DomainPolish: From MVP To Exit In 6 Months - <AUTHOR> http://www.danshipper.com/110636263

<comment><USER2> Congratulations. Our stories are a lot alike. I created Feedback Army in 2008 (I continue to operate it though). One thing I liked about reading your story was the lessons learned part. For a novice entrepreneur there's a lot of value in shipping something, marketing it, providing customer service, and dealing with the whole process. You'll find it's a good springboard to what you do next. Best of luck.

<comment><AUTHOR> Dude great to hear from you! I'd really love to talk some time if you're interested. Feedback Army is awesome and I think we might have some cool stuff to share. Couldn't find any contact info in your profile but my email is dshipper [at] gmail.

<comment><USER3> If he doesn't notice this, feel free to poke me, he's sitting next to me. I'll bug him for you :)

</comment></comment></comment><comment><USER4> $1000 to run something like that on EC2 seems like a lot. That type of site could probably be run off one or two micro instances, and if you bought reserved instances you can get your long term costs way down.

<comment><AUTHOR> I was running small instances - probably should have been micro. And there were definitely ways to decrease costs and stay on EC2. Heroku is free though so for me (at my scale) it seems like the best option for now.

</comment></comment><comment><USER5> Congrats, and thanks for sharing this.

The most interesting part of this post is the guy who wanted to build a service that reviews you online dating profile. That seems like something that has real potential.

In my experience, one of the most frustrating things about being on an online dating site is that it's really hard to get feedback from women about how your profile is perceived by them.

You send messages to a bunch of women and 90%+ never respond, but you have no idea why. I would pay $$$ to find out why they don't respond, and I'm sure that a lot of other people would as well (especially men).

Could this be built into a site like OKCupid? Perhaps some kind of revenue sharing arrangement (between reviewers and the dating site) where users pay to get feedback, and other users get paid to review the profiles of men or women who message them(or maybe even those who don't)...and it's anonymous feedback...or semi-anonymous.

<comment><AUTHOR> I really like the idea as well! From what I know the site didn't go anywhere because the minimum advertising commitment for dating websites is in the thousands. So I think he dropped the idea.

But definitely it could work for someone with some marketing skills and/or cash to burn. It's something that can be built in a weekend as well. Feel free to reach out to me and I can try to help point you in the right direction if you're interested in pursuing it.

<comment><USER5> Yeah, I think it would be very difficult to make this work as a standalone service, but I think it could be potentially be very successful as an internal feature of OKC or a similar site. It would be valuable to me to find out what the women that I am interested in think of my profile, especially the ones that don't respond to me. I would pay to get some decent feedback on myself. One of the problems is that I see my own profile in complete isolation. Actually, what I should do is go look at the profiles of other men to find out what the competition is like, but I'm not going to do that. But there are probably lots of women who would give me feedback on my profile if I paid them even $1.

</comment></comment></comment><comment><USER6> Congrats on your first deal, Dan. Sounds like you learned some valuable lessons along the way. They will serve you will in the future. Cheers. PS: Will be interesting to see what new owner does with the site.

<comment><AUTHOR> Thanks! I really hope so - that's the beauty of doing all this stuff while in school.

</comment></comment><comment><USER7> Very interesting story and I love these low maintenance ideas. Congratulations on that sale!

Can you elaborate a bit on how you drove customers to that site? I was looking at a similar idea just a few weeks ago but search engine competition on usability keywords is incredibly tough.

<comment><AUTHOR> In short: I drove customers poorly and infrequently.

The only marketing I did was through my blog/Twitter. That spawned a fair amount of word of mouth and some other blog posts by people who had used the service. Beyond that I think it was just people talking to eachother because the product really does provide value if you're building a website.

I also have a hunch that the custom thank you videos played a part too but I can't prove it.

</comment></comment><comment><USER8> Dan, great article and congrats on the sale. Domainpolish is a great product.

For the metrics did you ever set up Google Analytics? I typically tell everyone to just install that first thing, it can give you ballpark estimates for almost any basic metrics question with about 5 lines of JS on each page.

For EC2, I agree with PaulHoule that it's possible to save money if tuned properly, but the learning curve is steep. I know I've served 5 or 10 minor projects of a single mini reserve instance ($6 / mo) with no issues, but getting a sense for it requires a bit of work.

<comment><AUTHOR> Thanks for your comment! I did definitely set up Google Analytics. But I didn't have goals or Web Master Tools or funnels or anything like that set up. So I had a few metrics but nothing really in-depth.

Yea I definitely could have done the EC2 experiment much more cheaply. But Heroku is free if you're small scale like DomainPolish :) Thanks again for commenting!

</comment></comment><comment><USER9> Good stuff, keep it up! When I was your age, I was making $200/mth through hard labor, and it was 10 times higher than an average student :-) Since you seem inclined on entrepreneurship, I would highly recommend that you tackle negotiation skills, since those tend to define the financial outcome of idea+implementation. You can start with Jim Camp book "Start with NO...The Negotiating Tools that the Pros Don't Want You to Know" and reading about Richard Branson, and go from there. Good luck.

</comment><comment><USER10> Congrats, Dan! Fully agreed that given how most projects land the entrepreneur (and/or the investors) in the red, the real achievement here is executing an idea and seeing it through the full lifecycle of a business, in this case, through to a sale. The learning experience will be invaluable when you exit your next company.

This was a great story to follow through Hacker News, and your candor, detail, and introspection are admirable and indicative of the success ahead.

<comment><AUTHOR> Thanks Jason I'm glad you enjoyed following the story. It's definitely not a huge exit but I'm happy to have turned a profit and there's more where that came from :)

</comment></comment><comment><USER11> When talking about "exits", it might also be useful to keep in mind the amount of money you could've made while working a regular in the same period of time.

Of course I'll be the first to admit that working on your own projects is much more fulfilling and interesting, but it does have opportunity costs just like everything else.

<comment><AUTHOR> Definitely - although it's also worthwhile to take into account the fact that you own what you produce when you work for yourself. So while after working for someone else for 6 months I would only have cash to show for it, after working for myself (very part time) for 6 months I had the option to turn what I produced into immediate cash, or do anything else with it that I wanted.

But I definitely agree that it's something to consider.

</comment></comment><comment><USER12> > I set up 3 instances (two production and one staging) and thought I was a > boss. [..] Lesson learned: don't use anything but Heroku until you have to.

Did he really need 3 instances? Or even a separate staging environment?

<comment><AUTHOR> Thanks for the comment! Obviously 3 instances were too much. But the point remains that if you're running a low traffic Rails app it's a lot cheaper (free) to host on Heroku than it is on EC2. And if you're running at the scale that DomainPolish was that makes all the difference in terms of take home profit.

<comment><USER13> I was looking at Heroku as well for hosting some MVPs and I was wondering how good they are for hosting Python. Any ideas ? Naively, I'd hope they're as good as hosting Rails.

<comment><AUTHOR> I wish I could help you but I've only ever used them for Rails. I have used GAE for Python and had a pretty good experience. I think that's also free at the beginning.

<comment><USER13> I was wondering about GAE as well. After the pricing change, it looked like it got horribly expensive. Any comments on how a side-project would do on the free plan ?

</comment></comment></comment></comment></comment><comment><USER14> I'm sorry for being a total idiot - what does MVP stand for? :(

<comment><USER15> Minimum Viable Product.

<comment><USER14> Thank you!

</comment></comment></comment><comment><USER16> Congrats on the 'exit', and on all you learnt from it. Looking at your stats at the bottom of the post, what exactly is meant by 'Fee to License'?

<comment><AUTHOR> So I ended up licensing the codebase to someone else so he could build a different Mechanical Turk app. I kept all the IP but he got the codebase to use. Thanks for asking I'll try and make that more clear in the post!

</comment></comment><comment><USER17> Care to go more in depth about the pricing strategy? It seems as backwards as it gets. Had you seen it work somewhere else?

<comment><AUTHOR> Not really. Yea it's actually just stupid looking back at it. But I hadn't done any pricing before and I wanted to experiment. So now I know at least I won't make a boneheaded mistake like that again :)

</comment></comment><comment><USER18> so every time I sell a site on flippa thats an exit now

<comment><USER19> Yes it is an exit, technically.

</comment></comment><comment><USER20> Ummmm, congrats, but it sold for $3,500 - that's not really an exit imo. It's like selling a decent domain name.

<comment><AUTHOR> Thanks! I guess to me, more important than the selling price, was the process as a whole. It's a product that I took from an idea, built out and eventually sold. In there were a lot of lessons that I thought might be interesting to people.

$3,500 might not be a lot to you. And obviously it's not enough to go away on. But it does mean that I can work full-time on my startup this summer.

<comment><USER21> congratulations on your experience!

It really is difficult to name a price, I would have ignored any offers below 10-15k but on the other hand you can now concentrate on a new project and for 6 months from 0 to sale is remarkable.

<comment><USER22> according to some people a quite common exit is between 12 and 24 months[1] of the net profit. Considering his expenses (1700$) and sales (2500$), and initially ignoring the licensing fee, he had 800$ profit for six months, so let's round it to 150$/month, 3500$ is 24months of this profits. If we want to consider the single licensing fee, let's say he licenses once a year, it's 1500+1800 = 3300$/year, and so 3500 is a 12month evaluation. Still acceptable. 10-15k$ I think it was not acceptable (by the buyer of course) with this numbers, even thought he could have reduced significantly his EC2 expenses (and so having a much higher monthly profit)

[1] [http://www.softwarebyrob.com/2012/02/28/the-inside-story- of-...](http://www.softwarebyrob.com/2012/02/28/the-inside-story-of-a-small- startup-acquisition-part-3/)

<comment><USER21> I always assumed the 12-24 month-rule only applied to "content"-sites like a blog or a forum, but Dan built a unique service that cannot be copied with the same effort as a techblog or a bulletin board

<comment><USER22> the link I posted is about Hittail, that is surely not a "content" site but a service

</comment></comment></comment></comment></comment></comment><comment><USER23> Good write up. It's always nice when people share that kind of information / data. If I learn one thing from the time spent reading it, it was well worth it.

So, review a web site; review a dating profile (buyer). Why not a 'review anything' service?

<comment><AUTHOR> Really glad you found it informative!

I think you could definitely white-label the DomainPolish idea and sell it to people hoping to build a Review X service. The problem is that if you just try to build a site yourself that lets you review anything it's very difficult to target your customers.

People search for "get feedback on my website" not "site to review anything". Picking a specific vertical makes marketing much easier. But it's a cool idea! I can put you in touch with the current owner of the DomainPolish source - he'd probably license it to you :)

<comment><AUTHOR> Agree if you have enough marketing power (or good press hookups) it's much easier to make something like that work.

And definitely on the same page in terms of code. I like it to be mine!

</comment></comment></comment><comment><USER24> Congrats. What was the justification for that price? A certain number of months of earnings?

For something that required little work to maintain and produced consistent revenue, that should be 18 months earnings at an absolute minimum. 36+ months for this probably wouldn't have been difficult at all if you had put it on Flippa or similarly marketed the sale. Not trying to make you feel bad, just giving you some info for the future.</comment>


TouchStudio: Program Your Phone with Your Phone - <AUTHOR> http://blogs.msdn.com/b/nikolait/archive/2011/04/09/announcing-touchstudio.aspx

<comment><AUTHOR> Link to paper on which TouchStudio is based:

[http://research.microsoft.com/pubs/147663/TouchStudio-MSR- TR...](http://research.microsoft.com/pubs/147663/TouchStudio-MSR- TR-2011-49.pdf)</comment>


Ubuntu's window buttons to stay on the left - <AUTHOR> https://bugs.launchpad.net/ubuntu/+source/light-themes/+bug/532633/comments/564

<comment><USER2> I'm just stunned and puzzled by this, the best comment in that bug [1] puts it pretty succinctly:

 _It should be mentioned that the discussion would be much more productive if there was actually an official stance, a wiki documentation, a blog post, or_ anything* explaining the reasons for the change.*

I only read the first 80 comments , but I can't find anyone who really finds this to be a good change, and there's yet to be a good explanation offered as to why this would improve anything. Quite simply, what problem does this solve?

1: [https://bugs.launchpad.net/ubuntu/+source/light- themes/+bug/...](https://bugs.launchpad.net/ubuntu/+source/light- themes/+bug/532633/comments/51)

<comment><USER3> That's my main issue with all this UI twiddling that Canonical are doing at the moment - the left hand buttons, the notify actions removal, removing tooltips from indicator items, and gnome's great menu-icon removal of the last cycle.

There's absolutely no data, no testing and no rationale to backup any of these changes. No-one has been able to point me to impirical data, or any user testing to explain why these sweeping changes have been made, because there hasn't been any. Some XU designer thought it looked 'cooler' or 'cleaner' that way, so it got changed - end of story.

I really tried with the left hand title bar buttons - but after a week of 15 years of muscle memory putting my mouse in the wrong place every single time, I just had to change it back. Even if I had got used to it, so what? They're the same buttons in a different place - why is it an improvement to move them? If there's no demonstable benefit to moving them, why is it worth making all your users retrain their long established muscle memory? What's in it for them?

If there _are_ demonstrable benefits to these changes - then tell people what they are - demonstrate them - rather than just telling people to shut up. That will cut down on the bickering comments no end.

<comment><USER4> I can't related to this. I switched to OSX fully time over two years ago after using Windows most of my life. I adjusted to the close button being on the left in about a week.

<comment><USER3> I think you night have missed the point of my post.

</comment></comment></comment></comment><comment><USER5> Well, at least they decided to go with the order "close, minimize, maximize" which follows Mac OS X's standard rather than creating a third standard.

<comment><USER6> I knew this had to happen back when I first saw the mockup screenshots. I am totally happy with the new window controls now. It only took me a week or so to get used to window controls being on the left when I switched from primarily Windows to primarily Mac OS X. People will get used to it eventually.

<comment><USER3> 'People will get used to it eventually.'

I expect you're probably correct. What's the point, though? Why is it better this way? Why should thousands (millions?) of users retrain their muscle memory? What are the benefits to moving these windows controls from one side of the window to the other?

Are there any benefits?

<comment><USER4> _Are there any benefits?_

It's now easier for people that decide Ubuntu wasn't everything they wanted to switch OSX?

</comment></comment></comment></comment><comment><AUTHOR> Headline from here:

<http://lwn.net/Articles/381546/>

and to move them back:

[http://www.howtogeek.com/howto/13535/move-window-buttons- bac...](http://www.howtogeek.com/howto/13535/move-window-buttons-back-to-the- right-in-ubuntu-10.04/)

or

      gconftool-2 --set /apps/metacity/general/button_layout --type string "menu:minimize,maximize,close"

<comment><USER7> Thanks. Seems the (currently leftmost) 'menu' button is gone, and we need that fix to get it back.

I use that button to kick windows to the correct workspace. But it seems a righ-click on the bar also works. One of the things Ubuntu was better at than the Mac ...

The application icon in the button was pleasant too. I also liked a few colorfully distinct icons in the tray/notification area in 8.04, currently drab grey a la MacOS.

<comment><AUTHOR> I discovered this by accident a few months ago, but for the keyboard lovers, Ctrl+Shift+Alt+[Up/Down/Left/Right arrow] will move the current window to the workspace in that direction.

</comment></comment></comment><comment><USER8> I ran Linux because I disliked Windows, and then all of the Linux UIs started emulating Windows. Only Windows is now emulating OS X, and now the typical Linux desktop looks like a really old version of Windows.

I blame fvwm95 and everyone who liked it. ;)

Windows has never been Unix-y, OS X is Unix-y and friendly. Steal what's worth having and then invent something totally new.

Ubuntu is on the right track here. I hope they go farther:

-> Make paste Alt-V instead of the current Ctrl-Shift-V. Make close window Alt-W (for Window) instead of Alt-Shift-F3 (or whatever it is). Generally make the keyboard friendly for Terminal users and stop using awkward chorded key combos for things people do every day.

-> Stop wasting space with a toolbar on every window and stick it on top of the screen. (For those who may complain about the position of the Mac toolbar-- remember your Linux desktop probably does -both- a toolbar on top of the screen, -and- a toolbar on every window.)

-> Go from a window-centric model to an application-centric model where I can quickly switch between applications and windows without leaving the keyboard. (i.e. Alt-tab, Alt-~)

I've tried to go back to linux desktop (kde, gnome) and it was a struggle to use, even just to manage emacs, a bunch of terminals, and a web browser. I still like e16.

I don't know what to make of xulrunner (XUL in Mozilla was too magical) but the concept is right. Native C w/ Javascript as the HLL, and wrap older applications in a Canvas... Newer apps would combine Javascript, HTML, and native code. Wrapping application dependencies (clipboard, fullscreen, etc.) in Javascript (where new standards are emerging anyway) would provide incentives for application developers (cross platform, cost savings, no qt versus gtk, web reuse, etc.) Grant you'd still need custom native widgets -and- Javascript lacks a concurrency model. Just a thought.

</comment><comment><USER9> I have a Mac I use regularly. I have a Ubuntu machine I use constantly, and I have a Windows machine I use when I have to. I love the Mac UI in general, but I've always had a slight preference for the menu buttons on the right. It just makes more sense to me. To close a window, I click on the right-most corner of that window. I read from left to right, closing the window is the last thing I want to do with a window, since by that time, I'm done with it. The buttons on the right mean that the X to close comes last in the order of all of the info/tools in the window chrome. To me, this just makes more sense.

<comment><USER10> Ehmm. For this thought to make sense, all your windows would have to be text only, one line that you always want to read and doesn't wrap, with no other way to dismiss except the close button, and with your cursor always following along with your eyes.

By your logic, actually, the close button would be best placed in the lower right for any window with several lines of text.

</comment></comment><comment><USER11> Honestly, how difficult would it be to just make it a simple customization option in the Appearance preferences? Left or right orientation.

</comment><comment><USER12> Everyone's talking about how they went from right to left but few mention that they also removed the "menu" button from the layout.

That's the one that you can click on to make a window "always on top" or "always on visible workspace". I switched to the old layout to get it back.

<comment><AUTHOR> As ableal said, you can right-click on the title bar to get that menu too.

<comment><USER13> Does Alt-Space still open the menu?

<comment><AUTHOR> On 9.10, yes. What do people use that menu for?

Alt+F10 = toggle maximize/restore

Alt+F9 = minimize

Ctrl+Alt+Shift+[Direction] = move window to the workspace in that direction

Hmm, Alt+Space then 'T' toggles Always on Top. LSNED

<comment><USER13> Of course it works on 9.10. We are talking about 10.4.

I use it to move a window to a numbered workspace. The Ctrl-Al-Shift-Arrows moves the windows AND switches the workspace. My use case is restoring my many Chrome browser windows to their proper workspace after restarting.

<comment><AUTHOR> _Of course it works on 9.10. We are talking about 10.4._

I'm posting this from 10.4 Beta 1, where Alt+Space does still work. All they did was change the arrangement.

 _I use it to move a window to a numbered workspace. The Ctrl-Al-Shift-Arrows moves the windows AND switches the workspace. My use case is restoring my many Chrome browser windows to their proper workspace after restarting._

Good point.

</comment></comment></comment></comment></comment></comment><comment><USER14> This change really irritates me, as does the styling changes of the tabs. Enough so that "customize ubuntu" goes from the fun list to the todo list.

</comment><comment><USER15> Canonical thinks Ubuntu is better than Windows now. Next target to catch up: OS X. This is just the first step towards that goal.

</comment><comment><USER16> sometimes the most important decision is just to make a decision, and not leave it on the plate.

not hot about the left hand move, but I like that ubuntu is moving towards thinking about the ui, and I rarely use those buttons anyway.

<comment><USER17> I bet you'll find yourself using them a lot more than you used to, particularly when you go to click the leftmost menu bar element.

<comment><USER16> I very rarely use the file menu either, its hidden on firefox/terminal and emacs, which is 95% of my computer time

<comment><AUTHOR> I just turned the minimize/maximize/close buttons off completely, since I just use keyboard shortcuts for everything. Chromium uses its own, which is annoying.

</comment></comment></comment></comment><comment><USER18> April fools?

<comment><AUTHOR> _For the avoidance of doubt, this is not a comment dependent on the date :-)_</comment></comment>


Welcome to Clicking Bad, bitch.  - <AUTHOR> http://clickingbad.nullism.com/ don't use javascript, you cheater! <comment><USER2> Really cool. Save doesn't seem to do anything?

<comment><AUTHOR> it works for me on ubuntu 13.04 with google chrome running.</comment></comment>


Facebook's Randi Zuckerberg: Anonymity Online 'Has To Go Away' - <AUTHOR> http://www.blogoholic.in/2011/07/28/facebooks-randi-zuckerberg-anonymity-online-has-away/

<comment><USER3> As a private company, Facebook is free to set any standards they want but I guarantee that if FB imposes some kind of identification process to create an account they will lose to a social network that does not have such a requirement.

Moreover, if she is calling for any kind of government-imposed internet-wide standard she should be vociferously denounce. The whole internet "bullying" is a red-herring and the real problem is that people's _feelings_ get hurt when on the internet. Well too bad, no one has the right not to be insulted or denounced by people who disagree or even hate you and your ideas. It does happen that misbehavior crosses the line into harassment, stalking, etc. and there are plenty of laws already on the books to deal with it though granted that law enforcement is still catching up with the internet. I think that on net, in a free society, that anonymous profiles is a good thing. Just ignore the trolls and morons -- how hard is that? The last thing we need is to create is government regulated internet driver's licenses.

</comment><comment><USER4> "argued that putting an end to anonymity online could help curb bullying and harassment on the web."

Oh please like that stops bullying in real life

And I have to agree with Matthew Ingram:

"Many people believe that requiring real names will solve the problems of trolls and bad behavior, but they don't"

My Facebook feed is nothing but people trolling each other. Right now this is one of the top threads:

Person X - 100% pomegranate juice is mad sour flavor

... reply 3 - <USER2>

... reply 5 - you asians always eat weird sh/t

Sure its friendly, but its reality, my friends do nothing but insult each other and take the piss out of each other all day long. Its just human nature.

</comment><comment><USER5> Like Mark, she has worked almost exclusively at Facebook, and so has not experienced career problems caused by a permanent record of every controversial idea she may have ever held. Far from "say whatever I want", a pseudonym is the only way I'm willing to say _anything_ substantive in public (it's a different story off the record among those I personally respect and trust).

</comment><comment><USER6> Me: Facebook 'Has To Go Away'</comment>


Travel prep in 6 taps (instead of 100+) - <AUTHOR> http://flyright.co <comment><AUTHOR> New web + iOS app that gives you everything you need to know before you travel internationally:

\- Tourist visa requirements \- Vaccination requirements \- Travel warnings issued by the U.S. Dept. of State \- Currency import and export limits \- U.S. embassy locations and emergency contact information

Product Hunt: [https://www.producthunt.com/posts/flyright](https://www.producthunt.com/posts/flyright)</comment>


The thermodynamics of negative entropy: bounds on heat generated by computers - <AUTHOR> http://www.nature.com/nature/journal/v474/n7349/full/nature10123.html

<comment><USER2> OT, but this reminds me of something I've wondered about. Assume it is winter, and I live in a region where this requires me to run some kind of heating system to keep my house sufficiently warm.

Under those conditions, is my computer use essentially free? The idea is that when the computer is on, it generates heat, which presumably reduces the amount of heat that my home heating system is called upon to produce.

<comment><USER3> Yes, it's essentially "free" - an electrical heater does the same thing as a computer in this regard. My MacPro3,1 (lovingly called The Behemoth) produces enough heat to make my home office comfortable through most of the winter. The electrical bill is astronomical, however. And it really sucks in summer.

I always wondered why data centers aren't exporting heat to the local community the same way many power plants do - it's a lost opportunity. It would also be a great secondary heat source for many skyscrapers if they designed them with a well-placed datacenter inside.</comment></comment>


The H1B Visa Crunch - <AUTHOR> http://blog.upcounsel.com/the-h1b-visa-crunch/ There is an annual limit of 65,000 H1B visas available each year for foreign nationals with bachelor's degrees and an additional 20,000 for those holding U.S. master's degrees. As a point of reference, in 2013, the H1B filing period, which can vary in length depending on the number of filed petitions, lasted for only seven days as the USCIS received over 124,000 H1B petitions. <comment><USER2> I hear that the land of free is planning to legalize 12 million illegal immigrants ?</comment>


About the security content of iOS 10.3.1 - <AUTHOR> https://support.apple.com/en-us/HT207688 <comment><USER2> It looks a lot like this google project zero bug (same reporter, same bug type (stack overflow on the wifi chip)) but the CVE number has the last two digits swapped

[https://bugs.chromium.org/p/project- zero/issues/detail?id=10...](https://bugs.chromium.org/p/project- zero/issues/detail?id=1051)

Looks like it's hitting android devices as well as ios devices?

Edit: Apple must have known when they released iOS 10.3.0 since they named the next-day-beta 10.3.2. Perhaps they were embargoed because of other broadcom customers, but didn't want to delay the other crazy security fixes that 10.3.0 brought. Were they forced to ship an known insecure broadcom firmware because of Android then? Double edit: Or more likely they just wanted to get some more testing time. Looks like the p0 bug was unrestricted on Mar 23.

<comment><USER3> Well, it's quite obvious to see what went wrong.

        void function_79390(void* unk, char* ie, char* buf)

Those are terrible names for functions and variables. Very shoddy development.

<comment><USER4> This is probably decompiled code. Many functions loose their names if code gets optimized or obfuscated. function_XYZ is probably a placeholder used by the decompiler.

<comment><USER5> I'm 99% certain it was a joke...

</comment></comment></comment></comment><comment><USER6> > Impact: An attacker within range may be able to execute arbitrary code on > the Wi-Fi chip"

That's a major problem!

<comment><USER7> And yet Apple requires you to download this update over Wi-Fi to receive it OTA.

Sure you could update via a computer, but that seems to go against Apple's vision of not requiring tethering your device to a computer every time you need to update/sync/setup.

<comment><USER8> What do you propose then? Typing in the patch?

<comment><USER2> Allowing downloads of OS updates less than 100MB over 3G/4G, just like regular apps?

The 10.3.0->10.3.1 patch is ~20MB. My phone downloads multiple ~100MB app updates daily over cellular. Refusing cellular iOS updates that are smaller than one of those apps is getting pretty silly these days.

<comment><USER9> Are you really using 10GB of cellular data each month just for app updates? Isn't that expensive?

<comment><USER7> Why[0] would[1] it[2] be[3]?

[0] [https://www.verizonwireless.com/plans/verizon- plan/](https://www.verizonwireless.com/plans/verizon-plan/)

[1] [https://www.att.com/plans/unlimited-data- plans.html](https://www.att.com/plans/unlimited-data-plans.html)

[2] [https://www.t-mobile.com/cell-phone-plans](https://www.t-mobile.com/cell- phone-plans)

[3] [https://www.sprint.com/landings/unlimited-cell-phone- plans/](https://www.sprint.com/landings/unlimited-cell-phone-plans/)

<comment><USER10> The only thing "unlimited" about all 4 of those plans are the weasel words.

Verizon: After 22 GB/line/mo, we may prioritize your data behind other Verizon customers during network congestion.

ATT: After 22GB of data usage, AT&T may slow speeds

T-Mobile: On all T-Mobile plans, if congested, top 3% of data users (>30GB/mo.) may notice reduced speeds due to prioritization

Sprint: Data deprioritization during congestion after 23GB/mo.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Could this also work on "cold" devices, so devices that have Wi-Fi but it's turned off?

<comment><USER12> Presumably not, since the wifi chip in those cases is usually powered down entirely (hence why it can't be used for geolocation).

<comment><USER13> Receiving any sort of communications over wifi would require the radio to be powered on, and sucking down battery the whole time. There's no way Apple would have missed such an obvious way to extend battery life -- I'd be surprised if it's even powered on unless the phone is actively communicating on the wireless network.

</comment></comment></comment><comment><USER14> Something I just noticed about the iOS update process: it appears that when it tries to "verify" an update (which requires that you be online), it does not do so over a secure connection. I was on a captive network (the kind where HTTPS goes through but plain HTTP does not, until you click through an agreement page), and while it was able to download the update just fine, it couldn't verify it until I opened Safari and tried to go to neverssl.com to click past the captive network's "I agree" button. Doesn't that seem wrong? Or perhaps it's just the "check to see if the user is online before verifying" step that is unsecured. Either way that seems like a bug.

<comment><USER15> The way iOS and macOS applications are verified is by signing the application package itself, presumably the OS updates use a similar mechanism. At that point it is irrelevant whether the connection used to download the package is secure. This is similar to the way that packages for most (sane) Linux distributions are signed. The advantage to this technique is twofold: that there are network environments where SSL communication is not possible, and you can distribute updates offline or from your own server and devices will still accept the updates.

<comment><USER2> No, iOS updates require online validation because the boot rom will issue a one-time challenge based in part on the device's unique serial number, and it needs to be granted a "ticket" response by the apple servers. This is why you usually can't downgrade iOS versions (as the apple servers will refuse to grant a ticket for old versions). Google keywords: apnonce, apticket, shsh blobs, signing window

<comment><USER15> This comment appears to add additional, specific information to my general comment rather than disagreeing with what I said, but the comment starts with "no", which implies otherwise.

The core idea here is that SSL is not necessary if the data is signed through some other mechanism.

<comment><USER9> I think "no" was due to "you can distribute updates offline or from your own server and devices will still accept the updates." I assume you just meant that as a general thing, but one could read the comment as saying that because iOS signs updates this way, it can do offline updates.</comment></comment></comment></comment></comment>


How Oregon ensnares mentally ill people charged with low-level crimes - <AUTHOR> https://www.oregonlive.com/expo/news/g66l-2019/01/a646cacb3c6955/costly-ineffective-cruel-how-oregon-ensnares-mentally-ill-people-charged-with-lowlevel-crimes.html <comment><USER3> I'm a psychiatrist, and I worked at Oregon State Hospital.

This article, like most articles about mental health, raises some important issues while somehow managing to get lots of things wrong.

First off, the remodeling of Oregon State Hosital resulted in a net decrease in beds. Another recent project to consolidate most of the inpatient psychiatric beds in the center of Portland also resulted in fewer beds, but let local hospitals divest themselves of inpatient units they never wanted because they lose money. So, there are not many places for people with active and severe mental illness to get inpatient treatment (which is, of course, not the only way to get treatment, but can be a major one for people who are incapable of recognizing they are ill).

Having worked in other states, it is my opinion that the crux of the problem is that there are too few avenues to get people help when they need it but don't recognize the need. Because it's so increadibly hard to get people involuntarily hospitalized (which I recognize can be abused), we end up with them being arrested instead. As noted above, involuntary hospitalization can be abused, but when so many mentally ill people go untreated until they are arrested it's perhaps time to reconsider if things are working as intended. Then, once someone is arrested, evaluated as needing to be restored to competency for trial, and finally gets to the hospital, many of them decline medication. For most of them, it's implausible that their condition will improve without it. So they have arrived at a point in their life where they don't know they are ill, have done something to get themselves arrested that's often related to their symptoms, and continue to decline treatment. I see it as an unintended consequence of such strong protections on individual rights.

Of course those individual rights should be protected, but I would respectfully suggest it's time to reconsider where the lines are drawn. This movement of the mentally ill from asylums (where they were often mistreated) to jails and prisons has been dubbed "trans-institutionalization" if you want to read more about it.

<comment><USER4> It is a Big Deal to deny someone their autonomy, no matter which way you slice it. I think we agree on that.

But, respectfully, I think that because it is such a big deal, imprisonment is the proper escalation. It's necessary to maintain a sense of proportion, and we need to avoid - at all costs (and I think that is where we diverge) - <USER2> decrement of the right to autonomy. If we make it less of a Big Deal to revoke that right, 'merely' hospitalizing them, we lose our respect for that autonomy.

<comment><USER3> That's the tact that Oregon has taken, and I can see the logic in it. But as a doctor I find it more palletable to explicitly try to work in someone's best interest than to send them to jail/prison. I am obviously biased, but I have seen hundreds of people get well and go on to live lives that they themselves would identify as more rewarding. Deprivation is, and should continue to be a very big deal. But when it becomes necessary, I'd rather that it be focused on the best interest of a person who's not in a position to recognize their own circumstances.

Clearly it's a value judgement and there's no one right answer. It depends on which of two bad options you find least offensive.

<comment><USER5> > Psychiatry possesses an inherent capacity for abuse that is greater than in > other areas of medicine. The diagnosis of mental disease can give the state > license to detain persons against their will and insist upon therapy both in > the interest of the detainee and in the broader interests of society. In > addition, receiving a psychiatric diagnosis can in itself be regarded as > oppressive. In a monolithic state, psychiatry can be used to bypass standard > legal procedures for establishing guilt or innocence and allow political > incarceration without the ordinary odium attaching to such political trials.

[https://en.wikipedia.org/wiki/Political_abuse_of_psychiatry_...](https://en.wikipedia.org/wiki/Political_abuse_of_psychiatry_in_the_Soviet_Union)

Is that "inherent capacity for abuse" overstated?

I'm less afraid of the corrupt psychiatrist than of the one sincerely convinced that people who think like I do are sick.

<comment><USER3> It is real and relevant, and already accounted for in the concerts about limiting personal liberty. The usual mechanism to address this is to require more than one clinically trained person to agree, which holds them for a few days until it can be heard in court and decided by a judge. This requires it only illness but immediate danger to self or others. This has had the unintended consequence of conflating mental illness with violence. Always trade offs...

<comment><USER6> WRT

> The usual mechanism to address this is to require more than one clinically > trained person to agree, which holds them for a few days until it can be > heard in court and decided by a judge.

It seems the above would only work (meaning that it would prevent abuse) if:

a) the 'clinically trained persons' affiliate with different political fractions

b) there is no 'federal-level' oversight hammer that can strip them of their credentials for testifying against the wants of the currently ruling political fractions

c) The judiciary system overall is free from 'selective-outrage' ( Which is, unfortunately, some would say, not the case for US, Canada, France, UK, Australia, not even mentioning known oligarch/dictatorships countries out there )

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm not an american, and some points seem alien for me. Is it really bad to jail mentally ill homeless man? He is homeless, he is mentally ill, he have nowhere to go, he have no warm and soft bed to sleep, he need to eat, and have no ability to find food. He is forced to break a law to steal a bottle of tea to drink. Probably he is stealing his food to eat. The jail imprisonment can solve the most of these problems for him. Moreover he would get medication, which can make his mental life more comfortable. And it is good for a society: he now gets his dinner legally without need to steal.

I agree, that $1k per day per patient for that is a way too much, and I see _this_ as the problem. But while reading this article I've formed a suspicion that article points to moral unacceptability of imprisonment of mentally ill. It is unacceptable because it is amoral and to hell with all the attempts to reason rationally. Is my suspicion is a right one?

<comment><USER8> US prisons are more like torture centers than a traditional rehabilitative institution. If the prisoner doesn't behave just right, he could end up locked in a small room 23 hours a day. He could end up assaulted and abused. He could end up being taken advantage of.

In the US we have institutions for the mentally ill and he would be better off there, but it's becoming increasingly more only for the wealthy to use.

<comment><USER9> > US prisons are more like torture centers than a traditional rehabilitative > institution. If the prisoner doesn't behave just right, he could end up > locked in a small room 23 hours a day. He could end up assaulted and abused. > He could end up being taken advantage of.

Is this really true? This seems to be a popular assessment but every now and then I see first-hand accounts of people who went to jail/prison and my main takeaway from them is that it's simply boring and nothing really happens, and that the average joe is just going to go in, be bored, and get out.

There are definitely big stories/issues that come out every so often but they seem to be the exception rather than the rule.

<comment><USER10> LA county jails are dangerous especially if you aren't white. Depending on the unit, your pod will be ran by either a Hispanic or Black gang member who runs the "program".

I was arrested on a minor misdemeanor and thanks to the magic of corruption, got thrown in jail for 35-days when my plea deal was 0.

I was in jail with convicted murderers, people on murder trial etc. I was handcuffed to a man that was savgely beaten by gang members for a minor offense involving a newspaper.

The process to goto court was insane — including dry runs where you basically sit in a small cold holding room with up to 50 people from 6am to 5pm but are never called to court. In that room, inmates had been murdered and yes they're cameras now but people cover them up for a fight.

This was my 1st arrest, for a dubious crime. I even called the police for help, was unjustly arrested than put in jail with violent criminals and violent deputies whose behavior has improved since the FBI installed video cameras.</comment></comment></comment></comment>


Ask HN: How do you validate an idea that it will work? - <AUTHOR> I just launched http://startmydomain.com and im trying to validate the idea. I'm not sure if its a good idea or a crappy one. :)
Time will tell I suppose. The idea is that you want to create a coming soon website, with responsive design and you want to collect visitor emails for people interested but you don't have alot of time as you are busy building the main website.
Lets say it takes a week to build a coming soon website and your time ( or someone else's is worth $30 an hour ) that's $1200 dollar just for a basic coming soon website. with http://startmydomain.com you can build a coming-soon website with zero coding and zero hosting and i'm making it FREE while its in BETA or I might just keep it free if I don't get alot of signups
I am basically looking for validation and I'm making this up as I go along:)
Would love to get some feedback though.
Is it a thumbs up or a thumbs down ?
cheers! <comment><USER2> This seems to have some potential, but I feel like there are a number of services that at least overlap with what you're doing. The challenge might be differentiating yourself and figuring out how to gain mindshare.

A few thoughts on the site itself:

1\. "domain named servers" should probably read "domain name server" or just say "DNS servers".

2\. "Easely" should be "Easily"

3\. Regarding collecting emails... how do you do that? Do you just capture them and let the user download a file, or do you provide any sort of distribution list service, or is there a way to easily integrate with something like Mailchimp, etc? My point is, if you're going to collect emails, ideally it would be very easy to turn around and send a message out to all of those collected emails.

4\. Some of those templates you have do look really awesome! It might be interesting to put a carousel on the front-page with some thumbnails of those, so people can get a quick look without having to click through to the template list page.

5\. Profit??

</comment><comment><USER3> It seems like there would be a narrow window where firms would want a "Coming soon" website. So you'll only have like five minutes in the new firm's life get their attention and get them to sign on the line that is dotted. Also, since they are new they won't have much cash to spend.

There are lots of website creator websites (Wix comes to mind, or even wordpress), so cutting through the others' marketing noise and capturing a new firm within a short window seems very difficult.

It might be interesting to look at the tactics of capturing customers for other businesses that cater to the initial steps of creating an entrepreneurial venture. LegalZoom comes to mind (for incorporating a new business). Also, The UPS Store and getting a PO box --- how do they attract new small businesses?

My $0.02. Good luck!</comment>


An Economy of Liars - <AUTHOR> http://online.wsj.com/article/SB10001424052748704508904575192430373566758.html

<comment><USER2> >Classical liberals, whose modern counterparts are libertarians and small- government conservatives, believed that the state's duties should be limited (1) to provide for the national defense; (2) to protect persons and property against force and fraud; and (3) to provide public goods that markets cannot.

I happen to agree with this definition of the state's duties, but I have a more expansive notion of (3) than most libertarians. For example, universal health care and education are public goods that generate more market wealth in higher productivity than they cost in taxes collected to pay for them, but markets intrinsically cannot produce universal education or health care by themselves.

As for the article, crony capitalism is precisely what happens when capitalists control the levers of government.

<comment><USER3> You don't understand the definition of a public good. The key to a public good is that it is non-exclusionary, or at least partially non-exclusionary, and would suffer from the free rider problem if provided by the market, and so would be inefficiently under-produced.

You say that health care and education generate more wealth than they cost. That doesn't make them public goods. Education primarily produces the extra wealth for the person who gets the education. This doesn't make it a public good, it just makes it something worth investing for each individual.

Also, look to rural India if you think the market has trouble providing education.

There are bits of health care that fall into public good, like vaccinations, but public health and health care are mostly entirely separate things.

<comment><USER2> I understand the definition of a public good. Take education: a significant part of the benefit that flows from education is externalized, that is society as a whole benefits as well as the individual. As a result, in a pure market people tend to under-invest in education.

<comment><USER4> Ryan, I completely disagree. I am surprised that you would think that the society benefits more from the education than the individual. According to me, if I have higher education, I get a better job, better salary, more respect in social circle. Compared to this, what does society get if I am educated?

And looking at how tuition fees are at all time high and people are still paying them, I would not say that people are under investing in education.

 __EDIT 1: __

For some reason, I am not able to reply to some of the replies to my comment, so let me clarify.

What is society made of? Individuals. Obviously, if individuals are better off then society will automatically be better off. Isn't it?

So if you think by providing education to an individual, society becomes better, why don't we provide good healthy food for all the individuals and we will solve the obesity problem and end up with a really healthy society? How about providing free access to a high quality gym and personal instructor? I see that you are disagreeing and you would say, one has to draw line somewhere. And in my opinion, if you think that Government should be not be responsible for good healthy food (the most important thing for an individual, even more than education), I don't understand how you can say that Government should provide public education.

 __EDIT 2: __

And here's why I am not in favor of government programs. A bureaucrat has no incentive what so ever to please their customers (i.e. taxpayers). [Quick, tell me, how many government agencies do a good job in your opinion?] By nature, government will try to find a one-size-fits-all solution to education, which does not work. As someone else said, I am all in favor of voucher system which gives control back to people who care about education and let market place offer variety of solutions for people's education needs.

<comment><USER5> You're misrepresenting Ryan's statement. His argument is not that public education benefits society more than the individual. His argument is that public education is a net benefit for society.

<comment><USER4> And my point is, anything which benefits an individual (as long as it's not illegal) automatically benefits the society, as society itself is made of individuals. Is there any case where individual is better off but society is not?

<comment><USER6> Not necessarily. If the government were to, say, buy big screen TVs for its citizens that wouldn't necessarily create a social benefit as it may promote TV watching and negatively impact health. Education, however, it likely to give people perspective and options that will lessen their chance of looking to the criminal sphere for income and becoming a social cost via the prison system.

<comment><USER4> Now you are mixing two things. I am stricly opposed to Government forcing anything on individuals as it doesn't lead to any good. So if Government forces everyone to buy TV (or for that matter anything else), obviously it's no good for society.

I was talking about any __voluntary __, legal action by an individual which benefits himself. Such an action always leads to improvement in society as society is made of individuals.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> When something is regulated by the government, the nature of that regulation is subject to being influenced by the regulated.

If the regulator itself had competition and participation in the regulatory scheme was voluntary, there would be real pressure to honestly regulate.

The government could, instead of regulating companies itself, manage a system of competing regulatory regimes and let people decide which one they trust.

There could be a "Good Housekeeping Seal of Approval" for accounting competing with FASB, companies could pick one and then publish to investors which one they adhere to.

If investors find that they are consistently burned by companies governed by FASB, they would start to favor companies governed by the alternative.

There would be real pressure to perform honestly over the longterm that a monopoly is not subjected to.

In technology, we have all sorts of competing standards that live and die by how good the results are.

Competition is a good thing and we need more of it, especially in government.

<comment><USER8> Yes. That's also a good argument for pushing for power from the federal to the state level. (And for having a federal system, or really small countries in the first place.)

<comment><USER7> Amen.

Actual, the competitive situation I described is already in place to a degree. Companies can go public in a different country, which many are doing since the oppressive sarbanes oxley regulations went into effect.

</comment></comment></comment><comment><USER9> I know there has to be some great accountants, CFO's, finance people, etc on HN that can offer more detail about a Repo 105 and what the benefit is for an organization (maybe an individual?) to do this, not just in Lehman's case. WSJ explanation is straight forward, but I would like to hear a little more about this practice--hopefully I'm not the only one.

From the article: "We have now learned of the creative way Lehman Brothers hid its leverage (how much money it was borrowing) by the use of a Repo 105. The Repo 105 meant Lehman temporarily swapped assets (such as bonds) for cash. A Repo, or repurchasing agreement, is a way to borrow money. But an accounting rule allowed Lehman to book the transaction as a sale and reduce its reported borrowings, according to a report by the court-appointed Lehman bankruptcy examiner, a former federal prosecutor, last month."

<comment><USER10> Repo's are essential to banking. At the end of the day, a bank must be in a certain financial state. Fluctuations in withdrawls and deposits can lead to a need or surplus of cash. Financial institutions balance their books daily with repos. (The market is HUGE.)

IB's have a need for repo's also, but they often push the limits of sanity. LTCM used repos for large leverage also. ( _When Genius Failed_ is an interesting book to read; essentially the crisis of 2007 was LTCM on a larger scale.)

The financial crisis of 2007 was actually a run on banks through the repo market. IB's used repos on a rolling basis with very little margin for error. Suddenly, the haircuts got large and blew them up.

For an excelent paper on the crisis and the repo markets huge (dominant) roll in the crisis, see Gary Gorton's paper: <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1401882>

<comment><USER11> Though this is tangential to the story, I would like to second the recommendation of this paper. On the way to arguing for his thesis, the author explains the function of the modern banking system and the "shadow" banking system in clear and cogent terms. He relates contemporary banking practices to older ones and explains shows how they are similar in the event of a banking panic. Very good (but long) article.

</comment></comment></comment><comment><USER12> This article attacks the current attempt to create new regulations without actually providing any alternatives to fixing the problems in the financial system. The author states:

"If we want to restore our economic freedom and recover the wonderfully productive free market, we must restore truth-telling on markets."

Yet the author provides no ideas or suggestions on how this is to be achieved. Even Alan Greenspan, former champion of the free market said this about the greediness of Wall St, "Those of us who have looked to the self-interest of lending institutions to protect shareholders' equity, myself included, are in a state of shocked disbelief." The author wants to restore something that was never there.

Since people (especially bankers) have proven time and time again that they will act in their own, immediate, self interest, this simply comes off as a rant by someone who's quite satisfied with the current state of affairs (cronyism included) and doesn't want anyone messing up his (or his cronies') cash flow.

</comment><comment><USER13> Oscar Wilde said "a cynic is a man who knows the price of everything but the value of nothing". In the same spirit I say "a classical liberal or an economist is a man that believes that societies are nothing more than markets". And libertarians think societies are just an individual multiplied by n, where n > 1; they ignore that people interact and depend on each other.

Besides the list provided, I'd add 4) the state must protect the values of a society, also. Universal health care, avoiding abortions, protecting the environment, controlling proliferation of drugs are ethical values. The state must do it because it is just wrong not to do it.

Think of it as a "social infrastructure" akin to strengthening the social fabric or the human ties, of a society. It makes it more resilient to crisis.

<comment><USER14> _In the same spirit I say "a classical liberal or an economist is a man that believes that societies are nothing more than markets"._

Ridiculous strawman. If anything, it's the left that acts as though society is a simple system that can be effectively steered by central planning. And of course, selfless regulators will only steer in the right direction...

 _I'd add 4) the state must protect the values of a society, also_

Which values? Christianity? Defending the sanctity of marriage? Preventing mixing of the races?

 _Universal health care, avoiding abortions, protecting the environment, controlling proliferation of drugs are ethical values. The state must do it because it is just wrong not to do it._

Ah, the values that you personally like. And it's wrong to _not_ ruin the lives of recreational pot smokers?

</comment></comment><comment><USER15> >Modern liberals have greatly expanded the list of government functions, but, aside from totalitarian regimes, I know of no modern political movement that has shortened it.

We hear conservative and libertarian voices constantly decrying the expansion of government power, but what about the expansion of corporate power? Government deregulation is totally meaningless when virtually all industries are controlled by a handful of super-corporations with more capital and internal legal structure than most countries. The only way deregulation can have a whisper of a chance of ushering in a better market is if we also insist on the abolition of the multinational corporation, and break up the behemoths into competing regional conglomerates.

Of course, without any regulation, a single victor will soon emerge to impose its own will.

</comment><comment><USER16> This article is schizophrenic trash. In one breath the author complains that the failure of the market is due to lax regulation and corrupt officials, while in the next he calls for further deregulation and less government oversight. He completely ignores the actual issue brought to light by the financial crisis which is exactly that this same spirit of "deregulation" has squeezed regulatory agencies like the SEC of funding and allowed them to be infiltrated by industry insiders, to all our detriment. The SEC ignored Madoff because they didn't want to rock the boat and even if they did, investigations cost money they don't have.

The Wall Street Journal has been a real Newspaper of Liars since it was acquired by News Corp. Get this garbage off HN please.

<comment><USER17> "In one breath the author complains that the failure of the market is due to lax regulation and corrupt officials, while in the next he calls for further deregulation and less government oversight."

I think the point was that regulation and officials provide false comfort, as they will be captured by the interests they regulate. Removing those regulations and officials will at least remove the false security the "lax regulation and corrupt officials" provided.

<comment><USER18> The author isn't only talking about the regulators being corrupt or incompetent. He's also talking about market participants like Madoff and Lehman Brothers.

Removing regulation will not suddenly turn the bankers into honest people, as the author seems to think.

"Better than multiplying rules, financial accounting should be governed by the traditional principle that one has an affirmative duty to present the true condition fairly and accurately—not withstanding what any rule might otherwise allow."

He's suggesting that we take away the regulations and just ask the bankers to be honest. Maybe I'm just cynical, but I don't think that's going to work.

</comment></comment></comment><comment><USER19> Anyone who cites the U.S. constitution and limited government, who does not in the same paragraph acknowledge that the reason government was limited was to protect the power of slaveholders, perpetuates the crime.

<comment><USER20> If you're going to make a claim like that, you ought to cite your sources.

<comment><USER19> The 3/5ths clause? The two-senators-each rule to assure that the slaveholding states would have disproportionate power, and the subsequent battles to prevent new slave-prohibitionist states upsetting the balance? Article 1, section 9 (The migration or importation of such persons as any of the states now existing shall think proper to admit, shall not be prohibited by the Congress prior to the year one thousand eight hundred and eight, but a tax or duty may be imposed on such importation, not exceeding ten dollars for each person)? The necessity of the 13th Amendment? Sanford vs Scott (4. A free negro of the African race, whose ancestors were brought to this country and sold as slaves, is not a "citizen" within the meaning of the Constitution of the United States.

5\. When the Constitution was adopted, they were not regarded in any of the States as members of the community which constituted the State, and were not numbered among its "people or citizens." Consequently, the special rights and immunities guarantied to citizens do not apply to them. And not being "citizens" within the meaning of the Constitution, they are not entitled to sue in that character in a court of the United States, and the Circuit Court has not jurisdiction in such a suit.

6\. The only two clauses in the Constitution which point to this race treat them as persons whom it was morally lawfully to deal in as articles of property and to hold as slaves.) ?

<comment><USER20> How does any of this suggest that the purpose of limited government was to protect slaveholders? No one is going to say that allowances weren't made to protect them but the 3/5ths clause has nothing to do with the enumeration of powers or the scope of government. Limited government and slaverights are orthogonal issues and should be treated as such.</comment></comment></comment></comment>


Ten Days in a Mad-House (1887) - <AUTHOR> http://digital.library.upenn.edu/women/bly/madhouse/madhouse.html <comment><USER2> I found three small previous threads. Others?

2016: [https://news.ycombinator.com/item?id=10926253](https://news.ycombinator.com/item?id=10926253)

2015 (a bit more): [https://news.ycombinator.com/item?id=10470383](https://news.ycombinator.com/item?id=10470383)

2014: [https://news.ycombinator.com/item?id=7730311](https://news.ycombinator.com/item?id=7730311)

</comment><comment><USER3> Nellie Bly pretty much invented investigative journalism. Even today her journalistic investigations are fascinating.</comment>


DIY Jepsen Testing CockroachDB - <AUTHOR> https://www.cockroachlabs.com/blog/diy-jepsen-testing-cockroachdb/ <comment><USER2> This is a great write-up. Easily one of the most interesting posts I've seen on this subject, since Aphyr's last post.

Also nice to see things like:

> We noticed that the Jepsen test code didn't actually check for negative > balances, contradicting what has been previously written about it, so we > fixed that.

</comment><comment><USER3> This is refreshing to see. Much more refreshing than vendors trying to move the goal posts when Kyle's test show them coming up short.

</comment><comment><USER4> Excellent writeup. Looking forward to more development on this. Hopefully Kyle has time to do a Jepsen writeup (orrrr you can hire him!)

<comment><USER5> Employee here - A proper analysis from Kyle is certainly on our radar, although we'll likely wait until post-beta since its such a hefty project. We're just as eager to see how CockroachDB stacks up.

<comment><USER4> makes sense!

</comment></comment></comment><comment><USER6> These guys should pony up some consulting dollars to get the main guy to do his thing.

Also, I don't buy "NewSQL" without honest CAP discussions of tradeoffs.

<comment><USER7> Employee here - which discussion around NewSQL would you like to have? You pay for the consistency in more round trips between replicas, and you need a quorum of your nodes (which carry your data) to be alive. All of that stuff can be made arbitrarily more complex to increase throughput, but essentially these are the tradeoffs.</comment></comment>


YouTube's anti-extremism crackdown targets journalist who documents extremism - <AUTHOR> https://arstechnica.com/information-technology/2019/06/youtubes-anti-extremism-crackdown-targets-journalist-who-documents-extremism/ <comment><USER2> This is what happens when someone with an opinion censors content. The (old) reddit model was far better where small communities are policed by a moderation team and if you don't like the mods you go somewhere else.

There's simply too much content on YouTube to police effectively and fairly. It's time to move to community based decentralized alternatives.

<comment><USER3> Could YouTube provide more structure and moderate by subcatgories?

Say I say I'm an expert in chemistry and education - then I would be available to moderate chem Ed videos.

I'm not convinced this isn't an attempt by YT to claim they tried and it had unintended consequences they can't avoid.

</comment></comment><comment><USER4> Down with monopolies, Federated is the future. Now how do we monetize a federated youtube type service?

</comment><comment><USER5> Darwin would be a extremist. Freud would be called a pornographer. Copernicus would be banned for fake news.

I do not honestly care for propaganda, but if it has something new- aka, something atrocious but never heard before to say- spare it. How can a Algo actually classify novelty?

<comment><USER6> An algo or human being can only identify something as undesirable based on social norms of the times... There are many socially acceptable groups and ideas that have fringe or even mainstream elements to them that have undesirable elements that are simply tolerated. And often the implications of socially acceptable ideas is not fully understood when they are in vogue, and their critics are labelled as simply hateful bigots that are not progressive.

But really it's impossible at any given time to separate wheat from chaff and ideas mutate so that racial hatred becomes cultural hatred which still maintaining similar elements and a similar out-group vs an in-group. Is that crypto-racism? Maybe, you can never tell as it's like fashion oblivious to those who live in it... because you can only see it through the lens of its critics.

<comment><USER7> Very well put - exactly why free (unregulated) speech is so important, despite the downsides.</comment></comment></comment>


Nobody expects CDATA sections in XML - <AUTHOR> http://lcamtuf.blogspot.com/2014/11/afl-fuzz-nobody-expects-cdata-sections.html <comment><USER2> The irony is that CDATA isn't even very useful; there's no way to escape the ]]> closing tag so you still have to invent some special escaping mechanism to use it.

Nobody expects entity definitions in XML either, and yet about once a year some new service or software is found vulnerable to XXE attacks. (Summary: a lot of XML parsers can be made to open arbitrary files or network sockets and sometimes return the content.)

XML is a ridiculously complex document format designed for editing text documents. It is not a suitable data interchange format. Fortunately we have JSON now.

<comment><USER3> "Fortunately we have JSON now." Which doesn't support big ints. JSON isn't a silver bullet.

<comment><USER4> Sure it does:

      { "mybigint" : -123434580239458203948203982345723458 }

You can throw the spec out the window and put as many digits as you want into a JSON integer. Any half decent parser in a half decent language will accumulate the token and spit out an integer object.

There is no reason to write a JSON parser that doesn't accept bignum integers, in a language that has them.

There are only two reasons some JSON implementation doesn't accept them. One is that the underlying software doesn't handle them. In that case JSON is moot; it's a limitation of that system. You cannot input bignums into that system through _any_ means; they are not representable. The other is that the JSON implementation was written by obtuse blockheads: bignums could easily be supported since the underlying language has them, but aren't simply for compliance with the JSON specification. Compliance can be taken to counterproductive extremes.

<comment><USER5> > There is no reason to write a JSON parser that doesn't accept bignum > integers, in a language that has them.

Couldn't you write that about about almost any data type in JSON? The entire point of having a standard for such things is so that you don't have to worry about the differences between individual parsers/serializers.

<comment><USER4> > _Couldn 't you write that about about almost any data type in JSON?_

Yes, you could.

> _The entire point of having a standard for such things is so that you don 't > have to worry about the differences between individual parsers/serializers._

Things like the maximum size of strings or integers are implementation limits. These should be kept separate from the language definition _per se_.

There are _de facto_ different levels of portability of JSON data. A highly portable piece of JSON data confines itself not to exceeding certain limits, like ranges of integers. We could call that "strictly conforming".

JSON data which exceeds some limits is not strictly conforming, but it is still well-formed and useful.

Limits are different from other discrepancies among implementations because it is very clear what the behavior should be _if_ the extended limit is supported. If an implementation handles integers beyond the JSON specified range, there is an overwhelming expectation that those representations keep denoting integers.

This is different from situations where you hit some unspecified or undefined behavior, where an implementation could conceivably do _anything_ , including numerous choices that meet the definition of a useful extension.

<comment><USER5> > Things like the maximum size of strings or integers are implementation > limits. These should be kept separate from the language definition per se.

At least with integers, I think protobuf's ability to specify 32-bit and 64-bit integers has been quite helpful.

> There are de facto different levels of portability of JSON data. A highly > portable piece of JSON data confines itself not to exceeding certain limits, > like ranges of integers. We could call that "strictly conforming".

Yeah... and that's how you get yourself in to problems. Life is simpler with one standard that either works or doesn't. Easily the most annoying thing with protocol buffers is using unsigned integers because of Java's signed integer foolishness. Yes, you can argue that's a reason to have the "strictly conforming" concept, but I'd argue quite the opposite.

> Limits are different from other discrepancies among implementations because > it is very clear what the behavior should be if the extended limit is > supported. If an implementation handles integers beyond the JSON specified > range, there is an overwhelming expectation that those representations keep > denoting integers.

Hmm... I don't think that is clear at all. In fact, it isn't clear to me when I have to worry about floating point rounding potentially kicking in.

> This is different from situations where you hit some unspecified or > undefined behavior, where an implementation could conceivably do anything, > including numerous choices that meet the definition of a useful extension.

In practice, there seems to be little difference. While there might be some _idealized_ behaviour that is expected, there appears to be plenty of wiggle room for a variety of behaviours for these "not strictly conforming" cases.

</comment></comment></comment></comment></comment></comment><comment><USER6> I've been following posts about this tool for a few weeks and it is really remarkable how many interesting results are already popping out already. In particular since static analyzers have been around for years and years.

I'm assuming afl-fuzz is particularly CPU-bound, and it would be interesting to see some numbers about how many CPU years are being dedicated to it at the moment - and if we would see even more interesting stuff if a larger compute cluster was made available.

It's also super scary how "effortlessly" these bugs appear to be uncovered, even in "well-aged" software like "strings".

<comment><USER7> It would be pretty cool to have a public cluster that anyone can submit jobs to that are prioritized based on amount of donated CPU cycles. Instead of "Seti at home" it would be "fuzz at home".

<comment><USER8> I don't think that would be that efficient of a use of computing resources. Each instance explores the same instruction space. It keeps track of where it's explored, and uses various techniques to explore different parts of space.

It's very likely that multiple instances, if run in parallel and with no data sharing, will explore a lot of the same space.

Also, making a _public_ cluster would be a security challenge. It runs arbitrary C/C++ code, and can trigger code paths that the developers didn't even realize. How would your box stand up to multiple grabs of 4GB of memory?

<comment><USER7> Don't have instances explore the same programs starting from the same state. Have state reported back in intervals so other workers can be scheduled to resume the work if that one goes down.

Security would be an issue. A VM would probably be a hard requirement. That can bound the memory usage, hardware calls, etc.

<comment><USER8> Even starting from different states doesn't help, because afl uses semi-random search techniques. It's very likely that different start locations will still have a large overlap.

Nor is it obvious that state reporting is useful. I ran afl for about 4 days. It ran my test code about 1,000 times per second, for a total of nearly 1/2 billion test cases.

That's a lot of data exchange for each program to report and resynchronize.

I'm not saying it's impossible. I'm suggesting that it's likely not worthwhile. It would be better to support multiprocessing first, before looking towards distributed computing.

<comment> f- afl-fuzz can be parallelized fairly easily. The exchanged data amounts to newly-discovered, interesting inputs that then seed the subsequent fuzzing work.

<comment><USER8> Great work with afl. I tried it out last week, and found two segfaults and a stack smash detection in one program. I tried it on another program, only to have gcc crash with an internal error. :(

By parallelized, do you mean on the same machine or across a distributed cluster? If they only share the same set of interesting inputs, won't the different nodes also end up searching much of the same space? .... Hmm, no I see how I could be wrong. With interesting seeds, boring space is easy to re- identify, so there's a trivial amount of duplicate work, and the rest is spent just trying to find something new and interesting.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Recently I find it harder and harder to believe that lcamtuf is just one person.

<comment><USER10> He just started running afl-fuzz few years ago and redirects fitting outputs as blog posts.

<comment><USER11> Running it against an AI simulation of a human programmer, pattern-matching for the output "Wow that's awesome", no doubt.

</comment></comment></comment><comment><USER12> Heads-up to the "comment without reading the article" crowd: the title is _not_ bemoaning a lack of handling for CDATA in existing parsers. It's discussing an interesting behavior of the AFL fuzzer when used with formats that require fixed strings in particular places...

Related: NOBODY EXPECTS THE SPANISH INQUISITION, either. :)

</comment><comment><USER13> This is completely tangential, but I'm waiting for someone to create a breakfast cereal called Funroll Loops. You know, for the kids.

</comment><comment><USER14> How long till afl-fuzz reaches consciousness?

<comment><USER15> About 13 years, if all goes as planned. Then another 5 after that until we are all running afl-fuzz.

</comment></comment><comment><USER16> Wow, what an enjoyable read. I recommend the story about randomly generating JPG files too.

</comment><comment><USER17> This thread reminded me of a draft post I've been sitting on for a while, related to ENTITY tags in XML and XXE exploits.

Basically, it's really easy to leave default XML parsing settings (for things like consuming RSS feeds) and accidentally open yourself up to reading files off the filesystem.

I did a full write-up and POC here: [http://mikeknoop.com/lxml-xxe- exploit](http://mikeknoop.com/lxml-xxe-exploit)

</comment><comment><USER18> I'm actually not so surprised, given what the fuzzer does - mutating input to make forward progress in the code. Incremental string comparisons definitely fall under this category since they have a very straightforward definition of "forward progress"; either the byte is correct and we can enter a previously unvisited state, or it's incorrect and execution flows down the unsuccessful path. It's somewhat like the infinite monkey theorem, except the random stream is being filtered such that only a correct subsequence is needed to advance.

On the other hand, I'd be astonished if it managed to fuzz its way through a hash-based comparison (especially one involving crypto like SHA1 or MD5.)

<comment><USER19> It's kind of like breaking a password if you only have to guess 1 letter at a time until you get it right. Reminds me of the Weasel program: [https://en.wikipedia.org/wiki/Weasel_program](https://en.wikipedia.org/wiki/Weasel_program)

It's just the simplest possible demonstration of evolution, where characters of a string are randomly changed, and kept if more of the characters match. In a short amount of time you get Shakespeare quotes.

Obviously hashes are designed to be difficult to break. Although I've never heard of anyone trying a method like this before. I've heard of people using things like SAT solvers to try to reason backwards what the solution should be. But this is the reverse, it's trying random solutions and propagating forward to see how far they get.

I doubt it would work, I'm just curious to know if this has been tried before and how well it does.

<comment><USER20> The problem is that a good, side-channel resistant implementation would always do the same amount of computation and fail at the same place. You wouldn't get any information out of your attempts.

</comment></comment></comment><comment><USER21> But of course no one uses either when there's Atom/GitHub's favorite: CSON. [https://github.com/bevry/cson](https://github.com/bevry/cson)

</comment><comment><USER22> Tell the people that created the webservice I have to consume this!

</comment><comment><USER23> I didn't expect a kind of Spanish Inquisition...

</comment><comment><USER24> Maybe C based XML parsers don't, but JVM and .NET based XML parsers don't have any issues with CDATA sections.

Time to upgrade to more modern tools?

<comment><USER25> The reasons why we are still relying a lot on software written in low-level languages have been discussed to death, and are quite orthogonal to the insight in the article, which is that seemingly lo-tech techniques can discover much about an opaque, potentially vulnerable piece of software. And even some seemingly insurmountable difficulties ("the algorithm wouldn't be able to get past atomic, large-search-space checks such as …") may simply, with a bit of luck, fail to materialise.

Still, quoting from a sentence a few lines down in the article:

"this particular example is often used as a benchmark - and often the most significant accomplishment - for multiple remarkably complex static analysis or symbolic execution frameworks"

The author is thinking of backwards-propagation static analysis or symbolic execution frameworks, for which is it indeed a feat to reverse-engineer the condition that leads to exploring the possibility that there is a "CDATA" in the input. Forwards-propagation static analysis needs no special trick to assume that the complex condition must be taken some of the times and to visit the statements in that part of the code. The drawback of static analysis (especially with respect to fuzzing) is then with the false positives that can result from the fact that a condition was partially, or not at all, understood.

</comment></comment><comment><USER26> I am not sure but what is the actual harm of it?</comment>


Morevna Episode 3 – Made with free software [video] - <AUTHOR> https://morevnaproject.org/anime/episode-3/ <comment><USER2> It's cool that they actually finished the project. Last time I've tried Synfig Studio, it was very crashy. Congrats!

<comment><USER3> It's an ongoing project. There will be more episodes, and more Synfig improvements. IIUC Morevna is led by one of the Synfig developers and is used to motivate Synfig improvements, much like Blender shorts and Blender, and more recently, Ze Marmot and GIMP.

</comment></comment><comment><USER4> subtitles are unreadable

and that's too bad because the overall story seems quite solid

<comment><AUTHOR> The subtitles are available here - [http://www.amara.org/en/videos/2X4iBBif3jnx/en/1429060/](http://www.amara.org/en/videos/2X4iBBif3jnx/en/1429060/)</comment></comment>


"One Move Too Many". The $3750 rock-climbing book. - <AUTHOR> http://www.amazon.com/One-Move-Too-Many-Understand/dp/3928026208 <comment><USER2> Probably related to this:

[http://www.michaeleisen.org/blog/?p=358](http://www.michaeleisen.org/blog/?p=358)

</comment><comment><USER3> Two of my favorite things. Edge cases in code, and climbing. Who would have thought they could come together so beautifully.

</comment><comment><USER4> An example of Algorithms gone rogue?</comment>


Ryanair: Eircom must disclose IPs of bloggers accused of making defamatory posts - <AUTHOR> http://www.independent.ie/irish-news/courts/eircom-must-disclose-ids-of-bloggers-accused-of-making-highly-defamatory-posts-29066737.html

<comment><USER2> Hard to make comment without being able to see what was considered defamatory, but these cases always have the taint of large corporations using their size and cash to squash criticism, no matter how valid their defamation case.</comment>


NoSQL v. SQL is the worst holy war ever. - <AUTHOR> http://www.deserettechnology.com/journal/?p=44 <comment><USER2> The first comment on that post is quite hilarious.

</comment><comment><USER3> _NoSQL is designed to address a certain problem space and RDBMS is designed to address another._

I don't see it that way at all.

It's more like RDBMS is the all-purpose data store that attempts to distill the maximum number conceivable data storage, integrity constraints and lookup requirements into a set of powerful primitives. And NoSQL is a large group of technologies that are each optimized for specific cases which SQL is traditionally bad at, but which don't necessarily have much in common with each other.

<comment><USER4> I agree with this, but I'd add that we developers tend to make an RDBMS do everything because it's what they're familiar with. NoSQL is an alternative to solve a specific problem, but you can't see that problem if you're ignorant of it.

It's like my experience with SVN vs Git. I didn't know how useful and more efficient my workflow would be if I used branches, so I never saw why Git was useful. Sure I could branch in SVN, but it was way more work. I got involved in a project where I had to use git, and I learned how branching works, and now I use it all the time because I understand where it's applicable.

I don't think you have to choose MySQL over MongoDB. I think you could be very happy using both, each for its purpose. You don't always know why you need something until you need it. It's always good to keep an eye on what others are doing.

<comment><USER5> The same argument about branches in source control can made about SQL itself. In my opinion, a large number of developers don't know how to code SQL properly and a lot are afraid of it. They end up using an RDBMS as nothing more than a dumb bit bucket -- often hidden behind increasingly complex abstractions. The NoSQL movement, unintentionally, lets these programmers feel superior about their lack of knowledge.

I don't want to argue against the legitimate use of NoSQL solutions. I just don't think there are enough use-cases to justify the hype. For example, an article was posted here last week about using NoSQL solution to store e-commerce orders.

<comment><USER6> I disagree. Lots of applications only require dumb bit buckets. There is no real sophistication or structure to the data. Anything more is over engineering for a large majority of products which data storage is not particularly useful or meaningful.

<comment><USER4> I worked on a system a couple of years ago where we ran calculations nightly and then we write the results of this calculation to a row in a table for caching purposes. This row was then fetched by another job to generate a PDF. We used SQL for this because Reporting Services could build a pdf from a row in a table.

It's not a good solution. This type of data doesn't need to be searchable. It's using a database server as a caching mechanism. That seems wrong. Seems like memcached, mongo, couch, or anything else would have been better.

Heck, people have been using memcached for a long time, and yet all of a sudden people don't see a use for NoSQL setups?

Are we sure we're not just doing the same old "Defend what you know" dance?

</comment></comment></comment></comment></comment><comment><USER7> The whole idea with "NoSQL" is that you pick the best tool for the job. Most people that push RDBMS solutions try to shoehorn an RDBMS for every possible scenario. For modeling the majority of business data, an RDBMS is fine. There are many problems such as graphs, logs, lossy real-time data, etc that CAN be modeled in an RDBMS but shouldn't be.

<comment><USER8>
      The whole idea with "NoSQL" is that you pick the best tool for the job.

Stop it. You're doing it again.

The whole idea of "Computer Programming" is that you pick the best tool for the job. It has nothing to do with NoSQL.

<comment><USER9> NoSQL is primarily a reaction to the ubiquitousness of relational DBs. It's providing another tool aside from a hammer.

<comment><USER10> Ubiquity

<comment><USER9> Both are in nearly every dictionary around. And given the base of "ubiquitous", I prefer adding a "ness" to denote a quality, which is extremely common in English and can even be applied to words that don't normally accept it, so it's an easy cognate. Something being cheesy == has cheesiness. "Ubiquity" is more of a hacked form of a word, as it removes from the base word.

Though I admit it's shorter, thus may eventually achieve ubiquity over ubiquitousness.

<comment><USER11> Not to continue the content-free let-me-fix-that-for-ya sniping you're answering, but "ubiquity" dates back to 1579. It's a nice, old word, not a hack or neologism.

Nonetheless, both words are entirely proper, acceptable, and clear.

</comment></comment></comment></comment></comment></comment><comment><USER12> What it boils down to is choose the right tool for the job and sometimes that means using two tools that do similar things. I for one won't be giving up SQL any time soon but also look forward to replacing some of our poorly performing sections with NoSQL (we sort of already do thanks to memcache).

</comment><comment><USER13> I don't know. I think any holy war in which people aren't killed is pretty good as far as holy wars go.

</comment><comment><USER14> I can't help but see this post as the blog equivalent of the guy trying to keep people from fighting in the real life, at the same time trying to draw attention to him, and at how mature he is.The article has almost no content at all.

</comment><comment><USER15> I have that wish for humanity: I'd really like people to use words that are in proportion with what they describe.

Things like: "we're dead" (when we just talk about loosing a contract or even closing one company), "it's totally catastrophic" (when someone cannot make it to a meeting, or the vegetables you had planned for dinner are not available anymore at the groceries).

Come on.

Talking about "worst holy war" for tooling trends - sorry, not for me, even for the purpose of creating a catchy headline or of underlining a point.

Oh and yes: I use both NoSQL and SQL, sometimes in conjunction in the same system.

<comment><USER16> >I use both NoSQL and SQL, sometimes in conjunction in the same system.

As any sane developer would, and without having to go all-or-none either which way. I don't understand the people who are balls to the wall for _either_ side. They both have a purpose.

<comment><USER15> The fights around "tech X is better than tech Y" usually boil down to some kind of fear (of being replaced, of loosing the job) or biaised-validation of all the effort already invested in X.

</comment></comment></comment><comment><USER17> Recently I've researched all NoSQL databases(grpaph oriented to be precise). We're building a project which I think fits best in NoSQL solution. And I did not find any suitable solution. Either it doesn't a have client api(we're using .NET) other then REST or plain TCP/IP (and of course I don't have time to create my own API) Either this is just some project more like a school homework.

Do you seriously believe that you can rely your business solution which will run across dozen of PCs on someones experiment?

<comment><USER17> Another problem is deployment, if I adopt some RDBMS system to my needs, then I already have a bunch of web hostings supporting this type of DB or I can use installer to deploy the DB, run a few scripts and everything is ready to run.

<comment><USER4> Deployment isn't the issue with these - deployment can be automated just as easily as an RDBMS. Sometimes easier. It's trivial to throw up several instances of MongoDB for example. As for hosting solutions that support this stuff, well, I prefer VPSs that I control to shared hosting with Mysql for anything that's serious.

But you and I appear to have very different needs.

<comment><USER17> I prefer VPSs too, but if you aim wider auditory you should at least try to support web hosting. With RDBMS it is easy. And with NoSQL it is almost impossible. Maybe this is just a matter of time, when NoSQL will be as much widely used as MS SQL for example, then maybe you will be able to use MongoDB in a web hosting.

<comment><USER18> But if one of the purported values of many NoSQL technologies is their benefit to scalability, and you are using this tech in your application because the app needs to scale, then does it make sense to deploy this ultra-scalable app on shared web hosting (regardless of whether they support NoSQL tech)?

</comment></comment></comment></comment></comment><comment><USER19> > Relational databases scale. NoSQL databases scale.

This is simply not true, if we're talking about horizontal scalability (which is probably the most relevant kind of scaling these days, because it's the most cost-effective).

You can't add more nodes to an RDBMS, keep ACID, and get linear scalability. You just can't.

From what I know of CouchDB, you could scale it linearly if you manage the partitioning of data yourself according to load. But if your data distribution changes you're a bit screwed. My impression though is that most people just use CouchDB on a single machine.

For BigTable, on the other hand, it really is just a matter of adding or removing machines at any time and getting nearly linear scaling. The load is dynamically balanced between machines, so this is actually practical.

Are there ways of scaling an RDBMS architecture? Yes, but they involve giving up ACID (like having read-only replicas, for example).

So I'm not saying RDMBS's are bad, just that there is a real limitation here.

</comment><comment><USER20> This holy war seems to just be in the open source world. I really don't see cio's rushing to get rid of oracle/db2/sql server

</comment><comment><USER21> Best explanation I've heard so far: NoSQL = " _Not Only_ SQL" Pick the right tool for the job.

</comment><comment><USER22> I'm going to declare something else the worst holy war ever.

Then we can have an even worse holy war than ever was before, making ourselves both wrong.

<comment><USER23> I think the Crusades were the worst holy war ever.

There. Problem solved. Unless you wanna kill a few hundred thousand people and go to war for a few hundred years.

(If I'd said "The holocaust", I could've Godwinned this thread, but that wasn't really a holy war.)

<comment><USER24> That's quite an interesting point - if you restrict holy wars to the "my imaginary friend is better than your imaginary friend.... fight!" kind then you are probably correct.

I'm trying to think of other real "holy wars" - the 30 Years War is perhaps the only other major one I can think of. I guess most other "holy wars" are really justs lingering fall out from conquests Ottoman invasion of Europe, Ireland, .....

<comment><USER25> The 30 Year War was _really_ a Holy war?

Consider that Sweden, one of the big participants, was financed by the famously Protestant country France! :-)</comment></comment></comment></comment>