Israel's Cyber-Spy Industry Helps World Dictators Hunt Dissidents and Gays - <AUTHOR> https://www.haaretz.com/israel-news/.premium.MAGAZINE-israel-s-cyber-spy-industry-aids-dictators-hunt-dissidents-and-gays-1.6573027 <comment><USER2> HaArtez has a pawywall, which is unfortunate.

This industry seem to be comprised of morally bankrupt executives and that's a shame.

The worst part is that Tamar Zandberg, a leftist party leader, tried to get some of the companies' export license revoked, but the government flat out refused, saying that the export tax is prioritized higher than human rights violations.

<comment><USER3> > The worst part is that Tamar Zandberg, a leftist party leader, tried to get > some of the companies' export license revoked, but the government flat out > refused, saying that the export tax is prioritized higher than human rights > violations.

Was this refusal made in public? I'd love to read more about this.</comment></comment>


Ask HN: Making mobile consumable HackerNews cards - <AUTHOR> This is question to all pro users of hackernews. I am working on a product that makes different links consumable on mobile. Because hackernews is such a rich source of information, I am looking at making a hackernews link consumable on mobile. My biggest issue is the same, lot of information. Our current information on hackernews card shows minimal information about hackernews link. Mainly title, number of upvotes, number of comments and if its an article, then we fetch that article too. Its not a hackernews mobile client but we are doing it for multiple sources like producthunt, imgur etc so you can simple serach everything from this app and share a consumable card. But it is becoming very challanging to do the same for hackernews. I need honest feedback about if it is possible to do it for hackernews at all and if yes, what can I change? I know its a UX problem but I think would be better solved by users who constantly use hackernews.<p>Here is an example of card we have built for hackernews http://web.cubeit.io/web/index.html?id=7ee8b2b5-4aa9-49db-b054-b8cd1a9c28780 <comment><USER2> This might make a good "Show HN". In that case, just submit the link with "Show HN" in the title leaving the textbox empty.

Once the thread has been created, just add a comment to the thread explaining the purpose/asking for feedback.

Guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> Posted as show HN. Hoping for some quality feedback there

[https://news.ycombinator.com/item?id=11326880](https://news.ycombinator.com/item?id=11326880)</comment></comment>


Reasonably Secure Computing in the Decentralized World - <AUTHOR> https://www.qubes-os.org/news/2017/09/13/joanna-rutkowska-secure-computing-decentralized-world/ <comment><USER2> i'm developing an os with an architecture similar to qubes, in part because i disagree with the idea of using hardware virt as an isolation mechanism. i think this can be done with os virtualization much more cheaply without being much more difficult to secure. still quite early in the project, but i think we're touching on some interesting stuff.

[https://www.heropunch.io/tomo/os/grid/](https://www.heropunch.io/tomo/os/grid/)

[https://www.joyent.com/tech-videos/going-container- native](https://www.joyent.com/tech-videos/going-container-native)

[https://genode.org/about/index](https://genode.org/about/index)

<comment><USER3> Are you planning to use L4?

<comment><USER2> yes, I'm partial to seL4 in particular. I'm using flatpak as the application image format. these require sessions, but I see that as a plus. the goal isn't compatibility, rather to build an os platform specifically for running p2p applications. linux is a convenient abi and makes windows compat easy.

i am using linux and genode to compose a more modern version of the plan 9 system. other core tech includes ipfs, i2p, secure scuttlebutt, and mqtt.

</comment></comment></comment><comment><USER4> This is very interesting! At Praecantatio, we are actually working on something similar, though instead of using blockchains, we run ours like an ad network. If anyone is interested on working on distributed computing, drop me an email. Email's in profile!

[http://praecantatio.ai](http://praecantatio.ai)

</comment><comment><USER5> Can anyone who knows these things comment on the essential differences between Qubes and Sandstorm? Thanks in advance…

<comment><USER6> Product-wise, Qubes is for local desktop apps whereas Sandstorm is for web app servers.

Technology-wise, Qubes uses virtual machines whereas Sandstorm uses Linux namespaces and seccomp (aka containers, but Sandstorm's sandbox prioritizes security over compatibility, unlike most other container engines).

<comment><USER5> Thanks, Kenton!

</comment></comment></comment><comment><USER7> Classic Theo:

" _x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit._

 _You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can 't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes._"

[https://marc.info/?l=openbsd- misc&m=119318909016582](https://marc.info/?l=openbsd-misc&m=119318909016582)

<comment><USER8> You want the rest of the list of architectural security features Theo also doesn't believe in? It's pretty long.

For a very long time, Theo subscribed to the philosophy that the way to get a secure OS was to keep it as simple as POSIX and historical BSD would allow him to (and no simpler) while eradicating all the bugs. Eradicating bugs is obviously a good thing, but the track record of that strategy in the real world has not been great.

That's obviously changed over the last 5 years or so, but you should be careful reflecting DeRaadt cynicism from a decade ago into modern discussions.

Qubes is surely a better bet than vanilla OpenBSD.

<comment><USER7> We've had all the king's horses and all the kings men, working around the clock, decade after decade, applying layer upon layer of tweaks and countermeasures, and all we have to show for it is a sort of paper mache wad that no one fully trusts or understands. Fix one flaw, introduce two.

At the same time we treat the underlying hardware as inviolable because of "costs", which are probably just a drop in the bucket compared to the damage wrought by still using hardware that takes a life's work for a Linus Torvalds or a Matt Dillon to program, and even then there's still doubt about what they missed.

I just get the creeping feeling that we've got the economics backward, and that maybe it's time to do "code review" on the underlying architecture instead of investing in more bandages.

<comment><USER8> Something something definition of insanity is something something.

<comment><USER7> Serves me right for expecting anything more from HN's prince of bandages.

<comment><USER8> I shouldn't snark, but I'm making a serious point, which is that we've already tried retrenching in code quality improvement (and nothing else), and have already empirically seen that approach fail.

There are architectural components to our security problems (we still run systems with 1980s security models) and that needs to change.

By the way, I have no idea what "prince of bandages" means.

<comment><USER7> Layers.

I'm an embedded guy, so I'm looking from the outside in. Whenever I have to trunk something to the server room, they're usually trying to do _just one thing_ , like e-mail (just as an example).

Of course there's an OS firewall, but you can't trust that, so you have to have another firewall, and that doesn't help so much with DDOS, so there's also cloudflare, and the firewall doesn't understand e-mail, so there has to be an e-mail pre-filter, and you can't really trust the OS to isolate things, even though that's kind-of in it's job description, so you have to have a hypervisor, and since some things are too important to trust to the hypervisor, you have an extra box or two, and now that you have a half-dozen different systems in play, there has to be some form of monitoring service. I have seen almost every layer of this melt down in one way or another and take the rest of the chain down with it, and _that isn 't even my job_.

I just think if we had saner hardware, where we could write performant-enough code without having to dirty our hands with pointer arithmetic, memory boundaries, manual boxing and tagging, manual memory management / software- based garbage collection, etc., we'd at least be in there with a shot at writing an e-mail server that could be put straight behind cloudflare that would also let the IT guys drop their prilosec prescriptions and get eight hours of sleep every night.

edit: my main point is that PC architecture is garbage. when I wrote "code review", I meant over the silicon. Both DeRaadt and Rutkowska are putting their fingers in the dam. It's heroic, but it's also a waste of two very bright people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> love how this os is progressing, bit heavy still on the resources, but thats fair for a hypervisor, those tend not to run on potatoes. :D so much fun to fiddle with!

</comment><comment><USER10> The event was hosted by the Golem project: [https://golem.network](https://golem.network)</comment>


Millions of routers allegedly backdoored with malware that can't be removed - <AUTHOR> http://www.computerworld.com/article/3147958/security/millions-of-routers-allegedly-backdoored-with-malware-that-can-t-be-removed.html <comment><USER2> The writing in this article was so spectacularly unclear that it warranted this update:

> Update: Intel Global Communications wants to make sure you don't think the > latency issue from Intel's Puma chipset is related to the malware-infected > router problem. It's not; the chipset causing lag is a big problem of its > own. Also, he says the fix "is being deployed." Hopefully it won't take > months to roll out via ISPs.

It's obvious why this article is trash - it's a shameless rewrite of two other pieces that don't really have anything to do with each other (hence that update) and awkwardly spliced together probably because someone was up against their deadline and hadn't met their word count for the week.

If you want to know about the first half of the article, go and read the original:

[http://www.theregister.co.uk/2016/12/03/intel_puma_chipset_f...](http://www.theregister.co.uk/2016/12/03/intel_puma_chipset_firmware_fix/)

If you want to read about the second that the headline here talks about, reads the actual Motherboard article:

[https://motherboard.vice.com/read/hacker-claims-to-push- mali...](https://motherboard.vice.com/read/hacker-claims-to-push-malicious- firmware-update-to-32-million-home-routers)

I'd ask the mods here to consider changing the URL in the submission/title of this post to the Motherboard one as this ComputerWorld article is low quality.

<comment><USER3> This picture in that second article: [https://motherboard- images.vice.com/content-images/contentim...](https://motherboard- images.vice.com/content-images/contentimage/40224/1481045574667527.png)

Interesting that they didn't obscure the ip address in the login. It maps to an ISP in Ukraine...BlazingFast.io.</comment></comment>


Tired of enterprisey programming - <AUTHOR> First post here. Cheers to all.
I work as a Java programmer since 1999, but with all this mileage I do not consider myself a great programmer, only an average one.
Unfortunatelly most of this time I dealt only with Java, thus being a monolingual programmer... but I've never been a fanboy or evangelizer: I stayed with it for too long because as they say, I accomodated in my 'confort zone' instead of exploring new lands.
After reading and dabbling with few other languages (Clojure, Scala, Python and a little Common Lisp and Haskell) I became acutely aware of Java's limitations. This added to a slow but ever increasing impression that the Java's development/SW lifecycle is painfully slow, with low productivity and full of accidental complexities, like those absurd apparatuses Tom or Willy E. Coyote used to catch Jerry/RoadRunner in the cartoons (design patterns anyone? want a RefreshAuthorizationPolicyProtocolServerSideTranslatorPB class?).
Now, I'm growing tired of Java and am thinking of quitting it (how ungrateful), but I confess I don't know how to do that! Here in São Paulo / Brazil, Java is king, still has most of the jobs offers and pays fairly well. I'm in 40's, with two sons in high school and a housewife, so seems like I cannot risk too much.
What would you do if you were me? Try for example to learn and start contributing for something open-source as a ticket to enter in the brave not-so-new world of non-java programming? That seems not a bad idea, but how to start? <comment><USER2> > _like those absurd apparatuses Tom or Willy E. Coyote used to catch Jerry > /RoadRunner in the cartoons_

[https://en.wikipedia.org/wiki/Rube_Goldberg_machine](https://en.wikipedia.org/wiki/Rube_Goldberg_machine)</comment>


Can I Use Data to Beat Christie's Auction Estimates? - <AUTHOR> https://www.artnome.com/news/2017/7/27/can-i-use-data-to-beat-christies-auction-estimates <comment><USER2> Honestly, I think Christie's has an interest in their estimates being semi- accurate, but not _too_ accurate. They obviously want to be within an order of magnitude so they don't look stupid, but overestimating might drive up the price and make them money. Also, when things sell for double or triple the estimate, it makes the news, with Christie's name right beside.

Someone else said Sotheby's bought a database of art prices for 7 figures - why wouldn't a bunch of headlines with their name be worth a few million to them?

Additionally I think they have an interest in prices being as high as possible normally, with estimates high to encourage that. So the pattern would look like:

Antique Japanese woodcarving, $10MM predicted -> $12MM public predicted

Set of documents from Roman times, $5MM predicted -> $6MM public predicted

Van Gogh paintings (aka more headline potential), $10MM predicted -> $3MM public predicted

Then you get the headlines "Van Gogh paintings fetch more than triple the estimate at Christie's auction", which is free PR for Christie's.

</comment><comment><USER3> If you cannot, I would be shocked. Price estimates at auction houses are not their best faith effort at estimating sales prices. They are much more complex, and involve to some degree, an attempt to manipulate the price as high as possible.

</comment><comment><USER4> I wonder what is the point.

It seems to me like a back-justification of something not measurable analitically.

A 5 millions US$ bracket is not in any way an approximation.

IF you had narrowed the interval (and IF the picture is at the auction sold within it), then all your data mingling exercises might have some usefulness, otherwise it is just an arbitrary estimation like the one from Christie's.

So the similarity calculated by an arbitrarily chosen software between (photos of) study and painting of improvisation #8 is 64%.

The similarity between (photos of) study and painting of improvisation #20 is a MUCH lower 57%.

It is clear how this HUGE 7% different can easily bring down the value of the estimation by more than 50% from the improvisation #8 sale price of 23 millions for a 98x70=6,860 sqcm painting, i.e. 3,350 US$/sqcm to a mere 10 millions for the improvisation #20, a 71x99=7,029 sqcm painting, i.e. 1,423 US$/sqcm, give or take a couple of millions.

<comment><AUTHOR> Thanks for reading, I hope to improve the analysis over time. I spent the last three years building a unique database that contains the complete paintings of ~40 of the best known artists of the twentieth century. I was motivated by reading about the large percentage of works that are forged or misattributed. I had always just assumed there was a single database listing how many works artists created, average size of the works, changes in materials over time etc. (similar to sports stats). After asking around and learning no such database exists I decided to build one. Getting my blog out there has allowed me to meet with a lot of really sharp folks like yourself who are helping me refine the analysis.

<comment><USER4> >Thanks for reading, I hope to improve the analysis over time.

Good, but I don't see the analysis at all.

I mean you are betting (without any actual money which is good) on the actual auction price of something in the future.

The auction price of a work of art - by definition - is not in any way like the actual market value of anything (it will be MUCH lower or MUCH higher or JUST ABOUT right) depending on a zillion factors that have nothing to do with the actual value of the piece.

And you have so few data points that a statistical approach is mostly meaningless, let alone one based (in the case of a study) based on the differences between it and the final painting.

You could use a few sessions of flippism and get a similar value.

Or count the number of unique RGB colours in the (photos of) the paintings and give each one a value between 1,217 and 23,146 US$ depending on brightness , later multiplied by the square root of the year it was painted and arrive to a same "mathematical" estimation.

</comment></comment></comment><comment><USER5> Not sure what you're exactly building here, is it for fun or profit or both?

I heard when Sotheby's bought the Mei Moses Database/Index last year, the valuation they paid for it was in the 7 figures. This type of data analysis is on people's minds more and more and potentially quite lucrative, good luck.

<comment><AUTHOR> Thanks for reading my post. I am building a database of complete known works across the most important art and artists of the twentieth century. Currently no such database exists. Hoping to work with folks much sharper than I am to build out meaningful analytics around art and artists using this new data.

<comment><USER6> How do you collect the data for this??? Wondering how you measure your completeness, for instance.

</comment></comment></comment><comment><USER7> They have the same data available ... seems like it'd be more like the variations in weather models

</comment><comment><USER8> This is really cool work - if you're ever in New York City and want to chat Art/Tech come by the Artsy offices ( [https://github.com/artsy/meta/blob/master/meta/happy_hour.md](https://github.com/artsy/meta/blob/master/meta/happy_hour.md) )

<comment><AUTHOR> I'm a huge fan of Artsy, would love to chat some time.

</comment></comment><comment><USER9> Artnet has been doing the same basic analysis (finding comparable artworks and calculating the worth of a piece of art) for over a decade. They offer theirs as an add-on to their price subscription service: [https://www.artnet.com/analytics-reports/](https://www.artnet.com/analytics- reports/)

<comment><AUTHOR> Thanks for reading, Artnet is awesome. To my knowledge they do not have a database looking at all known works by artists, they focus on works sold at auction. This makes sense as they cover much larger group of artists and info on complete works is typically not available for the majority of artists.

<comment><USER9> Yes – I think the point of sticking just to open auctions is so that the prices and indexes they have represent what the market thinks of an artist and particular works.

</comment></comment></comment><comment><USER10> This is awesome - really eye opening. This seems like a good proof point of the inefficiency of the art market (partially due to lots of missing data, partially due to the relatively small sample size of high-end art sales). Excited to see where this goes, and how it impacts the efficiency of the market.

<comment><USER11> Part of the art market's appeal is it's opacity, though - there's plenty of manipulation that would be outright illegal in regulated markets, and plenty of dirty money being washed through it - all contributing to the exploding valuations for fine art in recent decades. I wonder how much transparency and efficiency the art world actually wants, and what is the optimal amount to maximize art valuations.

</comment></comment><comment><USER12> What about guarantees? That is a large component of auction price estimates. A lot of these big name paintings are sold with the house guaranteeing a price to the seller. Can't have a full understanding of the industry without understanding that component.

</comment><comment><USER13> Good book on this and other collecting aspects - Art Collecting Today

[https://g.co/kgs/UBo4YM](https://g.co/kgs/UBo4YM)

</comment><comment><USER14> I'm interested in the data visualization aspect of the DB. Is there somewhere we can download the database to run queries against it in Tableau?

<comment><AUTHOR> I'd like to open source at least a portion of the data to see if it is possible to build a community driven database. Could connect works back to museums and auction records as well as articles and research and potentially build a crowd sourced provenance.</comment></comment>


A Linear Time Majority Vote Algorithm - <AUTHOR> https://www.cs.utexas.edu/~moore/best-ideas/mjrty/example.html <comment><USER2> That's pretty interesting. I'm gonna write a perl script that implements it and play with it a bit.</comment>


How We Make Trello - <AUTHOR> http://blog.fogcreek.com/how-we-make-trello/ <comment><USER2> I'm more interested to know the actual technical details of the build and testing process than the "Task-List" software development based approach because that can be done by any software project management tools (even JIRA).

What's missing in this article is the whole Continuous Delivery technical aspect of it.

What do you guys use to build the NodeJS app?

What do you guys use to test the NodeJS app?

What do you guys use to check the code coverage of the NodeJS app?

What do you guys use to test the front-end?

What is the automated testing strategy?

How do you store artifacts of builds, schema migration (if using RDBMS) or handle different model versions, how do you rollback (what's the rollback strategy)?

<comment><USER3> I hope Doug writes a more technical post about the multi-client build/release process. We have unit tests for the whole API and very few automated tests for the front-end. Client builds are stored in S3. We use mongoDB and will do backfills if necessary (pretty rare). Rolling back the client is just pointing the stable branch to another build.

<comment><USER4> Bobby, you said every app is a client of the API. I notice Trello.com consumes API from [https://trello.com/1/xx](https://trello.com/1/xx) while an OAuth client (from one of your Jsfiddle examples) consumes from [https://api.trello.com/1/xx?key=xx&token=xx](https://api.trello.com/1/xx?key=xx&token=xx). I suppose the former just passes through to the later? If so, does the former needs to pass over the key and token (I suppose you can generate on the fly based on auth cookie)? I'm trying to get my head around the fact that your app provides OAuth for other clients and at the same time (from what you're saying) your app is also one of such clients. Not sure how it really works.

<comment><USER5> api.trello.com is just a CNAME to trello.com, in case that difference was confusing you. The authentication part is taken care of differently depending on the kind of tokens we get (the web client uses a cookie) but we turn that data into a standard authentication object and the rest of the route uses the same code regardless of request type.

<comment><USER4> Got you. This is very helpful, thank you!

</comment></comment></comment></comment></comment><comment><USER6> Fog Creek are the _kings and queens_ of dogfooding. Spolsky, you sure have nurtured a group of very loyal team players. I applaud you all. It must be really nice to work at a place where the love of the process and the product are both so strong.

In my opinion if there's one thing a reader should take away from this it should be that Single Page Apps and separation of server and client are The. Best. Thing. Ever. From the start, design your system this way.

Good post, and an entertaining read.

<comment><USER7> While I don't think client side apps are the only way of doing things, I will say that I think client side apps will become much more popular once browsers get a little better.

I love the separation of concerns that is possible with JS apps - you can have one team working on the API and one on the interface and the only place they really need to communicate is in the API documentation. Once it's all done, you've already got a fully functional and secure API (because it wasn't an afterthought) that can be used for other clients.

<comment><USER8> >you can have one team working on the API and one on the interface and the only place they really need to communicate is in the API documentation

That's already how you should be working anyways. Unfortunately, most language don't seem to have support for a decent template system that makes this natural. People need to start making heist clones in their language of choice so doing things right becomes more common.

<comment><USER7> I agree, but it's often too easy to just add another variable in your controller then modify the view, and now there's undocumented functionality. IMO the full separation is more helpful to stay DRY.

</comment></comment></comment></comment><comment><USER9> It's almost comical how nobody at my company would ever take a project this seriously. Good for them, Trello is awesome.

<comment><USER10> Everything I've ever heard about Fog Creek indicates that they take their people seriously. Which probably makes them more likely to take their work at Fog Creek seriously.

Funny how that works, huh? A lesson many, many other companies could profit from.

<comment><USER11> I agree with your point, but it requires that you hire correct right from the beginning. Spolsky (like pg, Atwood, Fried/DHH , etc.) has his pick of the litter because of well thought out essays and large base of followers. You can't simply take this attitude without having a large pipeline of people who (1) agree with you and (2) who are good.

Lesson learned - creating a community or following of people (i.e. talent marketing) is a very powerful thing.

<comment><USER12> The essays and followers surely helped, but there are lots of basic pragmatic things you can do to make yourself a desirable employer even if you aren't a great essayist. Just some obvious ones off the top of my head:

\- Have sensible working hours (30 to 40 hours a week is optimal).

\- Either let people work from home, or give them private offices.

\- Don't have idiotic hiring criteria like buzzword matching or college degrees. (Meta: don't have the personnel department doing the hiring.)

\- Get at least the basics of tools and process right. You don't have to let people code in Lisp or Haskell, but when a candidate asks you about version control, the answer better hadn't be "oh we don't have time for that here".

\- If you are requiring people to work in the office, don't quibble about things like high-spec machines and good chairs that cost a small fraction of the cost of hiring people.

Hit everything on that checklist and even if you're still not quite as sought after as Fog Creek, you'll be well out in front of most of your competitors at little cost in either time or money (and infinitely far in front of Fog Creek for any candidates who won't or can't live in New York).

<comment><USER5> > and infinitely far in front of Fog Creek for any candidates who won't or > can't live in New York

Fog Creek actually hires remote people now. We made the change almost a year ago and its been a great source of new candidates.

<comment><USER12> Ah, then I happily stand corrected on that point!

</comment></comment></comment></comment></comment></comment><comment><USER13> > > The Trello API is well-written, has no bugs, and is totally rock solid. Or > at > least it doesn't change very often. That means we can put out new > > clients all the time without having to update the API. In fact, we can have > > multiple versions of the website out at any given time.]

A very counter-intuitive result: most people would not consider a stable API to let you iterate quickly!

<comment><USER14> I think the article says that the API is stable unless you have access to "Alpha" and "Beta" channels.

<comment><USER5> Alpha and Beta channels only affect what client you get. All client versions talk to the same API, so it has to be very stable/backwards compatible.

</comment></comment></comment><comment><USER15> I've used Trello & FogBugz over the years and we've even modeled some of our software after some of the practices they've written about. Amazing stuff!

</comment><comment><USER16> So they create a new branch for each fix? And all developers are supposed to merge in their branch every few hours or so? Isn't it a bit of a drag?

<comment><USER17> Yes, more or less a new branch for each fix. But with git and Kiln, it's really not a drag at all; the merges are generally really easy and mostly performed by our release manager when the card makes it to 'Ready to Merge'.

<comment><USER18> How do you test the fixes? Which branch gets deployed to the test environment?

<comment><USER3> Everyone runs dev environments locally and tests. A dev environment is really easy to set up with mongo and node. Occasionally, we'll put stuff on a staging environment if we want to test a database or infrastructure change. Big, experimental client changes go to the alpha channel on production.

<comment><USER18> So when you have 2 features/bug fixes in the same area, built in 2 different branches and deployed to isolated dev/test environments... the first time you might find out that they dont work well with each other is in Staging? Why wait for that when you could deploy to a common environment and catch issues sooner?

Btw... I am trying to get some teams in my company to get out of branching. So trying to understand your view (which is exactly what these teams are doing), hence these questions...

<comment><USER3> That rarely happens in our experience. With our internal board, we know who is working on what and in what area of the code. Plus, all code is reviewed by someone working in the same area.

</comment></comment></comment></comment></comment></comment><comment><USER19> What I'm interested in is the mechanics behind how they know were to send a user based on their channel (beta/stable/alpha). We wanted to do something like this, but we couldn't figure out how to route users to the right app server either using AWS ELBs or nginx proxying ... admittedly we didn't really spend a lot of time thinking about it though.

<comment><USER5> We do that decision-making inside the web servers. It only affects the client you get, so when someone requests a page we do a lookup on the logged-in member to decide which channel they get. API reqs don't care what channel you're on. No need for any fancy nginx proxying/etc.

</comment></comment><comment><USER20> I'd love to hear—maybe I missed another blog post—why they went with the single release manager, where only one person can merge and deploy. What happens if Doug is sick or on vacation? Or even just in a meeting? What is a typical amount of time for a change to sit in "ready for merge" or merged but not deployed?

<comment><USER21> The primary benefit is that it creates a single point of communication for the developers, the designers, and the QA. It also helps with prioritizing changes that could be conflicting and, in the same vein, helps prevent bad releases or merges. And, of course, anyone can do this job. If I'm not available, someone picks up the slack. I just volunteered because I was interested and available.

All that said, I think that letting every developer deploy would not be a bad idea at all. The problem is that our team is too big to do that without creating more robust deployment tools and too small to dedicate enough time to doing so. My hope is that one day we can get there, though.

<comment><USER22> You should definitely work on the Kinect-to-deploy integration, then _everyone_ would want to learn how to do it ;)

</comment></comment></comment><comment><USER23> I like the lighthearted approach to cross-selling in the article. ☺

</comment><comment><USER24> Are they on AWS or hosting your own hardware? What OS?

<comment><USER25> AWS, which came about when Hurricane Sandy took down the data center's backup generator fuel supply and much of the team spent days bucket brigading diesel fuel up 17 flights of stairs.

</comment></comment><comment><USER26> How difficult is it to make the backend work with both new features and old features at the same time?

<comment><USER5> To add to what bobby said, changes to the API are far more likely to be additions rather than actual behavior changes (except for bug fixes, which of course all clients handle fine). This makes it easy; old clients just ignore new routes/arguments.

<comment><USER13> Thank you for this. I hope more people come to understand this more nuanced understanding of change. Please talk about it more!

<comment><USER27> Another Trello dev here.

Basically, we have many clients that are consuming the API, including our mobile apps. We never change the published interface so that if you're getting some board fields that will always work. This means that we don't change the types of fields (for example string vs object) or the names of fields since that changes the published service contract.

What we do instead is add more fields. A very good example of this is emoji. We added emoji support a while back and instead of changing the "text" fields to be objects or embedding HTML (gah) into them we added another field called "textData" that has the extra info.

This is copy/pasted from an actual call for getting card actions:

            "textData": {
              "emoji": {
                "daft": "https://trello-emoji.s3.amazonaws.com/4f820a995a03e8e82d134ac4/ae846ca70bf7aa95dd3330b8fd1c70cb/art-daft-punk-steampunk-951631.gif"
              }
            },
            "text": "Custom emoji! :daft:"

This may not be sustainable in the long term and if it's not we'll version the API if we have to at that point. So far though, the API has proven itself to be very well designed and adaptable (thanks to @d_lec)

</comment></comment></comment></comment><comment><USER28> Does anyone know how the server determines which channel the client should be using? Are they doing this check at the apache/nginx level, or on the server right after the user is authenticated, and before the client code is sent?

<comment><USER29> Good question, I wondered about this as well. Channel switching would certainly create issues on data model changes in the underlying store.

<comment><USER30> From what I understood, the API doesn't have channels, so the store only stores a single data model. The channels are only for the clients.

<comment><USER3> Right. The there is only one version of the API. Multiple clients.

</comment></comment></comment></comment><comment><USER31> This is great and all, but I really wish I knew why they won't make the audit logs accessible to users. If someone has a hack for this, I'm all ears.

Need it for compliance documentation.

</comment><comment><USER32> > The Trello API is well-written, has no bugs, and is totally rock solid.

The no bugs claim indicates to me this wasn't written by a technical person. Or at least, not very technical.

<comment><USER3> It was a joke. =)

<comment><USER32> I reread that paragraph. In context, it doesn't seem so.

<comment><USER33> Read more than just the paragraph. The entire article is written in a "fun", joking style.

> The revelation could result in a rippling shockwave that knocks you off your > seat and may have troubling, unpredictable consequences for the time-space > continuum. Possibly.

> You've probably downloaded our iOS, Android, Kindle, and/or Windows 8 apps, > and are saying to yourself, "These are very well polished apps which I have > rated or will rate favorably in their respective app stores

> The Trello API is well-written, has no bugs, and is totally rock solid. Or > at least it doesn't change very often. [Goes on to only reference the fact > that it doesn't change very often]

<comment><USER34> I like the passion for the product. Shines through very well.

</comment></comment></comment></comment></comment><comment><USER35> These tech intros are pretty cool, yet can I ask how does the team acquire users? That seems to be harder than the tech challenges for Trello IMHO.

</comment><comment><USER36> I don't get it. Why is having an API in the backend so that many clients can use it a big deal?

<comment><USER37> In trello's case they have a browser app, ios, and android. Having one well designed api makes these easier to build and maintain. It appears to be working pretty well for them. I use trello in browser, on an iphone, and on an ipad, and they all work together very seamlessly.

</comment></comment><comment><USER38> Anybody using FogBugz and Kiln from Fog Creek? Both seem to be a bit outdated...

<comment><USER39> In what sense are they outdated? UI-wise (which I will agree with) or feature wise?

</comment></comment><comment><USER40> I'd like to be able to write like this. It made me LOL.

</comment><comment><USER41> Trello using Trello,(Inception) awesome!

</comment><comment><USER42> Trello is using Trello to develop Trello. So meta :)

<comment><USER43> they're using Trello to write a Trello post on how they're using Trello to work on Trello.

</comment></comment><comment><USER44> So interesting!</comment>


Cat Hands - Node.JS + Kinect + OSC [video] - <AUTHOR> http://vimeo.com/20147460

<comment><USER2> if anyone is interested, the purpose of this project was really just to implement the communication as simple as possible. osc is just used to get the data from kinect to nodejs- and it's parsed and forwarded via websocket. i chose osc because the kinect lib that's used falls is terse as well.

there is a more robust, similar project called depthjs that runs on python and opencv, but as it's more robust it's quite a bit larger. node hands serves a simple purpose, which is to get x/y/z positions from your hands into the browser.

i'd like to thank johndbritton as well as scatman john for making this possible.</comment>


The Pac-Man Dossier (2011) [pdf] - <AUTHOR> http://tralvex.com/download/forum/The%20Pac-Man%20Dossier.pdf <comment><USER2> I loved PacMan as a kid in the early 80's. My mom and I would play it for hours at home on the Atari 7800, and when we found an arcade cabinet we'd play it as much as we could as well.

I never liked the original PacMan quite as much. I always loved the clones or similar games for other systems or even DOS shareware.

However, it was always easy to spot a fake. They just didn't look right or feel like. Even worse, a bad port like on the NES. It was actually a good port but the characters were way, way too large for the maze! So distracting.

Later on I learned why the programmers made it that way. The original game is a 224x288 screen, with a 28x36 playfield. Each tile is 8x8. The NES has 256x240 resolution, so of course they had to shrink everything down so they could use the original maps.

A game like Pacman is deceptively simple until you start playing your creation and realizing it just doesn't "feel right".

Luckily we have documents like these that point out all the quirks, the original designers were quite intelligent to have these all in there, the hours that went into tweaking these factors are really what makes the game.

A few years back I started writing a Javascript version of Ms Pacman but never really finished it, thought it is playable. [https://github.com/robilic/mspacman](https://github.com/robilic/mspacman)

</comment><comment><USER3> Great find and a great read as I just happen to be implementing a version of Pac-Man in C (with a sprinkle x86 assembler) for 16 bit DOS using the original Namco graphics. The biggest problem I currently have is to find a solution to somehow fit the original portrait screen orientation into a landscape orientation...

<comment><USER4> Simply put the score and other information (lives etc) in a screen-high box to the right of the playfield. Don't change the aspect ratio of the playfield itself.

<comment><USER3> The play field itself is already taller than 240 pixels and even though there are X modes that allow you to go beyond 240 scan lines, none of them work consistently on newer LCD panels. Ideally I use 360 x 270 which gives me square pixels and everything fits perfectly but it will only work in DOSBox for most people these days. I'd like people to run this on real hardware... Technically I could tilt the screen, as they did in the arcade (i.e. 240x320) but who can tilt their 4:3 LCD panel? I just happen to have one but... I think I have to use some form of panning...

</comment></comment></comment><comment><USER5> Nice to see this come back up. I worked with Jamey years ago and he was brilliant. I think he has a write up for Ms Pacman as well.</comment>


Ask HN: SafeBoot - <AUTHOR>

Im having an argument with a client; hopefully HN can make sure I am the sane one.
He's basically lost the password to his laptop - the issue is he has lost the SafeBoot password. Which is full disk encryption as I am sure you know.
So, I tell him this and say "sorry I am not going to waste my cluster time trying to break AES encryption" :)
But he claims that it can be done because another consultant says there is a dictionary attack tool going about.
Now I am not completely stupid but I cant find and have never heard of such a tool. Finding naughty programs like that is not usually a problem but my usual resources turned up blank
I had a minor play with the SafeBoot boot sectors (argh, hacking that stuff is fun for some I know, but bah!). I also gave it a bit of cluster time (after tracking down a reasonably performing AES256 implentation) but no joy (tbh I think my "solution" test was wrong).
So. Sanity check: I am right in saying no such tool exists? <comment><USER2> I have no comment on the tool you're talking about, but some obvious facts come to mind...

I am not familiar with this product and may be wrong...but it seems as though this password is entered before the OS is booted. The only code that runs before that point is in the MBR (<http://en.wikipedia.org/wiki/Master_boot_record>). The maximum length of code is 446 bytes. Disassembling this amount of code should be trivial for a hacker.

Additionally, it makes no sense to break AES256 as other have pointed out, but there is no reason to do so. Presumably, the encryption software must know the key to decrypt the drive in order to boot (I'm assuming). So the key has to be in long-term storage (ie. on the hd itself) in some form or another.

If one were so inclined, it would seem that the easiest approach would be to disassemble to MBR to determine where it finds the key, and then use the key to decrypt the hd.

I'd love to hear comments if I'm way off. This sounds kinda fun.

</comment><comment><USER3> You will never perform a brute force attack against an AES256 key. You might be able to brute-force _his password_ , depending on how strong it is and what key derivation function SafeBoot uses.

<comment><AUTHOR> yup, that's the problem. None of that information seems to have been researched - it's definitely possible to take that approach but he's not paying us enough for me to reverse engineer SafeBoot and do it :)

Just checking there really was no tool/research already.

EDIT: I did find some brief info on which files it moves, and I think i might have some sectors with data in that we can verify. But nothing on the key algorithm - which is crucial.

</comment></comment><comment><USER4> Sounds like he's the kind of guy who might use super simple passwords. Ask him what kind of pw it was -- if it was a single word, etc. He may have some fuzzy memories, which could help you out.

You could brute force his password if it's simple. But you'd have better luck going to a hypnotist to enhance his memory.

Sorry.

<comment><USER5> If he has no idea of the rough form of his password then perhaps it isn't his in the first place.

Or perhaps he wants you to go back and tell that it is impossible so that he can be sure that full disc encryption really is secure.

Sorry if any one finds that overly cynical.

<comment><AUTHOR> welcome to my catch22. Not crossing the line is really difficult - there have been times when a laptop turns up that is obviously nicked... (for whatever reason). From reputable sources too.

This is above board though (long term trustworthy customer - who is also totally dopey with computers).

We sent him it back in the end :) the "consultant" is giving it a shot.. he quoted 24hrs, £2,000, half up front :o

</comment></comment></comment><comment><USER6> Here's an idea: Full-disk encryption software should disable itself as soon as it detects that your backups are not up to date. Of course, if you have no backups it should refuse to encrypt your disk in the first place.

</comment><comment><USER7> Let him get the other consultant to do that work then.

<comment><AUTHOR> well that's the plan :) but he's not a one off client so if I am insane and there is a way I'd rather not let another guy show us up (my boss would hang me out :P)

<comment><USER7> If there are some implementation-specific ways to recover the pw, then it'd be possible. But if he had a reasonably-complex password, then I wouldn't waste my time trying to break it.

<comment><AUTHOR> It's probably fairly possible (just for background we have quite a big decryption cluster and a python/c based infrastructure for me to work with) but it's reverse engineering SafeBoot to make sure we get it right that's a pain - I cant find any research into that either.

AFAIK SafeBoot moves the data that would be simplest to use to identify the decryption success (i.e. the standard stuff at the start of the disk) so picking the right bits to test would be the hardest part.

Also not sure what their key generation mechanism is (and cant find research into that) so we would probably need to test the full 256 bit key (rather than a shorter password).

= painful.</comment></comment></comment></comment>


Ask YC: How do the Karma points work? - <AUTHOR>

How are some comment points negative?<p>What is the difference between new and newest? <comment><USER2> When you get more karma you can vote comments down. That's how they go negative.

New (in the title bar) and newest (in the URL) are the same.

</comment><comment><AUTHOR> Does anyone know what algorithm the karma point system follows?

<comment><USER3> If you're asking about front page ranking. it's been released with arc2, and looks like this:

      (= gravity* 1.4 timebase* 120 front-threshold* 1)

      (def frontpage-rank (s (o gravity gravity*))
        (/ (- (realscore s) 1)
           (expt (/ (+ (item-age s) timebase*) 60) gravity)))

      (def realscore (i) (- i!score i!sockvotes))

      (def item-age (i) (hours-since i!time))

Which is summarized, also in the code, as "[net] Votes divided by the age in hours to the gravityth power."</comment></comment>


United, Continental flights delayed due to glitch - <AUTHOR> http://abclocal.go.com/kgo/story?section=news/national_world&id=8198043

<comment><AUTHOR> I'm quoted in the story. I checked guidelines before posting. ("If they'd cover it on TV news, it's probably off-topic.") Yeah, although this is a link to a TV news story, it's hacker related. I'm amazed by the scope of the outage. The "glitch" has crippled their entire system -- airport operations _and_ website. United is effectively grounded at the moment.</comment>


The WebAssembly App Gap - rudi-c https://paulbutler.org/2020/the-webassembly-app-gap/ <comment><AUTHOR> As someone who likes Figma immensely, saying it can compete head-to-head with a native application is a very long stretch. The feature set of the application is great as is the tooling it provides, but the performance is simply abysmal. Photoshop starts up faster than Figma, and that says a lot. Offering the same application in both the browser and as a standalone is an interesting proposition and there are a few others out there who do that (a-la Spotify), but so far they all pay a considerable price for it.</comment>


Ask HN: What is the best way to get attention of VR early adopters? - <AUTHOR>

We are working on VR app that we think will change the way people interact via immersive communication on-the-go. We want to genuinely build a audience that cares about the problem of immersive communication. We think our target audience is between age 15-30 yrs as they care about better communication. Since we are not competing with HMD or Magic Leap etc we don't really think HMD market should be our target market. We want to cater to people who want to have better communication capabilities. Since this is consumer, it is slightly harder to nail and segment down the target market.
Any ideas on how to build a audience or gather people around the problem we are trying to solve. We are writing Blogs/content marketing, doing social media, talking to friends but we haven't yet found traction in people who would benefit the most. <comment><USER2> Aren't most of the vr headsets still just prototypes and dev kits?

<comment><AUTHOR> Yes, thats true. This is the nature of any new technology adoption curve. Everything starts with figuring out the target market. We are also stuck in the same phase. We are on a mission to bridge the gap between real world and virtual world. We are trying to reach our audience, but still struggling

<comment><USER2> Are you sure this is the right time to pursue traction? It seems to me like your target market just can't exist today in any significant numbers.

Edit: if you have something ready for consumers today maybe you could be approaching the device manufacturers and arranging some launch-day advantages for yourself?

<comment><AUTHOR> Yes, we could do that to gain traffic and momentum. However we are trying to figure our product/market fit first. We want to make sure that we can make people fall in love with our solution before we go out for strategic relationships and traffic. We don't want to bet on traffic numbers and want to make something people want(easier said than done). We want to genuinely build a community for people who care about immersive communication

<comment><USER2> What are other VR software companies doing to build enthusiasm before the devices go mainstream?</comment></comment></comment></comment></comment>


Asian tree rings explain historical plague outbreaks in Europe - <AUTHOR> http://www.wsl.ch/medien/news/jahrringe_und_Pest/index_EN <comment><USER2> Yeah, I'm not buying it. I have two complains about this article in particular and this kind of "science" in general.

1\. Their conclusion is unverifiable. Science is about hypothesis, experiment, and falsification in a reproducible context. When someone says, "I can look at these tree rings and tell you whether rats or marmots spread the plague," I say, "Cool! Show me the results." And when they say, "What do you mean results? I just mean that we infer from the rings to the marmots," then I say, "Okay, well I just infer from planetary alignments to mood swings." Speculation is part of science. Speculation is not science.

2\. An extremely strong inference is, by definition, acceptable without further evidence. You don't have to show me an experimental result if you can show me a strong logical case, with very strong causal or inferential links from one piece of evidence to the next. Although you can't reproduce for me a precise result showing that the Grand Canyon was the result of many, many millennia of erosion, you can show me over observable spans of time the general erosion rates in soil of that type with rainfall of that type and I'll accept your inference that many millennia were involved in the Grand Canyon. But tree rings in Asia to disease vectors in Europe? Give me a break.

<comment><USER3> Err, that's explicitly covered in the last paragraph; I've included a bit more for context:

 _[...] Moreover, their results challenge the long-standing, but poorly substantiated view that_ Yersinia pestis _must have had a permanent wildlife reservoir in Europe, such as the urban black rat. Instead, new strains of the disease may have been frequently imported from Asia.

Nevertheless, an ultimate confirmation of this hypothesis depends on the availability of appropriate genetic material of ancient plague victims not only from different periods throughout time but also from different parts of Eurasia. The advent of aDNA techniques and international research collaboration across disciplinary boundaries will most likely be able to shed new light on this fascinating topic at the interface of human history and environmental variability._

We've already reconstructed _Yersinia pestis_ strains from victims of the Black Death and the 6th Century Plague of Justinian....</comment></comment>


Microsoft: Our strategy with Silverlight has shifted - <AUTHOR> http://www.zdnet.com/blog/microsoft/microsoft-our-strategy-with-silverlight-has-shifted/7834?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+zdnet%2Fmicrosoft+%28ZDNet+All+About+Microsoft%29&utm_content=FeedBurner+user+view <comment><USER2> Proprietary client side solutions don't make any sense with the advent of what is being called HTML5. Apple's refusal to support RIA platforms on iOS is just accelerating their demise.

</comment><comment><USER3> Remember back when Silverlight apps were actually written in JavaScript?</comment>


Raised in U.S. without legal status, he attains the American dream – in Mexico - <AUTHOR> http://www.latimes.com/world/mexico-americas/la-fg-mexico-dreamer-20160424-story.html#nt=oft12aH-1gp2 <comment><USER2> Another casualty of the schizophrenic US immigration system

Some want everyone to come / others don't want anyone to come - all mashed up together in layers built up over the years by alternating factions.</comment>


Apple just unveiled its second wearables platform - <AUTHOR> http://www.aboveavalon.com/notes/2016/9/13/airpods <comment><USER2> Oh my god, this article can't be more wrong.

A wearable extends your capabilities without compromise. Like a smartwatch gives you much freedom the be connected, monitor your health, organize your life without being intrusive and limiting your freedom in movement.

Earpods go in your ear, they limit your hearing, the one of the top connections to the real world.

In this context VR headsets are wearables as well.

It's an overpriced BT headset with some extra features. Let's not try to look more into this then it actually is.

If anything bone-conduction headphones are closer to being wearables, because they not limit your freedom of hearing, they can be used to stay connected, you could use Siri with it.</comment>


Happy Family, Successful Start-up. Impossible? - <AUTHOR> http://www.inc.com/jessica-stillman/your-family-will-pay-for-your-start-up-dreams.html

<comment><USER2> It is definitely possible and I do this on a daily basis. I work from home, have 2 kids and have founded two startups. It's not without its challenges that's for sure...

Here is a post I wrote for parents in the same situation as me: <http://maplebutter.com/superhero-tricks-for-startup-parents/>

And here is another post I did last week summarizing 20 great articles on this topic: [http://jeff.io/posts/20-inspirational-articles-for- startup-p...](http://jeff.io/posts/20-inspirational-articles-for-startup- parents)

I am always keen to read comments when these kinds of posts hit HN. We are not alone STARTUP PARENTS!!! :)

<comment><USER3> Like anything, it is what you make of it.

I quit my desk job 4.5 years ago. Worked at home up until last month. In that time I've had two kids (eldest now 3) and every day of their lives so far they've had both parents at home with them. I work weird hours, sometimes starting early, some times finishing late....all just depends on what needs doing. The 3 hrs I'd ordinarily spend commuting, I spend with my kids.

Now things are a little different. We have a startup with actual employees and that means office time. It's much harder now, but it's really just the commute and the time away that is difficult.

Like any job, it's up to you to balance your life how you see fit. Being your own boss at the very least gives you flexibility you'll never see in a desk job. So I think startups are perfect for work/life balance.

</comment></comment><comment><USER4> Dennis Chookaszian, former CEO of CNA Insurance Companies, recently told me "Pick Two: Work, Family, Personal. I have never known anyone to be successful at all three." This message resonated with me.

Chookaszian has chosen work and family. By all accounts, he has been very successful professionally and the stories he recounts about his family, casually woven into almost every conversation I've had with him, I am lead to believe that he has also managed to maintain great relationships with his wife and children.

In order to pursue successful and meaningful work and family lives, he had to give up his personal interests. As a young man he loved working on cars. He got a great deal of enjoyment out of fixing up old Porshes. About 30 years ago he purchased a Porshe that needed an engine rebuild. He took the engine out of the car and began working on it. Meanwhile, he got married and had children. Where is that engine today? It sits, neglected, in the same place and condition that he left it in 30 years ago. "I now know that engine will still be sitting there long after I am gone," he quipped.

In that same conversation, he also made another keen observation: "When someone says that they want 'work/life balance,' what they really mean is that they don't want to be in an executive position." For CEOs of successful companies, there isn't such thing as work/life balance. If you want that balance, you can be successful in middle management, but only those who are truly passionate and dedicated to their work make successful CEOs.

To illustrate the point, he mentioned a recent email he received from the CEO of a company. Chookaszian is a director on the board of the firm, and the company was dealing with a crisis. The CEO wanted to let him know that he would be out of town for about a week on vacation. The notion that someone would follow through with vacation plans in the midst of a company crisis was, in his view, absurd. "As a director, when I heard news of the company crisis, I cut short my ski trip with my wife and flew home on the next flight in order to deal with the issue." If the CEO felt that his vacation plans superseded his obligations as a CEO, it wasn't likely that he would have a job to come back to after his trip.

This doesn't mean that you can't have a solid relationship with your family. However, success in business requires that you first fulfill your obligation to the company and its constituents. That duty will require sacrifice. It will require long hours at the office, vacations cut short, and kids' soccer games missed. When there is a critical decision to be made at the company, that must come first. The additional difficulty in the start-up context is that, in a company's infancy, critical decisions are being made almost constantly.

However, it also doesn't mean that you can't maintain happy relationships with your family members, but something has got to give. Namely, personal interests must be sacrificed.

Work, family, personal. Pick Two.

</comment><comment><USER5> _But do you have to be willing to give up a real bond with your kids to be an entrepreneur?_

I don't think so. I work about 60 hours a week and despite that I spend about 3 hours per _work_ day with my daughter (more than most of my salaried friends can pull off) and 2 full days a week "off" with her too (although I then often work after she's gone to sleep).

I think the real danger is lengthy commuting or needing to be away from home a lot. Not every business requires this, but for those that do, it's those multiple nights aways and lost meals, bathtimes and bedtimes that could eat away at the bond. Pick your battles wisely, though, and you can keep it up.

<comment><AUTHOR> If the startup is on the Internet that should help a bit (working from home sometimes). But I don't know exactly, I don't have kids yet.

<comment><USER5> I rarely work from home now (beyond e-mails on the Air) since I found it inefficient and like to split family/work, but.. my office is a 5 minute drive away so that sure helps :-)

</comment></comment></comment><comment><USER6> "He that hath wife and children hath given hostages to fortune, for they are impediments to great enterprises, either of virtue or mischief." — Francis Bacon

[http://www.laphamsquarterly.org/preamble/hostages-to- fortune...](http://www.laphamsquarterly.org/preamble/hostages-to-fortune.php)

<comment><USER7> Got me in soooo much trouble. "But Erin, he was the inventor of bacon!"

</comment></comment><comment><USER8> Surprisingly enough... there is no set rule here. Some people have trouble doing both, others manage both just fine. I would guess there is a correlation between those that really want to achieve both and those that do. Are we going to assume because a few successful people don't have a typical family life that this is because they are successful... and not because they didn't want a typical family life? That seems like a more obvious explanation to me.

So often we look for simple rules as an explanation, but typically outcomes are a result of many smaller factors. It's like the recent discussion here about VC causing more startups to fail vs. succeed. Maybe we can realise that VC isn't the deciding factor, in fact there is likely no single deciding factor, just a bunch of things that impact the outcome.

<comment><USER9> I agree there's no one solution for every situation. But it is also important for people to realize that it is _possible_ to balance family and start-up needs.

Startups can provide flexibility, especially in working times and telecommuting options that larger businesses usually cannot. That flexibility can enable you to spend the right time with your family and still meet the demands of a startup (which you shouldn't underestimate).

<comment><USER8> I agree it's possible to balance, I do so myself. I do however suspect that the benefits of startups you mention are more for employees of startups than the founders.

</comment></comment></comment><comment><USER10> this is barely an article IMO. Not much is discussed, not much is given thought - it simply rehashes some quotes found elsewhere online and leaves it at that.

I'm interested in the conversation that could happen here, but I feel the article itself is weak.

As for Ambitious Entrepreneurship and having a family - I guess it's possible to those that decide it is, and is not possible to those that decide it isn't. I for one have a daughter and another one due in a month - and i make time for both my ambitions and my family. It's obviously not easy - but really what has been worth pursuing that has been easy in life?

</comment><comment><USER11> My business partner (who i feel is slightly crazy for what im about to tell you...) has 4 children and a pregnant wife. Somehow he manages to do it, and from what i can tell, they're pretty happy.

I think it just takes a very special kind of person, but in general...its not out of reach for the /normal/ entrepreneur. It is however very hard, but what in life isnt?

You get in what you get out of everything in this world, so i think it just comes down to being able to balance your life. Maybe one day i'll be brave enough to have children, but that wont be until i feel like im smart enough to understand how to balance the responsibilities.

</comment><comment><USER12> I might be alone in this, but I'm getting a little tired of this particular author's linkbait articles. I noticed them on GigaOm first (mostly in her writing about coworking) and now this.

</comment><comment><USER13> potentially harder? of course. impossible? of course not.

<comment><AUTHOR> Sheryl Sandberg shows it is not impossible. Marcus Pincus, the same. And probably there are more...but yes, it is hard and takes a lot of understanding from both.

<comment><USER14> Here's another take on Sheryl: [http://blog.penelopetrunk.com/2012/02/07/what- facebooks-ipo-...](http://blog.penelopetrunk.com/2012/02/07/what-facebooks- ipo-means-for-women/)

</comment></comment></comment><comment><USER15> I feel the article was far too one-sided and didn't really do much to start a quality debate around this issue.

Let's look at this from a hacker perspective. Does an instance exist? Yes. Is this instance replicable? Ah, now we have a question.

</comment><comment><USER16> _I think that it hard, but a man has to decide what is it that he wants._

</comment><comment><USER17> Your relationship with your kids will be fine. It's your wife you really gotta worry about.

<comment><USER18> I think being away from your wife once in awhile is actually a good thing. If you're with her all the time, you get cabin fever, and you become irritated/bored with her. You need some time alone to rebuild the passion.

<comment><USER17> Yep, completely correct.

</comment></comment></comment><comment><USER19> Only at the same time</comment>


Massive Bird Nests - <AUTHOR> http://www.thisiscolossal.com/2013/02/massive-bird-nests-built-on-telephone-poles-in-southern-africa/?src=footer

<comment><AUTHOR> Actually, all thisiscolossal.com site is awesome.</comment>


Facebook Use of Sensitive Data for Advertising in Europe [pdf] - <AUTHOR> https://arxiv.org/abs/1802.05030 <comment><USER2> I am soooooooo looking forward to GDPR kicking in.

I have already bookmarked this "nightmare letter" [1], that was posted on HN a few days ago.

[1]: [https://www.linkedin.com/pulse/nightmare-letter-subject- acce...](https://www.linkedin.com/pulse/nightmare-letter-subject-access- request-under-gdpr-karbaliotis/)

<comment><USER3> Yep, it will cost money, but the big companies will have compliance automated, and will continue business as usual.

Now about the small companies, the ones that can will shut down European operations and continue elsewhere; the ones that can't, in particular European startups and small tech companies, will have to close shop or face severe penalties every year.

In the end, most of the damage will be done to small and medium European tech companies.

<comment><USER4> I run a small European tech company and disagree.

We have a product that deal with quite a lot of personal information (top quintile).

Sure, it's a headache right now but certainly not insurmountable. The law itself is easy to read, sensible and not needlessly long. You definitely don't need a lawyer to understand it.

Also, I know that a younger/smaller company with a more modern tech-stack will have a munch easier time implementing data minimization, profile erasure tools and proper encryption/security. For many large companies data is spread out over so many products and systems that just mapping it all up is a painful task.

Also, as a consumer I think 95% of the law makes a lot of sense! Citizens deserve it!

<comment><USER3> And how will your costs increase when you have to provide data to dozens, hundreds, or thousands of letters like the one the OP posted, each one asking for different things?

Managing the data is easy, managing the compliance and reporting will be the hard and costly part.

<comment><USER5> maybe show what you got under profile settings somewhere or button which will email you report with all or frequently requested information.

<comment><USER6> Its probably safe to assume that the person you're recommending this to has absolutely no idea about the general concepts of software development, or the rough orders of magnitude of information that is reasonable to store and serve with modern infrastructure available to nearly any small business.

Its reminiscent of the willful ignorance displayed by the Cuyahoga County Recorders Office, in Ohio. The office responded to FOIA requests by demanding $2 per photocopy, even though the documents were already stored on CDs. They hoped they could simply make freedom of information too expensive. Their legal argument was that the files could be semantically thought of as photocopies of the documents.

Here's a verbatim reenactment of a deposition in the case where a county employee puts on a charade of not knowing that a photocopier is.

[https://www.youtube.com/watch?v=PZbqAMEwtOE](https://www.youtube.com/watch?v=PZbqAMEwtOE)

</comment></comment></comment></comment></comment></comment><comment><USER7> The study links to this tool (from the same authors) that seems interesting: [https://fdvt.org](https://fdvt.org)

</comment><comment><USER8> Really interesting table on page 10. Selfishly I have to say I'm glad to see my country (Germany) being the least affected.</comment>


JPMorgan Warns a Trade War May Trigger China Corporate Defaults - <AUTHOR> https://www.bloomberg.com/news/articles/2018-07-02/jpmorgan-warns-a-trade-war-may-trigger-china-corporate-defaults <comment><USER2> On the other hand it also indicates it might not be a big deal anyway.</comment>