you're not attempting to solve the "no trust" problem.

<comment><USER4> How can you get an irrevocable ledger without solving the "no trust" problem?

<comment><USER3> You have a lot of people watching the trusted source to make sure that it's append-only and follows the rules for appends. It's a reputation thing; not impossible but it will be detected.

<comment><USER5> Isn't reputation trust-by-historical-evidence?

</comment></comment></comment></comment></comment><comment><USER6> > The tokens have been continuously sold off in small batches by the Dai > Foundation. Currently about 55% of the total supply has been distributed, > with the foundation still having another 45% for future fundraising.

And here where the "Scam" alarms go full retard, basically panicking the whole building I'm living in. The concept is yet to be finalized, let alone functioning and yet these guys started selling "tokens" a la "DAO".

I wonder when regulators are going to strongly hammer the ICO (or the crypto equivalent of IPO) by a 15 year of jail and catching bad jokers inland and overseas.

<comment><USER7> As soon as I saw 'dao', I realized I was wasting my time.

</comment></comment><comment><USER8> I don't see stability as a goal right now with leading cryptocurrencies (ETH, BTC). In fact, promoting cryptocurrency as a storage of value right now seems off too: one day, not today.

More people will store more wealth in cryptocurrencies as the number of applications grow. Being able to pay for my Chipotle, or renew domain names, or buy stock in companies, or run a website all make me more willing to keep more of my wealth in ETH. Eventually stability will come as the relative utility of a currency pushes volume up.

The last thing I want is stability as a believer in the Ethereum platform. I want the price of Ether to go up pursuant with the growing utilities Dapps provide.

In the interim, solutions like Bitpay that pay merchants in USD over BTC are brilliant. They allow merchants to buy into cryptocurrency without accepting the volatility risk until it's low enough.

</comment><comment><USER9> So this is trying to create a currency that is democratically controlled by the "MKR" holders - I don't really understand how this is fundamentally different than something like the US dollar. Sure, the central bank controls a lot of the system, but they are also 'democratically controlled' by our ACTUAL democracy.

Now, I am sure there will be an argument made that the central bank is beholden to special interests, who use their wealth and power to control our democracy... but won't that same thing happen with these 'MKRs'? The wealthy and powerful will have more control over them, and will certainly use that power and control in their own benefit.

It seems like a common flaw in all of these 'alternative' systems people create to replace large scale institutions; they might seem different than what we have now, but when you scale it up to match the size of the current system they are aiming to replace, you end up seeing that the systems are nearly identical in practice.

</comment><comment><USER10> I think one of the difficult things is that volatility (and speculators) do play a role in a coin succeeding, as speculators make the 'network effect' problem of altcoins easier to overcome.

There's next to zero reason for a random merchant to accept an altcoin unless there are people using it, and unless that coin is known. Speculators and volatility are very big generators of noise that gets the coin noticed and helps bring in actual for-the-sake-of-the-coin holders, which then makes the coin itself more attractive to a merchant (as there are people who wish to use the coin).

As much as coin purists may like to speak derisively of speculators, I believe that altcoins would be nowhere without those who have come in to the game to try to earn money off of the volatility.

<comment><AUTHOR> I agree with you on volatility playing an important role in bootstrapping the network in the early days of digital currencies like Bitcoin and Ethereum.

I think stablecoins will play out differently though and are an important component of attracting new users. I believe decentralized applications will be built that bring mainstream users in, and these users will want a stable store of value to use these applications.

</comment></comment><comment><USER11> There is absolutely no way this can go terrible wrong.

<comment><USER12> once you acknowledge this as inevitable it frees you to engineer systems that have failure modes

dollars are stablecoins

<comment><USER13> > dollars are stablecoins

i get it, dollars are digital. but really thats the only similarity.

</comment></comment></comment><comment><USER14> I think it was Ven that was the concept I liked where you build a currency on a bunch of commodities targeted toward stability. Clive Robinson on Schneier's blog had previously described that as the best solution then I stumbled on Ven.

[http://www.popsci.com/worlds-most-stable-currency-is- backed-...](http://www.popsci.com/worlds-most-stable-currency-is-backed-by- carbon)

So, my scheme was to put something like Ven in a sane country such as Switzerland under a nonprofit/foundation with strict rules aimed at preserving stability, security, innovation of ecosystem, and cap on admin overhead. If that works out pretty well, we can try a decentralized version of the same thing. Meanwhile, centralized can already work very well. Just eliminate as many incentives to mess it up as you possibly can to make it better.

The big brains haven't explored this option enough since they want a crypto/algorithmic solution to hard problems instead of using the well- understood systems of law, accounting, and safe investments. There's also a strong preference for decentralize stuff highly-likely to fail vs centralized stuff way better than what we have. I think that's ideological or even youth- related.

</comment><comment><USER15> A better whitepaper than the one linked in the article, [https://github.com/makerdao/docs/blob/master/Dai.md](https://github.com/makerdao/docs/blob/master/Dai.md)

</comment><comment><USER16> ,,While the volatility of Bitcoin has decreased significantly since it launched in 2009, it is still not a good unit of account or a stable store of value. ''

I will gladly accept his BTC from 2009 and give him USD from 2009 for the 2009 price.

Sorry, but stability is not holy grail in itself. I would prefer constant supply to it for long term store of value

<comment><USER17> Would you sign a 30 year mortgage denominated in BTC? I don't think so, it's neither a good unit of account or store of value. Looking back at the past when you know the previous value is not a good test; looking at the unknown future is.

<comment><USER18> The mortgage point illustrates the issue nicely.

However, I think if I had a reliable income that was measured and paid out in BTC, then the answer would be yes.

That's really the benchmark for when BTC can be used as a proper currency, when people are prepared to set their value in BTC.

At the moment it makes a decent transfer mechanism for funds where the quantity is calculated relative to another currency at the time of transfer.

If Bitcoin were to become a standard currency it will necessarily have to go though more volatility. Bitcoin's value, should it succeed, is significantly higher than where it is now (conversely, should it fail, lower). When its value does not match its utility it must eventually move. Stability increases utility. These oppossing forces will cause occilations like a plucked string. The occilations should deminish over time as the forces reach equilibrium. The point of balance is anyone's guess right now.

<comment><USER17> > However, I think if I had a reliable income that was measured and paid out > in BTC, then the answer would be yes.

I think you haven't thought it through if you still think that. 2BTC is currently worth just over 2g in dollars. In 10 years time, it might be worth 10g in dollars or it might be worth 4g in dollars. You'd be crazy to agree to pay 2BTC a month for 30 years with a currency that doesn't have a predictable future value. The dollar has a predictable future value; stability is not about not losing value, it's about predictable value.

> That's really the benchmark for when BTC can be used as a proper currency, > when people are prepared to set their value in BTC.

No, people can do that now, but they do it in relation to exchange rates of more stable currencies. BTC will be usable as a proper currency only when its future value becomes somewhat predictable, predictable enough to denominate long term contracts like mortgages in it without relation to another currencies exchange rate. It'll take decades to reach that point.

A currency without a reasonable long term predictable value, isn't a currency, it's a commodity.</comment></comment></comment></comment>


Here's what it's like to start writing a book - <AUTHOR> https://medium.com/p/1e68538617d3

<comment><USER2> Like Louis I started writing a book[1] after reading Nathan Barry's Authority. I did it mostly as a learning exercise, and boy did I learn a lot. For example, the first email I sent to my list had blue underlined words that were supposed to be links but didn't get linked. Never gonna let that happen again.

Writing and self-publishing books seems like it might be a little faddish lately, but I couldn't be more excited. A book, even a short one like mine[2], lets you expand on thoughts so much further than you can in a blog post or a tweet. I'm delighted to see all of this longer form thinking taking place in our community.

[1]: [https://www.petekeen.net/adventures-in-self- publishing](https://www.petekeen.net/adventures-in-self-publishing)

[2]: [https://www.petekeen.net/mastering-modern- payments](https://www.petekeen.net/mastering-modern-payments)

<comment><AUTHOR> This is exactly how I see these new ebooks, not so much as actual competitors to the oreilly kind of books (because they are more concise), but as longer form thinking than blogs. There's a lot of enthusiasm on self-publishing books, and maybe it will be short-lived, but I hope that in the long term we'll have more and more experts in our community who will share their knowledge on niche topics in the long, self-contained and polished form that books are!

</comment></comment><comment><USER3> I feel like setting yourself a "words/period of time" ratio is only good if you do not fear deleting these words afterwards. It's like setting a "LOC/period of time" ratio, focusing on removing bugs and increasing features (as an f-score ;-)) is a better optimization objective, but you've got to start somewhere...

<comment><AUTHOR> That's a very good point. These 1000 words often get replaced or deleted. I guess that in many creative activities it's painful to edit down, but it usually pays off. Sometimes you don't just delete what you wrote but you rephrase it. I find it much easier to formulate a complex idea when I already have a first version in front of me (even if it's terrible), than to start from nothing.

<comment><USER4> I agree completely, and for me it applies equally to writing and coding.

</comment></comment></comment><comment><USER5> That's a pretty good summary. Writing a book is hard, but it is rewarding to actually publish a book.[1] I'm still not sure how I feel about selling them with an average price of $80 though. I'd probably make more money overall that way, but I haven't been able to make myself do it yet. Perhaps at some point.

[1] - My Book - [http://buildanappbusiness.com/](http://buildanappbusiness.com/)

</comment><comment><USER6> It was a fun surprise to casually read through this and then see my blog mentioned. Glad my work is an inspiration! Let me know if there is anything I can do to help.

<comment><AUTHOR> Here's what it's like to be an authority ;)</comment></comment>


Realtime stats with Google analytics - <AUTHOR> http://text.krona.tm/post/11195455994/realtime-stats-with-google-analytics

<comment><USER2> Can't read, I get a "too many redirects error"

<comment><AUTHOR> really? Its hosted on tumblr, so I guess they might have screwed up. Worrying though, I picked them since I wanted something hasslefree.</comment></comment>


Microsoft demos breakthrough in real-time translated conversations - <AUTHOR> http://blogs.technet.com/b/microsoft_blog/archive/2014/05/27/microsoft-demos-breakthrough-in-real-time-translated-conversations.aspx

<comment><USER2> Wow! Not only very cool on the translation side of things - but how FAST they were talking. Very cool, Microsoft!</comment>


You guys spoke, we listened - A brand new Bitspend website is live - <AUTHOR> https://bitspend.net Thanks to you guys we received tons of positive and constructive criticism.  We're proud to say we listened, and acted!
We hope our new site is more up to all of your standards :)
Thank You, The Bitspend Team <comment><USER2> Mustache squirrel!</comment>


Temporal TC39 Proposal - <AUTHOR> https://github.com/tc39/proposal-temporal <comment><AUTHOR> Curious - is anyone using this via polyfill, or engaged in its ideas?

Thoughts on Temporals quality? Will people still want date/time libraries once it's out and stable?</comment>


Lessons Learned From Losing Someone You Love - <AUTHOR> http://brooklynhacker.com/post/9243052778/lessons-learned-from-losing-someone-you-love

<comment><USER2> "I wish I could say you get used to people dying. I never did. I don't want to. It tears a hole through me whenever somebody I love dies, no matter the circumstances.

But I don't want it to "not matter". I don't want it to be something that just passes. My scars are a testament to the love and the relationship that I had for and with that person. And if the scar is deep, so was the love. So be it. Scars are a testament to life. Scars are a testament that I can love deeply and live deeply and be cut, or even gorged, and that I can heal and continue to live and continue to love. And the scar tissue is stronger than the original flesh ever was. Scars are a testament to life. Scars are only ugly to people who can't see."

[http://www.reddit.com/r/Assistance/comments/hax0t/my_friend_...](http://www.reddit.com/r/Assistance/comments/hax0t/my_friend_just_died_i_dont_know_what_to_do/c1u0rx2)</comment>


Show HN: my sideproject Ohgle.it - <AUTHOR>

I've been spending 5-10 hours a week building this with a few friends.  Any feedback/suggestions are welcome!
http://ohgle.it
Thanks! <comment><USER2> Cool idea and you seem to have gotten some traction to it too. Looks pretty similar to <http://www.wanelo.com/>. Offhand difference I can see is that you allow your users to earn money on their recommendations, but I must say I personally prefer the Wanelo UI more. It seems, though, that Wanelo has been idle for some time.

</comment><comment><USER3> Nice design, loved colors and typography.

However would like to suggest that,

1\. please capture all click events on links with "#" as href. Its annoying when someone clicks on such link and page suddenly scrolls to top.

2\. I kinda didn't like "Join today and earn money" header in almost every page.

<comment><AUTHOR> Interesting... what links are you seeing with "#" as the href?

I agree about the "Join today and earn money" call-to-action. Any suggestions for better copy?</comment></comment>


BitcoinHop - Online auctions with bitcoin payments - <AUTHOR> http://bitcoinhop.com/

<comment><USER2> the site could use a FAQ. I'm not sure I'd like to give up my address and email and all that, not knowing exactly how the site works first.

</comment><comment><USER3> "Ebay with bitcoin payments" to me wrongly portrays the site. I was expecting to see a bitspend for ebay <http://news.ycombinator.com/item?id=2639572>

<comment><AUTHOR> Edited for clarity.

<comment><USER3> Good luck. No shortage of competition!</comment></comment></comment>


The other kind of "flash" that we used to worry about - <AUTHOR> http://rachelbythebay.com/w/2018/12/26/flash/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=18766917](https://news.ycombinator.com/item?id=18766917), which was posted earlier.</comment>


Autonomous car poll: Will you miss driving your non-autonomous car? - <AUTHOR> http://robohub.org/autonomous-car-poll-will-you-miss-driving-your-non-autonomous-car/

<comment><USER2> Yes and no. Yes in that driving can be enjoyable, and a car can be an expression of one's personality or identity. (I for example own a MINI Cooper; make of that what you will.) On the other hand, I often think about how I could recover many hours a week if I could be reading or working or sleeping or daydreaming during my commute to work instead of actually piloting the car.

<comment><USER3> I, too own a MINI Cooper _wave_.

I feel that I wouldn't miss the daily commute, and perhaps it would free up money and time for my _other_ car - which is a Lotus Elise. I would probably have to make arrangements to store it and transport it to and from the race track, but that's an acceptable trade.

</comment></comment><comment><USER4> Seems like people are fairly evenly split on this issue if you look at the poll results: [http://robohub.org/autonomous-car-poll-will-you-miss- driving...](http://robohub.org/autonomous-car-poll-will-you-miss-driving-your- non-autonomous-car/)</comment>


Dumb Password Rules - <AUTHOR> https://github.com/duffn/dumb-password-rules <comment><USER4> Joel Califa's "Patronizing Passwords" has some great examples: [http://joelcalifa.com/blog/patronizing- passwords/](http://joelcalifa.com/blog/patronizing-passwords/)

<comment><USER5> Thanks for the article, I enjoyed the read

<comment><USER6> You're welcome, thanks for reading :)

</comment></comment></comment><comment><USER7> I use KeePass to store all of my (randomly generated) passwords.

One ongoing annoyance is that it's increasingly difficult to generate a random string will be meet a given site's Dumb Password Rules, because so many sites have them, and there's surprisingly little overlap in the rules.

I would really like to see a database of sites and their corresponding Dumb Password Rules, so that I can tell KeePass (or any other app using the database) to generate me a new _Mindware_ password, or a new _Williams-Sonoma_ password, and get a random string that conforms to all the relevant DPRs.

<comment><USER8> KeePass should let users configure a pattern for passwords, like "8-25 letters or numbers or these symbols, must have 1 uppercase letter", and just replicate that socially (the pair of web site and pattern) across all KeePass users.

<comment><USER9> Sounds like a good idea at first, but could also be a huge attack point.

<comment><USER10> The "replicate" bit sounds deeply alarming - a password manager using social or learned rules just screams vulnerability. If you made me guess an attack, I'd picture someone paying for a server cluster or botnet to repeatedly assert super-restrictive rules, and then use their knowledge of those rules to guess the generated passwords.

Allowing some basic rule-setting, though, sounds quite nice. Arbitrary restrictions will probably leave people setting bad passwords, but there are some very common flags like "must have a special character" or "can't have a special character" that it'd be convenient to access for these sites.

</comment></comment></comment></comment><comment><USER11> In the same spirit, can we please do away with the idea of expiring passwords -- and then enforcing that we can't even re-use our last X number of passwords. It just causes locked out accounts, written down passwords or adding on one more of whatever character was at the end.

<comment><USER12> There is a specific reason for having "cant reuse last X number of passwords" combined with having an "expiring password" rule.

The idea is that if someone was silently in your account, and doing a "stealth" attack - then they could change your password, then change it back to your original password, thus "resetting" your expiring password timer, giving them more time in the system - and you would not know that the password was reset. Preventing old passwords prevents this.

Note: The only flaw I never understand with the above is cant the attacker just change the password like 10-15 times in 5mins, and thus "flush" out the old password?

Note 2: I dont personally agree with expiring passwords - but it helps understand the reason why it exists.

<comment><USER13> err in that attack how do they know your original password to change it back? and if they know your password to change it back why bother changing it in the first place, why not just log in as you?

AFAIK the reason for password history is where periodic password change is enforced, to prevent a user from just alternating between two passwords.

enforced periodic password change is (in the general case) not great for security, luckily we're starting to see official guidance which recognizes this [https://www.ncsc.gov.uk/guidance/password-guidance- simplifyi...](https://www.ncsc.gov.uk/guidance/password-guidance-simplifying- your-approach)

<comment><USER14> Let's say a service does not require you to change the password. You are then "compromised once, compromised forever", at least until you change the password.

Let's say it requires you to change it every month. You are compromised at max for a month, right? If the attacker changes the password, you will notice, and _make a different password_ , which will lock them out since they don't know the new one. So they won't change it, but they will lose access next month. This is good...

Except if you allow repetitions of old passwords. In this case, the attacker can change your original password to 'aaaaaaaa' for a moment and re-change it back to the original one, which will reset the "one month" timer, leaving them with access. Until you change it, but the platform won't bother you with it since the timer never expires.

<comment><USER13> I've done many password audits over the years and all monthly password changes does it make people use sequence passwords (e.g. MyPass1!, MyPass2!, MyPass3!) which are easily guessed by the attacker once they have one instance of the sequence, so really monthly changes add very little in exchange for the hassle they introduce.

The more sensible approach is not to force periodic change and only change where there is a suspicion of breach.

</comment></comment></comment></comment></comment><comment><USER15>
        > - Must be at least 8 characters long
        > - Include at least 1 number
        > - Include at least 1 uppercase letter
        > - Include at least 1 lowercase letter
        > - May use special character

"Password1"

<comment><USER16> Could be shorter.

<comment><USER17> Passw0rd

<comment><USER16> Now that's what I call security.

</comment></comment></comment></comment><comment><USER18> Popular German bank "Sparkasse" has this great online banking system that allows you only 5 characters (Small and large, numbers, umlauts and eszet[1]). They call it a PIN (Personal identification /number/), but IMO its terribly insecure.

[1] [https://en.wikipedia.org/wiki/%C3%9F](https://en.wikipedia.org/wiki/%C3%9F)

<comment><USER19> This is the second time I've now heard of this since starting the repo. I cannot believe an online financial institution allows this.

Feel free to submit a PR if you like.

<comment><USER18> @duffn is ok if its in german?

<comment><USER19> Sure. If you could also provide a description in English as well I think that would be helpful. Here's a non-English example: [https://github.com/duffn/dumb-password- rules#movistar](https://github.com/duffn/dumb-password-rules#movistar)

</comment></comment></comment></comment><comment><USER20> My favorites are the ones where you can't use more than a certain number of characters or where you can't use special characters.

<comment><USER21> Amex website had their max password length of 8 characters. Not sure if they changed it. Even if you do have a system constraint, you could just lop off the extra characters and the user wouldn't probably never notice.

<comment><USER22> Mine is way more than eight characters (randomly generated w/ KeePassX), although I haven't tried truncating it to eight and seeing what happens.

</comment></comment></comment><comment><USER23> Something I've always disliked about password rules is the "special" treatment of special characters. What makes one character special and not another? Is % special? Why? Can I use ½ in my password and have it count as a special character? How about 特别? What about Ѕ, Κ, and о? Does "special" mean non- ASCII, non-alphanumeric, not-on-the-keyboard or something else? Why is it that sometimes some "special" characters are allowed and others are not, even if they're right next to each other on the keyboard? Why require one? Is "P@ssword" really better than "correct horse battery staple"?

<comment><USER24> I think generally people stick to ASCII printable characters because of the support cost, since the benefit of allowing non-ASCII passwords is not generally worth the headache of dealing with customers who find themselves trying to log in to their account a terminal that isn't configured for the character set their password is in.

As for other special characters, a properly implemented password storage system would just dump these directly into a key-derivation function before it ever touches a database, but I think you get those rules from a mix of: 1. people who are storing their passwords in plaintext and are worried about SQL injection attacks and 2. people who know to pass them to a KDF before storing them in the database and either have inherited some old rule about "no special characters" or who are not convinced that someone in the future won't make changes to the system such that special characters would become a problem, and are trying to make it more robust to potential reversions.

Not saying it's a good idea, but at least some people "doing things right" will still have somewhat reasonable concerns about special characters.

</comment></comment><comment><USER25> My bank limits passwords to at most 5 alphanumerical characters. Yup. Five. There are over ten times more possible customer IDs (10 digits) than passwords.

<comment><USER26> Out of curiosity, what bank is this?

<comment><USER25> The Sparkassen in Germany do this, but they're not alone in doing so. They lock you out after a couple of attempts, so brute-force is out, but it's still dumb.

<comment><USER27> > so brute-force is out

Until someone gets ahold of a list of the hashed passwords and can brute force them at home without triggering the lockout.

</comment></comment></comment></comment><comment><USER28> Some of the restrictions of special characters I can somewhat understand: Depending on the keyboard layout, many of these often disallowed characters require proper right-alt support to be set up in order to be typed.

People tend to get these wrong or to be unaware of the currently set keyboard layout which will cause support issues.

Same goes for non-ASCII characters where this also depends on the browser configuration and version as they still get the encodings wrong at times.

Yes. For us advanced users using password managers this is a non-issue as we're pasting anyways, but for people typing the passwords manually, this can be a problem.

Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly. I've started this practice after having been forced to force-reset my password via the `init=/bin/sh` boot argument as the first step after the install :-)

What I absolutely don't get though is maximum lengths on passwords. You should be hashing them anyways, so setting a maximum length is completely pointless.

<comment><USER29> What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste...

QWERTY isn't the only keyboard layout. Nor do you need right-alt support to type things like é or ç, you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems).

 _> Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly._

That is smart for an initial password that you change once you know your keyboard is configured properly. A temporary password while spinning up a new machine isn't too big of a security deal if you're going to be changing it within a few hours anyways.

<comment><USER28> _> What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste..._

I have had to deal with people not being able to type their passwords because a character wasn't on their current keyboard of choice (some people use iPads and don't know how to type a # for example)

 _> you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems)_

you're giving way too much credit to the knowledge of the average computer user.

<comment><USER29> _> you're giving way too much credit to the knowledge of the average computer user._

If they're creating a password with ß in it I'm assuming they know how to type ß, yes. I don't expect the average user to know how to type ß. :)

<comment><USER30> And then they travel and use a different device with a different keyboard layout and suddenly they _don 't_ know how to type ß anymore.

<comment><USER28> Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know what it arrives as, but some browsers don't and suddenly the password 'foobar' can be used to log-in, but 'foßbar' can't.

By not allowing non-ascii characters in the first place you remove a whole class of support issues.

</comment></comment></comment></comment></comment></comment><comment><USER31> While we're at it, can we also shame the banks which ask you "third", "fourth" and "ninth" character of your password + date of birth to login? Clearly they're storing the password in Plaintext (otherwise the "random" characters can't be matched).

I know Thomas Cook did this with their pre-paid forex mastercards which I happen to use while travelling abroad.

<comment><USER24> It's a horrible practice that reduces the entropy of your password a huge amount, but it's possible to generate these things without storing them in plain text. Like if you know you're going to ask for 6 of the 9 characters every time, you'd just pre-hash whatever subset of 6-character passwords you plan on using. Of course, this turns a 9-character password into at most 84 six-character passwords, so assuming they allow all printable ASCII characters, you go from 1e18 possible combinations to 84 passwords of 1e12 possible combinations - of which you have to crack two, with the second one being 100000x easier than the first, so overall the password is ~1,000,000 easier to crack from the hash. I imagine in most cases it's actually a signficantly greater reduction in security than that, so it might as well be plain text.

I think the idea is that they are worried that their customers will enter in their real, full password on something with a keylogger.

</comment></comment><comment><USER32> Honest question: does password strength actually matter that much in practice? Do people using "horse" get hacked more often than using "zjh5?&Dp"? Is there a point of diminishing returns where "horse23" is basically good enough? Has anybody studied this in a systematic way?

<comment><USER33> Yes, if an attacker gets a dump of hashed passwords, horse will be tried much sooner than the other example.

</comment></comment><comment><USER34> A university that I'm applying to has a particularly stupid requirement on their login portal, but since I'm a prospective student, I don't think it'd be wise for me to name and shame.

<comment><USER35> Come back and contribute to this once they've made a decision. :)

</comment></comment><comment><USER36> CPanel -- [https://features.cpanel.net/topic/better-password- strength-c...](https://features.cpanel.net/topic/better-password-strength- checker)

Will say that "correct horse battery staple" isn't secure password and will give it a score of 0/100\. While "123!" will get 66/100 and will get accepted.

And this is control panel used by many hosting companies. :)

</comment><comment><USER37> I think that if you intend to "shame" something, you should at least start out with proper channels (e.g. send an E-mail, file a bug, whatever). Also, it's not really going to shame them unless you point them to the place they're being shamed.

In the end, what is more important: seeing the situation _improved_ or just complaining?

</comment><comment><USER38> I created an issue for this, but one really dumb thing is inconsistent password verification. Bestbuy will let you use anything for a password but on login really long passwords will trip it up. Been able to reproduce it a few times with 64 character passwords generated from 1pass.

<comment><USER39> Why use a 64-character password? This post suggests more than ~21 random characters (128 bits) doesn't get you extra (practical) security: [https://security.stackexchange.com/questions/33196/is- there-...](https://security.stackexchange.com/questions/33196/is-there-a- length-beyond-which-increasing-password-length-provides-no-additional)

<comment><USER38> No good reason other than they let me. My thinking is, if you're going to let me put anything in then your system should work with that. If it's going to break at n characters then cap the length.

</comment></comment></comment><comment><USER22> I think the reason that many banks still have "stupid" requirements (as seen in this thread) is because many of them still offer "banking by phone" \-- i.e. calling into an automated system and using DTMF tones to enter your password/PIN/etc.

</comment><comment><USER40> This is the reason I opt for alphanumeric passwords without special characters, unless a service requires otherwise. A single extra character in length more than makes up for the missing special characters and past a certain point a password simply is "strong enough".

</comment><comment><USER41> Stack Overflow is the offender that's affected (and surprised) me most in terms of arbitrary requirements. though It's a while since I've tried changing my password there so not sure if it's changed.

</comment><comment><USER42> The Covered California website suffers from the dumb password problem. It took me 6 tries with Last pass before I could generate a random password that "matched" their hidden rules.

</comment><comment><USER43> You can add Voat to the list, it has one of the most frustrating sign-up processes known to man. Most of the rules are hidden until you solve the captcha and press submit.

</comment><comment><USER44> Related. One local bank I've used forbid typing out password on keyboard. They provide a virtual keyboard and you have to click your keys one by one.

</comment><comment><USER45> What is HN's opinion on XKCD-936? Is it valid, or complete rubbish - <USER2> somewhere in-between?

The last time I researched this, I found a number of different opinions, but they ultimately trended toward it being a "good idea", with the caveat that the words need to be chosen by a truly random process, and not by the user (as then bias would creep in).

I'm not a cryptographer, though - maybe someone(s) here is and can give some further insight?

Also - if such a password is a good thing, it would probably be best to use it for a password manager, and let the manager generate long random passwords for individual logins.

If XKCD-936 is considered ok, then in theory, as long as the password field allows for reasonably long passwords (25+ characters), and simple letters and numbers - it should be ok.

The problem would then be education (for the users and developers - <USER3> convincing IT/security/management) - we've all been conditioned that passwords need to appear complex (not that they actually are for a computer). Then of course, there's the problem that this is baked into financial/banking security rules passed by Congress (so if XKCD-936 is correct, it basically means we've legislated an insecure practice in place, based on faulty knowledge at the time, for the one area where we need the most security possible)...

Thoughts?

</comment><comment><USER46> How about allowing special characters and not just a-zA-Z0-9.

<comment><USER47> Usually, there is some legacy system behind the scenes that can't be updated because reasons. Not an excuse, but it isn't always that easy.

<comment><USER48> I wonder if another reason may be the differences between traditional PCs and mobile devices with virtual keyboards. I've seen special characters that are two taps away on my phone that I'd have to look up an Alt code for on my PC.</comment></comment></comment>


Ask HN: What is the state of the art in OOP? - <AUTHOR>

I used to do a lot of object-oriented programming and found myself reading up a lot on how to do it well.
When C++ was the dominant OOP language there was a very different set of best practices than have emerged since. Some of the newer ideas I know of are BDD, internal DSLs, and the importing of ideas from functional programming.
My question is: is there any consensus on the best way to develop object-oriented software today in the more modern languages such as C#, Ruby, and Python? And what are those practices? For instance, I rather like the idea of stateless objects but how many are actually using that in practice?
Or, is the state of the art to deemphasize the importance of OOP? This might be the case for some Python programmers but would be difficult for Rubyists. <comment><USER2> State of the art is difficult to answer, given how faddish programming trends can be. It's hard to separate the truly important ideas from the ideas that are merely popular. I don't think any of the truly important ideas are all that new. Here's my perspective from inside the Agile camp:

Things that are popular and important:

\- Refactoring

\- Test-driven development

\- Closures and first-class functions

\- Domain-driven design

Things that are important but not popular:

\- Evolutionary design (aka continuous design)

\- Refactoring beyond what's built into IDEs

\- Domain and business expertise

\- Conway's Law; small, close-knit teams; minimizing dependencies on other teams

\- Minimizing maintenance costs over initial development costs

Things that are currently popular but likely to lead to pain:

\- Domain-specific languages, particularly internal DSLs

\- Behavior-driven development, particularly external DSLs like Cucumber

\- Storytest-driven development / acceptance test driven development

<comment><USER3> Hey, Can you explain or point to rational for these assertions ?

<comment><USER2> It's all my opinion, of course. I'm not aware of any objective way to evaluate these sorts of design techniques, and if you're looking for proof, you'll have to look elsewhere. (But ask yourself what proof you have for any design technique you hold dear.)

Here's a brief rationale for each one.

Important and popular:

\- Refactoring: Allows you to improve design as you learn.

\- TDD: Significantly reduces programmer error.

\- Closures + first-class functions: Enables new design abstractions which reduce duplication.

\- Domain-driven design: Nothing really new here, but it's a useful way to describe OO design that's finally making an impact on the legions of people who programmed procedurally in an OO language.

Important but not popular:

\- Evolutionary design: The only technique I've seen that actually improves code quality over the long term. See also <http://martinfowler.com/ieeeSoftware/continuousDesign.pdf> (PDF)

\- Refactoring beyond what's built into IDEs: Most people I meet don't significantly improve the design of their software when they refactor. Instead, when they need big improvements, they rewrite (and call it "refactoring"). I think that's because they don't really understand refactoring, which involves a series of small, behavior-preserving steps, most of which are not automated by IDEs.

\- Domain and business expertise: Provides context for trade-off decisions.

\- Conway's Law: I see the most defects and productivity problems at the boundaries between teams. This makes team structure an architectural question as well as a political question. When you have a large system, how do you break it into parts and who works on what? A careless approach results in a lot of cross-team communication, which leads to performance problems and defects.

\- Minimizing maintenance costs: Most software spends more time in maintenance than in initial development. See also <http://jamesshore.com/Articles/Quality- With-a-Name.html>

Popular but long-term pain:

\- DSLs: Suffer the same problems that frameworks do, but worse: When your needs diverge from the solution offered, you have to hack in kludgey workarounds. They suffer from leaky abstractions, so when they don't work right, it's time-consuming and difficult to figure out what's wrong. You're locked into their syntax, so switching to an alternate approach is difficult at best and requires a rewrite at worst.

\- BDD: Started out as "TDD with different words" and became steadily more obsessed with automated english-language specifications, which adds cost over TDD without adding significant value. The hope that business users will read (let alone write) a BDD specification is a pipe dream in nearly all cases, and programmers are perfectly capable of reading well-written code--which has the additional benefit of being more precise than english. The "fluent" interface many BDD frameworks use suffer all the DSL problems I just mentioned. External DSLs like Cucumber gravitate towards slow and fragile end-to-end tests (see next item) and also don't play well with refactoring tools, which is a maintenance problem.

\- Acceptance test-driven development: [http://jamesshore.com/Blog/The- Problems-With-Acceptance-Test...](http://jamesshore.com/Blog/The-Problems- With-Acceptance-Testing.html)

<comment><USER3> Thanks for the detailed answer. I always find it pretty difficult to objectively assess these design techniques.

</comment></comment></comment></comment><comment><USER4> Smalltalk should be a very good source of inspiration, if you're looking for an OOP reference i believe the smalltalk folks have things to say.

Being more of a lisper, I think stateless objects describe problems better suited for functionnal style and pattern matching. Relying on the type system of the implementation is a very unspecified aspect of a language. May be ok though if you know it is fast.

Rubyists still have blocks and closures, bringing in a lot of functional style, almost unnoticed.

The styles are complementary, finding the best one for the problem at hand is the art of program designers.

</comment><comment><USER5> "Object-oriented design is the roman numerals of computing." - Rob Pike

</comment><comment><USER6> I'd take the risk of pointing out that the state of the art OOP is still to be found in Smalltalk.

<comment><USER7> I'd say CLOS (<http://en.wikipedia.org/wiki/Common_Lisp_Object_System>) & Moose (<http://moose.perl.org>) myself.

However I do like Prototype based OO (<http://en.wikipedia.org/wiki/Prototype- oriented_programming>) and especially its implementation in Io (<http://www.iolanguage.com>)

<comment><USER4> Well, CLOS may be state of the art in very fine designed,exhaustively redefinable, roll-your-own aspect oriented programming, and the most exhaustive object oriented paradigm for the most fluid pragmatic language ever.

But I doubt you'll find useful sources for programming style searching for it.

If you are implementing an object-oriented paradigm for your programming language, it's a very recommendable source to discover what can possibly be done with OOP.

<comment><USER7> _But I doubt you'll find useful sources for programming style searching for it._

How about AOP? (<http://en.wikipedia.org/wiki/Aspect-oriented_programming>). I think both CLOS & Moose push you more towards this programming style.

</comment></comment></comment></comment><comment><USER8> Just 3 things that come to mind, I don't know if that is what you are looking for. It is coming from more of a C# and Java angle, than a Ruby and Python angle.

* People like Robert "Uncle Bob" Martin popularising and extending the ideas of Bertrand Meyer with i.e. SOLID principles, and design ideas focussed on quality and maintainability.

* Domain Driven Design, also in some sense a rehashing of old ideas but combined with some new ones as well.

* Service Orientation and Component Orientation could both be seen as extensions of OO to higher level design and architecture.

</comment><comment><USER9> I think OOP has become so mainstream as to become invisible. For example, HTML5, DOM, SVG, etc are OO (although defined in terms of interfaces). When you write JS code, you are mostly manipulating objects and relationships between objects.

You mention Python, it allows you to write both OOP and FP code. Functions can invoke methods on objects.

As for "state of the art" I'm learning more from reading open source project code than by reading books. I find that different languages have evolved different styles / patterns.

<comment><USER10> I find Python's OOPiness has a tacked-on feel, with copy.copy and self.x taking the place of more rational syntax. I've only looked at Ruby briefly, but it seems to be both lispier and oopier than python in an intriguing way. We'll see how I feel after using it in the real world for a bit.

<comment><USER11> What is tacked-on about this?

copy.copy: Who don't you "from copy import copy"?

self.x: It explicitly distuingishes between local variable and field access, which is the Right Thing in my opinion.

I do not understand, what this has to do with OOP at all.

</comment></comment></comment><comment> mlvl-spb-rus Newspeak (a "heir" of Self and Strongtalk), Qi and Scala, with Newspeak being the real "art" and Scala attracting more public, I think.

<comment> mlvl-spb-rus Oh yeah, and Design Contracts (Eiffel-style) are still hot (and getting hotter: we got them for C# and (in multiple implementations, one of which is from Google) Java too now).

</comment></comment><comment><USER12> Focus on interface rather than object.

Embrace explicit state with state machines and events.

</comment><comment><USER13> After years of OOP I came to the conclusion that OO is no good. It has too many problems with parallelism - you have to use way too many kludges to make your shiny objects work in parallel.

For _me_ Data Oriented Programming is the future. My data does not need to be intelligent. For that I have my central data processors. As soon as there are no "objects" that need to talk to each other parallelism becomes so hassle free.

The only case I still like OO for is UI programming.

<comment><USER14> Do you have a link to what you consider to be a good description/definition/tutorial of "Data Oriented Programming"?

<comment><USER15> Whenever I run across Data Oriented Programming it is almost always called Data Oriented Design. You focus on your data and what transformation it needs to undergo to become output. Noel's blog is probably the best source of information for that style of programming I have seen.

<http://gamesfromwithin.com/data-oriented-design>

<comment><USER14> Thanks, that's an interesting article.</comment></comment></comment></comment>


Group So Desperate to Go After Popcorn Time That It Threatens a Blog Software - <AUTHOR> https://www.techdirt.com/articles/20150129/06555929849/anti-piracy-group-so-desperate-to-go-after-popcorn-time-that-it-threatens-blog-software-maker.shtml

<comment><USER2> This is a perfect example of how broken the system is.</comment>


Hacking the grid in preparation for war? - <AUTHOR> http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9131275&taxonomyId=17&intsrc=kc_top

<comment><USER2> Why are these things on a public net in the first place? (Other than the detail that it's probably cheaper to do it that way.) The control systems of vital infrastructure should be on their own network, with authentication through public key cryptography.

<comment><USER3> This is a great point.

The California Department of Justice has a huge private network (On RFC 1918 space) that police stations and other government agencies must use to connect to the databases that the CA DOJ provides.

</comment></comment><comment><USER4> Preparing for war? Sound like FUD to me.

Being prepared in the event a war happens is more likely.

<comment><USER5> Putting in place the tools to disable infrastructure is an act of war, so is reconnaissance. It may not be an overt action, but it is a real and quantifiable threat.

Of course most of the SCADA systems out there are pretty much hopeless if they are connected to the internet at all.</comment></comment>


Amazon's letter to the FAA requesting sUAS/quadcopter exemption - <AUTHOR> http://www.regulations.gov/#!documentDetail;D=FAA-2014-0474-0001

<comment><AUTHOR> "Amazon shares Congress's goal of getting small aerial vehicles (a.k.a., small unmanned aircraft systems, or "sUAS")"

AMZN is:

 __* "Testing a range of capabilities for our eighth‐ and ninth‐generation aerial vehicles, including agility, flight duration, redundancy, and sense‐and‐avoid sensors and algorithms;"

 __* "Attracting a growing team of world‐renowned roboticists, scientists, aeronautical engineers, remote sensing experts, and a former NASA astronaut."</comment>


Unlimited Clubbing/Shows with Monthly Subscription - <AUTHOR> http://www.joinlisted.com <comment><USER2> This is interesting - how does one price out this membership? Different venues charge different amounts for different shows, how can you possibly loop them all in together and make sure everyone makes money?</comment>


Help scale the npm registry - <AUTHOR> https://scalenpm.org/

<comment><USER2> Yesterdays discussion: [https://news.ycombinator.com/item?id=6802203](https://news.ycombinator.com/item?id=6802203)

</comment><comment><USER3> Check this out...

* Commercial PaaS hosting firm, nodejitsu, is asking for donations to pay (or help to pay) for the costs of running npm.

* Nodejitsu uses Joyent infrastructure to host npm and is a Joyent partner ([http://www.joyent.com/partners/nodejitsu](http://www.joyent.com/partners/nodejitsu))

* Nodejitsu plan on using said funds to purchase additional resources at Joyent, where npm is currently hosted.

* Joyent own the trademark for Node.js

Er, say what?...

<comment><USER4> npm isnt hosted at joyent, npm isnt wrtten in node, its CouchDB, theres more details @ [http://blog.nodejs.org/2013/11/26/npm-post- mortem/](http://blog.nodejs.org/2013/11/26/npm-post-mortem/)

Even if it were, not sure what the issue would be, npm is a public service that costs money to run, they are asking for money from people who use that service.

</comment></comment><comment><USER5> I would be glad to donate bitcoin if they accepted it.

</comment><comment><USER6> they'd be able to handle webscale if they redesigned their platform using node.js</comment>


Projected losses of global mammal and bird ecological strategies - <AUTHOR> https://www.nature.com/articles/s41467-019-10284-z <comment><USER2> This is a really good read for stats people, this paragraph in particular kind of freaked me out:

> After 100 years of projected extinctions, the global composition of mammals > and birds is predicted to shift to smaller (permutation test: body mass > observed mean = 70.3 g, body mass projected mean across runs > [minimum–maximum across replicates] = 64.1 g [63.4–64.7 g]; P ≤ 0.001), > faster-lived (generation length observed mean = 4.27 years, projected mean = > 4.22 years [4.21–4.23 years]; P ≤ 0.001), more fecund (litter/clutch size > observed mean = 2.51, projected mean = 2.55 [2.54–2.56]; P ≤ 0.001), more > generalist (habitat breadth observed mean = 3.23, projected mean = 3.32 > [3.31–3.33]; P ≤ 0.001) and more invertivorous species (diet observed mean = > −0.00032, projected mean = 0.0012 [0.00087–0.0014]; P ≤ 0.001) > (Supplementary Figs. 5f and 7). These shifts are relatively large for the > species pool and temporal scale investigated, for example, Davis et al.10 > showed that current median mammal body mass is 14% lower than during the > Last Interglacial (~130,000 years ago), while we predict an extra 25.2% > (23.9–25.8%) reduction in median mammal body mass over the next 100 years > from the current level. These declines in body mass equate to a reduction > rate of −0.00011% per year between the Last Interglacial and now, compared > to a predicted reduction rate of −0.25% (−0.24 to −0.26%) per year between > now and the next 100 years.</comment>


Microsoft: iPad's Closed Platform is "Humorous" - <AUTHOR> http://technologizer.com/2010/01/28/microsoft-ipads-closed-platfor-is-humorous/

<comment><USER2> No Microsoft, this is what's humorous:

 _Developing applications for the iPhone and iPad is expensive, he said, because iPhone OS uses the Objective C language rather than Microsoft's more pervasive .NET platform._

<comment><USER3> Same here, I literally laughed out loud at that, and read it to a nearby programmer. I've used .NET and Cocoa, he's used .NET, and we both think it's a laughable claim. Personally, I _vastly_ prefer Cocoa's API / frameworks to .NET.

Programming for Apple products is frickin easy.

</comment></comment><comment><USER4> _"With Microsoft's platforms, developers can build whatever they want"_

Except on the Zune & Xbox platforms that is.

<comment><USER5> If you can compete with the million dollar budgets of video game companies I don't think anybody can stop you from developing for Xbox.

<comment><USER4> Microsoft certainly can. You have to accept their license agreement and possibly an NDA to develop on the Xbox platform. I don't think the exact terms are public knowledge. We can look at the XNA license/participation terms for some hints though:

 _"Microsoft reserves the right to take down a game retroactively without notice. Microsoft encourages peer reviewers to report objectionable content in a game."_

 _"Peer reviewers will reject your game if:

-Your game contains prohibited content, which is content not allowed on Xbox LIVE services -You misrepresent what is in the game play or in the promotional materials for the game. All games must have a trial mode that showcases the actual game experience. If you fail to do so, or use this method to provide your game for free, your game will be failed in the Peer Review process. Games are NOT available for free currently on the system. This system is NOT a video hosting service and should not be used as such. -The promotional content for your game ( for example, the box art, description, banner or title) is not appropriate for all ages on Xbox LIVE Marketplace -The game crashes, it has too many bugs, or it is technically defective in some way"_

<comment><USER6> If I understand this correctly, you can't make free games for Xbox? At least you can make free apps for the App Store.

<comment><USER7> Worse, you can't make free _updates_ for Xbox games. MS demands that all additional content cost money - this has been a point of contention between Valve and MS recently, as they are in the habit of releasing frequent, small content packs their games, and the pricing structure prevents this.

<comment><USER8> I'd like a source for that claim, because there are some free DLCs for XBOX 360 ...

</comment></comment></comment></comment></comment></comment><comment><USER3> I love Gruber's assessment:

 _Yes, there is much jealousy from iPhone developers at the sacks full of money being made by Zune and Windows Mobile app developers._

<http://daringfireball.net/linked/2010/01/29/msft-ipad>

</comment><comment><USER9> Show us how to design a mobile platform, Microsoft.

</comment><comment><USER10> I think that the author is completely right about the iPad (the names still makes me grimace) being an appliance. As are all of Apple's products, more or less. Microsoft is a little off the mark on this one, but it IS their job to criticize their competitors. I look forward to seeing their technological rebuttal since they sound so cock-sure. They better act fast.

<comment><USER11> Well... Microsoft has had tablets around that can do all of those things for a while. They can do more, actually. No, they do not look as sleek nor are they as targeted. However, all it takes is one hardware vendor to put together something solid together and MS has a strong competitor to the iPad that doesn't tie one down and could provide a much richer applications world.

<comment><USER2> This attitude is why so few companies even come close to replicating the Apple experience. It's not about "what the device can do", it's about elegance and design from end to end. No one will ever make a Win tablet that can compare to the iPad because the applications will not target that specific device, they will always have a watered down UX.

<comment><USER11> Maybe I just don't get it, but if the opportunity is there, then what stops an established company or a startup from making a tablet that does exactly this but is more flexible? Probably easier with a linux variant? My point is that this device could likely easily be replicated with a ux that treats the owner like an owner. By restricting everything so much, Apple has seriously limited its options -- especially in enterprise computing.

I don't know if the tablet market will progress the same way as the smart phone os market has, but I doubt Apple has hit a home run here. I look for a "Symbian tablet" or RIM-like product to take the majority of the market share and profits.

</comment></comment></comment></comment><comment><USER12> I wonder if Brandon will stop by to comment on this: <http://news.ycombinator.com/user?id=BrandonWatson>

<comment><USER13> Well, not here, but he has commented on this: <http://www.manyniches.com/fun- stuff/broken-tablets/>

</comment></comment><comment><USER14> When did fanboys become apologist?</comment>


Fast JSON parser for iOS - <AUTHOR> http://blog.nextive.com/392-nextive-json-parser-for-ios-and-mac-os-%E2%80%93-fast/

<comment><USER2> Any company that wants to show benchmarks should, at a minimum show:

        1. The hardware on which the tests were run
        2. The software (OS) on which the tests were run
        3. The design of their benchmarking utility
        4. How much memory/CPU was available for each test (i.e. how much crap is running in the background)
        5. The version of each thing (parser) they are testing
        6. How many trials they ran for each test (no reason for a test like this to not have several hundred or thousand)
        7. The average and standard deviation for each thing (parser) they are comparing
        8. The data ran for the tests. (Some data suites may favour certain parsers over others). Best case: running different kinds of data suites in separate tests, to see if some things (parsers) handle certain kinds of data better than others. (i.e. there might not be a global optimum parser)

Additionally, they should also run the parser on a few passes prior to starting benchmarking to "warm it up". This reduces variance in the runs, especially via things like initialization/memory allocation in the first run.

Without most (or all!) of that kind of information, one can't make a reasonable judgement.

<comment><USER3> It looks like he ran Sam Soffes' json-benchmark: <https://github.com/samsoffes/json-benchmarks>

That being said here are the results I got on my iPhone 4 (compiled with -Os) Reading: <http://yfrog.com/khul0wsj> Writing: <http://yfrog.com/h0nqgzej>

<comment><USER2> Interesting, but several of the questions I posed remain, some of I suspect which will explain the significant differences between your measurements and theirs. Except for one: NXJson is exponentially slower at reading for you than they claim it is for them, which may be hard to explain away...

</comment></comment></comment><comment><USER4> haberman's rule for publishing benchmarks: you don't get to claim that you're >2x faster than your already-highly-optimized competitor without explaining why. If you don't know why, you need to figure out why. Without explaining why, I will assume that it's not an apples-to-apples comparison, or that you made a mistake in your benchmarking.

</comment><comment><USER5> Not quite. See these tweets from the author of TouchJSON (Spoiler: JSONKit is still faster, TouchJSON still has a better interface):

<http://twitter.com/#!/schwa/status/94835100075819008> <http://twitter.com/#!/schwa/status/94840915075674112>

</comment><comment><USER6> It's not even plausible. Native binary plist reading is typically about 2x as fast as JSONKit (in my informal benchmarks).

So they claim to be about an order of magnitude faster than binary plists, which would be astonishing if it were true.

</comment><comment><USER7> Somewhat off-topic, but looking at the readme of JSONKit [1] I found: "At this time, there are no plans to support ARC in JSONKit. Although tenative [sic], it is extremely unlikely that ARC will ever be supported, for many of the same reasons that Mac OS X Garbage Collection is not supported."

Which seems kind of weird, seeing as ARC is going to be the default pretty soon.

[1] <https://github.com/johnezang/JSONKit>

<comment><USER8> Not that this matters, though, because ARC and non-ARC code can call each other.

</comment></comment><comment><USER9> Anyone benched this against a binary protocol like thrift or protocol buffers?

</comment><comment><USER10> If JSON parsing is a bottleneck in your application, you're doing it wrong.</comment>


Why Android isn't gaining on Apple in the Enterprise - <AUTHOR> http://www.appleinsider.com/articles/12/01/28/why_android_isnt_gaining_on_apple_in_the_enterprise_.html <comment><USER2> Working for a company that serves big pharma, I have the following observations:

The iPad is _the_ game changer for the mobile worker (pharma reps). Companies are taking away their sales reps MS laptops/tablets and replacing them with iPads. Why?

1., Unbreakable compared to classic hardware. Both in hardware as in software. No moving parts, light, powerful enough, so easy to use that reps can't claim anymore to be baffled by it. Cheap. No enterprise MS tablet PC comes close.

2., Far lower TCO, as the IT overhead is far lower. Virus Scanners? Custom OS images? Gone. A fully controlled, curated environment. Even if a user installs something, it will not break the system or steal your data. If an iPad gets stolen/lost, remote wipe and buy a new one. Log in, restore, done. Apple suddenly allows for bring your own hardware - the wet dream of enterprise IT.

3., Completely homogenic hardware, _globally_. This is the most important point. Wherever you buy an iPad, from Brazil to Korea, it is exactly the same. Same hardware, same OS. With notebooks? Lenovo, HP, Dell. And they change their models all the time, warranting a new driver here, a different OS image there.

4., The death of Blackberry is on the wall, making the iPhone the natural successor - for the above points.

Now, what about the MacBooks and iMacs? Looking at my company, once the iPad is in, those follow. If the majority of users is on iOS, there are no benefits of being on Windows. Most admins like Unix-style anyhow, and OSX is a great UI for that.

Managers are the ones left, and here the MacBook Air is gaining traction. It is sleek, light, and works. Plus, IT can standardize on it. Also, as people create slide decks, Keynote is seriously cool shit. Those presentations work seamlessly on iPad, whereas PPT breaks. Strong incentive there to switch.

The last big footholds of MS in the Office are Excel and Outlook. But both are available on OSX, and some argue in better shape than their Windows brethren. The biggest gap of Apple is Excel on the iPad. Whoever releases a fully compatible iOS Excel version/clone will accelerate the demise of MS in enterprise desktops.

Servers are completely different discussion, the MS Exchange/Sharepoint/Dynamics/SQL Server behemoth is here to stay. This battleground will shift due to SaaS.

<comment><USER3> > 4., The death of Blackberry is on the wall, making the iPhone the natural > successor - for the above points.

I can't speak for the pharmaceutical industry in America, but from what I've noticed in the financial industry in the UK a lot of people are ditching their Blackberry's and are moving to either Android or, surprisingly, WP7. One of the large financial services companies I've worked with is switching all of its employees to WP7 this year, and I wouldn't be surprised if this is where Microsoft find their area.

<comment><USER4> WP7 is probably a good choice if you're a big Microsoft dev shop and are actively developing custom tools. I've been told that development for WP7 is pretty easy for existing .Net programmers.

All of this is great news for the industry -- a robust market is a good thing.

</comment></comment></comment><comment><USER5> I feel like there really only one primary cause of iOS's (unexpected) enterprise success: it's a prestige phone.

We can wax poetic about the democratization of corporate IT processes, or specific technologies, but IMO those are all herrings, or minor causes at best.

At the end of the day, Apple introduced an incredibly prestigious product at the very highest end of the market. It had cachet and desirability, and when your SVP buys that drool-worthy envy-of-the-office phone, he damn well wants to use it with his email, and damned what IT thinks of it.

I suspect Android's success in the enterprise space hinges on a similar product - if someone can come up with the "oh my god I must have it" phone in Android-land, the enterprise support will follow.

<comment><USER6> In my experience that's pretty much the exact opposite of how enterprise IT works. That's why we tend to end up with so much miserable hardware/software. It's usually a calculation of cost/technical adequacy/ease-of-support. User preference or usability in general is not a big concern. Many companies have only recently begun to replace BlackBerries on a large scale. If you were correct we would have seen huge adoption of the iPhone 3G in the enterprise 4 years ago or maybe the iPhone 3GS 3 years ago. It's a trend that has really picked up only in the last 2 years or so on a large scale.

We have an IT company that is outsourced to handle all this stuff for us and they only deploy iPhones. They recommend replacing BB/Android devices via forklift upgrade. They actively do not support Android. If you're using anything other than BB/iPhone you're on your own. This is just one company out of probably thousands that provide similar services so maybe it's not a common policy. It was pretty sobering to me though. It reminds me of the Mac in the enterprise in years past. If you somehow managed to sneak one in the backdoor you wouldn't actually be allowed to use it. If this is becoming a common policy for Android devices then Google has a huge uphill battle. These types of companies aren't going to be re-evaluating their policies very often.

<comment><USER7> Another reason: updates

No one, not even Google, the carrier or the manufacturer can guarantee if you'll be able to install a security update on that Android phone you deployed to 2,000 sales people 6 months ago.

</comment></comment></comment><comment><USER8> I've often heard it said that (nearly every time Apple in the Enterprise comes up) the conventional wisdom is that Apple doesn't experience larger gains in the enterprise because of the culture of secrecy whereby it doesn't give advance information to large corporate buyers any more than it does to the average consumer. It's something of a surprise to me that this wasn't mentioned in this article.

Doubly so because a number of the other vendors of Android devices (Samsung, Sony, LG, ASUS) have a much more favorable history on releasing information about upcoming products so that enterprise support can be ready for them. Also, a lack of that culture of secrecy would seem to be more favorable for sharing more technical information up-front for deeper integration with corporate partners. Whereas I don't get the impression that Apple really views any enterprise customer as a partner, but rather as another customer.

<comment><USER9> Conversely, Apples does have a history of long-term support for the products they do release, so in that sense, the future is extremely predicable ... more so than other players in the mobile space. The predictability of support is perhaps more valuable than the predictability of new shininess.

<comment><USER10> This is much more the case for Apple in mobile than in their other products. The churn from OS 9 -> X, PPC -> Intel, and multiple breaking changes to APIs etc over the same time period made supporting Macs at the "enterprise" level quite challenging.

</comment></comment></comment><comment><USER11> As a member of an enterprise IT, and one that has been involved in out testing and decision making I'd put it down to three things:

1\. Android support for Exchange is generally awful. I can't speak for ICS, but many of the android phones we tested wouldn't do calendar sync, or would randomly stop receiving emails, requiring hard resets, or would have little to no global address lookup. In contrast, iOS has had very good exchange support since at least iOS 3, and it is rock solid.

2\. Android still doesn't work with our Cisco VPN, iOS has since at least v3.

3\. Beyond the internet and PIM software, we have been more successful finding quality apps. Too many apps on both platforms are lightweight things without much use in a business environment, but there are some decent application to be found on iOS (the Omnigroup apps come to mind.). There is also better support from business focused companies like VMware, ESRI, Autodesk, and all the conferencing companies like WebEx.

<comment><USER12> I must be walking under a silver lined cloud; I've had an original droid since launch day over 2 years ago, and now an ICS Galaxy Nexus since launch day, and the Exchange integration has been better than my Windows PC, by and large. I've never had any of the issues you mention. I don't doubt you've had them, but I have not. I frequently get "dinged" on my phone for new email before Outlook. (I will admit that deleting a mail on outlook takes up to 5 minutes to "be gone" on the Android.)

But never any calendar issues. Never any dropped mails. Never any needs to "hard reset". Lookups work as well on my phone as they do on outlook, for me.

</comment></comment><comment><USER13> The fragmentation mentioned in the article to me highlights one of the main reasons why enterprises shy away from Android. On iOS, there is ONE email/calendar client with a known set of features/limitations. On android, almost every manufacturer has their own email client and their varying feature sets and bugs are not documented anywhere. For example: <http://code.google.com/p/android/issues/detail?id=4760> How many posts in there are from google employees stating that it's not their problem because the email client the person is complaining about isn't written by google?

</comment><comment><USER14> I feel like one of the major changes in a Steve Jobs-less Apple is going to be an increased emphasis on the corporate market. This was historically one of the major differences between Apple (focused on end-users) and Microsoft (primarily focused on corporate enterprises--Paul Allen has a lot to say about this in his recent biography). To see Apple succeeding in this market is pretty exciting for them.

</comment><comment><USER15> our company wont go android because of the inability to remote wipe and the open android app store.

<comment><USER16> You can remote wipe (among other enterprise things) using google apps for business and the google apps device policy app.

[http://support.google.com/mobile/bin/answer.py?hl=en&ans...](http://support.google.com/mobile/bin/answer.py?hl=en&answer=190930)</comment></comment>


Announcing CircleCI Japan - <AUTHOR> https://circleci.com/blog/announcing-circleci-japan/ <comment><AUTHOR> They took down the link for a little while but it's back.</comment>


The Clock of the Long Now - <AUTHOR> http://blog.sciencemuseum.org.uk/collections/2013/07/31/the-clock-of-the-long-now/

<comment><USER2> I've always been fascinated by these functional time capsules, intended to communicate ideas rather than just entertain people with the novelty of historic artifacts.

One such project relates to how to communicate danger (nuclear waste) to a society 10k years hence - one possible answer being: you don't bother, they'll just have to learn to avoid it.

[http://www.wipp.energy.gov/fctshts/warned.pdf](http://www.wipp.energy.gov/fctshts/warned.pdf)

[edit] this is a nice summary of the full report, with a link to the original document (350pp)

[http://www.damninteresting.com/this-place-is-not-a-place- of-...](http://www.damninteresting.com/this-place-is-not-a-place-of-honor/)

</comment><comment><USER3> Nice looking guilloche escapement train with complication, but for very long term durability, I'd back the Jura's molecular biologists certifying DNA's proven reliability.</comment>


Four psychology principles every UX designer should know - <AUTHOR> http://whatusersdo.com/blog/four-psychology-principles-every-ux-designer-should-know/ <comment><USER2> One of those articles you're really glad someone did a nice research and put it all together. Thanks!</comment>


How do do you amplify a start-up culture inside a big company? - <AUTHOR> http://gapingvoid.com/2010/10/18/how-do-do-you-amplify-a-start-up-culture-inside-a-big-company/ <comment><USER2> i was at meetup.com HQ tonight, and they kept saying that they have "startups within a startup" - to refer to teams that are working on various features/products.

i think a key to doing this is to encourage small and self-organizing teams. have teams that include a sales person, developer, product person, and qa person, and make them sit together, instead of having people sit and work by department.

<comment><USER3> At a place I used to work at, this small group mentality was pretty successful, though it was usually a selection of top tier designers/developers/project managers. It just meant that if you were a part of it, it was amazingly fun. But if you weren't...</comment></comment>


Did Google just offer Pinterest $2B? - <AUTHOR>

A family friend, who happens to be a well known entrepreneur/investor, just mentioned that he heard Google offered to buy Pinterest for $2B (and they turned it down). Anyone have any merit to this "rumor"? Just curious... <comment><USER2> The Business Potential with Ads and Ecommerce is huge on Pinterest and with the current trends of acquisition, $2B is more or less the right price of Pinterest. But that would bring it to $100 / user ( if you take the 2M users number from this TC article <http://techcrunch.com/2012/02/11/pinterest- stats/> )

<comment><USER3> That was way back in February. Last I looked they were up to 7M users, and that was probably a month ago.

A recent USA Today article says that their 'active' logins are 'leveling off' to 8.3M, from 12.2.

</comment></comment><comment><USER4> If Pinterest was worth that much, I wonder how much Reddit would be.

<comment><USER5> Not $2 Billion. Pinterest is valuable because the site's users show interest in products by pinning or liking them. That's a marketing goldmine for brands and advertisers. Not to mention Pinterest is driving huge amounts of traffic to e-commerce sites.

Sure, Reddit get insane amounts of traffic but cat pictures and comics aren't nearly as monetizable.

</comment></comment><comment><USER6> Serving hyper-targeted ads on pins?

</comment><comment><USER7> That would be mental! $2B!?

</comment><comment><USER8> Don't scare us!</comment>


Adobe CS4 is shipping (link to faster HTML store) - <AUTHOR> https://store1.adobe.com/cfusion/store/html/index.cfm?store=OLS-US

<comment><USER2> Seeing as I already bought into CS3, this is a generation I'll skip and spend that money on other aspects of my business.

</comment><comment><USER3> 18GB download lol. it says "27 hours for DSL connection"</comment>


Convert and host dynamic website as static - <AUTHOR> I have a personal old website thats comprised of Geeklog and Gallery (php). I want to be able to offer the same contents at the same address but with static files. I've looked into a few tools like ArchiveBox but they don't seem to fit. <comment><USER2> Any website crawler should do it, for instance wget. However, I don't know any tool which tries to preserve URLs.</comment>


Why Publishing Salaries Results in the Opposite Effect - <AUTHOR>

Why is that we know the exact price of a gallon of gas more than the exact amount that's withheld from our paycheck due to taxes? We have occasion to interact with both amounts on about the same schedule, and the amount that's withheld from our paychecks is significantly more. But we spend much more time looking at the price of gas, as we stand next to our cars, waiting for it to be pumped in.
When you publish salaries to show your culture of trust and transparency, you are also showing your culture of caring what salaries are. And your culture that it's important to know what other people are making. All of this serves to elevate the importance of salary across your organization (and potentially also trust and transparency).
If your goal for your organization is to have a culture that is that is not focused on salary, it's hard to defend the decision to publish everyone's salaries and make a big splash out in the world in your blog and in interviews about how your culture includes publishing salaries.  Salaries, salaries, salaries.  You'd be much better off segmenting salary conversations to a particular time (or times) of year, having those as individual conversations, and framing those conversations to your organizational culture--"we want to make sure you're being properly compensated... now let's get back to being great!"
There is a concept in social psychology called the "ironic effect"--essentially, if I tell you to stop thinking about pink elephants, you're going to think about pink elephants.  The same problem applies here--if I publish everyone's salary to show how transparent the organization is, I'm also going to bring salary front and center to my organization and its culture. <comment><USER2> It's easier than that.

One argument you'll hear a lot is that publishing the salary table is more fair to employees. Employers know what they're paying everyone, you don't, so they have more information than you during the hiring process.

The problem is, most of that information isn't relevant when you're negotiating salary. What's relevant is the market. Employees who have been at the company for a while, particularly in engineering, probably haven't been given raises and bonuses sufficient to keep up to what they'd make if they hopped jobs.

Publishing the salary table takes a nuclear option against the ability of employees to negotiate salary. "This is what we're paying everyone according to the formulas we use."

The ONLY party who benefits from open salary tables is the employer.

And really, they're shooting themselves in the foot, because they've just drastically shrunk their pool of potential hires. Particularly engineers. Even if potential hires love your company - they have bills, a family, career plans, aspirations to retire in a few years and start their own company.

And there are a lot of competing companies which would LOVE to negotiate a bit on salary in order to attract the talent they need.

</comment><comment><USER3> Employees not focusing on salary may be good for the employer, but even the least money-minded employee will begin to care about the amount of money they are making, at some point. As an employee, there is nothing wrong in focusing/being motivated by money among other things.

<comment><AUTHOR> I agree that there's nothing wrong with being motivated by money as an employee, but there's lot of strong research that, as an employer, you keep more employees based upon non-monetary aspects of the job. If, as an employer, you start focusing on money, it better be because you (a) want that as your culture, and (b) can pay a whole lot.

</comment></comment><comment><USER4> I'm curious to watch how this plays out.

Personally, I wouldn't experiment with something that's not the core product in my startup. Too many risks / unknowns already without monkeying with salary stuff.

<comment><AUTHOR> Great point--unless you need your core competency to be "innovator in HR policies", why spend any time there?</comment></comment>


SoftBank terminates $3BN tender offer for WeWork shares - <AUTHOR> https://techcrunch.com/2020/04/02/softbank-terminates-3bn-tender-offer-for-wework-shares/ <comment><USER2> Adam Neumann will now have to fly business class. No more private jets

</comment><comment><USER3> Interesting, what happens next here?

<comment><USER4> One assumes that Mr Neumann will only be able to buy three golden yachts instead of five?</comment></comment>


Shoebill – A Macintosh II emulator that runs A/UX - <AUTHOR> https://github.com/pruten/shoebill <comment><USER2> Awesome. I've been dying to try A/UX for years. My only mac that could run A/UX died a few years ago. Getting ridiculously old computers and operating systems running is a fun hobby.

</comment><comment><USER3> "Requires a Macintosh II, IIx or IIcx ROM, and a disk image with A/UX installed".

That's kind of a tall order.

</comment><comment><USER4> Fun. Back in the very distant past I worked on a B-level secure version of A/UX. Honestly, A/UX was a pretty awful mishmash of crufty old SVR2, some BSD chunks and a smattering of SVR3.</comment>


Show HN: Simpla – content management as a service - <AUTHOR> http://simpla.io

<comment><USER2> What is the kickstarter for? You seem to have a product, you even have pricing tiers posted.

<comment><AUTHOR> Kickstarter is to help launch the infrastructure around it - the prototype at [http://simpla.io](http://simpla.io) is the frontend library, you can't save changes yet. We've built out most of the actual API (it's pretty minimal, clientside does all the heavy lifting), just need a few more things in place to get to private/public beta that we won't be able to do in a reasonable timeframe without a bit of extra runway - hence the small campaign.</comment></comment>


Cloudflare: Welcome to Crypto Week - <AUTHOR> https://blog.cloudflare.com/crypto-week-2018/ <comment> n-gate Points for trying to reclaim the word crypto.</comment>


OpenBSD patches rumoured Spectre-like vulnerability - <AUTHOR> https://v4.freshbsd.org/commit/openbsd/src/SqjSSDleV3uNd05n <comment><AUTHOR> Intel obviously failed to disclose information to OS providers like OpenBSD, but leaked information about the vulnerability by disclosing to the wrong parties, so they patched it based on the rumours.</comment>


Ask HN: Have you ever enjoyed completing a form? - <AUTHOR> Why are forms so annoying to complete <comment><USER2> Because they usually ask for one (or several) of the following: \- Basic information that could be retrieved automatically (say from an ID card or a driver's licence) but that you have to input on every form: name, address, date of birth... \- Questions that are unclear or have no good/definite answer: race (for someone with a very diverse ancestry or who's not American), state (when your country doesn't have any), questions about administrative categories you know nothing about.. \- Questions that ask for information that is hard or unpleasant to retrieve: passport expiration date (you need to take out your passport and check), amount of taxes paid last year, zip code of parents' place of birth, list of countries visited in the past 10 years with dates of stay. \- Questions that are repetitive (on psych /HR questionnaires for instance)

I don't think forms are naturally boring (I tend to like questionnaires from marketing surveys and the like for instance). Asking people about themselves and letting them answer somewhat freely will be fine.</comment>


Technical co-founder needed for Studeous - <AUTHOR>

We're looking for a co-founder for Studeous, a web start-up.
Studeous is the SalesForce.com of the e-learning industry--we provide an easy way for teachers to manage their classes online on our web platform, as opposed to typical enterprise e-learning systems. We're looking to commodify e-learning.
We have users, we've already made sales, and we're in the process of raising capital.
We're looking for a super hacker who is an expert at:
MySQL
System/Server Administration
Scaling/Optimization
CSS
Coldfusion experience would be preferred, but is not completely necessary
Overall great product dev skills
We launched in private beta last March, and we need more hands on deck.
We are located in the Dallas/Austin, Texas area.
You can contact Jeff West at email@example.com for more information. <comment><USER2> When looking for your technical co-founder, don't specify the technologies. This is not a job ad. Your start-up will be shaped around your co-founder's skills, not the other way around. You want the best co-founder you can get - technologies are irrelevant.

Also, if you're in beta since march, it's a bit late to find a technical cofounder don't you think? You're looking for an early employee, perhaps?

<comment><USER3> I think it's fine to specify the technologies, it's kind of like online dating. You specify your "interests" to find other people with common interests.

In this case, one cofounder already likes Cold Fusion and developed in it, so it makes sense that he's looking for another cofounder with the same taste in programming.

<comment><USER4> Online dating kinda sucks. Are you sure that's a metaphor you'd like to build your cofounder relationship on?

</comment></comment></comment><comment><USER5> From a marketing perspective:

What is the fire burning in the pants of your market? (And who is your target market -- you've got teachers and students and school admins, please pick one.)

The first thing I see what I visit your site: "You've never seen elearning like this before." As a teacher, how does that help me?

I can tell what you're doing. You are trying to position yourself as a competitor in the marketplace. You are coming from a position of weakness when you do this.

Features page: "Just go ahead and try to outfeature us." WTF are you even talking to? How does that apply to me as a teacher? When did more features make a project better?

Forget your competition and get yourself into the boots of a teacher. Feel the pain a teacher feels when they aren't using your software.

Where are the testimonials from teachers that are raving about your software? "Last year, I couldn't get my students to stop chatting with each other during class. This year, I signed up for Studeous, set everything up and 95% of my class is logging in each day and 85% are actually talking to each other on the message boards. I'm absolutely giddy!"

<comment><USER6> >What is the fire burning in the pants of your market? (And who is your target market -- you've got teachers and students and school admins, please pick one.)

WebCT and blackboard (the competition) are utterly unusable from a teacher and student perspective. I'd love to use something different if I ever have the need for more than just HTML. The main thing I'd like is a grade management system when I deal with large courses.

However, I'm almost certainly not permitted to use a grade management system besides the one my university provides, certainly not a third party one. That would violate student privacy.

Another problem is that commercial software can't (legally) add all the features of blackboard:

<http://www.blackboard.com/patent/FAQ_013107.htm>

<comment><USER7> _I'm almost certainly not permitted to use a grade management system besides the one my university provides, certainly not a third party one. That would violate student privacy._

Are you allowed to use a notebook?

</comment></comment></comment><comment><USER8> IMHO the ColdFusion requirement is more likely to get you a failed enterprise guy instead of a hacker that actually enjoys the work.

<comment><USER9> Yeahh.. probably true. I don't know of a single decent hacker who enjoys working with ColdFusion

<comment><USER5> Don't be too hasty in judgment.

My brother is a very good ColdFusion programmer. He got his start in the language because it was what I was programming with at the time. (Don't forget, around '99 when I got my start, there was Perl, ASP and Coldfusion as serious contenders.)

I ask him, "Why don't you give PHP or Rails a whirl?" "No interest." And so he focuses his effort in refining his ColdFusion skillset. He does Ajax and does CSS design with the best of them.

<comment><USER10> I personally don't use ColdFusion but I guess there are some CF haters around these parts. I guess that why you were downmodded. But please as hackers we love certain bits of technology and swear by them or perhaps swear at them lol(PHP comes to mind). I understand you as my brother also loves the ActionScript family of languages. And does not have any interest learning anything else.

<comment><USER11> It was probably downmodded because of the "no interest" in learning anything else.

Any programmer worth his/her salt should be always learning newer technologies that might be useful to him/her. Having a favorite is different than not wanting to learn anything else.

</comment></comment></comment></comment></comment><comment><USER12> Interesting product. I worked on a web-based LMS (not Blackboard) for several years.

The trick with this market is finding a way to squeeze out a profit. There's a very limited amount individual teachers are willing to spend, but selling to districts is a major undertaking - think dedicated salespeople working for a year or more on each account. They don't much like small companies either.

The other big issue is legacy system support. Districts won't buy a LMS that doesn't integrate with their student information system, which is unfortunate since the SIS vendors jealously guard access to their walled garden. (They all have their own LMS products now and don't want their customers buying yours.) We poured man-years into this problem and only covered a tiny subset of the products out there. It's a huge potential morass.

Pretty much everyone working in this field recognizes how bad the products are, but not always the reasons. The users - teachers and students - don't have much input into the decision-making process. Endless sales cycles ensure high prices, and that means the decisions are made by administrators at the district office who never come anywhere near the software. It takes years to make a dent in this market.

</comment><comment><AUTHOR> ColdFusion experience is not a requirement, only preferred and not absolutely necessary. If you've got the skills and you're interested, let us know.

</comment><comment><USER13> at that stage you need to start looking for employees, not co-founders. Just call it a CTO position and give the person stock options.

</comment><comment><USER14> Wow, asking for coldfusion? You might as well build it with classic ASP. In a matter of years you will not find any host but your own to support your end- of-life legacy product.

I'd go with COBOL and RPG. They represent the most solid UI kits available with many users (i.e. Banks).

</comment><comment><USER15> How do you plan to compete with Blackboard? Do you have a plan for dealing with their patents on eLearning?

<comment><USER16> There's little evidence their patents are meaningful at all. Almost always, the best course is to ignore patents entirely and forge ahead. Most software patents are unenforceable.</comment></comment>