Open Letter to Calendar Developers about HTTP - <AUTHOR> http://lists.w3.org/Archives/Public/www-archive/2013Aug/0021.html <comment><USER2> What do we learn from this? If you provide a public-facing API or service for direct use by applications over the net, use a unique host name / DNS entry for it so you can point it elsewhere or delete it at leisure. DNS entries are cheap, millions of HTTP hits might cost a bit more.

<comment><USER3> For even less fun, there have been numerous incidents of consumer accesspoints/routers hardcoding NTP servers by IP address[1][2].

[1] [http://pages.cs.wisc.edu/~plonka/netgear- sntp/](http://pages.cs.wisc.edu/~plonka/netgear-sntp/)

[2] [http://web.archive.org/web/20060408150213/http://people.free...](http://web.archive.org/web/20060408150213/http://people.freebsd.org/~phk/dlink/)

</comment></comment><comment><USER4> I would guess the problem is that most sites are going to serve up a 404 in this situation, and handling 404s is a bit trickier, since they might be transient (like a proxy gets in the way, or the hosting service has temporary issues). So they just don't handle it, since polling a server and getting a 404 is going to work well enough for most use cases. Maybe put a little exclamation point next to the calendar or something, but still poll it.

And then they handle a 410 the same as a 404, even though a 410 has very little chance of being transient. It's just rare enough that they don't even realize they don't support it properly.

<comment><USER5> I'd wager 99% of codes have a big if(200) { // Do stuff } else { // Try again later }

Actually, a bunch of them probably don't even check for response code.

Edit: If dataaccessd is really the iOS native CALDAV integration, that's a bit annoying. Of all people, they should be able to handle that correctly.

<comment><USER6>
      if(200) { // Do stuff } else { // Try again later }

That's like an "idiot-filter" interview question. "Is the following code valid?"

<comment><USER7> Seems like it should be paired with a "Is the following code useful?" about code which specifically handles every error code listed here [http://en.wikipedia.org/wiki/List_of_HTTP_status_codes](http://en.wikipedia.org/wiki/List_of_HTTP_status_codes) and contains code to handle unlisted ones.

Then "where do you draw the line?". Sometimes if(200){}else{} is plenty.

<comment><USER6> I was superficially commenting on the fact that '//' comments everything to the end of the line[1], but as @jimbobimbo pointed out there are multiple layers here, and it would be a good lead-in to a conversation in an interview.

[1]: It just struck me as one of those "low bar" technical interview questions.

<comment><USER7> haha, that kinda makes me want to make a language that prevents comments from breaking scopes, so "}" would implicitly also be a comment terminator :)

<comment><USER6> Off the top of my head, Vim has a folding mode where "{{{" and "}}}" are used to mark the start and end of a fold. So you can see this on the code:

      // ==== Section 1: Code ==== {{{

      BLAH

      // </comment></comment></comment></comment></comment></comment></comment><comment></comment><comment></comment><comment></comment><comment>= }}}

Granted, since this is Vim-specific, you usually only see it used in Vim plugins, because you're unlikely to have someone editing with another editor.

</comment><comment><USER8> Am I the only person who after about 3 months would have started returning random and numerous events? Then clients would voluntarily unsubscribe.

<comment><USER9> Nope. I'd be hard pressed to not do a little iCal trolling. I'm sure the moon would get destroyed by the Death Star at least a few times per year. Not to mention a new phase of the moon: Space station.

</comment></comment><comment><USER10> I have exactly the same problem with a project I run. I generate iCalendar versions of the timetables for each course at my university and let students download them. The timetables are static and do not change, yet I still get hundreds of hits every day from dataaccessd, even in the middle of summer when nobody has any classes.

EDIT: [http://notlate.co.uk/](http://notlate.co.uk/)

EDIT2: Not that it's enough load to be noticeable, but it's a little wasteful on the part of dataaccessd IMO.

</comment><comment><USER11> I have a feeling many of these are from rubbish applications that have mostly been abandoned by their developers but still remain installed and running in the background for a lot of users.

<comment><USER12> Except dataaccessd is how iOS's CalDAV sync process identifies itself, so I'd say it's not exactly a "rubbish" application that's been abandoned...

</comment></comment><comment><USER13> Fetching stuff over HTTP can be incredibly stupid. I there is a security list out there that some little firewall company decided to have their devices automatically download. The list doesn't change that often, but every single device that company made likes to check every 10 minutes or so. Nothing can stop them, they follow Wilya's algorithm [1].

[1] [https://news.ycombinator.com/item?id=6268919](https://news.ycombinator.com/item?id=6268919)

Side note: it's sad to see that Apple is a huge perpetrator in this one. I hope they fix that bug.

</comment><comment><USER14> I'd never even noticed there was such a thing as a 410 until this. And it's not surprising - what incentive is there for a team in the real world with a shipping product to honor it?

There's a pretty obvious incentive to ignore it: it takes developer time to implement, and the result of the 'feature' is that your customer may get permanently locked out of a net resource. What happens if a website admin accidentally puts up a 410, or - worse yet - if a previous owner of the domain once put up a 410 for a page with the same URI.

I suppose there's an RFC for the code somewhere, but it seems like a bad idea. I pity the tech support agent who has to explain why his/her customer's browser refuses to visit foo.com/bar when everyone else can view it and there's no longer any way of knowing that once, for an afternoon in 1997 the page threw a 410!

</comment><comment><USER15> A long time ago I published an XML file on my website for some ill-fated Google attempt at providing extensible search results. I took the file down some time later, but the Google crawler continued to hit the URL.

Amusingly, I asked around within the company to try to find who was responsible for the crawler repeatedly fetching the 404 but ultimately couldn't figure it out. (It seemed like the decommissioned service had maybe registered the URL with some still-running automated refetching service?) It eventually stopped on its own.

</comment><comment><USER16> Google will continue to request 410 resources for quite a while too. As far as I can tell it treats them the same as 404.

</comment><comment><USER17> This is another case for rate limiting

</comment><comment><USER18> This is probably a case where an exponential backoff would be preferable. When the client is faced with a fetch error the first time, it should wait and try again in e.g. 10 minutes, and double the wait for each repeated error. This way, after a week of downtime at the source, each client would send less than four requests for the resource per month.

<comment><USER19> No, this is a case where obeying the HTTP specification would be preferable. 410 GONE means: Gone. Don't try again.

<comment><USER20> Agreed. Incremental backoff makes sense for the 5xx-class errors, where the error is known to be server-side. But 404 is the only 4xx-class error that it makes any sense for: in any other case, it's pretty certain that your side is doing something wrong. Even when you're not -i.e. if you're absolutely certain that this is the right URL for what you want- a 404 should still trigger some kind of notification so that a person can look into it.

Using incremental backoff for 410, in particular, is to miss the point entirely. 410 very explicitly means that you should not try again. The fact that it's so rare only lowers the chance that it's being used incorrectly: someone savvy enough to set up a 410 knows enough to mean it.

That said, I'm starting to think that if you're going to implement 410 on your site, you should also start logging activity. When a host keeps looking, either incrementally or otherwise, start refusing connections from that host at the firewall level. A program that sets 4xx-class errors to fail silently probably isn't doing anything about refused connections, so an IP-ban should wake the developers up. Even if it doesn't, you won't have erroneous requests clogging your server logs, so you still benefit.

<comment><USER21> > The fact that it's so rare only lowers the chance that it's being used > incorrectly: someone savvy enough to set up a 410 knows enough to mean it.

I don't see how your conclusion follows from your premise. I fairly often come across cases where obscure options are mainly used by those who _don 't_ understand them, and in the absence of data I wouldn't assume that the same couldn't be the case for HTTP responses.

Exponential backoff is a quite reasonable compromise for those kind of situations.</comment></comment></comment></comment>


Ask HN: How do you react when you see another company doing what you intend to? - <AUTHOR> I've been fleshing out a new concept for an old idea. I haven't seen anyone 'do it right' and I've learned there is a market demand for this platform. However, I've discovered a local startup that is kinda doing what I want to. I'm trying not to get discouraged or in my head too much, so I'm asking here for some guidance on how you or someone you know has dealt with the same situation. <comment><USER2> I've been told that competition can be a good sign.

If nobody else is doing what you're trying to do, it may well be it is a crazy idea with no legs. If somebody else is doing it, it means there really might be a market.

<comment><USER3> Exactly. I would go one farther and say that if there is no competition for 'an old idea' you are most likely in a lot of trouble. It's a common trope that engineers google ideas and then give up because there is already competition, while the business folk see $$$. The fact that there is competition usually means there are customers.

</comment></comment><comment><USER4> I used to get very discouraged whenever this happened to me (which is often since very few ideas are original). But then i had a thought:

"If you want this offering and have never heard of this other company then THAT is your opportunity"

It means that at least one customer(yourself) has not been reached by your competition so there are probably many others in the same position as you. You just have to reach those uninformed potential customers first or more effectively than your competition.

I hope that thought helps!

<comment><AUTHOR> YES! You are right. This is exactly why I am compelled to try one more time. I see a frontier that is market is not reaching for, they are thinking too small and conventional. I honestly think branding, rhetoric, design, and features could all be a lot simpler and more meaningful to the target demographic.

Here we go again, this time with more experience and perspective. :)

</comment></comment><comment><USER5> Isn't this simply a case of execution?

Everyone has ideas. I had an idea for a product. Then a couple of years later somebody was selling the product and seemed to be doing well out of it. I was pleased that at least it was out there. I had my chance. I didn't execute on it.

So the real question is, can you be first to market? If not, can you execute better than them? Can you join them? Ideas just happen all the time.

<comment><AUTHOR> You're right. I'm glad I asked, I need to get over my 'but-I-didn't-go- Harvard' internal dialogue

I think this space is missing a critical component. That's why they have all failed to scale beyond a little early traction. The branding is very wishy- washy, nothing that resonates across many cultures and perspectives.

</comment></comment><comment><USER6> Look for any differences between what they are offering and what you are. Seemingly small differences can actually be big things for customers when it comes to ease of use, functionality and preference. Usually competitors don't approach things exactly the same way you are I've found and the differences can make your offering better.

<comment><AUTHOR> Noted. I get psyched out thinking 'they are already at 25k followers and I have 0'. But when I stop and look closer, they could buy followers because their content is not that original or powerful to have that many followers organically.

</comment></comment><comment><USER7> When you talk like that many will think they are going through exact the same things like you.

The greatest thing I discovered about going independet is that there is a salary limit and above that money does not bring any more satisfaction. So there should be space for everyone, forget about competition and negative emotions. As for that limit some say that a few thousands per months is enough to live well. Well for me even one thousand usd/eur is enougn because I rarely make more that that as employee. Just get used with copy cats there is no escape.

<comment><AUTHOR> duly noted. Expectations play a major role in happiness. I read a great article from DHH about his life before and after 37signals.

</comment></comment><comment><USER8> I can think of 2 positives in this: 1\. It provides validation to _your_ idea. Your job is somewhat reduced to validate and find a product-market fit. Remember, it's not a zero-sum game, there is enough room for both of you. 2\. Use your competition as a baseline for your product/service. You can use the gravity/momentum from competition to catapult yourself to higher velocity or get sucked-in.

<comment><AUTHOR> True. Looks like I better start building my rocket and prepare for a test launch.

</comment></comment><comment><USER9> Can you do it better, faster, or cheaper? That's the big question.

<comment><AUTHOR> I think I can, so I'll try. I have nothing to lose. Worst case, I'll use it to improve my skills and to land a job.</comment></comment>


Gilt Groupe Is a Cautionary Tale for Startup Employees Banking on Stock Options - <AUTHOR> http://recode.net/2016/01/19/gilt-groupe-is-a-cautionary-tale-for-startup-employees-banking-on-stock-options/ <comment><USER2> The real problem is 409A -- the provision should only apply to options in publicly traded stock and other similarly liquid comp. In the long-ago times, companies apparently could hand out options with nominal strike prices without any bad tax consequences. Now we have to set the strike price at least equal to "fair market value" on the grant date, even if there's no market for the stock. This imposes a transaction cost toll on early-stage companies, while simultaneously penalizing startup founders and employees.

<comment><USER3> That was imposed because companies would reprice stock options for their executives when the stock dropped. Shareholders hate that; they don't get a bailout like that.

The pre-IPO valuation thing is a mess. It's probably going away; investors are tired of being clobbered when the price goes down on a company that's supposedly successful.

<comment><USER2> Makes sense for a public company, but why impose 409A on startups? While we're at it, why do we tax startup founders on restricted stock grants -- should just tax when they sell the stock, or maybe when it is listed on a public market...? These changes ("reforms" in my view) may never happen, or may take a loooong time though.

</comment></comment></comment><comment><USER4> IMO it's best to regard stock options as worthless, even though that's not technically true.

<comment><USER5> Well, they're financial instruments. And like any financial instruments, they need to be understood. I'm not sure most people understand how stock options work.

<comment><USER6> Exactly, it's silly to say they're worth _nothing_. That's like staying stocks you buy are worth nothing because the value _could_ drop to 0. It's a matter of understanding what the probable outcomes are.

<comment><USER4> Agreed. However, the human mind doesn't cope well with probabilities, so I think letting yourself believe that stock options are worth nothing is a good intellectual shortcut.

<comment><USER7> The real disaster scenarios come not from when they're worth nothing, but when they're worth less than nothing.

</comment></comment></comment></comment></comment><comment><USER8> If you buy listed shares on the nasdaq, and they fall you lose money. duh?

No reason to think it works any differently in a private company - in fact private shares often carry a much higher risk of becoming worthless.

There is no certain guarantee that shares in your current or past employer "is gonna pay for your house".

If you have such an attitude you really should be thinking twice.

This whole "share options for everyone" mentality is a problem.

Share options are for risk/reward seekers - which means you accept the RISK just as eagerly as the reward.

Options are not supposed to be some sort of freebie lottery ticket for everyone.

Its meant as incentive for people with an entrepreneurial spirit who may be taking risks in terms of job security, or those who bring highly specialized knowledge to a startup at below market salary, or as an incentive for employees to work far harder than they would normally be expected to be working.

Tax considerations - definitely get real expert advice

And see what others have said below.

<comment><USER9> You don't owe taxes at the time you buy publicly traded stocks and if you were exercising options on a publicly traded stock you could sell some percent to cover your taxes, that's different than owning a completely illiquid asset yet still having taxes on it.

</comment></comment><comment><USER10> If you are new to stock options, it would be good for you to pay attention here. I am not qualified to offer tax advice, so this is all fiction based on my experiences of paying taxes in the Bay Area while working at startups and larger companies ...

It used to be that you could buy your options and hold them without any tax hit. After holding them for a year, _if you could sell them_ , any gain was taxed at the long term capital gain rate. Since the long term capital gains rate (LTCGR) was much much lower than the short term gain, this strategy reduced the amount of taxes you paid. It was deemed a "loop hole" that the rich used and it needed fixing.

The fix was something called "Alternative Minimum Tax" or AMT. The way AMT works is it ignores the fact that you cannot sell your stock, and asks you to compute if you had sold the stock options you just exercised and treated all of that gain as ordinary income, how much tax would you have owed in that fictional scenario? Then it asks you to compare your tax bill in that fictional universe, and your bill without considering that fiction, and which ever is higher? That is how much you owe in taxes. It doesn't matter how you came by the stock, it could be through restricted stock plans (no cost to you to vest) or incentive plans. The difference between how much you paid, versus how much that stock is theoretically "worth" is treated like ordinary income.

What that means from a practical standpoint is that you are screwed either way. But if the stock becomes worthless you are doubly screwed. First you lose all the money you paid to exercise (the value is now zero) and second, while you can claim a capital loss, that loss can only be applied against an offsetting gain of "like" kind. So back when it was an AMT calculation you had to treat it like ordinary income, but now as a capital loss you can only offset other capital gains. The small concession is that you can consider up to $3,000 as a loss against your income (so you adjust your income down by $3,000 and you end up not having to pay the marginal rate income tax on that $3,000. If you're in California and an engineer making $100K+ annually that means you are probably in the 28% tax bracket paying 28% federal and 11% CA state tax, (39%) so you get to "keep" 39% of $3,000 or $1,170 that you would have paid in taxes.

So are you keeping score? You paid $3,000 in tax on an asset you could never sell, and you got to offset your income by $3,000 so you got "back" $1,170 of it, letting $1,830 of it evaporate into smoke.

You can get it back, dollar for dollar, if you have some capital asset that you're selling and seeing a gain on, then you can apply every dollar of your loss against that gain, up to all of your loss, and not pay any tax on that gain. (that doesn't work for offsetting AMT but does work for an actual capital gain, like sale of property or equity you were already holding).

The system is designed to take money you might have otherwise been entitled to out of your pocket and to put it into the general fund of the government so they can spend it poorly on their own programs (ok that is a bit cynical but seriously, I would be totally ok if they told me I had to give some to charity.)

If you don't have capital gains you want to offset, don't exercise your options until you can actually sell them. If they are going to expire before you can sell them, the safe play is to let them expire.

<comment><USER11> Don't exercise until you can sell is great advice, but the giant wrinkle (particularly now that startups take far longer to go public) is if you don't wish to work for a company for 10+ years, you have a short exercise window after leaving a company. Some (very few) are converting ISOs to NSOs if you leave, allowing former employees to wait until the security is liquid before buying it.

My suggestion to all engineers is to use the leverage you have and insist that vested ISOs convert to NSOs if you leave a company. If they don't want to do this, well, there's a reason, and it's not good for you. At minimum, they intend to crank those golden handcuffs tight, and if you have life changing events in the 5-10 years it takes a company to go public (want a house, partner wants to live somewhere else, kids, etc)... tough luck. If you continue even without a conversion clause, apply a massive discount (on top of the massive discount you should already be applying) to the "value" of those options.

As for your anti-tax rant... if you want nice things (roads, schools, universities, clean air, judges, police, hospitals, child protective services, efficient postal mail, etc), someone has to pay for them. Charity is no substitute for our collective choice to pay for things.

<comment><USER5> > As for your anti-tax rant... if you want nice things (roads, schools, > universities, clean air, judges, police, hospitals, child protective > services, efficient postal mail, etc), someone has to pay for them. Charity > is no substitute for our collective choice to pay for things.

Upvoting to support the idea that taxes as a concept aren't the problem, here. The problem is this obnoxious system of taxing things which likely have no value.

<comment><USER12> >> "...police, hospitals, child protective services,..."

Wait, are hospitals taxpayer funded in America? If so, why do they charge my insurance such vast amounts of money for tiny services?

<comment><USER13> _Some_ hospitals are taxpayer funded. 2/3 of hospitals in the US are non- profit corporations. The rest are either public (run by the county or state) or are for-profit.

[https://en.wikipedia.org/wiki/Public_hospital#United_States](https://en.wikipedia.org/wiki/Public_hospital#United_States)

</comment></comment></comment></comment></comment><comment><USER14> My main takeaway is to not work for any startups that don't extend the window to exercise options.[1] Employees deserve to get what they earned without having to take on additional risk. Especially with the extended time to IPO these days. Why not do this as a company?

[http://www.businessinsider.com/pinterest-will-let- employees-...](http://www.businessinsider.com/pinterest-will-let-employees- exercise-options-for-seven-years-after-leaving-2015-3)

</comment><comment><USER15> The part of this story that caught my eye was who bought Gilt: the Hudson's Bay Company.

Yes, _that_ Hudson Bay Company. Founded in 1670. Among the oldest joint-stock companies in existence, I'd warrant.

</comment><comment><USER16> I've always seen equity/stock as an incentive to work my ass off, nothing more. They equate to nothing more often than not.

<comment><USER17> I've found cash to be an acceptable incentive to work my ass off. Stock options are the equivalent of lottery tickets.

<comment><USER18> I've always found a cool project, friendly and open team members, good project planning, and an atmosphere of fun as the only effective incentive to work my ass off. Money is great but has never been sufficient to induce inspiration for me.

<comment><USER19> Why are those things an incentive to work your butt off? I see why those would lead to you being happy at your job, but I don't really see why being happy at your job means you should work extra hard. Just curious, as it seems to me those are things which would make someone stay at their job for a long time but not necessarily work extra hard. After all, it's not like your not working extra hard would lead to losing to those things.

<comment><USER20> Some people work extra hard when they really enjoy what they're doing, such as those athletes that dedicate their whole lives to a given sport.

</comment></comment></comment></comment></comment><comment><USER21> "We're gonna party like it's 1999 ..."

I guess some things never change, oy vey</comment>


Ask HN: What stack would you use to build a CRUD web app in 2020? - <AUTHOR> <comment><USER2> I think it depends a lot on what's already in place. Are you a Microsoft shop? ASP Core is your obvious choice. Already doing Django? Keep doing Django.

If the question is what stack you would choose for a personal project, I think the answer is "Whatever you think looks interesting."

<comment><USER3> Agreed. My default would be C# with ASP.Net Core (though there are also other options), but that's because it's my favorite and the clients I work with are primarily MS shops. Yeah the front end may be Vue or Angular or React, but all of the backend code and competence is in C#. Since it's also where my area of expertise primarily is it's an easy choice.

Unlike OP here, I would make the same choice for my personal projects, but that's because I'm well into my career and life. I have plenty of personal projects, but they're all about _doing_ something, not about learning a completely new tech stack just for the sake of it. If it takes me 100 hours instead of 10 or 20 because I'm also learning a new stack, for better or worse, it's not worth doing to me.

</comment></comment><comment><USER4> [https://prisma.io](https://prisma.io) is a good choice, I know successful companies scaling while only running a single instance.</comment>


C's 'while' is spelled 'for' in Go - <AUTHOR> https://tour.golang.org/flowcontrol/3 <comment><USER2> It's kind of sad that "for" is the keyword programming languages settled on for the loop construct.

Ever since its counterpart "do" was dropped from the for-statement, it's just been utterly nonsensical. I mean how _on earth_ does the word "for" convey a loop?

With the recently designed languages like Go and Swift taking so many cues from the Pascal side of the ALGOL language family, how nobody thought to pick up "repeat" or "loop" is simply beyond me.

<comment><USER3> > It's kind of sad that "for" is the keyword programming languages settled on > for the loop construct.

Many languages only use `for` to mean a for-each style loop where it reads quite naturally:

Python - `for n in range(1,10)`

Ruby - `for i in 0..10`

Rust - `for n in 1..10` (also picked up the bare `loop`)

Others support for-each style loops along with the less than ideal C-style for loop:

JavaScript - `for (n of [1,2,3])` (second attempt, for-in has too many gotchas.)

Java - `for (int n : {1,2,3})`

Otherwise I agree that `while` reads far more naturally. I guess they must have wanted to minimize the number keywords in Go.

<comment><USER4> Interestingly, the more common way to write that in Ruby would be `(1..10).each { |i| ... }`, or (in the case of needing a multi-line block):

``` (1..10).each do |i| ... end ```

"do" does end up getting used, but only as syntax for a "block" (similar to what other languages would call a lambda).

Ruby also has a shorthand for when you want to do something `n` times without caring about the iteration number:

``` 10.times do ... end ```

One final note is that loop you wrote above is actually different in Ruby than it is for Python and Rust; `x..y` is an inclusive range in Ruby, whereas `range(x, y)` in Python and `x..y` in Rust are exclusive on the right side. I think you might have realized that since you used different starting values for the other two, but you got it backwards; the Python and Rust loops will loop only nine times, whereas the Ruby one will loop 11 times. Ruby does have a syntax for exclusive ranges though; `x...y` is an inclusive range from `x` to `y - 1`. Similarly, in Rust, `x..=y` gives an inclusive range from `x` to `y`. I don't know of any way to do an inclusive range in Python other than manually, but someone with more Python knowledge might be able to provide something for that.

<comment><USER5> You can kinda use `do` for looping with a Block and Kernel#loop :v [https://ruby-doc.org/core-2.7.1/Kernel.html#method-i-loop](https://ruby- doc.org/core-2.7.1/Kernel.html#method-i-loop)

</comment></comment></comment></comment><comment><USER6> It's a nice refinement over the C version, though do-while would also be convenient to handle paginated batches of work without unrolling the loop.

for-range _desperately_ needs to support some interface that would make user- defined types iterable.

</comment><comment><USER7> Looking at the syntax (as a Go beginner), I'm not really sure whether that's less or more to learn. Seems like one of those arbitrary language design decisions that don't make a huge difference either way.

<comment><USER8> Yeah when I picked up Go, the infinite loop caught me by surprise:

      for {
        ...
      }

<comment><USER9> Looks like a minor simplification of

      for (;;) {
         ...
      }

I'm biased by my experience with c, but I do like the explicit punctuation.</comment></comment></comment>


Ask HN: CrossFit or Not? - <AUTHOR> Does anyone have experience with Crossfit or suggestions as to whether or not you would recommend it?  Thanks! <comment><USER2> It probably depends on the group you choose. Try a couple if you don't click with the first one.

The emphasis really is on the "cross." I was a fat slug (and I am once again, I got sick). They were good folk and they let me do what I wanted and what I could. I was amazed after a few months what I could do.

I don't think it makes sense to do one or two things exclusively, we have a lot of muscles that do complicated things. Crossfit makes sense and it worked for me.

</comment><comment><USER3> In the end it's a tool like anything else. This tool requires the user to commit to learning how to use it and then the necessary practice to realize the benefits. You can do this on your own or under the instruction of someone else. I came from a triathlon background but decided I was over the long periods of training. I tried CrossFit and haven't looked back. I enjoy the variation and yes, I enjoy the competition aspect of it.

</comment><comment><USER4> If you devote enough time to CrossFit and work hard, you will end up in peak physical condition, just like Greg Glassman, the founder of CrossFit:

[http://games2010.crossfit.com/static/images/megan_glassmanin...](http://games2010.crossfit.com/static/images/megan_glassmaninsights.jpg)

I recommend starting with a favorite CrossFit exercise: kipping pull-ups. They're a great way to rid yourself of unwanted arm mobility.

After you've gotten your elbows in top shape with kipping pull-ups, I recommend focusing on the CrossFit kettlebell swing (AKA American swing, not to be confused with the hard-style swing). This exercise is so cutting edge that it has yet to be recommended by any competitive kettlebell lifters (girevoy sport) or their coaches. Interestingly, some of these aforementioned people are critical of the CrossFit swing, but I assume this is because they're Russians and Easter Europeans who lack an appreciation for the kind of think-outside-the-box innovation that comes natural to American entrepreneurs such as Glassman.

</comment><comment><USER5> A program like CrossFit only works if you stick with it for a decent amount of time. If you stick with it, you will see significant gains in endurance, strength, and overall fitness. I would definitely recommend at least trying out the CrossFit gym nearest you and seeing how it goes.

</comment><comment><USER6> My experience was very positive. However, the instructor I had was also my martial arts instructor who is very good natural teacher. I have heard the quality of a CrossFit instructor can vary a lot.

Try it out, but don't buy into any faddish aspect and don't overdo it.

</comment><comment><USER7> depends on what you're looking for. If it will get you into the gym and nothing else will, go for it. If you don't have the interest or discipline to go on your own, go for it.

If you'd like to see maximal strength/muscle gains, go see a powerlifting/olympic lifting coach for a few sessions (or join their likely weekly program for not very much $$) and do a linear progression program like Greyskull, Starting Strength, etc.

"but what about my core?" Guess what? After years of squatting on medicine balls packed to the ceiling, I can't say I had a strong core. Squat 2+x your body weight and you'll be surprised how magically strong your core gets :-)

</comment><comment><USER8> My advice is similar to jsonmez.

If you are trying to lose weight, I would mainly focus on weight training. I would also add in walking, swimming, running, or biking.

Diet wise: more protein rich food, more fruits and veggies, and cut out high- fructose corn syrup/high sugar products. Eating healthy is just as important as the exercise itself.

</comment><comment><USER9> It is a scam. Just lift weights and do cardio. 8-12 reps 3 sets. Eat right. Don't buy into fitness fads. :)

<comment><USER10> CrossFit isn't a scam. It's just another tool for in the realm of eating less and exercising more. I'd say CrossFit is worth if you like it, the price is right, and it's convenient.</comment></comment>


Quasar and Akka – a Comparison - <AUTHOR> http://blog.paralleluniverse.co/2015/05/21/quasar-vs-akka/ <comment><USER3> Seems like a very one sided comparison. Most other posts from paralleluniverse have also come off this way.

<comment><USER4> Anytime I see "Not needed" instead of "No" in a feature comparison chart, I am inclined to just stop reading.

<comment><USER5> In this case, as in many others, "not needed" means that one abstraction that is present makes other abstractions unnecessary. For example, if blocking is free, a non-blocking API is not needed, or if actor receives are selective, then message stashing is not needed. Saying "no" would imply that the functionality is missing, when in fact it is present only doesn't require a separate abstraction.

</comment></comment></comment><comment><USER6> Saying Quasar supports Kotlin/Clojure as though Akka does not (considering both languages interop with Java) is unfair. There is a difference between bytecode manipulation making alternative JVM languages impossible vs just not having a language-idiomatic wrapper.

There a few other parts I take slight umbrage with (e.g. pretending Akka is heavyweight, has deployment rules, incomplete integration information, etc) but overall a nice informative comparison if a tad biased feeling.

<comment><USER7> Some of it is definitely misleading. Saying that Akka forces you into a logging library when it can be used with log4j, logback, provides a bridge with slf4j, etc, is just being uncharitable. As is claiming that "commercial tools" are needed for monitoring when JMX can be used just as with Quasar. Same with labeling Akka's clustering support as "experimental". Akka dropped that status from the clustering module a while ago (I had it in production for over a year).

I get that it's marketing material so it's going to be biased but I can't help but feel that one too many liberties were taken in making Quasar look good.

<comment><USER6> This is most evident in the conclusion: "Akka [...] is a totalizing choice", "blocking is free", "Akka [...] the way to go if [...] you have embraced Scala", "Akka [...] betting on a framework and sticking with it [...] high rewrite price", on and on. In retrospect I would remove "a tad" from the last sentence of my original post.

<comment><AUTHOR> Can you expand on why you think these statements are not correct? I think they are thoroughly explained in the post.

<comment><USER6> * Akka is not a totalizing choice, it's just a concurrency mechanism. Many people to not bury logic in there but in traits or other places handling normal futures. That's like saying if you use threads, it's a totalizing choice regardless of where the majority of your code resides.

* "blocking is free" is contradicted right up earlier in the post with "highlights the additional cost of the real lightweight threads in Quasar"

* I will admit, between these two choices, you must choose Akka if you embrace Scala. But the inverse is not true.

* I don't believe it's a high rewrite price any more than any other library is. Do I pay a high rewrite price for using any other abstraction? I mean I just have functions that return futures, but because I composed them with Akka I can't rewrite it?

In general I think it's unfair to make assumptions or opinions here. To compare objectively is one thing, but to say something is a choice one way, requires you code one way, etc is invalid.

<comment><USER5> > Akka is not a totalizing choice, it's just a concurrency mechanism.

... that doesn't play nice with any other Java (or Clojure) concurrency mechanism.

> "blocking is free" is contradicted right up earlier in the post with > "highlights the additional cost of the real lightweight threads in Quasar"

Well, very nearly free, and the cost will drop further.

> I mean I just have functions that return futures, but because I composed > them with Akka I can't rewrite it?

Pretty much. Java code doesn't work that way, and certainly doesn't integrate with Scala futures. Also, you commit to using non-standard APIs in much of your application. With Quasar you'll likely write the REST endpoint in standard JAX-RS, and run it on top of Tomcat or Jetty or JBoss. So Akka is a library that 1/ encompasses many facets of your application, 2/ uses non- standard APIs everywhere and 3/ uses non-idomatic APIs that are very hard to compose with other Java libraries.

> to say something is a choice one way, requires you code one way, etc is > invalid.

Akka does require you to write asynchronous code throughout the entire call- stack.

<comment><USER8> > _[Akka] doesn 't play nice with any other Java (or Clojure) concurrency > mechanism_

I've been using Akka in combination with Scala's Futures, with Java 8's CompletableFutures, with Rx Observables, with in-house asynchronous queues and I can't see how Akka doesn't play nice. With the introduction of the reactive streams protocol, piping streams of events between multiple libraries becomes really easy as well.

> _Java code doesn 't work that way, and certainly doesn't integrate with > Scala futures._

Akka exposes a Future interface for Java, however I don't see the problem with working with Java's CompletableFuture or whatever is in Guava. I've done that, it's quite OK. Also, along with Scala 2.12 (now in milestone), Futures from Scala will be usable straight from Java 8.

> _With Quasar you 'll likely write the REST endpoint in standard JAX-RS, and > run it on top of Tomcat or Jetty or JBoss._

You can do that with Akka as well, I've done that, I don't see the problem there.

> _Akka does require you to write asynchronous code throughout the entire > call-stack._

I've worked on an RTB system processing over 30000 transactions per second, I'm working now on a system processing real-time events coming from industrial machines. I've been using Akka where it makes sense and while I only played with Quasar, I do have a lot of experience with Gevent and Eventlet in Python and the bit about "synchronous" and "blocking" code being easier (while cheating by patching connections) is bullshit, for one because sometimes it doesn't work creating more problems than it solves and because it doesn't simplify anything of importance. People should write asynchronous code throughout the entire call-stack, it's doable and fun with the right tools ;-)

I expanded a little for the why in another comment: [https://news.ycombinator.com/item?id=9585424](https://news.ycombinator.com/item?id=9585424)

<comment><USER5> > You can do that with Akka as well, I've done that, I don't see the problem > there.

The problem is that your (JAX-RS) endpoint will then not scale as much as your business logic.

> People should write asynchronous code throughout the entire call-stack

Ah, but why? Forget for a second about Quasar and its current implementation. Why on god's green earth should people ever consider writing asynchronous code? Correct me if I'm wrong, but the _only_ answer to that is "to avoid blocking threads, which is expensive". If you had a way to make blocking threads inexpensive and therefore _not_ have to write asynchronous code, wouldn't that be better (even if you think async code is not hard)?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Quasar is going the right direction - writing synchronous code is better - <USER2> code is simpler and cleaner. There is no inherent performance penalty in synchronous approach, it's just the runtime systems of many popular languages make it so - statically allocated stack, and some penalty of context switch via system call. In addition to the languages mentioned in the article (Go, Clojure core.async, Erlang), Gambit Scheme deserves to be mentioned, winch can spawn millions of lightweight (green) threads. Also there was Stackless Python.

BTW, no need to describe the implementation in terms of continuations. It's just enough (I think) to allocate function activation records on heap instead of statically allocated stack. (AFAIK continuations are also implemented similarly, although what I've read about Go, their call stack management is something more complex)

Also, I think the "actor model" is not the final solution for scalable distributed programming, it's just some initial, and IMHO pretty clumsy step. We will have better approaches soon.

<comment><USER10> I feel like Actor is a quantum leap ahead of all the previous and current paradigms, like Promise and Future and Async. What do you think makes it clumsy and why do you think we have something better in store?

<comment><USER11> The problem, I suspect, is that there isn't really one formal "actor" model that everyone agrees on. People have used it to describe formal models like CSP and linear logic, practical systems like the Erlang VM and Go's green threading implementation, and capability-based systems like the (provably secure) SEL4; these are _not the same thing._ And, not to pick on you specifically, this is exacerbated by confusingly referring to "promises, futures, and async" as "paradigms." Promises and futures are for the most part identical, and I don't see how you can meaningfully call them "paradigms"\--they're just APIs. "Async" (async what?) is _maybe_ abstract enough that I'd be willing to call it a "paradigm," but I don't see how actors don't also fall into that category.

<comment><USER10> could you point to a place where anyone's said that Go, or any other CSP system, are Actor systems? That would be interesting to see.

Promises and futures are not actually identical; and they're paradigms, because they are concepts shared across a large number of different languages. 'Async' is the P in CSP, as in C# (called 'async'), and as in ES7 ([https://github.com/lukehoban/ecmascript- asyncawait](https://github.com/lukehoban/ecmascript-asyncawait)). Hope this helps you.

</comment></comment></comment></comment><comment><USER12> Just wanted to comment on the "Blocking vs. Non-Blocking" nature of the different actor implementions. The article here says

 _A reason for choosing the asynchronous, callback-based approach has been that blocking plain OS threads entails significant overhead (as does the mere existence of many threads), which can be avoided with a non-blocking API. However, because Quasar – just like Erlang and Go – has true lightweight threads, blocking carries virtually no overhead_

In my opinion the difference is much then whether an OS thread is blocked or not. Being able to make synchronous-looking (but not-thread-blocking) calls inside Actors still will block the Actor for other incoming messages for that amount of time. So you have states were the Actor is unresponsive - and with the right amount of dependencies between Actors you can deadlock.

A Actor which doesn't use any blocking calls internally will be more responsive and less prone to deadlock. But of course - you have to model more states explicetly. E.g. if I have an Actor routine that's like

      while true {
        var msg = await mailbox.Get();
        if (msg is XYZ) {
          var result = await doSthAsync()
          updateState(result)
        }
      }

and would like to transform that into a completly nonblocking implementation then I would need to model an extra state and probably handle messages differently in the timeframe between doSthAsync() was sent and the result is received.

This can be a good thing (you can be more responsive and all states are explicit) and also a bad thing (more verbose code).

Important is also that with the blocked Actor one get some kind of backpressure strategy for free. Whereas with the nonblocked Actor one has to handle that also explicitly.

I tried both concepts in my recent work, the blocked actor mainly with F#'s mailbox processor and the nonblocked with my own implementation and personally favor the second version now. I find it quite useful to think about and model Actors as state machines and beeing able to handle all kinds of state transitions explicitly. It also made deadlock prevention easier.

Nevertheless I'm seriously impressed about the capabilities of Quasar and Pulsar.

<comment><AUTHOR> I'll only add that Quasar offers several types of "send" and "receive" operations: blocking indefintely, with timeout and even "try" variants that will not block at all, as well as several mailbox types, so the developer can regulate queues, responsivity (and backpressure) as desired.

</comment></comment><comment><USER13> How much does the fact you have non blocking green threads matters when you have a cluster of 100 machines? Yes, internally in each machine there are less kernel threads and less overhead, but If an actor on one machine sends a message to an actor in another, does it matter if it's a jvm thread or a fiber?

<comment><AUTHOR> If you want regular code and not async, then yes, it matters: if you have a lot of OS thread-based actors performing blocking network "send"s as part of their regular control flow, each of them blocks an OS thread and you'll run out of resources soon. If those actors are backed by lightweight threads instead, which are very frugal, basically you are only limited by the network stack.

<comment><USER13> My thought is that always the network is the bigger bottleneck. But I guess it depends on the data / OS etc.

</comment></comment></comment><comment><USER8> The article is full of incorrect statements and biased opinions, I stopped reading at some point, because even though I think Quasar is really interesting, this article has been a turn off. Some things that bothered me ...

Akka follows the Erlang actor model pretty faithfully and what you do in the actor model is that you model _state machines_. In Scala you can also work with scala-async [1], which is basically what Quasar does, but that is not enough because calling a function and getting back some future result is only a really simple use-case, whereas in practice you get streams of messages and the communication is a bidirectional ping-pong.

So you work a lot with context become/unbecome [2], which is very much like what you'd do in Erlang for evolving state. This is because modeling a communication protocol requires multiple stages and a constant dialog with the other side. Even in a simple producer/consumers relationship you need back- pressure. Pretending that the communication is somehow synchronous is not going to fix the non-deterministic nature of this process and the logic will end up looking mostly the same. This is because it's not the asynchronicity that bites you ;-)

Quasar cannot make blocking I/O to not block threads, although it's clearly stated in the article, but that's just wrong. You can indeed patch connections to work with Quasar's fibers, working much like how you patch sockets in Python with gevent, so you can create your own JDBC data-source that plays nice, but that's not the same thing.

This really means that your pieces of I/O logic are still separated into blocking and non-blocking (red versus blue) and I'd rather see which is which by seeing `Future[T]` or `Observable[T]` in my function signatures. Therefore I disagree that Quasar code is more readable, but at least I'm willing to admit that YMMV.

Also, that Quasar actor given as an example has nothing to do with the actor model. This is because in the actor model the actors are untyped. If you type your actors, then you're not talking about the actor model anymore and you'd be better off with another computational model. At the moment it is completely futile to try to type state machines that work in a non-deterministic highly concurrent environment. And if you go through the effort of typing those actors, then you have to at least recognize that actors can communicate with multiple other actors at the same time and thus expose multiple interfaces. And then you can say that at the very least your typing says something more useful than Object or String.

I could write more, but I got tired.

[1] [https://github.com/scala/async](https://github.com/scala/async)

[2] [http://doc.akka.io/docs/akka/snapshot/scala/actors.html#beco...](http://doc.akka.io/docs/akka/snapshot/scala/actors.html#become- unbecome)

<comment><AUTHOR> In Akka an actor is basically a message handler; I personally think that being able to use regular control flow constructs is an easier way to model state machines than swapping around message handlers.

scala-async looks more like core.async's go to me, i.e. it macro-transforms blocks of code that include special constructs into some continuation-passing style. Quasar implements lightweight threads on the JVM (via bytecode instrumentation, which is a language-independent mechanism), and this is a different thing: no special constructs are needed, you just write regular blocking code (only in lightweight threads, that have basically the same interface and usage as regular Java threads) using normal method calls and control flow constructs. Quasar will take care of blocking/resuming/scheduling efficiently.

As for I/O, Quasar integrations allow lots of fibers to make blocking calls _without_ as many OS threads blocking. The underlying implementation mechanism is often to tap into an async API, suspending fibers when an async call is started and installing an handler that will resume them when the async call completes. Quasar includes such an integration with Java NIO for files and sockets and more are available in Comsat (e.g. with servlet async, async HTTP clients etc.).

I agree about typed actors not being too helpful in dynamic, complex and highly concurrent environments, but in some situations (e.g. transient one- receive actors) they can help keeping communication in check more statically. Of course one can just avoid using types if not needed and Quasar behavioural actors are actually untyped.

</comment></comment><comment><USER14> If best things were winning we would all be using Mercurial and JS would be long dead. Popularity and endorsment decide.

</comment><comment><AUTHOR> By the way I'm the author of the post so feel free to get in touch, I'll be glad to answer any questions.

<comment><USER15> On GitHub, Akka has 14659 commits, 82 branches, 150 releases, and 188 contributors. Quasar has 1753 commits, 14 branches, 9 releases, and 7 contributors.

All other statistics are also massively in favor of Akka (just look at the numbers for this past week, or the number of contributors that are really active in both projects).

Akka is serious business software, that companies can safely rely on, without gambling their money. It is easy to use, performant, low risk, and has an incredible team of very capable developers who have been perfecting it for years. And "serious and safe" does not at all mean static: they constantly keep pushing the state of the art (I didn't see anything in the article about Akka Streams, Spark, the upcoming typed actors, any emphasis on the usefulness of message persistence, ...).

If you want to challenge the market leader, you will need more than biased reviews: you will need more people working on it, more activity, and real-life success stories.

<comment><USER16> I'm not affiliated with either horse in this race, but it would be good for you to explain exactly what about those repo statistics favors Akka. Seems like the numbers are larger, of course, but I'm aware of no relationship between any of those numbers and project quality. Or anything else, for that matter.

<comment><USER15> I am also not affiliated with either.

When you choose the backbone of your architecture, there are other things to consider, in addition to technical aspects. The numbers I mentioned give an indication of some of those aspects.

If I look at Quasar in GitHub, it seems to have only two developers who are really active: the same two people who are writing on this thread. Let's say I adopt Quasar and base my architecture on it. What happens when these guys land a big project paying big money with a big client? Will they have time to fix issues? Will they have time to develop new features? Will the big client dictate the direction of new developments?

Look at Akka on the other side. They have people like Jonas Bonér, Viktor Klang, Roland Kuhn, Mathias Doenitz, etc. People who are not only amazing developers, but who are also thought leaders. These guys publish books on the subject, speak at conferences, conduct massive online training, and have industry recognition. And they are just the tip of the iceberg. They have a team of less-famous but equally amazing rock star delelopers working with them. Akka gets more solid as time progresses, not only technically but also in terms of market perception.

On which of the two horses would you place your bet?

Quasar may have its technical merits, but unless it comes up with a really compelling feature that gives it a sustainable advantage against Akka, it has no chance of winning.</comment></comment></comment></comment>


Show HN: Comingsoonpage.com - <AUTHOR> https://www.comingsoonpage.com <comment><USER2> First and foremost, congratulation and good luck.

You sorely need a free tier, with limited emails or less features (say for example, no referrals).

This is the second try of this kind I see on HN and I think there definitely is a market space to fill for this kind of service. But for something so simple (many people just use the free tier of mailchimp to set up a basic subscription form) you probably need to invest massively into a free tier to get the word of mouth out.

Also: a live demo would be nice.

</comment><comment><USER3> I really think you need a free level maybe up to 100 emails or something. otherwise I'm not sure how you market this.

Also, a list of pages/projects within categories. And a way to sign up for updates of new projects/pages in categories.

So, if someone create a new "tech product" page I can get an update of that category(tech products) I might be interested in.

So, as your community grows you add more value.

</comment><comment><AUTHOR> Hey All,

This is an app I put together to create coming soon pages quickly. Would love any feedback. Thanks</comment>


Calculating pi with AGM and mpmath - <AUTHOR> http://www.johndcook.com/blog/2012/06/03/calculating-pi-with-agm-and-mpmath/ <comment><USER2> The idea is nice, but the code is a little flaky. For example, change the number of decimals from 1000 to 2000 and it enters an infinite loop, but 4000 works again. This occurs because due to rounding a and b might not converge to the exact same value.

A more reliable way to write the algorithm is this:

        n = 0
        while not almosteq(a, b):
            n, a, b = n + 1, (a + b)/2, sqrt(a*b)
            series += 2**(n+1) * (a*a - b*b)

<comment><USER3> Good catch. I updated the post so that it tests for a > b + epsilon instead of a == b.</comment></comment>


DocuSign email address database breached and used for phishing campaign - <AUTHOR> https://trust.docusign.com/en-us/personal-safeguards/ <comment><USER2> This is the exact reason I started building Breach Canary[0], so that businesses can be alerted as soon as their user data is used in a way they wouldn't expect it to be. We produce authentic users with real working email addresses and phone numbers, so that as soon as they are contacted, you know someone has a copy of your userbase and is using it for reason x.

We have already started seeing a tonne of DocuSign phishing emails as others have mentioned. They were already a popular target for phishing users but now with very realistic documents the users are expecting? Nightmare.

[0] [https://BreachCanary.com](https://BreachCanary.com)

<comment><USER3> I presume canary is an established term in this context but since I don't know what it is I don't understand your service. It sounds good though.

<comment><USER4> It is coming from the canary birds in the coal mines or in submarines[0]. They have a higher sensibility to CO than humans. This is now part of the common language to say that you sacrifice an animal or "something" to get early warning of something possibly more dangerous.

[0]: [https://en.wikipedia.org/wiki/Sentinel_species#Historical_ex...](https://en.wikipedia.org/wiki/Sentinel_species#Historical_examples)

<comment><USER5> Just wondering, what exactly is being sacrificed in this specific case?

<comment> kuro-kuris It is artificial users when their data is used it means your privacy has been breached. In a way a canary is not just a sacrifice but a transparent sacrifice.

</comment></comment></comment></comment></comment><comment><USER6> I'm not sure DocuSign has a full handle on what happened here yet. I received six (6) DocuSign emails, half of which used a convincing subject derived from actual DocuSign documents I have signed or processed through the system. Perhaps a coincidence? Or these hackers gained access to more than just "email addresses".

<comment><USER7> Hmmm yes I have received a few and if I recall, some of them had titles very similar to docusign documents I was previously sent.

Exact titles similar to this: "Accounting Invoice 630761 Document Ready for Signature"

<comment><USER8> The postmortem states that the phishing campaign used only a few patterns.

"Delete any emails with the subject line, "Completed: [domain name] – Wire transfer for recipient-name Document Ready for Signature" and "Completed [domain name/email address] – Accounting Invoice [Number] Document Ready for Signature". These emails are not from DocuSign. They were sent by a malicious third party and contain a link to malware spam."

Did you received phishing with other subjects?

<comment><USER9> As a general rule, if you receive an email referencing wire transfers, it's probably bogus.

<comment><USER10> Given the ratio of spam to ham, as a general rule every email is probably bogus.

<comment><USER11> Youd think that, but I never seem to get spam bug reports or feature requests. Always sex, drugs or money related it seems.

<comment><USER12> Now you've just given me new, horrifying, nightmares of the future.

\----

Feature Request: Your software does not make it easy to buy drugs, money, or sex as buydrugsmoneyandsex-dot-com does. Please implement buydrugsmoneyandsex- dot-com functionality by directing users to that website through our affiliate link program: [http://preview.tinyurl.com/2tx](http://preview.tinyurl.com/2tx)

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> In my opinion they're doing well taking responsibility like this and communicating honestly and openly. You can always disagree on how far the openness should go, but I've seen far less openness and far less communication (as in approaching zero), so they deserve some credit doing it this way.

</comment><comment><USER14> Thanks Every Employer I've Had In the Past 6 Years For Putting My Email In A Service I'd Never Want Otherwise.

Also Thanks Me for just using docusign w/ our employees when I was in charge.

<comment><USER15> I strictly started handing out "firstname.lastname@example.com" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

<comment><USER16> I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actual company's name as an alias in my client.

<comment><USER17> AliExpress does this, they don't accept "firstname.lastname@example.com". I suppose it's meant to stop you from providing "email@example.com", implemented lazily by rejecting anything that contains the substring "aliexpress".

Best response I've received when giving an email address of the form "email@example.com" to a representative in person was "oh you work here too?". The concept of catch-all domains is so foreign to most laypeople that it takes quite some explaining ("I get everything that's sent to any address at that domain", "no it's not expensive at all", "it helps me automatically sort my email").

<comment><USER18> A catchall on my domain was all fun and games till the second dictionary spam run.

<comment><USER19> I've heard that being a problem, though I've never had that issue using a sub- domain for the catchall (email@example.com).

Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.

<comment><USER20> Gmail allows you to do extension addresses like "firstname.lastname@example.com", which I've used since switching away from my own mail server where I did the catch-all. Some places are rejecting "+" in the address though. I was trying to give on to Dell and the tech I was talking to told me the system wouldn't accept the address, but that the "+dell" was just an extension "so can I put it in without that?"

The combination of them knowing that this was valid and just wanting to strip off the extension kinda blew my mind for some reason.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Looks like it took them about six days to figure out why their customers were getting spammed. It'd be helpful if they could outline what the "non-core system that allows us to communicate service-related announcements to users via email" actually was. Was this a Mailchimp account that got hacked into or did they have something they managed?

<comment><USER22> I had the same impression. Pretty sure it was their MailChimp (or similar service) account.

<comment><USER23> Yeah or an api key leaked

</comment></comment></comment><comment><USER24> Emails and email addresses are _very_ different in the context of DocuSign. The former includes the text of contracts. The latter is just a list of people who have ever given or received a job offer.

<comment><USER25> Sure they're different but make no mistake: emails being breached are a big deal! This is an appropriate response [https://twitter.com/troyhunt/status/864315287092342785](https://twitter.com/troyhunt/status/864315287092342785)

<comment><USER26> I fail to see how slightly wider dissemination of a bit of info I post publicly on my profile at this very web site constitutes a privacy or security risk to me.

<comment><USER27> Well, that is you. Others just might be quite a bit more careful. Or is that inconceivable for you?

</comment></comment></comment></comment><comment><USER28> > Ensure your anti-virus software is enabled and up to date

Uh, really, endorsing antivirus? They could at least have written something like "Ensure your system is properly secured" if they felt they need to stress that out.

<comment><USER29> And ~90% of the recipients would think "ensure my system is properly secured? How the heck do I do that?"

<comment><USER30> Well, atleast now they are THINKING about how they might do that rather relying on the mystical protection spell of antivirus which usually reduces the security posture of the machine.

</comment></comment></comment><comment><USER31> Ok, they deserve credit for openness, definitely.

Is it just me that feels this way, or should they not also apologize for the leak (which appears to have been from one of their systems)? I didn't see an actual apology.

</comment><comment><USER32> It amazes me that Facebook allows you to get pgp encrypted emails delivered from them[1], but docusign, a company whose only job is secure document signing via secret links in an email, does not.

[1] [https://www.facebook.com/notes/protect-the-graph/securing- em...](https://www.facebook.com/notes/protect-the-graph/securing-email- communications-from-facebook/1611941762379302/)

</comment><comment><USER33> Been receiving fishing mails for this myself and I highly doubt this has just been about email addresses, as the mail subjects contained titles of signed documents.

</comment><comment><USER34> Since there are now many occurrences of data breaches out there. I cannot stress enough the importance of a password manager and diversify-ing your passwords.

This one I learned from Troy Hunt and never looked back.

[https://www.troyhunt.com/only-secure-password-is-one-you- can...](https://www.troyhunt.com/only-secure-password-is-one-you-cant/)

</comment><comment><USER35> I did get an email from them which looked actually legit and opened it. It redirected me to a 404.

Is there a chance I could've been compromised in any way? I'm guessing they couldn't have gotten much more than my IP address, maybe some cookies, all my passwords, private life?

</comment><comment><USER36> It's good to see major security issues featured on HN. As a consumer, I typically react by resetting credentials, checking configurations etc. I'm not involved in the IT security field so HN serves is one of the early warning systems for me.

</comment><comment><USER37> I've got a ton of these phishing email in the last week. They were all pointing to a russian website. Pretty bad security fuckup by Docusign.

</comment><comment><USER38> The phishing emails had the color scheme changed, making them very phony and easy to classify.

<comment><USER35> They still got me! :>

</comment></comment><comment><USER39> I've been getting these fake DocuSign phishing emails for the last 2 weeks.

</comment><comment><USER40> Are there more to email addresses that were leaked? how do we know they did not?

</comment><comment><USER41> I would like to urge the Google team to solve one aspect of this problem, forever.

It takes no more than 20 minutes to prototype and then approximately 1 day to fully test the final solution that is necessary on their end to keep compromised emails from being fully compromised addresses forever, without any chance for you to ever know at any point in the future where mail REALLY comes from. Here is a description:

1 - Currently they (Google) correctly do 99% by allowing you to type a + after your email address to create a new inbox that is marked in a special way. For example if your address is email@example.com then you can give the company email@example.com when you sign up - that inbox goes to you and when you start receicing spam in the future to "jsmith747+docusign" you can tell how they got it. The phishing mails associated with this breach would have gone to the same place.

2\. The one and only problem with this, which currently has a "security through obscurity" solution, is that anyone can run a regex and remove +docusign to get at the primary, main inbox: firstname.lastname@example.com

3\. The full and complete solution is to allow me to create a new inbox in Gmail through a single step, for example "j45rsdfjdocusign" which is linked to jsmith747 in a single direction. Sending mail is not necessary. This must be enabled through the Gmail interface for signed-in users who wish to create a new inbox. They must be able to generate an inbox there, which thereafter goes to the inbox.

4\. Spammers have no way to programmatically get the original underlying address when going through a list. When they get to j45rsdfjdocusign there is no regex they can apply to get the original.

5\. If in the future j45rsdfjdocusign starts getting spammed, etc, you can add a filter.

There's no special authentication around it, anyone signed into their inbox should be able to do do it. They already have the infrastructure up for it around their + coding shceme.

To emphasize how important it is, here is a comment from this thread:

>The phishing emails had the color scheme changed, making them very phony and easy to classify.

Today. Under the current status quo, if in 48 months a much more legitimate- looking mail is sent to any of the same addresses, none of the recipients have any way to know the source of those addresses.

However, after solving this security issue, in 48 months anyone receiving even a very convincing phishing email could know instantly "oh, that is that compromised docusign account" \-- that is, if they haven't taken a moment to redirect that inbox to the trash already via a filter.

I urge Google, who has very talented engineers, to implement the correct solution today. Don't wait. You won't get a better example of how important this is, than what's been going on. There are no policy implications as you already do it via the + trick.

I hope you go the extra mile and add a small step to finish solving the problem. Thank you.

<comment><USER42> > The full and complete solution is to allow me to create a new inbox in Gmail > through a single step, for example "j45rsdfjdocusign" which is linked to > jsmith747 in a single direction.

When hosting your own email on your own domain you get this benefit out of the box now, without waiting for google to add it for you.

I've been doing this for years, each different company gets a unique email address. Real easy to see who has lost track of their email database, and very easy to turn off those that turn spammy as their business declines and they get ever more desperate to generate sales from their existing "customer list"

<comment><USER43> That solves this one issue, but now you're fully responsible for your email server's security. While this may be a feature for some, for the general (developer) public, it's a bug.

<comment><USER44> Many cheap hosting services offer catch-all email option for your domains, and my own experiences using various services says it's generally included in the price i.e. "free".

</comment></comment></comment></comment><comment><USER45> Wow, I just signed up for this today. Unbelievable. The timing.

</comment><comment><USER46> >The emails "spoofed" the DocuSign brand in an attempt to trick recipients into opening an attached Word document that, when clicked, installs malicious software.

I love how nothing changed about this malware payload delivery in about 2 decades.</comment>


Show HN: Wonderurl – Create a wonderful digital gift and discover freebies - <AUTHOR> http://wonderurl.com <comment><AUTHOR> Put together this small gimmick in ~5 hours and launched on the 24th, to celebrate the holidays.

The idea behind the platform is simple - Put a special message, offer, discount or freebie inside a custom wrapping (choose the shape and color of your gift), and send the link to whoever you like. They'll have to unwrap it to reveal its contents!

I personally have made a gift to it that I am happy to share with all of you. Enjoy! [https://wonderurl.com/gift/tcodina](https://wonderurl.com/gift/tcodina)</comment>


How to Report Child Porn on FB? - <AUTHOR>

Hey, sorry to ask this here but I figure there are many FB employees on HN. FB just showed me a disturbing video thumbnail in the "Trending Videos" section. It looks like some bad child porn, but I didn't click to view it.
FB's report abuse section just says to report content using the dropdown, but it doesn't exist for Trending Videos.
Here is a screen shot of my wall or whatever it's called:
http://dl.dropbox.com/u/396448/Screen%20Shot%202012-06-24%20at%2010.56.03%20PM.png <comment><USER2> It's not child porn.

It's a top YouTube video (162 million views, <http://www.youtube.com/watch?v=jlgr6MoXufU>) of a baby accidentally kicking her dad in the balls while they sit on a bed together.

</comment><comment><USER3> Giving this an up vote just so you might get some response. I'd probably try to report it normally and specify what happened in the notes in case this doesn't hot the front page.</comment>


Court in OWS Twitter Case Gets it Wrong Again - <AUTHOR> https://www.eff.org/deeplinks/2012/07/court-ows-twitter-case-gets-it-wrong-again

<comment><USER2> As Twitter is archived in the Library of Congress, any tweets and their metadata is, should, and can be public record... presuming your profile is marked public. Information that is not publicly displayed, such as e-mail, phone number, etc, is what should be protected - and it seems the courts have yet again failed us, granting an overly broad request for discovery.

Here's the question I've not seen answered - Were Mr. Harris's tweets private? If not, I really see no problem with identifying his words and the public portion of his location (I believe twitter only presents a few, not the full, significant digits of geodata). It's both more reliable and less invasive than asking local businesses "Did this man shop here?" which is a tried-and-true police tactic.

<comment><USER3> Twitter logs the IP address of every single access to the site (though it is not made public on the web).

IP address + timestamp + ISP subpoena == physical location.

Also, you can bet that Twitter is internally storing all those significant location digits, even if they don't publish them.

This is the troubling part.

</comment></comment><comment><AUTHOR> It's troubling that a city district attorney can compel the disclosure of non- public information without a search warrant.

It's equally troubling that this lax standard is applied so routinely in the most trivial of cases.

If we accept that participating in non-violent protest on the street instead of the sidewalk now justifies heavy-handed police action, we have bigger problems than loss of privacy.

<comment><USER3> The rule of law in the USA is gone. The feds issue 60k+ NSLs annually, and you never hear about those. Because there's no oversight whatsoever, we have no idea how many of these are issued against people exercising their legal rights in the ways that the police state simply doesn't find convenient or appropriate.

It's time to leave.

<comment><USER4> There was no national security letter involved here, and as far as I can tell all parties did follow the law. As far as I can tell, it's actually Twitter's terms of service that caused the trouble here, as they deny you ownership of your own content and thus prevented Harris from defending the rights he gave up by tweeting. At any rate, this talk of national security letters sidestepping the law and all that seems quite beside the point. This was just an unfortunate interaction of valid laws and onerous terms of service.

<comment><USER3> My point was not that this was an NSL, but it's this bad even in the cases where we're _hearing about it_.

Fact is, this is happening constantly, and in ways we can't even find out about to know how bad it truly is.

There's no hope. Run.

</comment></comment></comment></comment><comment><USER5> Access to location information is a complex issue. There are many reasons to want it, and many reasons to not want it given out.

For instance should the police have the right to ask mobile carriers for a list of all people whose phones passed within 500 feet of a particular location at a particular time? What if that location was where a drive-by shooting happened? What if that location was where a protest happened? What if it is the CIA attempting to figure out who met with a known spy?

Should a mobile carrier be allowed to sell location data to third parties? What if the party who wishes to buy it is your employer, who wants to check where you were when you were sick to identify people who might be interviewing elsewhere?

During a divorce, should you be allowed to get your soon-to-be-ex spouse's location information? What if a restraining order was filed against you?

I know that some of these questions have clear precedents, others have conflicting precedents. All are questions that people tend to have strong opinions on.

</comment><comment><USER6> My question is why they need to prove the dude was on the bridge? Didn't they arrest him there? Regardless, assuming privacy rights when using a public social network is a bit of a stretch. Even phone records are subject to release with a warrant. If one is worried about privacy, then don't tweet or Facebook your damned location.

The Twitter TOS might be illuminating for this case. If Twitter guarantees privacy then the defendant might have a civil case against Twitter if records are released. Though they do have indemnification clauses..

I'm not too sympathetic to this dude's plight, a reasonable person would expect arrest for blocking the Brooklyn Bridge. How many people were financially harmed by this guy's actions? Protest is one thing, but when his expression of his rights interferes with my right to get to work and earn a living, then he has very little moral ground upon which to stand.

<comment><AUTHOR> Maybe the district attorney isn't really interested in proving the defendant was on the bridge, but is using this trivial case as a pretext to get at his social network.

The DA requested not only his location, but IP addresses used to access Twitter plus all email addresses linked to his account.

Source: <https://www.eff.org/cases/new-york-v-harris>

<comment><USER7> Definitely a pretext. NYC would not expend all those resources just to convict someone of disorderly conduct (which is only a misdemeanor offense).

And believe it or not, there are real crimes happening in NYC which the DA might want to spend a bit more time on, instead of going after protesters. As a taxpayer, I'd be very curious to know why my money is being spent on this.</comment></comment></comment>


Edward Snowden nominated for TIME's person of the year - <AUTHOR> http://poy.time.com/2013/11/25/vote-now-who-should-be-times-person-of-the-year/slide/edward-snowden <comment><USER2> Miley Cyrus is currently winning, and probably will win. This isn't the NSA hacking Time or any other conspiracy. Miley Cyrus is more popular than Edward Snowden, and more people are likely to want Miley Cyrus to win than Edward Snowden.

This entire poll is, like any poll, a popularity contest. If you think Edward Snowden is more popular than Miley Cyrus, then you're far too isolated and need to leave the tech bubble to talk to some humans.

<comment><USER3> The stats I see are:

        Cyrus:
          Yes:  4.7k
          No:  16.5k

        Snowden:
          Yes: 35.5k
          No:   2.3k

This poll does seem to support the claim that Edward Snowden is more popular than Miley Cyrus.

<comment><USER2> This seems to contradict earlier reports in this thread, so there's probably a lot of volatility due to Time removing what they see as fraud. I stand by my original prediction[0], however.

[0] [http://predictionbook.com/predictions/22251](http://predictionbook.com/predictions/22251) (I feel 80% certain but am correcting this to 70% for obvious reasons)

</comment></comment></comment><comment><USER4> It's worth noting that the TIME person of the year and the 'winner' of this poll are not necessarily the same. The TIME editors will choose whoever they like.

<comment><USER5> Very true. Especially since m00t from 4chan won and they hacked the whole polling system before.

</comment></comment><comment><USER6> TIME magazine jumped the shark a very long time ago. I remember a time when everyone was curious who would win and it was a really big honor. Today you're sharing the honor with the likes of Moot from 4Chan. I think I am going to go off and vote for Miley Cyrus.

<comment><USER7> Well, it's supposedly the most influential person, and not necessarily an honor -- it's not the Nobel Peace prize.

Hitler was it in 1938. Surprisingly Giuliani was chosen over OBL in 2001. Then we have Khomeini in 1979. Stalin won twice.

I think Snowden fits perfectly here and not it's not necessarily an honor.

I can't think of a lamer (from a non-US view) controversy than the twerking, it's right up there with "maldrobe malfunction".

</comment></comment><comment> jack-r-abbit Not that this poll really matters as it is not really who gets it. That is picked by the staff/editor. But historically, the Time POY is not always a "good" person: [http://en.wikipedia.org/wiki/Time_Person_of_the_Year](http://en.wikipedia.org/wiki/Time_Person_of_the_Year)

So what ever you feel about Snowden (or Cyrus) really doesn't mean they _couldn 't_ win. Hitler won for fuck's sake.

</comment><comment><USER8> Previous Hacker News discussion with several comments (I'm not sure what the duplicate detector missed here):

[https://news.ycombinator.com/item?id=6800145](https://news.ycombinator.com/item?id=6800145)

<comment> jack-r-abbit The other one has a trailing "/" in the URL so clearly the dupe detector is fairly [dumb|simple|easily defeated].

</comment></comment><comment><USER9> Everyone here is well aware that TIME's editors choose the person of the year, and that the poll is a mere sideshow which at most _might_ influence the editors' choice, right?

Cf. moot and /b/'s votespamming.

</comment><comment><USER10> According to the following page Miley Cyrus has 25% of the vote...WTF?

[http://poy.time.com/2013/11/25/vote-now-who-should-be- times-...](http://poy.time.com/2013/11/25/vote-now-who-should-be-times-person- of-the-year/slide/poll-results/)

<comment><USER11> The numbers are being modified. In the other thread, someone posted a screenshot of the then-current results for snowden: [http://i.imgur.com/jv9t4X0.png](http://i.imgur.com/jv9t4X0.png)

<comment><USER12> Yes, I saw ~200,000 votes for Snowden when I voted earlier today, and now it's just 37,000. What's going on?! Is Time changing the numbers, or is NSA that petty and hacked them?

<comment><USER13> Maybe they detected fraud

</comment></comment></comment></comment><comment><USER14> Is TIME Person of the Year a festival of trolling now? There are some people on that list that have done some seemingly bad things.

<comment><USER15> Hitler was Time's man of the year at one point; they don't limit it to people who are altruistic.

<comment><USER16> actually i heard he was rejected for man of the century/millenium for precisely this reason.

without a question he has had the largest impact on modern history of a single individual from the past 100 years.

<comment><USER15> This is always an interesting question; I definitely do not think though, that the answer is "without a question".

[http://www.npr.org/programs/morning/features/2002/jul/fritzh...](http://www.npr.org/programs/morning/features/2002/jul/fritzha) ber/

<comment><USER16> you are right, it is a naive high level view and a deeper analysis is probably warranted... but i think its a pretty defensible position once you start looking at details, and especially if you are willing to lay the entire of WW2 at his doorstep... certainly in terms of human life lost and impact to industry and economy, its hard to think of a 'single event' from the past 100 years that even comes close.

<comment><USER15> For sure, I agree.

</comment></comment></comment></comment></comment></comment><comment><USER17> Oh good. A poll designed to draw publicity to what's already a brazen publicity stunt.

</comment><comment><USER18> The poll software is totally broken. Not that Snowden had 300k votes some hours ago. But right now if you open up the single pages of Cyrus (21,338 votes) and Snowden (37,756 votes) the total does not check out at all.

</comment><comment><USER19> Interesting, rigged to let Miley win?

[http://www.dailydot.com/news/time-person-of-the-year- miley-c...](http://www.dailydot.com/news/time-person-of-the-year-miley-cyrus- rigged/)

</comment><comment><USER20> In the faceoff section, we see: Obama (2%) vs Snowden (98%).

</comment><comment><USER16> ugh.

i applaud his bravery but its utterly misguided, as is all of the hype around this.

whilst i'm sure the specifics are very helpful i still wonder "well what did you think the NSA and GCHQ were doing if not /their jobs that we pay them to do/"

the naivete of the web elite is constantly disappointing.

edit: tempted to delete because it is yet another rage response to this situation, but curious to see how it goes.

</comment><comment><USER21> Go Miley GO!

That Miley is in the lead is sad commentary indeed.

That Snowden is a known figure is even sadder.

</comment><comment><USER22> Miley Cyrus, the epitome of American greatness.

</comment><comment><USER23> I hope someone makes a bot that skews anyone's votes but Miley's to stop her from winning.

</comment><comment><USER24> Ahg.

Log in with Facebook.

No vote from me.</comment>


Kubernaughty: A collection of documentation, how-tos, tools for K8s - <AUTHOR> https://github.com/jnoller/kubernaughty <comment><USER2> There are two pages of q&a, was there more to this? page 3 is empty.

</comment><comment><USER3> Not sure if this is in there, haven't had a chance to take a look yet, but does anyone know a good source (preferably with example) of how to get multiple images to deploy to the same node? From what I can tell I'm after the `nodeAffinity` field, but I found Kubernetes' documentation rather terse.

<comment><USER4> Have you tried just putting the images in the same pod? You might want to search and read about the sidecar pattern.

<comment><USER3> Do you mean manually? Should clarify, I use Google Kubernetes Engine that manages the deployments for me, and there's also CI/ CD happening in the background that updates the images every so often. Would need to find an automated way of doing this.

<comment><USER4> You can use affinity to assign pods to nodes. [https://kubernetes.io/docs/concepts/configuration/assign- pod...](https://kubernetes.io/docs/concepts/configuration/assign-pod- node/#affinity-and-anti-affinity)

But if you want several containers to always be deployed together, you want to put them in the same pod. You do this in the deployment yaml.

[https://kubernetes.io/docs/concepts/workloads/pods/pod- overv...](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) [https://kubernetes.io/docs/tasks/run-application/run- statele...](https://kubernetes.io/docs/tasks/run-application/run-stateless- application-deployment/)

<comment><USER5> So there are two types of affinity: Node affinity and Pod affinity. Node affinity would tell the scheduler to prefer a Node. Pod Affinity would tell the scheduler to prefer other Pods location.

<comment><USER3> I've learned more from your two lines than I did reading through three different entries in the K8s wiki, all of which are rather long. Or rather, it's only clicked now.

Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER5> This is good writing.

I wonder if we can take the next step and create some sort of storage troubleshoot operator, that would implement the manual troubleshot algorithm.

</comment><comment><USER6> I will star this and I hope you continue working on it

<comment><USER7> I found my password to this site only to reply to this: I am, it's a work in progress, and theres so many different failure modes I'll just keep going.

</comment></comment><comment><USER8> Added the 150th star.

Please keep up the great work!</comment>


How Entrepreneurs Can Create Their Own Luck - <AUTHOR> http://techcrunch.com/2011/11/05/how-entrepreneurs-can-create-their-own-luck/ <comment><USER2> What a great post. Being Canadian, something didn't sit right with me with the Gretzky quote. I think the corrected version "skate to where the puck is going to be" is likely what the author meant. Here are two of Gretzky's actual quotes:

"A good hockey player plays where the puck is. A great hockey player plays where the puck is going to be."

and

"I skate to where the puck is going to be, not where it has been."

Another one of my favorite Gretzky quotes - "You miss 100% of the shots you don't take."

<comment><USER3> The mis-quote stuck out for me, too. "Skating to where the puck is", is actually exactly what Gretzky was saying _not_ to do.

It threw me off the entire piece -- as soon as I see something fundamental so totally wrong, I find it hard to concentrate on the rest of the message.

</comment></comment><comment><USER4> "We know that the right place for right now is somewhere in social media."

Really? This seems to imply that every startup should be about social. People thought that Google would never succeed because search was cornered by Yahoo and AltaVista. I would think that VC-funded startups that are aiming for huge successes should take the opposite advice: look for holes in industries that aren't widely considered to be the "hottest thing" and create a market. Don't try to cash in on a gold rush in which there are thousands of players doing the same thing.

"Don't start a soft drink company competing against Coca-Cola."

I'm pretty sure we have a Coca-Cola in the social space. It's called Facebook.

<comment><USER5> "Don't start a soft drink company competing against Coca-Cola."

Tell that to Red Bull...

</comment></comment><comment><USER6> Great post by James Altucher here, one of my favorites regarding luck and startups is also this one about market timing: "Market Timing is a Skill Not Luck" - [http://altgate.com/blog/2008/12/market-timing-is-a-skill- not...](http://altgate.com/blog/2008/12/market-timing-is-a-skill-not- luck.html)

</comment><comment><USER7> I don't know about you guys, but James Altucher is one of my favorite bloggers on the net right now.

</comment><comment><USER8> Nice discussion. Remined me of what Github's Founder Tom Preston Werner said last year on Startup School[1].

And remined me of the great article recently mentioned[2] by Duck Duck Go's founder Gabriel Weinberg: _How to Increase Your Luck Surface Area_ [3]

[1] <http://www.justin.tv/startupschool/b/272178966>

[2] [http://www.gabrielweinberg.com/blog/2011/10/what-i- learned-f...](http://www.gabrielweinberg.com/blog/2011/10/what-i-learned-from- raising-venture-capital.html)

[3] [http://www.codusoperandi.com/posts/increasing-your-luck- surf...](http://www.codusoperandi.com/posts/increasing-your-luck-surface-area)</comment>