Average Net Worth by Age: How Do You Compare? - <AUTHOR> https://turbo.intuit.com/blog/real-money-talk/net-worth-by-age-704/ <comment><AUTHOR> Regularly I see people here make rather shocking statements about how 100k salary isn't a lot, how they need multiple millions to retire, (in threads like this one yesterday: [https://news.ycombinator.com/item?id=18643427](https://news.ycombinator.com/item?id=18643427) people were suggesting that a million dollars isn't enough to live the rest of your life on for example, while 1 million dollars is higher than MANY people's FIRE number).

I think this article will be a bit sobering, if not unbelievable, to a decent percentage of the HN community.

Chiefly I wany to stress this bit:

>According to the Federal Reserve, the average net worth for families in the U.S. under the age of 35 was $76,200 in 2016. That same year, _the median net worth was $11,100_ , so keep in mind that the average is skewed by a small percentage of affluent Americans.</comment>


Who is changing our weather? - <AUTHOR> http://www.geoengineeringwatch.org/

<comment><AUTHOR> More explanation at <http://www.geoengineeringwatch.org/cont/></comment>


Markdeep markup language - <AUTHOR> http://casual-effects.com/markdeep/ <comment><USER2> Markdeep has some very nice features. I love to be able to have more expressiveness than in regular markdown.

But I am not so sure about the diagramming feature. Writing diagrams as ascii art seems like a PITA to me, especially when you need to update a diagram with new shapes, etc.

For this I prefer PlantUML markdown integration: [http://plantuml.com](http://plantuml.com)

I use VS Code and it has a nice plugin to handle this.

<comment><USER3> What about freehand drawn diagrams? It seems pretty fast and intuitive, and would deal with your problem* . Are there any tools for making freehand diagrams look professional? It would be analogous to how Markdown makes "crude" text look "professional".

* As long as you have good coordination.

<comment><USER4> This is an interesting idea---how hard would it be to do this? It might be as simple as doing k-means on the pixels or some other kind of clustering algorithm, and then fitting a spline curve to each cluster...

</comment></comment></comment><comment><USER5> To go beyond generic Wiki syntax, SGML lets you define context-specific token replacement rules. For example, to make SGML format a simplistic markdown fragment into HTML, you could use an SGML prolog like this:

        <!DOCTYPE p [
          <!ELEMENT p - - ANY>
          <!ELEMENT em - - (#PCDATA)>
          <!ENTITY start-em ''>
          <!ENTITY end-em ''>
          <!SHORTREF in-p '*' start-em>
          <!SHORTREF in-em '*' end-em>
          <!USEMAP in-p p>
          <!USEMAP in-em em>
        ]>

The following text:
           *this*
           will be put into EM
           element tags

<comment><USER6> so XML removed the best part of SGML..

<comment><USER7> XML was always intended more for machine than for human consumption. It's easier for machines to consume extremely regular syntax, so that's what XML has.

<comment><USER6> unfortunately it had its time as a pseudo programming language period..

<comment><USER7> > unfortunately it had its time as a pseudo programming language period..

You are quite right. I should probably have said something more like "XML was intended _by its creators_ more for machine than human consumption" (and, incidentally, creation; I think I have read that XML construction wasn't really intended to be done by humans either).

</comment></comment></comment></comment></comment><comment><USER2> Something I haven't seen in any markdown editor so far (suggestions welcome) is extended table support.

Say I have a table with a 'name' and 'value' column and 100 entries. And I'd like names to be alphabetically sorted. So far so good.

But this table is too long and too small, so I want to have 4 columns and 50 rows, where the name/value continue in column 3, 4. Out of luck. This is unmanageable, as you have to shift many cells when adding a new entry.

A proposal for something like this: [https://github.com/github/markup/issues/1189](https://github.com/github/markup/issues/1189)

Also mentions multi-line cell contents, which are hard in regular markdown (require inline html)..

<comment><USER8> I think Emacs's org-mode can do that, by offering an easy way to insert columns. It's not markdown, but at a glance, the table syntax seems compatible or close enough, so maybe copy/pasting to and from Emacs could do the job if you can stand Emacs.

org-mode's tables can do a lot of things.

[https://orgmode.org/org.html#Tables](https://orgmode.org/org.html#Tables)

<comment><USER9> I'm pretty sure Pandoc has an option to interpret org-mode style tables in Markdown files, and Org-mode itself has a mode for editing tables in non-org files. I haven't played with either, however, so I can't report on how well they work.

</comment></comment></comment><comment><USER10> Well the whole point of markdown is that it is simple enough so that devs easily document whatever necessary. As you know documentation is notoriously neglected by the developers. But this is not that simple. I doubt it will be adopted that much.

<comment><USER11> I'm not sure you realize how many blogs and website are written using markdown.

<comment><USER12> I think the parent's point is that markdown is simple, but markdeep is not.

<comment><USER13> I think your parent's point was that Markdown is used in a lot of situations where simplicity isn't as important as it is when documenting code.

</comment></comment></comment></comment><comment><USER14> I really like the idea of a new markup format. To me markdown has been very unintuitive in some ways. I can never remember whether more # means higher or deeper header level. Or which of - - - or === makes a first or second level header. But since markdown is first class citizen at github, I don't think we'll ever be able to see any real competition rise up (even though github has first class support for others, markdown is the clear winner). And I've never heard anyone else mention these confusions so maybe everyone else is fine with it and I'm the only one who wants an alternative.

<comment><USER15> Asciidoc is a viable alternative. By now you have Asciidoctor in Ruby, AsciidoctorJ on JVM, Asciidoctor.js and even original Asciidoc Python recently rewritten for Py3.

[https://github.com/asciidoctor/asciidoctor.org/blob/master/d...](https://github.com/asciidoctor/asciidoctor.org/blob/master/docs/_includes/asciidoc- vs-markdown.adoc)

Here is a very short intro on rendering in your browser: [https://www.youtube.com/watch?v=4LOB3WeOUJk](https://www.youtube.com/watch?v=4LOB3WeOUJk)

Asciidoc.org at some time in the future should be the page for the language spec. The biggest feature is probably that you can produce DocBook and it's very easy!

<comment><USER16> We've been really happy with Asciidoc at work. We maintain multiple large versioned documents as a team and had been using Word and 'Track Changes' to do updates. We've now moved them entirely to Asciidoc and are using Git for tracking and approving changes, and the difference is night and day. We considered Markdown at the time, but things like numbered lists incorporating paragraphs, metadata inclusion, and the need to specify certain elements about the final published version meant that Asciidoc was a clear winner. To get all of those incorporated using Markdown would have meant implementing one of the Markdown dialects, and then ensuring that everyone's tool-chain that thought it spoke Markdown wouldn't then munge it to death.

</comment></comment></comment><comment><USER17> Hartl's Tenth Rule of Typesetting:

"Any sufficiently complicated typesetting system contains an ad hoc, informally specified, bug-ridden, slow implementation of half of LATEX."

Markdeep is no exception.

[http://manual.softcover.io/book/softcover_markdown#cha- softc...](http://manual.softcover.io/book/softcover_markdown#cha- softcover_flavored_markdown)

</comment><comment><USER18> I really wish people would simply forget about markdown and restart with a slightly more sensible and extensible markup. I personally always thought that some sort of latex/context with a simple markup for common commands would be more useful.

</comment><comment><USER4> This sounds pretty cool. My own workflow is so pandoc-dependent though that I don't think I could use it unless someone who is much better at Haskell than I am works the markdeep extensions into pandoc :-(

</comment><comment><USER19> The day I find one of these mark* languages that supports poetry -- which simply means, a section in which it respects literal indents and line-breaks, but not by dropping into monospace font -- I'll use it.

N.B. the online publishing platform Leanpub has its own mark* variant, "markua"[1] which actually does recognize a poem section -- although as implemented it has minor formatting issues.

[1] [https://leanpub.com/markua/read](https://leanpub.com/markua/read)

<comment><USER20> I've put together a book of poetry using CLI/markdown-ish tools. pandoc make texlive-xetex is what's in the Dockerfile that builds it. If you contact me directly I'd be willing to share how far I've gotten with the problem.

</comment></comment><comment><USER21> I think anyone would agree that Markdown the sna bit too simplistic, and while Markdeep looks cool, it seems like it ends up at the opposite extreme with too much complexity.

</comment><comment><USER22> From 2015: [https://news.ycombinator.com/item?id=10402121](https://news.ycombinator.com/item?id=10402121)

</comment><comment><USER23> Similar [https://ivanceras.github.io/svgbob- editor/](https://ivanceras.github.io/svgbob-editor/)

<comment><USER24> Very cool. Thank you for making and sharing this!

</comment></comment><comment><USER25> Shameless plug: [http://write.pub](http://write.pub) supports most of the features of MarkDeep, and allows WYSIWYG writing.

It also shows with built in version control, you don't have to know git to use it

<comment><USER26> Is this just a wrapper for tui.editor?

<comment><USER25> The editor is indeed TUI. But TUI doesn't support editing/saving local files, which write.pub allows.

There are multiple other features, like WYSIWYG diff and version control that make this app compelling

<comment><USER26> That's awesome! I'm a huge fan of tui so I was curious.

</comment></comment></comment></comment><comment><USER27> Markdown is cool because it's minimalistic.

Markdeep might be a good idea, but if you start adding more and more feature you reimplement HTML, at that point why not simply use HTML? Isn't HTML plain text, too?

<comment><USER28> This was my thought when I saw the example on the frontpage with styling

</comment></comment><comment><USER29> Is there some way of doing 3D diagrams?

</comment><comment><USER30> Justified margins?</comment>


A collection of useful tools and resources for designers and developers. - <AUTHOR> http://wootoolkit.com

<comment><USER2> nice website but it looks like the toolbox.cc or agiledesigners.com. I'll be watching.</comment>


Show HN: Real Real-Time Chat - <AUTHOR> http://chox.co/#/gAz941

<comment><USER2> Cool stuff, well executed :)

I run echoplexus @ [https://chat.echoplex.us](https://chat.echoplex.us) ([https://github.com/qq99/echoplexus](https://github.com/qq99/echoplexus)), a somewhat related project. Let me know if you ever want to chat

</comment><comment><AUTHOR> Now with private messaging. Built with Firebase, Angular, and Nodejs.</comment>


My Landlord Ratted Me Out to the Cops - <AUTHOR> http://thebillfold.com/2013/09/my-landlord-ratted-me-out-to-the-cops/ <comment><USER2> I think this actually went pretty well.

\- Internet crime is reported

\- Police IT team tracks it to specific IP and address

\- Contacts owner, she says (incorrectly) the WIFI is secured with only the two people at the address having access

\- Regular police is sent to collect all computers at the address

\- When the police IT team realizes the computers weren't connected to the scam, they are returned within two weeks.

The only thing that really went a bit bad is the reported attitude of the regular police officers sent to the address.

Of course it would have been better to have sent someone better at both IT and english. If either of those had been different they might never have taken the computers, but the two weeks to clear things up are pretty good as government organizations goes.

<comment><USER3> Two questions:

* did police payed the damage caused by confiscating computers? It could be easily thousands euro.

* crime was a few stolen theater tickets. Confiscating stuff seems like over-reaction, when bike is stolen (similar value) they do not even bother to come to crime scene.

<comment><USER4> As much as I normally hate political/police over-reactions of anything because it's digital, I think it's not reasonable to make a tickets--bike comparison.

They weren't there because someone stole theatre tickets, they were there because someone stole credit card numbers - which is more serious, largely because it's a lot more scalable than stealing a bike.

<comment><USER3> I think it is fair comparison. There are gangs stealing bikes, it is also frequently target to vandalism. And it is scalable to the level, that is not safe to leave your bike without lock.

Also article only talks about single credit card.

We should not make difference between crimes, just because one has strong bank lobby behind it.

<comment><USER5> ? You can't make purchases anywhere with a bike.

<comment><USER6> It's pretty easy to sell bikes...We have several specialty bike stores around here and if you walk in with a decent road bike in good condition you can walk out with $500 easily.

</comment></comment></comment></comment></comment></comment><comment><USER7> > The two cops are at the door, holding our computers.

That's service. When the German police took away my computer and I turned out not to be guilty I had to get it back from the police station in the next large town. The computer was pretty much destroyed. I don't know what they do in 'computer forensics' but I assume it has something to do with slamming a hammer into the main board and playing soccer with the hard drives ...

<comment><USER8> The exact same thing happens in the US. About 2 years after your equipment is confiscated, you get a letter stating that you can come get your stuff within the next 6 days or they are going to auction it off. So you've got to spend the gas to make a 2 hour drive to wherever they took your stuff, and then everything will be broken anyway. It's obsolete by now. And it's all covered in evidence stickers that don't peel off but at least give your case some 'street cred'. They always manage to break the case in about 5 places and the hard drives always come back DOA.

And it used to be they didn't have an Mac monitors, keyboards or mice, so they'd take ALL your Mac stuff. But for a PC they just take the tower.

<comment><USER9> Do you know if renters / home owners insurance covers confiscation and destruction of computer equipment?

From your perspective, your computers have been stolen.

</comment></comment></comment><comment><USER10> I can't help but feel that since the landlord believed that the wifi was secured and the only person with the password was the tenant the only decent thing to do was actually cooperate with the police. Wasn't it?

<comment><USER11> That's why he ends the story with:

> I'm not even all that pissed off about it. She genuinely thought I was the > only person with the password. I probably would have given me up too.

<comment><USER10> Yes, but the tone throughout the story feels otherwise, don't you think? It was more like an impression of how the text felt than this actual final line acknowledging it.

<comment><USER12> It's really the title. The story isn't about him being ratted out to the police, it's about the police officers sent not having the most rudimentary understanding of technology, and maybe a bit about the language barrier.

Even knowing that the wireless network was unsecured would not have stopped them from taking his computers and the router (as there was no particular reason to think he hadn't unsecured it knowing they were coming).

</comment></comment></comment></comment><comment><USER13> I was questioned by police a year ago. I hadn't done anything and was at the police station voluntarily but after an hour I exercised my right to leave - the 2 officers knew absolutely nothing about the crimes they were meant to be investigating and everything I said was either not understood or they believed that what I was saying wasn't "how it worked".

Their ignorance would be funny if it wasn't for the fact that some people have been arrested and convicted of crimes for which they were innocent of because of it.

</comment><comment><USER14> It is also a bit surprising that the police force is using regular police to do technology heavy investigations. Would it really have killed the budget to send along a adviser who know the difference between a computer screen and a hard drive.

Say he had been guilty. He could "given" the police the nice clean computer, while the real evidence sits on a NAS/cloud somewhere, or been encrypted, or have done anything that would confuse people who don't have a clue where digital evidence actually resides. It becomes a designed system to catch innocents, while guilty people can run circles around the system.

<comment><USER15> Not only that, they let him dick around on his computer in front of them. A quick "rm -rf" would have made evidence retrieval a fair bit harder, wouldn't it?

<comment><USER16> Not really, at least for most filesystems. Now "cat /dev/urandom > /dev/sda &" or equivalent while stalling the cops by looking at emails on the other computer, that might be something of a problem.

That's how I decommission drives and other media assuming I can't physically destroy (which I usually can and do, but sometimes it happens). Overwrite with random data. Sometimes multiple times if I'm in no hurry. Much easier if the device is in an external reader rather than being your boot disk of course. Sometimes it takes awhile.

I still have scar on my hand from snapping my first glass platter. Hmm platters from this era, were always metal, yeah that's what I thought before it shattered.

<comment><USER17> That's not the point. The point is that they let him touch the computer while the police were present. He could have his computer set up where if he unlocks it with a "special" password, it behaves normally while zeroing all the sensitive data in the background, for example. The point is, there's no limit to what he could do once he's allowed to touch the computer.

</comment></comment></comment></comment><comment><USER18> Pardon me, but shouldn't it be compulsory that if the police know they're dealing with a foreign national they speak to him with an interlocutor of his preference? I mean - why should the onus be on the accused to blurt out his rights and then do the entire merry-go-round. I'm sure it won't be that difficult to arrange for 1 English (global business language) interlocutor in Copenhagen. The onus should be on the police to allow an opportunity for explanation.

<comment><USER19> On the other hand, if you're a guest in a country, shouldn't you be responsible for making sure you can understand and be understood, either by learning the language or knowing someone you can call?

Personally, I think a middle term would be more appropriate - police agents should have a decent grasp of English (i.e., better than mine), and visitors to the country should know either the local language or English. An "interlocutor of his preference" seems an excessive requirement.

<comment><USER20> No.

Unless you make that a legal and well-known requirement for residence in a country, that's just not okay. Do I agree with the general idea, that 'guests in a country' (i.e. foreigners with a working permit) should learn about the local culture, the language? Sure.

But

\- the author claims that he knew some danish. Learning the local language to flirt, order a beer and talk about the weather isn't the same as defending yourself in a legal case

\- you need the translator anyway for short-term visitors that you want to charge (unless you ask people to learn the language before they go there as a tourist)

I'm speaking from the perspective of someone that worked in Tel Aviv for a year. I cannot speak Hebrew (well.. words, stupid phrases. I cannot speak a coherent sentence). That's unfortunate, since I tend to like the parts of the language I know. Languages are just .. hard, for me. Learning a language while you're working full time is worse. Being shy about using it -> even worse. The idea that a cop would've expected me to defend myself in Hebrew is .. a nightmare.

Frankly, if I'd be charged in London I'd ask for a German translator. I think antirez wrote an article (during that 'accent' discussion) recently that struck home: Even if you know a foreign language, you're often limiting yourself to the same topic. Smalltalk in English? Why not. Talking tech stuff? Sure thing. But I wouldn't try to argue with a cop just like I wouldn't feel comfortable discussing arts or doing pillow talk in that language.

<comment><USER19> Well, I did say you could have someone to call; in your case, you could have the number of a German translator who you'd call if you were to be arrested. My question is mostly whether arranging for that translator should be the police's responsibility or the foreign national's.

</comment></comment></comment></comment><comment><USER21> A good reminder to have offsite backups

<comment><USER22> "Backups" suck - it's a hassle to restore them, and due to all kinds of reasons how hardware can die, some restoration is needed every now and then. On the other hand, if all your [important] data automagically syncs on the cloud, you can take any blank computer and be productive within 30 minutes.

If your everyday environment is VM's on the cloud then you don't need even that and you're good to go from any device instantly, but it's a bit too limiting for me - but keeping all data + portable executables with config on Dropbox is simple, and leaves actual backups only as emergency precaution for cases if the cloud services screw you somehow.

<comment><USER21> I haven't checked Dropbox t&c's but I wonder whether backups come under its 'suitable for' uses. Ie: do they consider it a highly reliable form of storage. Personally I wouldn't trust any cloud storage with hundreds of gigabytes of family photos and movies. I have multiple disks on site and one truecrypt terabyte disk offsite which is rotated regularly. For work/code though the vm + cloud is a good solution.

<comment><USER22> T&C is a fairly useless as a suitability measure of anything. Sure, I'd use another "proper" backup service - but the expectation is that I'd use Dropbox in 99% of restoration needs and the other one only in the chance that, say, Dropbox dies - which hopefully happens less often than my computers die.

For personal data, Dropbox's versioning has been a lifesaver for me - if I have overwritten or changed something, I can get back also the previous versions; quite a few backup solutions don't keep the history. But for me the important data is various documents, so it's not that large - for example, I personally don't see the reason for making family videos, as even for our wedding video we just browsed through it once and haven't touched it in all the years afterwards, there's new stuff to do instead of watching old stuff.

<comment><USER21> Don't tell your wife this :)

</comment></comment></comment></comment></comment><comment><USER23> Lucky! Well, you should be glad you aren't in India! You would be in jail if that was the case.

Indian police's track record in handling cybercrime is unparalleled. [http://www.rediff.in/news/2008/jan/21inter.htm](http://www.rediff.in/news/2008/jan/21inter.htm)

And the ISPs stupidity too adds to it, most of the times.

*in the lines of Four Yorkshiremen.

</comment><comment><USER24> Funny story, but why wait 5 years to write it up?

<comment><USER25> Maybe the case just recently closed, and he can legally talk about it.

Turns out the wifi had no password.

:)

<comment><USER26> I was thinking something along the same lines, I think it's illegal to comment on ongoing investigations. The case might have been dormantly open until recently, when it was closed because of a lack of new information.

</comment></comment></comment><comment><USER27> "the files are IN the computer?"

<comment><USER28> I believe you typed this in the wrong tab. This is not reddit.

</comment></comment><comment><USER29> WEP is pretty much the same as open wifi.

<comment><USER28> Legally, a door locked with a flimsy easily broken lock is locked.

</comment></comment><comment><USER30> guys what's the law in the USA (and if anyone knows, in Canada) with respect to running an open wifi router? If you pay for your internet service and you leave a wifi router open, are you liable for any activity that occurs?

<comment><USER31> IANAL, but I'm guessing no. Free wifi is too common to be the sort of thing you're legally liable for.

Basically there's no way Panera would give wifi away if that were true.

<comment><USER32> Ah, but that's why Panera and Starbucks have that little click-through agreement absolving them of all responsibility.

<comment><USER33> As far as I'm aware, you can't absolve them of a statutory duty, you don't have the authority. You can only absolve them of things that _you_ could bring to bear against them personally - and even then I know that contract law is complicated enough to make that a dicey proposition.

</comment></comment></comment></comment><comment><USER34> Open WiFi in this day and age is kind of stupid. I have to think that with BabelFish, or what ever they had in 2008 I could secure a router regardless of the language.

<comment><USER35> > Open WiFi in this day and age is kind of stupid.

Why? I genuinely want to know. What harm is there if my WiFi is open? Is there a danger that someone will use up my bandwidth? (I don't really care.) Is there a risk that evil [child pornographers / terrorists / whoever it is we hate this week] will use my open WiFi connection and thus be completely untraceable (which they could never have achieved without my assistance)?

<comment><USER36> If your IP is traced to images of child abuse then you will at the very least have a lot of explaining to do. Is it really worth running the risk of someone using your open wifi for this?

Firesheep is another example of why not. If you use WPA then even plain http traffic is encrypted from your computer to the wireless router. If you have completely open wifi then the traffic between your computer and the router is in the plain for everyone to inspect freely.

</comment></comment></comment><comment><USER37> Cool granny with iMac. Well done, too.

</comment><comment><USER38> Note to self: Put all the stuff in truecrypt.

</comment><comment><USER39> Best horror story ever.</comment>


I left my job to start my first company. Tell me what you think. - <AUTHOR> http://getnotably.com

<comment><USER2> I think despite facebook already having an "I don't want to see this" smart filter that works pretty good, user privacy concerns about sharing their friends' feeds with a 3rd party, and the constant API and policy changes facebook apps have to keep up and deal with, you still have a chance of facebook or any other tech giant buying your company in a couple of years for bazillions of dollars. In the tech world there's no way of knowing what's gonna happen next...

</comment><comment><USER3> Looks interesting, but can't you do the same sort of filtering on Facebook itself? And since you left your job for this, how will you make money from it?

<comment><AUTHOR> Thanks! Not yet at least. You can use Notably as either a supplement to the time you already spend on Facebook (to make sure you don't miss anything important), or as a substitute (it emails you updates every day or week).

Not set on that. I'm playing with a freemium model or business applications.

</comment></comment><comment><USER4> I like it. I am signing up. But I think the challenge is that I dont even check the email I signed up with on facebook. I use a separate email.

<comment><AUTHOR> Awesome, thanks! You can change your Facebook email here: [https://www.facebook.com/help/207097142662705](https://www.facebook.com/help/207097142662705)

</comment></comment><comment><USER5> Looks great, good job - I signed up.

<comment><AUTHOR> Thanks! Let me know what you think once you start getting updates.</comment></comment>


Wanish – Open Source Implementation of Summly - <AUTHOR> https://github.com/reefeed/wanish

<comment><AUTHOR> This package allows you to summarize text by reducing an article in size to several sentences retaining the idea of the text.</comment>


Show HN: Let's Unlock the Data Economy - <AUTHOR> https://dataliberationfoundation.org/ <comment><USER2> it its always good too learn more

</comment><comment><USER3> Great innovation

</comment><comment><USER4> Nice</comment>


Forge – Work with Git forges from the comfort of Magit - <AUTHOR> https://github.com/magit/forge/ <comment><USER2> Is "forge" a well known term in this context? What does it mean exactly? A web based git host that adds collaboration features like issues and pull requests? Seems like that from the context but I've not seen the term before.

<comment> piotr-yuxuan [https://en.wikipedia.org/wiki/Forge_(software)](https://en.wikipedia.org/wiki/Forge_\(software\))

<comment><USER3> This article has no citations for the history/use of the term. It was largely written by a single editor over a decade ago.

<comment><USER4> > over a decade ago

If it ain't broke, don't fix it. Also: [https://www.computerweekly.com/blog/Open-Source- Insider/What...](https://www.computerweekly.com/blog/Open-Source-Insider/What- is-a-software-forge)

<comment><USER5> That's exactly the kind of article that gets written from a page on Wikipedia.

<comment><USER3> Furthermore the "definition" they provide is something they came up with; a Google search for portions of the definition only returns results for the article itself.

<comment><USER4> Then your Google isn't my Google. If the definition is used on sr.ht[0], then it's pretty much galvanized. Not to mention that I've heard it used that very way over the decades that I've been in software development.

[0] [https://meta.sr.ht](https://meta.sr.ht)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I know this is off-topic, but: a resource I really wish existed is "how to build Emacs UI like Magit".

<comment><USER7> That's so true! Emacs has got some modern and really well crafted packages during last decade (e.g. Magit, Org or Notmuch). It's a really interesting and vibrant platform right now. I have high hopes for lsp-mode.

Another package with great UI is calfw.

Of course, there were already plenty of great classic packages (e.g. Dired, Calc, Gnus or Eshell) and modes (e.g. AucTeX, SLIME, ESS...). But things are getting really good lately.

ELPA and use-package have also done away with lots of friction points when installing and updating packages.

<comment><USER8> Thanks for the calfw recommendation! I just installed it and it's really nice.

</comment></comment></comment><comment><USER2> I hear good things about magit, does anyone have any good learning resources for someone who is relatively new to emacs?

<comment><USER9> Here's a recent talk/screencast by John Wiegley that covers a lot of Magit tips and tricks: [https://www.youtube.com/watch?v=j-k- lkilbEs](https://www.youtube.com/watch?v=j-k-lkilbEs)

<comment><USER10> Thank you for this!

</comment></comment></comment><comment><USER11> I have been using it happily, but I have an issue where I have a fork on github, but I can't get the forge to point at upstream instead of my fork, it changes to the other github as soon as I set pus Default if I remember correctly. Is there any way to do this?

<comment><USER12>
        The convention is to name the upstream remote ~origin~.  If you follow
        this convention, then you have to do nothing else and the remote by
        that name is automatically used, provided it exists and regardless of
        whether other remotes exist.  If it does not exist, then no other
        remotes are tried.

        If you do not follow the naming convention, then you have to inform
        Forge about that by setting the Git variable ~forge.remote~ to the name
        that you instead use for upstream remotes.  If this variable is set,
        then Forge uses the remote by that name, if it exists, the same way
        it may have used ~origin~ if the the variable were undefined.  I.e. it
        does not fall through to try ~origin~ if no remote by your chosen name
        exists.

This is from the manual, but I will have to move (or copy) to a more prominent place within the manual. (This is currently in the node titled "Token Creation".)

</comment></comment><comment><USER13> previously: [https://news.ycombinator.com/item?id=18722548](https://news.ycombinator.com/item?id=18722548)</comment>


Obama Lets N.S.A. Exploit Some Internet Flaws, Officials Say - brown9-2 http://www.nytimes.com/2014/04/13/us/politics/after-heartbleed-bug-obama-decides-us-should-reveal-internet-security-flaws.html <comment><AUTHOR> It's very hard to take this initiative seriously. Software vulnerabilities are what software vulnerabilities are: the fundamental enabler of modern network signal intelligence. When you see Obama sign an executive order ending foreign signals intelligence, you can at that point start to believe that the USG is primarily in the business of fixing rather than stockpiling vulnerabilities.

NSA's first and overriding mission is in conducting signals intelligence against our adversaries. As people have pointed out here and elsewhere: regardless of what other missions NSA may have crept into in the last 40 years, when SIGINT comes into conflict with some other NSA mission, SIGINT wins.

(This analysis is descriptive, not normative.)

<comment><USER2> Take it seriously to the extent that they need to consider whether or not hoarding a vulnerability is likely to enable other powers to carry out SIGINT against important US sites.

Consider that while something like Heart Bleed would be an enormous asset to the NSA, if both NSA and a foreign powers found out about it at the same time it'd provide the foreign power with a disproportionate benefit because they'd likely have fewer other ways of infiltrating many sites.

I'm sure that in situations where they're confident they're the only ones with the knowledge, they'll still hold off on releasing anything.

<comment><USER3> > Take it seriously to the extent that they need to consider whether or not > hoarding a vulnerability is likely to enable other powers to carry out > SIGINT against important US sites.

And yet that didn't prevent them from sitting on heartbleed for two years (since approximately the moment it was introduced).

</comment></comment></comment><comment><USER4> > "You are not going to see the Chinese give up on 'zero days' just because we > do"

This is a dishonest argument - many of the zero days held by the Chinese are likely to be the same zero days being withheld the N.S.A., so by disclosing them the N.S.A. would be dealing a huge blow to our adversaries' offensive capabilities.

The NYT should have gotten a quote to counter-balance this argument from a "senior intelligence official" (upon whom they shamefully, but predictably, bestowed anonymity). Now many of the people reading this article will come away believing this is akin to nuclear disarmament, which is a totally inapt comparison.

<comment><USER5> > _upon whom they shamefully, but predictably, bestowed anonymity_

I'm with you on the rest of your points but not on this one. Balance would be nice but anonymity is often key to good reporting. There's nothing shameful about soliciting a quote and then keeping that person anonymous.

<comment><USER4> I'm not against all anonymity, but in general, anonymity is bad for journalism. It makes it impossible for readers to judge the credibility of the source, and puts people who want to challenge the source at a disadvantage. It permits the source to say whatever they want, without any fear of it harming their credibility.

In narrow circumstances, such as whistle-blowing where the source would face harm from a disclosure of their identity, anonymity is both appropriate and essential (and in such a case it's essential for the newspaper to do as much verification as possible before conferring anonymity). But a government employee spewing pro-government propaganda does not need the protection of anonymity.

Edit: reworded for clarity.

<comment><USER6> For some details to back up agwa's statement, [http://ajrarchive.org/Article.asp?id=1596](http://ajrarchive.org/Article.asp?id=1596) has some interesting history on anonymity in newspaper reporting. For example:

> During his shuttle diplomacy in the Middle East, Kissinger insisted on > anonymity even though the information was reported by the press traveling > with him and attributed to the "senior official on the plane." On one of > Kissinger's sojourns, humorist Art Buchwald attributed information to a > "high U.S. official with wavy hair, horn-rimmed glasses and a German > accent."

> Periodically, journalists grow weary of the insistence on anonymity and > rebel. But generally not for long.

> In 1971, then-Washington Post Executive Editor Ben Bradlee ordered that > information provided by Kissinger about a pending summit meeting be > attributed to him because it was simply too important to be reported > anonymously, according to Walter Isaacson's book "Kissinger."

> "The Post's action caused a widespread realization that reliance on > backgrounders had gone too far," Isaacson wrote. Nevertheless, the White > House Correspondents Association soon passed a resolution agreeing to abide > by Kissinger's briefing rules.

How does it help us, the public, to let Kissinger choose when to make anonymous statements?

Overall that American Journalism Review link points out that time and time again, with only a few exceptions, anonymity is abused.

</comment></comment></comment></comment><comment><USER7> "President Obama has decided that when the National Security Agency discovers major flaws in Internet security it should – _in most circumstances_ — reveal them to assure they get fixed, rather than stockpile them for use in espionage or cyberattacks, senior administration officials said Saturday."

Emphasis added is mine.

The "in most circumstances" means they can pretty much do whatever the hell they want.

<comment><USER8> Agreed, so large you can drive a truck through it analogy.

Why is there not more of a furore about this? When Bush set up (and it was found out) about the extensive activities of the NSA, the reaction was vitriolic in every sense of the word. Here Obama is tacitly agreeing to similar intrusion. This is not a comment on Bush vs Obama, it is more a comment on the media and public reactions.

<comment><USER9> That's the problem with people-oriented politics. Who's going to complain? The people doing it now, or the people that did exactly the same thing earlier?

</comment></comment></comment><comment><USER4> Wow! The NYT has changed the title of this article from "Obama Decides U.S. Should Reveal, Not Exploit, Internet Security Flaws" to "Obama Lets N.S.A. Exploit Some Internet Flaws, Officials Say"

Kudos to them for switching it to a much more accurate description of the situation.

<comment><USER10> Newsdiffs.org is useful to track both minor and major changes made to stories.

More generally, it's a convenient if limited way into the publishing process. It deserves scrutiny, all the more so for those PR-type articles that essentially try to covey nonsense.

[http://www.newsdiffs.org/article- history/www.nytimes.com/201...](http://www.newsdiffs.org/article- history/www.nytimes.com/2014/04/13/us/politics/after-heartbleed-bug-obama- decides-us-should-reveal-internet-security-flaws.html)

<comment><USER11> Wow, I was wondering why the HN title and NYT title were almost exactly opposite. This diffing site is interesting, thanks.

The new title doesn't seem to fit well with the rest of the article, though.

</comment></comment></comment><comment><USER12> This is arguably good military strategy, too - the US has ample resources to allocate to finding novel or even one-off exploits on an ongoing basis, where some poorer powers might want to rely more on keeping secret existing exploits for a longer period. Perpetually making enemies' weapons obsolete.

Also, the US has a much larger attackable surface area and far more to lose in this domain. So it makes perfect, cynical sense if the US government wants internet security in general to be better.

Just like a naval power with strong international trade interests has reasons to keep shipping lanes open to all and to deter naval piracy.

None of this requires benevolence, it's all self-interested

<comment><AUTHOR> What's a "novel" or "one-off" exploit? I don't see the realistic dividing line between "NOBUS" exploits that NSA could realistically believe it has a proprietary grasp on and the kinds of exploits that get deployed at Pwn2Own.

<comment><USER13> Configuration Errors are an example of "one-off" exploits. Things which are specific to a environment, rather then a code base.

</comment></comment></comment><comment><USER14> Stutnex used zero day flaws so when they make a statement like:

"When Federal agencies discover a new vulnerability in commercial and open source software ... it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose."[1]

I have to scratch my head because I can't reconcile this. I also can't reconcile what meaningful impact the White House statement will have since it has such a vague loophole. The White House statement reminds me of when Putin plays lip service to democratic processes inside Russia. Lots of words, little if any meaning or change.

[1] [http://blogs.wsj.com/digits/2014/04/11/nsa-says-it-wasnt- pre...](http://blogs.wsj.com/digits/2014/04/11/nsa-says-it-wasnt-previously- aware-of-heartbleed/)

</comment><comment><USER15>
        But Mr. Obama carved a broad exception for "a clear
        national security or law enforcement need," the officials
        said, a loophole that is likely to allow the N.S.A. to
        continue to exploit security flaws both to crack
        encryption on the Internet and to design cyberweapons.

i.e.:

But Mr. Obama then went on to say "discount everything I've just said, the NSA should go on with business as usual, interpreting all current and future situations to further their offensive needs regardless of what is best for the American people or becoming of a modern democracy."

</comment><comment><USER16> This "change" is so nuanced as to be essentially indistinguishable from the status quo.

</comment><comment><USER17> "Obama says" versus "Obama does."

Actions, not speeches, count.

<comment><USER18> "Obama does x" is the headline when when the news is in general positive.

"The government/administration/specific department" is the headline when it is negative. Look out for it...

<comment><USER19> "Obama exploited heart bleed" isn't a very accurate statement.

It's almost as inaccurate as "NSA says it should disclose exploits."

</comment></comment></comment><comment><USER20> This is why the NSA should be chopped in half. Offense and defense in different agencies so there's less conflict of interest

</comment><comment><USER21> NY Times updated their headline:

"Obama Lets N.S.A. Exploit Some Internet Flaws, Officials Say"

</comment><comment><USER22> NSA decides it shouldn't and should, respectively.

</comment><comment><USER23> > _– in most circumstances —_

</comment><comment><USER24> Honestly, it seems like the only way the US could get credibility on this "front" is to create an open, well-funded agency whose _only_ purpose would be to enhance world Internet security. Give it a mandate to be entirely separate from any would-be signal intelligence exploiters and let it loose. Yes, I'm sure something akin to this exists but if this had 10% of the US intelligence budget, it would be an eye-opener.

<comment><USER25> Prior to the NSA leak, "cyber warfare" was quite the buzzword. China, Iran, and other countries threatened the all US infrastructure from abroad. There was even debate as to if a foreign "cyber attack" could justify an armed military strike. The solution allegedly was the US government spending all kinds of money on these "cyber defenses."

Snowden's leak suddenly left people wondering if the United States itself posed the greatest threat to the US's own "cyber security." There is little doubt that the revelations did severe and lasting damage to US companies who want foreign customers.

Today the problems are, someone might have been able to access your Yahoo mail in the past two years. As computing and bandwidth expands and blends in to the background, future exploits will be things like, every moment, visual and audio, of the past two years of your life, was recorded and is available to playback in full detail. For better or worse, of course the government will get heavily involved.

<comment><USER26> The Snowden leak told no one who was capable of any amount of critical thinking anything they didn't already realize.

It was base-level _obvious_ that the US, EU and every other nation had cyber- warfare programs because there was no technical reason they couldn't, and the risks were the same as they were to China and others: its an invisible, zero- casualty engagement, indistinguishable from the actions of lone individuals or groups.

Moreover, it should always have been apparent that things inside the US could be arbitrarily subjected to search and seizure. This is not a problem companies are unfamiliar with - mining companies are big on sovereign risk, but moreover, it's not like Microsoft stores it's technical data on Google cloud services for exactly the same reasons.

The most surprising thing which has been disclosed nowhere by the Snowden leaks is any evidence of the NSA passing stolen technical schematics or plans off to US companies for competitive advantage. I'm sure a lot of people will insist this totally happened, but no one has come up with hard evidence that it has.

</comment></comment></comment><comment><USER27> > But Mr. Obama carved a broad exception for "a clear national security or law > enforcement need,"

Or a law enforcement need? So this is almost pointless then. Don't expect regular iPhone or Android bugs to be reported, because law enforcement uses them all the type to tap people, so of course in their view there's a "need" for them.

He should've just left it to NSA only, and for _very specific cases_ , if at all. Everyone else (FBI, police, DHS, etc) should be reporting the exploits.

As it is, don't expect them to reveal more than one relatively major bug every 2 years or so - and even that sounds optimistic, I think.

<comment><USER28> Call it paucity of imagination on my part, but I was wondering if somebody could make explicit some legitimate examples of situations involving a "clear national security need"? It's not like they're just making a legal exception for a "Blockbuster" scenario, where terrorists are about to nuke a city and a lone hacker saves the day by breaking SSH, right?

Is this supposed to apply to instances where the flaw affects the competition more than civilians -- say, a security flaw that somehow disproportionately affects Iran, China and Russia over the US? (there are obvious reasons why the government cannot explicitly acknowledge this, but I'm wondering if this is a direct implication)

<comment><USER26> The NSA would monitor hacker message boards and the various black market websites for exploits like this.

If they find something which they don't see any chatter about on any of these sources, then it's reasonable to presume no one has found it. Moreover, actually exploiting heartbleed would leave a signature. You can fake SSL certificates, but eventually someone has to lose their money, or some innovation has to come out of the blue. MitM's involve traffic diversions unless they're conducted at a government level.

Espionage always leaves a trail - even if you don't know where someone gets their intel, you can always tell they must be getting it somehow.

</comment></comment></comment><comment><USER29> >But Mr. Obama carved a broad exception for "a clear national security or law enforcement need,"

Read: unless we really want to.

</comment><comment><USER30> Doublespeak...

In black and white hat circles it is understood that using an internet security flaw is in fact revealing it as your adversaries find out by such acts..

His ex order has not rational meaning that context, the context of NSA's mission, the CIA's mission or DoD's mission..

What does Obama think we effing five?

</comment><comment><USER31> What is up with the "Mr. Obama ..." crap? Did the NYT have a change in policy recently? I do not remember Sanger writing like that in Confront and Conceal.

</comment><comment><USER32> Ok, is there any odds that a diff of Red Hat and Debian would reveal patches that Red Hat's largest customer, the Pentagon, has pushed?

</comment><comment><USER33> Nothing but pandering, and not even a very good job of it. Business as usual down at the NSA.

</comment><comment><USER34> So how's the US government's track record in reporting flaws to vendors?

</comment><comment> line-zero "We should reveal security flaws! ...Except in 99% of situations."

Go to hell you fucking snake.

</comment><comment><USER35> Contrast this with the recent NSA statement[1] made about heartbleed. This is how they intend to interpret this decision.

1\. [https://news.ycombinator.com/item?id=7575802](https://news.ycombinator.com/item?id=7575802)</comment>


The Tyranny of Structurelessness - <AUTHOR> http://www.jofreeman.com/joreen/tyranny.htm <comment><USER2> Key takeaway, structure is emerging whether or not you want it to, so take care to put in place a minimum viable structure that is malleable. One such list of properties of what she considers an effective structure is proposed at the bottom and is worth a read. Directly applicable to modern organizations and not just a historical essay from the earlyish days of the women's liberation movement

</comment><comment><USER3> This is one of the fifty greatest essays ever. Don't be distracted the talk of Feminism or the New Left. This stuff applies across every organization I've run into.</comment>


Ask HN: What do you use for developer documentation? - <AUTHOR>

I'm working on a Rails project that is starting to get pretty large in scope, and would like to start producing some clear documentation for the newer developers who are joining the project.  What are some of the tools that people use on their projects or companies that help you maintain clear  and up to date documentation? <comment><USER2> What kind of documentation? Code documentation? Process documentation? Architecture documentation? Something else?

Anyway, I like the idea of a Wiki or something similar. Everyone can contribute to it, it's easy to setup and not much effort to put stuff inside it.

<comment><AUTHOR> Well, at the risk of asking too much... Any (All)of those things.. I'm just starting out as the tech lead of a project we're bootstraping, and this is one the the weak areas I find ourselves heading in. So i'd like improve every aspect of the documentatiton that I can</comment></comment>


Does this kind of design have a name?() - <AUTHOR> I'm seeing this kind of sleek/modern/minimalist design on a lot of "trendy" startup websites: https://6figr.com/ https://www.trymontage.com/ https://www.drip.com/ https://robwalling.com/ https://nomadlist.com/ https://www.promomatic.com/
I really love this, and I'd love to do something similar for my projects, but I don't know where to start looking for ressources or data about this(I mean, I could just rip their CSS and html, but I'd like to do it cleanly) It's kinda reminding me of bootstrap, but in a more modern style.
Is there some "guidelines" that I can follow to achieve this kind of look? or some kind of basic template that I can start working on?are they using some kind of libraries or framework for this? or is this just a design/"artistic" trend for recent startups? <comment><USER2> They remind me of Material: [https://material.io/design/](https://material.io/design/)</comment>


Bloomberg suffers global terminal outage – hacking being investigated - <AUTHOR> http://www.ft.com/fastft/309642/bloomberg-terminals-around-globe-down

<comment><USER2> _> ..asked about a possible hacking, she said Bloomberg was looking into it._

I wouldn't read too much into this. I'm at Bloomberg's offices in London right now and the terminals here are working fine. From the error displayed on the terminal in the article's photo, it looks like a connectivity/infrastructure issue.</comment>


The African Union passport: A waste of time - <AUTHOR> https://medium.com/@darshandsoni/the-au-passport-a-waste-of-time-ef4faf9c5d12#.8enngk88g <comment> nevi-me Very good read! I was also puzzled at why diplomats who have little travel issues were first to get the passports.

I live in South Africa, and with the ruling party and president seeing their eyes on potentially making the former AU chair our next potential president; I've been quite critical of her capabilities.

I have largely thought of the AU passport as Nkosazana Dlamini-Zuma's vanity project. There's lots of structural issues which you mention, that make the practicality of the passport difficult, and than none have been dealt with says a lot.

My opinion is that ECOWAS have done better in managing their region than the AU has in intervening. The recent Gambian situation being a good example. I can't talk much about SADC as we have Swaziland and Zimbabwe that are violating human rights with SA and other members not intervening much.

Your solution of adopting ECOWAS and/or other frameworks is more feasible.

</comment><comment><USER2> Sir, there seems to be a problem with your African Union Passport, would you please follow me to the local police station to waste 2-3 hours and contemplate the absence of a bribe?

</comment><comment><USER3> I would imagine the real issue is that other countries will likely not accept it.

<comment><AUTHOR> That's a fair point when dealing with such a large number of countries (and a widely varying stage of development between them). But the passport would have to be designed to adhere to ICAO standards in any case. That would make countries legally obliged to accept it as a valid travel document. But that, in addition to all the other factors mentioned in the article, requires a lot of formalisation or written AU mandate - none of which has happened.

<comment><USER4> > designed to adhere to ICAO standards in any case. That would make countries > legally obliged to accept it as a valid travel document

That can't be true. It is possible for private individuals to create documents that adhere to those specifications. In fact, some do but of course the documents are not accepted.

<comment><AUTHOR> I stand corrected! So from what I read up, ICAO adherence only facililitates quicker processing at the entry point[0]. But member nations are not bound to anything.

So I previously thought that a country can obviously choose who it will accept with its own laws, but that it has to still recognise a valid travel document. That's obviously not true because there are many countries that refuse to recognise documents like the Israeli or Republic of China passports, despite them being perfectly standardised. Or the case of individually declared documents like the world passport or Liberland [1].

So in this case, the AU would have to formalise the status of the document in law, then member nations have to ratify it, before anyone should feel comfortable trying to travel on it. But of course, this isn't EU law that is generally well enforced; there's hardly anything stopping many African nations from flouting international, regional or even their very own set of laws! Hardly looking promising... It's just a shame there's so much wasted effort going in to this.

0 - [http://www.icao.int/Security/FAL/TRIP/Pages/default.aspx](http://www.icao.int/Security/FAL/TRIP/Pages/default.aspx)

1 - [https://liberland.org/en/request/](https://liberland.org/en/request/)

</comment></comment></comment></comment><comment><USER5> Good read, but the title is entirely misleading. It's not a waste of time, the AU passport is extremely important to be rolled out.

But the current scheme is of course a sham, a mere propaganda piece. And maybe yet another scheme to get paid bribes a 2nd time. Nevertheless, you have to start somewhere to build pressure.

</comment><comment><USER6> morocco is actually a member of the AU again, since a couple weeks

[http://www.worldbulletin.net/todays-news/183967/morocco- rejo...](http://www.worldbulletin.net/todays-news/183967/morocco-rejoins- african-union)

<comment><AUTHOR> Right you are! I've put a footnote in the article to reflect the change in status. After all those years outside, the AU probably strategically wanted a sizeable regional power like Morocco back in. Unfortunately for the Sahrawis, apart from an EU ruling every now and then, their cause is all but forgotten.

In the larger context of the article though, it probably doesn't change much of the political reality.</comment></comment>


Launch HN: Lang (YC S19) – Internationalization Built for Devs - <AUTHOR> Hey HN! We're Eric, Peter, and Abhi, founders of Lang (https://www.langapi.co). We help developers quickly translate their apps into foreign languages by combining internationalization SDKs with a command-line interface that integrates directly with human translators.
Previously, we all worked on building internationalization and localization tooling for companies. In our experience, companies don't think about translation until too late, and the tech debt builds up very fast. It's a nightmare to receive a task that says "translate app into Spanish." Choosing the right open-source framework, refactoring the entire codebase, and integrating with human translators is a massive effort. As engineers, we wanted to work on features - not putting every string in our codebase into a translations.json file. In our months of internationalization work, we couldn't find a good all-in-one toolkit. So we built Lang.
Like other internationalization libraries, Lang gives you a tr() function. Wrap your strings with tr(), and we'll show your users translations that correspond to their language settings at run-time. But how do you actually get the translations? Open-source frameworks like Polyglot.js stop here, but Lang doesn't. Run "push," and our command-line tool will parse your code files, find tr() calls, collect newly added strings, and send them to human translators for you. For JavaScript, we use Babel to construct an Abstract Syntax Tree (AST) of your code, and traverse the tree to find tr()'d strings. For a developer, this makes it simple to add/remove/update strings: just run "push" in your terminal. You can track the status of your translations on our dashboard, and when they're done just run "pull." We'll generate a translation file for you, and connect it with our tr() function. You own the file - Lang doesn't make any network requests for translations at run-time, and your translations always load, even if our service is down.
This works for static strings in the code, but what about dynamic content in the backend or database? We expose a function called liveTr(), which takes a string argument. The first time liveTr() sees an untranslated string, it will make a request to Lang to translate it and return the string in its original language. But the next time, it will fetch the translation on-demand. We've shipped liveTr() with built-in caching functionality to reduce the number of network requests. We also have self-hosted solutions for users with high uptime requirements. This is a common in-house feature companies build for internationalization, and we want to make it available to all devs.
Lang currently supports JavaScript and Typescript apps (React, React Native, Vue etc.) with closed betas for Django, Android, and iOS. Give us a try at https://www.langapi.co/signup - machine translations are free, so you can see your app in another language in minutes. If you use human translations, we charge $99 / month for our tooling, and 6-8 cents per word translated. A lot of our work is inspired by open-source, and we want to give back - if you're building an open-source project or non-profit, ping us at email@example.com. We'll drop the monthly fee :)
The HN community builds amazing products, and we're sure there are plenty of people here who have translated their apps - we'd love to hear your experiences in this area and your feedback on how we can improve! <comment><USER2> I like the idea, but you are putting more weight behind the tooling than I would. I don't find translation tooling to be cumbersome, so especially if machine translations are free, I don't find the price point for human translations to be compelling.

What would be compelling is if you could pro-actively call out the bigger gotchas in translation - grammatical differences that make you change word orders, different mechanism for handling plurals, etc. If you could preemptively warn us, even before a "push" that we may hit a problem, I'd take a closer look. For example, flagging a line saying, "Hey, it looks like you are using phrasing that will be problematic in <Italian/Hindi/Russian/etc.> Here's why..."

<comment><USER3> Mozilla's Fluent project [1] seems like a really thoughtful and comprehensive approach to many of these problems.

[1] [https://projectfluent.org/](https://projectfluent.org/)

<comment><USER4> We analyzed fluent when we built the product and found that it didn't offer much more than the international standard ICU. Our platforms have full support for ICU syntax including plurals.

</comment></comment></comment><comment><USER5> We needed recently translate our chrome extension (languagelearningwithnetflix.com) into 18 languages. We are poor and had less than $1000 for the job.

Here's our approach.

1\. Move all strings into a Google doc. Takes about 8 hours.

2\. Organise strings into groups with screenshots, think carefully, split strings, look for reused strings, reword things to make them simpler and easier to translate, add notes to some strings to make the meaning more explicit. Very tedious part of job, 2-3 days work.

3\. Put the doc, editable with link, onto upwork with a fixed payment, somewhat generous for translation wordcount. Check translator is a native in the target language, had some good feedback and ideally some IT/programming experience. Order translations for the languages we can check ourselves (5-6 languages).

4\. Check the translations received for issues. Translators typically misinterpret the same things, as the source was not clear enough. Fix these issues. Maybe 4 hours work.

5\. Now send to 10+ other translators for the languages we don't understand. Cross fingers that these will be ok.

6\. Check translations of labels for homogenous usage of semicolons, capitals, fullstops etc. Struggle with zh/ja/ko.

7\. Use a small JS script to transform CSV output from sheets to JSON for chrome.i18n.

8\. Cycle through all locales and for overflowing text or other issues.

9\. For any extra strings that we might need later, can try Microsoft UI translations database, or else, Google translate (which is mostly ok, can check the reverse translation).

Honestly this all was quite a lot of boring work, but we probably ended up with reasonable translations at a good price, and managed to pay translators reasonable money.

<comment><USER6> > Struggle with zh/ja/ko.

FYI, these are frequently called CJK (chinese, japanese, korean). Although, that more has to do with the fact that each character takes multiple keystrokes to type and thus is harder to support, than to do with the locale.

</comment></comment><comment><USER7> This is very cool! It took us months to build the equivalent tooling for reddit (except we were using crowd sourced translations instead of machine based ones).

Do your clients do local caching, or is my uptime dependent on your uptime (unless I code in my own caching I suppose)?

<comment><AUTHOR> Great question, and thanks so much for sharing your experience at reddit! For static strings, we create resource files and download them directly into your codebase, so your uptime is totally independent of ours once you deploy your app.

For dynamic strings in the database/generated by users, our servers need to be up to receive + handle the translation request, but that will be cached the next time you try to look the translation up.

<comment><USER7> I'm glad to hear you guys put thought into reliability from the start!

</comment></comment></comment><comment><USER8> The Hindi example on your front page is translated in a grammatically incorrect manner.

Instead of saying "Lang me aapka swaagat hai", you've got "me aapka swaagat hai Lang".

It's like saying "Lang Welcome to".

Nice idea though, if you can iron stuff like the above out.

<comment><AUTHOR> Great catch, thank you! We'll update the Hindi example :)

</comment></comment><comment><USER9> Does using the tooling depend on being translated through Lang? We are going to be setting up new internationalization tooling soon but have a robust human translation community already that we wouldn't want to bypass.

<comment><USER4> Our tools send the strings to a dashboard. At this point, you can have your own translators add translations and pull them back in. We have developed flows which make it easy for your own translators to go through your phrases, see the context (description + screenshots) and add appropriate translations.

Sending translations to the agencies we've partnered with is completely optional.

</comment></comment><comment><USER10> That's a great product! But... I can't change the language of your website?!

<comment><USER4> Our site is internationalized with our product and we have Spanish translations. If you change your Chrome language setting to Spanish you can see it. We'll plan to add a manual language flag soon.

</comment></comment><comment><USER11> I worked on internationalization extensively before (Pootle, specifically).

The good:

The library's API seems pretty well-thought-out. A good i18n API in JS/TS is highly needed, even more so one that works well with React. I use i18next in my projects but it's mediocre, although I don't know that the difficulties I end up facing with it wouldn't show up here.

The bad:

Pricing. Sorry but translation services are extremely competitive, and players that have been around a long time such as Crowdin, Transifex and Weblate have the benefit of being already trusted by name by a huge community of devs and translators.

You also talk about open source a lot but I'm disappointed your web tooling doesn't seem to be open source & self-hostable. This is one point where you really could differenciate yourself.

The ugly:

It looks like you've pretty concretely tied your i18n API and your translation UI together. I can't see your UI or whether it's any good, but I'm likely to want to use your API with a different translation service, or your translation service with a different API.

Also, please, Google oauth is basically a requirement for any b2b service.

(I'm happy to give more thoughts on a video/screenshare chat if you like, feel free to reach out, email in my profile; always want to help new players in the i18n space)

</comment><comment><USER12> This looks super cool. I got a bunch of questions!

1\. Am I correct in understanding this is meant as a client-side only solution for now? Right now we have a pretty complicated translations process that needs to support translations that are spread across the client and server. Would this support a hybrid approach like that?

2\. Another question I have is where does the `translations.json` file come from and where is that stored? Is that just generated by the CLI and then we have to deal with serving that however we want?

3\. Is there one `translations.json` file per language? One with all of them? Are there performance concerns with sending large files like that over to the client? This is a general question for me to other developers of large sites: how do you deal with _tons_ of translations?

4\. Any plans to support existing translations? E.g. if I have an existing set of translations keys and values can I plug those in somewhere? I know y'all are bootstrapping so it wouldn't surprise me if that's a Future feature.

Again, love the idea of this, and it would be super cool if this solves the problems due to complexity we currently have with supporting a ton of languages.

\--

For some background our current solution involves a generating a rather large (> 1MB) `translations.json` file for each language that we serve to the client via a CDN. Typical map of keys to values.

We create the keys ourselves as we go along something like `dashboard.salesCard-helpText`. Then we have to kludgy Drupal instance to populate the key and value, add some tagging to show it needs to be translated. Translations get entered into that Drupal instance. All of this is entered manually. Then that gets used to generate the `translations.json` file I mentioned earlier.

We have plans in the future to overhaul the process.

<comment><USER4> 1\. We support both client and server side frameworks (Django, python, NodeJS). We're adding support for more as fast as we can including Java and Rails.

2\. The 'translations.json' file is autogenerated by the CLI and updated each time you pull translations. It's automatically bundled in the deploy process so you don't need to do any extra work.

3\. Currently we have a single translations.json file. Space hasn't been an issue yet but we plan to add splitting to reduce it. For dynamic content which can be large, we have solutions where we can serve the content as a CDN. We could also give clients a microservice if they would like to self-host or directly update a cache on disk on the deployed machines. Still experimenting with the best/easiest way to do this.

4\. Sure thing, we have a file upload in our dashboard right now, but we want to add this to our CLI to make it more accessible.

I understand your frustration and one of our core philosophies is to do away with keys completely. Our keys are auto-generated and not touched by the user. The code can have the actual text which is a lot more readable. Ping me at firstname.lastname@example.com and I'd love to help solve your problems.

</comment></comment><comment><USER13> Congrats on the launch! I can totally see the need for this. What (if anything) would you say has changed in the recent years to make this technologically feasible for the first time? Have you looked into how the latest advances in NLP eg. GPT-2 has the potential to substitute translators entirely?

<comment><AUTHOR> Thank you for the kind words! Two main reasons for our approach:

1) JavaScript-based apps these days have complex rendering logic that makes the HTML-parser method to find + translate strings unfeasible. Every company we've worked at has needed to extract each string and wrap them with a special `translate` function in their codebase.

2) We make heavy use of the Babel and TypeScript compilers to work with JavaScript ASTs, and there's been huge progress on those recently.

We've thought about NLP, but quality is a huge concern of ours, and we're not quite ready yet to roll that out to companies. If that's something you're interested in, would love to chat, send me an email at HN username + gmail!

</comment></comment><comment><USER14> I have a small framework I built for developing small web apps faster and it also has a translation engine very much like this, basically what it does is:

        $T(Detajet e blerësit)

and it translates it to:

        buf.WriteString(T(`Detajet e blerësit`))

T is a function that takes a string and returns a string from static map that gets built when app starts or when somebody translates a label.

<comment><USER4> Cool stuff! I would love to hear more about it. Please ping me at email@example.com if you want to talk.

</comment></comment><comment><USER15> Correct me if I'm wrong but wouldn't I still have to take the time to wrap everything in the codebase? I feel like that's the majority of the painful work.

<comment><USER4> Developers with large code bases have complained that it takes weeks to manually wrap all their strings. We have an experimental tool for ReactJS which can wrap all the front facing strings with our function instantly. It's currently in beta but we recently used it to onboard a codebase with over 1000 strings in half an hour. We're also looking to build this auto-wrapping service for other frameworks.

Ping me at email@example.com if you want a demo of this beta tool or if you want it for another framework.

</comment></comment><comment><USER16> Hi, we developed a similar solution minus the handling of translations itself - fortunately we have inhouse people that can supply that.

A few questions:

\- Some translations are a bit context dependant, what happens if I dont agree with the translation? \- Sometimes we do some kind of media localization, eg: users in france will see a different image than users in portugal. Are you a translation only shop, or you plan to do some kind of l10n?

Best of luck!

<comment><USER4> Good question, we let you provide as much context to the translators as you want (description, tone, and screenshots). If you still don't like the translation, you can comment and it will be redone taking your comment into account. Additionally, if you have employees who want to review the translations, they can do that on the platform.

We currently handle plan to handle localization of text (regular, dates, currency, time, gender, plurals, etc.). Handling images is interesting though, I would love to explore that more if it was a pain point for you. Ping me at firstname.lastname@example.com'd love to talk!

</comment></comment><comment><USER17> Couldn't a bad actor abuse liveTr() and call it with a ton of random strings to make me pay to translate a ton of garbage data?

<comment><AUTHOR> A bad actor could only abuse liveTr() to spend your money if they had access to your API keys, which hopefully should be a secret. In these cases, you'll also be able to report bad strings coming in through your dashboard, and we'll take care of the bad actor and re-fund you immediately!

</comment></comment><comment><USER18> Looks great! It'd be cool if the homepage was a live demo that allowed you to toggle the language.

<comment><USER4> Our framework automatically checks the browser language preferences. Change your browser language preference to Spanish and refresh to see the translations. We'll also add the flag toggler soon to make it more obvious.

</comment></comment><comment><USER19> I use gettext for whatever back-end language I'm using. I much prefer handling this sort of thing from the back-end. That way it doesn't matter what the front-end is. It just works.

<comment><USER4> For frameworks with gettext we integrate with it! Gettext will extract the phrases into a .po file but these need to be translated. Running 'langapi push' will push out all the .po files in the codebase and running 'langapi pull' will pull the translated versions back in and automatically save them in the correct locations.

</comment></comment><comment><USER20> I'd love to see support for other server-side languages, like C# (preferably something that can blend in with existing resource files) and Java.

<comment><USER4> We're actually building out support for Java right now and would be more than happy to explore other server-side languages you're interested in. If you have more specific requests ping me at firstname.lastname@example.com and I'd love to talk!

<comment><USER20> As I mentioned - C#. Translation mechanism uses so called "resource" files with a master file (english), and secondary files with other languages.

see

[https://docs.microsoft.com/en- us/windows/win32/intl/preparin...](https://docs.microsoft.com/en- us/windows/win32/intl/preparing-a-resource-configuration-file)

for more information.

</comment></comment></comment><comment><USER21> Very interesting, question: from the pricing page: it is unclear to me what is meant by phrases in the context "100 Phrases" for $99 plan?

<comment><USER4> That's great feedback -- we're still working on the best way to do pricing. A phrase is any text wrapped with our 'tr' function. We use phrases for pricing currently because it's an industry norm but we're open to changing it if it causes confusion.

<comment><USER21> I think the confusion for me was that there is also a pay-per-word price; then for me the limit on the number of phrases does not feel logical. Phrases as tr() calls for me as a developer also depend quite a bit on how I have setup the translation and differ per project.

I would expect to pay a monthly fee for the online service + a fee for each word. Also, 100 unique tr()'s seem a bit limiting? (even smaller projects for me quickly get > 1000 separate tr calls)

</comment></comment></comment><comment><USER22> This looks great & hi Abhi! Will this support left script languages?

<comment><USER4> Hey! Requesting and receiving translations work with any language including left script (right-to-left) languages. In the future, we want to solve the page layout problem for RTL languages as we've seen it's a big pain point.

</comment></comment><comment><USER23> Cool I'd like to use this for my startup. Could I give you a call

<comment><AUTHOR> Absolutely, email me at HN username + gmail and I can onboard you :)

</comment></comment><comment><USER24> Wow, this is amazing!

<comment><USER4> Thanks :)</comment></comment>


Browser Support in jQuery 1.12 and Beyond - <AUTHOR> http://blog.jquery.com/2014/04/02/browser-support-in-jquery-1-12-and-beyond/

<comment><AUTHOR> What I like about this is the very clear roadmap with a lot of notice, what the changes mean, and some concise points about what bugs they can't fix.</comment>


Announcing Multi-Dimensional Scaling - <AUTHOR> http://blog.couchbase.com/introducing-multi-dimensional-scaling

<comment><USER2> Probably the greatest release since 2.0.</comment>


Ask HN: Guide to Learning Software Architecture - <AUTHOR> Is there any websites or books have solved Software Architectures?. This could help me evaluate my architecture against the de facto standard. <comment><AUTHOR> Is this way to learn software architecture ?. Is there any good other way to software architecture. Most of the books about software Architecture talks about the various methodologies but fails to show sample architecture to popular systems.</comment>


So close, you can almost touch it - <AUTHOR> http://www.ubuntu.com/

<comment><USER2> I'll bet it's Ubuntu for touch devices (based on the wording).

</comment><comment><USER3> The countdown is usually for new releases, but I wasn't expecting one until 13.04 in April. So what's this about?

<comment><USER4> Hardware?</comment></comment>


An Alternative to LaunchRock - <AUTHOR>

Does anyone know of an alternative to LaunchRock, where the email addresses obtained are validated, there is an API, and a way to migrate the data out? <comment><USER2> My friend recently tackled this in a hackathon using FireBase as the backend, and gh-pages as a static host. He hasn't open sourced it yet, though (I've just pinged him with this thread).

It will be available at github.com/shashankmehta/firelaunch as soon as he does.

<comment><USER3> [Firebase Community Manager here] I'm interested in seeing Firelaunch when your friend open sources yet!

<comment><USER4> Working on it now. Hopefully I'll be done with it soon. Coding with my left hand only. Right hand has stitches!

I could add you on GH so that you can give me feedback on it. Let me know if you are interested.

</comment></comment></comment><comment><USER5> Might want to check out leadpages.net, only bummer is that it's not free. Also, doesn't square space offer launch pages?</comment>


GoDaddy and Felons.io – The life of an unregistered domain - <AUTHOR> https://www.godaddy.com/garage/godaddy-felons-io-unregistered-domain/ <comment><USER3> I guess I appreciate the transparency. There have historically been accusations of domain name squatting by godaddy so weather true or not I think they did the right thing trying to present a case that they aren't a bad actor. The posts definitely did some additional damage to their brand and I think it's good for them to address the accusations, especially when the thread got dogpiled by their competitors.

<comment><USER4> Or, they could make that up too. There is no way to verify what GoDaddy says in the blog post is true.

</comment></comment><comment><USER5> I wonder if GoDaddy is unwittingly helping others exploit when someone is searching for domains.

E.g., if there's ML in their suggestions, and they look at cohorts, when I search for D after A, B, C, they'll start to suggest D to others looking for A, B, C.

Then all I have to do is watch A, B or C for changes, and when I see D, I know it's become _someone_ is interested.

<comment><USER3> Yes if they aren't doing it themselves I bet someone is combing through their suggestions algorithms and mining it for recent searches then squatting

</comment></comment><comment><USER6> yes, they stole swipekit.com "from me" two days after I searched for it on the godaddy site (in 2014). Last I checked it was owned by one of their employees (who has been taken to court for similar troubles) can't we f'n do something about that? or suppose that's business as usual

</comment><comment><USER7> The fact that a completely unsubstantiated accusation [1] from a throwaway HN account got an astounding _1,615_ upvotes yesterday...

...really saddens me.

Like they say, "a lie gets halfway around the world before the truth puts on it boots."

I really wish people had higher standards for actual evidence before jumping to conclusions.

Now let's see if _this_ post gets a similar 1,000+ upvotes, as fairness would dictate. Something tells me it won't, but I'd love to be proven wrong. I'd be shocked if it even makes it to 50.

[1] [https://news.ycombinator.com/item?id=24506303](https://news.ycombinator.com/item?id=24506303)

<comment><USER8> My reaction to the original post was a casual "must be a new generation learning", because I thought this was just _longstanding expected behavior_. At least at some time in the past, registrars (and IIRC, Godaddy specifically) definitely _did_ do this. To the point you could enter any string of random characters in their search box and it would show up in whois shortly thereafter. Apparently things have changed, but the initial accusation was not far fetched.

<comment><USER9> Can you provide proof that they did do this?

<comment><USER8> I personally remember going to some prominent registrar's webpage for searching domains, mashing the keyboard or typing in phrases about how said registrar sucked, and then those exact domains showing up registered with whois(1) shortly thereafter.

I can only describe my anecdote and others are chiming in. If you're still skeptical you could search. It was probably a story on Slashdot, as things were.

<comment><USER10> You mean this one?

[https://slashdot.org/story/07/12/28/1458247/domains-may- disa...](https://slashdot.org/story/07/12/28/1458247/domains-may-disappear- after-search)

</comment></comment></comment></comment></comment><comment><USER11> How many "fraudulent" registrations and cancellations does GoDaddy do each day?

Could it be that it isn't GoDaddy being malicious, but perhaps a third party? It's pretty easy to get a feed of queries into the GoDaddy search box - <USER2> you'd need to do is partner with any registrar.

<comment><USER12> Or it could be this is GoDaddy's version of the classic "I GOT HACKED!!1!!1" excuse when caught exploiting their users. Which is even easier.

</comment></comment><comment><USER13> Just avoid GoDaddy if you can. They treat customers like shit anyway. Trying to upswell you stuff all the time. It's the kind of company that you can't rely to behave and act in your interest as a customer.

</comment><comment><USER14> GoDaddy's response to the earlier accusations from the throwaway account here: [https://news.ycombinator.com/item?id=24506303](https://news.ycombinator.com/item?id=24506303)

<comment><USER15> Awfully coincidental, but I guess it's possible that these things can happen.

<comment><USER16> It doesn't even seem coincidental to me, it's a one word dictionary word. "Mafia"-esque games are popular as hell, look at stuff like Among Us.

</comment></comment></comment><comment><USER17> Who cares. Why would anyone use GoDaddy after the December 2011 boycott?

<comment><USER18> Collective memory is short

</comment></comment><comment><USER19> Thank you for reminding me to buy [my name].com back since it's lapsed

</comment><comment><USER12> This is all extremely convenient. It's not just "it wasn't me" but even "it wasn't me, somebody was hacked, the domain will become available again tomorrow". Methinks the lady doth protest too much, this might well be godaddy's SOP when caught red-handed.

Be as it may, the fact that GD is so casual about pwned accounts being an everyday occurrence should suggest people that it's better to stay away from their lumbering carcass of a service.

<comment><USER16> > Be as it may, the fact that GD is so casual about pwned accounts being an > everyday occurrence should suggest people that it's better to stay away from > their lumbering carcass of a service.

My assumption is that the vast majority of GD accounts almost certainly are people that have their first domain, are nontechnical, and have a credit card linked. The same would not apply for, say, Gandi, based on their advertising and upsells.

</comment></comment><comment><USER20> Gell-Mann Amnesia effect

This is every HN post.

<comment><USER20> We'll see how a story that refutes the also popular but also nuts "Whistleblower: Mass Hysterectomies at ICE Facility" goes -

[https://news.ycombinator.com/item?id=24526130](https://news.ycombinator.com/item?id=24526130)

<comment><USER21> I'm in the process of reading it now, but the top comment suggests it may not a simple refutation

</comment></comment></comment><comment><USER22> You can use a tool like this one to search for domain name securely. [https://www.domainhamper.com/](https://www.domainhamper.com/)</comment>


How to temporarily freeze a process in Linux - <AUTHOR> https://superuser.com/questions/485884/can-a-process-be-frozen-temporarily-in-linux?answertab=votes#tab-top <comment><AUTHOR> It seems to work with firefox - useful for saving battery when I'm not using it.</comment>


In-flight Wi-Fi is "direct link" to hackers - <AUTHOR> http://arstechnica.com/security/2015/04/in-flight-wi-fi-is-direct-link-to-hackers/

<comment><USER2> This is one of those cases I absolutely think there should be no common hardware or connection. A plane's control system should not have any physical connection to public facing systems except for maybe sharing the same power source.</comment>