Ask HN: Do you hate iTunes? - <AUTHOR> Hey guys,
Since iTunes is the only option Apple gives us for loading media onto our iPhone, iPad or iPod touch from our Macs, and it limits the audio and video file formats we can upload – I can honestly say that I hate iTunes.
If only Apple made it a bit smoother, and not as big. Right not it's super uncomfortable having a Music store, a music player and iOS device manager all in one app.
Now, I was always wondering if this was just me or do many others hate it as well? <comment><USER3> No. I don't hate iTunes.

It could certainly be better but I wouldn't say I hate it. If they improved the loading speed of iTunes and the App Store it would be fine. It's very similar to the Steam Apps in some regards (store and library in one).

I do hate the fact that ONLY iTunes can be used to move stuff onto an iPhone though. That's the part I hate.

If they broke it up into small parts I'd be so happy though...

tl;dr iTunes is a little worse than meh. I hate the fact that it's the only think we can use.

<comment><USER4> Why aren't there any alternatives ?

I remember fiddling with some tools on Ubuntu to put some music on an iPhone - like, half a decade ago. Is that now blocked somehow ?

<comment><USER5> There are alternatives. Apple has chosen to make it so that the alternatives require not using an iOS device. But there are alternatives.

</comment></comment></comment><comment><USER6> Yes, I dislike the whole iTunes thing all together. I'd like to be able to just plug it in and move files around like it's a drive. (like my android phone) I also really dislike iTunes a media player on my MacBook. Love my mackbook over all, but iTunes as a media player sucks. Main complaints is that I can't just point it to a folder and have it load into a library without it copying files around, so now I have music in two places wasting space. Maybe there is a way I can change that in the settings, but that shouldn't be the default behavior.

<comment><USER7> In iTunes' preferences uncheck "Keep my music organized" And it'll stop copying your music into the Music->iTunes folder.

</comment></comment><comment><USER8> Yes, I hate it so much. I have had many discussions about how great other Apple products are and how frustrating iTunes is. It's like they are made by different companies.

<comment><USER9> They effectively are or seem to be, whether literally via outsourcing work on specific apps, as some commenters here have hinted in the past, or simply as a result of insane internal compartmentalization at Apple. The end result is quite poor in many cases.

</comment></comment><comment><USER10> Well, I just get annoyed because it keeps saying there isn't enough space to sync when there's plenty, and I have to spend 3 hours wiping and rebuilding the entire contents of the device every time I want to sync.

</comment><comment><USER11> I mean, who doesn't? Sometimes if I accidentally hit a media key, it opens iTunes, which is slow as hell and I usually force-quit before it can fully load because it takes so long. When I do have to deal with iTunes, it's always this lumbering beast that I want to exit as soon as possible.

</comment><comment><USER12> YESSS!!! I hate iTunes, as well as the general idea of hiding the filesystem on mobile device from the user.

</comment><comment><USER13> The way to approach iTunes is what is its functionality, the pros and cons of its actions, and whether it accomplishes it well.

Functionality-wise, it works. People should remember the days of when devices would be USB'ed into a computer and not work. I can hook up an iPhone, an iPod touch, and iPod shuffle and the system instantly recognizes them, checks them for any discrepancies between the two and will allow me to sync and backup. I cannot say the same for my Windows Phone 8.1 which getting to a mass storage state requires planetary alignments and a passing comet (Microsoft, please fix this!).

Pros:

-Your device is recognized, has a graphic showing you the device and provides you with great information on the contents of the device. You can also make changes and back up individual game state files in the iTunes.

-Backups and restores are simple.

-You can transfer photos from the file system to your hard drive outside of iTunes.

-You can keep track of authorized and non-authorized devices on your own computer without having to go through a web portal.

Cons:

-iTunes is constantly changing the user interface between versions and makes it a learning curve period of about four tries before learning where the buttons are and the path to accomplishing tasks. All of this done without any easy to follow instructions.

-The first install of iTunes on a new system is great, however, each additional update places a small unnoticeable mess on my computer (in terms of start up time and interaction), by the time I am on the tenth version update, I am questioning the usefulness of the program.

-Music transfer between devices and ripping from CD's has a steep Choose Your Own Adventure feeling to it. Ripping a CD meant you had to choose between the AAC and MP3 format, while you can change these later, it is a pain. Transfer between devices has a prompt on whether you own the music. Compare this transfer within the Android or Windows Phone mass storage method and it is simply a drag and drop in the explorer file system.

Summary: iTunes creates a walled off system, but accepting it is much better than the messes that were preceding it.

</comment><comment><USER14> Tbh, when I bought my iPad and you didn't need to register it via iTunes I was relieved. For 3 years I didn't connect it to the computer so it never touched iTunes - this is how much I hate iTunes.

\+ I am always afraid that if you sync with iTunes (yeah, soooo 2007) that I am going to lose something somewhere, a file, a tune, image or - for sure - <USER2> PDF in iBooks.

I've had so many things "lost" that way. Without warning, or a summary or an opportunity to make my decision.

iTunes sucks, big time.

<comment><USER15> And yet if you don't, you risk losing purchases when Apple loses the distribution rights to something. The little cloud download button gives people a false sense of security, but I've lost a lot of music and TV shows by not keeping backups on my hard drive. Apple really pushes this feature, but when you get stung by a removal, iTunes support will say "what, didn't you read the fine print?"

<comment><USER14> Didn't know about that. Thanks for telling me.

It still sucks though.

</comment></comment></comment><comment><USER16> Jein. (Thats a very german cross between yes and no)

iTunes has a fast search through my large library and it is very easy to reach the thing you want. I don't create playlists, but from time to time return to my player, search for something and hit "play", closing the window afterwards.

iTunes is not perfect at that, but _every other player_ is worse. Either, closing the window kill the program (lackluster Linux/Win-Ports), the search is slow or just not very central the interface. For example, VOX wants me to search for a song and then hit "Enter" twice before playing it, with a fancy, but slow animation. Searching for albums is even slower, I'd prefer if they just presented me with album matches immediately.

So, the outcome of my eternal search is: iTunes is not a great music player, but every other on OS X is worse.

<comment><USER17> i think you're missing the key argument which is that playing music is just one of the many things iTunes does. Those of us who dislike it rarely hate it as much for its music playing as for the fact that it's a file transfer app (to get files into and out of ios apps), it's a iOS backup and sync manager, it's an OS updater, its a store, it's a music player, and probably 3 other things i've forgotten.

<comment><USER16> I'm not missing it, I'm ignoring it. I'd be fully okay with iTunes dropping all that stuff or using something different - if there were another alternative.

</comment></comment></comment><comment><USER18> The UI is really, really bad. Every time I sync one of my devices I have to search for the widget that gets me to the place where I can search for my content. The software makes arbitrary decisions on what type of content goes where, and honestly this shouldn't matter.

Music is music, a book is a book, an app is an app. Just provide a default structure and have the device figure out what's what -- we've been doing this with file systems for decades.

iTunes doesn't scale. A linear list of all of my music? Those books? Doesn't scale. Ordering a list by title / artist is clumsy after fifty entries, and unworkable past a few hundred.

I'm really surprised that Jobs didn't rip the iTunes team a new one. Or maybe he did, and this is the best they could do.

<comment><USER19> Agreed. The UI is horrible and getting worse with every release. What used to be a decent interface for digging through Genre -> Artists -> Albums is now hidden behind super kludgey nonsense. To get a fresh install of iTunes into a usable state with a music library of any reasonable size is a huge pain.

The idea that the default interface should basically just be a window with big album art is probably the worst thing they ever did.

</comment></comment><comment><USER20> I really like it. Easy sync with iOS. Not only music, but also contacts, calendar, all that jazz. Even though I use Firefox for browsing on OS X, I still find it handy to use safari for browsing where I left from iOS. Transcoding from FLAC to ALAC is easy and fast with XLD[1]. There's the nice visualizer from SoundSpectrum called WhiteCap[2] (free version is included). Organization is simple.

[1][http://www.macupdate.com/app/mac/23430/x-lossless- decoder](http://www.macupdate.com/app/mac/23430/x-lossless-decoder) [2][https://www.soundspectrum.com/whitecap/](https://www.soundspectrum.com/whitecap/)

</comment><comment><USER21> I can't say that I hate it but I don't really like iTunes. The problem for me is it is too slow, has too much features and always come out with annoying popups such as "iPad contains diagnostic information...", "A new iPhone software version... " and "Sign into the iTunes store". I quit using it as a music player some months ago: now I use mpd (music player daemon) with ncmpcpp (a client) and iTunes to only sync/backup my iPad. mpd is great for me: you control it with the client you like, it loads his music database from a directory, you make playlists and just listen.

</comment><comment><USER22> The whole interface is incredible unintuitive. Especially if you come from Windows.

</comment><comment><USER23> Can't say I hate it, I just had a bad experience with it yesterday. I wanted to buy an album, that's only on sale on iTunes. The following happened:

        I could not buy it on the web - I have to download the program!
        The .exe I was given did not work on my PC - I needed the 64bit one, which was hidden in some support article
        In the setup I selected English, but the program launched in Spanish instead
        The program froze when I changed the language
        Nowhere could I see what format/quality the music would be

I did not end up buying that album.

</comment><comment><USER24> On my Mac, I have no problem with it. Yes, it's a bit bloated because it does too many things, but I don't feel limited by it. Other than FLAC files, which I have a converter for, it plays everything I deal with regularly.

On my Win 7 32-bit PC, it's a steaming pile of something you don't want to step in. It crashes on startup. It crashes when playing music. It crashes when accessing the iTunes store. It even crashes when it's just sitting there doing nothing.

If Apple wants to streamline it I hope they start with the Windows version first, but that's only my opinion.

</comment><comment><USER25> I used to love iTunes back in the 10.3/10.4 days, but now it just feels too bloated to me. It seems like Apple has tried to do too much with the program over the years and now is the quintessential jack of all trades, master of none. The entire iTunes/App store experience is really confusing to me. For example, I tried to rent Snowpiercer before it was out on Netflix, and the process was painstakingly long and confusing. Having to wait to download the entire HD movie before being able to view it didn't help anything either...

</comment><comment><USER26> I actually like iTunes - I havnt been able to do what I want from a music player and would be happy to hear of suggestions!

I need ALAC (can be converted if necessary), AIFF, FLAC

I need syncing (eg if I change stars (1-5) on the device, it needs to sync to master)

Need to be able to listen to and rate from either mac, PC or a mobile device

Scenario: I have my songs on my ipod and take it to work, and listen and rate songs while I'm at work. I sync, then take it home, and it syncs with my home library on my mac.

Or I listen while I am out and about and rate songs.

</comment><comment><USER27> Using itunes makes me sad. I wouldn't say it was a terrible product but it has way too many features all of them at a mediocre level, which amounts to a poor user experience

</comment><comment><USER28> I always hated how stupid it makes adding a few songs to an existing device. Half the time it wants to re-sync everything and wipe the device while doing it.

Avoid iTunes with extreme prejudice.

<comment><USER4> Maybe I'm a cynic but that could be the point ?

Make it too cumbersome for your users to put an mp3 from their pc on their iPhone and they might just buy the song again from iTunes ?

<comment><USER29> No, just ill-informed. You can re-download your purchases (which are DRM free) from the iTunes store on to your device. There is absolutely no need to use iTunes to manage an iOS based device. Not for registration, backing up or adding media.

</comment></comment></comment><comment><USER30> It was so bad when i got my first iPod nano (2009) that I quickly actually gave up on using my iPod. It was such a faff getting music on it (using a windows based laptop) that I stopped changing my music and soon I lost interest in my iPod all together (couldn't be bothered to change the music). Later on, I've started using spotify on my android phone and it fully replaced my need of iTunes/apple products (iPod).

</comment><comment><USER31> I find it works really well for listening to music in album format and getting more albums from the iTunes store. The store integration is well done and I love the (newish) UI that reacts to the colors of the album artwork. For listening to music that is not in album format and/or which you didn't purchase via iTunes and for any other tasks they have bolted on, such as device management, I find it not so great.

</comment><comment><USER32> I only use iTunes to play mp3s on my machine and manually sync mp3s on my phone. It also does backups of the phone.

With that use case in mind, I'm very satisfied.

However, I stay away from videos, apps, sync or whatever else they shoved into this app. I don't have a compelling reason to use these features because they're either accessible through the iOS devices directly or iCloud (when it works).

</comment><comment><USER33> Yes.

On Windows at least there are some iTunes alternatives for loading stuff onto iDevices. You'll have to google around for them, but the couple I tried on my niece's iPhone worked fine.

I don't iDevice on my rMBP, and I think I accidentally launched iTunes once before I remembered to install VLC. Other than that, I simply pretend like it doesn't exist.

(being Android all around makes life super easy)

</comment><comment><USER34> Nope. Every piece of software has its limitations. I learned to use it, accept its limitations, and moved on with my life. I have better things to do than wrestle with a software application or expend time and energy actively disliking it. It will not change, but is necessary for daily use. I got over it.

</comment><comment><USER35> I cannot tell you just how much I fucking loathe iTunes.

The Windows version is bad, but I hate the OSX version about as much.

I'd be fine with iTunes if Apple gave me an opt out. Even if it had a big sign saying "after this you're on your own; you get absolutely no support from us for anything if you use this opt out".

</comment><comment><USER36> My favorite part is how it skips at random to arbitrary points of other episodes when playing Podcasts.

</comment><comment><USER37> I always do this after my Mac updates iTunes.

        $ sudo chmod -x /Applications/iTunes.app/Contents/MacOS/*

That keeps it from launching accidentally. I never launch it intentionally, in fact, I've never accepted its license agreement.

</comment><comment><USER38> Absolutely. I never actually use it on the laptop. (I never got the point of these music players that to organize all your music; I prefer to have it lying around on my file system as just plain files).

I used to be on iPhone and I absolutely loathed iTunes.

</comment><comment><USER9> I don't hate iTunes, but it's 2015 and Apple is still blocking the main thread all over the place. And displaying internal error numbers to users, with Google serving as their error to string conversion function.

</comment><comment><USER39> Yes. I have to do a thing on OS X on every new Mac to stop iTunes loading when I do random things. And 'syncing' is a little 2007.

On my iPad I have to go into 'iTunes Store' to buy books for iBooks. Which is bizarre.

</comment><comment><USER40> I don't know if there are design choices I'm not thinking of, but my big gripe is that if I am streaming from my mac to an airplay enabled TV, and I click a link to the app store in my browser, my TV pauses.

</comment><comment><USER41> Maybe if it didn't run like it had two broken legs I wouldn't hate it.

</comment><comment><USER42> Ugh. This post jumped to 40 points in 3 hours, and now has been pushed from the front page to page 4, rank #108.

It's really annoying and heavy-handed when HN shuts down and effectively censors conversation like this.

</comment><comment><USER43> I don't hate it, but I don't like it enough to use it. Any apps I download I do from the App Store from my iPhone, and for music I use Spotify almost exclusively.

<comment><USER44> My Spotify Premium subscription is worth it just for the fact that I haven't had to touch iTunes in months.

</comment></comment><comment><USER45> No. No linux support. I got an ipad as a gift and to use it is a mess. Spotify can work, but the fact that you need Itunes to pass items to the ipad annoys me as hell.

</comment><comment><USER46> Yes. Lately, as a replacement, I've been using VOX[0] and it's a pretty sleek player.

[0] : [http://coppertino.com](http://coppertino.com)

</comment><comment><USER47> I don't like it. It's heavy and bloated for what I would ever need it to do (put music onto my ipod). In fact, I have it installed solely for that purpose.

</comment><comment><USER48> yep hate it! one of the worst user experiences found in any app. Cant imagine how Apple UX designers ever figured that this would be a good design.

</comment><comment><USER49> It's gotten worse over the years but it's most certainly better than any of the alternatives I've been obliged to use on linux.

</comment><comment><USER50> I used to be pretty happy with it but it seems to get progressively worse. These days I can never find anything in the UI so I just avoid it.

</comment><comment><USER51> I feel like the odd one out. I am happy with iTunes. I like the way it presents my library and the store. I find it reliable and easy to use.

</comment><comment><USER52> Yes!! I hate it so much, it's the worst UI experience ever and I've used a lot of bad UIs over the last 35 years.

</comment><comment><USER15> I loved iTunes up until version 12. It is now a bafflingly user hostile piece of software and I am done with it.

</comment><comment><USER53> I disliked iTunes so much I just avoided all Apple products and removed all Apple software from my life.

Never looked back.

</comment><comment><USER54> Yes, I clicked on iTunes store today and could not find the 'App Store' anywhere.

</comment><comment><USER55> I don't hate the concept or utility of iTunes. I just hate the business model of not being able to port/copy/relocate my downloaded files that I bought to other devices. So my personal preference is to stick to DRM free platforms like Amazon and Google.

</comment><comment><USER56> I hate iTunes. I am much happier with Google Play for iOS and Android.

</comment><comment><USER57> I don't hate it, but it's not great either.

</comment><comment><USER58> iTunes for Windows is the WORST! I moved away from iPhones (a while ago) because of this crapware (they would not sync over the air then)

</comment><comment><USER59> Yes. It has become a horrible twisted mess.

</comment><comment><USER60> I thought iTunes sucked on Windows only.

<comment><AUTHOR> Mac users have to go through iTunes sync just as Windows users :) So, it sucks on Mac but just not as slow as it is on Win.

</comment></comment><comment><USER61> Yes, almost as much as I hate iPhoto.

</comment><comment><USER62> Hate it with a passion since 2001.

</comment><comment><USER63> Yes

</comment><comment><USER64> Yes. Hate it

</comment><comment><USER65> I hate it.

</comment><comment><USER66> yes

</comment><comment><USER67> I don't hate it. Other than testing on it and using it for work, I am completely independent of Apple's walled garden.

I use tablets that run a full operating system that I have full control over (not Android or iOS) and the only semi-limited system that I use is my Android phone.</comment>


Boosting the smart asset lightning network, OmniBOLT testnet is online - <AUTHOR> https://github.com/omnilaboratory/obd <comment><AUTHOR> Blockchain industry requires a much more flexible, extensible and cheaper smart assets circulation solution to solve the main chain scalability problem. Lightning network is a solid technology to this problem, but currently only BTC(and some of its forks) is supported. Lack of the support of smart assets limits the creativity of upper layer applications.

We propose OmniBOLT, the smart asset lightning network, to widen the perspective of the original BTC-only lightning theory and technology. OBD is the golang implementation, an open source, off-chain decentralized platform, build upon BTC/OmniLayer network, implements basic HTLC payment, atomic swap of multi-currencies, and more off-chain contracts on the network of smart assets enabled lightning channels.

</comment><comment><AUTHOR> The spec repo for further understanding is: [https://github.com/omnilaboratory/OmniBOLT- spec](https://github.com/omnilaboratory/OmniBOLT-spec)</comment>


Running .NET apps in Docker containers - <AUTHOR> http://friism.com/running-net-apps-on-docker <comment><USER2> I experimented wih docker a few month ago and made a docker image for the .NET kooboo CMS running on monofastcgi/nginx as an exercise. Here's the link if someone is interested: [https://github.com/guillaume86/KoobooCMS](https://github.com/guillaume86/KoobooCMS)

</comment><comment><USER3> VirtualBox, Docker and Mono ... at one point you have to ask yourself isn't it too much virtualization ?

<comment><USER4> VirtualBox: the author is using a Windows machine so needs to run Linux in order to experiment with Docker.

Docker: well, this is the subject of the post.

Mono: Mono is an application runtime (specifically an open-source implementation of the CLR) just like the JVM (yes, a 'Virtual Machine' but not virtualization, I would argue, in the sense that you are stating there is too much of).

Obviously if you had .Net apps and a Windows server environment you would just deploy .Net apps to it. But there might be scenarios in which this is useful. Perhaps migrating away from Windows servers to Linux, but not wanting to rewrite the C#/.Net apps in a new platform. Although whether Mono would be able to run those apps satisfactorily (the coverage of the SDK is not complete) is of course up for debate.

<comment><USER5> The answer to your latter question is: no. Only pretty trivial stuff is portable to Mono. I've tried it on every project I've worked on over the last 6 years to no avail. Show stopper every time.

<comment><USER6> This is nonsense. You just have to dev with Mono in mind from the start. Basically, don't use WPF and WCF and you're all set.

I'm currently in a web app team with a C# backend. Two devs run Windows, one has a Mac, and one runs Ubuntu. It works great. And yes, we deploy to Linux using Docker.

<comment><USER7> > You just have to dev with Mono in mind from the start.

then it cannot replace .net .You can put it every ways you want serious C# and .net development is windows only.

Mono doesnt run every C# library out there.

The people pushing mono here dont have to face the consequences of that choice.

It's easy for them to say "it just works", they wont be around when one realises it doesnt work. Dont use mono thinking it really works.It's an experiment.

</comment></comment></comment></comment></comment><comment><USER8> After some careful thought, I can't see a place anymore for virtualization in a development workflow. If your hosting provider uses it, sure, whatever, but ideally you shouldn't be using it in development or working your production environment around it.

Code should be written portably, it should depend on the language runtime, vendored libraries and nothing else. Finicky OS/language combos should be avoided, like Ruby on Windows. If you have to use virtualization to ensure that your dev/prod environments are the same, then that's a code smell. It should work the same on Ruby 2.1.0 on OSX in rbenv as it does on Ubuntu using the 2.1.0 BrightBox PPA install.

The most important thing about 12 factor, in my opinion, is the separation of code and configuration. Everything that varies between environments and deploys should be considered configuration and off-loaded to a configuration management system. The VagrantFile embeds configuration directly into your code and makes your application less portable, not more.

Configuration management should provide encapsulation at the level of a particular version of an operating system. You should be able to, by only changing your CM scripts, change your OS between different versions of Ubuntu, or even between Ubuntu and Red Hat. If you can't, that's a code smell.

Your hosting provider should also be abstracted over and encapsulated as well. Changing hosting providers from Linode to Amazon should not require changing your OS scripts.

All of this can and should be done without Big Design Up Front, it should not take you any longer to do this than to configure your app to support Docker.

What this buys you is real robustness. Virtualization to me is a crutch that protects lazy programmers, it's fixing the wrong problem. If you find yourself relying on snapshots, it's a code smell and it will come back to bite you in the ass.

If you think Docker is going to solve all your portability woes, you'll be in for a shock the first time your OS stops being supported by the vendor and you have to move to a new one. If you've done it the way I've described, then you can copy your CM script for the old OS to the new OS, try a cold deploy, and fix the small number of issues that will come up.

If not, then you'll be in for a long weekend. Or worse, you won't do it at all, like the last five guys that came before me at my job.

<comment><USER7> > The most important thing about 12 factor, in my opinion, is the separation > of code and configuration.

Nothing to do with configuration. Sometimes you need an envirronment where components of that env are not available on your system. For instance redis or nginx used to be linux only.

Also it's easier to pass around images in a team,than installing manually every components or libraries one needs. No time is lost in setting up and configuring this or that.

Further more virtualisation == 0 consequences on your machine.You can screw up stuff and experiment without worrying about doing something wrong,it doesnt matter.

So no side-effects,no configuration,os independent,easy to share images => better development env. You dont have to use docker ,i dont, but cirtualisation really helps.

<comment><USER8> > Also it's easier to pass around images in a team,than installing manually > every components or libraries one needs.

You're right, Bundler in Ruby seems to have spoiled the hell out of me. I don't think nginx belongs in your development environment. If something's not available for your system, virtualization can be used effectively, if you run one machine per service you're depending on, as it would be done in production. Or architecture your app so that you can use dummy services in development. With thin interfaces and continuous integration this shouldn't introduce any problems.

But really, you should be picking mature services to depend on. One of the signs of a mature software project is that it is available for multiple environments and the configuration remains mostly similar. External service configuration should be considered code and committed to your repo. All that's in your project config should be where the service is at and what port it's running on. You could make the argument that depending on something that's not available for all the development environments you're working with is a smell.

> Further more virtualisation == 0 consequences on your machine.

Personally, I treat my development machine as "crash-only software". If something goes wrong with it, I'll wipe it, re-install it, then git pull and bundle install. All important files are kept elsewhere and my development workflow is streamlined enough so that I can reinstall everything pretty quickly. All of my tools are in my dock. Chrome, Sublime, Sequel Pro, iTerm, and an SSH Tunnel Manager, the latter I consider an ugly hack and am working to get rid of. Service dependencies are painless to install with Homebrew.

<comment><USER9> >Personally, I treat my development machine as "crash-only software". If something goes wrong with it, I'll wipe it, re-install it, then git pull and bundle install. All important files are kept elsewhere and my development workflow is streamlined enough so that I can reinstall everything pretty quickly.

Hmm, you seem to basically be describing Vagrant, but with the added complexity of resetting the rest of your computer as well.

<comment><USER8> Do you install and run Chrome, Sublime Text and the like on Vagrant? I've never actually had to do that, because I don't think you should need to, these software packages shouldn't mess up your system, if they are then you're doing something wrong.</comment></comment></comment></comment></comment>


Julian Assange got engaged, had two kids while in Ecuadorian embassy - <AUTHOR> https://www.abc.net.au/news/2020-04-12/wikilieaks-julian-assange-got-engaged-has-two-kids/12143430 <comment><USER2> Life, .. uh .., finds a way.

</comment><comment><USER3> They should display Julian when googling "Follow Your Heart"

<comment><USER4> but google result is Vegetarian food company

</comment></comment><comment><USER5> Good for him. It is none, of my business.

</comment><comment><USER6> If he wasn't being held in a high-security prison he'd be shrugging at the covid19 lockdown as eh, whatever.</comment>


Show HN: Simple Web Bookmarking on One Big Page - <AUTHOR> https://linkzie.com My blog post about this Show HN submission:  http://peterlyons.com/problog/2011/03/show-hn-my-bookmarking-app/ <comment><USER2> I actually had thought of this exact same idea about a year ago. Mainly as a way to learn jquery and because i look at a lot of web pages during the day and traditional bookmarking really doesnt work for me. I started adding alot of ideas onto it though and ended up dropping eventually. Are you pleanning on developing it further? Oh i was even going to use a very similiar name. :-)

<comment><AUTHOR> I'm at the point now of showing it to folks, getting user feedback, and deciding what to do with it based on the user response. If I get some users, I'll continue to enhance it.

</comment></comment><comment><USER3> Great startpage I'm trying it out. You should make the whole line clickable rather than just the text. Also I couldn't find any import option - for a service whose main selling point is having many links visible at once it would be an advantage to not have to enter them all manually. Actually this would be a great view of my delicious (or similar) bookmarks grouped by tags.

<comment><AUTHOR> Thanks for the input. Definitely making the whole line clickable is easy to do and I've thought about it before. No import yet, I know. I debated whether to build import before or after posting and ended up going to feedback as early as possible. Definitely if people like it import from browser bookmarks and delicious is the #1 next feature on the queue.

</comment></comment><comment><AUTHOR> My blog post with further introductory material: [http://peterlyons.com/problog/2011/03/show-hn-my- bookmarking...](http://peterlyons.com/problog/2011/03/show-hn-my-bookmarking- app/)

</comment><comment><USER4> I really like the simplicity here. It solves a big problem without too much overhead.

One minor thought: You might consider adding a quick intro video so newcomers can see how to operate the site.

</comment><comment><USER5> I really like this. Any plans for an API so I can pull my data onto my own interfaces/webpages?

<comment><AUTHOR> Probably not in the short term, but export to JSON is something I could easily do. I'm curious exactly where you would plan to embed your data and for what purposes.

<comment><USER6> I'd imagine putting an always up-to-date links box on your personal site/blog would be the main use.

</comment></comment></comment><comment><USER7> Seems to be down?

<comment><AUTHOR> Looks up for me now. I have it monitored by monit and didn't get any messages. Not sure why it wasn't working for you, but it is up as of now.</comment></comment>


BBS and Usenet era Textfiles - <AUTHOR> http://textfiles.com/ <comment><USER2> [https://news.ycombinator.com/item?id=22995008](https://news.ycombinator.com/item?id=22995008)

Please search before submitting. Reposts are ok after a year or so, but this was a huge thread just two months ago. You can use "comments>N" and "points>N" to narrow down:

[https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=textfiles.com%20comments%3E0%20points%3E3&sort=byDate&type=story)

<comment><AUTHOR> Oh hey, extremely sorry, new user here. Also, thanks for the tip!

</comment></comment><comment><USER3> Also see:

[http://telehack.com/](http://telehack.com/)

 _" Telehack is a simulation of a stylized arpanet/usenet, circa 1985-1990. It is a full multi-user simulation, including 25,000 hosts and BBS's from the early net, thousands of files from the era, a collection of adventure and IF games, a working BASIC interpreter with a library of programs to run, simulated historical users, and more._

 _" You can telnet directly to Telehack on the regular telnet port of 23._

 _" Open a command shell and type_

      telnet telehack.com

_" See [http://telehack.com/telehack.html](http://telehack.com/telehack.html) for more information."_

<comment><USER4> came to the thread to encourage everyone to experience them this way. it's so immersive and really makes you feel like you've time machine-d into dialup era (or older!)

</comment></comment><comment><USER5> Ok, wtf. Clicking around randomly, I came across:

[http://textfiles.com/sf/bane_of_](http://textfiles.com/sf/bane_of_)

Which I presume is some kind of speculation on "Episode 3" of star wars. I have no clue when this was written, but given the context, I'm assuming it's 80s-90s era, but it's shocking how much it resembles the prequels! Young Anakin being force sensitive, Yoda being apprehensive about teaching him, Kenobi deciding to teach him anyway, lava-side duel, corrupt senator taking advantage.

If this is really a vintage text, it's really amazing how close they got!

<comment><USER6> Well "they" could in fact be George Lucas, who is an active ham and has been for decades, which makes us suspect he was also using the Internet too.

</comment></comment><comment><USER7> Oh this brings back memories. I was browsing around this site and came to a section that gives the complete, start-to-finish set of instructions to beat The Black Cauldron. I can't tell you how many hours I spent on that wonderful game. Looking back, I don't even remember if I completed it. Just reading through, I remember various screens being described: [http://textfiles.com/games/blackc.txt](http://textfiles.com/games/blackc.txt)

</comment><comment><USER8> Found many old lists of BBS's. Listed was a BBS I would dial up years ago.....

Fond memories.

</comment><comment><USER9> A bit surprised that you cannot download the whole bunch of textfiles on a single tgz.</comment>


Nexus 7 Selling Out, Dousing Kindle Fire - <AUTHOR> http://news.yahoo.com/nexus-7-selling-dousing-kindle-fire-214500144.html <comment><USER2> 1\. Whether a product sells out or not means very little. It could be really popular. It could be bad sales forecasting.

2\. The Nexus 7 is only reducing number of Kindle Fires from 14 to 12 million. Not that huge of an impact.</comment>


Show HN: AsOne – Platform for Crowdsourcing Research - <AUTHOR> https://asone.ai <comment><AUTHOR> AsOne is a platform for crowdsourcing research where anyone can create and join research communities. We allow all research topics, from COVID-19 to your own personal research.

Our mission is to help solve humanity's hardest problems by creating a world where research is openly accessible and massively collaborative.

Topics on our site are organized into a tree, so for example the _P versus NP_ topic is a child of the _Computational Complexity topic_ , which is a child of the _Computer Science_ topic. Even specific attacks on P versus NP, such as by Vinay Deolalikar can have their own page under the P versus NP page.

We aim to fulfill Timothy Gowers' ultimate vision of the Polymath Projects. We recently became the official host of the Polymath Wiki [1]. I have been in correspondence with Terence Tao, who has an account on the main site (under the username teorth) and has been giving us design feedback.

We are currently a small team of 3, and are looking for people who can help in any way! If you're interested in the project, please join our development process at Discord [2] or email me at email@example.com

[1] [https://asone.ai/polymath/index.php?title=Main_Page](https://asone.ai/polymath/index.php?title=Main_Page)

[2] [https://discord.gg/7K5z6d4](https://discord.gg/7K5z6d4)</comment>


Hulu sued for patent infringement - <AUTHOR> http://www.bgr.com/2011/07/29/hulu-sued-for-patent-infringement/

<comment><AUTHOR> Bah, missed that the story was essentially ripped off from: [http://www.reuters.com/article/2011/07/29/us-hulu-lawsuit- id...](http://www.reuters.com/article/2011/07/29/us-hulu-lawsuit- idUSTRE76S4TV20110729)

<comment><USER2> Can't you edit the link?</comment></comment>


Flickr: Invitations disclosure (resend feature) - <AUTHOR> https://hackerone.com/reports/1533 <comment><USER2> Hey, HN, CISO of Yahoo here, typing on a phone at a kid's birthday, so excuse the formatting.

We run a very progressive bug bounty program that allows bugs like this to be posted publicly. Every once in a while we might miss something out of the thousands of invalid reports we receive every month, and we made a mistake in the triage of this bug. The bug is fixed and we won't make the same mistake again. We definitely consider info disclosure to be a class of issue that needs to be addressed and to infer otherwise from one mistake is incorrect.

There are a handful of companies experimenting with this kind of open bounty model, and if we want it to survive (I certainly do) then we are going to all have to be willing to iterate to fix the problem, and move on.

<comment><USER3> That's great, but you were aware of this issue for a month. If the whole point of having a bug bounty program is that you benefit from the distributed intelligence of the community you should perhaps place a bit more faith in your unpaid and unrewarded labor. Do you really receive thousands of invalid security reports every month or is user Schofield way out of their depth.

Why should another dev ever bother submitting a security issue to Yahoo if they have to deal with such obstinate silliness?

<comment><USER4> > Do you really receive thousands of invalid security reports every month or > is user Schofield way out of their depth.

Although our project is much smaller, we also run a bounty program through HackerOne, and publish aggregate results every month. You can see them under the "Security" headers of the changelog for the last few months to get a quick sense of the overall composition of reports that come through a channel like this, at least for our project:

[http://phabricator.org/changelog/](http://phabricator.org/changelog/)

For example, last month we received 49 reports, of which we believe 5 were legitimate security issues which we fixed and awarded. Although the signal on this channel is extremely valuable, it's embedded in a lot of noise, and separating the two is often difficult and time consuming. It wouldn't surprise me if we made mistakes with a few reports even at this relatively small scale, and we have a much easier task than larger projects do.

I'm extremely supportive of HackerOne, but I'm always a little worried we'll make a mistake and end up tried in the court of public opinion when we triaged >99% of the reports correctly and the overall impact of the program is hugely beneficial for researchers, for us, and for our users.

Of course, we should be aiming for 100%, and getting it right almost all the time isn't a free pass for the cases when things go wrong, but seeing just the cases where an issue wasn't handled correctly discards a lot of context.

<comment><USER5> To echo this sentiment: In 2013 facebook received 14,763 submissions which lead to 687 paid issues, 1 : 21 signal to noise. Facebook errs on the side of paying out as often as possible even for lame bugs (apache shows its version number in some talent acquisitions blog), code we didn't write, defense in depth type stuff, instances where the reporter was wrong and there wasn't actually a bug but in the process of investigating the non-bug we happened to find a bug on our own etc. Given all that, I would (personal opinion) put the number of useful, impactful security issues we received in 2013 at about 70. If we use this guide its 1 : 211 signal to noise. In this sea of noise the reports submitted are often in other languages or submitted by less clueful people. This yahoo example the reporter explained the issue pretty well but in my experience this is a rarity. A legit issue could come from anyone though, even the guy who writes a sentence of Polish and sends you a 30sec youtube video in 320x480.

Basically doing a bug bounty right is very hard.

Stuff like this will happen. By running a bug bounty at all you are opening your company up to situations like this but the bigger picture is that you care about security enough to still do it for the valid security issues bug bounties find. It is a strong signal to me that a company actually cares about security and we shouldn't lose focus of that in the midst of pitchfork-waving "but yahoo was WRONG".

We recently released some stats that support all this here: [https://www.facebook.com/notes/facebook-bug-bounty/bug- bount...](https://www.facebook.com/notes/facebook-bug-bounty/bug-bounty- highlights-and-updates/818902394790655)

<comment><USER2> Thank you for your data. I'm hoping to do a talk this fall with detailed stats after we have a whole year on this platform, but to a first order approximation your ratios do not look far off from our experience.

</comment></comment></comment></comment></comment><comment><USER6> I love how publicly posting bugs shifts the balance of power. "schofield" probably though it was just a conversation between Yahoo and the submitter. Now it's a conversation between Yahoo and Hacker News.

Welp, the verdict is schofield is being dense. Of course user relationship pairs are potentially sensitive. Therefore enabling attackers to discover them by enumerating your tiny key space is an issue.

Either schofield needs to wisen up or Yahoo needs to put someone better in charge of their security issues.

<comment><USER7> Companies need to send out an email to all employees every morning reminding them of the most basic law of corporate communications:

"When you speak to a customer, reporter, friend, or any other person not employed by $Company about $Company-related matters, you are acting as a public representative of $Company.

Regardless of whom you speak to or in what context, you must assume your words will be repeated to the entire world as $Company policy.

Your words will be read/heard and interpreted by people of every conceivable level of intelligence and education, in every conceivable cultural context. Even people who have never heard of $Company before and know absolutely nothing about $Company or the matters you are discussing will form opinions based on your words.

People more intelligent, better educated, and more experienced than you in the matters you are speaking about will also read and interpret your words. Then they will speak publicly about them, and further influence others' opinions of $Company.

There are no exceptions."

<comment><USER8> Also, maybe my time zones are wrong, but it seems like the engineer changed the bug status to "disclosed" late in the day Friday?

A corollary: Don't do sh*t late Friday that will fester over the weekend.

It makes me mental when people want to "close their week" by deploying a change to a public-facing system. Yes it feels great to check it off your list and start your weekend. But unless you're prepared to deal with it over the weekend -- and got buy-in from the rest of your team they're prepared to deal with it -- please don't.

<comment><USER9> I run ops at my current ship, and my counterpart is our lead developer.

I'm not sure how it works elsewhere, but together we have a very strict "We DO NOT deploy production changes on Friday". New chef script? Monday. Change to how we're sending writes or reads to different DB clusters? Monday.

I do not know why this isn't the norm in more places.

<comment><USER9> s/ship/shop

<comment><USER10> I quite like the idea of calling one's workplace a ship. I'll take that expression on board, sea if it floats.

<comment><USER11> Definitely. Ship that shit.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> The response to this bug is atrocious and shameful. The developer that responded to this did the same as putting on a blindfold and declaring that because they could no longer see the bug, it must not exist.

Right from the get-go, schofield showed incompetence when they declared they couldn't reproduce the bug, even though it was explained to them plainly and thoroughly!

How do these inept developers get hired?

<comment><USER13> Furthermore, Yahoo can not unilaterally choose to define what is "sensitive". In the EU, many countries implementation of the Data Protection Directive considers e-mail addresses personally identifiable information, which makes it subject to the relevant laws.

Given that Yahoo operates in a number of European countries, and have offices and legal entities in many of them, this potentially means they are _legally liable_ for data protection breaches if they don't plug this hole.

<comment><USER14> Indeed. In Spain, the LOPD (Data Protection Law) states that the email is personal information. Many companies have been fined for leaking emails, specially when sending mass emails with all the addresses in the "To:" field instead of BCC.

<comment><USER15> Are First/Last names personal information in Spain too? So a customer list would also have the same protections?

</comment></comment></comment></comment><comment><USER16> A simple fix seems to be to use longer random id for the invitation.

As d4d1a179c0f3 mentions, this kind of information could be useful for setting up more targeted phishing attacks. "Hi John, remember the Flickr invite for holiday photos I sent you two weeks ago? I moved my albums to new site, please go to blackhat.org/malwaredl.."

<comment><USER17> Yeah it would be a fairly simple fix in code: they could hash some of the user data (e.g. email + name) and then append the id to create a token that won't ever collide and is always unique. e.g. [http://www.flickr.com/invite/?resend=<hash>-<id>](http://www.flickr.com/invite/?resend=<hash>-<id>)

<comment><USER18> Exactly what I was thinking, expiration isn't even necessary.

<comment><USER19> Of course, hashing _and_ expiration would be best.

I'm not really seeing any good reason _not_ to expire them...

</comment></comment></comment></comment><comment><USER20> This bug was fixed just seconds ago. The power of HN :)

You can still load the invite/resend page, but you won't get any user info from it.

</comment><comment><USER21> So I clicked on one of the example invite links listed in the bug report. I was then prompted to log in to my Yahoo account. Hmm, OK... so I logged in, at which point I was taken to a page with a form asking me to join Flickr. I did NOT fill in or submit the form because I don't want a Flickr account, though it was presented with defaults based on my Yahoo ID anyway. I closed that window and tried clicking on an invite link again. Much to my surprise, the link then worked and I received an email saying "Welcome to Flickr". What the hell?

[edit: on the plus side, Flickr make it very easy to delete your account entirely. The only obvious side effect is that the screen name you had is now unavailable for any further users]

</comment><comment><USER22> The collision rate seems pretty high and to someone with a bit of resources (say 500 ips) to go through the ids would take 3~ days at 1 request per second.

The party would have a list of of flickr users / email combinations.

The best way to fix this if they want to have the urls work for some backward compatible reason is probably severe rate limiting after x requests if they do not want to expire these requests -- right? Otherwise, something the size of UUID will make the search space too large.

<comment><USER23> This is not a collision rate. Collision is when two plain text gives the same hash.

<comment><USER24> No, collision is not exclusively for hashes. The term can be used for any area where there's a high ability to encounter a value already in use. In this case, by guessing or incrementing.

</comment></comment></comment><comment><USER25> Isn't this basically how weev got sent to federal prison?

<comment><USER26> No, there is a difference between accessing things and publishing things with malicious intent.

<comment><USER27> Most people would not call only releasing the data to a journalist "publishing", and much less "with malicious intent".

weev didn't put his dump up on the pirate bay, he sent it to Gawker.

</comment></comment></comment><comment><USER28> Can we not call this a "bug?" It's clearly a design weakness and "schofield" said it was working as intended, ergo not a bug, but just a poor choice of mechanism. Pretty humorous that "schofield" thought it was fine the way it is. Guess that has been cleared up by the internet. It's pretty trivial to generate a random, non-guessable, unique code to use as a lookup key for the invitation, and I guess that's what they've done.

</comment><comment><USER29> Knowing an individual's network of names and email contacts in a highly specific domain could be quite attractive for a phisher. This seems quite different from viewing the contact list on, say, Twitter, where an individual explicitly makes their contacts known to the world (and via synonym only).

The response surprises me.

</comment><comment><USER30> I saw a similar issue with a company that sold tickets to events several years ago. They sent me an email with a link to my e-ticket. The URL had a sequential id, and there was no auth/verification that I was the one who purchased it.

So, I took a look at the person who ordered before me, and was able to view their name/address, and could have printed their tickets to the event!

</comment><comment><USER31> Actually the Yahoo! employee (schofield?) in the above link is right and you cannot blame him for this - it is because Yahoo! really think first name + last name + email are not private information AFAIK, not particularly to Flickr, there are multiple ways to retrieve these information...

<comment><USER32> Relations are another interesting thing. That would make phishing much more effective. Though I suppose somebody's Yahoo profile page should get them access to that as well.

<comment><USER33> There was also the invitation text which might contain private messages.

</comment></comment></comment><comment><USER34> Awe, I was in the middle of writing a scraper for this and it seems they have now "fixed" it.

</comment><comment><USER35> Well thats messed up... At least now I know how spammers get my email :D

<comment><USER36> As jpalomaki points out it's better than that... We are entering a brave new world of spam that's "from" people you know.

<comment><USER37> No, we've been there for a long long time now.

I use different email address for different people, and virtually every single one of them has been harvested and used to send spam from that person.

At this point I don't expect email to be secure at all. You basically have to expect that unless you are dealing with someone with IT skills their email will inevitably get hacked.

The implication is that email is NOT a good way of doing password resets. The problem is what's the alternative (that doesn't require specialized hardware, like a 2nd auth token generator)?

<comment><USER38> You don't need to hack someone's account to send mail as them, you just need a server that will get into the popular services. That's the reason social graphs are sensitive, match up people who trust each other and send them messages as each other.

Interesting point about password resets though, if you can read (have hacked) the email you're into pretty much any account. BTW in case you're unaware any Android/iOS device can run Google authenticator and generate 2FA tokens. Email behind 2FA is probably the best security/friction tradeoff for that sort of message, but not many people use it.

<comment><USER37> > You don't need to hack someone's account to send mail as them, you just need > a server that will get into the popular services.

They emailed me on an address only used by them in their email, and not in any other service. That only way I could get spam on that address is if their email was hacked. (Either remote, or locally via their desktop.)

<comment><USER39> What about spoofing? [http://en.wikipedia.org/wiki/Email_spoofing](http://en.wikipedia.org/wiki/Email_spoofing)

<comment><USER40> I think 'ars is saying that these are "personalized" email addresses: there is a separate one for each person from whom 'ars wants to receive email. Assuming these addresses aren't easily guessable/enumerable, and aren't on any lists stolen from or sold by service providers, the spammer must have have gotten them _somewhere else_.

<comment><USER13> The problem is that pretty much every one of them have probably given one or more services access to download their contact data to connect them to their friends, so any number of services other than their e-mail likely contains these personalized e-mail addresses.

 _Someone_ has likely been hacked or sold/leaked data, but he should assume that those addresses have been spread quite a bit voluntarily by his friends/associates.

<comment><USER40> OK, that makes sense.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> Yahoo has fully embraced working with security researchers. For a company their size (they're no. 1 in web traffic!) with that many different services, they're doing an amazing job. No company that size has ever moved this fast. Yes, they're catching up but they do it fast!

</comment><comment><USER42> Why the hell do companies think it's trivial to just give away data about huge swaths of its user base? Is it some kind of ego thing, like, they aren't willing to admit it's a security issue, so just pretend like this is a feature and not a bug?

</comment><comment><USER43> it's really easy to capture contacts this way. As Mathias said, they have to limit the view of the saved form to the one who sent it in the first place... and add an expiration for deleting such data.

So what's missing ? an ID for knowing the first sender, a timestamp, a checking process and a garbage collector to delete the expired ones periodically ? Ok, we don't add a column so easily in the big DB table here, but they can add a sister table with both IDs, the timestamp and a "IsActive" boolean... and start filling the new table with no reference ID, so only the timestamp works for the existed ones. the system will repair itself at the end of the expiration date.

<comment><AUTHOR> Minor correction: it was "d4d1a179c0f3" who reported and suggested that solution, not me (although I agree with their proposal). I'm just the guy who posted this on Twitter ([https://twitter.com/mathias/status/452714683628527616](https://twitter.com/mathias/status/452714683628527616)) and Hacker News.

</comment></comment><comment><AUTHOR> Looks like someone just changed the title of this HN submission. For the record, it originally said: "Full name and email for every Flickr invite ever sent can be viewed by anyone", which was accurate at the time of posting.

<comment><USER44> I changed the title in accordance with the HN guidelines.

<comment><AUTHOR> Which guideline in particular? "Otherwise please use the original title, unless it is misleading or linkbait"? The new title is definitely not as clear IMHO.

<comment><USER44> That's the one.

I agree that it isn't as clear, but (a) it isn't misleading, and (b) we use the original title unless there's a strong reason to change it.

</comment></comment></comment></comment><comment><USER45> To fix,this, they should

\- make the link protected by login

\- accept only post requests

\- generate more complicated, hard to guess tokens

<comment> zero-error Regarding your second suggestion, how would allowing only POST requests stop this from being exploited?

POST requests aren't any more secure than GETs[0] in the context of this exploit, so surely it would make no difference if the attacker was forced to send one type instead of another?

It would also mean that the intended recipients of the Flickr invites would be unable to accept them because you can't POST via links in emails.

[0] [https://stackoverflow.com/questions/198462/is-either-get- or-...](https://stackoverflow.com/questions/198462/is-either-get-or-post-more- secure-than-the-other)

<comment><USER40> Maybe this is a repetition of that old "POST-only prevents CSRF" myth?

</comment></comment></comment><comment><USER46> Schofield, you're _fired_!

Maybe the incentives are wrong. Less bugs, less work for the dev.

Maybe the people processing bug submissions should be paid more per bug submitted and should not be on the same team as the developers.

But there's ocean of incompetence out there, and clever processes can only get you so far when you're dealing with incompetence.

</comment><comment><USER47> Shame on you, Yahoo!

</comment><comment><USER48> I have no idea why anybody would do business with a company as awful as Yahoo in 2014.

<comment><USER49> Yahoo has roughly 12,000 employees, so you can imagine controlling what those 12k employees do on a daily basis is next to impossible.

Should this have never happened? Absolutely. Does it display that Yahoo is "awful," absolutely not.

<comment><USER48> You're assuming that my comment was based on this incident alone.

</comment></comment></comment><comment><USER50> Anyone able to view this site without Javascript?

</comment><comment><USER51> The propaganda completely unbacked license response by Yahoo to the Openstack/MongoDB fiasco and now this are making me want to delete my account on the site

</comment><comment><USER52> <paranoid>This is why the bitcoin thefts concern me. Now you have a bunch of bad guys with battle-tested black-hat skills and plenty of millions at their disposal.

So they can easily afford a giant cluster to throw up phantomjs instances to scape this data in an easily throttleable way. Not that they would be particularly interested in this case, but similar ones for sure.

I think we will see this WAY more in the future. If your email/name retrieval is not an intractable problem, you might as well put up a spreadsheet with the info.</paranoid></comment>


3 part series on HTML5 game development tips - <AUTHOR> http://blog.clay.io/tag/html5-game-development-tips

<comment><USER2> Part 1: <http://blog.clay.io/134442661>

Part 2: <http://blog.clay.io/html5-game-development-tips-part-2>

Part 3: <http://blog.clay.io/html5-game-development-tips-part-3>

Each post has 4 to 6 sections, and are brief in their content. Lots of source code is given, and available for your use from GitHub. I found the posts to be very informative, and touched on a number of things I figured out the hard way in developing apps for iOS and Android. It's also helpful to see if their solution to a problem is similar to what you came up with.

<comment><AUTHOR> Thanks for the feedback and glad you liked the posts!</comment></comment>


Generate Investment Ideas by following public market trends - <AUTHOR> https://shareseer.com <comment><AUTHOR> Track what institutional investors are holding and generate ideas from them

e.g [https://shareseer.com/search?q=BERKSHIRE+HATHAWAY+INC+13F](https://shareseer.com/search?q=BERKSHIRE+HATHAWAY+INC+13F)

Perform due diligence before purchasing any stock e.g [https://shareseer.com/search?q=gs](https://shareseer.com/search?q=gs)

Track all institutions by aum [https://shareseer.com/aum](https://shareseer.com/aum)

Follow insider transactions to generate ideas

[https://shareseer.com/weekly/insiders/largest](https://shareseer.com/weekly/insiders/largest)

I encourage you to create an account to get full access to the site at [https://shareseer.com/signup](https://shareseer.com/signup)</comment>


New Zealand has eliminated Covid-19 - <AUTHOR> https://www.nejm.org/doi/full/10.1056/NEJMc2025203 <comment><AUTHOR> Originally posted on Reddit but this is so awesome, deserves to be shared with everyone.

</comment><comment><USER2> I'd say, for now. The problem with a virus that's contagious like this one is that non-pharmaceutical interventions are just bandaids. The moment someone makes a mistake (and it might happen even in the best scenario, we're all humans), the virus might appear again in the community.

You need pharmacological means to fight it. Not necessarily vaccines, also drugs (which might be available earlier than a vaccine).</comment>


The Irksome Cellphone Industry - <AUTHOR> http://www.nytimes.com/2009/07/23/technology/personaltech/23pogue.html?_r=2&partner=rss&emc=rss

<comment><USER2> It also suggests that the NYT intern that wrote this has very little idea about phone companies.

>DOUBLE BILLING In Europe calls to cell phones (from landlines) cost the caller 5-10x as much as calls to another landline - local calls on landlines aren't free. Because of this cell phones have special numbers so the caller knows it's a cell phone. So you can't have a cell phone with a local exchange number. Which means you don;t have the wholesale replacement of home phones with cell phones in europe. Many people there are campaigning for the US system of cell phone owner pays.

INTERNATIONAL CALLS: The reason your call to Greenland costs $3/min is that the Greenland state telephone company is charging them this. It's also the reason that calls to say the UK cost less than to geographically closer countries in S America and why calls to the 3rd world cost a fortune. For a lot of countries 'settlement charges' are their main source of hard currency.

THE SUBSIDY GAME Have they not heard of interest? Of return on investment? Perhaps not, perhaps they built a new office block in NY because they assumed they simply paid back a fraction of the cost each month until the capital was repaid.

<comment><USER3> I don't know anyone in Europe who'd like the US system of cell phone owner pays. In fact, quite the opposite: I imagine everyone I know, without exception, would hate it.

</comment></comment><comment><USER4> Open Question to HN: How would you go about making a cellphone company that could both make a good network and not treat its customers terribly?

<comment><USER5> You need spectrum. Those with spectrum have all the power and can do essentially whatever they want. The FCC could step in and regulate this or that but I wouldn't count on that happening too soon.

This is why it's a shame that Google didn't go for a win in the wireless spectrum last year. $5 bn would have been worth it and put Android on a whole other level, IMHO. Maybe they were worried about anti-trust scrutiny.

</comment></comment><comment><USER6> The most interesting thing about this article to me is that the author has linked to another site using a visible bit.ly link -- literally "One blogger (<http://bit.ly/gHkES>) calculated...". It suggests some disconnect between the NYTimes journalist and the technology he's using.

<comment><USER7> we do that at my newspaper because it's an easy way to track outbound links. sure we could set up our own outbound redirection thingy, but bit.ly is _les cool_ and we have other things to work on.

<comment><USER6> You could also use awe.sm to set up a redirector on a domain of your choice, which is pretty cheap and looks more professional than a generic shortener (disclosure: I know the founder).

</comment></comment></comment><comment><USER8> Although I think it's a good thing for congress to help us out with things like this every now and then, the author's list of gripes are a bit much. I think congress has better things to do.</comment>


The Complete Guide to Not Giving a Fuck - <AUTHOR> https://medium.com/best-thing-i-found-online-today/52bc4be9e7c1

<comment><USER2> In case you don't get much discussion, it may be because some of us have seen this before:

[https://news.ycombinator.com/item?id=2484160](https://news.ycombinator.com/item?id=2484160)

[https://news.ycombinator.com/item?id=2500556](https://news.ycombinator.com/item?id=2500556)

[https://news.ycombinator.com/item?id=4083115](https://news.ycombinator.com/item?id=4083115)

[https://news.ycombinator.com/item?id=5162117](https://news.ycombinator.com/item?id=5162117)

[https://news.ycombinator.com/item?id=5549393](https://news.ycombinator.com/item?id=5549393)

[https://news.ycombinator.com/item?id=5612606](https://news.ycombinator.com/item?id=5612606)

<comment><AUTHOR> Aargh! Why doesn't it warn you if the link has been posted already..? Is there a way to check? I totally missed it.

<comment><USER2> This is a well known "feature" of HN - it will detect exact URL duplicates provided they're recent enough, probably provided they're in cache. The same story is often submitted over and over again with no way of ensuring that discussions don't get split across multiple submissions. If you follow the "newest" page you see lots of them, although usually one "wins" and the others fall off the page without an up-vote.

A recent example of the same story submitted multiple times in quick succession is the $50,000 twitter handle being lost. An example of the same story submitted many times over the years is on the front page now: [https://news.ycombinator.com/item?id=7149634](https://news.ycombinator.com/item?id=7149634)

Until recently I've tried to cross-reference submissions, but largely now I've given up. This is a rare lapse.

And welcome to HN.

<comment><AUTHOR> I guess one has to hang out in 'new' (I usually just visit the top links).

Thanks for the welcome! :-)

<comment><USER2> Hanging out in "newest" wouldn't help you in this case because it's an item that's been submitted over the years. Most people don't care and just submit things anyway. If you've interested there's always the search function. Sometimes a search to check if something has been submitted before will turn up an interesting item anyway, so there's value in that.

<comment><AUTHOR> Gotcha.

:-)

Thanks!</comment></comment></comment></comment></comment></comment>


Chinese Space Station to hit earth within hours - <AUTHOR> http://www.dailymail.co.uk/news/article-5567801/Chinese-space-station-hurtling-Earth-set-enter-atmosphere-hours.html <comment><USER2> Reentry is confirmed one hour before this link was posted.</comment>


Ask HN: Best Consumer Hosting - <AUTHOR>

Hey all, I'm looking to upgrade hosting that can handle a decent amount of traffic. I can't really spend a whole lot of monthly money, and am curious what you all think is the best at handling traffic for the price.<p>Media Temple, Midphase, DreamHost, Name.com standard hosting, HostGator, etc. Any input appreciated! <comment><USER2> If you're comparing shared hosting companies you're not really comparing anything at all. They all have the same business model -- stuff several hundred to several thousand sites on each server, advertise unlimited resources but terminate any site that uses more than the average. If you want to handle more than a trickle of traffic, you need dedicated resources -- that means $20 a month or so for a VPS.

Once you switch you'll never go back. Having your site operating at the whim of some resource checking script will seem ridiculous. The idea of paying for "10 domains" or "20 mailboxes" or "100 subdomains" will make you laugh since you now realize these things are nothing more than few lines of text in a configuration file -- not actual scarce resources to be portioned out at different fees. The idea of not being able to upgrade your language versions or install your own packages will seem appalling. It's worth the couple extra dollars a month.

<comment><USER3> I totally agree- once you go vps you'll never go back.

</comment></comment><comment><AUTHOR> In response to both dangrossman and ohashi, sorry to not add this info to the question.

The problem with me is my app will have subdomains for each user. For example, `john.myapp.com`. These subdomains are each going to be password-protected areas with healthy amounts of embedded video and I just don't trust the shared hosting I currently have.

You've both recommended VPS. Any input on that?

What do you think of something like this from MediaTemple: <http://mediatemple.net/webhosting/ve/> ?

The videos are embedded from Vimeo, so the concern for me is just having good uptime and reliability and not having to worry too much about running out of "disk space" and bandwidth.

<comment><USER2> > The problem with me is my app will have subdomains for each user. For > example, `john.myapp.com`.

Sounds pretty straightforward. Wildcard DNS entry, wildcard vhost -- two lines of text that say "point all DNS queries to the IP of my VPS, point all HTTP requests to this document root (your app)", then your app has some code that looks at the hostname in the request to decide which site to show. Subdomains are not 'things' that take up any resources.

> These subdomains are each going to be password-protected areas with healthy > amounts of embedded video and I just don't trust the shared hosting I > currently have.

If all the videos are embedded offsite, then they really have no impact on your choice of hosting solution. You don't have to handle the bandwidth or storage or even the HTTP requests for the videos. A shared host wouldn't know or care if you put a million videos on each webpage -- it would have no impact on their server. It'll have no impact on yours either.

> What do you think of something like this from MediaTemple: > <http://mediatemple.net/webhosting/ve/> ?

Considering it's an unmanaged service, I don't see why you'd pay them $30/month when Linode is only $20/month and has a perfect review record among HN hackers.

<comment><AUTHOR> Great answers man, thank you! I feel pretty good about Linode. I'm going to look more into it and shop around a bit more. Thanks for all the help.

</comment></comment></comment><comment><USER4> I have heard good things about <http://linode.com/>

<comment><USER5> I've used Linode to host my personal website and various side projects over the last 2 years and I've been very pleased. For low traffic sites and small apps the $20 per month plan has been sufficient.

<comment><USER6> Depending on the definition of "low traffic" and what exactly you plan to do, Heroku may be a free solution.

</comment></comment></comment><comment><USER7> First of all, you haven't really defined a decent amount of traffic. Where are you bottlenecking? database? bandwidth? cpu?

I agree with dangrossman that going from one shared host to another isn't going to go well most likely. Of course, that depends on the bottleneck. I've got a shared host running SSDs, if my bottleneck was disk i/o it might work on that while failing on shared hosts using something slower.

If you really are pushing a lot of traffic and having trouble with shared hosting though, it's time to upgrade. VPS/Dedicated/Cloud are the options I would be looking at. Also possibly a CDN depending on what the bottleneck is of course.

</comment><comment><USER8> Has anyone here used media temple's $20/mo service? I'm looking into that as well

<comment><USER2> It's shared hosting with all the drawbacks that implies, yet without the price benefit of shared hosting anywhere else. If you have $20 per month to spend on hosting you have two choices -- if you want managed, shared hosting, save some money and buy it somewhere cheaper. If you want the full control of a VPS and can manage it, then spend that $20 on a VPS somewhere else and get much more.</comment></comment>


ARM: Heretic in the church of Intel, Moore's Law - <AUTHOR> http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9131098

<comment><USER2> That headline is mind-bogglingly stupid. Cheap, powerful chips as a _refutation_ of Moore's law? Buh-what?

Of course, it starts off by an entirely-fabricated misquote of Moore's law. Wikipedia's article strikes me as pretty good and there are a number of reasonably good ways of looking at it, including component density over time, or price-per-transistor. Note that neither "raw performance per CPU" nor "MHz" show up in any formulation; nothing in Moore's law says whether you need to take your X nanometer process and make a hundred Opterons or a thousand ARMs per silicon wafer.

</comment><comment><USER3> From the end of the article:

"Last month, a Motley Fool blogger suggested that Apple might drop the ARM processor in the next version of the iPhone, either for the next version of Intel's Atom, codenamed Moorestown, or if Apple build its own chip using the technology from its acquisition of low-power chip maker P.A. Semi Inc. last year."

Apple switching the iPhone to Atom is highly unlikely. They'd have to either scrap their entire library of software (running it under emulation would be unusably slow), and they'd probably end up losing out on power consumption anyway.

Building their own ARM is totally possible, though.

<comment><USER4> ARM is so small Intel could license ARM's IP and build an ARM core inside an Atom processor, sacrificing a tiny little bit of the cache memory. If the ARM core could use some logic on the Atom side, the sacrifice would be even smaller.

<comment><USER5> Didn't intel have a license to Produce ARM CPUs? Didn't they end up producing StrongARM after they acquired it from DEC (or was it already Compaq).

</comment></comment></comment><comment><USER6> I can't believe they think a Windows version is pre-requisite to success in penetrating the server market

Taking websites as an example : The clear leader amongst web servers used by the million busiest websites is Apache with a 66% share. It has a 47% lead over its closest competitor, Microsoft-IIS, much greater than on the web as a whole.

netcraft confirms it - [http://news.netcraft.com/archives/2009/03/15/march_2009_web_...](http://news.netcraft.com/archives/2009/03/15/march_2009_web_server_survey.html)

<comment><USER3> Not to mention, an ARM edition of Windows wouldn't be much good without either (1) a binary translator or (2) everyone rewriting their software to run on ARM. The OS does not exist in a vacuum.

<comment><USER7> or (3) everyone making source available? Could a more heterogeneous processor market drive people towards open source purely from the practical aspect of being able to built the right version to run on their kit?

<comment><USER8> It's more likely to drive people to use a JITting virtual machine.</comment></comment></comment></comment>


Ballmer: Microsoft Has 1 Million Servers in Datacenters, Only Second to Google - <AUTHOR> http://wind8apps.com/microsoft-datacenters-amount/

<comment><USER2> So many errors with that article. And a few spelling mistakes too. I think people are better off going straight to the source instead of reading a poorly written re-interpretation of the source: [http://www.zdnet.com/microsoft- million-server-datacenters-70...](http://www.zdnet.com/microsoft-million- server-datacenters-7000017996/)

<comment><AUTHOR> I just love it how you folks always give it to the "zero spelling mistakes" website and all. You're simply giving no chance to other websites to evolve. I gave that source because they were first, not because they were exclusive.

and it wasn't a reinterpretation of that source only.

<comment><AUTHOR> Thanks for the time you took to correct me

Indeed, the were some errors inside the piece that I almost never make

My mistake was to write and then submit it here, NOT KNOWING NOR EXPECTING that it would get so quickly picked up on the front page.

Quicker than I realized, I was confronted with the mistake I made, without having time to re-examine the article again.

And yes, I did research. Initially, I wanted to write something about Microsoft's focus on the cloud and then I found this piece - [http://rcpmag.com/blogs/scott-bekker/2013/07/wpc- microsoft-1...](http://rcpmag.com/blogs/scott-bekker/2013/07/wpc- microsoft-1-million-servers.aspx), which is 3 days old, so, most likely, that is the initial source, but not Zdnet.

Then, I linked Microsoft's focus on cloud with the expansion in Iowa + another article with a funny, side fact - [http://www.greenm3.com/gdcblog/2013/7/11/microsofts-new- orga...](http://www.greenm3.com/gdcblog/2013/7/11/microsofts-new-organization- puts-datacenter-four-times-and-s.html)

then, I found this one - [http://www.datacenterknowledge.com/archives/2013/07/10/micro...](http://www.datacenterknowledge.com/archives/2013/07/10/microsoft- wpc-2013/)

Therefore, I stand for my work and I accept the errors that I made but please don't label my effort that quickly

<comment><USER2> _> "My mistake was to write and then submit it here, NOT KNOWING NOR EXPECTING that it would get so quickly picked up on the front page.

> "Quicker than I realized, I was confronted with the mistake I made, without > having time to re-examine the article again."_

I hate to say this, but the title drew a lot of attention because of it being inaccurate. eg I clicked the link because my thought was _" wow - that can't be true. I wonder where all these data centres are and how big they are"_. I'd guess many others did the same - which is why someone accused the article as linkbait.

I think this is one of those occasions that need to be chalked down as "experience". And a good reminder to all of us to proof read the stuff we post online. :)

<comment><AUTHOR> Definitely,

I was so damn surprised, man!

The last story I had on the front page was like 6 months ago so I said to become active again and thought timing was crucial with this one.

I got the timing right :D

What I want to ask is this, with the current title, would it have been as "baiting"? I mean, did it have a chance of getting on the front page with the actual title? Because if it did, then it's too bad :(

<comment><USER2> The original / incorrect title was definitely more interesting than the new / correct version. It's no surprise to me that Microsoft have a number of data centres and a million servers seems believable. But the original title was so far fetched that I was fascinated to read how the numbers were comprised.

But going back to your original question, I wouldn't like to say if you'd have made the front page or not. It would have been _less_ likely - but there's still a possibility enough people might have been interested to up-vote it. If I'm honest, I wouldn't have - but then I didn't up-vote your incorrect title either as I read then vote; and once I spotted the issues, I was put off voting - sorry :(

I've never really understood what drives articles to the front page though. I've read some cracking news items that failed to gain more than a couple of votes but equally I've read some extremely dull articles (and even Twitter statuses) that have made it. I guess it just shows how individual we all are.

</comment></comment></comment></comment></comment></comment><comment><USER3> I don't think the author knows what a datacenter is

<comment><AUTHOR> I know, and so does Steve Ballmer, I assume

<comment><USER4> From your article:

 _We have something over a million servers in our datacenter infrastructure_

They do not have a million data centers, they have a combined million servers in their datacenters.

<comment><AUTHOR> I understand the difference now, thank you!

<comment><USER5> It seems like you're still a bit confused. These might help: [http://en.wikipedia.org/wiki/Datacenter](http://en.wikipedia.org/wiki/Datacenter) [http://en.wikipedia.org/wiki/Server_(computing)](http://en.wikipedia.org/wiki/Server_\(computing\))

</comment></comment></comment></comment></comment><comment><USER6> TIL Microsoft has 10x as many data centers as they have employees. Every employee gets 10 all to themselves!

</comment><comment><AUTHOR> "Steve Ballmer: Microsoft Has 1 Million Servers in their Datacenters, Only Second to Google" is this correct?

again, apologies for the misleading title

</comment><comment><USER7> Even when corrected for number of servers this tells us essentially nothing. How much compute and storage capacity does Microsoft have compared to Google and Amazon? I'm not talking raw hardware performance either, but Windows Server vs. Google's customized server OS. This kind of information would provide us better insight into their computational capabilities.

<comment><AUTHOR> I think that's a lil' bit hard to quantify

</comment></comment><comment><USER8> Wow, 1 million servers across all of their datacenters. I wish I could visit such an operation just to get a sense of the scale. And how do you exactly manage that much compute/storage capacity? Amazing.

<comment><AUTHOR> Phew,

Clive, this should've been the first comment I got, not all this :(

I guess the answer to your question is this - [http://msdn.microsoft.com/en- us/library/bb895144.aspx](http://msdn.microsoft.com/en- us/library/bb895144.aspx)

</comment></comment><comment><AUTHOR> By the way, if some moderator reads this, the story has been pulled of because of its stupid mistake?

</comment><comment><USER9> datacenters != servers

<comment><USER10> Even the updated article is completely wrong!

"Microsoft Has 1 Million Server Datacenters" \- Uh, that's not what Ballmer meant.

But as a link bait, this article must have been super successful.

<comment><AUTHOR> It wasn't even a link bait. I understood the difference only now. I am not an expert in the field, I agree, I didn't even thought it'd get this quickly in the top. Again, I didn't intend this to be a link bait, apologies!</comment></comment></comment>


How la Gendarmerie (French military police) ditched Microsoft and McAfee - <AUTHOR> http://www.numerama.com/magazine/26373-comment-la-gendarmerie-a-envoye-bouler-microsoft-et-mcafee.html

<comment><USER2> The last paragraph is a good summary:

Last week, 21 June 2013, the head of technology and information systems of internal security, General Bernard Pappalardo, wrote to the interdepartmental steering information and communication systems, by sending a copy of his letter to all departments. "For many years, the police tried to avoid this type of dependency and promote free software for its information systems (workstations and servers)", said the general. "That's why it will not deploy the solution chosen by UGAP to protect its desktop solution and launched a preliminary consultation on the acquisition of an antivirus solution which must include a management console on Linux."

UGAP being (to my knowledge) in charge of making the government save money in this kind of situation.

</comment><comment><AUTHOR> Automatic translation : [http://translate.google.com/translate?depth=1&hl=fr&ie=UTF8&...](http://translate.google.com/translate?depth=1&hl=fr&ie=UTF8&prev=_t&rurl=translate.google.com&sl=auto&tl=en&u=http://www.numerama.com/magazine/imprimer/26373-comment- la-gendarmerie-a-envoye-bouler-microsoft-et-mcafee.html)</comment>


40% of patients in a 'vegetative state' are misdiagnosed - <AUTHOR> http://www.timesonline.co.uk/tol/life_and_style/health/article3004892.ece

<comment><USER2> Funny, last night's episode of House was about exactly this, and was one of the best episodes I've seen.</comment>