How I Make Yogurt (2019) - <AUTHOR> https://rmosolgo.github.io/blog/2019/03/28/how-i-make-yogurt/ <comment><USER2> A few updates since I first wrote this up:

\- I don't bother sterilizing any more. I make sure the jars are clean, but that's all. I think the culture is fast enough to raise acidity to a safe point very quickly. (I still sterilize for cheese though.)

\- I always use commercial culture now. I had off-results after the third round of saving a starter. (Someone mentioned heirloom cultures, which I think would avoid this problem. My wife tried those, but we didn't care for the flavor, and I prefer the workflow of two gallons at a time, done overnight.)

\- If you make yogurt, but never started with the high-temperature initial step, I really recommend trying it. It makes a thicker consistency because the proteins are denatured and curdle better. (The downside in my opinion is that it also destroys some of the goodies present in my previously-raw milk.)

\- My 20-minute high-temperature hold is often much longer. I try to reach 180 degrees F and take it off the heat, then put the kids to bed. It always seems to do fine.

Anyways, thanks for all the comments. I'm always happy to read a nice discussion about dairy processing! Next time you're passing through central Virginia, let me know and we can share a cheese plate.

<comment><USER3> How critical is the rate of cooling? Do you have to use an ice bath or can you use air cooling to cool it down?

I make my own yogurt using an instant pot for both the boil and incubate but cool using the air. Sometimes the consistency is lumpy, and I wonder if this anything to do with it.

<comment><USER4> I use my Instant Pot in pretty much exactly this way, but have never had lumpy yogurt, so maybe something else?

<comment><USER3> That's good to know, thank ou. Maybe it's my starter culture. I had been using yogurt from Dannon or a Skyrr.

<comment><USER4> Try (if you can find it!) Stoneyfield plain yogurt, not their Greek-style. It tastes great, and I have a 100% success rate with that as a starter. Good luck!

</comment></comment></comment></comment></comment><comment><USER5> How my wife does it:

1\. Boil milk in a pot (3-4 liters). Forget it's there. Turn it off when someone notices it boiled.

2\. Wait till it cools to ~40c. Try to put a finger in the milk. If it's cold enough so you don't have to take your finger out, it's about ready.

3\. Dump a cup of probiotic yougurt inside and stir.

4\. Cover with the lid. In the winter wrap it with some blanket to keep it warm (probably not really necessary)

5\. Wait for 24 hours.

6\. It's ready. Put the whole thing in the fridge.

Somehow this works every time... It's seems really hard to ruin the process, and not for lack of trying...

<comment><USER6> I'd like to hear more about _why_ you make your own yoghurt. Does it taste very different than store bought plain yoghurt, do you find the DIY aspect appealing, or is it mainly for cost savings?

<comment><USER7> I do it to make full-fat, low-sugar yogurt, which is harder than it should be to find at the grocery store. Almost all of them besides the Fage Greek are loaded with sugar. Guess which one our store doesn't stock? (the Fage 5%)

<comment><USER8> In Spain you can find everywhere "natural yogur", not sweetened, with "4 g sugars", I guess lactose, per 100 g, so 5 g per 125 g cup. Is this low-sugar by your standards or is it possible to achieve lower contents?

<comment><USER7> Yes, I'm referring to "no sugar added" really. As you mentioned, there is some natural sugar.

</comment></comment></comment></comment></comment><comment><USER9> Instant Pot is great for this. 1\. 4L of yogurt, press button. 2\. Wait to cool to 40C (place whole pot in sink full of cold tap water if you're in a hurry). 3\. Stir in 1-2 tbsp yogurt, press second button. 4\. 8hrs later/next morning, yogurt is ready. Transfer to whatever container you want.

You can strain it further with one of these dealios, or a homemade contraption: [https://www.amazon.ca/Euro-Cuisine-GY50-Greek- Yogurt/dp/B009...](https://www.amazon.ca/Euro-Cuisine-GY50-Greek- Yogurt/dp/B0091XNL0I) It makes it milder and absurdly thick.

Sometimes I like to leave batches for 60hrs instead of the usual 8. It makes it incredibly acidic, but after straining thoroughly, most of the acidity is gone and you're left with a very strong tasting, goat cheese-like product, ie yogurt cheese. Mixing this with finely grated garlic and salt is sublime. I've given this to many friends and acquaintances, it's always a hit.

<comment><USER10> Yep - Instant Pot makes it really simple. Do make sure your model has a yogurt button (not all do). It works something like 95% of the time. You'll easily make up the cost of the Instant Pot with just yogurt if you eat as often as I do.

The only modification I make is that after the milk has cooled down to about 110F, I pour the milk into containers, and put the containers in the Instant Pot. I add water to the IP to make a water bath. This way when the yogurt forms, it is in my final container I want it in.

Some other "tips": I do 6.5 hours - it is enough. For the cooling, I simply put the hot pot in the fridge and wait an hour - easier than continually checking the temperature. I've timed it such that an hour will get it to about right. In any case, it's OK if you forgot about it and it gets cold - you can still make yogurt - you only have to adjust the time (so instead of 6.5 hours for me I may do 8 hours with cold "boiled" milk).

</comment></comment><comment><USER11> For those interested in avoiding the complexity of dealing with industrial bacteria strain that can't survive easily in normal conditions, I recommend looking into traditional yogurts.

. They don't need sterilization at all

. They mature at room temperature

. They taste great and have a range of different textures and flavour depending on the strains

. They are stable among generations and can be reused indefinitely

My favorite is Viili but the slimy texture is challanging for some.

This is a great low scale shop that I use:

[http://gemcultures.com/](http://gemcultures.com/)

<comment><USER12> That website has a delightful geocities look to it.

</comment></comment><comment><USER13> I've never bothered with sterilisation to a great deal (just hand washing with washing-up liquid), I just use UHT milk (I think it tastes better for yogurt, and it's already obviously more sterile than fresh milk). I just add a spoonful of yogurt to 1-2 L of milk (I don't bother heating it beforehand), leave it in my PID-controlled crock pot [1] overnight at about 42°C, then it's done. I usually leave the yogurt in some coffee filters for an hour or two to get more of the whey out and make the yogurt thicker. If you leave it for 2-3 hours it's essentially solid, and absolutely delicious.

[1] No write-up yet I'm afraid, but it's a custom PCB I made with a simple temperature sensor, Atmel microcontroller and mains relay that switches on and off my crock pot. It's powered from the mains via a cheap board-mount switch- mode power supply, so no extra power required. Board files here: [https://github.com/SeanDS/slow- cooker/tree/master/hardware/v...](https://github.com/SeanDS/slow- cooker/tree/master/hardware/v2).

</comment><comment><USER14> There is no comparison between home-made and store bought yogurt. More than anything a proofer box [0] has made the process better. Author mentions the Brod and Taylor recipe, but not the box. The box is what makes that recipe easy. The "Set it" step is where I find things tend to go awry. The box will hold the temp, which will allow you to control the consistency of the finished product. Also it makes it easier to do larger quantities.

[0] [https://www.williams-sonoma.com/products/brod-and-taylor- fol...](https://www.williams-sonoma.com/products/brod-and-taylor-folding- proofer-and-slow-cooker/)

</comment><comment><USER15> Or just use instant pot. I use it to make a small batch (1/2 gallon) of yogurt everyday for years now and it have never failed me. Thought I add the culture at 110F.

</comment><comment><USER16> This seems hugely complicated. I make yogurt daily.

Warm up milk to lukewarm. Mix spoonful of starter. Bundle the vessel in a thick towel for insulation. Leave it overnight. (Or less, if you live in a very warm place).

If it is cold, I warm up the oven just a tad and turn it off, and leave the vessel inside.

Use a spoonful of that yogurt the next day as starter.

<comment><USER17> Do you strain yours, does yours naturally thicken to a consistency you like, or do you like it kind of thin? I ask because this is the part I find the most frustrating - the making it is easy, the getting it to the consistency I want is work.

<comment><USER16> The image shown in this link is the consistency I get.

[https://www.indianhealthyrecipes.com/how-to-make-thick- curd-...](https://www.indianhealthyrecipes.com/how-to-make-thick-curd-at- home/)

As this site says, if you want it thicker, use whole fat milk, or boil the milk on low for a while before letting it cool to luke warm temp.

<comment><USER17> Good info -- yes I've gotten sloppy about milk selection as I often make it with just whatever we have on hand that needs to get used up.

</comment></comment></comment></comment><comment><USER18> I find you can even make yogurt from slightly sour milk, just by adding a little baking soda.

Details: to make good yogurt you need to bring it to 85-90C, which denatures the milk proteins and improves thickening. If the milk is acidic, it will separate into curds and whey when heated. Sour milk is acidic, so adding a little baking soda to raise the pH allows you to heat the milk without separation. Then, during the later fermentation process, the pH falls again, and the yogurt is tart.

</comment><comment><USER19> My method is very similar, but I find even just a tablespoon of yogurt from the previous batch is enough to inoculate 1 gallon.

We also drain off a good portion of the whey using a nut bag to make Greek yogurt. The leftover whey we put in smoothies.

I LOVE being able to control how much sugar is in it, and it's way cheaper than buying individual packs. All in it costs us right around $2.50 for a gallon of yogurt at home.

</comment><comment><USER20> This is how I make yogurt:

Step 1: Put 1 liter of milk mixed with 0.2 liter of Yogurt on a heating radiator at 11PM.

Step 2: Wake up at 7AM. Yogurt is ready.

<comment><USER21> What Yoghurt do you use in Step 1?

<comment><USER20> The first time, you can use a Yogurt without artificial flavor. Afterward, you can reuse the Yogurt made the first time. Or just use a common Yoghurt from the store. You can use less than 0.2L the first time because the artificial flavor mixed with the natural Yoghurt flavor will not taste that good. The second time and afterward you can use the Yogurt made the first time, the artificial flavor will be diluted.

EDIT: Warning, I do not know how many times can you safely reuse the Yogurt. I've reused the 'same' Yogurt several times without any issue, but please do your research. Of course, I store it in the fridge.

</comment></comment></comment><comment><USER22> Nice writeup, good tips.

I recently started making my own yoghurt. Here's my bits:

I buy the Costco 3-pack of organic whole milk. I'd never get thru that much milk otherwise. Works out to about the same price as their greek yoghurt, but theirs is low fat and I want the full fat for the extra calories.

For my starter, I now use a store bought brand I really like, ellenos.com. I tried a few dry starters. Blech. Though I will now try cheesemaking.com's Thermophilic stuff too (linked in article).

I can't figure out an easy, practical way to drain the whey. I don't mind the juice so I've stopped trying.

Now I use my Instapot.

I bought the wrong model of thermometer. [https://www.thermoworks.com/DOT](https://www.thermoworks.com/DOT) Has a temperature alarm. But it only works for rising temps, no way to alert for cooling temps. Surely someone knows how to hack it. Recommendations please.

</comment><comment><USER23> I make and consume kefir every day. It's a lot less involved than this and has the same familiar tang that plain yogurt has.

I also notice a sense of well-being shortly after drinking it. I noticed this prior to learning that kefir is Turkish for "feel good".

<comment><USER19> What is your method? I'm a champ at making yogurt, but my first foray into kefir went horribly wrong.

<comment><USER24> 1\. Put kefir grains in milk.

2\. Wait maybe 24 hours at room temperature, depending on preference. I regularly do 48 with no problems.

3\. Remove grains and eat.

<comment><USER25> Can you reuse the grains? If so, how many times until they stop working?

<comment><USER26> I've been using a set of grains since 2017 or so.

Since they're essentially a symbiotic culture of bacteria and yeast (SCOBY), they won't "stop working" as long as the grains are regularly replenished with milk, or kept in the fridge to slow down the fermentation process.

</comment></comment></comment></comment></comment><comment><USER27> You can also make Yogurt out of soymilk. Not every milk that you can buy in the store will work, but it works just the same way.

What works for me is:

\- Heat up the soymilk to 45 °C

\- Put in the yogurt culture or a tablespoon of the leftover yogurt

\- Add a tablespoon of sugar

\- Fill into an isolating container and wait for 8+ hours

\- Put the yogurt into the refrigerator

\- Consume yogurt but save a spoon for the next batch

I've found that when starting from culture it takes a couple batches until the yogurt gets really good. After that there didn't seem to be an upper limit on how long you can keep making yogurt from the old batches, although it can get bad if you wait for too long with starting a new batch.

<comment><USER28> I've actually found that it doesn't usually make a noticeable difference for soy yogurt whether I heat the yogurt to 45 °C or some lower temperature or even at all, at least when using a electric yogurt maker (or other device with active heating). Maybe I need to try them side-by-side because I assume there's some reason many people suggest heating the milk first.

I just mix the existing soy yogurt with soy milk, both of which only consist of soybeans, water, and cultures which seems to be the most reliable option. It involves virtually no effort this way.

<comment><USER29> With a yogurt maker there's no need to preheat it since the appliance will take care of heating and maintaining the temperature. But if you make soymilk yourself, the milk has to be cooked for sometime (regardless of whether you're going to consume it directly or make yogurt with it).

</comment></comment></comment><comment><USER30> Hello, former home yogurt maker here. I used to do this weekly, using a recipe from Harold McGee in the NYT. The incubator was a home oven left warm overnight. It was pretty painless with a success rate of 100%. But, the result was always mediocre, no matter the starter culture. (I didn't buy pro culture, just made it from different brands of yogurt.) It was always pretty thin, never creamy enough, never tart enough. The next step is of course to strain out some of the whey and doctoring the milk fat. Out came the cheesecloth and the bowls, and ... now I've done it. What was I going to do with the whey? The counter was always littered with stuff, the cheesecloth had to be disinfected and washed and hung dried. I got thicker yogurt, but it still didn't taste great. It dawned on me one day that I was spending a lot of time and money (organic milk, expensive yogurt starter) and putting up with a lot of silliness to get an OK homemade product. I chucked it all. Now I buy the European Style yogurt from Trader Joe's and their brand of plain Greek yogurt, both at $3 a container. I love how those taste. I don't regret having tried to make yogurt, and then quitting. That's been my experience and perspective, and I'm in no way devaluing or deflating the experience of the folks here. I think it's pretty awesome that people are still making their own food. My next dairy misadventure: burrata.

</comment><comment><USER31> There are machines that just do this process for you that work well, I have one similar to this[0] and it's very easy to use.

0: [https://www.amazon.co.uk/VonShef-Digital-Yoghurt-Maker- Jars/...](https://www.amazon.co.uk/VonShef-Digital-Yoghurt-Maker- Jars/dp/B07GB6V4JH/)

<comment><USER32> The machine I have is so easy that I ended up getting two. I just pour a quart of UHT milk in each one, don't bother boiling, add yogurt starter, turn on, put great thick yogurt in the fridge 9 hours later.

</comment></comment><comment><USER33> My wife makes yoghurt in an Instant Pot, she uses lactose-free milk, full-fat Fage yoghurt as a starter and I think some other ingredients. (I'll check and update later)

End result is a Greek/Skyr like yoghurt that lasts both of us for more than a week. It's so tasty!

<comment><USER34> > she uses lactose-free milk

I am lactose intolerant but yogurt is fine for me. As I understand it lactose in yogurt is easier to digest with the yogurt bacteria.

Curious do you have intolerance with regular milk yogurt?

<comment><USER35> I thought lactose was what yogurt bacteria ate?! How does this work?

<comment><USER33> Bacteria eat sugars, not just lactose. There's other sugars in milk.

</comment></comment></comment></comment><comment><USER36> How I make yogurt:

Requires:

* a Digital temperature regulator * a non digital crockpot (mechanical on/off switch)

1\. Dump milk into gallon jar. 2\. Stir 1/2 C yogurt into milk. 3\. Put jar in crockpot 4\. Pour water around jar 5\. Insert temp probe into water 6\. Plug crockpot into temp regulator and temp regulator into wall 7\. Set temp regulator at or below 115 deg F 8\. Cover with towel or apron to hold in heat 9\. Wait 12-36 hours to taste.

Total working time: 5 min. Total cost per gallon: < $2.00

You don't have to pre boil the milk if you're going to use a commercial probiotic yogurt rather than chaining. That's the biggest time and effort saver: not having to watch a slowly heating pot of milk and preventing it from boiling.

</comment><comment><USER37> If you don't want to spend 30+ minutes a pop sterilizing everything, you can always go the homebrewer's route and pick up a bottle of Starsan, a food-grade sanitizer.

A bottle lasts for quite some time, and if you make the solution with distilled water, its shelf-life is quite a bit longer. When you want to sanitize something, just throw the dilution into a spray bottle and spray down your containers and wait for 30 seconds - no rinse needed.

Just a thought to save time for those who might be doing this often.

</comment><comment><USER38> I love making yogurt, and have tried it on and off since I first had fresh homemade yogurt made by my Oma on my first trip to visit them in Germany back in the 90s. Every day started out with fresh yogurt with muesli, and my mind was blown. But here in Canada because of supply chain management price controls on milk it's just not that cost effective compared to buying pre-made yogurt. And there's not the same variety of fresh milk products available here either.

</comment><comment><USER39> How I do it:

      1. Heat 14oz of milk for 2 minutes in a 700W microwave
      2. Add 4oz of cold milk to a container
      3. Add 2 spoons of Yogurt (I use Pavel's full cream) to the cold milk and mix
      4. Pour the hot milk in the container and stir it
      5. Put away in a place where the temperature won't fluctuate much and container won't be disturbed for next 12-18 hour.
         I use an oven for this with no per-heating or temperature control.

</comment><comment><USER40> Tip for making better yogurt: use a clay pot if you can find one. I can't tell you why, but somehow it creates smoother, richer yogurt.

</comment><comment><USER41> I have a gas stove whose oven has a pilot light, so the oven is always slightly warm and suitable for culturing yogurt. Here's my recipe:

Put milk in a pot on stovetop on lowest heat, heat until its steaming (or to a boil) then turn off heat and allow to cool to room temperature. Add some yogurt, stir, put pot inside oven and leave overnight. Its all yogurt by morning!

</comment><comment><USER42> I followed a recipe a few times and had decent success using store-bought as a starter. It ends up taking a long time, cost about the same to make as buying a 32oz tub and yielded about the same volume so I just buy it. Fun and easy project to do yourself, but for me it isn't something I took enough interest in to keep doing regularly.

</comment><comment><USER43> I use a sous vide machine to keep the yogurt at a consistent temperature. If you're working with non dairy milks, that extra time can help a lot.

If you're looking for another good fermentation, kimchi is a great one. There's nothing better than making kimchi fried rice or kimchijjigae with homemade kimchi.

</comment><comment><USER44> I do a lot of yoghurts at home. I find skim milk powder is really excellent for thickening it up before you culture it. I also enjoy browning it a teensy bit on the bottom of the pot - gives it a nice caramel flavour.

</comment><comment><USER45> I make yogurt pretty much following same steps. Unfortunately I only have access to store bought yogurt as starter. It's fine for a few times after that it gets stringy. I have to find a good alternative.

</comment><comment><USER46> I use a $20 salton rice maker on warm (not cook) setting into which I put a 2 litre glass jar of ingredients brought to 90 degrees F beforehand. No sterilizing. Takes about 10 hours

</comment><comment><USER47> Poking around a little in that guy's repo... he actually seems to write that entire blog as plain HTML files! I was really surprised, sort of expected it to be gatsby or something

</comment><comment><USER48> I wish I could give it a try... I don't have a place of my own yet and no access to a kitchen, but hey! It could be worse. I'll save the recipe for the future though.

</comment><comment><USER49> Is yogurt the next peanut butter&jelly or craft beer or avocado toast thing?

I've seen a few recipes for making yogurt on my hipster friends facebook feeds recently and now this.

<comment><USER50> What was the peanut butter & jelly thing?

Fermenting in general has been gaining popularity over the past few years and with shelter in place there's been a sudden spike in interest. I've see a lot more content on making sourdough, yogurt, sauerkraut, kefir and kombucha popping up.

</comment></comment><comment><USER51> You can avoid burning the milk by keeping the milk moving with a large spoon. Nesting the milk in a second pot of water seems overly complicated.

</comment><comment><USER52> Has anyone tried using thermophilic starter to make yogurt? How does it compare to using store bought yogurt as starter.

</comment><comment><USER53> Thanks for sharing. Will be giving this a try. Also, for the author, I like the design of your site. Very easy to read.

</comment><comment><USER54> Walk into any Indian home for a free lesson, they make it every day for a few thousand years now :-)

</comment><comment><USER55> How long does home-made yogurt remain active enough to be used as starter for a new batch?</comment>


Idea: A Social Enterprise YC in New York City - <AUTHOR> http://theforwardlean.com/

<comment><USER2> Kind of cool. I was about to throw my monitor out the window at the repeated use of "Social Enterprise" and "Social Entrepreneur" until the author actually defined it. I thought they were just hurling buzzwords around. I like the idea of trying to find viable business models that improve society.

</comment><comment><USER3> Interesting idea. TerezaN's XX Combinator would probably be a better model -- <http://terezan.tumblr.com/post/816358389/xx-combinator></comment>


Ask News.YC: Do you prefer to hack in darkness or in the light? - <AUTHOR>

<comment><USER2> I used to think darkness, but it turned out that quiet was the active ingredient in darkness.

<comment><USER3> Quiet is the most important but even when I can't get that it still helps me to be in a dark and cold environment. It's calming.

</comment></comment><comment><USER4> It's nice to be able to look away from a computer screen to think. So facing monitors and a window at the same time is ideal. I find this setup good for day or night, and have a similar setup at home. I took a quick picture to show what I mean. <http://flickr.com/photos/ikirigin/1061406827/>

I constantly have headphones on. Sometimes without music -- lowering interruptions.

</comment><comment><USER5> In the light, but when it's dark outside. When it's dark inside, the brightness from the monitor gives me a headache.

</comment><comment><USER6> Light, but only natural sunlight. Darkness is better than ugly green fluorescents/ugly yellow incandenscents.</comment>


How the rich get richer – money in the world economy [video] - <AUTHOR> https://www.youtube.com/watch?v=t6m49vNjEGs <comment><USER2> "You never change things by fighting the existing reality. To change something, build a new model that makes the existing model obsolete." \- Buckminster Fuller

Capitalism has to be replaced. Trying to change it is futile.

We've been trying to tweak capitalism for a couple of hundred years and we're still stuck in a global board game of Monopoly.

There is only one outcome in such a game and everyone knows it: one winner takes all and the rest ...

<comment><USER3> It's not like capitalism was just put here by someone, it's how free humans will interact by default. The idea that it can be "replaced" is one of the most asinine that I've ever heard. Even in places that have tried to practice something different capitalism has still existed in the way of black markets and has always emerged as king.

<comment><USER4> There are limits to how much a person can own without a state or an army backing them up.

That is; a society, and a social contract.

Your basic "apple-for-a-dollar" trading will always be around, sure.

But billionaires and massive wealth concentration are a thing that can only exist if society is structured to allow it.

</comment></comment></comment><comment><USER5> What are one or more modifications to the board game Monopoly which would allow the gameplay to sustain itself; which is to say that nobody would win?

<comment><USER6> A redistributive property tax.

</comment></comment><comment><USER7> At about 25 minutes into this, the claim was made that the world was financially stable, currencies were backed by gold, the "real economy" was in balance with amount of money available, until 1971, when the "Nixon Shock" happened. It's somewhat true, but Wikipedia gives a more nuanced story:

\- There was the Bretton Woods system (c. 1958) which established a kind of gold standard for currencies; the U.S. dollar was pegged at $35 per ounce, and the U.S. owned over half the world's official gold reserves—574 million ounces at the end of World War II. Foreign governments could exchange their dollars for gold.

\- As Germany and Japan recovered, the U.S. share of the world's economic output dropped significantly (from 35% in 1950 to 27% in 1969). The French called the Bretton Woods system "America's exorbitant privilege" \- i.e. the U.S. could produce a $100 bill for a few cents, but anyone else would first need to produce $100 worth of goods to get one.

\- In February 1965 French President Charles de Gaulle announced an intention to exchange its U.S. dollars for gold. By 1966, non-US central banks held $14 billion, while the United States had only $13.2 billion in gold reserve (with only $3.2 billion available to cover foreign holdings). By 1971, the money supply had increased by 10%.

\- In May 1971, West Germany left the Bretton Woods system. Other nations began to demand redemption of their dollars for gold (e.g. Switzerland redeemed $50 million, France acquired $191 million). On August 5, 1971, the United States Congress released a report recommending devaluation of the dollar. On August 9, 1971, Switzerland left the Bretton Woods system.

\- On August 15, 1971, Nixon directed that the convertibility of the dollar into gold or other reserve assets is to be suspended (with certain exceptions) - hence, foreign governments could no longer exchange their dollars for gold (presumably for the time being, at first).

From this lay-person's perspective, an improving economy and a growing population would naturally bring about an increase in the demand for money. Gold isn't as constraining on the supply of money as some folks may insist (there were already too many greenbacks for the gold in reserve by 1966). Everyday working Joes will still need some cash in their pockets to purchase their day-to-day needs, and the more such "Joes" you've got the more money you'll need to put some into the newer pockets. For that reason alone, fractional-reserve banking becomes a thing; at the end of the day, a "Joe" has a more immediate need for food-clothing-shelter than for gold. So long as banking clients collectively have other more pressing desires than that for gold, the "virtual gold" of its ledger books could suffice.</comment>


Why Common Lisp Bothers Me - <AUTHOR> http://lovehateubuntu.blogspot.com/2010/03/why-common-lisp-bothers-me.html <comment><USER2> Summary: "Because I'm used to something else."

\- executables: [1] \- library: while there are certain libraries that are harder to set up in CL than Ruby/Python, the provided example of list and string functions is laughable. [2] [3]

[1] <http://www.xach.com/lisp/buildapp/> [2] <http://cl- cookbook.sourceforge.net/strings.html#number>

<comment><USER3> Buildapp looks like a very nice solution to a long standing Common Lisp problem. When I was still reading comp.lang.lisp, seemed like every request for how to build an executable turned into a long diatribe about how "you really don't want to do that", "you're thinking in the UNIX way, not the Lisp way", yadda yadda yadda. Now, that question can be just be answered with the buildapp URL.

Agreed that thinking Common Lisp lacks adequate ways to manipulate sequency things is quite funny. The main problem is the lack of definitive libraries for things that were not included in the standard 20 some years ago.

</comment></comment><comment><USER4> I don't consider the executable critique to be legitimate. Java cannot run without a JRE, and arbitrary Lisp code cannot run without the entire Lisp image without losing runtime compilation. It would be possible to forbid (eval ...) and friends from a source program, and then save a Lisp image sans compilation machinery, but that is a lot of work to save a few megabytes and you would break compatibility with existing code in the process.

<comment><USER5> Things would be better for Lisp if it were as easy for non-hacker end users to obtain and install the needed Lisp system.

A Google search for _java runtime_ results in top hits like "Download Free Java Software", "Java Downloads for All Operating Systems", "Java SE Downloads" (with the pertinent phrase visible, "What Java Do I Need?").

A search for _Lisp runtime_ results in top hits like a chapter from the gigamonkeys.com Lisp book, an irrelevant question thread on StackOverflow, and a somewhat relevant page about the Lisp runtime that comes with Autodesk.

I can imagine that doing something like, say, making an easy-to-find, easy-to- download, easy-to-install package of CLisp, tossing in wx widget bindings for good measure, would go a long way toward making distribution of Lisp software easier.

<comment><USER6> What you would like is a "download it here" link on <http://lisp.org/>

It's not as trivial as that.

</comment></comment></comment><comment><USER7> The only thing about Common Lisp that bugs me is that it seems increasingly unlikely that we'll see an updated spec. It kind of sucks for anyone who wants to create a new CL implementation because of all of the anachronisms in the ANSI spec. Additionally, new things like concurrency end up getting done a bunch of different ways between implementations which kind of screws up code portability.

</comment><comment><USER8> Yeah, this was frustrating to me as well. oconnore's point is valid, in that CL is not the only language to behave this way --- but Java (his example) is more up front about it :) (that is to say, learning Java, you learn this limitation quickly, and it's not a problem because most machines have a JRE; CL you might go some distance before you have to look up what's going on, and once you do you realize how few machines have a CL).

Don't get me wrong, I still love me some common lisp --- but I agree with Britton that the issue shouldn't be dismissed as meaningless.

<comment><USER4> So, Java is popular because it is popular... ugh. :P

</comment></comment><comment><USER9> Clojure is popular for these exact reasons. Clojure apps are deployed like any Java app, and they can access the huge library of Java.

Java also deploys an image that needs to be executed in a runtime, but the industry is so familiar with the JVM that it is a moot point.

</comment><comment><USER10> Here's an example of building an executable using CLISP on windows: [http://grault.wordpress.com/2009/10/30/common-lisp-gui- appli...](http://grault.wordpress.com/2009/10/30/common-lisp-gui-application- shipment-delivery-on-windows/)

</comment><comment><USER11> (deliver 'my-main-foo-function "/Users/joswig/lispfoo" 0)

Delivers an executable as a single file in LispWorks. Most implementations have something similar depending on what kind of architecture they are based on). Exceptions are Lisp to C compilers and Lisp Machines. But it is unlikely that you will use one of them.

</comment><comment><USER12> I had the same issue learning the standard library. It's huge, redundant (I think...), and has completely unsearchable names and no organization or hierarchy.

I seem to remember sbcl having some way to compile real executables though, someone back me up on this?</comment>


Sun's Puzzling Plasma Recreated in a Laboratory - <AUTHOR> https://www.quantamagazine.org/suns-puzzling-plasma-recreated-in-a-laboratory-20190729/ <comment><USER2> I've never understood how the sun's magnetic fields are described as entities in their own right. Isn't a magnetic field a result of a moving charge, and not a thing that can exist on its own?

Or is that simply a shorthand way of saying the plasma creating the magnetic field is moving which causes reconnection, etc.?

But the plasma is also described as moving _because_ of the magnetic field moving!

So which is it? Anyone able to explain?

<comment><USER3> > Isn't a magnetic field a result of a moving charge, and not a thing that can > exist on its own?

No. Even in the absence of any charge at all, moving or otherwise, Maxwell's equations still have a nonzero solution. This is known as "light".

<comment><USER4> To elaborate on this a bit: you can talk about electric and magnetic fields as properties of space itself, and they have a fully-established physical reality to them. Moving charges appear as terms in Maxwell's equations making contributions to the field, but the field is the ground truth.

Magnetic fields from moving charges are pretty cool because you can show that they are equivalent to electric charges with relativistic effects due to charges' motions factored in. But thinking about relativistic motion equations for a huge number of particles is a tough starting point conceptually if you're just trying to find how a particle at a particular point in space will behave. So pragmatically, magnetic fields are a great conceptual tool. They also hold up straightforwardly once you bring in special relativity.

One thing that's very nice about electric/magnetic fields is that they are local. You can calculate the effect of magnetic forces on solar ejecta by just calculating the local field. It's much simpler conceptually to talk about how a particle will respond to a local magnetic field than it is to talk about how it will respond to a tremendous number of moving charges. It also ends up being very mathematically elegant; Maxwell's equations are very beautiful and conceptually simple, and their common applications are likewise beautiful and simple considering the seeming complexity of EM phenomena.

Furthermore, in some cases, like those involving light (EM waves propagating through space and time), you don't even have the luxury of knowing where the charges are that produced the field/how they moved: if a light wave is striking a piece of material from some distant light source, _the only thing you know about /can measure is the field itself_; it's therefore really nice to be able to do all of your calculations using the field.

But EM fields are more than just frameworks for understanding or calculating forces. They are very physical things. EM fields can literally carry linear/angular momentum and energy away from them. Let's say you have a satellite shaped like a long bar with two lasers at opposite ends pointing in opposite directions orthogonal to the main axis of the craft:

                           ^
      beam 1 points up ->  |
                           </comment></comment></comment><comment></comment><comment>==
                                        | <- beam 2 points down
                                        v

Firing these lasers at very high power is like firing very weak thrusters, and _your satellite will start to rotate_ ; its angular momentum will change! Even though the light waves from those lasers are not interacting with intervening matter (at least in the classical picture), it's _still carrying carrying away momentum and energy_ ; from the center-of-mass frame, the EM field now has clockwise angular momentum (from the view of the above diagram), while the satellite has an equal and opposite counterclockwise angular momentum.

This comes up again in general relativity, where EM fields energy and momentum contribute to the curvature of spacetime in _precisely_ the same way as mass does. In other words, if you had a huge amount of light passing through a region of space, it would be just as gravitationally attractive as an equivalent amount of mass (after converting units using E = mc^2).

When you think about it, conservation of momentum + the speed of light + EM fields' ability to move objects (i.e. change their mass and momenta) _necessitates_ that they have this sort of physical reality. In the bar- satellite example, the laser beams are pushing back on the ship; since light doesn't travel infinitely fast, there is no equal-and-opposite reaction from some regular matter that the EM fields would mediate instantaneously, i.e. no regular matter that's pushing against the satellite to get it spinning (as would be the case with a regular thruster used for stationkeeping). The momentum has to go _somewhere_ ; as it turns out, it goes into the field itself in an extremely well-defined way.

So, again, EM fields are the real deal; moving charges _contribute_ to fields, but the fields themselves have their own well-measured, well-described physical reality in classical physics.</comment>


UK Parliament Rubberstamps Mass Surveillance Law - <AUTHOR> https://techcrunch.com/2016/11/17/uk-parliament-rubberstamps-mass-surveillance-law/ <comment><AUTHOR> This is a re-post but I think it's important to elevate awareness.

Related:

[http://europe.newsweek.com/ip-bill-most-extreme- surveillance...](http://europe.newsweek.com/ip-bill-most-extreme-surveillance- law-ever-passed-democracy-516573)

[https://www.eff.org/issues/uk-investigatory-powers- bill](https://www.eff.org/issues/uk-investigatory-powers-bill)

[https://www.engadget.com/2016/11/17/uk-ip-bill- surveillance-...](https://www.engadget.com/2016/11/17/uk-ip-bill-surveillance- law)

[http://www.wired.co.uk/article/ip-bill-law-details- passed](http://www.wired.co.uk/article/ip-bill-law-details-passed)</comment>


Italian village offers $2,100 to boost falling population - <AUTHOR> http://www.cnbc.com/2017/05/09/italian-village-offers-2100-to-boost-falling-population.html <comment><USER2> The "applications" seem now to be closed, and the linked Facebook post from the BBC source has been removed (or, I can't see it for some other reason).

If anyone has more information as to the terms to which this offer was subject, or a link to the original Facebook posting I'd be glad to see it.

<comment><USER3> From the mayor's facebook page (though not the original post): [https://www.facebook.com/daniele.galliano.56/posts/143193966...](https://www.facebook.com/daniele.galliano.56/posts/1431939663519645)

Translated:

"This will be my last post and I hope to be able to provide clarity.

My it was an idea to propose to the region of Liguria, with which I am in contact, and extended only at national level. The news was reported in the wrong way and has reached a worldwide audience.

Italy is a beautiful country but like others in the economic crisis, to today are followed by more than 17.000 people and unfortunately it's not really possible to find a help to all. Thank you for your interest.

I don't have other profiles, so if there were more news in my name are fake."</comment></comment>


How the Cruise Industry Became Synonymous with Disaster - <AUTHOR> https://slate.com/business/2020/05/cruise-industry-disaster-history-coronavirus.html <comment><USER2> Probably ever since 'The Poseidon Adventure'.

[https://en.wikipedia.org/wiki/The_Poseidon_Adventure_(1972_f...](https://en.wikipedia.org/wiki/The_Poseidon_Adventure_\(1972_film\))

<grin></comment>


A blackhat social engineered me by posing as an early adopter of my startup - <AUTHOR> http://blog.codeboff.in/2010/09/23/social-engineering-attack/ <comment><USER2> Summary: The author of the article has a web app that allows you to administer programming tests to job applicants. The two languages currently supported are C and C++. As part of that process, (I'm guessing) the code needs to go through some sort of compilation process.

The author of the article had left a default whitelist on the production box that whitelisted /dev/random as being readable. The attacker compiled a program (took a test I'm guessing) that included /dev/random. The author found out based on ip and sheer luck that the attacker was a user of the system that he had corresponded with previously.

The reason I summarized this is because I wasn't totally clear on what codeboff.in was from the article. It makes sense how an attack like this could happen. The author seems to really know his stuff and the attack vector really was a small oversight. It's pretty unsettling to me, though, how persistent/insane this attacker seems.

<comment><USER3> From the perspective of an information security researcher with plenty of time spent working on both sides of the issue, I can tell you that any attacker worth their salt will be persistent and use multiple attack vectors to get what they want. This holds true for bored teens, corporate spies and real penetration testers (not just dorks that get paid to run scanning tools on your network) alike.

I've spent the last decade doing mostly IT Security defense work. I don't worry when I see someone port-scan my servers. Those kiddos are almost always benign. I worry when I see that our IDS starts to correlate many subtle attacks over a long period of time from similar places (such as the same school, ISP, etc)

<comment><USER4> You should be most paranoid when you see/hear nothing

<comment><USER3> Please. No attack is perfectly stealth.

Keep in mind I've played both sides of this game. People who know how attacks work in the wild can usually spot things that might not raise the ire of average sysadmins.

<comment><USER4> So you are saying that in 2 minutes that you aren't watching logs somebody can't gain access, clear out the IDS and other logs and reset tripwire?

<comment><USER3> No, I'm saying an attacker would also have to find and destroy the immutable central logging store that all the stuff goes to. They'd also have to reach through the sands of time to get the stuff that's already been blowing up my phone. Get over yourself.

It's worth mentioning that no one is perfectly secure, either. A sufficiently bored, persistent and motivated attacker WILL find some kind of way in. I'll give you that. I've seen it play out enough times. But with centralized logging, transaction shipping for hot-site replication, and sufficient effort placed on separation of duties, an organization can minimize the impact a successful attacker can have, and can ensure that all audit trails remain intact in some way or another.

<comment><USER4> I am over myself. Note that everything I replied with was a question, and that I haven't had to proceed anything I have said with something like 'Keep in mind I've played both sides of this game'.

Anyway, to go on (keep in mind that I am genuinely interested in what you have to say). Isn't it true though that your IDS is only as good as your signature db? So if there was sshd or ftpd 0day that wasn't generic (generic shellcode etc.) that in theory you could spawn a shell without it ever being logged?

<comment><USER3> It's true. You could. But that shell and the activities therein would get logged in places that would make it hard for most attackers to cover their tracks. Mandatory Access Control and privilege separated daemons should also severely limit what that shell can do.

I'm not trying to have a pissing contest, but the reason we have defense in depth isn't to get 100% secure. You and I both know it's impossible. It's also there to preserve evidence if the unthinkable occurs. I do genuinely appreciate the forward thinking, so I'm sorry if I was a tad harsh in my reply above. Your responses (and your HN bio) came off a tad skiddie-ish at first blush. Being in infosec, where "Hacker" has a different meaning and stigma than "Hacker" in HN was originally meant to convey, I'm actually glad there are threads where Infosec "hacking" discussions can occur without getting completely buried by haters.

<comment><USER4> It's ok and thanks, I know I can also come across as terse/dickish sometimes. My profile is intentionally vague just because I prefer being anonymous (this is my 5th or 6th profile on here).

I worked in infosec (on all 3 sides, if you know what I mean) from the mid to late 90s, and then became disillusioned with the entire industry and left for greener pastures. I still attempt to keep on top of things (and have done the odd contract job here and there) but I am not all that up with everything going on.

Wrt the topic, what you are saying is that even with my /bin/sh running in the context of whoever sshd or ftpd are running as, by the time I figure out a local escalation, by then the activity on that shell has already been sent to another machine and onto your phone etc?

<comment><USER3> That was, of course, hyperbole (about blowing up my phone) however on certain very sensitive systems I do have a kernel module that provides a wrapper to execve() and that goes directly to a remote logging server and gets replicated. Yes, it's fucking noisy, but storage is cheap and databases are searchable.

As you well know, a careful individual can evade it if they know it's there, but the initial prodding would get logged.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> If I could give one piece of advice to every startup who is worried about server security, it would be this: read the NSA's two page pamphlet for hardening Red Hat Enterprise Linux [1] for a quick overview and then move on to the ~200 page complete guide [2]. The principles are generally applicable to most Linux systems.

The NSA's guide is good enough for low value targets. Besides, these are your tax dollars at work, so you really should make use of them. :-p

[1] [http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731....](http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.pdf)

[2] <http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf>

On the web application side, you're going to want OWASP. <http://www.owasp.org/index.php/Main_Page>

EDIT: Just thought of something.... There were several privilege escalation exploits for the kernel made public around this time frame [3]. I'm guessing that's the reason why his kernel was silently upgraded. :-p

[3] <http://www.ubuntu.com/usn/usn-988-1>

<comment><USER6> When I started managing my own VPS, I found the Linode Library's Linux Security Basics to be a fantastic primer.

<http://library.linode.com/using-linux/security-basics/>

<comment><AUTHOR> Thanks, I checked that list. All clear!

</comment></comment></comment><comment><USER7> It's never too early to educate your employees about social engineering. My startup is small but has been targeted a few times by people trying to social engineer their way into more information.

An employee of one of our direct competitors even called one of my developers to try and extract information - good thing she caught on quick. We eventually tracked a number of attack vectors to either him or his company. They weren't the brightest attacks though (calling her from his work #, emailing her and other employees from email addresses which he'd used online, running port scanners and SQL Injection tests (etc) on our servers from company IP addresses).

Other times people call pretending to be customers, but they don't pass the smell test. We've had a few people call with tons of questions about our tech, capabilities, existing customers, etc, but won't divulge much of their own information or can't properly answer some of the basic questions that our real customers would know.

Early customers are kind of like a job interview, it has to feel right for both sides.

<comment><AUTHOR> > Early customers are kind of like a job interview, it has to feel right for > both sides.

So right. I consulted for a while as a programmer. It took a few times being burnt before I could distinguish between the good and the bad clients, but after that the difference was night and day.

<comment><USER8> Interesting. Could either of you expand on that? What qualities do you now look for in a client/customer?

<comment><AUTHOR> The biggest thing I look for is to be clued in to the feasibility and difficulty of their commission. If someone wants a Facebook clone for $500 and/or finished in 3 weeks, I'd walk away immediately. I guess that's an exaggerated example but if a client is completely non-technical it's almost always too painful to work with them directly.

I don't agree with 'never say no to a customer' in software development work.

</comment></comment></comment></comment><comment><USER9> Huh? I don't see how this person is a "blackhat". Just because they are playing with your server and trying to find holes doesn't mean they are intending to maliciously exploit them.

I also don't see how it is social engineering. What did the attacker convince you of?

<comment><AUTHOR> They didn't mention it on the emails at all. It was the contrast between 'my son is named x' and 'i kill u' that scared me. What I should have mentioned in the blog post was that there were other messages they left as comments in the code they submitted.

So at the moment you have to leave an email address to take an open test. (This will change soon to no address required). The guy consistently signed in with a fake email address, email to which was bouncing. I blocked that email address, which amounts to not accepting it to let someone sign in for an open test. This is just a soft warning, of course. So the guy appended a character to the address, and left me the message: "Why have you blocked firstname.lastname@example.com? Too bad codeboffin!" I just don't see why they couldn't have discussed it on email on which they were already in mid-conversation with me.

I presume the social engineering was coming. I would probably have told the person anything he wanted to know about my security setup by then. I don't think I would have been as open to anyone else off the bat.

<comment><USER2> Totally off topic but I love the concept of code boffin and wish you the best of luck with it.

<comment><AUTHOR> Thank you very much!

</comment></comment></comment></comment><comment><USER10> No social engineering took place unless you gave up something you shouldn't have. Someone was friendly in email and was playing around with your code submission system seeing how far he could push it. rm -fr * is a nice joke on you for letting it slide and the #include /dev/random is just funny.

</comment><comment><USER11> What surprised me is how this one evil guy took the effort to hack his server. Some strange motive is in place. Usually they scan ip addresses and ports and attack servers randomly.

<comment><USER12> The former case happens when the attacker challenges himself to just do it. Motivation may increase with time. This is the attacker mindset.

The latter is when any host would do the trick (relay, host platform, whatever).

</comment></comment><comment><USER13> Just a technical question: Shouldn't you use a virtual machine (or similar) whenever you let anything user created run (or compile) on your machine?

<comment><AUTHOR> I do! It's a separate (and smaller) linode VPS from the one that houses the app servers.

<comment><USER13> Would it be feasible to have one (short-lived) VM per user?

<comment><AUTHOR> Not if they're running linux. It's an interesting idea though! Food for thought.

<comment><USER13> If you do something like copy-on-write (for storage, and possibly for memory, too), it could be fairly light-weight.

Disclosure: I am working on XenServer.

<comment><AUTHOR> That's neat. What I'd worry about is boot-up time. I let people compile and test their program with an AJAX button in the middle of taking a test. It's already 3-4 seconds before they get the result back, more delay would hurt.

With tasks queuing up as they already are, I might not be able to keep a fresh VM pre-warmed every time, either.

edit: The other factor is of course the prospective cost of a brand new configuration. Unless I find I can't prevent the current config from being breached and ephemeral VMs will fix it.

<comment><USER14> Check out U of T's Snowflock. Very fast VM cloning and destruction.

<http://sysweb.cs.toronto.edu/snowflock>

<comment><AUTHOR> Hundreds of milliseconds, wow. Thanks!

Ach, I see now what eru meant by copy-on-write VMs.

<comment><USER13> Yes. Booting up every VM would take too long. Cloning them just before you execute the payload is the way to go.

(At least as long as you have a general purpose operating system. A special paravirtualised would probably not need to make much of a difference between booting and resuming. But that's only a theoretical musing for your circumstances.)

<comment><AUTHOR> Many thanks for the tip.

This is my new plan of last resort if I can't prevent the current sandbox from failing.

<comment><USER13> Please keep me informed (email@example.com) on your progress, if you go this route. Thanks!

<comment><AUTHOR> Will do!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I fell out of my chair laughing when I read this:

"So of course, the blackhat compiled a C program with #include "/dev/random" in it, and gcc was hosed."

<comment><USER13> Including /dev/urandom would also have been interesting. (I am assuming this was a Linux box.)

<comment><AUTHOR> Yup, that was on the same whitelist.</comment></comment></comment>


Cell-level Three-way Merge in Dolt - <AUTHOR> https://www.dolthub.com/blog/2020-07-15-three-way-merge/ <comment><AUTHOR> We blogged about how Dolt implements `dolt merge`. Merges of divergent histories in databases is a super interesting problem in general. Dolt takes a simple approach that works pretty well for the dictionary style databases we're currently targeting as a use case, but we would love to hear feedback on our approach and communication in this space in general.</comment>


U.S. gasoline sales by refiners - <AUTHOR> http://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=PET&s=A103600001&f=M

<comment><USER2> hm… i'm trying to make sense of this. from what i gather (based on [http://www.zerohedge.com/news/2014-05-30/us-gasoline- consump...](http://www.zerohedge.com/news/2014-05-30/us-gasoline-consumption- plummets-nearly-75)), "Total Gasoline Retail Sales by Refiners" is a measure of production and is not necessarily consumption, due to storage capacity. still rather remarkable - i didn't realize we've topped out our storage/reserves.

<comment><USER3> One measured thing you can use to guess better at stocks lies here:

[http://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=PET&s=W_...](http://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=PET&s=W_EPC0_SAX_YCUOK_MBBL&f=W)</comment></comment>


Revolution Pi, an open, modular and inexpensive RPi-based industrial PC - <AUTHOR> https://revolution.kunbus.com/revolution-pi-series/ <comment><AUTHOR> I'm rather excited by these. I work with B&R industrial controllers at the moment, and it would be lovely to replace the proprietary Windows-only toolchain with a standard-ish Linux system, while retaining the toughness and extreme I/O flexibility of the industrial system.

Planning to get my hands on one someday soon.

<comment><USER2> What do you think of the prices? I imagine many people will get sticker shock, but is this a good price in the world of DIN-rail-mounted embedded computers?

<comment><AUTHOR> They're roughly comparable to the controllers we use.

A B&R Atom-based controller with 512Mb-2Gb of RAM will set you back £600-£1200 depending on speed and RAM size. I/O modules are a bit cheaper on B&R, but their capabilities are much more limited: four analogue inputs or outputs, or dix digital inputs or outputs, per module. The RevPi digital modules also have built in counters for encoders, which is a separate and more pricey card on B&R.

So, it's certainly not a low cost system, but it seems to be one that's designed for parity with the existing industrial controllers, rather than being lower cost but much less capable.

I'm not sure how it compares to systems from Wago, Siemens etc, but a quick Google seems to indicate that they're also in the same price range.</comment></comment></comment>


Ask HN: Problems/Limitations With Online Shopping? - <AUTHOR>

Been focusing my attention towards online shopping, deal aggregation, and similar sites lately for some reason or another. I know none of us like sharing innovative ideas, but I've been trying to brainstorm what this industry is missing or could use. There hasn't seemed to be too much change in the area. Was curious if anyone had any thoughts on the problems, limitations, or anything related for the online shipping industry - any personal frustrations, etc. <comment><USER3> My biggest problem is with stores that try too hard to be innovative and end up making the process harder. But then, they don't frustrate me too much as I just won't use them.

Other frustrations:

\- Gauging availability

\- Having easy access to shipping cost info

\- Offers or product names that _aren't_ links. If something says "T-shirt sale, $10 each" I want to be able to click on that to see that sale!

\- Lack of a categorized view. I want to easily see OTHER products that are very similar to the current one. If I'm looking at a blue shirt, I want to easily find a yellow one (say).

\- High shipping costs. I gotta admit, "free shipping" gives me an instant shopping boner, even if it makes no sense. It just makes me more likely to buy.

\- Lack of details. If electronics equipment, I want access to the full specs, including dimensions, etc. If clothes, I want to know the sizes and what scale was used (e.g. US size, UK size, or what?)

\- Ridiculous registration requirements. I don't want to fill out a 30 field form to become a "member" of your shop. Ask for the absolute minimum to start and then get the other info over time as I become faithful to your brand.

\- Lack of any review functionality. Sometimes it doesn't matter, but on many items it does. Even if you're just getting reviews from elsewhere, I wanna see them.

\- Sites that don't fully use HTTPS through the whole checkout process.

Things I would like:

\- Better search.

\- Support for tagging. I like _browsing_ by tag.

\- "Random" product link. Not for every store but on some it would be awesome. I like browsing!

\- Make it easier for me to _browse_ when I don't know what I want. (I think I've made the point now, lol)

\- Offer a clean but powerful advanced search. If I want to buy something for $5-$10, I should be able to limit searches to that.

\- "Similar items" when looking at an item. Even if it's just a few with similar names, it helps.

\- Easy access to _high resolution_ imagery of the product. Let me click on the thumbnail / smaller image to get more awesome shots. It's a big deal when you're looking at the positioning of ports on a notebook, for example.

\- Cheaper and more expensive alternatives to the current product. This is a touchy area for the actual store providers but as a customer I want to quickly work with my budget. Sometimes I want to spend more on something better, or sometimes less.

\- Products on the front page of the site. I don't want to have to dig just to reach a single product.

Things I don't care about:

\- Comparison tools. Most are useless. If I really want to compare something, I'll load them up in separate tabs and just figure it out after looking at them both. Very few products come down to a spec by spec comparison.

\- Splash pages.

\- Overuse of "theme" imagery. A common problem with clothing sites. I understand building a brand, etc, but in the store section, give me product.

<comment><AUTHOR> Great list - what shopping site(s) do you use?

".. instant shopping boner" - <USER2>

<comment><USER3> I use any site that seems professional and competent if I want something I can't get either at Amazon UK ( <http://www.amazon.co.uk/> ), Play.com ( <http://www.play.com/> ), eBuyer ( <http://www.ebuyer.com/> ), or similar large sites (those are all UK examples, just because that's where I live).

eBuyer is worth a look actually, as they've tended to implement a lot of the features I mention above, such as full specs on most products, high res images, easy browsability, etc. They might have some ideas you can "be inspired" by :)

Oh, to add to my previous list. If I were in the US, I'd want to see the price including tax (alongside the regular price) if I were in the same state at the store. Having the price leap up at checkout is not nice (as I constantly whine when shopping in the US).

<comment><USER4> Good point about the sales tax, I hate getting whacked with an extra 10 bucks at the last step of checkout. I assume they're waiting until you give a billing address, but at least make an attempt with geolocation.

</comment></comment></comment></comment><comment><USER3> Something else I realized I always do..

If I see a "promo code" box when buying, I _always_ Google for a promo code for that store, or try retailmenot.com to see if they have one.

Sometime I get one, sometimes I not, and I feel a teeny-weeny pissed off when I don't find one that works as I feel someone else is "beating" me. So.. perhaps seeding a very, very tiny discount promo code out there for people like me would make me remember your store more because you let me "win" for my ingenuity :)

</comment><comment><USER5> I get this feeling that clothing is _THE_ consumer product but nobody buys clothes online because:

1) sizing is screwy

2) it's impossibly kludgy to browse clothing, textures, etc.

3) a painful return process

SO, I'm waiting for a department store with:

1) ONE pair of each item

2) ZERO inventory,

3) With all that additional space, a MASSIVE selection

3) Everything gets shipped straight to your home.

When you walk into the store they measure you, scan your credit card, and hand you a barcode scanner. Scan what you want and the perfectly sized clothing shows up on your doorstep in a day or two.

Nice side effects:

1) No more fear because it's easy to take back to the store if you don't like it.

2) For all the people that don't live in NYC or LA there would finally be a store with a decent selection...

3) Few clothing stores actually track purchases-- finally, you could now have a killer recommendation system that people would actually trust.

Solves so many problems (and probably creates a few). It kind of reminds me of Service Merchandise back in the day where they only had one item out front and everything else in the warehouse-- except now the warehouse is in "the cloud" so to speak.

...I already do this at Barnes & Noble-- browse for what I want and I've already Amazon Prime'd the book before I walk out the door...

Beyond the obvious technical challenges to me the biggest question is whether the economics of it works when you individually ship everything from a central location.

<comment><USER6> Disagree that no one buys clothing online. It's a massive industry.

Agree that the process is broken. I know someone who orders multiple sizes and colors of a single item and returns most of it after trying it all on. Lot of obvious inefficiency here.

I wonder how much a place like zappos (great return policy) pays for all the returns at the end of the day. I know shoes aren't clothes strictly speaking but it suffers from similar issues.

</comment></comment><comment><USER4> There are two major things I want from online shopping:

Real time stock data. I don't care so much about quantities, just whether or not my size/color is in stock -- though a "low quantity" warning would be nice.

Ship my order within 24 hours, and with "free" overnight shipping. If I order a pair of pants tonight (1 am on Thursday morning), I should have them Friday. Now I know nothing's really free, but build it into your prices; don't make me think. Pull this off, and you're 80% of the way to matching brick and mortar retail -- it takes a day or two to build a shopping trip into my schedule anyway.

<comment><AUTHOR> Interesting and good suggestions. I've been thinking more about aggregation, comparison, organization, etc, aspects - not exactly the 'store' behind the scenes.

<comment><USER4> Regarding aggregation: I don't use rss at all, no feed collection, no feedreader. I get mostly everything I read online from HN and sites like it.

I'm not aware of anything similar for clothing. My process for checking out new stuff looks a lot like my tech news process did a year or two ago: type in techcrunch.com, read, type in mashable.com, read...

I'm not saying digg-style voting and karma is the way to do it, but I'd love a place where I could get the same kind of curated updates and discussion about new clothes/gadgets/etc. I certainly wouldn't check it every day like I do HN, but I imagine there are people who would.

<comment><AUTHOR> well a number of large shopping sites and deal/coupon sites work based on aggregation. the user doesn't need to know anything about it. look at like.com - an amazing shopping portal/search engine - all aggregation. they just refer to products on other store sites.

<comment><USER4> like.com is definitely impressive, but I guess the point I mean to make is that sometimes I don't want choice. When I come to a site like HN, I get 30 vetted stories and discussions relevant to programmer-entrepreneurs.

Something similar for clothing, targeted to my demographic, (20s/male) would be hugely useful.

</comment></comment></comment></comment></comment><comment><USER7> (Slightly off topic) I know there are a lot of startups doing a physical- internet crossover similar to QRCode, but they read bar codes instead. The only issue I see with this is that not every item has a bar code (i.e. clothes) and it requires the cooperation of both online and brick-and-mortar stores.

Augmented reality for physical shopping anyone? Stick RFID/bluetooth emitters in the security-ink devices, stick the security devices to the clothes, and then pull out your phone to get relevant information.

</comment><comment><USER8> They don't ship worldwide. Sometimes they do, but not for every item. And they don't make it clear from the start.

This is the biggest single limitation that I encounter constantly.

</comment><comment><AUTHOR> thanks for the comments everyone</comment>


Ask HN: What do you wish you had learned earlier in your programming career? - <AUTHOR> <comment><USER2> 1\. Negotiate your salary.

2\. If you're new in a programming language and you're deploying to production for an important customer, make sure you get a code review first.

3\. Writing software isn't the important part, solving problems is the important part. ([https://codewithoutrules.com/2017/07/10/stop-writing- softwar...](https://codewithoutrules.com/2017/07/10/stop-writing-software/))

4\. Productivity is about doing _less_ work, by avoiding waste. It took a while to get all the related skills here, and most of them don't have to do with coding as such. ([https://codewithoutrules.com/2017/10/04/technical- skills-pro...](https://codewithoutrules.com/2017/10/04/technical-skills- productive/))

5\. Testing comes in different forms, each with its own purpose. Spent years getting to a place where I could articulate how to choose, and then I gave this talk about it: [https://www.youtube.com/watch?v=Vaq_e7qUA-4&feature=youtu.be...](https://www.youtube.com/watch?v=Vaq_e7qUA-4&feature=youtu.be&t=63s)

</comment><comment><USER3> At the end of the day, we write code not for its own sake, but to solve problems in real life. After realizing this I abandoned several pet projects that were basically going nowhere and only taking up time--they were not designed to solve a problem.

Also if you don't start something the right way, it is quite difficult to fix it. I spend more time now thinking about appropriate data structures, project layouts, etc. before I jump in.

</comment><comment><USER4> People matter. It matters that you are factually correct, but how you treat people also matters. Learn how to treat people with tact and consideration, even when you disagree with them.

<comment><AUTHOR> Spot on.

Lose the dogmatism.

People remember how you handled a problem, not what the problem was.

Relationships with others are more important than being right about some technical thing.

</comment></comment><comment><AUTHOR> How to use a debugger.

That the more time you invest in learning debugging tools, that faster your overall development process will be.

</comment><comment><USER5> Not to minimize lines of code at all cost, repetitive but clear code is better than clever code with many abstractions.

Design user interfaces around workflows not database tables.

Unix. Sed, grep, awk, bash and more. Learn them all well.</comment>


Ask HN: Best on site developer training - <AUTHOR> I have been tasked with finding a company that will provide onsite Java training.  The students are all senior developers, but mostly in controls and C, all pre OOP.
Which services would you recommend, and why?
We would like to avoid online training, and self taught video/tutorial series. <comment><USER2> I work for a coding bootcamp that also offers onsite corporate training. Our focus is ruby/rails/javascript/API not Java. We may not be the best fit but I can recommend New Horizons. Here: [https://nhlearningsolutions.com/FindTraining/Java/tabid/2904...](https://nhlearningsolutions.com/FindTraining/Java/tabid/2904/Default.aspx)

Looks like they offer Java 8 training. If I remember correctly onsite 5 day training cost 20k-25k for 10+ people who already have dev experience. Pricey but a lot cheaper than hiring a team of Java developers.

Feel free to email if you have any questions or happen to be located in the Chicago/New York/San Francisco area and want to talk about what we can offer. email@example.com

<comment><AUTHOR> Thanks I'll look into them.

</comment></comment><comment><USER3> My company specializes in onsite training. Courses are taught by an expert, small class size to ensure quality (12 max), meticulous definition of every term, correct sequence of presentation of materials so that everyone understands -- and plenty of lab exercise to cement that understanding! I've had students remark it was the best training they've ever had. We started out training system administrators but now train developers as well (and everything in between).

</comment><comment><USER4> It's not ground up training, but once you've done that...and have a decent base of Java skills on place...

You might consider talking with either ThoughtWorks or Pivotal Labs. Both have deep Java expertise, but more importantly, the ability to have your team members work side by side with them on the other aspects of dev methodology.

Neither is inexpensive, but may be helpful if your team is trying to bridge more than just a Java knowledge gap.</comment>


Ask HN: Best way to put a database on the web? - <AUTHOR> I have some data that is currently in an xlsx. I'd like to put this data on the web, as is, so that it is queryable by anyone via a UI. ie someone visits mydatabase.com and they can perform ad hoc queries (SQL, some slick UI, whatever works) on the data.
The data is not big, it's a single sheet with about 20 columns and less than a million rows (however the xlsx file is too large to import in to google drive sheets, and attempts to save as csv have failed). I don't care if it is SQL, cloud based, some other service. I'm not concerned about cost. I don't need authentication or authorization or anything. I'm optimizing for just getting the data out there and ease of querying. I would like to be able to see visitor analytics if possible.
Before I go writing a webapp to do this, there must be something off the shelf? <comment><USER2> Oh dear, I think your file is already too big to handle it easily. How big is the file?

First, get the data somehow to plain text. LibreOffice is maybe able to convert it to an CSV file. Otherwise you have to open it with Python (for example) to export the data to a text file or directly to a database.

Best way is to find a web hoster which allows you to make the database public. With this solution you can transfer the XLSX columns one by one (with Python) to your online database. After finishing change the database from public to local.

An easy UI in PHP isn't really a thing.

<comment><USER3> Xataface is pretty quick and easy. Xataface.com

</comment></comment><comment><USER4> Checkout [https://datasette.readthedocs.io](https://datasette.readthedocs.io)

</comment><comment><USER5> Try looking for a separate xlsx to csv converter that doesn't have the limitation saving to csv. That'll get you part way to being able to import the csv into a db or something you can query.

Edit: you'll likely have better luck with offline utilities, online ones could fail on size.

</comment><comment><USER6> Something like indexDB our one of the layers on top if it are probably good solutions.

CSV is probably easier to work with, if you're having trouble converting from xlsx to csv, DM me and I can help out.

My email is in my profile.</comment>


How Snowden Escaped - SG- http://news.nationalpost.com/features/how-edward-snowden-escaped-hong-kong <comment><AUTHOR> I don't understand how Snowden was able to fly from HK to Moscow. Was his passport revoked after leaving HK? It seems strange that the US requested extradition from HK but would not revoke his passport.</comment>


The Surreal Madness of Ethereum's Pyramid Schemes - <AUTHOR> https://medium.com/@optimumregret/the-surreal-madness-of-ethereums-pyramid-schemes-da705fe7d92e <comment><AUTHOR> > Later, the OG PoWHcoin smart contract — that immutable, incredible > construction made out of memes and duct tape — was drained completely of its > $2 million total, leaving Ponzibot with the loss of over $2.5 million on his > hands.

> How?

> Because the developers of the OG contract had failed to use the safe math > functions included in Solidity, the language of Ethereum's smart contracts, > this allowed an unknown hacker to make an unsigned integer underflow > withdrawal — giving themselves an infinite number of PoWH's tokens to > withdraw, and draining the contract.

It is absurd that one needs to _opt-in_ to unsigned integer underflow checking, especially in a language designed for writing financial contracts.</comment>


Australian Govt funds IT start-ups - <AUTHOR> http://www.zdnet.com.au/blogs/bootstrappr/soa/Australian-Govt-funds-IT-start-ups/0,2001092438,339292565,00.htm <comment><USER2> Boy, there's an idea that'll snatch defeat from the jaws of victory if ever there was one. Government and technology innovation, a match made in heaven.

<comment><USER3> Yep, and assuming equal distribution of tax (including children), I paid 15 cents for this. Realistically more like approaching $1.

So let me get this straight - pick n companies that are the most effective at sucking up to the govt, give them grant money, while hurting the rest of the (total - n) companies in the country, some of which will actually be profitable.

I don't have an intrinsic problem with the govt investing in start ups, getting their returns as tax dollars (I don't think it's the governments role, but if they were profitable I wouldn't have a problem with it), but when will they wake up and realise that they're no good at it?

</comment></comment><comment><USER4> A client of mine received a COMET grant in a previous cycle. The article gives a poor impression of what the COMET scheme was designed to do - allow small businesses with little capital to commercialise their technology so as to be able to bring it to market effectively. Grantees are required to match twenty percent of the grant they spend.

There are guidelines to how the money may be spent, but as long as it's towards commercialising your technology, they are satisfied (i.e., you have a programmer as an employee, but you can contract out a programmer to complete the work required).

I've heard most businesses in the scheme don't end up profitable, but this is no different from your typical VC fund. While some of the businesses listed may not appear innovative, there are plenty striving to serve a niche, my client being one of them. The technology platform isn't particularly innovative, but the research behind it is solid and the implementation is getting fantastic results.

If there is but a single success from this scheme, then it will have all been worth it.

<comment><USER5> unless it competes with my business.

</comment></comment><comment><USER6> _"... bootstrappr trawled through the list and pulled the most obviously web 2.0 or IT-related companies out ..."_

$64K AUD for escalator advertising isn't really web or software. I think the IP is tied up in the printable media ~ <http://www.escalated.com.au/faqs.html> Grants like these are pretty funny affairs. If you satisfy the criteria you can spend the money as long as the guidelines are followed & you keep the receipts for a set period of time.</comment>