Ask HN: Are you a Firefox Extension Developer? - <AUTHOR>

I am looking for a Firefox extension developer who is interested in turning the Tyba Firefox Extension into an opensource project, manage the code, make changes so that it's compatible with a new internal API (just a few changes of XMLHttpRequest URLs) and most importantly make it work cross platform. The groundwork has been done by a Firefox developer (it currently works great on XP and Vista) allready but it's proving difficult to make it work cross platform.
Besides the occasional freelancer (hence the initial FF extension) it's a bootstrapped one man startup I work on fulltime (I code and manage everything but the FF extension - currently out of my range of expertise). Our budget is not large but the majority of it is allocated to this.
I am really looking for someone who is enthausiastic about the idea of Tyba and is willing to initially spend some time to make it work cross platform, the api change and set it up as an opensource project and from then onwards just spend a few hours each week maintaining it.
If you would like to use the extension before replying just go to http://tyba.com and request an invite I'll be sure to send out the invites immediately.
You can contact me by emailing: contact [at] tyba [dot] com
Thank you,
Eiso <comment><USER2> More information on Tyba, I found on his blog:

"The startup is Tyba and it's a simple concept: You download a Firefox extension which allows you to rate web pages and append tags (a feature I like is that when you come from Google or Yahoo the search term is automatically sent with your rating). The rating and tagging is simple, done by clicking stars or using keyboard shortcuts. Then when you feel like it you can login in to the web interface and organize the links you've rated into groups. These groups become public and anyone can view them. The other Tyba users can follow your groups and you in turn can also follow other people's groups. When you follow a group you can do two things, see when new links are added to them and you can search through them. It's a bit like building your own search engine with the links you rate and the groups other people make. Right now all this functionality is there in its most basic form."

I've developed a few Firefox extensions, though I'm not available to help as I'm driving my own company.

What kind of platform-specific code does the extension use that makes it difficult to run cross-platform? I'm surprised it has problems because no extension I've ever coded required much more than visual tweaks across Mac/Windows/Linux. Some extensions clearly are tied to a platform, but from what is described here, I'm not seeing a piece that can't just be XUL/JS.

Good luck, regardless!

<comment><AUTHOR> Thank you! The extension hangs under the tab and shows up when you hover over the tab. This breaks on Mac OS X and Linux plus the keyboard shortcuts don't work on these platforms. I am as surprised as you are that it doesn't work cross platform. Also thank you for posting more information about Tyba - it's much appreciated.

</comment></comment><comment><USER3> I'll forward this on to a FF extension developer I know.</comment>


Three Reasons To Use Disqus - <AUTHOR> http://avc.blogs.com/a_vc/2008/05/three-reasons-t.html

<comment><USER2> OK, this might be a really stupid question. If so, I apologize, but...

What happens if Disqus goes out of business? Do all of your comments evaporate? Or are the comments stored locally somehow?

<comment><USER3> _"... What happens if Disqus goes out of business? Do all of your comments evaporate? ..."_

A quick look at the website would reveal, _"No"_ ~ <http://disqus.com/help/#faq-6>

      I use Disqus because it gives me
      "the freedom to leave" at anytime

Understand that data _"Lock-in"_ is the new _"Lock-out"_. If Disqus does collapse, I still have my data because I have access to it now. To understand why this is important read about _"The zen of free"_ ~ [http://asay.blogspot.com/2006/06/simon-phipps-on-zen-of- free...](http://asay.blogspot.com/2006/06/simon-phipps-on-zen-of-free- osbc.html) by Simon Phipps.

</comment></comment><comment><USER4> What about the loss of page rank and search due to content not being hosted on your server? Could disqus perhaps allow you to use a custom subdomain (such as disqus.yourblog.com)?

<comment><USER5> Disqus comments are included via javascript, so you don't have outbound links that diminish pagerank.

Comments won't be indexed by Google but your article text and links to the article from other blogs will have a bigger impact on where you appear in SERPs.

</comment></comment><comment><USER6> One bit of information is missing:

what's the price?

<comment><USER7> Disqus is free for bloggers

<comment><USER8> I don't think he's talking about a monetary price, rather sacrifices that bloggers might be making to use their service, as others have pointed out here - page rank, etc.

<comment><USER6> Actually, I was talking about both. It's all good and great that they'll host my comments, but how do they make their money?

I need to know this in order to migrate.

<comment><USER9> Hmm, no obvious way to make money, do we assume they last until they run out of VC money?

<comment><USER10> An obvious way to make money: Persistent reputation is extremely valuable. Extended and deep information about a user from their writings and the sites they visit is extremely valuable. Think about the targeted advertising down the long tail, where eCPM will be huge.

<comment><USER9> I'd hope their plan is more than to reach some critical mass then start inserting ads into people's blogs. Will it be "put our ads on your blog, and we'll split the profits" or "pay for Disqus or we'll put ads on your site"? I guess we'll wait and see, perhaps they'll manage to productise it, if they've not reached the maximum price point yet.

<comment><USER10> There are many ways for them to make money. My point was to counter your comment that there were no obvious ways.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I am not convinced. I do see the advantages but I would rather have the text on my blog. The comment text gives your blog a little more life in the eyes of Google and adds just a little more content.

If I don't want to mess with creating a comment system then why did I build my own blog in the first place?

I think a good compromise to make things easier for the commenter is to use Clickpass for easy login.

I don't mind that my blog is being commented other places (like we are doing here for this entry) but if a commenter is at my site then that is where I want my text to live.

<comment><USER12> It's a two way street - a long discussion on a topic with a specific keyword can hurt your ranking for that keyword if the discussions aren't using the phrase you're targeting.

I love the quick and easy functionality that Disqus has and am using it on a few of my blogs. I'd like to set it up for my companies web properties but am reluctant because we already have our own login and user systems.

</comment></comment><comment><USER13> And the biggest reason not to: javascript is required. It causes really bad problems in IE: [http://blogs.msdn.com/ie/archive/2008/04/23/what-happened- to...](http://blogs.msdn.com/ie/archive/2008/04/23/what-happened-to-operation- aborted.aspx)

<comment><USER12> I'd have to think that they are working on an API solution that will have MT and WordPress plugins that use it...The JS problem is just too big not to be addressed.

</comment></comment><comment><USER14> He forgot the most important reason (to me): You can stick a fully functional comment system on anything without doing it yourself. Why reinvent the wheel and deal with managing your own when you can just tack on an excellent system by someone else?

<comment><USER11> How far do you want to take this though? Why not just use Blogger or Wordpress.com? Why custom code your own blog?

BTW, I assume you are talking about a custom coded blog (or whatever is being commented) because systems like Wordpress or ExpressionEngine make adding commenting trivially easy.

<comment><USER14> I have coded my own blog in the past, and yeah, after a while it's boring and so I just use Blogger now. But you can stick comments on more than just blog entries.

At least I was under the impression that you could put Disqus comments on anything really (is that not true?). It would be trivially easy to make a site like HN... just a list of links and with disqus comments for each of them. I am working on a project right now where people can suggest strategies for something and others can comment on them. Disqus would be an easy fit there as well.

You could host your own photos with some quick gallery code too, but why not let Flickr do it? I think Disqus is in the same category.

<comment><USER15> Yes, you can put Disqus comments on anything that's for public consumption and has a permalink.

If you enable Disqus comments on OurDoings, any photo you deem worthy of a caption will get its own comment thread.

</comment></comment></comment></comment><comment><USER16> We've been looking at adding CoComment to our site which I think is very similar. I have been using it and I like the way it records all the comments I make which I can then go back and refer to. However, it feels like we provide them with new customers and we don't get a ton back in return.

Anyone implement it or Disqus?

</comment><comment><USER17> I'm surprised at the number of websites that hide, or as in this case do not have search functionality. Isn't that the first thing you want to do when you arrive at a forum and have a question?

</comment><comment><USER18> do any social web apps use disqus?</comment>


Ask HN: is it better to have work experience before starting a startup? - <AUTHOR>

I'm asking the HN community because I'm about to graduate ( in September ), and I got an offer from quite a successful startup ( about 120-150 people now ). The pay is good and the people I'll be working with are definitely smart. I'm just wondering if this will actually helps me with my plan which is starting my own startup eventually. Should I start it up right after school and decline job offers  ( which means living at my parents since I don't have cash in the bank ) ? What about doing consulting/freelance work on the side and starting building the product in the same time ? If any of you has an advice about what elements should I base my decision on, that would be really helpful. <comment><USER2> I was in the same situation as you about 2 months ago and I decided to take the plunge and work on my own start-up.

While I know that work experience and the network from working someplace awesome would help me, I had the idea, the passion, and a basic prototype so I decided to just do it. I could always go join a start-up later, and I don't have any debt or obligations so I can live super-cheap. Even if I fail I will have a cool piece of software to show for it that I can use to help me get a job later.

Good luck with whatever you decide! Shoot me an email if you want to talk.

</comment><comment><USER3> No. Yes you will learn a lot. Some truly helpful things, but 90% will be about how to thrive inside a company as an employee. If you want to be a founder the only real experience is to be one.

Your job as founder of a tiny startup puts you on the correct trajectory.

</comment><comment><USER4> If you want to start a company, it is good work in a company environment where you can see what you think works and doesn't work first hand. Practical experience vs theoretical will help you make fewer mistakes no matter what craft you practice be it, running a business, programming, carpentry or anything else.

<comment><USER5> Solid advice. Plus, if he lives frugally (he said living with his parents was on the table) while working for a few years, he should be able to save up a nice cushion of savings.

</comment></comment><comment><USER6> Working at a "real" company will give you some insight about "how the sausage is made", both from the business side as well as the software development side. You can gain a lot of information about what does and does not work by observing and participating in the process for a while. Stay at home or live cheap and put some of that decent salary into savings for if/when you commit to your own project full time.

Nothing wrong with developing your own product on the side or "after hours", although be aware that at many startups most positions have some kind of operational component and/or tight deadlines, which might interfere with after hours projects. (Not all startups/small companies are like this of course).

Make sure that if you are developing something on your own time that it does not compete with the company's product line, you will often have to sign a contract to that effect. Along the same lines, be sure to have a clear line between things you develop for the company and things you develop for yourself - keep a separate machine for your own code, don't use your employer's equipment or even a personal machine with your employer's code checked out on it. The same advice goes for freelance projects.

</comment><comment><USER7> I have worked at various levels of several different kinds of companies - everything from epoxies to hospices to ship management to pure software houses to educational institutions. I never learned so much about running a company as I did after reading Gerber's "E-Myth Revisited" and then starting out on my own company. Rather than go corporate, I recommend poring over the org charts and business models of several different kinds of businesses and follow the money. Figure out why they have hired the people they do and what function they serve in the nitty-gritty to serve the overall vision of the company. How do they make a customer? How do they deliver? When you can map each of these out on paper in the nitty-gritty, then you are ready to think about your own company, I say. But working in the corporate world will not necessarily help you with that. It will, however, give you contacts and a network that you can leverage. In addition to Gerber's book, I encourage you to take to heart Felix Dennis' "How to Get Rich", wherein he takes up the matter of working for someone else only enough to learn the business inside out so you can compete with them.

<comment><AUTHOR> I already read "How to get rich" ( Hint: It's not by working for your boss, so I think I have my answer ;) I understand it can be beneficial to work for a company, but I'm not sure if working as an engineer and being surrounded by engineers ( as smart as they are ) will help me significantly for my future startup. Thanks for the book recommandation, I'm going to order E-myth revisited right away.

</comment></comment><comment><USER8> Well, it depends on your needs, situation.

If you are not running after money but want to work for yourself (passion for being an entrepreneur), I would suggest you to take risk and start your own company. Try it for a year. I possible also have a co founder who's frequency matches with you but skill sets are complementary with yours.

If you need more money. Forget about starting a company now. Get few years of experience (4-5 yrs). And than start.

</comment><comment><USER9> I'm late to this. But in my experience you should start up your company while you can live with your parents. Don't bother with working for someone else's startup. Also, the 120-150 person mark is a really bad time. You have all the chaos and long hours of a startup, but all the weird political lameness of a big company at the same time.

<comment><AUTHOR> Is it a choice you had to do yourself as well ?

<comment><USER9> If only I could turn back time...

</comment></comment></comment><comment><USER10> Go do the company. The older you get and the more assets and commitments you have the harder it is to take a big risk.

<comment><USER11> This is true but in my case my first "company" imploded from the weight of all the things I didn't know I didn't know.

<comment><AUTHOR> But does working in a company ( as an engineer I would add ) really prepares you for all those troubles you're eventually going to bump into with your startup ?

<comment><USER10> I went for the experience and I was pretty dissapointed that I didn't learn any magical new way of doing things in 'the real world'.</comment></comment></comment></comment>


China fires back at US with tariff hike on goods worth $60 bn - <AUTHOR> https://news.yahoo.com/china-fires-back-us-tariff-hike-goods-worth-140446979.html <comment><AUTHOR> I think China realized their horizon is much longer then the term of office of Trump. They could even argue that for the short term (election is in 1.5 year ?) a trade war, resulting a worldwide economy slowdown, might hurt Trump personally more then China. A next president might be in office sooner (no re- election of Trump) and be easier to negotiate with.</comment>


Ask HN: Not Accredited Angel Investor? - <AUTHOR>

Is there a good way to be an angle investor without being an "Accredited Investor"? <comment><USER2> No. The purpose of "accreditation", like all regulations, is to distort the market for investment in favor of established interests, namely the friends of the politicians in power at the time they passed the law. This profits politicians as well, by giving them a favor to trade, to the detriment of startups and small time investors across the country.

You can lose $20,000 in a weekend at a casino, but you can't invest it in your brother's startup.</comment>


IPad in Education: How It's Going - <AUTHOR> http://speirs.org/blog/2010/9/23/the-ipad-project-how-its-going.html <comment><USER2> I would like to add my own little anecdote. I first started to suspect that the iPad [1] might substantially change how we use and perceive computers after my sister told me that instead of magazines the hairdresser recently offered her an iPad. This is not some trendy big-town hairdresser [2], this happened in a small town in Germany. My sister loved being able to check Facebook [3] while her hair were cut.

There is just something different about the iPad [1], it has qualities which make it ideal for certain uses, uses for which laptops or netbooks are just not right.

[1] It's just the iPad now but I'm sure there will be many similar devices in the future.

[2] Ok, maybe somewhat trendy: <http://www.projecth.net/>

[3] The privacy implications make me cringe. I suspect that many customers forget to log out, but that's just a software problem and doesn't really matter in the grand scheme of things.</comment>


FilmFish: Humanly curated movie recommendations - <AUTHOR> https://www.film-fish.com <comment><USER2> Hey, congratulations on launching. Some feedback:

\- If there are no search results for a movie, let me add it from IMDB/TMDb/etc.

\- Let me create personal lists (a la Letterboxd)

\- The rendering on search autocomplete looks... off. (Chrome Version 50.0.2661.102 (64-bit))

<comment><AUTHOR> Thanks for the feedback!

</comment></comment><comment><USER3> I will definitely be diving into this. I've been using Criticker for over 7 years now and its recommendation engine has never failed me. It is based on thousands of user ratings, and customizes to the user according to other similar users. I did love Jinni for a while, their interface was beautiful and their engine amazing, but it pivoted to b2b services. They spit out an Excel file of my ratings so I went back to criticker and had to manually add all my new ratings, ugh.

Good luck with your project, I think the space has a lot of opportunity!

<comment><AUTHOR> Thank you, please keep us updated on your experience as you dive in

</comment></comment><comment><USER4> Looks great, also have some feedback:

Some of your trailer and video provider links aren't matching the film described, rather films with similar titles. See the following examples:

The link to watch "The Lobster" on Amazon Prime takes me to "My Village, My Lobster", a documentary about lobster fishermen in Nicaragua[1]

The link to view the trailer for the indie sci-fi film "The Wall" pulls up a trailer for "Roger Waters The Wall", another documentary, this time about Pink Floyd, possibly.[2]

[1]: [http://www.amazon.com/My-Village-Lobster-Bil- Yoelin/dp/B00C5...](http://www.amazon.com/My-Village-Lobster-Bil- Yoelin/dp/B00C58SAPC%3FSubscriptionId%3DAKIAILQBWT2AVLRAOG3Q%26tag%3Dfilmfishcom-20%26linkCode%3Dsp1%26camp%3D2025%26creative%3D165953%26creativeASIN%3DB00C58SAPC)

[2]: [https://www.youtube.com/watch?v=ZuPyeCX7Fgg](https://www.youtube.com/watch?v=ZuPyeCX7Fgg)

<comment><AUTHOR> Thanks for the catches. Will edit these films, and run some more checks

</comment></comment><comment><USER5> Note that despite advertising as such on their front page, this does not exclusively search the amazon prime selection, rather the entire rent/own/prime availability

<comment><USER6> What I see in their main image at the top is "Find Good Movies to Watch on Prime, Netflix, Hulu, & more."

</comment></comment><comment><USER7> Looking forward to test driving it more.

So far I am not a fan of the default UX. If I type in a movie, I want a simple list of movies, not categories.

</comment><comment><USER8> Nice !!! just browsing through the indy scifi section showed Primer and Upstream Color, two of my favorite movies :)

</comment><comment><USER9> Any chance of setting the region for the services one uses?

<comment><AUTHOR> Yep, we're working on Netflix UK, Canada, etc.

</comment></comment><comment><USER10> Pity it's not more like goodreads

</comment><comment><USER11> Humanly?

<comment><USER12> Heh!

I typed "brazil" and got recommended "boys from brazil". Next I tried "being there" and got recommended "there will be blood". Everything about this needs a lot of work.

<comment><AUTHOR> hey, unfortunately I think you clicked the wrong movie.

Here is the Boys from Brazil:

[https://www.film-fish.com/movieslike/the-boys-from- brazil-19...](https://www.film-fish.com/movieslike/the-boys-from-brazil-1978)</comment></comment></comment>


Ask HN: Any desperate things you did just to keep your startup alive? - <AUTHOR>

I love the story of how the AirBnB guys sold cereal boxes just to survive. Does anyone know any more similar stories about successful startups. <comment><USER2> When I started my first software related company at 21 (almost 3 years ago) I had already had some small successes in other businesses, and had a fairly strong customer base to start because of contacts I had made. So I went out hired employees bought copy machines, set up an office etc. But after the 6th pay period (3 months in) I paid all my employees and I had $3.62 left in the company bank account with several unpaid invoices from clients who I did not know very well, since we were working mainly for law firms and they are famous for not paying in a timely manner I did not know what to do.

I went and took an evening job at "geek squad" for $13 hour and started selling cars at a friends car lot on the weekends in a city about 50 miles away so none of my employees would know we were struggling. Often times over those next few months I was paying my employees from money I had earned working those two jobs which none of my employees even knew I had.

I eventually started researching effective ways to collect past due bills and I was harsh and even lost a few customers in my collection tactics, but ultimately learned a great deal about the types of customers I did and did not want which allowed me to realize that having tons of business was not necessarily as good as simply having a smaller, loyal customer base who pays their bills and respects your work.

I can recall one conversation where I was speaking to an attorney's secretary and she told me that after talking to "John" Aka the attorney in question, he simply did not have the money to pay the bill, but he "would get it paid as soon as possible" to which I quickly popped off "Well why don't you tell John that if he doesn't have the money he needs to stop parking his Aston Martin in front of my office."

luckily for me, my young hot headedness paid off and I received a hand delivered check the very next day.

While I struggled for some time to come and eventually spent my entire savings paying my employees salaries the business did eventually succeed and go on to be very sustainable.

When selling the company to a large firm out of Charlotte, NC I was even able to negotiate terms allowing all my employees to keep their same grade of pay for at least 2 years after the sale (they were all on salary and paid above market rate) While I worked harder in those 19 moths than I ever had in my life it was the most fulfilling time that I have ever been through and it shaped the me into the person I am today.

</comment><comment><USER3> I went on the "super noodle diet" - Which consisted of eating 2 packets of instant noodles per day, seasoned with lots of pepper to make it seem more filling. As a treat on a Sunday I had a 99p pizza too! I paid for this with the contents of my penny jar. When that had run out, I survived for another week on cornflakes with golden syrup instead of milk, which were the only things I had in my cupboard.

I lost ~30lbs in the 2 months I was doing this. In the end the startup failed, I swallowed my pride and got my old job back, the one I'd left a year previous to work full time on my startup.

</comment><comment><USER4> We arbitraged Facebook application development when the platform was brand new. I had developed some applications in the first few weeks platform was out, and had done some early work on the predecessor to rFacebook. I used these examples and some well placed adwords ads to drive customers to us. The phone was ringing off the hook with people wanting apps, many calling just to waste our time, but a fair number of solid leads. We hired competent subcontractors to do the development and most of the product management (so we could spend time coding for our startup). This turned out to be a mistake as our subcontractors tried to steal a client from us behind our backs. This of course was against both our contract with the client and our subcontractors.

However, our client was a hedge fund manager with an in house attorney who kept trying to convince me that because of my age (I was 21 at the time) I had no idea what I was doing and was being unethical for subcontracting work. He refused to pay and threatened to have his in house attorney waste enough of our lawyers time to make it unfeasible for us to pursue litigation (we didn't have a lawyers fees clause in our contract in case of disputes). After a lot of back and forth, he ended up settling for 50% of the contract amount ($12.5k IIRC) and we didn't pay anything to our subcontractors as a result of their breach of contract. The $12.5k plus some other purely advisory (non- development) work we did paid for us to stop arbitraging consulting (which was great since we didn't have any subcontractors anymore since we fired them) and to live on for the rest of the summer and work on our startup.

We raised money from YC right before that money ran out.

</comment><comment><USER5> <http://en.wikipedia.org/wiki/John_DeLorean#Entrapment>

(If you are not familiar with the story, in a last-ditched effort to save his car company, De Lorean attempted to traffic a large amount of cocaine. Turned out the seller was a federal agent. That is dedication)

<comment><USER6> That is not dedication, that is criminal, that is, following the first easy thing you can think of, regardless of the consequences. If he has the dedication, a firm no to the above suggestion, and a further five minutes thinking, would have probably brought up a much honourable means, even in times of desperate need, to get what he wanted.

<comment><USER7> He managed to avoid prosecution, as he was found not guilty due to entrapment. Entrapment is when the alleged criminal was:

1\. given the idea for the crime by the government agents

2\. persuaded or talked into committing the crime by government agents

3\. not _ready and willing_ to commit the crime before the government agents spoke with him.

So no, it wasn't "the first easy thing you[he] can [could] think of".

EDIT: Formatting.

</comment></comment></comment><comment><USER8> Fred Smith, the founder of FedEx, took the last $5000 in the company's bank account to Vegas so they could afford to make the ~$30k fuel payment they needed to stay in business. Turned out pretty well for him ;-)

</comment><comment><USER9> I went on a few 24 hour online poker binges to pay the rent. I won a lot, but had to borrow money from my parents because it took over a week to cash-out.

Also drove to Foxwoods to play poker once with my co-founder when we were particularly desperate. We only had enough money for one buy-in ($300). Figured that if I was asking my parents for money again, asking for an extra $300 was worth the risk, if I had a chance to win and not ask for anything.

Bill also took random jobs on Craigslist (helping people set up pod-casts, writing papers for wealthy foreign students, etc.)

I taught the LSAT and did "law school admission consulting" which basically translated to helping people write personal statements.

<comment><USER9> shit, just posted this from my girlfriend's HN account :(

(I'm "aberman", one of the co-founders of WePay)

<comment><AUTHOR> You're GF's HN about line is awesome.

</comment></comment></comment><comment><USER10> That was about ten years ago. For a while there, we did pretty good: hovering stable at around 10 employees, mostly custom web projects for advertising agencies. One day we took on a very nice-sounding project for a local manufacturing company. One company-year flowed into the project, we did almost nothing else. At the end, the project was canceled and they wanted their money back because they were on the brink of bankruptcy (a move that despite our contract was OK'ed by German courts).

It all went downhill from there, but I still hung on for a few months. Didn't want to fire anyone. I took out crazy loans to keep this lead balloon afloat, but there was really no turning around. And it pretty much ruined my life.

It's a cautionary tale, really. I should have allowed this company to fail at a time when I still could have walked away without some serious damage. The company was done. It had no product, burned-out employees and no prospects. I wouldn't make that mistake again today. The lesson here being that desperation is never a good sign. When you're doing a startup, what you want is hunger and euphoria. Not desperation.

</comment><comment><USER11> I live in a little house in one of the poorest countries in the Americas, making Flash games every now and then to fund me and my startup.

If I was back home (AU) then I couldn't have come anywhere near as far as I have - my cost of living here is like $500/month. I'm able to devote a tremendous amount of time to my startup.

<comment><USER12> Which country?

<comment><USER11> Nicaragua, but all of Central America's a great place to live ridiculously cheap and hack away. Plus they're beautiful countries and latinas are so hot.

The internet's not fantastic (a crappy 1 megabit, and outages happen at least once a week), half of the TV is in Spanish, and you have to be careful sometimes since white guys are usually cashed up tourists and ripe for a mugging.

But when push comes to shove it beats trying to make $1000 rent + living expenses and trying to balance a startup around that.

<comment><USER12> Thanks for the details. This is getting a bit off-topic, but can you describe how a foreigner should go about finding a place to live in Central America? Did you just fly there and look for "For Rent" signs or did you line something up beforehand?

<comment><USER13> I constantly travel to Latin America, speaking at conferences and recruiting talent. I've lived/worked in Chile, Argentina, Mexico, Peru Colombia and traveled to Honduras and Guatemala.

If you want to go to central america let me know. I can introduce you to the tech/startup community there. They can hook you up with the best/safest placest to live, work areas, and the whole thing.

My personal experience is with Guatemala and Honduras, though I know top notch developers and entrepreneurs (all bilingual) throughout the whole region.

If I were you, I'd pick costa rica to live in if you want to live in Central America. Bigger expat community, great nearshoring tech talent. Though Chile will give you $40k to startup in Chile.

When I go live/work at a LATAM country my process is usually:

1\. Stay in a hostal for two days, those two days I check out places to rent 2\. In south america, you can find great stuff on craigslist, furnished rooms or studios from $200-$500/mo 3\. Meet local entrepreneurs, and find coworking spaces/become an office guest.

If you need more tips/intros for living in LATAM, my email is in my profile, or @andresbarreto

<comment><USER14> If you ever decide to come to Mexico and need a safe place to stay give me a buzz as well. I'll hook you up.

<comment><USER15> Where in Mexico?

<comment><USER14> Mexico City. Forgot to be a little more specific, my bad :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> In the early days of my first company my co-founder ran into visa issues. He was a British national and post-September 11 his H1B was coming due. At the time the company couldn't sponsor him due to prevailing wage issues so he had to leave the country. Within the span of 2 months I moved from Austin, TX to Sydney, Australia with my co-founder and his family. When I arrived I had no where to live, nothing (living w/ my co-founder was not really possible, mostly because he had four kids and adding a fifth would have driven everyone insane). I initially setup in a hotel and eventually found an apartment. We did it so we could continue to press forward knowing that such a large separation of distance would effectively kill the company. My girlfriend (now wife) stayed behind in Texas. I lived in Sydney on a tourist visa, leaving every 3 months and re-entering. I lived off my credit card and whatever hardware I could sell on eBay. This lasted for about 9 months. After we had made enough progress I came back and about 6 months later we had our first round of venture financing. When we got the check I had about $500 in my bank account.

Only now can I really look back at that time and appreciate what a huge opportunity it was. Most people only have one shot in life to take infinite risk. Eventually life kicks in and you have to start making more measured decisions. However, even with the huge amount of risk I took back then it almost certainly would not have been possible had it not been for my very supportive family and girlfriend. I knew that no matter what happened I could always go home and tell them I gave it my best shot and life would go on.

</comment><comment> old-gregg Ha, we didn't consider selling cereal since we're not good at it. :-) So, when we needed money we decided to stick to what we knew best and started another service-oriented, and therefore instantly profitable, startup: <http://buildasandcastle.com>

<comment><USER17> did it work?? how long before you got your first check from buildansandcastle?

</comment></comment><comment><USER18> The AirBnB cereal boxes is more genius than desperate. I consider desperate things like the Zappos story where Tony literally sold everything he owned to keep the business afloat.

<comment><AUTHOR> I think it was more desperate than genius since it was nothing to do with their product and the goal there was to earn money to sustain them further. The expo>shortage>CNN coverage is an example of a genius move by the same guys.

</comment></comment><comment><USER19> Someone who is a member of a lesser known six person startup (the other five of which Im sure are lovely people) took some front end development work from me, then dissappeared off the face of the earth - no Skype, no email, no phone calls - before the product could be completed, without warning. The guy is otherwise a nice person, but I get the feeling he was desperate for the cash and did a bad thing.

<comment><USER20> You paid ahead of delivery or just a (small) downpayment ?

<comment><USER19> I paid per milestone, which were set by the developer according to his own estimation of delivery, with a thousand dollar plus bonus to meeting his own schedule. there was never any dispute, just the occasional 'I'm sorry this has taken so long, something came up' until after getting paid for near completing the first three milestones, he disappeared.

I was in another continent, so after all communication failed, decided not to peruse the matter. However I ran into him at PyCon this year, about 2 years afterwards. I didn't say anything, as to not cause a commotion. I'm over it, and a lot has changed in my life since, including that I can now do all the work I once needed him for.

<comment><USER20> Wow, what a bad experience. Good to see you get over it without holding a grudge. That said I hope the person has learned their lesson and did not see your decision to walk away from it as an encouragement for a repeat performance.

<comment><USER19> Thanks man :^).

</comment></comment></comment></comment></comment><comment><USER21> Built a MFA (made-for-adsense) site: <http://www.snapspans.com/>

:)

<comment><USER22> Care to share little more? Where traffic come from, how you built it, estimated revenue...

<comment><USER21> I was thinking about advertising arbitrage at the time. Arbitrage, simplified, works like this:

1) Buy something for a price.

2) Sell for a very tiny bit more.

3) Repeat as much as possible, for as long as the market sustains the price difference.

Early on in AdWords/AdSense, some sites were able to buy traffic from a cheap keyword and put up basically a thesaurus page with the higher value pay-per- click (PPC) ads more than covering expenses (eg. pay $0.05 per visit for a N visitors, then by optimizing conversions encourage click-throughs for > $2.00 each).

Later, before the online ad-market shook out upstarts, it was often possible to buy traffic from one source and sell it on another, most often to or from AdSense. Hence a proliferation of MFA sites (with almost no content but relevant AdSense links).

But not thinking too hard suggests that paying nothing for traffic, not paying less, is even better. So with an entrepreneur's ethics, I figured:

a) Business names and addresses are long tail search terms and not under copyright

b) Dense Pages of Long Tail Search Terms => Targeted, Specifically Motivated Traffic

c) (+ AdSense) => User Gets A Solution (finds a service) + PROFIT

I designed a logo, scraped some yellow pages, and it made some money. Continual earnings trumped the dreams to conquer the internet.

Incidentally, the name is a palindrome, and rotating the logo through 360 degrees both spells out "snapspans" and looks like a yin-yan:

<http://www.snapspans.com/>

EDIT: Somewhat erratically, as search engine rankings update every so often, it's at ~30K visitors and ~$450/month. It got spidered because of a link exchange with another more established site.

EDIT2: Probably a good opportunity to write a blog post and submit, but only if people care.

</comment></comment></comment><comment><USER23> Haven't done it myself, but I'm guessing most startups can and do take on consulting/outsourcing gigs for side money.

<comment><USER24> That's not particularly desperate though. Often the startup ends up boosting the consulting side of a business to the point that it's making you more money in business development than in actual on-site revenue.

</comment></comment><comment><USER25> Hot dogs and peanut butter burritos.

</comment><comment><USER26> if anyone's curious what the post is referring to,

<http://en.justin.tv/startupschool/b/272007200>

starts @23:00 or so

</comment><comment><USER27> I coached tennis for some extra money on the side.</comment>


Bloomberg Reports China Infiltrated the Supermicro Supply Chain We Investigate - <AUTHOR> https://www.servethehome.com/bloomberg-reports-china-infiltrated-the-supermicro-supply-chain-we-investigate/ <comment><USER2> > If the FBI, or other intelligence officials, had reason to believe > Supermicro hardware was compromised, then we would expect it would have > taken less than a few years for this procurement to stop.

From the perspective of someone who merely reads what experts write, that isn't true at all. If you have information on your enemy's operations and they are unaware, you have the information advantage and you don't give it up. You use it to monitor them, trace their activities: For example, where does the connection go? And where does the information go from there? Plant malware in whatever is sent back in order to trace who accesses it and maybe give you a backdoor, or if you can't do that plant false information and see where it turns up. Also, who is physically planting the PCB? Mine them, their activities, and social network for more intel.

Also undermine your enemy with false information and by shutting them down not now, reactively, but at the worst possible time for them - when the crisis hits in the South China Sea or Taiwan, pull the plug on their intel or start feeding it false info. And in the meantime, avoid giving them anything too valuable.

On one hand, undoubtedly I have massive blinds spots in my knowledge and the details are probably somehow wrong. On the other, I'm somewhat confident that many times, an intelligence agency would not reveal what they know and would do the _kinds_ of things I'm discussing.

</comment><comment><USER3> Why spend 2 paragraphs talking about how DRAM chips cannot be intercepted because of large number of lines only to get to the point later and say "BMC chips are more probable"?

This is obvious. This article is annoying to read.

<comment><USER4> It seems weird because the Bloomberg article says they were connected to the BMC:

> The illicit chips could do all this because they were connected to the > baseboard management controller, a kind of superchip that administrators use > to remotely log in to problematic servers

The discussion of DRAM only really seems necessary if that _isn't_ plausible.

</comment></comment><comment><USER5> >Saying there is a vulnerability in a BMC is like saying the sun is hot.

This was my thought upon hearing the story when it broke this morning. There has to either be more to it, or I suppose..less. I did wonder if it was some sort of false flag op designed to make people in the US fearful about Chinese Hacking. Based on the people I've spoken to, inside the industry today, it has succeeded.

<comment><USER6> We're seeing a lot of anti Chinese and anti Russian news. I have a tendency to believe them but at the same time there's of course never going to be reported in the US what we are doing.

<comment><USER2> > there's of course never going to be reported in the US what we are doing

That doesn't square with all the reports on US domestic and international spying, much of it in the NY Times, not to mention The Intercept and others. How do you think we know about it? Not from Chinese and Russian newspapers.

> We're seeing a lot of anti Chinese and anti Russian news

Hmmm ... maybe we're seeing a lot of Chinese and Russian activity. If you look at coverage of the current US President, you might notice a lot of 'anti-US' news also. Under the prior administration, there was a lot of that on Fox News and in the Wall Street Journal.

</comment></comment></comment><comment><USER7> > Bloomberg says it is in line with memory to CPUs to intercept some password > validation code

I think that's a misreading of their article. They were not claiming that's what was actually done, they just provided that as an example of what a HW attacker could do. Later on I remember them saying that the malicious part was connected to the BMC, not the main CPU. If there's a serious USB vuln in the BMC, then four wires could be enough to compromise it and gain God Mode over the early x86 SW environment.

<comment><USER5> I thought the article was implying the attack involves the BMC's capability to supply (or change) a boot image. However I'm not sure how that would be able to defeat boot image signing and storage encryption.

<comment><USER7> It's possible that some servers hang the BIOS flash off the BMC, or (more likely) at least have some way for the BMC to write to it - if not by design, then through a HW vuln further up the stack.

And I believe that once you control the BIOS image you control the boot chain of trust.

<comment><USER8> You can update the BIOS via SuperMicro's IPMI. It's actually a feature you have to pay extra for: [https://www.virtuallifestyle.nl/wp- content/uploads/2016/08/S...](https://www.virtuallifestyle.nl/wp- content/uploads/2016/08/SMBU.png)

<comment><USER5> Getting them to take your money in exchange for that utility turns out to be hard. I seem to recall figuring out a way to work around the lack of it, but details have been paved out. I think it involved building the OS-based BIOS flashing tool from source.

</comment></comment></comment></comment></comment><comment><USER5> I still don't get why they need to make a custom chip and embed it in the PCB just to subvert a chip (BMC) that they also supply (or can at least change the firmware for)??

</comment><comment><USER9> Thanks for this investigation. I was trying to think of what an actor in a position to insert such chips at a manufacturing level would actually want. You've got some tough limitations - you want a security hole that you can exploit on highly firewalled, monitored, and locked-down servers running a variety of software types. But it also needs to be hard to detect and exploit without knowing some sort of secret. If anyone notices you using the exploit, you're screwed. If any security researcher or black-hat hacker finds it too, you're also screwed. It'd have to be pretty good to avoid that, since those guys are probably fuzzing servers all the time. You'd have to be very careful how you used it - if anybody traces a known data breach to this, then you're screwed too.

Presuming you can get control of the BMC and transmit arbitrary network traffic, you'd have to limit it somehow. At least some of the compromised servers would be installed in places where any unexpected outgoing network traffic would be noticed and investigated. Large amounts of detectable traffic could be generated too if these things are all pinging away at something. You'd have to trigger it somehow I suppose. But what kind of trigger can you set up on a server running an unknown OS in unknown configuration that may be behind lots of firewalls? Are we sending some kind of weird magic packet to the server? If I was Google or something, I'd have dumb filtering firewalls set up in front of my servers that drop anything that doesn't look like normal network traffic, just to keep any random person from fuzzing the server and triggering some weird unknown bug.

</comment><comment><USER10> Disappointed that there was not any actual technical substance to this article aside from the pictures of the boards. I was excited for a moment, hoping they'd get further until the details, but it ended up in some opinionated rant about how the SEC should get involved.

</comment><comment><USER11> Just give me the option to totally disable this functionality. I understand why farms need it, but I should be able to turn it off. That and Intel AMT.

</comment><comment><USER12> Couldn't this all be easily thwarted with a relatively basic firewall and network analysis of traffic emanating from a data-center?

Also - I found it funny that the "horrific exploit" was just piggybacking on a mgmt engine vuln...

<comment><USER5> As a matter of routine, nobody with a clue would ever allow public Internet connectivity to the BMC NIC. They would also never allow the "bridge" mode where the BMC NIC gets logically connected to one of the primary NICs (useful if you want to spin up a box with only one drop cable in the lab). I wondered if perhaps the attack involved subverting the air gap between the BMC NIC and a primary NIC. Perhaps a reason to use [https://en.wikipedia.org/wiki/IEEE_802.1X](https://en.wikipedia.org/wiki/IEEE_802.1X)

<comment><USER13> In the other threads it has been mentioned that this hypothetical attack could run similarly to the US/Xerox op in the Cold War. The Xerox machines recorded data which was collected by a Xerox technician during regular maintenance. A board with a trojan chip on it could potentially record data to be collected during an RMA. No need for network transmission.

<comment><USER14> Heck, you can find millions of pages of highly confidential documentation in any Xerox copier junkyard--it's all standardly copied to their internal disks, which are never cleaned on junking.

This caused a small stink a while back but I doubt if anything's changed.

</comment></comment></comment></comment><comment><USER15> I like servethehome.com as a good place to learn about people running servers in their home (thus the name), but that wasn't the greatest article. Look into their forums for more interesting technical discussion.</comment>


Field notes – ElasticSearch at petabyte scale on AWS - <AUTHOR> https://grey-boundary.io/field-notes-elasticsearch-at-petabyte-scale-on-aws/ <comment><USER2> This is fantastic! Thanks for sharing. It could be because I have not looked hard enough but this type of knowledge is not easily findable all in one place.

Great job at striking a good balance between opinion and best practice, I already came away with a few ways to optimize some parts of a large Es cluster I manage.</comment>


Pay Me for My Content - creative people and the web - <AUTHOR> http://www.nytimes.com/2007/11/20/opinion/20lanier.html?ex=1353301200&en=c30184eb5de46606&ei=5090&partner=rssuserland&emc=rss

<comment><USER2> What has Jaron Lanier been doing all this time? He seems to be rather quiet...</comment>


Removed use of gendered pronoun - <AUTHOR> https://github.com/joyent/libuv/pull/1015 <comment><USER2>
      Glad this didn't go through. The White Knights of tech are getting a bit
      over their heads on this. One thing is to raise awareness of a problem that
      exists throughout society -- not just tech, a whole different one is to go
      to the extent of requesting a pull request to remove gendered references.
      That helps no one. Zero. It does not advance anyone's argument.

Gosh, it's pretty upsetting that there are people who believe this. In any case, though, I'm glad that the PR went through. A small step in the right direction.

<comment> vezzy-fnord Why is it upsetting? I wholeheartedly agree that this particular case is a triviality.

I tend to use gender-neutral pronouns in written language myself, but I do not see any significant difference in using gendered ones, either. They can be used to describe hypothetical scenarios that apply to everyone reading the documentation.

I've noticed a recent tendency to use female pronouns extensively, something that I am not bothered by at all.

<comment><USER3> But a lot of us notice. A lot of us notice that it's usually 'he'. And a lot of us notice that that's not for us.

</comment></comment></comment><comment><USER4> This is ridiculous and leads to awkward constructions like 'the user might not know that _they_ need to catch that error' when the intended use is obviously singular.

The fair solution is to grep the entire codebase for 'he', 'him', and similarly gendered pronouns, and then randomly replace 50% of them with the corresponding female pronouns. This should be done regularly if desired.

Also, stuff like "using gendered language is hostile" is absolute rubbish. It is not hostile to have a specific instance of gendered language in technical documentation -- it makes it more personal and identifiable. To be fair, this identification can be randomized between male and female.

[EDIT: downvoters, how about _my_ choice to not want to be known as "them" and suchlike? I would like my pronoun to be in the singular form. I am not multiple people.]

<comment><USER5> Using they or their in a singular form is a very well-established form in historical and modern usage; the gender-indeterminate form in particular is known as the 'epicene they':

[http://en.wikipedia.org/wiki/Singular_they](http://en.wikipedia.org/wiki/Singular_they)

For instance, there are sections on there using this form by Shakespeare, Austen, Thackeray and Bernard-Shaw.

I actually wonder whether this might be an American thing, along the same lines as the Webster spelling reforms - the wikipedia page says that grammatical prescriptivism over this primarily occurs in America. Personally, I would say your quoted sentence is completely standard English.

<comment><USER4> Look at the reflexive form in that article.

"Each child feeds themself."

I don't think that singular "they" _never_ be used, just that _enforcing_ its usage everywhere by claiming that the opposite is "hostile" (as this PR seems to lead to) will lead to awkward constructions.

</comment></comment></comment><comment><USER6> This probably doesn't help feminists with the image problem of being uptight and overly serious.

<comment><USER7> I am a heterosexual white man, but this kind of comment still makes me bristle. If you had to deal with the casual dismissal of inequity in your particular cohort on a regular basis, you might be "uptight and overly serious," too.

<comment><USER4> I am a heterosexual man of colour, and I think this sort of artificially enforced "all right, let's remove all traces of individually identifiable references" does absolutely nothing to increase equality between different subgroups.

[side note + example: I really do not understand the term "person of colour" as used in modern American society. To me, it smacks of the old racist term "coloured". But do I still go ahead and use it to refer to myself, because _the majority of people understand what I mean_.]

<comment><USER8> What if our pronouns were racial instead of gendered? I'd have a problem with the white versions being used in all my technical documentation.

<comment><USER4> Exactly. But if you go around and look at any tech company, the majority of people are white males. I think changing that actual situation is more important than changing documentation and making yourself feel good about having done _something_.

If you really want to change things, you can write to your Senator or suchlike about racial inequality you have observed, or immigration reform. That is much harder than just grepping a codebase and submitting a PR -- but if you do it, you might actually effect change (and as a person of colour, I would be much more grateful to you, if you are from a more privileged class).

<comment><USER9> Of course, doing something to effect greater change is 'better' than doing something that effects lesser change, but that doesn't invalidate doing the thing that effects lesser change. Lesser change is better than no change.

<comment><USER4> No, [http://en.wikipedia.org/wiki/Opportunity_cost](http://en.wikipedia.org/wiki/Opportunity_cost)

You grep your codebase of choice for 'him', s/him/them, fire off a pull request, and think "Nice! I really did a lot for the advancement of minorities in tech today!", and then go out for drinks with your mostly white coworkers, where you discuss diversity in the workplace with a straight face.

<comment><USER3> It's a start. It costs you very little. Do it!

Posting on hacker news an starting a flame war might cost a lot though.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I am a strong supporter of using the singular pronoun 'they' where the gender of the subject is unknown. People who say it is improper english are completely idiotic. It has been widely used in this way for a very long time and specifically as a direct substitute for the opposing trend for at least 30 years now.

That being said, I think it is perfectly reasonably to reject pull requests that only change the wording in a couple of comments and don't have any impact on the implementation /or/ the clarity. They should have added something else of value at the same time imo.

</comment><comment><USER11> Or they could use one of various invented gender-neutral pronouns, including those listed here:

[https://en.wikipedia.org/wiki/Gender-specific_and_gender- neu...](https://en.wikipedia.org/wiki/Gender-specific_and_gender- neutral_pronouns#Invented_pronouns)

<comment><USER12> These aren't really used at all in real-world English though (at least American English). So the result would be a very awkward phrase and probably a phrase that is understood by fewer people than before.

The technically grammatically-incorrect plural pronouns come off sounding better and in my opinion are the better choice if the use of gender-specific pronouns is an issue that needs to be addressed.

I don't personally mind the use of masculine pronouns to indicate a generic person, because I think there's nothing inherently wrong with it, but in the tech world it's good to be careful as there clearly are gender issues to be sensitive of. I think another good solution to this kind of wording issue is to just use masculine pronouns in some places and feminine pronouns in others.

<comment><USER13> Yeah, agreed. Singular "they" is the best path forward IMO.

</comment></comment></comment><comment><USER14> Alright. You kids can't just agree to something? Fine! Everyone is now "it".

<comment><USER15> Thing.

</comment></comment><comment><USER15> What a waste of time.

Seriously.

And I'm not talking about Node.js.

<comment><USER9> Hacker News? :)

</comment></comment><comment><USER7> fwiw, less than 10% of the comments on that page were from women, but ~50% of the human race consists of women. hmm.

<comment><USER4> 78% of the teaching staff is female at the school my girlfriend teaches at.

Someone should really tell them that this horrible gender balance is a problem and get onto correcting it _immediately_.

<comment><USER16> I wish people would stop making comments like this.

Education departments are well aware of the under representation of men, particularly in primary education, and are trying to fix it (although not doing any better than computing does, unfortunately)

<comment><USER4> If you work in education, do you hear people telling kids to refer to an imaginary teacher as "she"? (cause kids I know do that).

I know a lot of people who work in the K-12 education sector, and I have never heard them saying that the gender ratio is unfair towards men.

</comment></comment></comment></comment><comment><USER17> Or one could perhaps just say something like "one could say something like..."</comment>


Netflix is testing a button for skipping the opening credits - <AUTHOR> http://www.theverge.com/2017/3/17/14959650/netflix-skip-intro-button <comment><USER2> I've seen this button. The main problem with it that I've found is that it only shows up at the very start of a show. I'd really like to see the intro, _then_ skip the opening credits. As it is now there's no way to do that.

</comment><comment><USER3> I thought they already automatically do this for some shows?

<comment><AUTHOR> Could be</comment></comment>


Neither Neanderthal nor sapiens: new human relative IDed - <AUTHOR> http://arstechnica.com/science/news/2010/03/neither-neanderthal-nor-sapiens-new-human-relative-ided.ars

<comment><USER2> The article asserts that this species is separate from _h. foresiensis_ , but I'm curious how closely they might have been related. Sure, they are separated by geography and 50,000 years, but it seems more plausible that there were 3 rather distinct branches of humans wandering around at the time than 4. And there is a cladistic analysis suggesting that _h. floresiensis_ diverged more recently than _h. habilis_ which would make the timeline for the one fit the genetic evidence for this new species.

<comment><USER3> Why does it seem more plausible there were 3 distinct branches than 4 distinct branches? There are many more distinct branches of apes right now.

<comment><USER2> The more currently unknown branches there were walking around, the more surprising it is that we haven't found more fossils from the ones that are currently unknown.

<comment><USER4> This might be a stupid question, but has anyone ever considered that a higher intelligence or some other attribute might enable a species to just not end up fossilized so much?

"Hey Grok, don't go there, the gods will kill you."

</comment></comment></comment></comment><comment><USER5> Hopefully a yeti...

See [http://johnhawks.net/weblog/reviews/neandertals/neandertal_d...](http://johnhawks.net/weblog/reviews/neandertals/neandertal_dna/denisova- krause-2010.html) for an anthropologist's take on it.

</comment><comment><USER6> > IDed

you know you've seen too many ads when you read that and think it's a new apple product. Scary.</comment>


Not Cool: MPAA Joins The W3C - <AUTHOR> http://www.techdirt.com/articles/20140107/11263425789/not-cool-mpaa-joins-w3c.shtml <comment><USER2> > All because it refuses to update its business model at the pace of > technology.

"All we want is brand new, big-budget entertainment in our homes for nothing. Why doesn't Hollywood get that?" \--Carl Carlson

</comment><comment><USER3> We desperately need to bury EME before it becomes an ecosystem where no other browser vendor can enter the marketplace and innovate with new technologies. If it takes us forking HTML5, then we better do it.

</comment><comment><USER4> There is much that can't be consumed via the browser for the lack of DRM. I fail to see the problem with enabling it because I do believe that content providers have rights and I'll respect them to be able to consume their product. Of course the industry organizations want a say in how that is done.

<comment><USER5> > I fail to see the problem with enabling it because I do believe that content > providers have rights

If they need to deliver closed content, then that's their thing. Just don't be delusional and expect to be able to do it by piggybacking on and free-loading off free and open technologies.

If the "fix" for this conflict is closing down the open technology, that is a cost I'm under no circumstances willing to pay.

<comment><USER4> What do you mean by "piggybacking and free-loading off free and open technologies."

I don't understand where this "closing down" comes from. They want the option of DRM. How could they close down open technology?</comment></comment></comment>


Facebook Deals Launches Tonight - <AUTHOR> http://www.readwriteweb.com/archives/facebook_deals_launches_tonight_groupon_doesnt_sta.php

<comment><USER2> I wonder how much the timing of Facebook Deals is being driven by the upcoming Groupon IPO. A competing Deal service that is free to businesses could upend the Groupon model, making them more open to an acquisition instead of an IPO.

Or maybe just put the brakes on Groupon before it has enough users to add "social features" and become a shopping-driving social network?

</comment><comment><USER3> I question Facebooks place in this market. While rather interesting move and actually a forward thinking move, what happens when other small web companies spring out of nowhere like Groupon and the BEAST steps in called facebook and takes over. I think it Compares to MSoft in the early days.

Maybe with the huge mountain of Cash groupon is sitting on, they should push some money into creating a solid, yet open-slightly closed source of a social network to even try to dethrone something as big as facebook.

<comment><USER4> From one side, it is exactly what Facebook should be better at than any other company; targeting specific people by interest and location, and networking that via the social graph. If my wall post provided free advertising for a company when I purchase a deal, there is a higher chance for my friends to consider the deal.

On the other hand, Facebook has done a remarkable job not trying to become the Google of the internet. For instance they seem to have left Zynga alone to make games; where as Google has tried to buy (DoubleClick) or copy (Buzz) every product which came along in a niche that they hadn't reached into yet.

</comment></comment><comment><USER5> I hope this doesnt mean that I lose friends because of my friends pushing products on me.

</comment><comment><USER6> Oh cool - another service I won't use!

<comment><USER7> I originally thought the same, but you should remember that they've developed this a wee bit differently than other models. It's based on friendships (Facebook after all) and Facebook credits. So I'm guessing that if suddenly all my friends were going to X on Y and I see that, I can say to myself, "hmm, I feel like catching up with some friends, all I need to do is go to X on Y too...".

Groupon, you show the link to a friend and they go, "Yay, cheap food!" or you can go, "hey friend! let's get more friends and go hang here!! cheap food!!" but I'm guessing Facebook will take out all of that "tedious" planning stuff, so it's very streamlined - i.e. if more than X friends are going to Y you'll be pestered via your Wall until you click "buy" or whatever it'll be.

<comment><USER6> Sounds like I'm going to get bombarded by requests/wall messages telling me to buy crap because my friends did. I don't know.

Seems like facebook is late to the party - they should have partnered with groupon or livingsocial imo. Time will tell.

<comment><USER7> Use the 'hide' feature.</comment></comment></comment></comment>


Zuckerberg announces Newsfeed change "less businesses, brands and media content" - <AUTHOR> https://www.facebook.com/zuck/posts/10104413015393571?pnref=story <comment><USER2> The main discussion on this topic is on the front page with over 124 points and 124 comments:

[https://news.ycombinator.com/item?id=16129401](https://news.ycombinator.com/item?id=16129401)

</comment><comment><USER3> This is probably coming after a drop in user(s) or engagement. I know I personally have completely stopped using Facebook (same with many friends). It's easier to simply setup a Signal group and text (which I do with even my parents and 80 year old grandfather).

</comment><comment><USER4> Fixing Facebook was one of his new year resolutions:

[https://www.bloomberg.com/news/articles/2018-01-04/mark- zuck...](https://www.bloomberg.com/news/articles/2018-01-04/mark-zuckerberg-s- new-year-s-resolution-fixing-facebook)

[https://www.facebook.com/zuck/posts/10104380170714571](https://www.facebook.com/zuck/posts/10104380170714571)

</comment><comment><USER5> no comments yet - how strange! seems like a major change, assuming he can follow through on it, which might be hindered by all the other stakeholders FB is beholden to. i have NEVER really used it for social engagement (ie always passively) so i won't notice any effect, but curious if it does make things substantially better

<comment><USER2> > _" no comments yet - how strange!"_

The main discussion on this topic is on the front page with over 124 points and 124 comments:

[https://news.ycombinator.com/item?id=16129401](https://news.ycombinator.com/item?id=16129401)

<comment><USER5> ah

</comment></comment></comment><comment><USER6> _Fewer_

To be That Guy.</comment>


Exclusive Inclusivity - <AUTHOR> https://status451.com/2016/11/06/exclusive-inclusivity/ <comment><USER2> I think whenever you have a profession which is heavily male, the question to ask is, "Why do women avoid this field?" but instead "Why do men stay?"</comment>


Better search for Node.js modules - <AUTHOR> http://node-modules.com

<comment><AUTHOR> We wrote a blog post explaining how it works (it's actually hard work to give good results), [http://www.reddit.com/r/node_modules/comments/1msian/a_cleve...](http://www.reddit.com/r/node_modules/comments/1msian/a_clever_search_engine_for_node_modules_and_a/)

One of the more clever things is that you can log in with github and then we use your github stars/follows to give you customized search results.

</comment><comment><USER2> Did you try the search on VersionEye? [http://www.versioneye.com/?ab=b](http://www.versioneye.com/?ab=b)

</comment><comment><USER3> This is brilliant!</comment>


Monitoring Isn't Observability - <AUTHOR> https://www.vividcortex.com/blog/monitoring-isnt-observability <comment><USER2> All this DevOps talk about "monitoring" and "observability" isn't new in any way. The process control/critical infrastructure industry figured out these concepts years ago.

Maybe I should change careers and become a "DevOps" consultant, I could preach all these "new" ideas and concepts that were commonplace in my former profession. It'd be new to all the MBAs and managers so it'd look good and they'd just throw money at me. I'd be the guy applying "monitoring/observability/alarming" concepts from the electric grid to large software systems...I bet someone would pay me if I had a good looking blog and re-introduced these old ideas in a new and "flashy" way.</comment>


Measles erases immune 'memory' for other diseases - <AUTHOR> https://www.nature.com/articles/d41586-019-03324-7 <comment><USER2> That's phenomenal, I didn't know any virus could do that - I wonder if studying the mechanism at play could lead to treatments for autoimmune diseases

</comment><comment><USER3> I find it interesting Nature uses leading language like "wiping" the memory. I don't know my immune cell chemistry, but I doubt the memory is completely wiped.

<comment><USER4> It's just a quick analogy that people readily understand even if what people imagine it entails is wrong. The main thing is people lose their immunity to other pathogens so the meaning of the effect is carried by the shorthand.</comment></comment>


Time Is Running Out for NTP - <AUTHOR> http://www.infoworld.com/article/3144546/security/time-is-running-out-for-ntp.html <comment><USER2> Article doesn't bother to mention that there are completely different projects which implement NTP servers with varying levels of functionality (openntpd, chrony, ntpsec, ntimed). And while the pool.ntp.org system is a nice scheme, it's hardly a global necessity. You can fairly easily get a stratum 1 server going on your own infrastructure. IMHO, too much of NTP relies on GPS, but that's a separate matter.

<comment><USER3> > IMHO, too much of NTP relies on GPS, but that's a separate matter.

I'm curious to know more. Can you please elaborate or point to some articles discussing this?

<comment><USER4> [https://ntpserver.wordpress.com/2008/09/10/ntp-server- stratu...](https://ntpserver.wordpress.com/2008/09/10/ntp-server-stratum- levels-explained/)

[http://www.ntp.org/ntpfaq/NTP-s-refclk.htm](http://www.ntp.org/ntpfaq/NTP-s- refclk.htm)

TL;DR Most NTP networks are relying on GPS versus a high precision on-site time keeping device. Break GPS, and you break timekeeping for a wide swath of the worldwide NTP pool. But thems the breaks when you can get access to atomic clocks in space (each GPS satellite carries an atomic clock on board) just by sticking an antenna out the window.

If you require precision time for critical business operations (financial transactions, global database operations), you should be running a precision time source locally at your datacenter; for under $20 an attacker could deny you GPS timing.

<comment><USER5> If anyone is wondering: yes, _you_ can own your very own atomic clock for a "reasonable" price! I encourage everyone to read [0] where a father takes his kids and a few atomic clocks up a mountain and back down. By looking at the clock drift due to changes in gravity, he was able to observe relativity!

[0]: [http://leapsecond.com/great2005/](http://leapsecond.com/great2005/)

<comment><USER3> > If anyone is wondering: yes, you can own your very own atomic clock for a > "reasonable" price!

Just to clarify, the clocks used to demonstrate gravitational time dilation were on the order of $10,000 (or more, e.g., [0]). But one can find rubidium standards online for a few hundred dollars.

[0] [http://www.ebay.com/itm/HP-5061B-Cesium-Beam-Frequency- Stand...](http://www.ebay.com/itm/HP-5061B-Cesium-Beam-Frequency-Standard- Fully-Tested-and-Guaranteed-Working-/321564435988)

</comment></comment></comment></comment></comment><comment><USER6> I thought NTP was a protocol, not a piece of software. Is the article conflating them, or is there only one single implementation of it that everyone relies upon?

<comment><USER7> There is NTP the protocol[1], and there is NTP the implementation[2].

While the implementation is popular, there are alternatives. There is also OpenNTPd, chrony and ntimed for instance.

There are also alternatives to the NTP protocol too, such as PTP and SNTP.

[1][https://www.ietf.org/rfc/rfc5905.txt](https://www.ietf.org/rfc/rfc5905.txt) [2][http://www.ntp.org/](http://www.ntp.org/)

<comment><USER8> Don't forget the billion-plus machines out there running Windows Time Service (which strangely has had zero security issues I can remember, even when running in server mode).

<comment><USER9> W32Time has different kinds of issues, in my experience. With it, one's problems tend to be that, by design until _very_ recently, it doesn't provide to-the-second accuracy.

* [https://blogs.technet.microsoft.com/askds/2007/10/23/high-ac...](https://blogs.technet.microsoft.com/askds/2007/10/23/high-accuracy-w32time-requirements/)

* [https://greyware.com/software/domaintime/v5/overview/w32time...](https://greyware.com/software/domaintime/v5/overview/w32time.asp)

* [https://technet.microsoft.com/en-gb/windows-server-docs/iden...](https://technet.microsoft.com/en-gb/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-2016-accurate-time)

</comment></comment></comment></comment><comment><USER10> If you care that much about accuracy you should take a look at [https://en.wikipedia.org/wiki/Precision_Time_Protocol](https://en.wikipedia.org/wiki/Precision_Time_Protocol) ... "IEEE 1588 is designed for local systems requiring accuracies beyond those attainable using NTP".

</comment><comment><USER11> Surprised that the whole piece didn't mention roughtime, a timesetting protocol developed by Adam Langley with much better security properties (NTP basically has no security): [https://www.imperialviolet.org/2016/09/19/roughtime.html](https://www.imperialviolet.org/2016/09/19/roughtime.html)

</comment><comment><USER12> > NTP is buried so deeply in the infrastructure that practically everyone > reaps the project's benefits for free.

The most common embedded NTP implementation is probably busybox, being used on Linux routers/modems/etc.. is actually based on OpenNTPD.

[https://git.busybox.net/busybox/tree/networking/ntpd.c](https://git.busybox.net/busybox/tree/networking/ntpd.c)

</comment><comment><USER13> why dont dns servers provide this capability? seems like they are the most centralized of all the online services.

<comment><USER14> The problem isn't the service being provided, that's well handled. The problem is that the development team is woefully underfunded, incapable of keeping up with maintenance, security fixes, new design, documentation, testing, etc.

</comment></comment><comment><USER15> The alternatives are most certainly as much underfounded as the mentioned project.

</comment><comment><USER16> Classic NTP is hardly the only game in town. For example, see the NTPsec work in progress: [https://www.ntpsec.org/](https://www.ntpsec.org/) which I'll probably transition to someday, maybe even get an el-cheapo GPS receiver now that I'm not effectively living in a basement.

And I've personally be using chrony for a while, although my needs are significantly less than whatever level of accuracy it provides. There are some other clients out there as well, such as OpenBSD's OpenNTPD, although I have a vague memory of it having issues of precision, congruent with the distribution's focus on security.

<comment><USER17> My biggest issue with NTP is little control over who runs the servers. Unlike the CA system that has checks in place against bad actors, practically anyone can run an NTP pool.

It was discovered a while ago for example that some part of the Linux default NTP servers are run by shodan. So when your machine gets the time it lets shodan know you've got a server running so they can port scan you.

It would be stupid not to run a bunch of NTP servers if you wanted a to run a bot net. A free list of every running Linux server and countless IoT devices! Without having to actively scan IP space at all

<comment><USER18> NTP is more analogous to an SMTP server, HTTP server or any of the other myriad servers anyone can run on the internet with absolutely no vetting. The CA system is something different entirely. If you're confident that an NTP server is safe, don't use it. The same you would do with a potentially malicious website.</comment></comment></comment>


Cogent confirms null route of the Pirate Bay - <AUTHOR> https://mailman.nanog.org/pipermail/nanog/2017-February/090180.html <comment><USER2> This is reprehensible behavior by Cogent, and behavior that is almost certain to be abused in the future.

The follow up replies on the nanog list say it better than I can. but this is not something that I want to see a backbone provider doing.</comment>


Dear Microsoft, Don't Bail on Windows 8 - <AUTHOR> http://gizmodo.com/dear-microsoft-dont-bail-on-windows-8-499085690

<comment><USER2> I don't know why people hate on Win8 so much. It's a conceptual change, yes, going from the start button to the blocks. But if you think about it, it's not that different from launching programs from the icons on your desktop. Only now the icons can pass status info to you before they get run. So it's like a return to the Active Desktop of Win95 days (only safer)

</comment><comment><USER3> The Windows 8 UI feels much more snappy (possibly due to less animation for windows etc) and the new start menu is more comprehensive than the old one.

The metro apps, however, feel contrived and out of place, so I don't use those. Still wouldn't go back to Win7.

</comment><comment><USER4> Dear Kyle Wagner,

Stop using flat design if you have no sense of which colors compliment each other. The dark saturated colors in the top image made me puke in my mouth.</comment>


Mistakes we make using JavaScript Promises - <AUTHOR> https://www.betamark.com/blog/mistakes-using-javascript-promises/ <comment><USER3> This "solution" given here has a syntax error since you don't have access to `user` within the second then() callback:

        get("http://data.com/user")
          .then(user => get("http://data.com/location" + user.id))
          .then(location => createEntry(user, location))
          .then(response => {
            // handle response
          }).catch(err => {
            // handle failure
          });

Instead, back before async/await made things easier this nested pattern was used (notice the difference in parenthesis location):

        get("http://data.com/user")
          .then(user => get("http://data.com/location" + user.id)
            .then(location => createEntry(user, location)))
          .then(response => {
            // handle response
          }).catch(err => {
            // handle failure
          });

Edit for completeness, this is how it is now with async/await:

        try {
          const user = await get("http://data.com/user");
          const location = await get("http://data.com/location" + user.id);
          const response = await createEntry(user, location);
          // handle response
        } catch (error) {
          // handle failure
        }

<comment><USER4> Instead of subtle nesting, I would have passed through the user as part of the result of the second promise.

        get('//data.com/user)
          .then(user => resolve({user, location: get('//data.com/user')}))
          .then(({user, location}) => createEntry(user, location))
          .then(response => {
            // handle response
          }).catch(err => {
            // handle failure
          });

Async/await is much cleaner now though.

<comment><USER5> How does the resolve function work here? It is passed an object where one property is an object and the other a promise. The next then suddenly receives the resolved location..?

<comment><USER6> The argument passed to `resolve` gets returned from the resolve function and becomes available to any handler that handles it with `then`. In the above example, the object is being destructured as part of the arguments. The destructuring is probably what's tripping you up.

        // straightforward, no magic
        const simpleFunction = function() {
          return Promise.resolve({ name: 'simpleObject' });
        }

        simpleFunction().then(function(response) {
          console.log(response); // { name: 'simpleObject' }
        });

        // alternatively, destructuring the arguments
        simpleFunction().then(function({ name }) {
          console.log(name); // 'simpleObject'
        });

<comment><USER5> No that is not what is tripping me up, or happening. The other answer explained it, some library code was executed aeaiting the location-promise.

</comment></comment></comment></comment></comment><comment><USER7> With respect to Promise.all:

> In this example, both promises will be processed asynchronously and only > when both of them are resolved, we handle the result.

While that is true if all the promises resolve successfully, if _any_ of the promises get rejected the catch block gets executed as soon as the _first_ rejection occurs. Beware of that behavior, as if you're not aware of it it can leave your system in a bad state (speaking from experience, of course :)

</comment><comment><USER8> Metamask doesn't like the domain:

"Ethereum Phishing Detection"

This domain is currently on the MetaMask domain warning list

</comment><comment><USER9> Hopefully with async/await we can all put this behind us.

In my own projects, async/await has made improved readbility and reduced errors.

<comment><USER10> async/await helps a lot, but there are still a few common errors with them...

1) Not calling promises in parallel. Easy to do because it's impossible to run them in parallel with just "await", need to use Promise.all() or something.

2) Forgetting to write "await". If you try to use the return value then now you have a Promise object instead of the actual value. But the worst is when the code doesn't use the return value. Then it has a really subtle race condition that's hard to find. Or if the promise has any errors, then you might get the dreaded "Unhandled promise rejection" with a useless stack trace, and you might need to search the entire codebase to find where it happened.

<comment><USER11> For the first I wonder if we could solve this with array syntax:

       const [foo, bar] = await [async1(), async2()]

<comment><USER12> Yes, the correct syntax is:

        const [foo, bar] = await Promise.all([async1(), async2()])

</comment></comment></comment></comment><comment><USER13> Are these "common" mistakes? With basic understanding of Promises, these mistakes shouldn't happen. Also I believe #1 is wrong when using async/await.

<comment><USER14> Some older libraries will still be callback driven, and one important thing is always resolving or rejecting promise.

<comment><USER13> If it's callback driven, is it a Promise mistake or a callback mistake? I don't think it would apply here

<comment><USER14> Most of the time first thing i do is to wrap the library call in a promise. Callbacks are really bad after a few nested ones, bht promise doesnt eliminate all the problrms

</comment></comment></comment></comment><comment><USER15> _any_ function that returns a promise should have the `async` modifier - <USER2> if `await` isn't used.

A function may return a promise or throw an exception. An `async` function may only return a promise. async functions cannot throw exceptions.

``` // This code sucks but you might have to write it if `get` isn't an async function. try { get().catch(_ => /* handle async errors _/ ) } catch { /_ handle sync errors */ } ```

<comment> matt-attack Interesting about adding async. I actually didn't know it eliminated the possibility of it throwing an error. What happens if it explicitly throws an error?

<comment><USER15> An async function that throws and error will return a promise that will reject with the thrown error.

</comment></comment></comment><comment><USER16> And he makes mistake #1 in mistake #3 by running "get" sequentially instead of using Promise.all

<comment><USER17> They're all artificial examples: one could assume that the tasks in #3 are intended to be executed serially. Though there aren't any data dependencies expressed between the different calls, perhaps ordering could be important for other reasons.

<comment><USER18> I feel it should have been called out explicitly when introducing await, because the 'clean' solution in async/await code is to call each async function and then await the results where you need them - which is a pattern he doesn't hint at at all.

<comment><USER17> I think there is a danger in that approach: if you forget to await, errors are silently ignored. You can also await a Promise.all, which is reasonably good enough if you do depend on all of the results to do anything meaningful anyways.

<comment><USER18> If you need you can name your intermediate results fooPromise or something else to make it obvious that it isn't meant to be used directly.

The async article linked from this article has a toy example for this concept where the result is unused, but most of the time you would be passing the result somewhere. If you were using typescript it could fail at compile time when you try to pass a promise instead of the expected type. Even if you're not, you should notice it never work in your tests.

<comment><USER17> Sorry, by forget to await, I mean you call an async function but then don't ever actually use the result. TypeScript can also diagnose that one by illuminating unused variables.

Still, I think it is easiest to never mess up if you await as soon as you have a promise value. In many common cases this is easy enough.

</comment></comment></comment></comment></comment></comment><comment><USER19> Lots of bikeshedding about minute differences in syntax. Especially #3 rubs me the wrong way, it is all syntactic sugar, the only tangible thing you get from all this is to prevent the code from working in older browsers.

</comment><comment><USER20> I find Promises to be nothing but fancy looking syntax sugar over the callbacks. Infact, using the Async library one can write more cleaner and easy to understand code using callbacks as compared to Promises.

</comment><comment><AUTHOR> Thanks for all the feedback! I will correct the article shortly

</comment><comment><USER21> One thing I realized about async/await is that it removes the ability to use the synchronous continuation of an async function call. In return, it makes its asynchronous continuation feel synchronous. Technically, that's less power, but I realized that's almost always a good thing.

<comment><USER7> I don't understand what you're saying here. An async function just returns a Promise, that's it. You don't have to await on it immediately - you could just as easily assign it to a variable and await on it some time later.

<comment><USER21> I should really say `await`, in particular. But obviously, you can't `await` outside of an `async` function (proposed top-level `await` notwithstanding). It's true that you'll eventually get to the top of the `async` function stack and you'll have an actual Promise value, at which point, you're back in synchronous continuation land.

But point is that using `async`/`await` as much as possible restricts the programmer to less concurrency, which inevitably means fewer glitches and race conditions. Many people make the mistake of thinking that JavaScript is safe because there's only one thread. But it turns out that most of the hazards of concurrency still exist as long as continuations can interleave with access to shared resources and mutable state.

Does that make more sense? It's late over here, so I might not be super clear.</comment></comment></comment>


Insurers are putting the lives of sick and disabled at risk during COVID-19 - <AUTHOR> https://abishekmuthian.com/insurers-are-putting-the-lives-of-sick-and-disabled-at-risk-during-covid-19-pandemic/ <comment><USER2> Why do I not find this surprising?

Its almost like a state ordering COVID patients into state run nursing homes. Trimming operating costs, so to speak.

<comment><AUTHOR> What's worst is that it seems like 'If you want your insurance policy, you have to lie about your health condition'; Then they will deny the claim sighting preexisting illness.</comment></comment>


New York Is a Genuine Tech Hub - <AUTHOR> https://www.nytimes.com/2018/11/14/technology/new-york-tech-jobs-amazon-hq2.html <comment><USER2> Was it ever not a tech hub? Every time I speak with a tech person from New York I feel a hint of inferiority complex.</comment>