How We're Building a Business to Last - <AUTHOR> https://www.cockroachlabs.com/blog/how-were-building-a-business-to-last/ <comment><USER2> RethinkDB [ex-]founder here.

The problem wasn't that we (and presumably others) didn't plan for open- core/cloud. We did, but there are structural problems in the market that prevent this from working.

Open-core didn't work because the space is so crowded with high-quality options that you have to give away enormous amount of functionality for free to get adoption. Given how complex distributed database products are, by the time you get to building a commercial edition you're many years in and very short on cash.

Cloud didn't work because AWS/GCloud have enormous moats of pricing and brand recognition. They drive margins down to epsilon, and if your product sees meaningful adoption in the industry they launch their own service and take all your customers.

<comment><USER3> Do you think there's something different that Cockroach could do? Or do you think that the database market as it exists today leaves them without a path to building a lasting business?

Personally I believe that latter. I don't see how they're going to get people to pay for Cockroach with all the options that are already out there. I think they might have an even more difficulty than RethinkDB did because their interface is SQL which means that migrating to things like Postgres or RDS is a lot easier.

<comment><USER4> A majority of software companies can operate on RDS (and DynamoDB for that matter) and utilize their built-in scaling functions. CockroachDB adds no value to those customers, which will presumably make up the bulk of them hypothetically becoming a profitable company.

Contrast CockroachDB with some of the other nascent open-source-to-successful- businesses:

Influx - Solves timeseries applications challenges. (biz problem)

Citus - Solves a scale out technology problem with an already established DB platform. (tech problem)

Confluent - Solves scaling issues with an already established data streaming database. (tech problem)

Cloudera - Solves scaling issues with an already established big data platform. (tech problem)

Elastic - Solves search application challenges. (biz problem)

Cockroach - Solves scaling issues with SQL databases by offering an alternative DB. (??)

Unless Cockroach can position itself as either solving a technology challenge with an already adopted DB solution, or solves a business problem, it's going to be very difficult to achieve profitability.

<comment><USER4> I should add. One of the reason I thought that RethinkDB might actually survive was that (as far as I could tell) their database not only solve scaling issues, but also helped solve real-time push to mobile apps. I'm surprised they didn't position more to mobile app devs for adoption.

<comment><USER5> When I tested RethinkDB, it was an order of magnitude slower than Postgres. That didn't match the website marketing, so I just gave up.

Dunno what that anecdote adds, but... that was my experience.

</comment></comment></comment></comment></comment><comment><USER6> Great direction, I think they it on the head. If I would have to give suggestions they would be:

1\. CockroachDB Community License (CCL) might sound like a Community Edition, and that normally refers to the open source version instead of the proprietary one.

2\. It is hard to quantify the difference between a startup and an established company. We put the difference for GitLab at 100 people that can potentially use our software.

3\. I see the CTO commenting here [https://news.ycombinator.com/item?id=13438863](https://news.ycombinator.com/item?id=13438863) that they will never move features from open source to the CCL Maybe they can consider publishing a set of promises to the community. We did that at about.gitlab.com/about/#stewardship

</comment><comment><USER7> From the chapter by Michael Tiemann in Open Sources:

"At first I tried to make my argument the way that Stallman made his: on the merits. I would explain how freedom to share would lead to greater innovation at lower cost, greater economies of scale through more open standards, etc., and people would universally respond "It's a great idea, but it will never work, because nobody is going to pay money for free software." After two years of polishing my rhetoric, refining my arguments, and delivering my messages to people who paid for me to fly all over the world, I never got farther than "It's a great idea, but . . .," when I had my second insight: if everybody thinks it's a great idea, it probably is, and if nobody thinks it will work, I'll have no competition!"

I still find it interesting how many people dismiss Cygnus's business model out of hand when entering the open source market. (Cygnus was acquired by Red Hat for $600 million and Michael Tiemann is _still_ VP of Open Source development IIRC) What is interesting to me is that I've never heard of anyone else even trying it. No successes. No failures. As Michael Tiemann said, no competition. And Red Hat enjoys that competitive advantage even today.

I highly recommend reading that chapter for an alternative view on how to approach open source development.

<comment><USER8> _> I still find it interesting how many people dismiss Cygnus's business model out of hand when entering the open source market. […] What is interesting to me is that I've never heard of anyone else even trying it._

Well, as I understand it, part of the reason is that contrary to their origin story, Cygnus didn't really follow the "Cygnus Business Model" either, and anyone trying similar tactics since then has had to deal with much greater visibility.

</comment></comment><comment><USER9> It looks like you are trying to replicate the MongoDB Inc. business model (regardless of major differences in the actual product being offered).

MongoDB offers a commercial version of their product with enterprise features (encryption at rest, LDAP auth, etc) and support - MongoDB Enterprise.

Additionally they also offer managed, cloud hosted MongoDB deployments - MongoDB Atlas.

Over the last few years the valuation of MongoDB, Inc. has been slashed by institutional investors such as Fidelity and BlackRock. While they haven't had mass layoffs or some other negative corporate event, they have clearly had some difficulty making their (and apparently your) business model work.

Do you agree that this is a fair comparison? And what do you makes CockroachLabs more likely to succeed with this business model than MongoDB?

<comment><USER10> (Post author here) I'm not incredibly familiar with the ins and outs of MongoDB Inc's business model, but I agree with your assessment. They certainly seem to have embraced both of the OSS business models I described in the post as viable alternatives. We are going to start with just one, and there's still a huge amount on our plate.

MongoDB Inc did have its valuation reduced by some institutional investors. Hard to say whether that was premature or what the impetus was behind their decision. MongoDB is an incredibly well-adopted product that has gotten considerably more capable over the years. I would argue they've had good success with this business model, as building a $1.6B business is a huge accomplishment whether you've got an OSS business model or not.

It would be fair to ask whether they've done the balancing act as well as they might have. They've certainly knocked OSS adoption out of the park. On the other hand, I've heard anecdotally that they waited a long time before introducing enterprise features.

Regardless, I view MongoDB Inc. as a big - and still growing - success, and consider much of what they've accomplished to be worthy of emulation.

<comment><USER11> > (Post author here) I'm not incredibly familiar with the ins and outs of > MongoDB Inc's business model, but I agree with your assessment.

"I don't know much about one of our signifcant competitors' business model." doesn't sound like something you would want to hear from someone just announcing their business model.

<comment><USER12> I don't think that's a fair interpretation of 'not incredibly familiar.'

<comment><USER13> Point still stands. I'm not even in the market but have looked at the community vs enterprise editions of successful companies to learn what splits are already market-proven. Just curiosity for me in case I got into the business. If I was in the market, I'd know everything about market leaders, main competitors, and failures that seem like they should've worked. It's necessary to compete with them to best effect.

</comment></comment></comment></comment></comment><comment><USER14> This can be seen as a kind of response to concerns about the survival of other open source databases raised after closing RethinkDB and its recent postmortem [https://news.ycombinator.com/item?id=13421608](https://news.ycombinator.com/item?id=13421608)

</comment><comment><USER15> > In 2017, any product whose core capabilities cannot scale without requiring > a commercial license is probably setting the bar too low.

Is this a dig at InfluxDB for removing clustering from their open source version?

<comment><USER16> InfluxDB never had clustering in any version.

They announced that when they'd have clustering, if they ever do, it will only be in a paid edition.

That's open for another debate entirely: Advertising and promoting features that don't exist and won't in any near future.

</comment></comment><comment><USER17> Do you envision features moving from CCL to APL? For instance, should the database ecosystem change such that everyone and their mother are offering row level geo partitioning in OSS databases, would it be likely that that feature would become APL licensed?

<comment><USER18> (Cockroach Labs CTO here) We don't really anticipate making a lot of changes like this, but yes, it's possible that as the product and market evolve we may change our minds and relicense some CCL features as APL. Of course, we wouldn't move in the other direction - once something has been released under the Apache license it will stay that way.

</comment></comment><comment><USER19> If they really want to actually make money with a database, they would implement binary compatibility with Oracle's SQL dialect, Oracle stored procedure language, and its OCI binary protocol for programming from C.

There are plenty of big customers locked into Oracle. If you gave them a backwards compatible but scalable database for half the price, they would happily cut their costs in half, and make cockroachlabs very rich.

And then Oracle would offer to buy your company.

</comment><comment><USER20> > So what doesn't a startup need to succeed, but an established company would > consider an important requirement.

> The first is a fully-distributed, incremental capability for quickly and > consistently backing up and restoring large databases using configurable > storage sinks (e.g. S3 or GCS). The same functionality, but non-distributed, > will be available for free to all users.

I appreciate that you're trying to write a good database and build a business, but what do you mean by "startup"?

If a database can't guarantee it can make backups, why would a startup attempt to use it in the first place?

<comment><USER18> (Cockroach Labs CTO here) This could have been worded more clearly in the post. There will be two versions of backup functionality: a basic implementation for free (Apache license) and a faster distributed and incremental implementation as a paid feature (CCL). It's like the difference between mysqldump and an InnoDB-aware backup tool.

<comment><USER21> Sounds like crippleware for a distributed database.

If you can't incrementally back it up, you can't really afford to run it in production in a cluster that has a large dataset. If you don't have a large dataset, you don't need cockroach db (first law of distributed objects, etc).

Maybe you'd be better off designing features for clients with specific requirements and very deep pockets.

<comment><USER22> Not necessarily, even small datasets can benefit from a distributed database. Configuring a HA database setup for any of the open source DB's requires a lot of work. For a startup, a small cluster can provide HA, redundancy, and ease of scalability should the need arise.

<comment><USER21> No one cares about the difference between 99.9 and 99.999 reliability at the DB layer and then adopts a new open source DB to solve that problem. Especially when that exciting, new, experimental database cripples your ability to back it up. Hilarious.

</comment></comment></comment></comment></comment><comment><USER23> What's wrong with actually charging money for what you make? I think the over open sourcing of things leads to a tragedy of the commons whereby no one can profit enough to afford a marketing budget. Or if they can afford one, its 100x smaller than anyone else in the space that "charges" and is closed not open.

</comment><comment><USER24> I'm really looking forward to the 1.0 release of CockroachDB. S3 and GCS were mentioned as configurable storage sinks, are there plans to release with Azure Blob as well?

<comment><USER25> Yes, Azure blobs will be supported. (I'm a dev here and just finished that feature.)

</comment></comment><comment><USER26> Disclaimer: I am outside the database market (we view it all as just "storage")

We are a similar play (open core, etc) I commented in the rethink thread as well.

A few lessons on the business model we ran in to:

1\. Cloud is commodity/experimental. It _could_ be the future though and there's no reason not to have an offering at least. We are launching a partnership with microsoft on azure to experiment with cloud for their hadoop offering. We found it was bring your own license and very similar to on prem. It seems like a no brainer to at least try this.

2\. We are on prem first. Enterprise customers need "pay to blame" kind of like insurance. We have closed source features we license. Support is secondary and comes only with a license.

3\. Bundling and minimum purchasing is key. You _need_ to validate a customer has a budget.

1 thing that I notice database companies don't cover which kind of surprises me (that cloudera,red hat, etc do) is training and the "services swamp" 1 way to qualify customers and increase run way is a "small" amount of support you charge a high rate which in turn drives licensing revenue on top. A lot of the companies that have actually stood the test of time started like this.

Where we deviate:

1\. Building a horizontal platform but focus on 1 product at a time. In our case, we have a generic platform we can license for teams that just need "something better". We focus on a use case such as fraud/network intrusion/money laundering and sell that. This is very similar to the oracle model. "Bundle a database with the app"

2\. Any services we end up doing we put aside to turn in to a product down the road. In our case, we observe and learn the patterns and reapply those as "templates". In our case we accumulate expertise, make a bit of money, and monetize later. Many SAAS companies in our space keep the customer data because they need to build better models. I'm not quite sure what the analog in the database market here is. We just keep the "lessons learned". The key here will be scaling that. In our case, we do that by focusing on 1 vertical use case and owning that. We also minimize engineering time on the platform.

In short: We have a dual licensing model where we have an "app" that's easy to sell in the market, get paid to explore the market (while focusing on/prioritizing 1 use case for more scalable revenue, and for teams that just need a better platform, we can just offer that and make some fairly passive licensing revenue.

1 other neat anecdote: for all the people raving on HN about what google's doing with AI, the problems people had 50 years ago are still the same ones people pay for today. The database market maybe similar, it might not be bad to learn from your predecessors but maybe just update the business model a bit (eg: cloud offerings,..) At the end of the day people pay for use cases over everything else. Think about the _reason_ they are about HA not "HA is cool, they obviously want to pay for that"

</comment><comment><USER5> These are famous last words. You can't predict any of this.

</comment><comment><USER27> What about AGPL?</comment>


Major Android Bug Is a Privacy Disaster (CVE-2014-6041) - mike-cardwell https://community.rapid7.com/community/metasploit/blog/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041 <comment><AUTHOR> If you haven't tried Firefox Fennec (android mobile) it is actually pretty good now.

[https://play.google.com/store/apps/details?id=org.mozilla.fi...](https://play.google.com/store/apps/details?id=org.mozilla.firefox)

[https://www.mozilla.org/en- US/firefox/partners/#android](https://www.mozilla.org/en- US/firefox/partners/#android)

They make it for arm and x86 android.

They used to make a windows version but sadly stopped that build.

<comment><USER2> Been using Firefox mobile for four months now, and forcefully removed both chrome and the vulnerable browser from my device about one month in. Slight battery drain issues, but those are almost all solved in recent releases. Definitely give it a try.

</comment></comment><comment><USER3> It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands.

Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very public security process and good industry comms and the devices are proven usable if not faster after recent updates (unlike iOS which starts to be terribly limiting performance-wise). Plus they're dirt cheap.

<comment><USER4> Yes, this continues to be a problem that I hope Google addresses somehow. I got the Samsung Galaxy _Nexus_ because I assumed it would be kept up to date with the latest Android version, since it's using the Google brand 'Nexus' name.

I even asked the sales representative if it would be kept up to date (knowing I couldn't trust them, but was looking for any extra assurance), and they said yes.

Right now it's at 4.3 and wont upgrade...

<comment><USER5> Just switch to CyanogenMod or other custom compilation; there is a gain from Nexus brand in the ease of unlocking bootloader (;

<comment><USER6> I'm not convinced CyanogenMod (or any other variant) is actually that great; I have a Samsung Galaxy S2 (i9100 model), the last non-nightly CyanogenMod update was over a year ago now. There have been a number of CVEs issued for Android (and likely numerous others cover Android as a platform, covering OpenSSL for example) over that time period, so there's no way the phone is anywhere near up-to-date with security fixes.

CyanogenMod doesn't have any way to distinguish which phones are currently receiving security fixes in a timely manner and which are not; nor do they have any list of security advisories covering packages they distribute (go look at any notable desktop/server Linux distro — they _all_ have public lists of security advisories and documentation of what release fixes them).

To my knowledge there is no Android distribution that has anywhere near the cohesive security story — and they're all miles behind any desktop OS.

<comment><USER7> CyanogenMod changed their release versioning. There are no more "stable" builds anymore, at all. You're supposed to run "monthly" or "milestone" or whatever they are called. Yes, I think they could have communicated this much better.

<comment><USER6> And anyone running the stable builds have therefore never been updated to an at all recent build… _sighs_

And looking at my phone, I have no idea how I'm meant to update to the milestone builds. The updater lets me select "stable" or "all (inc. nightly)", and nowhere do the milestone builds appear…

None of this is helping me believe there's really any decent security story. Abandon all users who don't check the website (or whatever) to find out about releases, trusting the built-in updater to provide updates. Never publish any security advisories that cover your distribution…

</comment></comment></comment></comment></comment></comment><comment><USER8> If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy.

If you would like to test on your device/browser, you can on ejj.io/SOP.php . If you click on the button and you see an alert box, you're vulnerable (I doubt many on HN will....)

Many other browser's also seem to be vulnerable. So if you use something else best be safe and check yourself

<comment><USER9> The alert did not appear on an Android 2.3 device (HTC Desire), or a 2.2 emulator (via BrowserStack.com) - not vulnerable, or not compatible with the exploit test?

<comment><USER10> I didn't test back this far; I should have, it's about 10% of android users. I tested back to 4.0 (not that 4.0-4.1.2 being vulnerable matters much, since you can get remote code execution easily through the addJavascriptInterface vulnerability). I tried out 2.1 in the emulator just now and got the same results as you, so it looks like 2.x is not affected by this.

</comment></comment></comment><comment><USER11> Replaced by Chrome ("that giant hog").

I'm on a slightly older phone, but I actually removed Chrome from it not long ago. I started having problems with updating apps due to insufficient space, and while I have a fair amount of crap installed, I also have ~2.5GB of "Phone" storage for apps so I started investigating (this is separate from "sdcard" data storage which is ~8GB). Turns out Chrome, at least on the HTC Amaze 4G with 4.0.3, takes up about 250MB - my largest installed app by about a factor of 4 (next largest was ~80MB). This was not cache or data, this was the app itself.

I don't know what all they've moved into there as part of their push to cripple Android except as a host for the "Google Play Ecosystem," but crap like this is not endearing.

<comment><USER12> I am running out of space because Play Store and Google Framework get bigger and bigger. It fills me with rage how Google actively makes my old phone less capable over time for no benefit to me.

<comment><USER13> Yeah. I was using a Nexus One for a long time until I had to prune so many apps due to space that it wasn't worth using. I got a new phone, HTC One S (I needed a t-mobile branded phone for wifi calling) with several gigs of system partition space, and now I have to play that game again.

I recognize that there are a bunch of features now that I get to enjoy, but now I have to choose which ones I want to keep.

When I switched, 20MB was a big app. Now I have at least 30 apps that are bigger. Chrome in particular seems bogus. The desktop version isn't even this big.

       Chrome : 211MB
       Facebook: 116MB
       Google search: 70MB
       Google+: 65MB
       Amazon: 60MB
       Mantano Reader: 54MB
       Dropbox: 50MB
       Google Play services: 50MB
       Google Text-to-speach engine: 45MB
       Hangouts: 35MB
       t-mobile my account: 33MB
       SwitftKey: 33MB
       Kindle: 30MB
       Evernote: 30MB
       BaconReader: 28MB
       twitter: 25MB
       Hulu: 25MB
       Google Maps: 24MB
       Google Drive: 24MB
        <...>

I do recognize that these apps balance the data differently. Chrome is 189MB app, and facebook is 80MB data.

<comment><USER14> I have the latest Chrome for Android and it's 65MB for the app. Still large, but nowhere near 190MB.

<comment><USER15> did you disable cache somehow?

open a bunch of ssl pages and see app data space explode. same happens with firefox

<comment><USER13> The cache doesn't seem relevant but I could test that. Presently my breakdown is 189MB+21MB , App+data, and 13MB Cache.

       Uninstalled.

       Reinstalled.  (play store reports 30MB download)

       Before opening the app  65MB+4KB, 0MB cache

       First launch (no sync sign-in) 65MB + 10MB, 60KB cache

       Browsed Noisy SSL page (google plus feed):  65MB + 14MB, 13MB cache

       Signed into sync: no change  ( 10min later, no change)

       Browsed image heavy site (imgur): 65MB + 14MB, 25MB cache

Does chrome store the old versions on upgrade? That would perfectly explain why my fresh install is 64MB, and my older isntall was 3x that size.

<comment><USER16> It does on the desktop: Omaha, a.k.a. Google Updater, follows a "keep a few recent versions around and just symlink the current one" model to enable atomic upgrades and rollbacks of failed upgrades. If Android Chrome manages its own updates, it's likely using Omaha for them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Just an update from the Google side: As discussed below, any Android users on 4.4+ or running Chrome are not affected. For earlier versions of Android, we've shipped patches for AOSP:

[https://android.googlesource.com/platform/external/webkit/+/...](https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87) [https://android.googlesource.com/platform/external/webkit/+/...](https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c)

These are in the AOSP branches for jb-dev, jb-mr1-dev, jb-mr1.1-dev, and jb- mr2-dev.

<comment><USER18> Does this mean that there will be an update for the Galaxy Nexus?

<comment><USER19> OS updates for $SPECIFIC_PHONE are generally reliant on the carrier to decide to push out a patch, even after AOSP itself is patched. So an answer "from the Google side" can't really answer your question.

<comment><USER18> The regular carrier-independent versions (Yakju/Maguro and Takju/Maguro) which are directly supported by Google.

</comment></comment></comment></comment><comment><USER20> Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): " _Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities_ " [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their Android license agreements with device makers. At least then, when these things are discovered and publicized, tens of millions of people won't be left vulnerable.

[1] [http://www.zdnet.com/android-fragmentation-turning- devices-i...](http://www.zdnet.com/android-fragmentation-turning-devices-into- a-toxic-hellstew-of-vulnerabilities-7000028342/)

<comment><USER21> Note that this isn't an "incredibly serious system level issue." This is an issue with a browser that Google hasn't supported for several years, since they replaced it with Chrome. It also doesn't affect alternative browsers like Firefox or Opera.

Note that if Apple had a similar vulnerability, you likely couldn't work around it by using an alternative browser, because all browsers are required to use Safari's rendering engine.

<comment><USER22> In addition to the Browser app that is still widely use in devices with less- than-latest Android versions, It's present in every app that uses WebView. And you only get fixes to WebView via OS updates. (x)

(x) Maybe. Assuming someone bothers to incorporate them into to the OS update for your device and they make it through the hurdles between the engineer and OTA update certification.

<comment><USER23> WebView uses Chrome as of 4.4 as well. Also many apps that use WebView show only their own content in it. There are only a couple apps that show user specified content in app via WebView, like Reddit and HN.

Even if I were to go back to the old Internet app instead of Chrome, this bug is irrelevant to me since I use an app for GMail, Twitter, Facebook and anything else important. I can't remember the last time I used the mobile browser for anything that matters.

<comment><USER22> It's still a copy of the browser code that comes with the base OS, even if it dodges the bullet on this bug. The Chromium-based WebView doesn't receive updates like the Chrome app so will generally contain unpatched vulnerabilities, so the system level issue remains.

(Note that the rare-to-nonexsistent OS updates are still a problem, this WebView issue nonwithstanding. They are running old vulnerable Linux kernels which compromises the app sandbox)

<comment><USER17> > The Chromium-based WebView doesn't receive updates like the Chrome app

We hope to see that change very soon. [http://thenextweb.com/google/2013/11/12/google-says- working-...](http://thenextweb.com/google/2013/11/12/google-says-working- automatically-updating-androids-chromium-based-webview-just-like-chrome/)

</comment></comment></comment></comment></comment></comment><comment><USER24> I am a big Linux fan and appreciate the openness and control that I can get with Android as opposed to Apple and Microsoft products, but...

My Android experience has been shit, and I'm really getting sick of it.

Admittedly, much or even most of the problem for me is the OEMs screwing things up and not sending out updates.

<comment><USER25> You're not the only one. I'm sorry, but the Android issue has devolved into a holy war but...

.. support is terrible on the Android side. Really terrible.

<comment><USER26> People need to stop buying terrible phones. Consumers keep rewarding companies who don't keep up with their promises and thus no one ends up giving a crap.

In my opinion if you're not going to buy a Nexus device or a Moto E/G/X then you might as well buy Apple. The Android One program will hopefully add more to that.

<comment><USER27> You can only know if it is a "terrible" phone until long after you have bought it.

Most people don't have the ability to make an informed decision about a phones purchase (or they want to buy an iPhone or Nexus but they simply can't afford it).

I bought a Google Nexus at USD650 _retail_ \- a perfect counterexample to your advice.

I recommend iPhones to those who can afford it (purchase price, insurance, screen replacements etc.).

I recommend Huawei Y310/320/330 for those who don't have much.

In between there are too many other factors to make a straight recommendation (e.g. buy second hand iPhone versus a Moto G).

<comment><USER28> My one year old Nexus 4 is on KitKat. I guess you're talking about the Galaxy Nexus. While I agree with you that they dropped the support a way too soon, being the reference phone you'll have no problems in updating it with CyanogenMod, which is a really good distribution btw.

But as a slight counterpoint, given the fast release cycle, you can't expect them to support a phone forever. You mentioned iPhones. Well I have an iPhone 3GS. It's a perfectly capable phone that still works and that was still sold as the low-price alternative after iPhone 4 happened, yet Apple stopped supporting it as well. But I can understand that, because these OSes get more bloated with stuff and it leads to a shitty experience. I was able to upgrade an older Galaxy S (first generation, shipped originally with 2.1) to 4.3 by means of CyanogenMod and it was unusable due to the less than capable hardware.

Google did drop the support too early for the Galaxy Nexus, but try out CyanogenMod. I'm even thinking of installing it on my Nexus 4 because the Android on this device is bloated with Google-stuff that I cannot uninstall and it pisses me off. It's also enlightening to install CyanogenMod without Google Play, for an all open-source experience ;-)

<comment><USER29> [http://www.androidheadlines.com/2014/09/galaxy-nexus-will- li...](http://www.androidheadlines.com/2014/09/galaxy-nexus-will-likely- cyanogenmod-support-android-l.html)

<comment><USER28> Ouch. The issue seems to be with " _the OMAP processor from Texas Instruments_ " that makes support difficult. Haven't seen that coming.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> As Firefox saved us from dangerous browsing circa 2004m from IE5,6,7, now I may save us from obsolete Android stock browsers. At least that's what I use.

<comment><USER31> Unfortunately a lot of apps embed the Android browser as well, and you can't change that.

</comment></comment><comment><USER32> Does anyone know if WebView is similarly susceptible?

<comment><USER10> I wish I had tested this sooner, but yes, Webview is vulnerable (use document.write(document.domain) instead of alert() to test). So afaict apps that embed webview/ads on < 4.4 are at risk.

<comment><USER33> How would this be exploited? Can you read the contents of a webview in another process? Your users would have to navigate somehow to an exploited page (via an ad)?

</comment></comment></comment><comment><USER34> >While the AOSP has "been killed off" by Google, it...

I do not follow android closely, but this refers to the browser only, right?

<comment><USER35> The author is also slightly mistaken on that. The AOSP browser is just a UI shell for WebView, and WebView has absolutely not been killed off. The WebView in KitKat sits on top of Chromium, for example, so installing an AOSP browser on KitKat will likely not have this vulnerability.

<comment><USER22> But it will still have vulnerabilities that have been fixed in current Chromium.

(In the Chromium WebView FAQ they say they're working on fixing it, but there are major difficulties. [https://developer.chrome.com/multidevice/webview/overview](https://developer.chrome.com/multidevice/webview/overview))

</comment></comment></comment><comment><USER36> It was a mistake to put Webkit as an operating system level component in the first place. It would be better if the solution wasn't to push Chromium but a storage framework style pluggable component, mainly since they can't get stuff like text sizing right.

Luckily since most vital user info is going to be in apps this doesn't have nearly the same impact as it would on desktop, but it does represent yet another demonstration that having the web as a sort of super-platform-on-a- platform doubles your attack surface.

Android really is comparable to 90s era Windows, in every possible sense. For better or worse Chrome OS is clearly being positioned as the NT equivalent as well, but it's hard to see how you can recreate the functionality of Android without adopting the flaws too.

</comment><comment><USER37> So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

<comment><USER38> "a browser that isn't supported by Google"

But still a browser that was _created_ by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android <=4.3 accounts for 75% of Android users:

[https://developer.android.com/about/dashboards/index.html?ut...](https://developer.android.com/about/dashboards/index.html?utm_source=ausdroid.net)

Just because Google decided not to support it any more doesn't mean they _shouldn 't_. Pointing out Firefox and Opera is all very well, but this is the default browser on Android <=4.3, and very few users explore alternative browsers (Chrome being the exception, to a point).

It's also the browser engine used in embedded webviews, don't forget.

<comment><USER37> Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.

<comment><USER39> Who, engineers? Certainly not my wife or anyone else I have ever met who isn't technical.

<comment><USER37> My grandmother managed to switch entirely to Chrome on her PC without the help of anyone in our family. Anecdotal evidence works both ways. It isn't 1998. Most people know what a browser is and which one they are using on their desktop. Making the leap to a second browser on a phone (where they can easily get it from Google Play) isn't that ridiculous.

<comment><USER40> Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.

<comment><USER41> Example? I worked quite hard to get my grandma to install Chrome.

<comment><USER39> >Bundled by default in many installers, including Flash, installs with user permissions only

Not saying I agree with the Malware comment, though the bundling is annoying.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER42> Is anyone familiar with the code that allows this vulnerability to be present and where I can find it(I believe this project is open source)? I understand the exploit is adding a nullbyte at the beginning of some javascript due to some bad handling in the parsing code. So I'm looking here: [https://android.googlesource.com/platform/packages/apps/Brow...](https://android.googlesource.com/platform/packages/apps/Browser/+/master/src/com/android/browser)

<comment><USER10> I don't know the exact location, but it is probably somewhere in the webview tree, since it affects apps that embed webviews as well:

[https://android.googlesource.com/platform/frameworks/base/+/...](https://android.googlesource.com/platform/frameworks/base/+/jb- release/core/java/android/webkit/)

<comment><USER43> Since it's both webview and browser itself, I'd suspect some kind of common denominator object at fault... like...[https://android.googlesource.com/platform/frameworks/base/+/...](https://android.googlesource.com/platform/frameworks/base/+/jb- release/core/java/android/net/UrlQuerySanitizer.java)

Especially with a method called _" public static class IllegalCharacterValueSanitizer"_.

</comment></comment></comment><comment><USER44> The general lack of updates is exactly why I use/install/recommend Firefox. That and the automatic syncing w/ Desktop and the regular performance improvements. (Chrome isn't an option. I can't even turn off third-party cookies. In 2014.)

Too bad it uses quite a few resources and may be too heavy for low-end phones.

</comment><comment><USER45> This is nuts. On a sidenote, any suggestions for an equivalently fast, secure browser for Android 4.2 on a relatively old phone? Not gonna use AOSP anymore!

<comment><USER46> You can try Opera Mobile Classic, it's important to use classic version since the new Opera Mobile uses the same engine as chrome so it might have the same vulnerabilities.

<comment><USER47> AOSP != Chrome, right? ...

<comment><USER48> Correct. Chrome is a separate project from the AOSP.

That said, Android 4.4 and later use Chromium for their WebViews, the source for which is developed along with Chrome as a part of the Chromium project - it does not live in AOSP.

Presumably the stock browser that _is_ in AOSP 4.4+ wraps Chromium, which more or less means the AOSP browser _is_ Chrome...but not the other way around. :)

</comment></comment></comment></comment><comment><USER49> This leaves us with little alternatives. Tint is affected. Dolphin is affected. Firefox is just horrible on mobile, come see this page and you'll understand why (they can't get font inflation right). Chrome and Opera are what's left. Anything else?

<comment><USER50> I'm using Firefox on Android 4.4 as my full-time browser, it is rather good most of the time. TBH HN is the only site I can think of that gives me trouble... and knowing the authors' attitude to HTML I'm prepared to accept the fault is not Firefox's.

<comment><USER49> There are many font inflation bugs open on Firefox mobile. One of them was opened about HN [https://bugzilla.mozilla.org/show_bug.cgi?id=707195](https://bugzilla.mozilla.org/show_bug.cgi?id=707195) in 2011. Others are about reddit. Others are about other sites. Firefox didn't grok a way to handle font inflation in a reasonable way. All the other browsers did. I quote a Firefox developer:

\</comment></comment></comment><comment> From a UX perspective, we should really try to fix this somehow. Reddit and ycombinator look terrible in our browser right now. Some examples:

ycombinator [http://cl.ly/0l2f2v0p3v0e290J0A0W](http://cl.ly/0l2f2v0p3v0e290J0A0W)

Reddit [http://cl.ly/1M452m2a2D3D04070S1I](http://cl.ly/1M452m2a2D3D04070S1I)

These pages look perfectly fine in stock Browser -- they are a little wonky in Chrome but still better than us \</comment><comment>

[https://bugzilla.mozilla.org/show_bug.cgi?id=707195#c27](https://bugzilla.mozilla.org/show_bug.cgi?id=707195#c27)

That was 2012-05-01.

<comment><USER50> 1) reddit renders fine for me now, zoom is consistent (Firefox 32, Android 4.4)

2) HN uses HTML straight out of 90s (tables nested three deep, spacer images to indent threads) so I don't mind them not focusing on trying to salvage it. Also from the comments thread: "to fix this we'd want to know the widths of the containers of all the text, which requires doing layout on the whole subtree (or at least a decent part of it), but we need to know the inflation numbers before we do layout. (It's probably doable by constructing reflow states for the entire subtree as we walk it, but that would be a significant performance hit that I don't think we want to take.)" Don't abuse tables and you won't have a problem.

</comment></comment><comment><USER51> Use Chrome.

<comment><USER52> Use Firefox.

Why? Chrome isn't open source, if you care about that kind of thing. And personal preference also.

<comment><USER53> [https://code.google.com/p/chromium/wiki/AndroidBuildInstruct...](https://code.google.com/p/chromium/wiki/AndroidBuildInstructions)

<comment><USER54> That's not chrome.

<comment><USER55> It is very very close: [https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo...](https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome)

tl;dr: Chromium is Chrome minus:

1\. Crash/usage reporting to Google.

2\. Proprietary video format support

3\. Embedded Flash implementation (which doesn't exist on mobile anyway).

4\. Google API keys.

If what you care about is security auditability, that's pretty good. If you care about running only open source software, that's going to be very hard to do in the Android/Google-Play ecosystem.

<comment><USER15> > If you care about running only open source software, that's going to be very > hard to do in the Android/Google-Play ecosystem.

yet, the main advertisement google trhows for android is "open source" "community driven" yadda yadda

<comment><USER55> Main advertisement? I just went to android.com and developer.android.com; android.com advertises "Google built in" and lots of platforms, with a very small link to AOSP at the bottom of the page; developer.android.com has an AOSP link buried in its menus.

<comment><USER15> oh sorry. advertised.

we have already been baited and switched. but marketing takes a long time to dissipate...

here, i just clicked 2010 and clicked a random day for android.com

[http://web.archive.org/web/20100112200506/http://www.android...](http://web.archive.org/web/20100112200506/http://www.android.com/)

the 1st block is about the nexus one (market as open, but not on this page) and look! the second item on the page reads "Access to the entire platform source and information on how to contribute."

guess they forgot an asterix there saying that the "entire platform" means some of the platform.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER56> If only Meego took off.</comment>


Cycle.js: A fully reactive JavaScript framework for Human-Computer Interaction - <AUTHOR> http://cycle.js.org/

<comment><USER2> I really like the idea behind Cycle.js, but I don't think it does a very good job explaining itself. The idea as I understand it is not very complicated, but the language is rather esoteric.

The main benefits of Cycle.js in my eyes are:

1\. Emphasis on a single entry point for event handling instead of a million separate event handlers. This is similar to the idea of the "Dispatcher" in Flux -- it's a central handler that manages all user input. But the Flux dispatcher has a specific purpose, whereas the main Cycle handler is more generic (which is, in my opinion, preferable).

2\. Use of reactive programming, which is an extremely powerful paradigm in asynchronous environments like the browser. It takes a while to wrap your head around reactive programming but once you do it's absolutely fantastic. The only concern I would have here is that Rx.js adds overhead that might be unnecessary in some cases. But then I guess you would just use a more lightweight framework., so it's not exactly a criticism of Cycle.

<comment><USER3> Agree that those two benefits alone are super, may I also add:

3\. The MVI framework, it's a great way to structure apps, much beyond the lifecycle methods React throws at ya.

4\. The driver architecture, which shows forward thinking. It's ready to render to DOM or any other target or sink with any backend.

It's also the right way to think about engineering. Not just with the component mindset but more importantly, with Human-Computer Interaction being the main driver, which reveals the flow and structure of an app if you follow it through.

</comment></comment><comment><USER4> I've been working on a similar project, though it's not nearly as complete as Cycle: [https://github.com/jasonhansel/flumen](https://github.com/jasonhansel/flumen)</comment>


What YouTube Stars Are Going to Do Now That They Can't Swear and Get Paid - <AUTHOR> http://motherboard.vice.com/read/what-youtube-stars-are-going-to-do-now-that-they-cant-swear-and-get-paid <comment><USER2> Suprised the 'or they could just go to other platforms' is buried at the very end of the article. To me this seems like an obvious solution.

For influencers that are truly influential enough to attract their own fanbase, the exact site that hosts their videos is irrelevant. Their presence spans more than one social network and is driven by name recognition, not by their exact youtube channel URL.</comment>


The Haunting Beauty of Germany's WWII Bomb Craters - <AUTHOR> https://www.citylab.com/design/2014/07/the-haunting-beauty-of-germanys-wwii-bomb-craters/373891/ <comment><USER2> Interesting to me was wondering if the creation of so many distributed small standing water pools altered local ecology enough to be detectable for e.g. frogs, newts, water voles and Birdlife in general. This part of Europe isn't often in drought so probably lack of standing water isn't an issue.

Lovely photos too.

</comment><comment><USER3> When I was in the US Army (1968-1971), I was stationed for a while at an Army airfield just outside a small town in Germany named Langendiebach. The post was surrounded by forest, but what an odd forest. All of the trees grew in straight rows, and among the trees, there were hundreds of bomb craters.</comment>


Exxon Mobil dropped from the Dow after 92 years, replaced by a software stock - <AUTHOR> https://www.chron.com/news/houston-texas/article/Exxon-Mobil-dropped-from-the-Dow-after-92-years-15512970.php <comment><USER2> The Dow Jones Industrial Average is swapping Exxon Mobil for Salesforce.com. Time to rename the index IMO, that seems farcical.

<comment><USER3> The big news is that Honeywell was added. I thought they had drifted away in the '90's. Guess not.</comment></comment>


Tunnel collapses at Washington nuclear waste plant - <AUTHOR> http://www.reuters.com/article/us-washington-nuclear-idUSKBN18524M <comment><AUTHOR> All good for now, top left nuclear site on the map:

[http://radiationnetwork.com/](http://radiationnetwork.com/)

EPA: [https://www.epa.gov/radnet/radnet-air-data-richland- wa](https://www.epa.gov/radnet/radnet-air-data-richland-wa)</comment>


The Physics of Spilled Coffee - <AUTHOR> http://news.sciencemag.org/sciencenow/2012/05/the-physics-of-spilled-coffee.html

<comment><USER2> Realizing that positive feedback in the coffee/mug system led to the sloshing and spilling, the advice I've always kept in mind:

"Walk without rythm, and you won't disturb the worm."

<comment><USER3> Feel free to do the experiment, but attempting to walk without rhythm would, I imagine, lead to sudden jolts that would spill your coffee. Maybe if you were a carefully trained fremen and/or Christopher Walken.

<comment><USER2> The idea is to make a small change in pace, or stutter a step, every few steps. The big sloshing motions that end up spilling your coffee happen when you've taken many steps that re-inforce the sloshing motion, and a mis-timed step here and there counter that loop.

</comment></comment></comment><comment><USER4> My friend was a waiter and told me the trick they used to keep from spilling the glasses they carried out was to waver the tray a bit to the left and right in a steady rhythm as they walked, which according to this probably disrupts the natural oscillation of the liquids and creates a new, more stable pattern.

</comment><comment><USER5> The results of this seem underwhelming.

Personally, oscillating the mug up and down in sync with my stride does a pretty good job mitigating left-right waves, but executing it well takes practice.

<comment><USER3> _The results of this seem underwhelming_

It should be subtitled: how to turn an afternoon's work into a paper in one of the lesser Physical Review journals plus fifteen minutes of internet fame (at current exchange rates equivalent to 300 nanoseconds of actual fame).

</comment></comment><comment><USER6> _the researchers' "take home" advice is to look at what you're doing—so long as your mug isn't filled too high, a watched mug almost guarantees a clean run_

This is the opposite of my experience, when I focus on the mug it seems harder to control the sloshing than if I just look at where I'm going and don't really pay attention to the mug.

</comment><comment><USER7> Related: the physics of coffee stain rings [http://news.discovery.com/tech/coffee-stain-science- smartens...](http://news.discovery.com/tech/coffee-stain-science-smartens- inks-110818.html)

</comment><comment><USER8> As you walk don't hold the cup rigidly (making it move as you move) - let your hand bounce around, decouple the movement of the cup from the motion of your body.

</comment><comment><USER9> like a boxer: roll with the punches and keep your hands relaxed :)

Hold it tight, keep your arm stiff...and get ready to clean</comment>


Announcing Ernie 2.0 and 2.1 (GitHub's Erlang RPC Server) - <AUTHOR> http://github.com/blog/606-announcing-ernie-2-0-and-2-1 <comment><USER2> I've been using this in production for the past few months and and it's been solid.

(If you're working in Python, you can use <http://github.com/krobertson/python-ernie> with the Erlang server. Note that it's not as fast as running a Ruby handler because the BERT serialization is not done natively.)</comment>


Fast and precise type checking for JavaScript - <AUTHOR> https://blog.acolyer.org/2017/11/08/fast-and-precise-type-checking-for-javascript/ <comment><USER2> I used both Flow and TypeScript extensively at my last job (coda.io), and through a series of thoughtful discussions and debates, we chose to migrate to TypeScript, even though we had already started using Flow in parts of our codebase.

Microsoft did a really good job putting resources behind TypeScript, making sure tooling and IDE integrations are good, and generally getting a ton of momentum going. TypeScript is fast-moving, with bugs fixed and features added at a high rate, and the quality of discussion on the issue tracker is high. Flow, in comparison, was not evolving as fast.

Flow touts global inference, which I think means better types when you don't necessarily have annotations on module boundaries, but I mostly care about what's possible in a greenfield or well-annotated codebase.

Flow deserves a ton of credit, and Microsoft probably studied it in detail, but I think the advantages are overblown at this point. Take the soundness thing. TypeScript added null-strictness a while ago, and recently they improved function type polymorphism. The reality is that both type systems have limits and you sometimes need to type something imperfectly or use an escape valve ("any"). In most cases, however, TypeScript gives you more sophisticated tools to construct the types you want, so you actually get better types. Maybe TypeScript lacks a theoretical underpinning for soundness, but there's no reason it can't continue to get "more and more sound," with it harder and harder to find good examples of unsoundness.

<comment><USER3> Flow/Typescript both of great but writing from start from scratch both flow and typescript slow me down with all the hassle of needing to define the types of parameters and data structures. Typescript being a bit verbose at time too.

When working with another person API then typescript does become a godsend in helping understand what the bloody hell does this callback parameter are required.

<comment><USER4> >When working with another person API then typescript does become a godsend in helping understand what the bloody hell does this callback parameter are required.

Plot twist: While you are cursing at the person who wrote that API, you slowly realize that it was you all along.

<comment><USER3> Agree, typescript does help with that slow realization that its a problem with your code passing in undefined instead of a object.

</comment></comment></comment></comment><comment><USER5> Flow capitalizes on its soundness, but its not as useful when the error messages are so cryptic. We tried adopting Flow at a company I worked at, but dealing with gibberish errors and the huge meaningless stack traces was a productivity sink.

We migrated to Typescript. Error messages are more understandable and unlike flow include line numbers and the column. Add huge number of typings, and ts definitely wins.

There are many gripes we've had with typescript too, but at least we didn't spend hours trying to understand error messages.

<comment><USER6> What is soundness, exactly, and how is Typescript unsound?

It seems like a useless academic term that doesn't work so well in the real world, maybe?

<comment><USER7> Soundness means that if the type system says that a variable has a particular type, then it definitely has that type at runtime. A sound type system is always correct, and an unsound type system might be incorrect in some cases.

Here's an example of unsoundness in TypeScript:

[https://www.typescriptlang.org/play/index.html#src=function%...](https://www.typescriptlang.org/play/index.html#src=function%20messUpTheArray\(arr%3A%20Array%3Cstring%20%7C%20number%3E\)%3A%20void%20%7B%0D%0A%20%20%20%20arr.push\(3\)%3B%0D%0A%7D%0D%0A%0D%0Aconst%20strings%3A%20Array%3Cstring%3E%20%3D%20%5B'foo'%2C%20'bar'%5D%3B%0D%0AmessUpTheArray\(strings\)%3B%0D%0A%0D%0Aconst%20s%3A%20string%20%3D%20strings%5B2%5D%3B%0D%0Aconsole.log\(s.toLowerCase\(\)\)%0D%0A)

TypeScript incorrectly (but conveniently) says that Array<string> can be assigned to Array<string | number>, and you can exploit that to create an "s" variable that TypeScript thinks is a string but is actually a number.

You can try the same code in Flow and it gives a type error:

[https://flow.org/try/#0GYVwdgxgLglg9mABAWwKYGd0FUAOAVAC1QEEA...](https://flow.org/try/#0GYVwdgxgLglg9mABAWwKYGd0FUAOAVAC1QEEAnUgQwE8AKC8gLkTMqoB50pSYwBzRAD6IwIZACNUpAHwBKJgDc4MACaIA3gChE2xPVIA6HCHQEaAZhkBuDQF8NGiAk6JO3PuiYtqHLj15TEAF5EAG0AcmA4ODCAGkQwsXowgF1rNExcQhJyahpXP3Qre0cwZw8XXz4girdedBCAJlSHJzgAG1R9NrhePP0oOAAZOAB3SQBhCnRUGhkZDSA)

<comment><USER8> So Flow seem to be complaining that _number_ and _string_ are incompatible types for the array elements. I attempted to change your _arr.push(3)_ statement to one that is appending a string, and it gave the same error even though it should not have given an error in that case.

Neither Flow nor TypeScript are correct in this instance. Neither keep track of the actual array element's value, just the general type of the array, which means they actually don't know for sure and do their best guess. So in the Flow example, it complains that the number and string types are incompatible even though it doesn't know that this specific case is incompatible, just the general case. In the TypeScript example, it should keep track of the type of the argument value supplied during the function invocation, not the type for the argument declaration.

In this case I would argue that even though TypeScript is incorrect, it's preferable to Flow because Flow doesn't infer that the types are incompatible from actual usage but theoretical.

<comment><USER7> The issue with changing `arr.push(3)` to `arr.push('baz')` is that there's still a type annotation on the function saying `Array<string | number>`. If you get rid of the type annotation or change it to `Array<string>`, flow is ok with it:

[https://flow.org/try/#0GYVwdgxgLglg9mABAWwKYGd0FUAOAVAC1QEEA...](https://flow.org/try/#0GYVwdgxgLglg9mABAWwKYGd0FUAOAVAC1QEEAnUgQwE8AKC8gLkTMqoB50pSYwBzAPgCUTAG5wYAE0QBvAFCIFieqQB0OEOgI0A5ACMKAL22CA3LIC+s2RASdEnbn3RMW1Dlx4DEAXkQBtbWA4OG0AGkQ9em0AXTM0TFxCEnJqGgdPdFMrGzA7Z3sPPh8Cx150PwAmWOtbOAAbVBU6uF40lSg4ABk4AHdUUgBhCnRUGkFBWSA)

Both Flow and TypeScript have good type inference (with Flow's generally being better, I think) and do pretty well with all type annotations removed, but that wasn't shown in my example because I explicitly annotated all types.

Note that if you do want/need to give an explicit type annotation for this sort of thing, Flow provides `$ReadOnlyArray`, where `Array<string>` is assignable to `$ReadOnlyArray<string | number>`:

[https://flow.org/try/#0GYVwdgxgLglg9mABAWwKYGd0FUAOAVAC1QEEA...](https://flow.org/try/#0GYVwdgxgLglg9mABAWwKYGd0FUAOAVAC1QEEAnUgQwE8AKC8gLkQBIAlVCgEwHkwAbKmUpUAPOiikYYAOaIAPojAhkAI1SkAfAEomANzgxOiAN4AoRBcQQE6OH1QA6PnGl1yAbQAMAXS0BuUwBfU1NrMHFEcUkZdCYhajEJKWkNRABeRHcAcmA4OCyAGkQslXos7wC0TFxCEnJqGijk9H8QsIjYyKSZdK7o6XR3ACYK0Js7R2dXdAcoOAAZOAB3dQBhCnRUGi0tUyA)

It sounds like you're arguing that TypeScript is wrong because it's overly- permissive, and Flow is wrong because it's overly-strict, which makes sense. That's probably why people prefer to use the word "sound" to describe Flow rather than "correct". Every sound type system has cases where you can write perfectly correct code that would be rejected by the type system (which is provable because of the halting problem). Opting into a type system always means that you limit the type of code you can write in exchange for better automatic verification.

<comment><USER8> An issue with $ReadOnlyArray is that if you're doing something that does work on both String and Number types, like using them for some template string, Flow will complain that the types are not compatible even though in this instance they are. This is a bigger issue with both TypeScript and Flow, in that they don't seem to keep enough track of the data in arrays, only the type of the array, to know if the actual types are valid. If TypeScript/Flow kept track of the array elements and their usage, this issue wouldn't occur in the same way.

</comment></comment></comment></comment></comment></comment><comment><USER9> I'd be much more enthusiastic about using a type system if it was a part of an official ES-next spec. Right now community efforts around static typing are divided between two very similar, but incompatible type systems, similar to the situation we had a few years ago with CommonJS and AMD modules (though the two module systems are much more dissimmilar than Flow and TypeScript). The module debate has been been mostly laid to rest with the introduction of the official ES modules spec (at least from the perspective of the application developer when it comes to module code they actually write), and I'm hoping an official type annotation spec can do the same for the JS static type checking landscape.

Flow has already long-since demonstrated that it's perfectly possible to introduce useful type annotations to JS code without changing any runtime behavior whatsoever, and Flow and TypeScript have mostly converged on similar syntax and semantics when it comes to the type annotations. Given all this, I'd have thought that the standardization process would be pretty far along by now. Maybe someone more familiar with these matters can offer some insight on the seeming lack of progress?

<comment><USER10> It feels a little bit like if you'd want a linter to be part of an ES spec. As in: I appreciate TypeScript for the compile-time guarantees it gives me.

<comment><USER11> A good comparison here is the Python approach: Python 3 made the syntax for type annotations a first-class part of the language but only to the point of parsing that syntax and providing an AST, it did not (and at least for now will not) define "compile time" or "run time" meanings for them.

The immediate benefit to adding Typescript/Flow-like annotations to the ES spec would be that you could run Typescript files unchanged (without transpilation) in the browser, even if the Browser didn't do any type checks for you. You could still use TS or Flow to do the type checks in a separate process, but you could potentially drop the type-stripping steps in TS or Babel. The possibility exists that eventually the browser could also start to enforce basic type checks, but the immediate benefit of slightly faster build processes with no type-stripping step shouldn't be overlooked.

<comment><USER10> That makes sense. I can also imagine not wanting to start too quickly with that though, to learn what such a syntax would have to support from Flow and TypeScript.

</comment></comment></comment></comment><comment><USER12> I thought this was a new thing, but it turns out it's facebook's flow. [https://flow.org](https://flow.org)

<comment><USER13> Yes, it would be good to add that to the title

</comment></comment><comment><USER14> Both flow and typescript are great tools. Typescript has much better tooling and great IDE integration, using typescript is a no-brainer for new projects. Flow's soundness does shine though once your codebase (and your team) becomes very big, as any unsafe cast can be reliably treated as error. I use flow at work, and so far my experience is that unsafe cast in flow always indicates a bad design or actual bug.

</comment><comment><USER15> I've always wondered if you could let the engine do the type checking or create type definition files for you, maybe an optional v8 flag?

This would be best case scenario so we could get rid of the tedious work that one has to put in to make an older library have type checking.

<comment><USER11> Typescript has inference for "plain" JS files if you use the `--allowJS` flag.

That inference is also made available more directly in dts-gen [1], which is a tool built around Typescript inferencing that produces decent first pass type definition files for a library.

dts-gen may be something to try the next time you need a definition file. (Personally, I still prefer to start a new definition file by hand, but it's good to have an automated option, even if only to double-check your work.)

[1] [https://github.com/Microsoft/dts-gen](https://github.com/Microsoft/dts- gen)

</comment></comment><comment><USER16> I think the-morning-paper is one of the best things on the internet. It's probably the thing I miss a proper blog reader for most.</comment>


Crowding out OpenBSD - iso-8859-1 https://lwn.net/Articles/524606/

<comment><AUTHOR> I had to chuckle when I read this (near the end):

"That, needless to say, is a recipe for irrelevance and, eventually, disappearance."

In the last eight+ years I've used OpenBSD extensively as the networking and firewall core for smart grid networks. I can, with confidence, say that 100% of the smart grid transactions on at least two $Billion+ utilities on at least two continents flow through OpenBSD servers.

We evaluated the full gamut of Cisco, Fortinet, and other Firewall technologies, but, from 2004 through 2010, only OpenBSD had the functionality and failover that we were looking for for < $100K/appliance. (And, when you want two for redundancy, plus another two for your DR center - Four appliances add up). It almost pained me to see how low-end a server could handle hundreds of thousands of IPv6 UDP states compared to what Cisco would have charged. (Note - and, regardless, Cisco didn't, until recently, handle IPv6 in fault- tolerant Active-Hot-Standby mode on their ASA platform)

For those that have a lot of experience with OpenBSD - the continued rock solid stability, almost 100% complete (and useful) _systems_ documentation (as opposed to the utility and library documentation you get on a linux system), consistent startup/configuration for 10+ years, plus, of course, very mature pf, makes the platform a continuing _highly relevant_ product, that will not disappear for many years to come.

<comment><USER2> The problem seems to be the desktop software...

<comment><AUTHOR> I've been involved in north of 50-60 servers running OpenBSD since 2001, and I've never seen, nor even heard, of anybody running OpenBSD on the desktop. It's never been relevant on that platform and serves no useful function as a Desktop Environment beyond the core developer and OpenBSD Hobbyist community. Not to suggest that they aren't an important community - but they are fully capable of taking care of their own needs. The rest of the world uses OpenBSD as a firewall/routing/networking/reliable-appliance platform.

<comment><USER3> Certainly it is used on the desktop outside of the developer/hobbyist community. See [http://www.undeadly.org/cgi?action=article&sid=201104200...](http://www.undeadly.org/cgi?action=article&sid=20110420080633)

<comment><AUTHOR> If you read the article, you'll see they aren't deploying OpenBSD to their users as a general desktop, but as an Appliance Environment - which makes total sense. Call Centers, Transaction Centers, NOCs, etc... - Anywhere you have a pre-set configuration/applications, OpenBSD is a great choice. Rock Solid stability and super secure. This is also an area where ChromeBooks will do well.

By "Desktop" - though, I mean users who are planning on downloading/installing various productivity utilities, applications, etc... to do their job. Creating Reports, Slide Decks, PDFs, Spreadsheets, charts, diagrams, IM apps, Skype - whatever random app they want to use to do their Job.

I've never seen an OpenBSD user in 20+ years of supporting Desktops in Engineering and Corporate environments - Windows obviously, but lots of Macintosh OS, A nice run of NextOS, Lots of FreeBSD, umpteen distros of Linux (for a while, that's all people seemed to be running), many versions of Solaris, tons of Irix, a handful of HPUX users, and even a couple AIX users.

But, in that same time - I've seen OpenBSD squirreled away in all sorts of Appliance/Network/Firewall duties.

<comment><USER4> ``By "Desktop" - though, I mean users who are planning on downloading/installing various productivity utilities, applications, etc... to do their job.''

I think the average user could be satisfied with what's available on OpenBSD. The only bummer is flash.

``Creating Reports, Slide Decks, PDFs, Spreadsheets, charts, diagrams[...]''

LibreOffice is available on OpenBSD.

``IM apps''

Pidgin and a ton of other clients are available.

``Skype''

It used to work a few releases ago, I don't know if it still does now.

`` - whatever random app they want to use to do their Job.''

Yes, if you compare it to Windows in that regard then it's at a loss. But if you compare it to Liunx I'd say it's up to par.

The problem is that it's getting harder to keep up to date, which is what Marc is trying to explain in his email to tech@.

</comment></comment></comment></comment></comment></comment><comment><USER5> > One could easily poke holes in this complaint; the characterization of PAM > as "modern" is somewhat amusing; it is 1990s technology. There is an evident > case of cognitive dissonance shown in the simultaneous desire for the > comfortable "Posix and Unix" world of decades past and the ability to > "innovate and do cool things." It is difficult to simultaneously innovate > and stand still, but that is what Marc seems to be asking for here.

There's a bit of nitpicking in the above. PAM may not be a new technology, but it's not used by every OS. The problem is the implicit assumption by many devs that it _is_ being used. Multiply this by every choice that the Linux kernel and various distros have made differently than other Unix-like OSs and you end up with a ton of open source software that is effectively locked into Linux.

In my (limited) open source experience, most devs using Linux do NOT do this on purpose. They just assume that they're writing UNIX software when they are not. They end up using GNUisms, #defines only available in Linux, assume PAM and other things, ad nauseam. When I've pointed such things out, I usually get a bewildered look. Many Linux people think they're using vi when they're using vim. They don't understand that their sed scripts are really gsed and won't work on traditional sed. They don't know their sh scripts are really bash scripts and break on traditional /bin/sh. And C code is a similar story. In most cases these little things do not improve the code; they only introduce incompatibility. So when Espie uses scare quotes on "progress" and "modern" I get his point. When _progress_ and _modern_ mean an equivalent but incompatible system, then they deserve scare quotes.

</comment><comment><USER6> I love BSD, but the user community is hostile to entry and hostile to causal users, so it's not surprising that everyone but the experts has switched to Linux.

<comment><USER7> Given there are at least four large and distinct BSD communities, I am inclined to assume this is a rather unsubstantiated and cheap shot at "BSD".

</comment></comment><comment><USER8> Previously discussed here:

<http://news.ycombinator.com/item?id=4798791>

The previous discussion is more informative.

</comment><comment><USER9> Why did the author, Jonathan Corbet, and HN submitter, "iso-8859-1", decide to revive the slashdot troll meme of "BSD is Dying" here on HN which is running FreeBSD?

<comment><USER10> I'm not sure about "troll meme", but it is news and hackers are involved. This forum seems appropriate.

<comment><USER8> It _was_ news: <http://news.ycombinator.com/item?id=4798791>

</comment></comment></comment><comment><USER11> New song and artwork every release

I doubt those two are used to gain market share ... maybe openbsd is just pure fun

<comment> iso-8859-1 All major distributions get new artwork every release AFAIK. I hope you are teasing. The artwork took a fraction of the time to make.

</comment></comment><comment><USER12> This is in some sense a good counterpoint to the recent comparisons of WebKit monoculture to Linux monoculture: everyone working together on Linux is nice, but it has downsides, too, because things do become unduly Linux-specific to the detriment of competition.

</comment><comment><USER13> This is exactly why I stopped using linux. It seems that in their attempt to compete with windows, linux has forgotten about trying to be a decent unix OS. A modern linux distro is every bit as complex, disorganized, undocumented and buggy as windows. So now linux distros feel to me like the worst of both worlds, a bad unix platform, and a bad desktop experience. I end up running windows 7 for a desktop, with an openbsd virtual machine for my unix/dev environment, and get the best of both worlds.

<comment><USER14> If you think that the OpenBSD has it right, why don't you use it as a desktop, too? Why aren't you running a virtual machine of Windows 7 under OpenBSD? Probably because there's no proper virtualization support in OpenBSD.

Linux is complex because sometimes it has too be, not just for the sake of it. systemd (which is great in my opinion) wouldn't be possible without cgroups. Should I also mention the better multi-processor support? Regarding the desktop, I strongly recommend watching "27c3 - Desktop on the Linux... (and BSD, of course) - Wolfgang Draxinger (+ Lennart Poettering)" [1].

[1] <http://www.youtube.com/watch?v=ZTdUmlGxVo0>

<comment><USER13> >If you think that the OpenBSD has it right, why don't you use it as a desktop, too?

Because I need to run windows applications.

>Why aren't you running a virtual machine of Windows 7 under OpenBSD?

Because my laptop already had windows 7 on it, why install two OSes when I can install one?

>Linux is complex because sometimes it has too be

No, using complexity to justify further complexity does not mean it has to be that way.

>Should I also mention the better multi-processor support?

That has nothing to do with simplicity though. NetBSD is also simple, and it has SMP support as good as linux does. I am just using openbsd because fine grained locking is un-noticable for a dev box, and openbsd comes with better package management than netbsd.

>Regarding the desktop, I strongly recommend watching "27c3 - Desktop on the Linux...

I'm not very far through, but I have no idea why you think I should be watching this? Is there a particular time I can jump to where something relevant happens?

<comment><USER14> I'm not familiar enough with NetBSD, but David Miller from Red Hat said "I love NetBSD releases, because their new feature lists help remind me what I implemented a decade ago." [1]. I've also found a benchmark done by the DrangFlyBSD guys[2]:

 _The tests were performed using system defaults on each platform with pgbench as the test client with a scaling factor of 800. The test system in question was a dual-socket Intel Xeon X5650 with 24GB RAM._

 _NetBSD 6.0 was unable to complete the benchmark run._

That video shows that things aren't as simple as one might think, at least on the desktop.

[1] [https://plus.google.com/101384639386588513837/posts/ZD5ZhZ2F...](https://plus.google.com/101384639386588513837/posts/ZD5ZhZ2FJLk)

[2] <http://www.dragonflybsd.org/performance/>

<comment><USER13> David Miller is better known for spewing crap than he is for writing code, with good reason. When you feel the need to stir up shit by posting stuff like "durr netbsd is doing stuff I did a decade ago" while ignoring the fact that netbsd also did it a decade ago and is just updating their implementation (just like linux does), you stop being someone worth listening to.

It is pretty unfortunate that the dragonflybsd camp still insist on pushing deliberately misleading benchmarks, I must admit. They have a great OS and there is simply no need for them to be doing that shit. Refusing to adjust the default limits when you know full well netbsd and openbsd ship with conservative limits to prevent accidentally DoSing yourself on low end hardware is just plain stupid. "Oh look, netbsd mysteriously stops working right when we hit the default resource limits!"

<comment><USER14> Nevertheless thread-local storage (TLS) and Logical Volume Manager (LVM) functionality have been available under Linux (and probably other BSDes) for quite some time.

So that benchmark is kind of wrong. What about the results for fewer concurrent clients? NetBSD seems to perform worse than (Scientific) Linux. Is it because of those resource limits?

<comment><USER13> TLS is not a feature, it is a problem. It was added because of the very problems that started this thread. Modern linux software expect stupid crap like that, so NetBSD eventually feels forced to add it. The entire point is that BSDs try to avoid adding unnecessary complexity like that.

The dragonfly benchmark doesn't give us any real info, so it is impossible to say what exactly the problem is. Clearly something is wrong though, given we already know netbsd made performance and scalability a major focus of the 5.0 release, and nobody has reported any regressions in 6.0:

<http://www.netbsd.org/~ad/50/img13.html></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Programming Languages with the compiler/interpreter written in JavaScript ? - <AUTHOR> What programming languages have their compilers and/or interpreters written in JS (or webassembly) ?<p>Can these compilers/interpreters be run in the browser ? <comment><USER2> do transpilers count ? if yes, then prepack, babeljs</comment>


A South Korean shipyard worker - <AUTHOR> http://i.imgur.com/m7fynr9.jpg

<comment><USER2> this is an image from this article about a robotic suit: [https://news.ycombinator.com/item?id=8133808](https://news.ycombinator.com/item?id=8133808)

</comment><comment><USER3> Context?? Is this a demo? Or new standard issue equipment?</comment>


Jekyll against the rest of the world - <AUTHOR> http://tobyx.com/2015/jekyll-vs-world <comment><USER2> >Statically generated pages usually offer no way of showing any sort of dynamic content.

There's two kinds of dynamic content. Content that needs to be rendered at site build time and content that needs to be rendered on page load. As an example on my personal site I have an Atom feed that I have as part of my Jekyll blog which I wanted to have the first five entries from on my homepage. Since any change in the Atom feed will mean redeploying the blog, how I decided to do this was to write a deploy script for Jekyll that will check for the existence of a 'prerender.py' in the site root and execute it to modify the site before building it:

[https://github.com/JD-P/misc- scripts/blob/master/reset.py](https://github.com/JD-P/misc- scripts/blob/master/reset.py)

What this means in practice is that I can have content that is static on page load but is dynamically generated at build time.</comment>


Ask HN: Would you read Q&A with senior developers about their career path? - <AUTHOR> I love reading Indie Hackers and was inspired to start a website that was focused on doing interviews with senior developers/senior level technical management people. I want the site to revolve around helping younger developers learn about the non-technical sides to being a developer such as communication, salary negotiation, career path etc.<p>As a technical recruiter, I see tons of developers making basic mistakes when approaching their career and I'd love to build a community around this. <comment><USER2> I think this is a great idea! You could even go a step further and also discuss challenges like perfectionism and procrastination. I believe that a lot of developers are struggling with this and would appreciate guidance in areas which are also about the internal challenges and not just about the functional career challenges. I know I could have used a website like this.</comment>


Making graphics in 4 kilobytes (2008) [pdf] - <AUTHOR> http://iquilezles.org/www/articles/proceduralgfx/inspire2008.pdf <comment><USER3> I've loved these kinds of demos since I first discovered them. For those not in the know, this is _the_ site for finding them: [http://www.pouet.net/](http://www.pouet.net/)

Though it didn't end up involving any procedural generation, I was tasked with cramming an OSD into an FPGA that was already using the majority of its resources. The device was processing an HDMI video stream and needed to display a menu and various other information to the user, for control and settings. All this at up to 1080p60. I ended up using about 16 KB of on-chip SRAM, if I recall correctly, and designed an old-school inspired GPU ala NES/SNES, with perfect alpha blending even! It was palette based, of course, and the memory is used to store sprites and a "command buffer". While pixels are flying through the GPU it reads the command buffer sequentially, which instructs it which sprites to draw in-order. Space between sprites is handled by rendering a fully transparent 1x1 sprite, repeated however many times. I was able to draw the framing for the menus and displays with fancy drop- shadows, logos, text, etc. It worked quite well! The only major limitation was my inability to handle exotic languages like Chinese, simply because there wasn't enough room for all the necessary sprites.

While the FPGA handled real-time, on-the-fly rendering, the on-board MCU was the one uploading sprites and configuring the command buffer over SPI. I had to build up all the software to not only drive the GPU but also handle the OSD. If you think coding up GUIs on a desktop is bad, just wait until you try to design a GUI system completely from scratch on an MCU!

I can only imagine what demoscene artists would be able to accomplish if they could design their own GPUs on an FPGA!

<comment><USER4> Sounds like you might appreciate LFT's Parallelogram fpga demo:

[http://www.linusakesson.net/scene/parallelogram/](http://www.linusakesson.net/scene/parallelogram/)

</comment></comment><comment><USER5> It's also inspiring to see how much you can do with only 140 characters of code (so it fits in a tweet). Here are some examples:

[https://www.dwitter.net/d/104](https://www.dwitter.net/d/104) (tunnel)

[https://www.dwitter.net/d/302](https://www.dwitter.net/d/302) (old school effect)

[https://www.dwitter.net/d/406](https://www.dwitter.net/d/406) (rotating cylinder)

<comment><USER6> So cool! Thanks for posting them.

</comment></comment><comment><USER7> Obligatory link to Elevated - a 4 kilobytes animated 3D demo with music by rgba (authors of PDF in the OP) & TBC: [https://www.youtube.com/watch?v=jB0vBmiTr6o](https://www.youtube.com/watch?v=jB0vBmiTr6o)

For me, achieving something like this in 4k is just mindblowing.

</comment><comment><USER8> The eye was pretty interesting. These primitives, what are they? smoothstep() is apparently "Hermite interpolation" but colsca() - col-scale? collerp - col- linear interpolation?

<comment><USER9> found an implementation here. [http://fingswotidun.com/code/index.php/Eye](http://fingswotidun.com/code/index.php/Eye)

Don't know if it's the same one but it all it seems to do is scaling and clamping.

<comment><USER10> I did that. It's a fairly direct conversion from the paper.

I'm guessing SmoothStep got converted for size or performance seasons, but it doesn't really do the same thing.

One of the tricky bits of procedural generation like this is that bugs get entrenched easily, because 'fixing' things can dramatically change the generated result. Perhaps that is what happened in this instance.

</comment></comment></comment><comment><USER11> still the favourite - [https://www.youtube.com/watch?v=SzW0ammfUAQ](https://www.youtube.com/watch?v=SzW0ammfUAQ)

<comment><USER12> Here is how it was made: [http://m.imgur.com/t0rxWqH](http://m.imgur.com/t0rxWqH)

<comment><USER11> awesome - thanks!

</comment></comment></comment><comment><USER13> Reminds me of these [https://www.youtube.com/watch?v=Tfh0ytz8S0k](https://www.youtube.com/watch?v=Tfh0ytz8S0k)

</comment><comment><USER14> Kind of related. I've stumbled upon someone making an old school demo of sorts in asm on amiga on youtube: [https://www.youtube.com/watch?v=p83QUZ1-P10&list=PLc3ltHgmii...](https://www.youtube.com/watch?v=p83QUZ1-P10&list=PLc3ltHgmiidpK-s0eP5hTKJnjdTHz0_bW)

</comment><comment><USER15> If this is from 2008, does anybody know what's up with one of the last slides which states "There was an interesting procedural full 3d image in this slide. After some explanations on it, speech attendees were flashed and their short term visual memory erased."?

<comment><USER16> Probably referring to the 'neuralyzer' gadget from the movie Men In Black ([https://en.wikipedia.org/wiki/Neuralyzer](https://en.wikipedia.org/wiki/Neuralyzer)).

But could also be a reference to the 'visual knock-out capsules' from Alfred Bester's SF novel 'The Demolished Man':

 _" They were cubes of copper, half the size of fulminating caps, but twice as deadly. When they were broken open, they erupted a dazzling blue flare that ionized the Rhodopsin - the visual purple in the retina of the eye - <USER2> the victim and abolishing his perception of time and space."_</comment></comment>


YC West Coast Demo Day Roundup - <AUTHOR> http://www.techcrunch.com/2007/08/16/y-combinator-demo-day-the-summer-startups/

<comment><USER2> I'm always fascinated by the folks who flip a U-turn on their startup like Cloudant. I have to assume it happens far more often in the YC environment. When you're just kind of holed up in your bunker and spring something on the world after you've brought it to alpha, I don't think it's so common to throw out what you're working on even if it's for the best.

I had a half-year-long entrepreneurial experience when I was 23, but it was basically just me, in the spider hole, coding, and never finishing the product. I was trying to make something technologically cool and didn't know (or care to know) a thing about the business aspect. It was a huge waste from a learning perspective, much less a money perspective, although I did enjoy it. I lacked a co-founder, investors, much of a clue about the market and guidance, but what was fatal was that I was missing feedback and a deadline.

I think startups are painfully difficult to assess without a structure that provides honest feedback and a real deadline. I think it's greatly to YC's credit that they have teams that radically alter their focus like Cloudant did, however it turns out.

<comment><USER3> Cloudant is cool, just hope that router doesn't get you banned from those sites that specifically ban IP's for using download accelerators (IE making too many simultaneous requests).

<comment><USER4> That's a valid worry. I know for a fact that using Fasterfox will get you banned on many sites (I got banned for using it myself). I hope Cloudant guys expose some settings to help with that.

<comment><USER2> Y'know, after seeing "Cloudant" a few times, I'm starting to want to pronounce it _en francais_. Clou- _dant_. Clooo- _dahhn_. Okay, sorry.

</comment></comment></comment></comment><comment><USER5> Damn, I am working on a python script to do simultaneous range requests and 'am hoping to release it as open source by October. @work, lots of ISOs get transferred over the network all the time; even on a fast network, it's a pain with uncached images. @home I download OS iso's quite often. This is a great source of pain for me and I am pretty sure for a lot of other people as well - hope the Cloudant guys pull it off. But they need a way to figure out how to throttle bandwidth usage.

BTW, is there such a thing as universal mind ? How come you think about something and very soon you find out someone else doing something with more or less the same idea ;-)

<comment><USER6> It is because, for each problem/annoyance you have, there are certanly many other people in the world who have it too.

In addition, many of them are exposed to a similar environment so it is probable that they come up with similar solutions.

Anyway, it doesn't matter how many are they, but how many have the will to make it happen. That is what makes all the difference.

</comment></comment><comment><USER7> Tip for Cloudant: market your product in countries outside of the US. In Japan, Korea, and some parts of Europe people have very high bandwidth connections but high latency to the US. A high bandwidth delay product means multiple connections is a _massive_ win for largish files. I'd go so far as saying you should totally ignore the US entirely. Market it to foreigners as a way to download faster from the US, where so much content is hosted.

</comment><comment><USER5> [http://www.flickr.com/photos/11585518@N04/sets/7215760148516...](http://www.flickr.com/photos/11585518@N04/sets/72157601485163904/)

The photos on this page have a few interns - Does YC take interns ?

<comment><USER8> I think you're referring to the TechCrunch interns.

</comment></comment><comment><USER9> My winners are Anywhere.fm and Dropbox. The minute anywhere goes mobile they will truly change the way we listen to music or anything audio. If you think about it one day people will laugh about the Ipod. I never really grasp the concept of putting all your songs in a box. It is like carrying all your savings in a briefcase rather than a debit card. Anywhere will soon ( i hope) start streaming your tunes using edge, gprs or wifi enabled phones. wacth out Jobs.</comment>


AAP, police clash at Delhi dharna - <AUTHOR> http://www.thehindu.com/news/cities/Delhi/aap-police-clash-at-delhi-dharna/article5596249.ece?homepage=true

<comment><AUTHOR> This is an interesting development as there's an clash between the state govt run by the newly elected AAP (Short for the People's party) and the central govt of India. The CM is protesting against police inaction (Delhi police is under Central govt. which is in contrast to other states in the country) against an alleged prostitution racket.

This is the first time I have seen something like this happen in Delhi</comment>