We tested popular web hosting companies and all were easily hacked - <AUTHOR> https://www.websiteplanet.com/blog/report-popular-hosting-hacked/ <comment><USER2> I'm less interested in how vulnerable Bluehost and Dreamhost are (of course they are), and more interested in how good a writeup this is about finding variants of and then weaponizing a handful of vulnerabilities most pros would write off as sev:lo hygiene bugs. The form POST as JSON is particularly cute. This is pretty great.

Here's a quick breakdown:

1\. Autogenerating CORS headers based on a regexp that can be tricked into allowing <safe.org>.evil.org.

2\. A form POST encoded text/plain that gets interpreted as JSON to bypass CSRF check.

3\. Using CORS origin check gaps to do an HTTP downgrade.

4\. XSS-ATO by email address changes (this is pretty vanilla).

5\. Sending "token[]=" to break PHP CSRF token check through type confusion.

6\. Breaking a different CORS generator by smuggling the whitelisted domain into a ?urlparam=safe.org.

7\. Setting content-type=text/plain; application/json to fake out browser check for JSON and bypassing CSRF at OVH.

8\. Some fiddly and not super interesting CSP bypasses.

<comment> ncc-erik My go-to link for that class of issue is: [https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS#Simpl...](https://developer.mozilla.org/en- US/docs/Web/HTTP/CORS#Simple_requests)

It's usually a lot easier to write the PoC with fetch() though.

</comment></comment><comment><USER3> These seem to have been "technical" bugs, mostly in the client-server communication of the self-service websites.

But hosting management also has a whole lot of potential for logical errors. I work at a B2B ISP that is also a managed service provider, and every now and then somebody calls for more self-service. I'm not against it, but it's full of landmines.

It starts with such simple things as account creation. We allow accounts with the appropriate roles to be used for several different customers, which means we cannot namespace them by tenant.

We used to give accounts usernames based on the first and last name, but that makes it very easy to leak which other accounts exists (when "John Doe" becomes "johndoe4" instead of just "johndoe", you can infer the existence of other accounts, and thus that other "John Doe"s are among our customer base). We had to change that, which isn't as easy as it sounds for a company that has been doing things a certain way for 25 years.

Potential logic errors and information leaks lurk in all places where you cannot namespace things because they are not fully under your control, which can be IP addresses (big customers bring their own address spaces, and IPv4 address space is too small for generous segmentation), Domains, email addresses, phone numbers and so on.

<comment><USER4> Curious, shouldn't you have moved over to IPv6 at this point?

<comment><USER3> This a very heterogeneous business, aka "we do whatever the customer pays for".

One customer has one or two whole /8 blocks of public IPs that they use even for internal systems in our data centers. Others are IPv6 on the inside and IPv4 public facing. Some are big layer 2 setups (which we internally route through IPv6).

</comment></comment></comment><comment><USER5> Are the old hosting companies of the past still sharing the same disk with other users? I remember going cd .. and seeing a bunch of folders in /home from other users. If any one of those users used a chmod incorrectly I would be able to access their shit. It is not super likely for most files but well known files can be a problem. Beyond that, trusted CGI-BIN processes could probably be used to get around security concerns (takes some work). I've been wondering if many of these FTP/SSH/Hosting sites have since moved to docker or some containerization tech.

All this assuming the hacker would use a gift card to get a paid account to start.

<comment><USER6> Standard containerization technology (e.g. docker) isn't designed to sandbox untrusted code.

<comment><USER7> Do tell what is designed to sandbox untrusted code

<comment><USER8> AWS Has written Firecracker for this purpose [https://firecracker- microvm.github.io/](https://firecracker-microvm.github.io/)

</comment></comment></comment></comment><comment><USER9> Dreamhost had the best response of all of them (at the bottom of the article).

Anecdotally, I've used Dreamhost for years as a domain host and have had nothing but positive experiences.

Originally I switched to them for being very vocally against SOPA, and they've consistently been on the right side of various Internet legislative issues.

<comment><USER10> I've been with Dreamhost personally for almost two decades, and as a group my friends have a shared account with them that's far older. Like, old enough that work was done on porting code to _the brand new PHP3_.

They do seem like good people, I have no plan to move my own stuff from Dreamhost and I can't fault their customer service, but I also cannot recommend for stuff beyond vanity domains, fun side projects and so on because they've had so many issues that suggest a lot of stuff is kind of half-arsed. My home Internet service provider is also good hearted, but they've also been very _competent_ which is important, and I just can't honestly say that about Dreamhost.

Three (of many) Examples:

I own a .co.uk domain, and the people who run .co.uk have different requirements for WHOIS and for how domain transfers work. So Dreamhost would present me a generic "Here's how to change WHOIS" page and then it'd mysteriously fail, but actually their backend just didn't work with that entire 2LD, and domain transfer stuff would not work or it'd seem to work but then payment was rejected and the transfer doesn't go through...

I made a DNS change through Dreamhost's control panel, and after a reasonable period of time (maybe an hour?) of Dreamhost's three authoritative DNS servers only one had updated. So I talk to their support. They say I need to wait for it to "propagate" which is bullshit, these are authoritative servers, "propagating" data to the authoritative servers is Dreamhost's problem and if they can't do it in an hour what are they using, carrier pigeons? Then the support person shows me dig results they see locally for those DNS servers which don't match results I see, showing that actually these servers are either split brain or anycast groups, I ask about that, and the tech assures me that no, the answers they see are correct and that answers I see, by literally querying the same IP addresses, must need to "propagate" for a few hours more. After enough prompting they relent and say they'll "check" with someone about the DNS servers. Literally under 60 seconds after going to "check" the results are fixed. Huh, what a "coincidence".

Most hilariously one time they charged me for a year in advance entirely by accident, someone fat fingered a script that takes money from customer accounts. Now, like I said their customer service is good, I got the money refunded together with my costs for the currency difference between when they took the bogus transaction and when it was refunded rounded up. But if I had a $5000 contract that'd have hurt a lot more than it did for a few vanity sites.

<comment><USER11> > I also cannot recommend for stuff beyond vanity domains, fun side projects > and so on

Seconded.

Dreamhost is fantastic at tone in their communications, especially broad public communications; they sound accessible, human, and open rather than corporate... and maybe they are, or maybe that's just part of their brand.

They are not, however, super reliable when it comes to availability, especially if your resource usage starts to approach something on the order of magnitude stated capacity, and in that case you will find out that there are the system rules they sold you on, and there's the unwritten rules which may or may not even be legible to you by the time you're done.

This is not unheard of when it comes to discount hosting, of course, and I don't expect them to be different. Just sayin' that neither should anyone else.

</comment></comment></comment><comment><USER12> I wish they had kept going till they found a web hosting firm that didn't have these issues. Can anyone -- not affiliated with such a firm -- recommend one?

If you are affiliated with such a firm, and you respond anyway, please explain what you do differently.

<comment><USER13> I'm the founder of [https://KubeSail.com](https://KubeSail.com) (YC S19) - we're building a Cloud Hosting platform for human beings built on the back of Kubernetes. We want to make Kube accessible to ordinary people trying to get work done - but at the same time offer the "right path" for developers who know they want real tools, not black-boxes. We're a deployment platform you'll never outgrow! The idea is to allow even junior developers to build powerful cloud-native apps with zero lock-in from day 1. We're also building a template system to help people share server apps with each other (ie: you can launch a dokuwiki [https://kubesail.com/template/erulabs/dokuwiki/](https://kubesail.com/template/erulabs/dokuwiki/) with one click). We have a ton to build and big plans, and have not publicly launched, but please let me know what you think! The site is live and free for GitHub users! We consider ourselves the non-ops Kubernetes tool - or to put it another way, GitHub is to Git as KubeSail is to Kubernetes

We're working really hard on securing multi-tenant Kubernetes clusters and have some tricks up our sleeves from years in the cloud industry, but we have not yet completed any external audits - that said, as the CTO, I take security _extremely seriously_ and consider it my number 1 priority, if that helps! We use tech like containerd, gvisor, eBPF and lots more to secure users containers on our multi-tenant hosting tier.

</comment></comment><comment><USER14> Factor in that all of these hosts are used primarily for Wordpress hosting(Bluehost is the recommended partner). So, the plausible attack vectors for exploiting these vulnerabilities are plenty via thousands of plugins.

</comment><comment><USER15> 3 of the 5 companies they tested are really the same company.

"Endurance, who runs Bluehost, iPage, and HostGator:"

<comment><USER16> Can attest, having worked at the Bluehost brand as a tier 2 chat support (before they shut down everything and offshored all support to the Indian CEO's family's Indian call center).

The company is a fucking nightmare. ALL EIG brands should be avoided like the plague including Constant Contact, site5, bluehost, hostgator, fastdomains, justhost, hostmonster, ipage, NetFirms, UnifiedLayer, IpowerWeb, PowWeb, ResellerClub, HostNine, HostCentric, Domain.com, Dotster, Verio, AppMachine, Arvixe...etc...

They have horrible security. Hacked sites were the norm not the exception. The techs we had were decent, but when things started off-shoring the off-shore tech's were complete idiots who couldn't figure out how to add space to a VPS...That was in 2015, I'm sure now it's way worse. I left in 2014/2015 to do development full-time, my wife worked there till they shut down their Orem, UT operations.

We had friends who they actually got to move to AZ to work w/ hostgator during the transition, and then fired 3 months later after they didn't need them anymore and AFTER they'd already bought a house in AZ... real pieces of shit there...

The CEO even said 3 weeks before everyone got the notification they were being canned "Don't worry your jobs are all safe, nobody's getting laid off" ...lmao

<comment><USER17> Luckily most of those domain names already scream "do not trust this hosting service"

<comment><USER18> Unluckily, in the majority of small and mid-sized businesses, non-technical people like sales and middle managers are responsible for making technical decisions, like picking a hosting provider.

Witness all of the otherwise upright companies that have domains through GoDaddy.

</comment></comment></comment></comment><comment><USER19> Would setting samesite cookie values have mitigated Bluehost's problems 1 and 2 in part? Or do CORS requests include cookies for compatibility purposes?

<comment><USER20> SameSite cookies are never sent on CORS requests (not even when the server explicitly allows CORS requests with credentials [1]).

In other words: yes, it would have mitigated Bluehost's problems. It would also have broken their sites (or otherwise they would _not_ be needing to use CORS requests at all).

[1] [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Ac...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials)

</comment></comment><comment><USER21> I think everyone need to remember CORS is a browser-only protection and anything you expose via CORS protected endpoint in reallity has no protection at all. Try cURL reaching any endpoint protected by CORS and you'll see what I mean.

Also browsers automatic sending cookie enable many of these CSRF, consider JWT.

Amazing how PHP is still bitting developers.

<comment><USER22> If you've taken the time to understand things well, you'll do just fine, even with PHP. Otherwise, the quirks of any language/library/tool may catch you out (it's not just a PHP thing).

</comment></comment><comment><USER23> Lots of people seem to have anticipated these results! So, is it OK now that for low-volume static sites I've just thrown everything on S3? How about adding in lambda and SQS for low-volume almost-static sites? Is it still terrible that I've wasted cents per month on these services?

</comment><comment><USER24> Has anyone asked for a comment from any of these companies? Seems like a big security problem.

<comment><USER24> I emailed Bluehost, this is the response I got.

Hello Joshua,

Thank you for reaching out to Bluehost via our press@ email address; as a brief introduction, I am writing you from Endurance International Group, parent company to Bluehost and several other web hosting services. In regards to your questions for how to best protect your website, one of the best things you can do to invest in your business is to acquire web security, something like Sitelock, to protect you from malware. Below you will find the following: i.) article from Sucuri.net explaining more about website security, and ii.) information to speak to Bluehost representatives more in depth about our partnership with Sitelock and help you set up that addon service, if this is what you wish.

i.) [https://sucuri.net/guides/website- security/](https://sucuri.net/guides/website-security/) ii.) 888-401-4678 | [https://helpchat.bluehost.com/](https://helpchat.bluehost.com/)

Kind regards,

Jacob Endurance International Group

<comment><USER25> "You got hacked because you didn't give us enough money"... these guys should get into the Ransomware business.

<comment><USER16> As I mentioned in another thread, I used to work for EIG... and 'one does not simply reply to a CSR request without first offering an upsell...' was a meme that was posted quite often.

</comment></comment></comment></comment><comment><USER26> I stay away from Endurance International, which own a ton of hosting companies:

[https://en.wikipedia.org/wiki/Endurance_International_Group](https://en.wikipedia.org/wiki/Endurance_International_Group)

</comment><comment><USER27> The good news is that these require a successful phishing attack, which is the number one way of getting hacked. Best to never click on any links in email.

</comment><comment><USER28> Were there web hosting services known for being more secure? For example, is AWS (particularly EC2 and LightSail) considered inherently more secure

</comment><comment><USER29> I always assumed cheap hosts were terrible, but this is mind boggling incompetence beyond what I would have imagined.

<comment><USER3> > but this is mind boggling incompetence

I disagree. It's very easy to make such mistakes, often even to miss them in code review. You also cannot simply cover all potential errors in integration tests, because there are infinitely many potential errors you can make.

You need continuous or regular red-teaming or comparable security controls to reliably avoid such things, and you typically only have those at the _really_ big and high-tech companies, or in highly attacked or regulated environments.

<comment><USER30> The other thing to keep in mind is that these companies are all in the lowest- cost tier of web hosting, which means the customers they're all fighting over by definition don't care about much other than getting the absolute cheapest possible solution. If they have a choice between a $9/month host with abysmal security and a $10/month host with robust security, I guarantee you 99% will go with the $9/month one. So anyone in these companies arguing for greater investment in things like security is going to have a hard time convincing management that it's worth the additional expense.

This tier of the market is also where the less-technical customers tend to congregate, so even if you _have_ great security, most of your customers aren't going to be in a position to be able to appreciate that. You could argue that security is a potential marketing plus, but then you could get the same "pop" by just _claiming_ you have great security without actually providing it. It's not like your customers are going to be able to tell the difference.

</comment></comment></comment><comment><USER31> Just don't use cookies and all those attacks are irrelevants

</comment><comment><USER17> In fairness these are decidedly not top-tier hosting services</comment>


PHP Insights: Analyze the code quality of PHP projects - <AUTHOR> https://phpinsights.com <comment><USER2> Hey everyone. I am Nuno, the creator of PHP Insights

First, thanks @MindGods for sharing PHP Insights on Hacker News!

To answer some question on the comments:

The goal of PHP Insights is not to perform type checking, for that we already have PHPStan and Psalm. And both already work great by default.

PHP Insights wraps tools like PHP CS, or PHP CS Fixer, putting each check/sniff within a specific category: A missing blank space is related to coding style. On the other end, having mutable objects can be considered a code quality problem.

So, once we have those checks performed, we show a well-designed console interface that shows developers the results per category in a human-readable form: with a score, percentages, etc.

Besides, it's designed to work out-of-the-box with Laravel, Symfony, and others. In other words, we have prepared a set of presets, that represent the conventions per framework, so when people launch PHP Insights within a Magento2 project, their project will be analyzed following the Magento conventions.

Long live PHP!

<comment><USER3> Off topic.

I really like the colors, theme and fonts of your terminal. Can you share them?!

<comment><USER4> Looks like Dracula

</comment></comment></comment><comment><USER5> Worth mentioning PHPStan [1] and Psalm [2] for static analysis as well.

1\. [https://phpstan.org/](https://phpstan.org/) 2\. [https://psalm.dev/](https://psalm.dev/)

</comment><comment><USER6> I look forward to the April 1st version of this tool.

PHP is truly a defining technology of our age. For all the tongue-in- cheekiness of my comment, it's a matter of fact that several giant web properties were built with PHP and have had irrefutable global impact.

<comment><USER7> Other than Facebook, who are they?

<comment><USER8> Wordpress.

<comment><USER9> it's difficult for me to link PHP as important in wordpress success

<comment><USER10> Can you name a business/site/project that was successful _because_ of the language it was written in?

<comment><USER9> according to pg viaweb was one

I can also think of nichimen mirai which was also 10 years ahead of the competition in terms of ergonomics and features and was based on symbolics S-graphics system (and I kinda believe most of the value in mirai was due to the lisp broader paradigm, you could clearly see how limited most programs were at the time, exception being maybe prisms/houdini [which was probably C based though:)])

some people also quote apl or prolog to be an extensive reason on why their product exists or has an edge

</comment></comment></comment></comment></comment></comment><comment><USER11> This looks like a cool high quality project. Has anyone used it? How does it compare/fit-in with other tools like Psalm and Prettier?

<comment><USER12> Hey, I created Psalm.

Psalm and similar tools perform type-checking static analysis. This tool does not do type-checking.

It does a few things:

\- Complexity analysis, with a few other top-level checks (analysis done here: [https://github.com/nunomaduro/phpinsights/blob/966fddbacb17e...](https://github.com/nunomaduro/phpinsights/blob/966fddbacb17e9504faa3a9a1d4977ebeb7a5cc4/src/Domain/Analyser.php))

\- Composer dependency security checks (if third-party packages have vulnerabilities)

\- It wraps PHP CodeSniffer with some additional sniffs

\- It wraps PHPCS Fixer with some additional sniffs

The tool doesn't go out of its way to advertise the fact that it wraps two popular existing tools, but that's the author's prerogative.

</comment></comment><comment><USER13> Thanks for sharing. I have some open source PHP projects (with Yii2), that I maintain on my free time, and I was wondering if there were any static analysis tools for PHP, and this just popped at the right time.

Will give it a try.

<comment><USER14> You might also look into exakat and phpstan. I can speak to the quality of exakat (my preferred static analyzer), where phpstan comes in as a close second.

This one also looks decent, and will be evaluating it for use in my day job.

<comment><USER15> This one looks more like a polished wrapper around phpstan and several other tools: [https://github.com/nunomaduro/phpinsights/blob/master/compos...](https://github.com/nunomaduro/phpinsights/blob/master/composer.json)

<comment><USER12> It doesn't wrap PHPStan

</comment></comment></comment></comment><comment><USER16> > src/Grouchy/MessageStream.php:17: Class has too many methods: 12. Can be up > to 10 methods.

> src/Grouchy/MessageStream.php:66: Your function is too long. Currently using > 40 lines. Can be up to 20 lines.

sigh.

One of the annoyances of modern PHP practices is the tendency to write one class, per file, which extends or implements one other class, and adds one or two functions to it. Every single logical abstraction in a PHP project can have somewhere between one to thirty different classes associated with it, and larger PHP projects end up with a thousand or more files. All of this is enabled by composer's PSR-4 autoloading support, so as long as you give your classes the right kind of names and put the files in the right places, you don't have to think about what it means to hit the disk that many times on a page load. Consequently, there are more and more harebrained caching schemes showing up to kind of paper over this architectural problem. And tracking some unexpected behavior through that many different pieces just suuuuuuucks.

I fully get that god objects are bad. But metrics like these are making complex PHP projects worse, not better. PHP is not, _and should not be_ , Java. Java has already shown us what the end result of these practices looks like. Let's not do that.

I desperately want a good code analysis tool for PHP: something that can look behind whether there's exactly one space before a '*' in a comment block and into deeper things like, "hey, on this line over here you tried to call a function that doesn't exist in the class the variable is supposed to be referencing".

Some further reading:

Aim small, miss small: [https://www.deconstructconf.com/2018/stuart-halloway- aim-sma...](https://www.deconstructconf.com/2018/stuart-halloway-aim-small- miss-small-writing-correct-programs)

Composition over inheritance: [https://github.com/jupeter/clean-code- php#prefer-composition...](https://github.com/jupeter/clean-code-php#prefer- composition-over-inheritance)

Small functions considered harmful: [https://medium.com/@copyconstruct/small- functions-considered...](https://medium.com/@copyconstruct/small-functions- considered-harmful-91035d316c29)

(There were a few other minor misbehaviors in this tool's output, but I'm less disappointed by those.)

edit: Sometimes I forget to mention the things I like about a project. The output this produces is super clean and easy to navigate, I liked it a lot. The dashboard presentation at the beginning of the output is super cool. It's a great idea to have a single thing you can drop in that sets up phpcs and similar tools with reasonable defaults. The developer for PHP Insights probably didn't make any of the decisions that resulted in line counts or function counts being part of the output. My disappointment was only that I got my hopes up that it was something different from what it was.

<comment><USER17> > I desperately want a good code analysis tool for PHP: something that can > look behind whether there's exactly one space before a '*' in a comment > block and into deeper things like, "hey, on this line over here you tried to > call a function that doesn't exist in the class the variable is supposed to > be referencing".

Then you want phpstan or psalm. They do actual type checking and static analysis rather than style linting, and do it quite well.

If you do want an alternative for linting, Slevomat Coding Standard adds a huge number of highly-configurable and useful extra rules to PHPCS. I'm a big fan.

<comment><USER16> Wow, phpstan and psalm are both brilliant, and this is the first time I've been introduced to them. Thank you.

</comment></comment></comment><comment><USER18> I like that it has an Artisan command for Laravel projects.

</comment><comment><USER19> Direct link to the (long list) of criteria: [https://phpinsights.com/insights/code.html](https://phpinsights.com/insights/code.html)

(And continues with Architecture, Complexity and Style.)

</comment><comment><USER20> How does it compare to PhpMetrics? [https://phpmetrics.org/](https://phpmetrics.org/)

</comment><comment><USER21> my codebase is so old and messed it broke this tool :(

<comment><USER22> I was just thinking that running this on our code base will probably break the tool. Have code from 2006.

</comment></comment><comment><USER23> Cool! Keep it up! I will give a try on this.

</comment><comment><USER24> Insert joke about the purely binary nature of determining PHP project quality.

<comment><USER25> I'll bite: it either isn't or it ain't ;)</comment></comment>


2244 Tesla - <AUTHOR> https://en.wikipedia.org/wiki/2244_Tesla <comment><AUTHOR> I'm wondering when SpaceX will send a probe to asteroid Tesla, I imagine at some point they're going to want practice with asteroids, and Elon is partial to whimsy.</comment>


Ask HN: What approach would you take in my situation? - <AUTHOR>

First, a little background into myself, then I'll tell you my story.
I've been working a corporate job for 6 1/2 years and have been interested in trying to do a startup for a large majority of it.  My biggest obstacle has been that all of my friends are either happy with their job or uncomfortable with the risk associated with a startup.
So, last Friday my cousin calls me out of the blue and says he's got a website idea.  We get to talking, and he explains that he and a friend of his have this idea but don't have the technical know-how to do it.  He explains the idea then asks if it sounds like something I'd be capable of.  He originally presents the idea as if he'd contract the development out.  I tell him it does sound like something I could do and that I might be interested in partnering with them. So, he arranges to further discuss the idea in person with his friend.  We met today.
The idea has promise, but there were some things that set off flags for me.  Would they set off flags for you?  One, the friend didn't seem to place much stock in a technical co-founder.  His offer was 10%, with the logic that he was taking more risks in going after the money and that somebody he talked to said they could built the site for $7000 and walk away.  I replied back that not having a technical co-founder would probably be a bad idea for him,and that before meeting him, I was thinking we'd all be equal but wondered if 20% might be closer to acceptable for them.  He replied that the two of them would need to talk about it.  The other thing that was discussed before that was whether he had any intention of seeking VC or angel money to be able to pay me to work full time.  They didn't plan on going that route, and were hoping I could work on it on the side while continuing my full-time job, though they were hoping that I might still be able to finish it within a few months if at all possible.  There was more in the discussion about the idea itself, a little brainstorming, and at the end we ended with the two of them saying they'd talk to each other and get back with me.
So, at this point, if you were in my shoes, do you think you'd move forward with these two or walk away?  Was I being selfish or selling myself short? <comment><USER2> Simple math: \--Are you comfortable working for $70/hour? \--Do you think this can be built/polished/updated in 100 hours? $7,000 / $70 = 100 hours

\-- Can this idea be sold relatively quickly for $70,000? \-- Will you be willing to wait for your pay-off? $7,000 is %10 of $70,000

Honestly though, sounds like you will be treated as a second rate citizen the entire time while also doing the majority work. If you're cool with that, that's your business. If you just want to start a start-up, but don't have any ideas, email me and I can help you come up with some ideas.

Lastly, family and business don't mix. If either party isn't _completely_ satisfied with how the process turns out, you ( and your family ) will hear about it for the rest of your lives.

</comment><comment><USER3> Ask yourself: WWZD?

Immediately start implementing the website.

Negotiate with them for as long as possible, so they don't hire outside help.

After promising them (verbally, no written communication) to start working on the website, don't do any work. When they ask about progress, be evasive.

Launch the website, owning 100% of it.

Profit.

<comment><USER4> This is legit advice.

I'd like to offer some names for your project: ConnectBook.com or conbook.com maybe even facecon.com

</comment></comment><comment><USER5> Honestly, if it would take you a couple months to implement it full time and they think they can get it for $7k otherwise its probably not a realistic estimate on their part and you'll never be respected for what you brought to the table. An idea is not worth 80% and making it come to life certainly isn't worth 20% if you truly want to do a startup you have a community right here to find friends and make connections.

You can set up a repository and both work remotely part time to see if it works out.

My point is mainly this, you are the only thing stopping you from doing a startup, so just do it.

But their idea (even if it's a good one) is not the only one that is a feasible startup so why work on it when you know going into it youre going to be under appreciated from day one.

Just my $.02

</comment><comment><USER6> With this attitude, they will hardly succeed. I've been through this situation in the past.

You will be blamed for 100% of the stuff going wrong on technical side, and will be given 10%. Moreover, I don't think you will be able to keep yourself motivated with this kind of attitude within the team. You won't be a considered co-founder, just a technical guy to finish thing off. Remember "Ideas are worthless".

Don't settle for 10%, not even 20%. Its not about money, but how much they value your work. Coming up with an idea is not a big deal, but execution is.

</comment><comment><USER7> It might be useful for some money, if he's paying up front. But the equity is probably not worth anything. All they have is an idea. Their contribution isn't worth 50%, much less 90% of the startup.

If you want to start a startup, you are better off going to hacker meetups, or getting a job at another startup in order to gain more relevant experience and connections.

</comment><comment><USER8> It doesn't sound like they put much, or any real value on what you'll be doing. Let them go with the $7k guy, if you want to do a startup then do your own.

<comment> wh-uws Let them go with the $7k guy, fail when they realize that a technology _business_ is way bigger than an idea

Then they'll come back with a better offer

</comment></comment><comment><USER9> What are they going to be doing? Does either one have any business skill at all? Is there any reason to believe they are capable of running the business while you handle the development side. Is one of them a designer, or an expert on the subject-matter?

If not, then it's really just a guy with an idea and I'll give you 10% to build it. That would definitely be a no for me. I'm probably approached about once a month by a friend who has a great idea for a website. They don't realize that I have way more great ideas than I have time to build them.

</comment><comment><USER10> Pawn, don't be a pawn! The only way I could justify him giving you 20% is if he has customers _secured_. Secured means money in the bank account and not verbal commitments.

And I'm not sure I understand him saying he has more risks. Is he putting more hours selling than you coding? Is he committing capital? Is he quitting his job?

I have a project I'm currently looking for an equal technical co-founder. email me if you're interested.

</comment><comment><USER11> Walk. These guys are amateurs looking for an easy ride after watching The Social Network.

<comment><USER12> Um.. Which business type character in the social network got an easy ride?

<comment><USER11> The Winklevoss brothers.

</comment></comment></comment><comment><USER13> As long as they actually believe that they'll get, well, anything at all really for $7000, then that's what they're valuing your contribution at. Its not surprising at all that they would offer you 10% for this $7k "investment". They probably feel that they're being generous and doing you a favor.

Until your cuz and his friend get some grounding in the real world of web development, I'd steer well clear.

</comment><comment><USER14> Unless these two people have a ridiculous amount of skills you're not mentioning, I wouldn't touch this with a twenty-foot-pole for any amount of equity.

It certainly sounds from your note like they don't know what they're doing, and will end up dooming your company before it starts.

Besides, as mentioned elsewhere in the thread, this guy is family. This situation likely ends with you mutually hating each other. Who needs that?

</comment><comment><USER15> They aren't doing fair business. Either they have customers or funding lined up, or you take an even split.

A guy who gets paid $7000 to build the site is not the guy that keeps the servers running, is not the guy that backs up the database, is not the guy who organizes further engineering efforts should the site take off.

</comment><comment><USER16> I think you shouldnt waste anytime working in a startup on/with a idea/team that you dont believe in. Youre potentially going to be taking a lot of risk by going the startup route - an unimplemented idea from your cousin's friend is probably worth a week or two of brainstorming. I would say walk away.

</comment><comment><AUTHOR> Thank you all for your feedback. The overwhelming majority of you seem to be telling me the things I was thinking before, but not necessarily sold 100% on. I was concerned that I might be biased towards thinking the technical side is the majority of the work merely because I'm a developer, but you all seem to be of the same opinion.

For those asking about the other guys' contribution, they were essentially saying that they had potential investors who said they were interested in investing, but wanted to see a product first. Not exactly money in the bank, but a little better than nothing at all. I don't know how sound the logic is, but the "risk" on their part was stated to be financial, while mine would be time.

Once again, thank you all for your advice. You've certainly helped.

</comment><comment><USER17> An idea without execution isn't worth anything.

You'll be doing all the work up front and then all the work maintaining and improving.

You're also not a flight risk as it sounds like you're in it for the long haul.

They also sound like they're not convinced, which means they either haven't though it through or they're not worth the risk.

Good luck with the decision. I would vote a no for them as it sounds like you deserve better and if you keep looking, you'll find some cofounders worth taking the startup risk with.

</comment><comment><USER18> Use the spare time that you would have given them, for 10% of failure, to build your own side project, then either build that into a business or leverage the experience for the next thing.

</comment><comment><USER19> Lack of understanding of the value of technology and execution that shows from the discussion you described would be a HUGE red flag for me.

I wouldn't move ahead with a team like this that has no experience and little understanding of what's needed to be successful.

</comment><comment><USER20> [http://marcgrabanski.com/articles/long-live-the-hacker- entre...](http://marcgrabanski.com/articles/long-live-the-hacker- entrepreneurs)

</comment><comment><USER21> Take cash up front. Be professional about delivering. Make sure that the rate appropriately values all your weekends and evenings.

Keep your day job.

These guys don't know anything: having their $7000 developer "walk away" is a disaster and they think it's a feature.

What happens in the future is anyone's guess, but the mostly likely outcome is that nothing happens. The next most likely is that something modest happens. Etc. Many of the eventualities will require continued development; you're the first choice and you'll have the upper hand.

</comment><comment><USER22> And the very next day: <http://news.ycombinator.com/item?id=2579668></comment>


Show HN: Mini Meme Generator (using photos from recent Lenovo campaign) - <AUTHOR> http://slidechute.com/memes/lenovo

<comment><AUTHOR> TechCrunch ran a story about how funny these photos were and how they should be captioned.

We thought it would be cool to actually do it.

Original article: [http://techcrunch.com/2012/06/07/the-only-logical-thing- to-d...](http://techcrunch.com/2012/06/07/the-only-logical-thing-to-do-with- these-lenovo-ideapad-ads-is-start-a-caption-contest/)

<comment><USER2> Ah, that context is helpful.

Right now the page appears to be broken, and is giving me a blank image to caption.

<comment><AUTHOR> Yeah we're trying to figure out what's happening. I am getting a timeout on the jquery script of all things.

</comment></comment></comment><comment><USER3> giant comma:

      <a>,

cut off right side of picture:

      <a>|||

text overlay:

      <?foo><?bar>

</comment><comment><USER4> All I can say is: Marketing campaign == successful!

<comment><AUTHOR> haha yeah, pretty funny.

</comment></comment><comment><USER5> I want my laptop and I want to be using it. I don't want some woman holding it near a horse. Number one because I can't use it, number two because she might drop it in horse shit. How is this effective marketing beyond "look at pretty people"? Or am I just wrong for thinking that that sort of marketing would not be effective on the intelligent types that I expect would be interested in Lenovo laptops?</comment>


Rubular, dude - a regex testbed for Ruby - mkr-hn http://rubular.com/

<comment><AUTHOR> This is such a nice site - it's even great for non-ruby regexes, I use it for troubleshooting my JS patterns as well.</comment>


Microsoft code contains the phrase 'big boobs' - <AUTHOR> http://www.networkworld.com/community/node/81053/

<comment><USER2> Obviously the phrase is a recursive reference to the people who are offended by the phrase. I guess the lesson is stick to 0xDEADBEEF which is oh so much more PC?</comment>


MLP based network which learns and play T-Rex game all by itself - <AUTHOR> https://github.com/amaneureka/T-Rex/ <comment><USER3> A fun project T-Rex Chrome game player using machine learning. - <USER2> Preceptron Neural Network (Tanh Layer) - Unsupervised Learning repo: [https://github.com/amaneureka/T-Rex/](https://github.com/amaneureka/T-Rex/) demo: [http://amaneureka.github.io/T-Rex/](http://amaneureka.github.io/T-Rex/)</comment>


Ask HN: What to do when web hosts ignore DMCA's? - <AUTHOR>

It was brought to our attention that our files were being illegally posted on www.gfxtra.com.  After researching the domain, we sent out 15 DMCA's for each file to both Cloud Flare and LeaseWeb. Here are their responses...
LeaseWeb:
Unfortunately, we cannot handle your request as the mentioned website is being published and protected by the CloudFlare network: 1.	The domain is being hosted on CloudFlares nameservers. 2.	The domain name resolves to IP addresses under CloudFlares control. 3.	When the website is entered in a browser, the browser connects to a CloudFlare IP address.
In LeaseWebs opinion, websites published and protected by CloudFlare,are CloudFlares responsibility. CloudFlare has a direct relationship with the website owner, since the website owner is CloudFlares customer. This puts CloudFlare in the position where they can contact the website owner directly. Also, with the domain name hosted on their name servers and the website being published through their IP's, they have all the tools at their disposal to remove the website from the internet may the website owner refuse to cooperate. By pointing complainers towards LeaseWeb, CloudFlare is  walking away from their responsibility
Cloud Flare:
Please be aware CloudFlare offers network service solutions, including a reverse proxy, pass-through security service and a content distribution network (CDN). Because CloudFlare is a reverse proxy, our IP addresses appear in whois and DNS records for websites using our services. CloudFlare is not a hosting provider, and we do not have access to our customer's content.
More and more of our files keep showing up on the site while both companies continue passing the buck.
What is the best way to deal with this issue?
Thanks for you help! <comment><USER2> The DMCA takedown provisions are a safe harbor against legal liability -- compliance protects a host against legal liability they would otherwise have to a copyright holder for copyright violations. Implicitly, they are backed by the threat that, if the receiver fails to comply, they will be subject to a lawsuit for copyright infringement.

If you are sending DMCA takedown notices and they are being brushed off, you probably are at the point where you need to talk to a lawyer

<comment><AUTHOR> Ugh. We're a very small company, and we don't exactly have tons of money to spend on a lawyer at this point.

<comment><USER2> Sure, you have limited resources you can expend on legal services -- but you presumably also want the piracy to stop. A consultation -- which shouldn't be too expensive -- will give you a better idea of what your options are and what it would take to pursue them, from which you can evaluate what it is worth doing given the value of the content involved.

</comment></comment></comment><comment><USER3> Can you not contact the site owner? Or ask Leaseweb to forward your request to the owner? Besides that, I would assume the next course of action would seek legal advice.

<comment><AUTHOR> We did contact the site owner with all 15 DMCA's and never got a response. He's based in Turkey. Not sure if that helps to shelter him or not.

</comment></comment><comment><USER4> Send an email to both LeaseWeb and CloudFlare stating the other party's response.

<comment><AUTHOR> We did email LeaseWeb with CloudFlare's response, and we never heard back.

<comment><USER4> I'd just say you will pursue further legal action.</comment></comment></comment>


"Child Pornography Is Great," Anti-Pirates Say - <AUTHOR> http://torrentfreak.com/%E2%80%9Dchild-pornography-is-great%E2%80%9D-anti-pirates-say-100429/

<comment><USER2> Sure, this tactic is similar to my view of the situation in Arizona, or drug laws.

The tactic is to hold up an example that people can't disagree with as being 'bad', and claim you need new powers to fight this scourge. Illegal immigration is bad, so we need to be able to stop and search anyone at anytime in case they are undocumented. Drugs are bad, so we need to be able to tap phones and search houses without warrants, and set up checkpoints to screen anyone driving within 20 minutes of the Mexican border. And, child porn is bad, so we need to monitor all internet communications constantly to screen for it.

In each case, it's simply an excuse to grant unheard of powers to authorities, which they will then be sure to use for various other purposes which they didn't see fit to mention at the time. The actual solution to any of the problems used as the wedges don't resemble the proposed solutions, either.</comment>


Researchers Seem To Hide Details - <AUTHOR> http://iphone-cocoa-objectivec.blogspot.com/2009/08/researchers-seem-to-hide-details.html

<comment><USER2> This is definitely a problem. I'm trying to write a paper now (in applied math), and there's no way I can fit the true details of the implementation into the paper (there's just too much detail in the implementation!). While I can skim over some of the less relevant details in order to get the 'gist' across, it seems ridiculous to me that no-one will ever be reading my code! At least for rigor's sake.

This brings up other interesting questions too, actually: Should I be going out of my way to make my code readily available via a website in spite of publication norms? Are the supposed benefits to the scientific community significant (I'm in a field where the minority of researchers can read the code at all)? What are potential costs and benefits to me, as someone attempting to establish themselves in the field? I can imagine this sort of action improving or deteriorating my credibility as perceived by others.

</comment><comment><USER3> This has bitten me a few times. CS type journals should totally start requiring source, or at least links to it. I have more than once gotten the source used for a paper, only to find the claims of the authors were nothing like what the source actually did. Worse is that frequently there are leaps of "oh it will work like this" in the papers, which are show to be wrong by the code!</comment>


Deterministic Execution vs. Record-and-Replay - <AUTHOR> https://www.cloudseal.io/blog/2019-05-06-deterministic-execution-vs-record-and-replay <comment><USER2> By that standard, there really isn't deterministic execution. You'll always want something that simply must be recorded, such as the current time.

A better distinction: deterministic execution is when you rerun the executed instructions, depending on predictable execution to avoid needing full snapshots for all possible stopping points.

By my definition, I've been on a team that has had it working for more than a decade. We built our own hypervisor in fact, purely for internal use. It has been a neat project, providing a lot of benefit to us. Along the way we have frequently had to fight CPU errata, and Intel flat out refuses to officially support the technology.

We're hiring: [https://news.ycombinator.com/item?id=19797601](https://news.ycombinator.com/item?id=19797601)

Overall, I think that deterministic execution is going to become important to many software developers.

An interesting issue is that the typical RISC CPU can not support this. RISC CPUs tend to use nondeterministic locking sequences, generally some variation of "load locked" and "store conditional". This design error is found in all instruction sets supported by ARM, MIPS, PowerPC, and RISC-V. Aside from the occasional errata glitch, Intel works fine. CISC wins.

<comment><USER3> That exact issue stops rr from working on those architectures.</comment></comment>


How Basic Performance Analysis Saved Us Millions - <AUTHOR> http://heap.engineering/basic-performance-analysis-saved-us-millions/ <comment><AUTHOR> Hi, author here. Feel free to ask any questions about the post.</comment>


Ask HN: How do small startups handle customized changes to terms and policies? - <AUTHOR> More and more, customers of our relatively small startup (https://CoCalc.com) have been emailing us to say "Based on the review of the terms/privacy policy, we can only contract for services with the signed modification to your terms."  These typically come from universities or high schools, both in the US and Europe.   Our official Terms of Service (which were drafted in consultation with a reputable law firm) are here: https://cocalc.com/policies/.   The changes that are requested by customers are often described as being required by local law.  For example, a university in Texas added a bunch of requirement including "you will not boycott Israel", among many other changes.   The most recent request from a school has numerous new terms involving precisely how security of the site is periodically audited, data about how students will be shared (e.g., it will never be stored outside the USA), etc.
QUESTION: what do some other small startups do in situations like this?
It seems like our realistic options are (1) pay lawyers and hope it pays off later, (2) do the best we can, but without official legal advice, (3) just say no unless the customer lifetime value exceeds some threshold, (4) just say yes to any reputable client, irregardless of size, and possibly subject ourselves to some surprise liability down the road.
Regarding (4), these customers are very reputable universities and schools who are just trying to comply will all local laws and best support their student's privacy -- they are not malicious or trying to take advantage of us.  The requirements mostly seem reasonable and something we can comply with, assuming I understand them correctly.
So far we have done some combination of (1) and (2).  When we ask the universities what happens when they deal with companies, they will do things like tell stories about how different it was to deal with Microsoft and Apple, which isn't really helpful, since those companies are massive. <comment><USER2> We've raised prices, or rather asked for annual prepayment of one of the higher plans. It's usually the customers who demand more complex billing arrangements and yearly chasing to get the next invoice approved. Anti-slavery amendments seems normal, one asking to boycott (not not boycott) we wouldn't sign, the extra long forms about security ("state how often you change the wifi password") we refused as over-binding.

Funniest was to agree to take down any content of erotic nature within X hours after notifications. We deal with geographic data (addresses) and there's many places around the world with "naughty" names. We can't remove those (facts) from our database just because a customer is offended.

<comment><AUTHOR> Thanks for sharing your experience. Did you raise prices, then use the extra money to consult with a _lawyer_?</comment></comment>


USAToday.com Redesign Preview - <AUTHOR> https://www.facebook.com/video/video.php?v=10151250080289923&saved&utm_source=buffer&buffer_share=46f5e

<comment><USER2> wait, this is a spam post, I'd undo my vote if I could</comment>


Show HN: Pimod – Reconfigure Raspberry Pi Images with Docker-Like Configuration - <AUTHOR> https://github.com/nature40/pimod <comment><USER2> This is a really neat idea...of course you can also just use docker for much more flexibility: [https://blog.hypriot.com/getting-started-with-docker-on- your...](https://blog.hypriot.com/getting-started-with-docker-on-your-arm- device/)

</comment><comment><USER3> Pretty neat idea!</comment>


Show HN: Bastions – a QA tool for lead generating web forms - <AUTHOR> https://bastions.co <comment><AUTHOR> Hi there, I'm the creator of bastions. Here is a coupon code created specifically for HN users that originate from this post: HN2018. This code will get you 50% off for the first 6 months of service. I am still trying to get a handle on the correct pricing model for the service. Hopefully, this coupon will help if any of the numbers are off-putting.

Bastions solves an important problem impacting businesses that generate leads from their websites. With so many moving parts (the website/server itself, the form, the CRM, etc.) it is easy for one to malfunction and cause a break in your online sales pipeline. In most cases, these issues go unnoticed for days, weeks, or even months (especially if the issue is subtle). Once the business discovers the issue, the potential for lost revenue is an unknown (and frightening) number. Bastions helps detect these issues before they become bigger problems. Using selenium, bastions will routinely test your web forms just like a user would. It can optionally integrate with a third-party CRM to ensure your lead arrived at its destination (and clean up the test lead afterwards).

I'm constantly improving the product and looking for any and all suggestions. I would appreciate any feedback from the HN community. Thanks for checking it out!</comment>


How to become an Entrepreneur - <AUTHOR> http://ozprix.com/2013/06/24/how-to-become-an-entrepreneur <comment><AUTHOR> is good to learn new things...i hope you going to enjoy this post</comment>


What I wish I knew before starting a business - <AUTHOR> http://entrepreneur.venturebeat.com/2010/08/19/8-things-i-wish-i-knew-before-starting-a-business/

<comment><USER2> There are corollaries to a bunch of these items:

1\. You will need to be more agile than you could ever imagine. It's amazing how much dexterity and foresight is needed to manage things when they're moving at such glacial pace, but timing is critical. An hour could mean the difference between eating next month or closing up shop.

2\. Some items will succeed quickly, but only temporarily. You need to burn the kindling, but you also need some good wood. This is especially critical when you're in a service-based company. Your first few clients might bring you a lot of bacon, but the clients you build relationships buy you a pig farm.

3\. You can't do it alone. Whether it's financial, technical, social, or moral support, you're going to need it eventually.

Overall, I think this list petered out a bit in the end, and some of the points missed the mark. Overall, I think that running a business is a lot like fishing, playing a game of poker, and riding a bicycle at the same time. You need patience, attentiveness, social and observational skills, and endurance.

And a very understanding wife.

<comment><USER3> It got a bit sexist there in the end.

<comment><USER2> Apologies!

</comment></comment></comment><comment><USER4> 5\. Your bad employees rarely quit

If you've ever worked for, or with, the government this is readily apparent.

<comment><USER5> This is true of any large organization. No government bashing required.

<comment><USER6> A large organization populated by bad employees will go out of business. Only the government and its appendages have the luxury of avoid that fate.

<comment><USER7> You will not believe how many bad employees a large organization can carry and still grow and prosper.

I mean, ever talked to an AT&T call center? Do you see them going out of business any time soon?

There was this guy I worked with on a previous job. He was simply unqualified to do his job, and displayed no interest in becoming more qualified. He did the bare minimum to survive, and very often others had to do his work for him so they can make progress in their own job. For various reasons his managers preferred to keep him even though he knew of his low performance. He was there for 3 years when I left. The organization is in no danger of dying, even though around 30% of the employees were of similar quality.

<comment><USER6> When I think of firms not dependent upon nor beneficiaries of government largesse, market manipulation, and anti-competitive barrier raising, AT&T isn't what comes to mind.

<comment><USER7> Sigh.

HP? IBM? Oracle? Verizon?

Although "market manipulation" is broad enough to include any large company at all. Same with "anti-competitive barrier rising".

So, we can say that past a certain size companies become evil bastards and have many bad employees and they survive quite well.

They are still not government though, and consumers could choose to stop using their products and they could go out of business. Except they don't.

<comment><USER6> Perhaps I wasn't clear. Let me try again:

When I think of firms not dependent upon nor beneficiaries of the government's largesse, the government's market manipulation, and government's anti- competitive barrier raising, AT&T isn't what comes to mind.

And of course the firm's resistance to market forces is not binary, but rather proportional to how close the firm is to the government corpus. Fannie Mae and Freddie Mac more so than AT&T more so than Apple.

<comment><USER7> So I was hoping you will accept one of my other examples of companies with large numbers of bad employees that show no intention of going out of business any time soon.

The cellphone market is highly regulated, but the large computer and software manufactures don't seem to depend on government manipulations.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Nice point about bad employees will be the most loyal :-) I had not quite thought of it that way.

<comment><USER9> Me, I'd worry about the person whose most loyal employees were bad. It would mean they don't provide the kind of workplace where good employees stick around. The number one reason people leave jobs: they don't like their boss.

There are a lot of technically brilliant people who aren't looking to move for a 10% pay rise (unless they are grossly underpaid - sheesh, don't underpay your people). Great people will stay for a good boss (see above), a happy environment, a degree of creative freedom, opportunity to work independently, the chance to extend their skills, etc etc.

It's true that bad employees generally don't quit, though.

[Edit: Don't believe me? Ask Pixar what their staff turnover rate is. Is Pixar full of bad employees? Methinks not.]

<comment><USER10> I'm not sure the intent was commutative (if a then b, but not if b then a)?

Your bad employees will be loyal.

That doesn't mean your loyal employees will be bad.

</comment></comment></comment><comment><USER5> A good corollary to #4 is that good bosses/managers are also very hard to find. That includes most of the people who will be reading that blog full of self pity about the bad luck they have finding good employees.

Why is it that these management blogs always pander to the readers without ever suggesting that the problem may be you - the manager/boss.

</comment><comment><USER11> Don't know if I agree with #2. There are plenty of overnight success stories that are 10 years in the making (Zappos comes to mind). And plenty of startups had to muscle through tough times without seeing "quick success" (Pandora). Countless others.

If things things that succeed tend to do so quickly, why is the idea of a pivot so important?

<comment><USER12> Perhaps pivoting is important to turn away from something that isn't succeeding, towards something else that might.

</comment></comment><comment><USER11> The larger a company is, the easier it is for bad employees to hideout in the org. The path of least resistance for the average manager is to just let it slide.

It is also my experience that letting poor performers slide has a big impact on your top performers. Top performers want to be part of a winning team, and letting slackers ride sends a terrible message.

<comment><USER13> There's actually some research, which I couldn't find that points out just the opposite. The best performers often like being the best performers, and actually take a slight pay hit for being considered the best.

But there's probably also a difference between working with someone who does no work, takes 3 hour lunches, and never gets anything done on time. Versus the person who works hard, but just takes 20% longer than you to get stuff done. The former really bug people, but the latter tends to just make you look good, while still helping the company.

</comment></comment><comment><USER14> _"If you want to build a business predicated largely on finding, getting and keeping quality employees to succeed, you should understand that premise will be your greatest risk. Finding a market and profitably selling to it (usually the greatest risks) will take a back seat. Better yet, pursue a business that needs some reasonable percentage of employees to be really good."_

I'm having trouble parsing that. What option is the last sentence better than?

<comment><USER15> He's saying it's better than the first option: pursuing a business that requires a very high percentage of quality employees in order to have any chance of succeeding.

</comment></comment><comment><USER16> I'm interested in item 2 (things that succeed do so quickly). Is this true?

Edit: (I should note that I'm more interested in this observation as applied to people than I am applied to products, though. Are great salespersons great on the first day, or is it possible that some people just need time to get used to the environment?)

<comment><USER17> I'd love to see some data on this as well, are there no instances of slow and steady winning the race in the startup world?

</comment></comment><comment><USER18> The unlucky point is so true. All kinds of crazy costs and snafus will sneak up and knock you off your feet. Taking care to plan ahead always helps, but having that new server go dead or finding some unexpected legal fees or finding an unanticipated tax bill in the mail can really knock you off your game for a few days.

Just be sure to keep some emergency cash reserves on hand if you can afford to do so. It can save your sanity and your company (I've had 2 instances where the cash reserves have saved my company's behind: (1) was for a costly rescue from DriveSavers and (2) was for some hefty but worthwhile legal fees from an unexpected legal dispute.

</comment><comment><USER19> I'm a solid worker - just spent the weekend in the Bay Area for the first time ever and on the Saturday I worked for 16 hours instead of seeing anything. Anyone want to hire a solid worker for some freelance? :)

<comment><USER20> What do you do? Dusing at row27.com

<comment><USER19> .NET mostly - just looked at your site so I doubt that lines up but you have nice looking work :)

</comment></comment></comment><comment><USER21> I believe the author is confused about what a "sunk cost" means.</comment>


The Decline of the American Actor - <AUTHOR> http://www.theatlantic.com/magazine/archive/2015/07/the-decline-of-the-american-actor/395291/?single_page=true

<comment><USER2> My cousin's daughter trained at the Royal Academy of something in England. When she returned, she immediately went to LA to find work. After a few years, she quit. Her reason? "I thought it was all supposed to be about the art. It isn't."

I've been in and around the business for 45 years. Far too often people get into acting cause they want to be rich and famous so they jump in cause someone said they were good looking and did great in the high school play. They then try to land an agent while never studying the craft.

Acting is art. Artists study the work and try to get better at it.

My son is an actor and runs his own theatre company. Often I visit him and find an open book about a play by someone I never heard of, yet to him, it's a matter of course that the playwright should be studied. I never see this among others in his circle of friends and acquaintances.</comment>


Show HN: Cloudbank-An OpenAI universe Alternative - <AUTHOR> https://github.com/SHEUN1/Cloudbank <comment><USER2> [https://github.com/SerpentAI/SerpentAI](https://github.com/SerpentAI/SerpentAI)

</comment><comment><USER3> Wow! That's amazing. Looking forward to running it on a VM this weekend.

<comment><AUTHOR> Cool, let me know how it goes. I'm really eager for some feedback so I can improve this.</comment></comment>


Algebra and geometry – the MVC way of understanding mathematics - <AUTHOR> http://morganwilde.svbtle.com/algebra-and-geometry

<comment><AUTHOR> I have to give credit for the idea of the article to Bret Victor. I think it was his "stop drawing dead fish" presentation during which he mentioned algebra and geometry as just different views for mathematics.</comment>


Bay Area awakes to foreboding, smoke-choked orange skies. Here's why - <AUTHOR> https://www.sfchronicle.com/bayarea/article/Bay-Area-awakes-to-foreboding-smoke-choked-15553731.php <comment><USER2> Sad what journalism has become, nothing more then a twitter search filter.</comment>


Game graphics could be 100,000 times better - <AUTHOR> http://www.reghardware.com/2011/08/03/game_graphics_could_be_10000_times_better/

<comment><USER2> Previous submissions and discussions:

<http://news.ycombinator.com/item?id=2832669> : A few comments

<http://news.ycombinator.com/item?id=2835383> : >100 comments

<http://news.ycombinator.com/item?id=2836042>

<http://news.ycombinator.com/item?id=2836424>

<http://news.ycombinator.com/item?id=2837948> : >40 comments

<http://news.ycombinator.com/item?id=2837954></comment>


Node Knockout Leaderboard - <AUTHOR> http://nodeknockout.com

<comment><USER2> We wrote a testing / continuous integration service for all 3500 npm modules. It saves you time you would have spent agonizing over broken code.

The billboard (<http://hollaback.no.de/billboard>) shows a gigantic list of the test results for the node modules we've tested.

Vote for us! <http://nodeknockout.com/teams/hollaback>

</comment><comment><USER3> I created <http://observer.no.de/> as solo entry for NodeKnockout. It allows you to follow your site's users in real time (or watch a automatically generated recording of it). You can see the mouse movements, scrolls, clicks , JavaScript errors and much more (if you are following them in real time you can also start chat conversation with them :))

See demo: <http://observer.no.de/demo> Votes: <http://nodeknockout.com/teams/speedo>

<3 It was an epic competition

<comment><USER4> Wow, I didn't know that this was a solo entry. Planning on throwing my vote in sometime tonight, but based on what I saw with the demo it looked awesome. Great entry, hope for the best on the results.

<comment><USER3> Thanks, glad you liked it! I managed to pull it off thanks to a lot of planning.

Btw I won solo / overall (and also became first in utility) :)!

</comment></comment></comment><comment><USER5> We created an 8bit multiplayer game where you run accross an office to became the BOSSMAN <http://nodeknockout.com/teams/team-gauchos>

You can play against other people in the Hacker News room here: <http://playbossman.com/play/hackernews>

</comment><comment><USER6> We wrote continuous integration for node.js.

Either specify a repository, or setup a post-receive hook from GitHub to trigger builds.

Please vote for us! <http://nodeknockout.com/teams/swipers>

</comment><comment><USER7> Most badass JS you will see today? Distributed chess AI with webworkers and nodejs!

<http://chessathome.org/>

Please vote for us, top right corner :) thx

</comment><comment><USER8> If you like JavaScript checkout <http://jsninjabattle.no.de/> it's our entry to NKO. It lets you compete with your friends to see who's the better JS Ninja.

<comment><USER9> internal server error ... something wrong with your templates perhaps

</comment></comment><comment><USER10> I've created PostCatcher - the HTTP POST requests testing application

Check it out at <http://nko2-3node.herokuapp.com>

</comment><comment><USER11> What a fun competition. Tons of great new ideas and some really amazing examples of the future of the web.

</comment><comment><USER12> Please vote, this is what I am doing after college. No real job :) <http://markover.nodejitsu.com/> Contextual real time commentary that works on NYTimes and other news sites!</comment>


Latent Semantic Analysis Tutorial - <AUTHOR> http://www.puffinwarellc.com/index.php/news-and-articles/articles/33.html?showall=1

<comment><USER2> State of the art implementation, using random projection for reasonably accurate yet hundreds to thousands of times faster: <http://radimrehurek.com/gensim/>

Random Projection is something you should be aware of if you do any kind of large dimensional modeling. It _is_ magic.

<comment><USER3> Also, random indexing, which is in its theoretic essence the same thing: <http://www.sics.se/~mange/random_indexing.html>

</comment></comment><comment><USER4> Truncated SVD has been a wonderful tool for "cleaning up" pairwise cosine similarity data for text document comparisons, graph/network building (for a visual representation of entities represented by documents, embedded in something like Gephi/Sigma.js/D3), and for item-based recommendation systems.

The biggest problems I then run into involves choosing a "k" (the dimensions allowed in your truncation). Have had some thoughts about training this unsupervised method (providing labeled data for what "oughta" be the top nearest neighbors for this particular entity, and optimizing toward that) or building an ensemble method on top of many SVD'd truncated vector spaces (though the combination method is unclear to me-- pick kNN from a linear combination of each model's outcomes? Pick the intersection of each method's k nearest neighbors?)

To novices looking at this tutorial: NumPy's a wonderful tool for small toy examples, but at a certain scale you will depend heavily on the sparse matrix formats provided for you by SciPy. (That and random projections should curb any memory problems you'll run into for many vector space-based problems, short of operating at a Google/Yahoo scale, or if your target's TBs of logging data).

<comment><USER5> Visualising multi-dimensional data is indeed, tricky. The best tool I have found so far for word representations similar to LSA has been t-SNE:

<http://homepage.tudelft.nl/19j49/t-SNE.html>

In some cases what I get isn't all that much better than simply using PCA, but overall t-SNE is superior. Although t-SNE is dreadfully slow... Below is a link to an implementation used for text and I can highly recommend the original paper on t-SNE:

<https://github.com/turian/textSNE>

</comment></comment><comment><USER6> FYI

What are the differences among latent semantic analysis (LSA), latent semantic indexing (LSI), and singular value decomposition (SVD)?

[http://stats.stackexchange.com/questions/4735/what-are- the-d...](http://stats.stackexchange.com/questions/4735/what-are-the- differences-among-latent-semantic-analysis-lsa-latent-semantic-i)

</comment><comment><USER7> Also: "LSA was patented in 1988 (US Patent 4,839,853) by Scott Deerwester, Susan Dumais, George Furnas, Richard Harshman, Thomas Landauer, Karen Lochbaum and Lynn Streeter."

<https://en.wikipedia.org/wiki/Latent_semantic_analysis>

<comment><USER8> So the patent is expired now, right?

</comment></comment><comment><USER9> Also here is a nice paper to get started with LSI : <http://www2.denizyuret.com/ref/berry/berry95using.pdf></comment>


Hillary Clinton claims Russia used machine learning to influence the US election - <AUTHOR> https://www.recode.net/2017/5/31/15722218/hillary-clinton-code-conference-transcript-donald-trump-2016-russia-walt-mossberg-kara-swisher#DmvrJh <comment><USER2> Could have gotten away with it too if it weren't for those meddling learned machines.

</comment><comment><USER3> This person could have been president.. smh

<comment><USER4> Jeb Bush was the insider/large donor favorite on the Republican side. You can't tell me something isn't seriously broken about America's two major political parties.</comment></comment>


John Carmack's Deep Thoughts: Ideas, Work, and Emotion - <AUTHOR> https://www.facebook.com/notes/kent-beck/john-carmacks-deep-thoughts-ideas-work-and-emotion/1051813558184841 <comment><USER2> Is there a video of the lecture somewhere? I love his endless and flawless ramblings about bleeding edge tech!

</comment><comment><USER3> Any chance there's a non-facebook link to this?

<comment><USER4> You don't need an account.</comment></comment>


Make a Donation to the Internet Archive - <AUTHOR> http://archive.org/donate/ <comment><USER2> The Internet Archive is genuinely one of my favorite sites on the Internet. From the vast audio archives[1] to the insurmountable web archive[2], I find myself using it daily.

[1] <http://archive.org/details/GratefulDead>

[2] [http://web.archive.org/web/20070405032412/http://news.ycombi...](http://web.archive.org/web/20070405032412/http://news.ycombinator.com/)

</comment><comment><USER3> Bitcoins sent, my pleasure. Apparently they have received over 560 BTC... very cool.

<comment><USER4> Yep, you can see all the bitcoin donations they have received over here:

[http://blockchain.info/address/17gN64BPHtxi4mEM3qWrxdwhieUvR...](http://blockchain.info/address/17gN64BPHtxi4mEM3qWrxdwhieUvRq8R2r)

</comment></comment><comment><USER5> They also accept Bitcoins :)

</comment><comment><USER6> I've donated 50$ to the Internet Archive under this donation campaign. It's awesome that someone is tripling that - so that the Internet Archive gets 200$ from that.

Whoever is doing that, is awesome.

The Internet Archive does a lot of spiffy things - and it's in my opinion really worth it to support them.

</comment><comment><USER7> Where's Jimmy Wales' face when you need it?

<comment><USER8> So true.

</comment></comment><comment><USER9> Interesting that they dont have a message like "This page brought to you by archive.org Donate here to keep this page alive" on the archived pages.

I dont think people would mind seeing that on the recovered sites. (Unless they do and I cant see it for some reason?)

<comment><USER6> People does not seem to like that kind of Wikipedia donation advertising, if I understood you correctly.

At least in the sense that there's endless parodies and nagging about those ads.

It does however seem to work, since they raise money that way - and continue doing so.

Internet Archive do have a top banner which is quite neutral on most of archive.org (It's the blue ribbon thingie). It's not on the Wayback Machine though.

</comment></comment><comment><USER8> I'm using the Bitcoin option!

</comment><comment><USER10> I donated some money to the Internet Archive last year and was pleasantly surprised when I received two IA-branded caps in the mail some time later (I live in Germany). Very nice gesture.

</comment><comment><USER11> after visiting sf last year i became a donor to the internet archive (for practical purposes) and the long now foundation (for philosophical purposes) with a company match. will be looking into whether i get a company match outside the ordinary 'window' - would be nice to add another multiplier to this matchstravaganza.

</comment><comment><USER12> Sent a few bitcoins their way.

</comment><comment><USER13> 4 peta bytes doesn't seem that much. How long is that going to last them?

<comment><USER6> Not to sound like an ass, but it's going to last them longer than no extra drives from the campaign. So it'll certainly help them along :-)

<comment><USER13> You don't sound like an ass!

I was just wondering why something which is almost universally seen as good (or great, even) is running donation drives to get 4 petabytes. (To bring them to a total of about 14 petabytes.)

(I guess I'm comparing to Megaupload's 25 petabytes - which are still(?) sitting in racks not being used.)

</comment></comment></comment><comment><USER14> When someone is matching your donation, there's no reason not to donate.

<comment><USER15> Not at all. If it's a cause you support then it certainly makes it more compelling, but any reason against donating normally still exists when donations are being matched.

</comment></comment><comment><USER16> Very useful site, however im kind of broke at the moment :)

</comment><comment><USER17> Am a user, but primarily as free storage for live show recordings. It's a great service and should be supported for all they do, but unfortunately I won't be a donor anytime soon.

<comment><USER18> As a user of the site, what is preventing you from chipping in for your usage?

<comment><USER17> It's too bad that I got a -3 for my post- I was just being honest. Thanks for asking.

I upload content, and used to listen to it, but now I don't. Some others have downloaded the content, but it wasn't critical. I don't use the site enough on my own to justify donation. I think it is a great service- really! But, I would bet many feel the same way. Unless it is really helping others that you care about, why donate? It has never significantly helped me personally, or any that I know. I would rather donate to a charity that helps those in need. But I'm glad others donate. It is preserving history. It is just a matter of priority.

</comment></comment></comment><comment><USER19> Am I the only one that finds appeals to donate actually more irritating that adverts?

<comment><USER20> Yeah and those damn pesky charities who have the audacity to ask for donations to help sick children get better or provide clean water and food to families in third world countries... /sarcasm

To answer your question: yes, you are the only one that finds appeals for donations for worthy causes to be irritating. The Internet Archive might not get as much attention as Wikipedia or other donate-able causes, but what they're doing is a very worthy cause and something that will be commended and finally recognised one day in the near distant future. When someone is willing to match a donation 3-1, you can't argue that even the minimum donation of $25 which I am sure most HN users could afford would help them out a lot.

It's attitudes like yours that are the reason sites like Wikipedia have to resort to plastering Jimmy Wales' face over their site and beg for donations to keep the site running. Have some heart, man.

I just donated $50, please consider donating even just $25.

<comment><USER6> I've also donated $50. So - thanks to you and me, IA now has $400!

Also, please keep in mind that the Internet Archive isn't plastering this donation campaign everywhere - and that this is completely user submitted.

They have a blue banner on <http://archive.org> asking for donations on some pages. But they do not for example;

* mail every user that is registered

* add the banner on all wayback machine pages

In other words, they're pretty subtile.</comment></comment></comment>


Apple Keynote video for iPhone5 introduction is live - <AUTHOR> http://www.apple.com/apple-events/september-2012/

<comment><USER2> Ok so just to recap the differences with the iPhone 4S:

-taller screen

-4g lte connection

-better camera

-better earphones

-better graphics

-new connector: no backwards compatiblity

-new software: no jb for a while, apple maps still less reliable than google maps, apple youtube app removed and the new google one can't play videos in the background

-no nfc

<comment><AUTHOR> I think what will make it a success or not is not a list of stats but rather if users like it significantly more than the previous model.

I believe they will.

<comment><USER2> Yes but I can't believe that this is the phone J. spent the last months of his life co-designing. This product has a "more of the same" feel to me, I would call it iPhone4SS actually.

ps.if you prefer android just read the name in a l33t way.

<comment><AUTHOR> Well, the iPod hasn't exactly been completely reinvented over the past decade. The first version is usually the breakthrough, and then it gets refined.

Same with the iPad.

I'm not sure what people were expecting with the iPhone after all this time..

<comment><USER2> nfc maybe?

</comment></comment></comment></comment></comment><comment><USER3> I'm not really impressed with the new phone. It seems like Apple will need to come up with more cool features if they want people to keep buying iphones. I'm not sure if I'm going to get the Galaxy SIII or the iphone 5 at this point. I need a new phone and was expecting to go with the iphone. But, I'm sort of underwhelmed at this point.

<comment><USER4> Out of curiosity, what makes the Galaxy S III more compelling than the iPhone 5? Or, to turn the question around, what is the iPhone 5 missing that makes it so underwhelming?

On paper, the S III has a larger screen, NFC, a _slightly_ higher MP front- facing camera, a barometer, and access to more Google services, like Maps, Play Store and Now (assuming the majority of Galaxy S III owners ever upgrade to Android 4.1).

For me, personally, none of those are remotely compelling. But then I'm heavily tied to Apple's services and love the App Store, so I'm quite biased.

Regarding hardware, aside from new enclosures, I don't expect any major changes in the near term. I doubt they'll add NFC any time soon, if ever. Why bother? The 4S and 5 support Bluetooth 4, which offers many NFC like features, and there's no compelling reason to add explicit NFC support now or anytime soon. Likewise, I bet it'll be a while before induction charging makes an appearance – again, if it ever does. Induction charging just adds bulk and isn't a huge step forward for most users; placing your phone on a charging pad is effectively equivalent to docking it.

The "cool new features" will probably continue coming from software, just as has been happening with Macs. Most Macs are only evolutionary improvements over their predecessors, with the occasional enclosure redesign. That hasn't harmed Mac sales in the least.

<comment><USER5> The problem with Apple's approach is that _all_ innovations in iOS software and hardware have to come from Apple and Apple alone. So it's not enough to just keep releasing incremental and obvious improvements.

In order for Apple to maintain its unprecedented brand recognition and profit margins it's not good enough to match the competition. They have to be unambiguously _better_ than the Android alternatives and they just aren't right now.

<comment><USER4> _In order for Apple to maintain its unprecedented brand recognition and profit margins it's not good enough to match the competition. They have to be unambiguously better than the Android alternatives and they just aren't right now._

I disagree… are Macs unambiguously better than the alternatives? I'd say they aren't, but they still give Apple unprecedented brand recognition and profit margins. Ditto for iPods. For years, Macs and iPods often only saw incremental and obvious improvement.

Innovations don't always need to come from Apple; as is eagerly pointed out here, Apple's quite happy to let others pioneer tech (like, say, NFC) and only adopt it when it makes sense for Apple's product story.

Apple creates a superior story, a superior experience. That's it. Macs, iTunes, iPods, Apple Stores, and iOS devices all play together to offer clear and obvious benefits to consumers. Apple only needs to innovate when nothing currently on the market meets their product goals. Otherwise, they're focused on improving and refining the tech they're already shipping.

<comment> old-gregg Ryan, I disagree. I just got an iPhone 4s. Actually it was given to me for free. It was a major downgrade from Samsung Nexus (naked latest Android), actually it felt like traveling backwards in time. Heck, in many respects it's not even up to the original Nexus One!

iPhone simply feels outdated because it's not as "online" as Androids are. The notion of "syncing" reminds me of my decade-old Nokia, the maps are barely useful (I use google maps via browser instead), the address book, the mail app, the way you use it is just ughh... old school: everything lives on an island which needs to be "synced". You can't even put a music on it without the iTunes, still. And even basic UX is plain wrong in many places, for example why does it keep beeping when receiving SMS messages _while I'm typing_??? Sorry, but this is a phone from 5 years ago. The world has moved on.

<comment><USER4> Interesting perspective and, like I said, one with which I'm not familiar. I've used a few Android devices (basically, I've played with all of the Nexus devices because we have them around for work), but only for a day or so at a time.

Personally, iCloud solves all of my syncing issues; the device is basically always online and all of my data's always up to date without manually syncing. All of my media is in iCloud, so I never need to sync my music, movies or TV shows. Likewise, I can purchase all of that media from the iTunes store on the device. Maps on iOS 6 is hugely improved with an enormous (and potentially disastrous) regression – there are no transit directions. And I've never noticed the beeps from Messages when I'm typing a response… I must have internalized and learned to ignore those. ;-)

I think it may really come down to: I can't use Android because I'm so tied to iCloud/iTunes and some of my favorite apps (Tweetbot and Reeder are probably the big ones) haven't been ported to Android. Also, the lack of polish on Android (even in 4.1) and in all Android apps drives me nuts. Maybe I'm too brainwashed by iOS. Every time I use an Android device, I feel like I've picked up an unusable and barely functional rip-off of iOS.

Likewise, perhaps iOS isn't usable to you because you're so tied to Google's ecosystem, and you're accustomed to Android and Android apps. And because you're used to the way everything works in that universe, iOS feels like the backwards, decrepit OS.

</comment></comment></comment></comment></comment></comment><comment><USER6> Most undersold new thing is finally revamping iTunes.

Hopefully it's actually faster now too.

<comment><USER7> Amen to that! This revamp is long overdue.

Plus, you never know, some rogue developer might have given in and added FLAC support.

</comment></comment><comment><USER8> I used to like watching the keynotes. Mr. Jobs is gone. Without, his salesmanship, the keynotes are not as interesting. That might not be the right word. I actually can not put my finger on it.

<comment><USER9> Jobs had an infectious, natural enthusiasm for his products.

Tim Cook just sounds like he's giving a rehearsed performance, no real emotion. It's fairly dull to watch.

<comment><USER10> For the first 12 minutes, Tim Cook sounds like he's trying really hard to mimic Jobs's style, albeit unsuccessfully.

<comment><USER11> I came here to post exactly that and was wondering if anyone else felt that. I wish Tim Cook would speak in his natural style, whatever that is. On the flip side, other companies' announcements are similarly boring, so that's not saying much.

</comment></comment></comment></comment><comment><USER12> How embarrassing, Apple still requires QuickTime

</comment><comment><USER5> Sure feels like skating to where the puck is already.

<comment><USER13> I think they're skating to where the __profit __is.

<comment><USER5> Apple made its new fortune by being at least one step ahead of everybody else.

</comment></comment></comment><comment><USER14> Quicktime eh? not this man.

</comment><comment><USER15> It's the end of 2012. Use a proper media player, Apple, either Flash or a h.264 one. Just something that actually works in a browser. This is ridiculous. And if you want as many people to actually watch this, you may want to even consider uploading it to Youtube.

<comment><USER16> > Just something that actually works in _a browser_.

Working fine in my browser.

<comment><USER17> What a throwback to the days of "Best viewed in Internet Explorer 5" that held the web back.

</comment></comment></comment><comment><USER18> Anybody know how I can watch it from Linux (Mint - Cinnamon)?

<comment><USER19> Nopal suggests opening this in VLC: [http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd...](http://qthttp.apple.com.edgesuite.net/129opiygabsdvibsdfobsd/sl_vod_mvp.m3u8)

</comment></comment><comment><USER20> 1\. No information about the price of the iPhone 5 (I think they'll ask $650 like the old 4S price -- the 4S is now announced to cost $550).

2\. They say there's a multi-standard radio in each phone but Apple lists three different incompatible models for USA, CDMA, and Germany/Japan carriers.

3\. The iPod Touch upgrade looks really good. It's even more impressive than the iPhone 5 it's based on. (Still no GPS, though)

<comment><USER21> 1\. The prices are on the apple website. They are the same prices as the 4S was.

<comment><USER20> Those prices on the apple site only include carrier subsidized carrier-locked prices. The real prices are not listed anywhere yet.

<comment><USER22> On the .ca site it says:

"From $699"

[http://store.apple.com/ca/browse/home/shop_iphone/family/iph...](http://store.apple.com/ca/browse/home/shop_iphone/family/iphone)

</comment></comment></comment></comment><comment><USER23> My favorite part BY FAR was when Tim Cook introduced the Foo Fighters like they were an Apple product.

Skip to the end if you haven't seen it. Definitely worth it. I couldn't stop laughing.

</comment><comment><USER24> I really dislike the two tone backs on the iPhone. Having gloss and the matte looks pretty terrible. Why couldn't they make the entire back matte like the iPod?

</comment><comment><USER25> Why don't they allow controls on the video?

<comment><USER25> OK, I tested this. No video controls in Safari or Chrome (Mac), but I get them in Firefox. How profoundly stupid that I cannot pause the video in Apple's browser, I have to use Firefox to do that. But the video quality is reduced in that browser.</comment></comment>


Why Are Women Paid Less? - <AUTHOR> http://www.theatlantic.com/business/archive/2012/10/why-are-women-paid-less/263776

<comment><USER2> Related: [http://www.reddit.com/r/MensRights/comments/11lsrw/feminist_...](http://www.reddit.com/r/MensRights/comments/11lsrw/feminist_myth_of_women_earning_072_to_a_mans_1/c6nmfiv)

(If it's correct or not, I do not know)</comment>


Show HN: Breadth First Growth – a newsletter for growing as a developer - <AUTHOR> https://breadthfirstgrowth.com/ <comment><AUTHOR> Creator here: I started this newsletter on growing as a T-shaped developer after I didn't find anything similar online that scratched my itch. I try to do one or two small explorations a week in different areas of tech that I wouldn't normally come across in my day job as a front-end engineer, and I decided to send them out to others too!

I like the metaphor of a T-shaped developer, which is why I mention it on the site. I decided on "Breadth First Growth" as a cute way to convey the focus on growing sideways (and reference the search of course). It's mostly geared towards junior developers and those without a solid CS foundation, so although I might not recommend it for the average HN reader, I've heard good things about it from other junior devs and bootcamp grads. It's been great to make and share!

Happy to answer any questions! You can also check out past projects on our subreddit: [https://www.reddit.com/r/BreadthFirstGrowth/](https://www.reddit.com/r/BreadthFirstGrowth/)

<comment><USER2> I'd love to add your newsletter to my site [http://inboxreads.co](http://inboxreads.co)

You can submit if you like</comment></comment>


Changes to comments on private videos - <AUTHOR> https://support.google.com/youtube/answer/7064178 <comment><AUTHOR> YouTube are disabling comments on private videos, as of 29 August 2016, and removing them from videos uploaded before 16 August 2016.

The reason is that private comments may become public if the video's status itself is changed.

It's among the types of privacy issues I'd forseen on G+ concerning public or private posts. The approach YouTube are taking isn't the only way this could be resolved (comments could, instead, be removed if the video's mode was switched, say), but it's fairly effective, at least for protecting privacy.

It does tend to disable the prospect of private discussion of videos within the context of YouTube itself, though. Which I find interesting.

Privacy is a hard problem.

More discussion at G+:

[https://plus.google.com/+JohnSkeats/posts/8zr1J8pjRem](https://plus.google.com/+JohnSkeats/posts/8zr1J8pjRem)

[https://plus.google.com/+PeggyKTC/posts/AvJHgvfNtRv](https://plus.google.com/+PeggyKTC/posts/AvJHgvfNtRv)</comment>


What are the cheapest ways to live in the Valley? - <AUTHOR>

<comment><USER2> youth hostel on 23rd and Bryant in SF

friend's couch

shack up with an older gay man

<comment><USER2> I don't know much about cheap living down in the valley.

If you are talking SF, there are some other options:

www.sfofficelofts.com - a friend of mine (an artist, not in software) rents one of these for $725 a month. It is a huge loft. The downside - you share a bathroom with everyone else on the floor, like a college dorm. And, the building is conveniently located between a porno theatre and an alley full of meth tweakers.

The usual option is to find a share on craig's list. <http://sfbay.craigslist.org/roo>

</comment></comment><comment><USER3> If you are not a snob Oakland has some great places to live on the bleeding edge of gentrification. I stayed at a friend's place near 17th st, a kind of brownstony place, 800 bucks/month, beautiful kitchen, right on the BART.

<comment><USER4> In the late afternoon, early evening, you can walk down to Oakland Chinatown and get an adequate meal at one of the deli's @ Webster/10th.

Oakland Chinatown is one of those rare places where some of the eateries are open 363 out of the 365 days.

</comment></comment><comment><USER5> <http://zipcar.com>

I haven't tried them out yet but plan to when I move to Cambridge in a few weeks. Seems like a good way to save money if public transportation gets you most places but you still need a car.

</comment><comment><USER6> just to be clear, are we considering Oakland and SF the Valley? might be better to pose the question as cheap ways to live in the bay area. unfortunately there are not many, but places in the eastbay (elcerrito, oakland) can be great.

Also check out places near SF State, shaking up with a student can be a good way to go.

</comment><comment><USER7> A beat up van. Ideally RV-type. You can drive around to fish for free wifi.

</comment><comment><USER8> A sleeping bag on the beach. (Beware of high tide)

<comment><USER9> is there free wireless?

<comment><USER8> Actually, almost. SF is almost finished with a deal for Google to wifi (at no cost) the entire City (and probably the Bay Area eventually), so coding on the beach at no charge will be possible soon.

<comment><USER10> Interesting also to note that GoogleWiFi isn't designed to work in buildings. You might get a weak signal, but chances are you'll have to be outside to get reception. Just fyi, based on my experiences in Mountain View.

<comment><USER11> You can purchase a WiFi modem to boost the signal and have it work inside:

https://wifi.google.com/support/bin/answer.py?answer=44022

</comment></comment></comment></comment></comment><comment><USER12> Bench</comment>