Gmail and Drive - a new way to send files - <AUTHOR> http://gmailblog.blogspot.com/2012/11/gmail-and-drive-new-way-to-send-files.html <comment><USER2> Totally off topic but blogspot is just awful. Why does everything have to be a complicated buggy JavaScript app? There's nothing wrong with serving up good ol HTML pages, especially for simple text and images content like a blog.

<comment><USER3> I despise this new trend, and it kills me that Google seems to be embracing it more and more.

Google Groups is the worst offender for me - it completely breaks my browser's keybindings for going backwards, so every time I'm, eg. searching Googling a bug and open a mailing list archive to find an answer to a bug, I inevitably end up collapsing the thread each and every time, when what I really want is just to go back to the search results. I don't want every Google website to have its own tiling window manager within the page - that's what my OS is for!

Of course, they have no intention of fixing this, it seems. Disabling Javascript just yields an error message - 'Please turn on Javascript to view this page'.

<comment><USER4> I totally agree. Not only does it disrupt bindings and make pages slow to load, but at least once a day Chrome now freezes when I do a Google search - the results page loads, but I can't click on anything and if I scroll down the bottom of the page hasn't been rendered at all. Nothing for it but to reboot Chrome 3 times (it dies silently the first two).

I still love Google overall (so yay on mailing big files and yay on Gmail generally), but the endless feature creep is a weakness, not a strength.

</comment></comment></comment><comment><USER5> > Have you ever tried to attach a file to an email only to find out it's too > large to send?

Yeah! Some jerk who runs my MTA set the size of acceptable attachments really low! I wonder who did that...

$ host -t mx mydomain.com

mydomain.com mail is handled by 0 aspmx.l.google.com.

Oh... I see.

<comment><USER6> Attachment size limits aren't there just to fuck with you. Sending large files around between web clients is okay, but if you send a large file to an outlook user they're going to have to sit there waiting for it to download before the rest of their email comes in. And then it's going to make their PST file exceed the maximum PST file size, which in a poorly managed system (i.e. most personal computers) is going to cause data loss.

Also, my parents used to use an ISP-provided email address, and it would silently drop any messages that included a file that exceeded their maximum attachment size. So any time i tried to send them photos, they'd never get the email. Limiting attachments to a fairly small size is just being a good citizen of the email network.

<comment><USER5> Oh sure. However, it also puts a lot of load / strain on servers that Google doesn't want to run (SMTP, IMAP, etc). The way the post is written makes it sound like Google has figured out how to tame some natural force to allow us to have big e-mail attachments, while all along the limit was set by Google itself. I really don't think that Google cares about Outlook users (why should they).

Somewhat unrelated, I think that Google is beginning to try and pressure people to stop using SMTP and IMAP. I've long used Mail.app, mutt, or Thunderbird to use mail hosted by Google, almost entirely because the GMail client doesn't support any kind of message encryption or authentication. Recently, I have been receiving a lot of "quota exceeded" messages during routine interactions with the IMAP servers. I suspect that Google is in the process of gradually lowering the allowed quotas for IMAP usage in an attempt to get people to use the web UI, Android, or cros ...

<comment><USER7> I'm not sure why you're getting those quota errors, but I can assure you that we're not trying to pressure people to stop using SMTP and IMAP.

If you post on the forums, some user support folks should be able to help you out and escalate to engineering if they find you're hitting a bug.

Sorry for the issues you're seeing.

</comment></comment></comment></comment><comment><USER8> I've been paying for Google Drive for several months because I really, really want it to work, but it's actually kinda useless as it causes constant instability and 120%+ CPU load on my 2012 Macbook Pro. This means that I frequently close the application down, so it's not actually covering me and if I lost my computer, the most recent files probably wouldn't be covered. There's been an open issue about this in the support forums for months and there's no news on when they're going to fix it...

<comment><USER9> I switched to Arq with Glacier as my "House Burns Down" backup, as I already backup to a Time Machine external drive at home. I'm very happy with it, but of course, I've never tried to get the data back yet.

<comment><USER3> > I'm very happy with it, but of course, I've never tried to get the data back > yet.

Not to be that guy, but... if you don't have a tested restoration plan for a backup, you don't have a backup!

Nothing's worse than losing all your data with no backup... except for losing all your data and going to restore from your backup, only to find that all your data there is gone as well!

<comment><USER9> Agreed. When Arq finishes its backup, I'll do a verification.

I appreciate you being "that guy" :)

</comment></comment></comment></comment><comment><USER10> This is long overdue. I've been inserting links to Google Docs (the old name for Drive files) into emails forever, but plenty of people I know don't realize how easily they can do that and give up if a large file cannot be attached to an email. I'm also surprised by how many Gmail-using friends of mine don't even know there's some hefty free file storage a click away even though the link to it has been at the top of their Gmail for years.

</comment><comment><USER11> A welcome feature, but we can't ignore the paradigm shift's tiny repercussion: once the sender deletes the file, the receiver will no longer be able to access it (assuming they've lost, deleted, or not yet downloaded their own copy). Lately I've used shared Dropbox folder links for larger attachments, but the same problem seems to persist with any hosted solution. A solution that pleases both the sender having control over their files and the receiver having long-term access is tough to imagine.

<comment><USER12> > A solution that pleases both the sender having control over their files and > the receiver having long-term access is tough to imagine.

It's that paradoxical? Having control of the file means being able to revoke access to it. If the viewer has long-term access, the owner doesn't have control.

<comment><USER11> I agree with your statement. I should be more precise: the gap will appear in the layman's approach. For example, A: "Hey remember that file you sent me a while ago? I can't access it anymore." B: "Oh, I deleted it." A: "But I thought it was an attachment?" B: "Well..."

</comment></comment></comment><comment><USER13> This is lovely. Very welcome.

Sending and sharing files are two of those things that are just now sluggishly rolling over to discover that it's a new millennium.

Dropbox and Drive are making great strides lately and I'm really thankful for it. Using Dropbox to have the same "folder" across three computers is the first time synced sharing ever felt intuitive enough for my (71 year old) father to regularly use, and now he can use this to reliably send larger files to people without any worry of fouling up permissions (that would otherwise be difficult for him to understand).

</comment><comment><USER14> So can we use that to send binaries to people? Because gmail will absolutely not allow you do that. They will go as far as inspecting archives to look for binaries and ban you from sending them.

<comment><USER15> You can get around this by renaming the file to have some arbitrary image extension. Not ideal, but works.

<comment><USER16> Or zip it up with something like 7zip, encrypt it with a password and tell it to encrypt the filenames as well so Google can't peek inside :)

</comment></comment></comment><comment><USER17> So, in other words, Gmail just added a feature that Hotmail/Outlook.com have had for years.

 _golf clapping_

<comment><USER18> yes. Exactly... But, you know, now it's done by Google... Anyway, I'm surprised that no-one except you cited skydrive and the fact that they just copied a feature so old for many users...

</comment></comment><comment><USER19> It's about time!

I use Google's cloud-based services for as much as I can, but it's still not seamless and is annoying when I have to open a new window to access a service run by the same company providing the one in the page I'm on.

Next step: Please allow me to easily save PDF's and other documents directly to Drive from a URL. I shouldn't have to download a file to my device and then upload it to drive.

<comment><USER20> If you use cloudprint (link: <http://www.google.com/cloudprint>), you can already save PDFs or any other URL directly to Google Drive. I use this all the time to save online confirmations, receipts, etc.

</comment></comment><comment><USER21> > Now with Drive, you can insert files up to 10GB

Hmm, how much space do I have in there now?

0% of 5 GB used... Now it makes sense.

<comment><USER22> You can pay and get more space.

<comment><USER21> Sorry for the late reply... that is what I was implying. They are offering this to sell more storage space.

</comment></comment></comment><comment><USER23> Is no-one else worried about these TOS applying to their email attachments?

you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps).

EDIT: I guess it's a moot point if you're already using Gmail.

</comment><comment><USER24> I've been dogfooding the "Gmail will double-check that your recipients all have access to any files you're sending" feature for a month now and it's FANTASTIC. If you use Google Docs a lot, this saves so much permission pingpong.

<comment><USER25> Honestly Gmail's new features never cease to amaze me. Their new compose box is a good example. Initially it was terrible for me as I frequently send from other email addresses but within a week they had removed a click or two and now it's perfect.

<comment><USER26> I'm very impressed with how fast that other-email-address UI issue was fixed.

</comment></comment></comment><comment><USER27> Is this minuscule feature worth the front page?

</comment><comment><USER28> This is how email could work too. The sender would host it (by himself or in cloud) and the recipients go fetch it when they want to read it. Updates and comment threads all collect into the same place. No spam either since nobody would be pushing tens of megabytes of messages to your inbox.

<comment><USER29> It's cool in a lot of ways, but there are two big disadvantages over traditional attachments:

\- The recipient doesn't get a static copy of the file to keep alongside the email.

\- The sender's responsible for keeping the file available until the recipient has seen/saved it.

<comment><USER30> those are both advantages in plenty of situations. Just depends on what you want in a given situation.

</comment></comment></comment><comment><USER31> this is awesome! it might also just tip the scales from dropbox over to drive. I cant believe something so obviously powerful took so long! I do hope that it will allow me to share files with non-gmail users as well!

</comment><comment><USER32> There is a really good third-party Chrome extension that effectively does this already and also works with Box and Dropbox: <https://attachments.me/>

<comment><USER33> I LOVE attachments.me! I have it set up to automatically store attachments from certain folks to a dropbox folder. I only wish it worked with MailPlane...

</comment></comment><comment><USER34> Question: so with this, I can send an attachment and change the file before the recipient opens it? Will they see if it has been modified? Will I see when they have accessed it?

<comment><USER35> This is an automated way to do what was previously "copy and paste a Google Docs link into an e-mail".

Yes, you can change the file. If it's in native Google format (e.g. a Google Doc, not an uploaded/stored Word .doc file) you have a revision history. You can see when people join/leave the document while it's open (without timestamps), but you can't bring that up later.

</comment></comment><comment><USER36> plug: my friend built a chrome extension that does a superset of that - it is called Cloudy and integrates with filepicker.io which lets you choose files from multiple cloud storages: [https://chrome.google.com/webstore/detail/cloudy/fcfnjfpcmno...](https://chrome.google.com/webstore/detail/cloudy/fcfnjfpcmnoabmbhponbioedjceaddaa)

disclaimer: I work for a Google competitor

</comment><comment><USER37> Would be perfect if they add this Google Drive attachments functionality to Sparrow. Someday.

</comment><comment><USER38> I wonder if this will cause storage optimisations on their data centers.

</comment><comment><USER39> I never liked the idea of hosting my own files on someone else's server (Dropbox) or sending them through a middle-man.

That's why i just run my own "cloud" on my own premises. If I want to give someone access to a file, I just throw it on my Synology DiskStation and the receiver can get at it via FTP or HTTP client.

<comment><USER40> That's not a "cloud," that's just a server. There's an important difference, and people need to stop using them interchangeably.

<comment><USER41> What is the difference?

<comment><USER42> I believe cloud by definition means third party, but something like the host wont know what it is storing, just who accesses it. So in OP's case if his computer is shutdown, the server wont be able to serve the file, but if it is on "cloud" there is a lot less chance of downtime and greater latency as "cloud" can have multiple data centers around the globe to server same file.

<comment><USER43> I believe it's worse than that.

Since as long as I remember and probably even before that, when explaining networking to executives, marketing and other technically challenged people, we use drawings. In these drawings the part representing the internet is for some reason drawn as a cloud, probably to convey that some magic we don't want to get into the deatils happens there.

Now you've got it, the cloud, a.k.a. the internet symbol for ignorant people.

</comment></comment></comment></comment></comment><comment><USER44> Seems very useful. I bet I'll be using that a lot.

</comment><comment><USER45> Sorry for being pessimistic, but any speculation on the vulnerabilities this connection opens?

<comment><USER46> No more than the years-old sharing features in Google Docs/Drive, I'd imagine.</comment></comment>


How to Choose a CMS that doesn't suck - <AUTHOR> http://cmscritic.com/how-to-choose-a-cms-that-doesnt-suck We have noticed more and more that people are having a hard time deciding how to choose the right CMS for the job.<p>It's not an easy task for some people, and for that reason we've created this article with the hope that it can free some of you from feeling overwhelmed. <comment><USER2> Great article, really helps</comment>


DIRECTORY_HAUNTED_DO_NOT_OPEN = true; - <AUTHOR> http://patrickjamesmcguire.com/2016/02/26/directory_haunted_do_not_open-true/ <comment><USER2>
        A simple

        $: ls *

        would load the millions of unique names into memory
        hit the memory max and throw the server into swap
        hell.

I'm surprised by that. I'd expect the shell to abort wildcard expansion when the expanded argument list gets bigger than ARG_MAX, since there is no point in continuing to pile on expanded args past that point.

It would be interesting to try this with different shells and see if they all behave this way.

        Guess what

        $: rm -rf *

        does? That's right, it expands the wildcard and
        tries to load the gigs and gigs of names of files
        into memory until it hits swap hell, but
        recursively.

I do not believe this is correct. It does exactly what "ls *" does with regard to the wildcard. Wildcard expansion takes place in the shell before the command is executed, so the fact that rm is being asked to operate recursively has no bearing on the wildcard expansion.

<comment><USER3> > I'm surprised by that.

In hindsight, you shouldn't. Shell sorts wildcard expansion lexicographically, so it needs all the filenames read at the sorting time.

<comment><USER2> I remain surprised. If the partially read, unsorted set of filenames exceeds ARG_MAX bytes the shell can infer that exec will fail (E2BIG). There is no need to finish reading the names and sorting them.

</comment></comment></comment><comment><USER4>
      "Guess what 'rm -rf *' does? That's right, it expands
      the wildcard and tries to load the gigs and gigs of names
      of files into memory until it hits swap hell, but recursively."

Why not go up to the parent directory and do 'rm -rf _dirname_ '? Then there'd be no wildcard to expand, and 'rm' would just walk the directory removing one file at a time.

<comment><USER3> That's right. And even if we assume `rm' does build those gigabytes, `find | xargs' should not. xargs is smart enough to build commands with chunk of the input and execute them one by one. The job can also be done with one of the several programming languages, Perl oneliner being my choice.

Actually, this could be a good interview riddle, along the lines of fixing `chmod a-x /bin/chmod'.</comment></comment>


Medical Convention Cancels on San Fran Because Its Streets Are So Distressing - <AUTHOR> http://fortune.com/2018/07/02/san-francisco-streets-streets-medical-convention/ <comment><USER2> Amazed it hasn't happened sooner. San Francisco is the last place I want to go to a conference.</comment>


Sendy Is Insecure: How Not to Implement ReCAPTCHA - <AUTHOR> https://victorzhou.com/blog/sendy-recaptcha-security/ <comment><USER2> I am the author of Sendy.

There are a lot of miscommunication between me and the author of this post. The selected snippets of messages posted on the article seem to put me in a bad light, however it's only one side of the story. The selected messages posted on the article are ones that are favorable to his argument. For example the author did not post a screenshot of me saying that I will be looking into this but went ahead to write an elaborate blog post immediately to put Sendy in an unfavourable light.

Bugs and issues with security has been and always will be the top priority with Sendy over the years. I agree the client side parameter 'subform' bypasses the reCAPTCHA and should be fixed. It is an oversight. And it will be fixed.

<comment><USER3> Unrelated to the issue:

I've been asking this hundreds of times but never got an answer, why doesn't Sendy add a visual e-mail builder?

Customers are going crazy over the issues with Wysiwyg and tables to make simple two-column designs, while drag/drop builders are straightforward and simple while keeping the code fully compatible with mailers.

Basically all competitors have drag/drop builders now, even the simpler one- time-pay scripts on Envato.

<comment><USER4> check out [https://mjml.io/](https://mjml.io/). Its a great solution for creating email layouts in code. I use it with vcode where it has an option to preview the result.

</comment></comment></comment><comment><USER5> Sendy has some massive problems with code quality and always had. The last time I took a look at it (because I needed to send emails), it was quite horrendous. I would not be surprised if it was insecure - was literally a "nooooooope" right back out.

Background: I write PHP for fun, I don't compete with Sendy, I don't have any stake in any service that competes with Sendy. I also don't expect PHP to be written in the most OOP-everything Symfony-esque way either. But this is a bit too much for me even.

It doesn't follow any modern standards or guidelines; it doesn't use any templating system, just PHP hardcoded inline with HTML in hundreds of files (no modern framework, lightweight or not), concatenated variables into SQL queries and HTML. The author seems to hate using { } for if/else statements, which has the potential of introducing fun bugs if not extremely careful. 1 and 2 letter variable names are common (and I don't mean in the way of $i or $j); parts of it border on insane or bizarre; there are 500 character lines where instead of an error generation feature they just die() with a full HTML document as a string for error pages; functions are written inline all over the place and they all use the keyword global; there are no parameterised queries - it's covered in repetitive mysqli_real_escape_string and query concatenation. There is a massive amount of copy-pasted code: instead of some kind of single database management layer, there's a re-definition of a function that connects to a database with the same name in dozens of files, all of which try to read global variables (doesn't take any parameters)

<comment><USER6> That's all true (I haven't checked myself, but lots of people talk about it on Reddit and elsewhere).

Still, the big selling point is: Inexpensive. Easy to install (simple PHP). Looks relatively polished.

All the "competitors" are either much more expensive, or you need to be an enthusiast in the tech stack they have chosen.

<comment><USER7> Shameless plug: [https://listmonk.app](https://listmonk.app) (FOSS. Written in Go)

<comment><USER8> I'm curious, what made you go with a multiple lists approach instead of tagging users on a single list?

A lot of popular (but expensive) services like ConvertKit have moved to a tagging approach many many years ago.

It's so much easier to manage your list of emails when it's a single list and then you add tags to specific users like "purchased X". This way the email address only exists in 1 spot and you can segment on the tags.

The Sendy approach (and from the looks of it your app too) becomes very unwieldy with having to manage, parse and merge multiple lists on a regular basis.

<comment><USER7> listmonk supports arbitrary nested tags and attributes in the form of JSON. A subscriber can have properties like {"purchased_x": true, ...}. It's possible to issue complex SQL expressions to filter and send campaigns to subscribers.

The multi-list approach has several other benefits. When manager / sender (and other) permissions get introduced, it will be straight forward to restrict users to managing certain lists. In addition, multiple lists allow subscribers to selectively subscribe / unsubscribe from lists.

Internally, the structure is simple. There is only one subscribers table and subscriber data is not duplicated anywhere. List (foreign key) relationships are in a separate table.

<comment><USER8> That sounds very promising.

So in theory could you have 1 list and each subscriber has many tags, and then you can segment on those tags?

Also, do you have any public success stories beyond your own Zerodha campaigns? Have you compared delivery / bounce / etc. rates vs Sendy and other tools using the same email providers? Also how fast can you send emails out through SES?

</comment></comment></comment></comment></comment></comment><comment><USER9> Nice writeup, @vzhou842.

I feel like part of the problem here is just miscommunication. Victor and Ben seem to be talking past each other.

This line stood out to me:

>>There's no way to implement Google's reCAPTCHA in an API.

>That can't be right - the reCAPTCHA documentation has a dedicated section on Server Side Validation!

I assume what Ben meant was that it's impossible to implement reCAPTCHA _entirely_ in an API. The nature of reCAPTCHA requires you to have a UI element, which would be impossible in an API. Victor interpreted the claim as if Ben said that an API can't _support_ reCAPTCHA, which would be incorrect, but may not be what Ben meant.

I feel like the lead sort of got buried in Victor's report. The headline to me is that _abusers are actively automating phony signups with this vulnerability_. I don't see that stated explicitly anywhere. The closest is this line in Victor's third email, after the conversation has gotten somewhat heated:

>What good is reCAPTCHA if anybody with a computer can write a script in 5 minutes to spam your email list with thousands of fake signups.

The fact that attackers are exploiting this in the wild seems to be the most salient point, but I'm not sure that Ben knew that from the correspondence shown.

<comment><USER2> > I assume what Ben meant was that it's impossible to implement reCAPTCHA > entirely in an API. The nature of reCAPTCHA requires you to have a UI > element, which would be impossible in an API.

That's exactly what I meant. Thanks for picking up on this.

> The fact that attackers are exploiting this in the wild seems to be the most > salient point, but I'm not sure that Ben knew that from the correspondence > shown.

I know that and hence was working on a fix for the next update.

Even though some of my comments may not be in agreement with the author, but I did mentioned in my email conversation that I am looking into it. But of course that was being left out of the post, no screenshots of that comment was found in the author's post.

If I had released the next update without addressing this issue then yes feel free to write a post with these accusations. But I wasn't given the benefit of the doubt.

</comment></comment><comment><USER6> > Sendy treats these email addresses as distinct, but they're actually largely > duplicates because of the Gmail period trick.

But they are distinct! Why should anyone have to special-case some provider's hack? Do you expect Sendy to special-case plus addresses? For which hosts?

Sure, it's nice if Sendy handles special cases, but it's strictly a bonus feature, and not doing it is also correct.

(The main issue with the hidden field is a valid complaint, of course, and it really doesn't look good)

<comment><USER10> He didn't say they should have a special case. He just made a factual statement, "Sendy treats these email addresses as distinct, but they're actually largely duplicates because of the Gmail period trick," and looked to implement recaptcha as a solution, which was poorly implemented. However, if you were going to do create one special case for a provider, gmail would be a good choice.

<comment><USER11> These addresses are distinct. They just point to the same mailbox. At best they can be called aliases. /p

</comment></comment></comment><comment><USER12> Wow, the response where Ben claims bots aren't humans so they won't remove HTML form elements before submitting is an embarrassing look for Sendy.

</comment><comment><USER13> For anyone wanting an alternative, there's Mailwizz - one time payment, and you can self host and connect it with SES/Sparkpost/Mailgun/etc.

I've mentioned it at least a dozen times here on HN because it's an underrated piece of software that works and is actively maintained, unfortunately their marketing is very weak.

Bonus: the code is not obfuscated, it's built on PHP using a proper framework and the author is very active on the support forums. I'm hosting it on Webfaction (currently migrating to Opalstack) for cheap and almost no maintenance.

<comment><USER3> Thanks for this, haven't seen it even though I've been actively searching!

I think it's hard to get taken seriously by companies when you sell a "script" on Invato too and I'm not sure why they do this? Why not just sell it yourself and receive more of the profits?

<comment><USER13> I guess it's somewhat easier if the product is good enough (Envato features it) and the developer cares more about developing than marketing it.

<comment><USER3> I guess that's true, everyone coming to the site will then see it featured and buy it.

Nothing prevents him from doing it in the future though, when he already have enough customers to make a recurring cost profitable.

</comment></comment></comment></comment><comment><USER14> That would make me concerned about the engineering culture at the company. The initial ill-reasoned response sounded like a response he gathered from the tech team. If they knew what they were doing they would agree with Victor.

<comment><USER15> Afaik sendy is a one man band playing a triangle.

</comment></comment><comment><USER16> Obviously, this should be fixed, but shouldn't you also be doing double-opt-in and making the user confirm the subscription by clicking a link in an email?

<comment><USER17> Definitely, and I was doing that, but everytime a new spam variant (with gmail period trick) of an email gets subscribed that same email gets ANOTHER double- opt-in email from me. This is my guess as to why I was getting reported as spam so much - people would literally be getting spammed by me (unintentionally).

EDIT: forgot to mention I'm the author of this post

</comment></comment><comment><USER18> Yeah we definitely use recaptcha in a GraphQL API for sign-ups to browserless.io. There is a doc on how to do so programmatically via JS in the browser. The docs aren't great, per se, but it is definitely doable.

EDIT: docs are here: [https://developers.google.com/recaptcha/docs/display#javascr...](https://developers.google.com/recaptcha/docs/display#javascript_api) though the lifecycle of how this all works is confusing. I'll have to do a write-up on this at some point.

</comment><comment><USER8> Does anyone know of a self hosted email list management solution that uses a tagging based approach of managing users instead of multiple lists, supports auto responders and also has a decent API for at least adding users to a list?

I have not found any self hosted solutions (paid or free / open source) and I've looked a lot in the past. I've seen services like Drip and ConvertKit offer this but both of them are at the high end of hosting costs. To put things into perspective it's $80 / month for a list of 3,000 users with ConvertKit even if you send nothing.

One of the more polished tools I've seen is Freecodecamp's [https://github.com/freeCodeCamp/mail-for- good](https://github.com/freeCodeCamp/mail-for-good) project but it doesn't support auto responders or tagging. I've opened issues on this 2+ years ago at [https://github.com/freeCodeCamp/mail-for- good/issues/196](https://github.com/freeCodeCamp/mail-for-good/issues/196) and [https://github.com/freeCodeCamp/mail-for- good/issues/197](https://github.com/freeCodeCamp/mail-for-good/issues/197) but I don't think they are going to implement it.

<comment><USER19> I could be interested in writing one, having just written a semi complex wishlist management app with some overlap in user management features. Would nodejs suit a project like this do you think?

<comment><USER8> I'm more of a Flask, Phoenix and Rails type of guy but if you prefer using Node sure, you probably couldn't go too wrong if that's what you have extensive experience in.

<comment><USER19> Also a Rails guy but have found Node is quite a good fit for async work like managing email queues. Would use Phoenix but don't have enough production experience in it yet..

</comment></comment></comment></comment><comment><USER20> I run a service in the same space ([https://emailoctopus.com/amazon- ses](https://emailoctopus.com/amazon-ses)) and we see a lot of Sendy defectors. Their code desperately needs a rewrite.

</comment><comment><USER2> An update of Sendy had just been released to address the reCAPTCHA issue → [https://sendy.co/get-updated](https://sendy.co/get-updated)

</comment><comment><USER21> Just reading the first two responses from "Ben" in that e-mail thread and parsing his attitude should make it obvious to anyone that this is a project you should steer well clear of.

</comment><comment><USER22> >Plus, it should be super easy for you to fix this - all you have to do is remove the check for "subform" and drop support for that field in your API.

It might not be that easy, because there might be a bunch of users currently depending on the current behavior, and as soon as a real ReCAPTCHA token is required, they will break. They might need to introduce a 3rd ReCAPTCHA option. So they would have 3 options "ReCAPTCHA off", "ReCAPTCHA legacy weak", and "ReCAPTCHA on".

</comment><comment><USER17> Author of the post here - Happy to answer any questions. I'll be editing the post with responses/updates from Sendy. Hopefully this convinces them to release a patch!

<comment><USER23> Why would you willingly use such a garbage POS script? There's better services out there, or you could just roll your own.

<comment><USER24> Any suggestions?

<comment><USER20> Seeing as you asked, I'll give my startup a shameless plug:

[https://emailoctopus.com/amazon-ses](https://emailoctopus.com/amazon-ses)

</comment></comment></comment></comment><comment><USER25> Here is a patch for subscribe.php (22.214.171.124) to address the captcha issue from this post and another issue that allows bypassing double-opt-in by setting silent=true: [https://pastebin.com/dT1NszTt](https://pastebin.com/dT1NszTt)

this change requires verifying secret api key in the subform=no case and restricts opt_in bypass to this subscribe api usage (since captcha is not good enough to stop all bots)

</comment><comment><USER26> I've seen cases where spammers abuse sign-up forms to generate spam (by using the name field for their content). Without server side validation it would be trivial for a malicious user to accomplish this.

Shameless plug - I run a hosted alternative to Sendy [https://www.mailblast.io/](https://www.mailblast.io/)

</comment><comment><USER27> >// DO NOT USE - it's illegal and will get you in trouble.

>WARNING: DO NOT use this code to attack a real email list without permission. That's super illegal and can get you in serious trouble.

"Super illegal"?

<comment><USER5> almost certainly construed as some kind of CFAA violation

</comment></comment><comment><USER28> So are you recreating the recaptcha code in your custom form?

</comment><comment><USER25> Author seems self-righteous and does not understand what he is being told by Ben from Sendy. This is additionally evidenced by hundreds of lines of email and a blog post for what could be addressed with 12 lines of code modification.

Sendy is open source (albeit not free) and running on your own server. Ben's response says because you are using a customized webform instead of sendy's provided forms, that you need to handle the captcha code on the form and siteverify on the backend on your own.

Before sendy had recaptcha support you would have to modify the subscribe code to include a call to captcha siteverify. Here's some PHP code for how you call siteverify before proceeding with something: [https://www.adam- bray.com/2018/04/02/adding-recaptcha-with-p...](https://www.adam- bray.com/2018/04/02/adding-recaptcha-with-php/)

You can avoid running your own backend altogether now anyway since SES supports bulk template emails. You can store all your form submissions using a lambda/cloudfunction/webworker to verify the captcha and store the list. When you want to send email you can pull your list into something running on your laptop and then invoke the SES bulk templated email from there. You can use lambdas for pixels and custom links that update records for those users. I wrote my own angular-firebase version of this

<comment><USER29> My reading of the issue is that Sendy's webform allows the external requester to bypass the server-side captcha logic by changing a client-side "hidden" input. If you want to be protected then you have to customize the form.

<comment><USER25> I have the source code too and checked it already. The gist of the code is:

if subform:

       if captcha fails:

           feedback = "Failed recaptcha test"

... if feedback!='Failed recaptcha test' (&& other stuff)

       do subscribe

edit: misread the code and formatting on HN didn't even show my intent, but the subform check doesn't contain the subscribe logic. The bug is clearly that it doesn't check if the captcha has passed.

<comment><USER30> And the point is that anyone with even a modicum of dev experience can remove the `subform` field and automate submission to the otherwise-standard form and completely bypass ReCAPTCHA.

<comment><USER25> The issue goes even deeper: if subform is set to no then sendy considers the user as added via api. This _should_ mean that it would verify_api_key before allowing such a submission, but sendy doesn't verify the API key for subscribe calls (doh!). Old forum posts suggest that double-opt-in is a solution, however not only can you bypass the captcha and form with subform=no, you can also bypass double-opt-in via the subscribe API by sending silent=true in your POST.</comment></comment></comment></comment></comment>


Archive Shows Medieval Nun Faked Her Own Death to Escape Convent - <AUTHOR> https://www.theguardian.com/books/2019/feb/11/archive-shows-medieval-nun-faked-her-own-death-to-escape-convent <comment><USER2> Oh hey! The first photo includes Gary Brannan from the youtube show Technical Difficulties. For those unfamiliar, it's a gameshow run by educational youtuber Tom Scott, whose videos regularly make it on HN.

Technical difficulties playlist [https://www.youtube.com/watch?v=um7Nfjac5To&list=PLfx61sxf1Y...](https://www.youtube.com/watch?v=um7Nfjac5To&list=PLfx61sxf1Yz2bl7aufBF6wHN- QXuxo48m)

</comment><comment><USER3> I submitted a similar story some time ago, although it didn't raise any interest:

[https://en.m.wikipedia.org/wiki/Catalina_de_Erauso](https://en.m.wikipedia.org/wiki/Catalina_de_Erauso)

</comment><comment><USER4> So, the nun went to town.</comment>


Show HN: I've Created Simple Standup Meeting App for Slack - <AUTHOR> https://www.simplestandups.com <comment><USER2> This is a good product idea, but it should support video standup updates. That shouldn't be too difficult of a feature to add.

<comment><AUTHOR> Yes, I'll be adding more features in coming week

Thanks for you feedback!</comment></comment>


Ask HN: Do you think nature loves pomegranates more than apples? - <AUTHOR>

A pomegranate has about 600 seeds; an apple, on the average, has 4 to 8 seeds.
http://www.aquaphoenix.com/misc/pomegranate/
http://www.pollinator.com/sd_count.htm <comment><USER2> i'd point out that the apple has been cultivated for something like 1000 years. its been developed into a larger fruit with fewer seeds via an extremely long period of selective breeding.

i don't think the pomegranate has had the same level of effort/attention.

<comment><USER3> Additionally, the pomegranate is native to an extremely arid environment; more seeds are necessary to ensure reproduction.

<comment><AUTHOR> "more seeds are necessary to ensure reproduction"

Looking at other fruits grown in similar climate (mediterranean) [http://www.hort.purdue.edu/newcrop/proceedings1996/V3-416.ht...](http://www.hort.purdue.edu/newcrop/proceedings1996/V3-416.html) it seems to me that the number of seeds and aridness of the climate are not related: olive (1 seed); Mandarin (12?). Only fig is similar to Pomegranate; fig too is filled with seeds.

</comment></comment></comment><comment><AUTHOR> <http://www.aquaphoenix.com/misc/pomegranate/>

<http://www.pollinator.com/sd_count.htm></comment>


MSSQL hasn't been ported to Linux. Windows has been - <AUTHOR> https://twitter.com/dev_console/status/799097696959287296 <comment><USER2> I wonder how many kernel/windows api dependencies sqlsever has. Probably SQL Server was never thought to be cross platform, and it is easier to include part of the kernel interfaces for mediation than rewrite the whole beast.

If it makes sense commercially then MSFT could refactor the code...</comment>


Editable Set of Animated Icons - <AUTHOR> https://lordicon.com/icons <comment><USER2> > MIT license. Royalty free for personal and commercial use.

Nice.</comment>


What? Some Indie Games Made Money? - <AUTHOR> http://jeff-vogel.blogspot.com/2010/01/what-some-indie-games-made-money.html <comment><USER2> I love this guy's blog, have since I came across it somewhere on Reddit. It's very interesting to look at how indie games do and Jeff Vogel has really been a great source of that info.

Xbox's indie program looks really cool, especially as a Flash game developer with a background in .NET. The revenue stream looks more clearly and reasonably defined than the various ways to monetize Flash games.

</comment><comment><USER3> As one of the developers on the list (Slingstar) I'll throw my two cents in on the $1 vs $2.50 pricing. The vast, vast, vast majority of sales come while you are on one of the four featured lists. The "new releases" one is the only one that you are guaranteed to be on (and I have been on all 4 lists and it also seems to be the most important). However you get bumped off that after 20 games so if you are going to be selling more than 20-35 games a month you better hope you get on the top sellers or to rated. Top sellers is by number of units so a cheap game has an advantage there, and I believe that people tend to take into account cost when they rate things too (this game was totally worth a dollar, 5 stars!). I think a lower price point is optimism showing. People believe that they can claw their way on to the top rated/top sales boards and then stay there, and are willing to do anything to make that more likely.

</comment><comment><USER4> I'm going to take every reasonable opportunity I can to tell everyone to go buy the Xbox game "Braid" and play it right away. That is all.

</comment><comment><USER5> These numbers are disappointing compared to iPhone games. Look at Doodle Jump or The Moron Test as examples. Doodle Jump is over $1M in revenue (minus 30% App store fees), and The Moron Test is at over $500K in revenue.</comment>


Nissan attacked for one of 'nastiest anti-union campaigns' in modern US history - <AUTHOR> https://www.theguardian.com/us-news/2017/aug/01/nissan-mississippi-union-vote <comment><USER2> Just bought a car for the first time in 13 years. Still refuse to consider Nissan products due to their using the legal system to harass others using their family name over trademark.

[https://en.wikipedia.org/wiki/Nissan_Motors_vs._Nissan_Compu...](https://en.wikipedia.org/wiki/Nissan_Motors_vs._Nissan_Computer)

Nissan the car company name has nothing to do with a person named Nissan. It was landed upon by committee.

While I understand trademarks "must be defended" is part of the laws that govern them, the law is garbage. It's giving special privilege to already established human language when it's used like this.

If you take a known name and make a "trademark" around it, you should get no special protection.

</comment><comment><USER3> Sounds like the unions have something to gain...or lose. oh well, better job security for developers once we automate everything.

<comment><USER4> Automation is inevitable, but will likely happen quicker _without_ unions.

Unionized autoworkers make the same wages as non-unionized autoworkers. It's a concession the UAW and other unions have made to keep plants from moving.

The real cost of unionization to a company isn't wages, it's a loss of flexibility in moving or closing plants. Unionization extracts better job security. Even the most rabid anti-union Americans want a system that makes it more difficult for companies to move or close factories. Job security brings _political_ and _economic_ stability. But ironically the popular narrative about unions has grown more negative even as conservatives have become increasingly vocal about providing job security to low-skilled workers.

Ask yourself this: would you rather government pass laws that restrict free trade and limit the movement of factories, or would you rely on unions to seek that stability within an otherwise free market system, where union contracts can be tailored to each factory and more easily amended in light of unexpected market conditions?

Realize that most programmers don't have to worry about job security in the same way that low-skilled workers do. Even if the current technology labor market didn't favor supply, the cost of on-boarding employees is huge. For even nominally skilled positions, most companies will overlook even the worst performing employee just because the cost of on-boarding a replacement can cost thousands, if not tens of thousands of dollars; and you never know if the next employee will be any better. People think this reluctance to fire is because of the risk of discrimination lawsuits, but in industries reliant on low-skilled labor people will get fired at the drop of a hat, sometimes out of sheer retaliation, even though the same legal risks exist.

Unless you want this country to go the way of Venezuela, you want to to secure some significant degree of job security for low-skilled workers. Succumbing to market forces is inevitable, but there's nothing inevitable about a capitalist free market or a liberal political system. Those things can be extinguished in the blink of an eye.

</comment></comment><comment><USER5> I'm fine with unions or no unions. What I'm not fine with is the government making laws giving one side unfair bargaining power. I think a lot of unions have gotten too greedy and "killed the goose that laid the golden egg". There are plenty of places to work in this country. If you don't like one, you can unionize Or move on. But trying to get a law passed to strong arm your position is just wrong if you ask me.</comment>


The Next Wave: A new personnal finance newsletter - <AUTHOR> https://thenextwave.substack.com/ <comment><AUTHOR> Hello everyone, I just started a weekly newsletter about personnal finance and investment (mainly stocks and commodities, but also crypto and startups to some extent). The idea is to build a community around the topic and start investing (small) together. I'd be glad to have your feedback, questions and suggestions</comment>


Ask HN:What was the one hack which took most time? - <AUTHOR>

We have all been through that one hack which took so much time. But feels great when it's done. It has that aha moment to it.<p>Let's share the story. <comment><USER2> Not really a web based hack but writing the functions to detect and decode a valid stream of manchester encoded data over a 433MHz link on a PIC microprocessor too me an age, mainly because I designed it to detect the baud rate from within the received data stream. The most irritating part about it all is that the encode part of the system is like 5 lines of code that took two minutes to write. The decode however is several timers, interrupts and about 5 weekends of work.

It works well enough but it's on breadboard so will never be perfect.</comment>


Sunglasses That Could Correct Color Blindness - <AUTHOR> http://www.smithsonianmag.com/innovation/scientist-accidentally-developed-sunglasses-that-could-correct-color-blindness-180954456/

<comment><USER2> I have these, they work for me. They make a really big difference in distinguishing things like red/green traffic lights, or vegetation on top of red brick. They also just make all of nature look a lot nicer.

If you have any questions about them, I would be glad to answer.

<comment><USER3> What sort of color blindness do you have? And is what you see qualitatively different, like is there a new 'feel' to the color being made apparent? Or is it more like the tiny differences you were always aware of are more intense?

Glad they work for you, by the way. Tough problem to solve.

<comment><USER2> I have red-green deficiency, so red and green both seem like they have a lot of white in them (I found out). For instance, green traffic lights actually look white-green to me without the glasses, and same for red. The sunglasses make them look like a pure, brilliant green or red with no white added.

I would describe it as a pretty big difference, it's not tiny, it's really obvious, and whenever I forget my sunglasses or can't wear them for whatever reason, the outdoors look really muted.

They won't work if you have complete color blindness, because there's no red- green distinguishing information to work off of.

<comment><USER3> Right, gotcha. Excellent, I may have to keep these in mind for a few friends.

Do they have to be modified or customized in any way for you depending on sensitivity or whatnot? I suppose I could look it up but your situation may have differed.

<comment><USER2> I don't think there are any options, I just got "large" "black" sunglasses in one of the few frames they offer.

</comment></comment></comment></comment></comment><comment><USER4> This is really interesting, but the articles description makes no sense to me:

> EnChroma's technology works by placing a band of absorption on glasses that > captures light, pushing the cones away from each other and reestablishing > the normal distribution of photons on them.

The glasses are _not_ pushing the cones on your retina apart (if they are you're probably wearing them a bit close), so what are they doing?

<comment><USER5> Typical science/tech Babel effect. Try EnChroma's own explanation.

[http://enchroma.com/technology/how-it- works/](http://enchroma.com/technology/how-it-works/)

It seems like a pretty straightforward band-pass filter in the visible frequency range. I don't know enough about eye physiology or chemistry to say whether that would really have the effect they claim, but it sounds like plenty of people have already tried them and found them useful somehow.

<comment><USER6> Actually that description is sound conceptually: the cones' spectral absorption peaks are shifted apart with a stopband filter.

</comment></comment></comment><comment><USER7> I have red-green colour blindness, and I tried prototype contact lenses that claimed to do this about 15 years ago.

Did they work? I don't know! Everything certainly looked different and a lot more vivid.

I guess I would have had to use them for a long time and 'retrain my brain' before I got any benefit.

They were quite expensive, and I just didn't like it - I might have been seeing as a normally sighted person, but I just didn't know what the colours were that I was looking at, so I decided not to use them.

</comment><comment><USER8> As someone with a green deficiency, I'm not impressed. These glasses may distort the natural colour spectrum enough to be useful as an assistive technology when dealing with bad accessibility, but I wouldn't buy them unless colour distinction was essential to my work.

Implants or gene therapy would be interesting. Assistive technology, not so much.

<comment><USER9> Since you called out green deficiency specifically I think you're one of the few people I've seen actually define their specific colorblindness, instead of just saying "red/green colorblind". I have the same, green deficiency (deuteranopia) and I've read others with it who have tried this had little to no benefit. It's good to see it confirmed again. It's tempting to buy but I would be severely disappointed I think based off everything I've read.

<comment><USER8> I just think calling everything "color blindness" isn't particularly helpful in discussions about color vision. In everyday conversations I just say I have a "red/green weakness", which is what most people know it as in my language (German). However the term carries a few unfortunate implications (namely, that it's just about distinguishing red and green in general, which couldn't be further from the truth).

If you're in the same boat as me, having to explain yourself whenever you tell people what it means to be "color blind", I've found this article helpful: [http://critiquewall.com/2007/12/10/blindness](http://critiquewall.com/2007/12/10/blindness) (the images are nearly indistinguishable for me, except for a few variations in intensity and subtle changes in hue).

</comment></comment></comment><comment><USER10> I've used these and think they're awesome. Even as a non-color blind person, they make colors a lot more vibrant.

I also got to see my colorblind friend witness his first rainbow, which was an incredibly cool moment. We had to stop the car and pull over just to look at it.. great technology.

</comment><comment><USER11> I'd love something like this. After I realised others saw more colours than me I've been thinking a few times what the world really looks like.

</comment><comment><USER12> This was up on reddit a week or two ago. They thought it was pretty "meh"

<comment><USER13> [https://news.ycombinator.com/item?id=7721720](https://news.ycombinator.com/item?id=7721720) \- they've been here too. A few times, with not much interest.</comment></comment>


The Nizza Secure-System Architecture [pdf] - <AUTHOR> https://os.inf.tu-dresden.de/papers_ps/nizza.pdf <comment><USER2> From 2005. More recently, Qubes has adopted a broadly similar approach (using the Xen hypervisor instead of L4, but also isolating untrusted legacy apps and OS-es in VM-ish containers).</comment>


Show HN: A place to collect and share GIFs - <AUTHOR> http://gifcollector.com

<comment><AUTHOR> just something we felt the interblag was missing. still working out some kinks but let us know your thinkings.</comment>


China's steelmakers owe $484 billion - <AUTHOR> http://qz.com/196766/chinas-steelmakers-have-branched-into-shadow-banking-which-is-funny-since-they-owe-484-billion/

<comment><USER2> Anyway, apparently the executives of [https://en.wikipedia.org/wiki/Shandong_Steel](https://en.wikipedia.org/wiki/Shandong_Steel) don't have a problem buying private jets and flying to Phnom Penh in Cambodia for private parties... I saw one on the tarmac yesterday.</comment>


Are you ready for America's data protection laws? - <AUTHOR> https://venturebeat.com/2019/10/12/are-you-ready-for-americas-data-protection-laws/ <comment><USER2> The government should be providing a free guide for how to be compliant. It's stupid that we have all of these regulations and the layman won't know how to follow them.

<comment> m-p-3 Considering how slow the government and legal system are to adapt to new technologies compared to the private sector, I do not think this is a good idea.</comment></comment>


Reactronic Live Demo: Transactionally Reactive State Management for ReactJS - <AUTHOR> https://nezaboodka.github.io/reactronic-demo/ <comment><AUTHOR> Reactronic is a free open-source JavaScript library that provides transactionally reactive state management in a Web application.

Transactional reactivity means that state changes are being made in an isolated data snapshot and then, once atomically committed, are consistently propagated to corresponding visual components for (re)rendering. All that is done in automatic, seamless, and fine-grained way.</comment>


SmartyKit Apple I replica - <AUTHOR> http://apple1.smartykit.org/ <comment><USER2> The bottom photo shows an ATmega328P. So this is just a software emulation of an Apple I? What's the point?

<comment><USER3> I think it is just there for generating the video signal. This sort of thing is common. The earlier (solder-based) Briel Replica I Apple I clone used a Propeller chip for that. But it still had a 6502 for the actual computing, and I imagine this does too.

<comment><USER4> A lot of modern hobby computer projects use a FPGA, micro-controller, or dedicated modern CPU to bit-bang the video signal.

How did the original 8-bit computers do it? Did they have access to chips that are no longer produced?

<comment><USER5> The Apple I and Apple II both used discrete logic to generate a composite video output. The Apple I used a couple of unusual Signetics parts (2504, 2513, 2519) and a character generator ROM to implement a text-only "video terminal" with a UART-like interface; the Apple II used a more complex system built around the system's DRAM refresh which allowed for graphical output.

None of this required any truly unique parts (although the Signetics parts used in the Apple I are hard to find nowadays), but most hobbyists prefer something more modern than composite video. :)

<comment><USER6> It's also a problem using discrete components for noise and EMC compliance, you need a shielding because you have a lot more higher frequency traces compared to otherwise. It's still possible to do without too much trouble but compared to doing most of it in a single devices there's just very little point in spending that much work most of the time.

<comment><USER5> EMC compliance isn't really a concern until you're building a consumer product. A breadboard kit… nah. :)

Noise is a real issue -- but the main concern there is the CPU. Video generation isn't unusually noisy.

<comment><USER7> "EMC compliance isn't really a concern"...

Unless you're this guy

[https://hackaday.com/2019/05/15/the-great-ohio-key-fob- myste...](https://hackaday.com/2019/05/15/the-great-ohio-key-fob-mystery-or- honey-i-jammed-the-neighborhood/)

But seriously, you're totally right.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I really enjoyed building and programming on the Briel Computers Apple I replica, [http://www.brielcomputers.com/wordpress/?cat=17](http://www.brielcomputers.com/wordpress/?cat=17)

</comment><comment><USER9> Is anyone else seeing OpenDNS security warnings on the headlone link to the site?

<comment><USER10> yes

</comment></comment><comment><USER11> I'm really curious how they're doing video. That was the big roadblock I hit when making a Z80 computer a while ago (and what led me to FPGAs).

<comment><USER12> The photo is low res, so can't say for sure, but I expect it uses a microcontroller of some sorts to generate a composite video output.

<comment><USER11> That's a lot harder than it seems, so, I have my doubts. It needs to not only run fast enough to bit-bang the signal but also simultaneously respond to bus requests from the 6502.

<comment><USER13> All depends on which microcontroller it is using. The Propeller microcontroller has multiple cores and specialized registers for video, so it can just dedicate independent core to video and bus control. An Arduino is certainly fast enough to bit bang video, and it could probably interleave bus control between servicing pixels, but the code and timing for that would get complex.

</comment></comment></comment></comment><comment><USER14> Also worth looking at if you're into this sort of thing:

[https://www.reactivemicro.com/product/replica-1-plus-from- br...](https://www.reactivemicro.com/product/replica-1-plus-from-briel- computers/)

</comment><comment><USER15> I wonder why an Apple I? Are they perhaps concerned about IP-related problems with the ROM and other firmware in the II? They're pretty similar but the latter is still easily recognizable as a personal computer and the former not so much.

<comment><USER16> Wasn't the Apple I originally shipped as a kit that you had to put together? I think it's trying to recreate that same idea, but with easier assembly.

<comment><USER15> That could be it, although I guess they also have some earlier kit that seems to be capable of more. But maybe this can too - the 'screenshots' on that page show things an Apple I doesn't do as it is, like display lower case letters. I just have a hard time seeing how the end result can hold a kid's interest. An Apple II can be made to fill the screen with rude words in a line of code!

</comment></comment></comment><comment><USER17> Building, exploring, and programming the workings of early computers builds foundation knowledge that helps with a wide variety of newer technologies. It's good to see projects like this, in my opinion.

</comment><comment><USER18> Serious question:

Do kids want to do this? Is this mainly for geeky adults.

<comment><USER19> Bit of both. Kids like making things with their parents, and geeky parents are more likely to spend the time making stuff with their kids if there's a fun nostalgia trip for themselves at the same time.

I've done a lot of retro gaming projects with my kids because I get some nostalgia, they learn how to make things, and we all get to play some games at the end. It's fun for everyone.

</comment></comment><comment><USER20> Why so little information on this thing? It doesn't even mention if it's using a real 6502, which one, etc.</comment>


Ask HN: I want my Github to be my resume, but... - <AUTHOR>

The following question draws its inspiration from the recent HN submission: `Github is my resume'.
I want nothing more than to establish some interesting (hopefully, successful) FOSS projects, and because I feel programming is the most enjoyable of hobbies, I'm excited to use my free time to this end, but _I_have_no_itches_to_scratch_.
I can't think of anything to add to- or modify in my computing environment(s).
What should I do?
I've felt like an aspiring author with writer's block for the past ~4 years and I'm starting to hate myself for it. <comment><USER2> What can you do?

What do you want to do?

I made <http://jekyllbootstrap.com> because I decided one day I needed and wanted to make myself a blog that was not Wordpress.

All my code is Open Source on Github, I just code all day everyday and throw it up on GitHub.

I would be interested in helping you along because I think it is very rewarding to contribute to Open Source.

So if you will tell me what you are interested in doing as well as what you want to do. For example: web app? front end, backend? backbone? redis? twitter API, documentation generation, good writer? good teacher?

There's something out there, you just need to make small steps. Also what's your github username?

<comment><AUTHOR> > So if you will tell me what you are interested in doing as well as what you > want to do. For example: web app? front end, backend? backbone? redis? > twitter API, documentation generation, good writer? good teacher?

I'm interested in low-level programming, such as compilers/PLs, OS kernels, and GCs. I think I'd also enjoy revitalizing legacy Unix applications, such as Bill Joy's vi from 4.x BSD.

Programming Languages (from most familiar to least familiar):

      C (ANSI C89/ISO C90)
      Java (1.5/5)
      Perl (~5.8)
      Scheme (R5RS)

> There's something out there, you just need to make small steps. Also what's > your github username?

I haven't yet signed-up for an account, but I think I'll go with Bitbucket, as I'm more familiar with Mercurial than I am with Git.

</comment></comment><comment><USER3> I run an open source project called mRemoteNG. We can use all the help we can get. As far as I know, there's no place to match projects needing help with people looking to help projects.

<comment><USER4> Please put your project on <http://swym.me>. I'm working towards matching projects and people with the right skills.

<comment><USER3> Awesome!

<http://swym.me/projects/163></comment></comment></comment>


Counting Bloom Filter: Efficient d-left implementation in Go - <AUTHOR> https://github.com/seiflotfy/dlCBF

<comment><USER2> Odd: "This implmentation (sic) currently does not implement the counter feature."</comment>


5 Questions Every Unit Test Must Answer - <AUTHOR> https://medium.com/javascript-scene/what-every-unit-test-needs-f6cd34d9836d

<comment><USER2> I disagree with some of the points made here.

> Design aid: Writing tests first gives you a clearer perspective on the ideal > API design.

Unit tests are usually too low-level to give feedback into the API design. My experience is that functional tests, based on use case scenarios, give much better feedback.

Standard TDD-based design doesn't really have a way to specify which is part of the "public" API vs. the testing API. Instead, it usually implies that everything is part of the public API, which locks in the architecture rather early. Are there common practices for distinguishing between the two?

> Feature documentation (for developers): Test descriptions enshrine in code > every implemented feature requirement.

Unit tests rarely encode performance requirements. For example, you might have a feature requirement that the code process 10 M records in 2 minutes, or that a given implementation must have worst-case N log N performance. While it's possible to use a unit test framework to write these sorts of functional tests, they are not unit tests.

> Manual QA is error prone. In my experience, it's impossible for a developer > to remember all features that need testing after making a change to > refactor, add new features, or remove features.

Manual QA is a skill in it own right. This is why you have QA staff, who develop and implement a testing plan. Developers rarely have QA experience, so it's not surprising that they would have more problems.

> Automated QA affords the opportunity to automatically prevent broken builds > from being deployed to production

Agreed, but as James Coplien pointed out in "Why Most Unit Testing is Waste":

> You'll probably get better return on your investment by automating > integration tests, bug regression tests, and system tests than by automating > unit tests.

<comment><AUTHOR> > Unit tests are usually too low-level to give feedback into the API design. > My experience is that functional tests, based on use case scenarios, give > much better feedback.

I was talking about the API of the unit under test. In JavaScript terms, this typically means the public API of the module being tested. APIs are developer UX, and providing a good developer UX is great for code quality.

> Standard TDD-based design doesn't really have a way to specify which is part > of the "public" API vs. the testing API.

You should only test the module's public API. If there are functions used internally by that module that also need testing, those bits should be in their own modules with their own unit tests.

> Unit tests rarely encode performance requirements.

Correct, but mostly because the biggest perf problems don't happen at the unit level. They happen at integration levels where things like network communications and disk access happen. Unit tests document the unit's requirements, not the app's requirements. That's why it's also important to have functional tests, and depending on needs, integration tests as well, but even those usually don't measure perf. That's where load testing and app profiling come into play.

All of that is important, and I'm not trying to downplay any of that. However, none of those things can replace unit tests, and the benefits of documenting unit functionality in code.

> Manual QA is a skill in it own right. This is why you have QA staff

Agreed, but it would be extremely inefficient for a developer to ask the QA team for help testing every time they make a change to a unit under development. Automating unit-level QA can solve time by automatically checking the full behavior suite of the unit under test every time the developer saves a file. Studies have shown that far fewer errors make it into the released product when developers use a TDD process, which saves developer time, saves QA time, and improves the user experience, because there are fewer product defects.

> You'll probably get better return on your investment by automating > integration tests, bug regression tests, and system tests than by automating > unit tests.

That's one person's opinion. The empirical evidence linked to in the article says otherwise.

In the article you refer to, James Coplien betrays his misunderstanding about the ideal role and use of unit tests by talking about refactoring already existing functions into smaller, more testable functions. Using the TDD process (test first), you write the assertions before you implement the functions, so no such refactoring is necessary.

He also talks about the futility of large code coverage from the perspective of somebody going back over code and adding tests later, which can indeed be quite challenging, but if you're following TDD, you don't write code paths that do not satisfy a test assertion, which guarantees 100% code coverage.

It would be silly to throw out a process that has been tried and proven because of the opinion of somebody who doesn't even understand the process to begin with. =)</comment></comment>


What We Found Scanning Millions of Email Systems - <AUTHOR> http://blog.smtplogic.com/2012/10/04/what-we-found-scanning-millions-of-email-systems/

<comment><USER2> My mail server deliberately won't complete in under a second. This is because many spam systems don't actually speak SMTP - they just spew the protocol at you and ignore what is being sent back. A little delay helps catch them. (In Postfix use sleep and reject_unauth_pipelining.)</comment>


Spam Volumes Drop by Two-Thirds After Firm Goes Offline - <AUTHOR> http://voices.washingtonpost.com/securityfix/2008/11/spam_volumes_drop_by_23_after.html

<comment><USER2> It's interesting to me that the spammers can recover their operations in merely a few days. Few organisations I can think of could move their entire infrastructure to another provide from a hard shutdown in that amount of time.

I also find it surprising that the obvious barrier exist to shutting these operations down. Since they seems to have a handful of these hosts shut down a year the impact on (illegal) spammers is minimal given their turn around time to redeploy on a new host. That is a sad failure in the legal system. I'd at least like to see the Western world have the legal infrastructure to push this stuff offshore to China, etc.

</comment><comment><USER3> I like Hurricane Electric, fine folks over there. It shows in their actions. I'd give them my business any day. Consider them if you are in the Bay Area.

<comment><USER4> Why should I pay for what is more or less a commodity business that is located in one of the most expensive parts of the country?

<comment><USER3> Because a) nobody provides these services free, b) HE has very competitive prices, and c) their location doesn't matter.

</comment></comment></comment><comment><USER5> So this ends the myth that spam is distributed by Russians and Chinese. (Well, that's probably still true for Russian and Chinese spam, but not English.)

It is also good to know that botnets aren't fully responsible for this, because otherwise spam would be almost unbeatable.

</comment><comment><USER6> One word: Awesome.

</comment><comment><USER7> The article concludes by quoting:

"We're seeing a slow recovery," Bhandari. "We fully expect this to recover completely, and to go into the highest ever spam period during the upcoming holiday season."

When will spamming stop being profitable? There's certainly no shortage of fools in this world--something must be done to the medium itself.</comment>


Non-Sensational Analysis of Recent Facebook Privacy Issues - <AUTHOR> http://www.insidefacebook.com/2010/05/11/analysis-some-facebook-privacy-issues-are-real-some-are-not/

<comment><USER2> The article gives an example of Facebook making its profile information privacy change tool difficult to use, to trick users into giving out more information.

Phone companies where I live have some (overtly advertised) special deals - register up to X friend's numbers for YYY minutes free calls per month.

Problem is the online interface is rigged to fail, forcing the subscriber to contact the operator to set it up manually (lengthy waiting times and the call center is outsourced - low audio quality and thick accents).

Someone on HN noted this type of behavior before and I think mentioned that the company then has plausible deniability (and ofcourse the vast vast majority of users won't bother with the (very nice) deal, because they have to jump through so many hoops.)

Another company (free SMS) had a $2 weekly donation checkbox during signup. Fair enough, but it refreshes the page with the checkbox ticked again if you untick the checkbox and try to submit.

I hate companies like this with a vengeance.</comment>


Adobe Releases First Linux Flash Player Update in 4 Years - <AUTHOR> http://qntra.net/2016/12/adobe-releases-first-linux-flash-player-update-in-4-years/ <comment><USER2> Oh please, no! This was hands down, the worst thing I've ever experienced on linux.</comment>


What is payondelivery? - <AUTHOR> http://blog.payondelivery.com/

<comment><USER2> What if I sell an expensive product, such as a smartphone. It arrives, but then out of the blue the buyer says it is not what they ordered. They return the product and provide proof that they mailed the replacement. All good?

When the merchant receives the replacement, they find that the return box just contains a brick, or something less obvious, such as a broken phone. Now the customer has not paid yet, but they have your merchandise.

How would you be protected in that case?

Currently the seller is protected, because they can defer issuing the refund until after verifying that the returned product is what it should be.

<comment><USER3> hey bemmu, here's the Payondelivery return process: The buyer has to return the package 'as is' through their Payondelivery account, they print a return label on their Payondelivery account and ship it back to the seller (hence no need to provide proof of return). When the seller receives the package and it's a brick, they raise a dispute with Payondelivery (seller has 24 hours to do this). Because we have shipment data on both the outgoing and return package we can quickly decipher if something else was shipped in the return package to the seller. Once this process is concluded and we determine the seller's original product was not returned, seller gets paid.</comment></comment>


Ask HN: Why aren't the big tech sites discussing #eG8? - <AUTHOR>

Is it just me or is it odd that none of the big tech sites (except Arstechnica and Techdirt) are discussing eG8? I can't believe there's no story for Techcrunch, Gigaom, Gizmodo and even Engadget to write about in any of these days. Isn't this kind of a matter of life and death for the Internet?<p>I think they should take more responsibility in defending the environment in which they were built, or at least weigh in on the issue. <comment><USER2> as long as there is no decision made by policians which will affect ordinary internet users, entrepreneurs and investors nobody cares. but of course you are right. there should be much more engagement right now to prevent negative decisions made by politicians in the future, who care more about elections and votes to get reelected #sarkozy

<comment><USER3> > _as long as there is no decision made by politicians which will affect > ordinary internet users, entrepreneurs and investors nobody cares._

The ironic thing is that, if they think nobody is paying attention/cares -- that is precisely when they will feel empowered to make decisions.

<comment><USER2> exactly!

</comment></comment></comment><comment><USER4> I find it more odd that the EFF founder wasn't mentioned as a "world's most powerful internet and media bosses" even though he was included to speak on equal terms.

<http://www.bbc.co.uk/news/world-europe-13513958>

[http://www.dw- world.de/dw/article/0,,15099686,00.html?maca=e...](http://www.dw- world.de/dw/article/0,,15099686,00.html?maca=en-rss-en-all-1573-rdf)

</comment><comment><USER5> This is not #twitter, you don't need #tags.</comment>


JRumble: A jQuery Plugin That Rumbles Elements - <AUTHOR> http://jackrugile.com/jrumble/ <comment><USER2> I'm not sure why there is so much negative sentiment about this effect. Rumble can be used pretty nicely for a range of things, for example if you attempt to click on something which should not allow focus, or if you add an item to a new item to a page which would otherwise look too similar to the rest of the page and you want to draw attention to it ... there are loads of valid uses for this.

<comment><USER3> It would be pretty great for replicating OS X's "shaking no" effect when you type your password in wrong on the login screen (it needs a falloff setting though).

<comment><USER4> I noticed recently that the Wordpress login page now does this.

</comment></comment></comment><comment><USER3> I'm going to see if this works with the CSS3 animated glowing form (<http://news.ycombinator.com/item?id=2399927>). If you don't hear back from me, it's because my brain exploded.

<comment><USER3> <http://jarinudom.com/experiments/brainexploder>

<comment><USER5> Thank you for making Glowform even more EXTREME!!!!

</comment></comment></comment><comment><USER6> I think it would be very cool to add a 'decay' option, where the ranges decrease over time until the effect stops. I might have to fool around with this myself.

</comment><comment><USER7> Well, I expected to see what I actually saw. A++

</comment><comment><USER8> It's neat that he was able to make this effect, and I'm glad we're experimenting with new Javascript+CSS3 effects.

This particular effect, though, reminds me of turbulence in an airplane, or the rumble of a subway. When I see the rumbling elements on the page, it makes me nervous and anxious.

</comment><comment><USER9> There needs to be a Bookmarklet for this, whereby I could click it and every div on the currently viewed site would rumble until the browser crashed.

EDIT: <http://dl.dropbox.com/u/4912110/jrumble-it.html>

<comment><USER10> eh, i just made it so it rumbles all divs:

      javascript:var i,s,ss=['http://dl.dropbox.com/u/1578229/jrumble.1.1.min.js,http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js];for(i=0;i!=ss.length;i++){s=document.createElement('script');s.src=ss[i];document.body.appendChild(s);}void(0);bookmarklet

</comment></comment><comment><USER11> Such a fun little effect, but probably such a bad design decision 99% of the times I'd be tempted to use it. Great looking documentation page, too.

<comment><USER12> Similar effect is used on iOS devices when you are in the "rearrange icons" mode.

</comment></comment><comment><USER13> Before I got to the end of the title, a little part of me hoped it was a jQuery plugin that operated rumble motors and force feedback in game pads and the like. Not that it would be useful on any widespread scale.

The rumble effect presented on the other hand seems like it will be useful to alert users to errors or interactive elements. I can think of some cool interface sugar to implement with it.

</comment><comment><USER14> The new <blink>?

</comment><comment><USER15> Very cool. I was surprised at how much little code is needed to make this work. After reading through the source, it seems like no js lib is "needed" for this effect to work at all. The rumble.js file might be a tad bit longer, but no need for an external dependency.

Cool work! It's amazing just how creative people are.

</comment><comment><USER16> I remever rumble effects like this being very popular in flash interfaces for a good long time. Now all we need is an on hover ramping tansition to a hilight color and transition back and we are set to repeat 1998!

</comment><comment><USER17> This is actually a great way to teach someone about mouse states.

</comment><comment><USER18> This is hilarious. I wrote a button hover algorithm just like this years ago in Lingo for a shopping CD-ROM. What comes around, goes around...

</comment><comment><USER19> Very interesting effect! I can see using this to attract attention to an inbox indicator that got a new email, or something similar.

</comment><comment><USER20> great another annoying thing to look forward to in the future of web ads.

</comment><comment><USER21> This will be useful for April fools next year.

</comment><comment><USER22> Is this the new <blink>? :)

</comment><comment><USER23> Worst.Effect.Ever /comicbook guy

</comment><comment><USER24> Given that the developer was about 7 years old when the BLINK tag was inflicted on the world, I'm going to forgive him for this. But really, this is a lot of HTML/JS/CSS evolution just to get back to what is effectively BLINK.

<comment><USER25> What about all of the UI animations built into jQuery and other frameworks these days? Sliding, pulsing, hopping, etc. all provide essentially the same purpose, to guide your attention to a particular element as it changes. I don't see anyone clamoring about those being the second coming of the evil BLINK tag.

The problem with the BLINK tag was the fact that anything wrapped in it would blink continuously, for as long as the page was loaded. I don't think anyone is suggesting that this plugin should be used to continuously rumble anything on the page, any more than anyone thinks jQuery.slideToggle() should be called in an infinite loop to slide something up and down continuously.

It's a design element that should be used sparingly and for a limited time to grab the user's attention in an interesting way. Nothing more.

<comment><USER24> There's a difference between the potential to do annoying things, and actually _implementing_ annoying things. I'm sure there were non-annoying ways to use BLINK, too, but that doesn't meant that it wasn't mostly used in a bad way.

<comment><USER25> > There's a difference between the potential to do annoying things, and > actually _implementing_ annoying things.

That's exactly my point.

> I'm sure there were non-annoying ways to use BLINK, too, but that doesn't > meant that it wasn't mostly used in a bad way.

Similarly, there are annoying ways to use jRumble (or jQuery.slideDown()), which shouldn't preclude it being mostly used in a good way.

</comment></comment></comment></comment><comment><USER26> My first thought reading the headline was, is this to make sure my web site is earthquake safe?

edit: If nobody downvotes this I will consider it a successful comment!</comment>


"Ok Google, play music on Spotify" stopped working - <AUTHOR> For years that command worked fine, it would play some of your Spotify songs. Since a few days ago it now trigger a 30 second voice instruction on how to use Google Home for music.<p>From now on, you need to specifically choose a song to play. <comment><USER2> It works just fine for me, but it's for my car, and I'm not in a country where Google Home is common.

</comment><comment><USER3> Just tried it on mine and I'm experiencing the same. Don't know that it will bother me much though.</comment>


Why can't programmers design software? - <AUTHOR> https://qnoid.com/2011/02/23/Why-cant-programmers-design-software.html#main <comment><USER2> Is it just me? I don't like this design.

What's the point of wrapping an algorithm in strategy, when there is no reuse, nor any need to exchange algorithm?

And more. Why FizzBuzz(15), Buzz(5), Fizz(3); in enum and not in the constructor?

Why "mod" attribute, when the rest of the code doesn't use shortened words? It should be modulo.

Why FizzBuzzOperator when FizzBuzzStrategy's initialization is that easy? Also, again there's no requirement for reusability.

The code here is a classic example of why people make jokes about (usually in J2EE) overengineering solutions where even FizzBuzz will be designed for 1000MD-average-task-size scale.

I have switched to Clojure for good. Our FizzBuzzes are oneliners [http://www.learningclojure.com/2014/05/fizz-buzz- interview-q...](http://www.learningclojure.com/2014/05/fizz-buzz-interview- question.html)

<comment><USER3> The Clojure FizzBuzzes may be one-liners, but they are multiple statements, which I'd find easier to read on multiple lines.

<comment><USER4> Which is exactly what you found when you clicked on the link to the blogpost in the previous comment. So what is your point?

</comment></comment></comment><comment><USER5> Very simple:

Because in the precious few hours they have to devote to "pure learning", when between jobs -- they're only motivated to hunker down and bone up the only thing that really matters: the latest tips 'n' tricks for passing all those fun programming quizzes (and the occasional "culture fit" question or two) that are the mainstay of the modern interview process.

Designing real, usable, maintainable ... _software_? That's much more difficult to "test" for.

<comment><USER6> Is it though? I give an interview question where I present a spec to be implemented. There's no algorithmic trick, but you do have to know to watch out for common problems (end of array conditions, etc). Sadly though we hired someone against my vociferous objection that failed my question in the worst way - he ditched the spec, attempted a complicated solution, and proudly asserted that "it works" at the end of the interview, because it passed the four test cases that I wrote as examples. I couldn't identify the bug by eye and in fact had to write a property testing framework to identify the bug. On the plus side, I now have a property testing framework for my interview question.

<comment><USER7> Do you ask the same question each time?

<comment><USER6> low n. I'm just starting out.

</comment></comment></comment></comment><comment><USER8> I guess it's because I haven't worked on a really massive project with lots of other people, but I've never really needed to "design" software. Sure, sometimes I'll stop for a minute to think about the next thing I'm going to write and how it slots into the existing parts, but for the most part my programs grow organically. They start from a small kernel, parts of them grow and are branched off (B-tree style) into new files and subdirectories, and soon enough the whole thing is complete, or at least as complete as I need it to be for the moment.

The best experiences I've had programming are with languages and tooling that make this organic growth and splitting process as painless as possible (Rust in particular is really strong in this aspect). Doing such a thing from the top down (as with Java, where you have to be very thorough with your design patterns and UML diagrams and whatnot) seems unnecessarily difficult and restrictive.

<comment><USER9> Designing from top down may help you a bit when you already have a mental model that you'd wish to convey in written form rather quickly, otherwise risking to loose sight of it when you get into details. UML helped me write down ideas (mostly communication flows and other behavior related aspects, not class diagrams), but I can understand why one may feel restricted when that's not necessary. Growing organically has its benefits for sure (is more fun, at least), but I also had more than one case of reconciling diverging/incompatible parts of a system simply because I went ahead of myself there with improvements on the go. Wasting time on that under deadlines is less fun.

</comment></comment><comment><USER10> I can't tell whether this is real or a parody.

<comment><USER11> It is parody.

</comment></comment><comment><USER12> Perhaps the issues is a programmer actually writing that in an interview they would be given a hard pass from any team I would actually work with.

</comment><comment><USER13> Surely someone needs to mention FizzBuzzEnterpriseEdition [1], which is clearly the best resource in this domain? Don't ignore the issues, true gold in there :)

[1] [https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpris...](https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpriseEdition)

</comment><comment><USER14> Summary: 2011 OO FizzBuzz joke...

</comment><comment><USER15> Is this article some sort of joke? Poe's Law seems to be in force here.

<comment><USER11> Cannot be anything but a joke. The problem is simple, the solution requires 10 lines. There is no reason, absolutly none, to create an interface for a such simple problem.

<comment><USER16> Until this is done in Reactive programming style, this is far from complete.

</comment></comment></comment><comment><USER17> Maybe it's that ol' Software Crisis or thar Pleasantness Problem

</comment><comment><USER18> Because the language discourages it? Language, or pretentious Pidgin in this case, limits thinking.

<comment><USER19> Is it Java the language or Java developers that people think is a joke?

<comment><USER18> Hey, minecraft was done in java. It can't be that bad.</comment></comment></comment>


What are the Big Problems? - <AUTHOR> I'm leaving this open-ended, there's no specific criteria for responses.
I'm interested in both your list and the reasons why. Submitting your list before reading other's contributions would be preferred.
Optionally: who is (or isn't) successfully addressing them. Individuals, organizations, companies, governments, other. How and/or why not?
I've submitted this question previously to HN (most recently over a year ago), and ask it periodically on several forums for four years now.  I've written fairly extensively on my own views, reasonably findable if you wish, but my interest here is in gaining fresh input, resetting my own biases, and not colouring the discussion overly myself.
In the past year, a notable development on the question itself is the MacArthur Foundation's "100 and Change" program, putting a substantial financial backing to a specific proposal to address a large global social problem (submissions are closed for 2016, the award will be made every three years). <comment><USER2> How to police in a world of perfect information. For example, we are rapidly approaching a time where the speed of every car or the alcohol level of people's blood will be known 100% of the time, so how will social norms, policies, and policing need to adjust?

</comment><comment><USER2> The US National Academy of Engineering believes there are 14 top engineering challenges - [http://www.engineeringchallenges.org/challenges.aspx](http://www.engineeringchallenges.org/challenges.aspx)

<comment><AUTHOR> Oh, thanks, I really appreciate external references!

I see maybe five of those as particularly laudable + practicable. And there a number of other projects I'd add (or substitute) into the list.

Solar, water, infrastructure, information security, nitrogen cycle, and carbon sequestration seem sound. The others not quite so much.

there are a few entries I'add or substitute on that list.</comment></comment>


Ask HN: How does free compete with paid? - <AUTHOR>

Our free website makes money off of CPC revenue, but our chief competitor charges a monthly membership fee. This means they can run promotions saying "Hey! Sign up now and get your first 2 months at 50% off", while we can only say "Uhh... we're still free."
So they get coupon site love, and we end up in the free-site bucket. (Though our site totally kicks their butt, not that I'm biased:-)
And this leads me to my question: WWHND? <comment><USER2> freemium.

say "hey, our free version is just as good as those guys' paid version. plus, if you want even better stuff, you can pay $X/mo and get some even more super awesome features that those guys don't even have at all! here's a coupon."

<comment><AUTHOR> Where would you say "Hey, we're better"? Mentioning it on the service's site isn't that useful since the visitor is already there.

<comment><USER2> adwords is a good start.

</comment></comment></comment><comment><USER3> The site he mention is <http://linkup.com> . HNers please suggest how to promote the FREE service. I have no connection with this service but like to see things free as long as it's possible. (No offense with making money with technology but if someone is happy & able to offer a free service it's cool I guess.)

<comment><USER4> How about starting a blog about how to find jobs in this market?

That'd no doubt be highly diggable and gather hits from all over the place. Then page rank goes up. then hits come in.

<comment><AUTHOR> We've got a Twitter account, and a Facebook friend's page.

I've leaned against doing a blog for two reasons: 1) There are many other experts in this field who praise us & eclipse my knowledge (like <http://jobsearch.about.com/>)

2) Other job search engine blogs have been miserable failures, based on number of comments & attention they've failed to attract (like <http://blog.indeed.com/>, <http://blog.simplyhired.com/>, <http://www.careerbuilder.com/jobseeker/blog/> and <http://monster.typepad.com/>)

<comment><USER4> It's good to see that you've done your research, but I wouldn't discard the blogging route just because of those examples (so long as you have a good writer on your team).

Looking at the examples you gave, and tearing them down one by one:

<http://blog.indeed.com/> \- fairly basic design, and all the articles seem to be about themselves.

<http://blog.simplyhired.com/> \- again, mostly self-serving and/or random articles... "2009 Simply Hired Nugget Bowl"?? Who cares.

<http://www.careerbuilder.com/jobseeker/blog> \- better content, but terrible design. It's painful to even look at, let alone read.

<http://monster.typepad.com/> \- better content again, but mostly ultra-short articles.

None of those are blogs that anyone sensible would read regularly, because they mostly regurgitate fairly boring or self-serving points without any new, useful ideas, and they're badly designed.

By "doing a blog" I don't mean doing a blog about you or about your business. I mean doing a blog about the topic that your business is related to, and making a genuine effort to write thoughtful articles that will influence the industry positively and/or be of interest to your target market.

I'd like to give our blog (<http://www.woobius.com/scribbles/>) as an example, but it's a little bit shambolic at the moment. Yet even so, the "thought leadership" articles we posted there generate some good hits and have generated some very good leads for us. Importantly, they've also massively upped our pagerank (because we run it on the same domain rather than a subdomain), which means, for example, that woobius comes up on the first page of results already for, for example, "construction collaboration".

So there's multiple benefits to creating a _good_ blog. Of course, creating a good blog is hard, but if you can, imho, it's worth it. Whether you can is a function of whether you have interesting ideas about your industry (you probably do) and whether you have a good writer on your team who can write those in a clear, blog-friendly shape.

</comment></comment></comment></comment><comment><AUTHOR> The business is a job search website. Although the discussion certainly doesn't need to be limited/oriented towards that niche.

</comment><comment><USER5> depends on what kind of bussiness you're running though...

If it has anything to do with "exclusivity" or "privilege" or "be the first to do blah", you _must_ charge. You can give "special" customers a free or heavily discounted pass, but you must make it seem like it's only them getting something exclusive for an exclusive price. Think country club or night club style business.

</comment><comment><USER4> This begs the question... why aren't you charging a monthly fee? Too much money sloshing around in your bank account?

<comment><AUTHOR> We're not charging a fee because we're firmly against charging jobseekers (who are usually unemployed). We're able to finance ourselves through the CPC methods.

<comment><USER6> OK, so you won't charge jobseekers. Does your service have a flipside where you allow employers to search resumes, or do any sort of matching between jobs and seekers? Are you charging the employers at all? And if not, why not? A free service is good for individuals looking for a job, but charging companies looking for excellent employees will actually make you look more credible.

<comment><AUTHOR> Since the service doesn't have jobs on it, it just points to josb (like Google, ignoring their cache), there are no resume services offered. For people wanting resume hosting, we point them to <http://emurse.com>

The service charges employers for sponsored listings, like Google's AdWords. Another paid service is for more frequent indexing, and another is for direct access to customized company-specific job feeds, which is useful to recruiters, affiliates & competitors.

</comment></comment></comment></comment><comment><USER3> Hey let's do some campaign to promote yours, if it's really good.

<comment><USER3> Hmm... I knew this would be a down vote magnet. Anyway I was trying to help the FREE service.</comment></comment>


Ask HN: Do we limit a mind by teaching it how to think? - <AUTHOR> Parents try to raise their kids inside the box to give them the best possible chances of success in society. Employers then tell their employees to think outside of the box. In a society where creativity and new ideas are prized, are we restricting a mind's imagination with mental disciplines during its formative stages? <comment><USER2> /r/tenguy</comment>


Inbound Marketing Attracts Millions Of Google's Dollars - <AUTHOR> http://marketaire.com/2011/03/08/inbound-marketing-attracts-millions-of-googles-dollars/

<comment><USER2> I followed Dharmeshs' blog from one of the earliest posts.

It seemed from that outside that he learnt about entrepreneurship at college, and then simply went about the business of putting that into practice.

Theory grounded in the type of common sense espoused on this site.

Congrats to him & Brian for making such a huge success of it. Has been very interesting to follow.

<comment><AUTHOR> Very cool! I wish I had checked out the blog earlier, but even following the more recent news with HubSpot and the future potential is exciting. It proves that a solid initial strategy must be in place for success, but the limit of success is unknown due to innovation. I can see this company booming very, very soon.</comment></comment>


SpaceX Grasshopper Divert (13 Aug 2013) - <AUTHOR> http://www.youtube.com/watch?v=2t15vP1PyoA

<comment><USER2> I believe that the most amazing part was the last 2 seconds. The rocket landed with no net motion of the entire vehicle - it cut engines almost instantly upon touching down.</comment>