Hackers exploited Word flaw for months while Microsoft investigated - T-A http://www.reuters.com/article/us-microsoft-cyber-idUSKBN17S32G <comment><AUTHOR> This is why what McAfee did is ok. It was already being exploited. This got it patched and let Corp IT roll out a settings change to fix it immediately. Google's 90 day policy from its team is also sane. Letting bad bugs live on in the dark after submitting to a vendor is clearly more dangerous for everyone.

<comment><USER2> Not really, according to the article the sequence of events went

* Microsoft warned in March of active attacks

* Microsoft schedules patch for April 11th

* McAfee sees attacks on April 6th

* McAfee publicly explains how to use the exploit on April 7th

* April 9th attack-kits are publicly for sale

* April 11th Microsoft releases public patch as scheduled

McAfee fucked up here.

<comment><USER3> Microsoft was formally notified of the vulnerability in October 2016. Why leave this out of the timeline?

The researcher that found the vulnerability first noticed it in July 2016. Between July and October he had gathered even more information about the vulnerability, presumably in his interest to demonstrate how serious the matter is, as well as a likely attempt to procure as large a bug bounty as possible.

If Microsoft was presented with such a serious vulnerability and didn't address it properly for over half a year, I would say that they are the owners of the lion's share of the responsibility here.

</comment></comment></comment><comment><USER4> [https://mobile.twitter.com/hashbreaker/status/85322416941220...](https://mobile.twitter.com/hashbreaker/status/853224169412206593?p=p)

The strange "counterargument" I commonly see on HN to any suggestion that Microsoft closed source software could potentially be unsafe for use on an internet-connected computer is that the company has "improved" since some earlier 1990's/2000's time period.

Are these commenters suggesting that other, open source operating system choices have not also improved since that time period? Should one consider how much did each respective system _need_ to improve?

(By "other, open source operating system choices", I mean the ones that were able to connect to the internet for years before Gates decided the www was something his company should be interested in and to copy the TCP/IP stack from an open source kernel into the Windows kernel).

Are there convincing arguments why Microsoft deserves special treatment compared to the open source alternatives, i.e., why their users should not be permitted to freely evaluate the Windows kernel or Office source code via the public web? Are there compelling reasons why MS users should not be allowed i.e. given the _option_ to edit/remove source code they are uncomfortable with and recompile? Consider the effects of limiting the number of people who can find and fix defects in a product.

Does closed source status of Windows make Microsoft's software superior to the longstanding open source operating system alternatives?

<comment><USER5> Their users don't need to be allowed to freely evaluate the source, period. When you write software, you control its distribution.

What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of.

If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... and that has kept it back, and it kept it back long enough for microsoft to establish a de-facto standard on the home desktop market...

The closed or open source status of a product has no bearing over its superiority at all. Again, in the world of geeks, it may, but in the world at large, it doesn't, and really, it shouldn't.

<comment><USER6> "But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc"

For what it's worth (which may be not a great deal): I have installed _a lot_ of Windows and Linux over the years, but my Windows experience has been lackin further and further behind these last few years. A short while ago, I had to a rare chance of setting up two identical machines side by side, one with Windows 10, one with Manjaro, an Arch Linux derivative. The Linux install finished sooner and with less need of interference than the Windows one. It also didn't require preparatory messing round with weird licensing codes and what have you, and of course it didn't require one tenth the amount of postprocessing to reach the desired level of functionality - compare the twenty second operation of setting up a LaTeX which worked to the corresponding twenty Windows minutes of setting up one which didn't.

Your anecdotal mileage may obviously vary.

<comment><USER7> You needed twenty minues for

      choco install latexdistofchoice

?

(Yeah, I know, I'm being a bit facetious. I omitted three additional lines of PS to first install chocolatey...)

<comment><USER6> I need a lot more than twenty minutes to learn about and ascertain the validity of some third party installation robot, which your choco-thing appears to be.

I then need some minutes to get it started.

And yes, installation proces itself took something on the scale of ten to twenty minutes.

Pacman -Syu (or Pamac if you're in a clicky mood) took care of everything in less time than the BibTeX took to download download.

<comment><USER7> > I need a lot more than twenty minutes to learn about and ascertain the > validity of some third party installation robot, which your choco-thing > appears to be.

> Pacman -Syu

So it's basically "I know one system much better than the other". And your ignorance is somehow the fault of the OS now?

<comment><USER6> If you fail to understand the difference between an integrated package management system overseeing all or most software installation, and a third party bolt-on component like your chocolate robot, we may not really have the basis of a meaningful conversation here.

Anyway, I am not putting anything or anyone at fault. As clearly stated, I was relaying some anecdotal evidence of probably very littly use to the world at large.

<comment><USER7> I agree about the lack of a basis. Educate yourself.

[https://msdn.microsoft.com/en- us/powershell/reference/5.0/pa...](https://msdn.microsoft.com/en- us/powershell/reference/5.0/packagemanagement/packagemanagement)

[https://msdn.microsoft.com/en- us/powershell/reference/5.0/pa...](https://msdn.microsoft.com/en- us/powershell/reference/5.0/packagemanagement/get-packageprovider)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> "A quick change in the settings on Word by customers would do the trick, but if Microsoft notified customers about the bug and the recommended changes, it would also be telling hackers about how to break in."

In their monthly update, couldn't Microsoft have released a patch to have this setting to the correct configuration? Of course this would only be the short term solution, rather than waiting for 9 months for the permanent solution.

<comment><USER9> I guess the reason is that by studying the patch, even a short term workaround such as this, you can deduce what the vulnerability is and quickly knock out a working exploit. I'm not suggesting that security-through-obscurity was the correct choice by MS, or the time taken to build a comprehensive fix was acceptable, but from the article it seems that this has been a bit of a gnarly issue to solve properly and even a cursory fix might reveal deeper seated issues.

I'm not defending MS here, but I imagine that Word's codebase is a helluva pile of cards to work on. Especially given that it can still open document formats such as WordPerfect 5 which date back to 1988. Add in all the legacy OLE automation stuff, a VBA environment and all those shims and backwards compatibility things that MS are known for (see Old New Thing blog) that translates as "One Does Not Simply Patch Word".

</comment></comment><comment><USER10> Vendors, even ones as large as Microsoft, do not have infinite resources available to evaluate vulnerabilities. There are only so many of the issues you can work on at once. They have to evaluate each issue and prioritize the fix. In this case, they merely did not recognize the potential scope of the problem at hand.

<comment><USER11> That's true, but it doesn't matter. It's still broken.

That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause.

Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced.

What we need is a public and open way to do this that doesn't involved walled gardens.

<comment><USER12> I don't want anyone to be able to shutdown and/or withdraw software that I'm using for any reason. That cure is worse than the disease.

<comment><USER11> Personally I don't want you to have to. As far as I'm concerned, if you're notified in big, red letters (perhaps every time the software starts)? Works for me. As long as you know -- and are reminded. (That's because different people use the same software. If the notice only appeared once, a new person might start using the software/machine and not be aware of what's going on)

But if you had a piece of software with a terrible vulnerability that was currently being exploited to do some sort of terrible harm? Beats me. Does my right to use the internet without being DDOSed override your right to use unsafe software if you want?

<comment><USER13> Not sure why you're down voted. I had the same thought as parent, but this seems like the answer.

A standard splash screen on load that pops up for 10 seconds and says "this program has known active vulnerabilities that are unpatched". If people choose to ignore it, that's on them. Cheap and easy, no?

<comment><USER12> That still requires that a third party is allowed to flash things on my screen without my explicit consent.

<comment><USER11> Does it?

We already have a solution to this, which I hate: walled gardens. I'm exploring options that preserve the peace while not letting companies effectively own their users.

Maybe there is no answer that makes everybody happy. That's why it's worth asking questions.

Just so I understand this, you're saying that if you have a piece of hardware that's say, taking down the local ISP because you're running compromised software on it, you don't want to even be notified before your box is compromised or that there might be a problem.

Well, dang. Something's going to happen. That much is sure. What's the first notification you'd like that you're destroying the internet experience for others and perhaps ruining a local business? SWAT team at the door?

I hear your complaint. I'm just not able to figure out how it makes sense.

<comment><USER12> I don't want other people to be able to change things on my computer. If my setup is causing problems on their end, they have my contact information and can tell me over traditional routes. An ISP can cut off my internet connection if they detect suspicious traffic.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Even though there is a lot of work in computer security, those stories really scare me and I wonder if I would dare working in this field. I wonder if hackers already lost their life due to their work in computer security, and I would not like to fall in the crosshair of russia right now.

</comment><comment><USER15> What's more interesting than vulnerabilities being found is vulnerabilities being created. I used to think they were progressively eliminated so older software is safer. But is that true? Is MS accidentally creating new ones faster than they're patching old ones? Same goes for any software.

<comment><USER16> The answer is yes:

> _Despite being Microsoft's newest and 'most secure' operating system, > Windows 10 was found to have the highest proportion of vulnerabilities of > any OS (395), 46% more than Windows 8 and Windows 8.1 (265 each)._

[https://www.avecto.com/news-and-events/news/94-of- critical-m...](https://www.avecto.com/news-and-events/news/94-of-critical- microsoft-vulnerabilities-mitigated-by-removing-admin-rights)

And if you've used Windows 10, you'd already know that. Windows 10 has added a ton of new features/crap. The Q&A has suffered, too, and Windows 10 has been quite buggy so far, ruining some people's computers, etc.

And since we were talking about Word, here's another tidbit from the same source:

> _Microsoft Office products were the subject of 79 vulnerabilities, up from > 62 last year. This represents a 295% increase in Office vulnerabilities > since 2014._

The amount of bugs likely increases in general, too, because more code = more complexity = more bugs and bigger attack surface, especially if we're talking about "improving" or adding on top of an old codebase, as is the case with Windows and Office, as opposed to writing something from scratch (which may benefit from safer languages sometimes, newer safer architectures, etc).

</comment></comment><comment><USER17> We need civil penalties for failing to patch any serious vulnerability (that can be defined as RCE, priv. escalation, etc) within 30 days of disclosure.

If you can't patch it, you must issue a patch that announces the vuln and disables the minimal set of functionality that enables it. Even if that's the whole program.

<comment><USER18> So, turn a nontrivial set of vulns into successful DoS attacks?

<comment><USER19> Yes. That, in turn, will give the economic incentive to not have the vulnerabilities in the first place.

<comment><USER20> Or for software not to get written in the first place.

<comment><USER21> >Or for [buggy] software not to get written in the first place.

FTFY

We place too much trust and rely too much on computer systems these days to have the luxury to write software like we used to.

<comment><USER20> No don't twist my words. I meant I'm sure as hell not inventing something new if it sets me up for civil liabilities. It would kill innovation.

<comment><USER21> > meant I'm sure as hell not inventing something new if it sets me up for > civil liabilities.

And I'm arguing that not doing so might be a good thing. I shudder to think how we'd be off if other infrastructure disciplines took the same approach we take to develop software.

If you build something that people use in important infrastructure, prepare to be on the hook if it fails.

<comment><USER20> So if you write some toy PID controller for your kids LEGO project and post it to stack overflow, should you be held liable for all the places it is used?

<comment><USER21> I don't think a person should be held liable in this case because the solution was clearly labeled as a toy, and not as a serious solution.

If this person presented it as a real solution, however, then yes I believe he should be held liable, as much as a lawyer would be for recklessly giving out legal advice.

In either case, The developer who built upon the solution without validating it or verifying its correctness should bear most of the blame, regardless of how the answer was given.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> And _this_, ladies and gentlemen, is why we have disclosure deadlines for security vulnerabilities. For example, Project Zero expects vendors to fix security vulnerabilities within 90 days of notification.

Looking at this story, it's possible that 90 days is almost too long and should be shortened. As time goes on, it's becoming more and more common for multiple parties to become aware of the same vulnerabilities. Not all of those parties have good intentions, as we see here. Shortening the window of exposure is key.

<comment><USER23> Next up on HN: extreme outrage after a botched security update breaks hundreds of millions of machines. Not all bugs can be fixed with a simple one-line fix, and the faster patches need to be cranked out, the lower quality they'll be.

<comment><AUTHOR> There was a simple settings change for a temp fix on this one too. When there is even a remote chance a bug is being exploited in the wild it needs to be disclosed. Corp IT can work around it almost always. Individuals can as well. This argument that "it's complex to patch" is a non-starter at best. We the users deserve the option to decide how to deal with it. Silent exploitation is how we all lose, even the vendor.

</comment></comment></comment><comment><USER24> I thought that it is the norm for M$ to hand out the zero-days to the 3-letter-agencies for "a while" and patches them ONLY when someone else gets hold and starts using the same vuln.. so it makes PERFECT sense that they would do something like that.

Also who in their right mind allow Word/Excel/Powerpoint to access the internet? (oh yes it's called "365" and it makes software, that is completely unfit for the task, to access the internet)

<comment><USER17> Not sure why you're being downvoted. This is literally the company that built in "_NSAKEY" into the kernel, which is still present (just called "_KEY2" now.

<comment><USER25> If "_key2" is an public key embedded within Windows, then presumably there exists one or more holders of the private key somewhere - what exactly are they able to do with this key?

I've seen a lot of concern about "_key2" and "_NSAKEY" being expressed over the years, but scant technical detail.</comment></comment></comment>


Assembly Language for Beginners [pdf] - <AUTHOR> https://yurichev.com/writings/AL4B-EN.pdf <comment><USER2> I actually got paid a salary for learning & programming in IBM mainframe assembler (BAL or Basic Assembly Language) in 1970, for an insurance company. The CPU memory was so small (32K, yes 32,768 bytes) that the only way we could squeeze enough functionality was to write in assembler, with overlays (no virtual memory). Debugging consisted of manually toggling hex data and instructions at the control panel. What a blast!

It was a lot of fun, but terribly inefficient programmer productivity. I would not want to go back :o) Dereferencing registers prepared me for C pointers later.

<comment><USER3> Forgive me, but I'm struggling to understand how much useful work one could extract from a computer with only 32k of RAM. A microcontroller for an appliance, sure, but a mainframe? Could you tell us more about the work you were doing?

<comment><USER4> In 1970, a company named Telemed built an Electrocardiograph analysis service where hospitals would call in from all around the country and send ECGs over the telephone line with analog FM signals, three channels at a time. The computer located near Chicago would accept the incoming call, digitize the three analog signals every 2ms to 10 bits, write them to disk, and decode the touch-tone patient ID.

When the call was completed, the data from disk would be assembled into a full ECG record and written to tape, and simultaneously passed to the diagnostic program written in Fortran. The system would then initiate a phone call to the hospital's printer and print out an English-language diagnostic. The result was then available in ten minutes to the staff a the hospital.

The front end and back end was all Sigma 5 (first SDS then Xerox midrange real-time computer) assembler in an interrupt-rich process--one interrupt every 2ms for the analog, one interrupt for the disk write complete, interrupts for the tape record writing, interrupts for the outgoing phone call progress. This included an cost optimization process that would choose which line (this was in the days of WATS lines) based on desired response time. The middle was the Fortran program that would analyze the waveforms, identifying all the ECG wave forms--P-wave, QRS, and T-Wave--the height, duration, sometimes slope.

This all took place in a machine with 32k words (four bytes per word). There were two computers, one nominally used for development, but could be hot- switched if the other failed. I think downtime was on the order of an hour per year. This would have been called an Expert System, but I don't think the term was in common use as yet.

So the answer to your question is: "A considerable amount". Today we are all spoiled by environments with more memory on one machine than existed in the entire world at that time.

<comment><USER3> Thank you, that's brilliant! It is unfortunate that the source code is lost to humanity, as an example of what is possible.

<comment><USER4> Ah, I could replicate it with a bunch of time and likely emulators. There wasn't anything secret about it, just good engineering with an innovation or two. The one that was the coolest was to use coroutines to kind of invert the inner loop. In the middle of the loop was a macro call that said "Get interrupt from the OS" which simply translated as a WAIT that would fire when the particular interrupt came in. We wrapped coroutine around this to properly save and restore state.

By the way, this was significantly easier than what folks have to go through with C or using that dratted asynsc/await pattern.

This particular code that used the coroutine was the outbound call processing low-level stuff. I was second fiddle on that one, and the lead was a fellow who is quoted in TAOCP. We had zero single-thread errors and one multi-thread error when we stood it up. Keep in mind that this was in the days of no debuggers other than console switches.

</comment></comment></comment></comment></comment><comment><USER5> Maybe too much content? 1000+ pages, many architectures... Probably too much content for a beginner book?

Btw, a great book imho is "Assembly Language Step By Step - Programming with Linux - 3rd ed" ([https://musho.tk/l/d2d56a34](https://musho.tk/l/d2d56a34)).

The great things is that it is an easy read and really starts from the basic and explains how the i386 architecture works, and then explains how to program it using assembly.

The sad thing is that afaik the author is quite old and probably is not going to release a 4th edition, meaning that the book will stay on intel i386.

<comment><USER6> I have the first or second edition of "Assembly Language Step By Step", and it's the best intro I know of.

It must be difficult to write a good assembly book. On one hand there's a lot of basics to cover, like memory addressing, segmentation registers, etc. But on the other hand, the main use case for it today is hand optimized functions for when the compiler can't optimize enough, which is inherently an advanced topic.

<comment><USER7> There is another use: Understanding compiler behavior and reverse engineering. Those mostly need reading skills.

</comment></comment></comment><comment><USER8> The fact that the document targets multiple architectures is great, most ASM tutorials online target solely x86 and as such give a very partial view of how assembly is written and how CPUs work, and on top of that x86 ASM is really quite a mess.

I've skimmed the document and it seems rather thorough and doesn't shy away from all the nasty details (which is a good thing for an ASM tutorial), the only criticism I have so far is that the assembly listings are a bit hard to read, additional whitespace and basic syntax highlighting (at least to isolate the comments) would make it a bit easier on the eyes I think, for instance: [https://svkt.org/~simias/up/20180717-151848_asm- listing.png](https://svkt.org/~simias/up/20180717-151848_asm-listing.png)

<comment><USER9> Yep, I was very happy to see the ARM and MIPS output. Syntax highlighting is a great idea. It didn't even bother me but this is coming from a guy that had a hard copy print out of the 386 programmers reference.

</comment></comment><comment><USER10> This seems to the same text as the author's Reverse Engineering for Beginners ([https://beginners.re/](https://beginners.re/))

[https://news.ycombinator.com/from?site=beginners.re](https://news.ycombinator.com/from?site=beginners.re)

<comment><USER11> Yeah, I'm a little confused about this "build" of the pdf. It clearly states: "The latest version (and Russian edition) of this text is accessible at beginners.re." \- which points to: [https://github.com/DennisYurichev/RE-for- beginners](https://github.com/DennisYurichev/RE-for-beginners)

But as far as I can tell there's no branch with a different name - maybe this was just a working title for the English version at some point?

Anyway, this new submission with a new title made take a look, so I'm happy :)

Now, I just hope someone takes a crack at forcing an epub build for better reflow/resize on small screens...

There's a (dormant?) issue: [https://github.com/DennisYurichev/RE-for- beginners/issues/37...](https://github.com/DennisYurichev/RE-for- beginners/issues/371)

<comment><USER3> The title pages are different. The Reverse Engineering book's title text is hex digits, and is dated July 9, 2018. The Assembly Language book's title page is English text, and is dated today, July 17, 2018. And there is no mention of the Assembly Language book on his home page, yurichev.com.

</comment></comment></comment><comment><USER12> At one point when I was considerably younger I started learning 32-bit x86 assembly as my very naive career goal was to become the next Linux Torvalds. I managed to construct a multiboot-compliant 32-bit kernel that could load tasks from a ext2 ramdisk image passed to the bootloader and multitask up to around 64 processes. I figured out how to use the CR3 register and craft page tables, enter into kernel syscalls using software interrupts, handle CPU faults, page faults, double faults etc. It was quite the learning experience until it eventually crumbled under my lack of skill and foresight. In short, I got more or less about as far as most amateur, self-taught, lone OS developers get before losing interest and giving up.

Fast forward a couple of decades, and I found myself reverse engineering CP/M for the Z80 processor in order to create a virtual Z80-based system that ran inside Unreal Engine. I started with Udo Munk's wonderful Z80pack system, adapted a public domain Z80 CPU emulator which was written in C to C++, and did minimal reimplementation of the Z80pack terminal and disk I/O devices. Since the systems were implemented as "actors" in UE4 it's possible to spawn and run quite a few concurrently as long as you limit the CPU speed of each instance somewhat.

The resulting virtual system in UE4 is able to run original CP/M ports of Rogue and Zork ([https://i.imgur.com/gnOCp3e.png](https://i.imgur.com/gnOCp3e.png)), various Z80 instruction exercisers ([https://i.imgur.com/kwNuq5X.png](https://i.imgur.com/kwNuq5X.png)), a Z80 C compiler and and even Wordstar 4 ([https://i.imgur.com/Q6307w3.jpg](https://i.imgur.com/Q6307w3.jpg)) and Microsoft BASIC.

Learning assembly can be a lot of fun - it can really teach you quite a bit about systems architecture that you otherwise might not get if you're always programming in high-level languages only.

<comment><USER13> Have you published a plugin or the source? Sounds very interesting for using in computers inside the game (as in Fallout and the like).

<comment><USER12> I'd like to but it would still take quite a bit of work to make it production quality code, and I don't really have the time right now. One day I hope.

</comment></comment></comment><comment><USER14> My god, 1000+ pages. What a great submission though. I wonder what kind of things keep such people motivated to write one fuckin' thousand and eighty two pages about assembly!? This is nuts.

<comment><USER15> I don't think it's nuts to share such depth of knowledge. I greatly welcome the knowledge, too. I legitimately am wondering what sort of project I could take up that would be "small enough", only do-able in asm/c, and interesting.

<comment><USER16> Think "nuts" was used as an endearing compliment there. Like "insane" in the sense of "insanely good".

</comment></comment></comment><comment><USER17> Old school, but I've always enjoyed this gentle introduction:

[https://chortle.ccsu.edu/AssemblyTutorial/index.html](https://chortle.ccsu.edu/AssemblyTutorial/index.html)

<comment><USER18> That looks nice. People learning hardware, too, might follow-it up with a study of Plasma MIPS:

[https://opencores.org/project/plasma](https://opencores.org/project/plasma)

Then, they'll understand at least one architecture inside and out. Plus be able to customize it to their liking. :)

</comment></comment><comment><USER19> Amazing. One of my fondest memories is when, at age 10-11, I "played" Core War [0] with an older friend of mine (he was 20-21 back then, and a CS student at one of the best CS universities in Italy, Pisa). I loved to learn how to program in a game-like environment. I still remember several things, ~30 years later.

[0]: [https://en.wikipedia.org/wiki/Core_War](https://en.wikipedia.org/wiki/Core_War)

</comment><comment> g-b-r DiffPDF 2.1.3 finds only two tiny (if weird) differences in the appearance of the two versions of the books ([https://yurichev.com/writings/AL4B-EN.pdf](https://yurichev.com/writings/AL4B-EN.pdf) and [https://beginners.re/RE4B-EN.pdf](https://beginners.re/RE4B-EN.pdf)) besides the title, author and build date: two page references at pages 1075 and 1078.

Since both sites appear to be owned by the book's author this is most likely just a change that has not yet been pushed to github (or mentioned in the author's sites), but it would be better if the author clarified it (would that be you, dennis714?)

<comment><AUTHOR> Yes. Explanation: [https://yurichev.com/blog/UAL/](https://yurichev.com/blog/UAL/)

</comment></comment><comment><USER20> Godbolt is my favorite goto for "What would this look like in assembly" answer websites.

<comment><USER21> That will only tell you what a compiler will generate, though, which sometimes isn't enough.

</comment></comment><comment><USER22> I got interested in assembly fairly early on my programming career by playing wargames(io.smashthestack.org anyone?). Writing exploit payloads was very fun. After that in my career i have only written assembly to vectorize some code using neon.

I think the best reason to learn assembly is not to write rather be able to read compiler output.

</comment><comment><USER23> This is a great resource. I don't think it is for beginners, it is a bit overwhelming. But as a programmer who has to dive into asm every few months (on a variety of architectures!), this will be a very helpful reference to help me reset my frame of mind for the particular architecture.

</comment><comment><USER24> I feel like 6502 assembly is probably better for beginners, but that might be because that's what I'm trying to teach myself...

<comment><USER25> This sentiment is one of the reasons why I didn't bother in the past: it's apparently so complex that I have to learn something completely different and useless these days, before I can start learning something useful. I'd much rather just deep dive into x86_64 or ARM or something.

These days I know that older versions are still (partly?) included in x86_64 and that they're often mostly the same, but that was not clear to me when I saw tutorials for ancient architectures of which I didn't see the point.

But then, I've never taken well to the school system where you get taught something stupid first only to see practical applications later. It's why I dropped out of high school and went to do something of which I did see the use (a sysadmin 'study', because I knew I enjoyed working with computers, and that was indeed a good fit for me).

<comment><USER24> Saying that 6502 is useless is a bit harsh- I wouldn't call it an employable skill, but it's great for hobbyists who are into retrocomputing (like me).

You could deep dive into x86_64 or ARM, but in the general case you would never actually code in those (i.e., most folks trust the compiler) unless you were writing a driver or writing something with crazy performance like MenuetOS.

<comment><USER18> "Saying that 6502 is useless is a bit harsh. I wouldn't call it an employable skill"

It must be both useful and a job skill for some people:

[https://wdc65xx.com/chips/](https://wdc65xx.com/chips/)

I wouldn't study it to _get_ a job. There's apparently still utility in it, though, with WDC's versions of it.

</comment></comment></comment></comment><comment><USER26> Now do that for the GPU.

<comment><USER27> To be fair to NVIDIA, they have done a pretty good job here.

[https://docs.nvidia.com/cuda/parallel-thread- execution/index...](https://docs.nvidia.com/cuda/parallel-thread- execution/index.htmlbg)

<comment><USER28> I thought that PTX is an intermediate format, kind of like a Nvidia specific LLVM bitcode for GPUs.

</comment></comment></comment><comment><USER29> Great share. I have been curious about assembly languages for a while. Hopefully it's not to technical for someone without a CS background.

<comment><USER30> 13 year old kids figure it out. I was one of them, and I'm an idiot more days than I care to admit. Granted, it was 6502 assembly, but later I'd be able to sift my through x86, before it went completely nuts.

<comment><USER31> I think my motivation for learning 65C02 assembly back in the day was necessity. To take advantage of the Apple //e at any reasonable speed I had to. Besides 65C02 was simple, as was 16 bit x86. Things got a lot more complicated and the necessity went down.

</comment></comment></comment><comment><USER32> Great resource! It brings me back to the early days of the web, poring over "Fravia's Pages of Reverse Engineering".

</comment><comment><USER33> I've never had a desire to learn about Assembly, but I thought the first few pages of this book were kinda interesting, and I might end up learning more than I had ever cared to.

</comment><comment><USER34> This looks great! Thank you for sharing :)

</comment><comment><USER35> Nice basic intro to assembler, as a person from some electronics background it fits with knowledge of simpler architectures

</comment><comment><USER36> Thanks for the recommendation.

</comment><comment><USER37> Thank you. This is a godsend.

</comment><comment><USER38> Nice!

</comment><comment><USER39> Nice share! Thanks

</comment><comment><USER40> This isn't for beginners. What beginner's assembly text covers multiple architectures and assembly flavors?

My recommendation for beginner's assembly on linux is to write toy code in C and then view the disassembly in gdb or objdump. You have options to switch to Intel syntax from GAS/AT&T if you want.

I'm generally against using windows for anything, but Visual Studio has decent disassembly debug options where you can step through the native assembly code. You could also look at IL code ( which is very similar to native assembly ) and learn assembly concepts that way. ildasm and ilasm are great tools for that.

Assembly is so low level and can be intimidating to write from scratch in the beginning. It's better for beginners to write code in a higher level language like C and then read the compiler generated assembly code. Once they are comfortable with a disassembly of a "hello world" program, then write more complicated code and understand the disassembly. Then try to edit and compile the disassembled code. Once you are comfortable, then write your own assembly code from scratch.

Edit: Also, if you have time and the will, watch the nand2tetris lectures and try their projects. It'll give you a hands-on general overview of hardware to assembly to VM to OO. How native assembly works with hardware. How VM interacts with native assembly. How you go from OO to VM? It's a very limited but educational overview of code flow from object oriented code all the way to circuitry ( software circuitry ).

<comment><USER32> The book literally follows this process starting on page 5.</comment></comment>


Show HN: Checkbot for Chrome – web crawler that tests for web best practices - <AUTHOR> https://www.checkbot.io <comment><USER2> Very cool. I'm giving it a quick go whilst doing yet another patchathon on customer systems.

First impressions are that it is very quick and gives some great advice. I'm not really a web. dev. but I even I can see how this can make a good audit tool. Looks great as well.

I suggest caution against using the term "best practice" though. It's one of my pet hates - there is good practice and there is bad practice but its a brave person who claims to know best practice. I think my hatred of that term stems from seeing it plastered all over older MS docs and the usual crop of "me too" copy n paste blog postings that litter the web, not to mention various forum postings. We're all bloody experts who know best in this game 8)

<comment><USER3> I agree, it runs nicely, and is nicely presented. The term best practice does irk me. But weirdly enough I think the use of that term is why I decided to give it a go.

<comment><USER4> Love-hate relationship with marketing is probably pretty common in this crowd!

</comment></comment></comment><comment><USER5> Nice. very similar to Lighthouse [https://developers.google.com/web/tools/lighthouse/#devtools](https://developers.google.com/web/tools/lighthouse/#devtools)

<comment><USER6> Similar feature-set at first glance, but not open-source, not free after beta ends, and created/maintained by an unknown solo developer. Nice site design, but I think the cards are pretty heavily stacked against this one.

<comment><AUTHOR> The big difference is Checkbot crawls whole websites as opposed to checking a single page at a time. The Checkbot interface is designed around helping you hunt down issues that impact groups of pages and pages you didn't think to check. For example, this lets you find duplicate title/description/content issues and root out pages with broken links and invalid HTML you don't look at often.

<comment><USER6> That does sound like a key differentiating feature, thanks for clarifying. While I'd probably prefer to hook up an open-source web-crawler to lighthouse (e.g., something like github/lightcrawler [1]), I could see SEO/marketing experts in particular paying for a user-friendly all-in-one solution like this versus cobbling something together from open-source tools.

[1] [https://github.com/github/lightcrawler](https://github.com/github/lightcrawler)

<comment><AUTHOR> Yes, so I think the UI is a really important factor here in terms of productivity and ease of use. For example, after Checkbot has scanned your localhost/development site and identified a page has the same title as other pages, you can edit your site, hit the "recrawl" button for that page and confirm your fix worked in a few seconds. Users I've worked with so far have really appreciated this fast and simple workflow.

</comment></comment></comment></comment></comment><comment><USER7> Very cool.

I noticed that it's mangling some of my URLs, though.

`/!0ead1aEq` is getting turned into `/%210ead1aEq` (the exclamation point is getting percent-encoded), which leads to a bunch of spurious 404 errors.

[https://tools.ietf.org/html/rfc3986#section-3.3](https://tools.ietf.org/html/rfc3986#section-3.3)

<comment><AUTHOR> Ah, thanks a good bug report! I'll get this fixed.

</comment></comment><comment><AUTHOR> Hi, I didn't get much feedback when I posted last time so I'm giving it another try. This is aimed at helping web developers follow SEO, performance and security best practices so I'd love to know what the community thinks. Can you think of any changes that would make Checkbot more helpful? Did you notice any bugs? Thanks!

<comment><USER8> Cool, I'm checking it out right now. Can you share what your tool provides that others don't?

<comment><AUTHOR> The major one is that instead of manually checking pages one at a time, Checkbot lets you easily test 1,000s of pages in a few minutes to root out issues you'd normally miss. As you're doing web crawls from your own machine, you can also crawl any site you want as often as you want including localhost/development, staging and production sites. This lets you identify issues early and confirm fixes during development before problems go live.

<comment><USER8> Interesting. So the intent is to tackle problems before deployment. Do you plan on any devtools integrations so it can be used as part of an automatic CI/CD process? Also, does Checkbot dig into all dependancies or skip them like some others?

<comment><AUTHOR> > Interesting. So the intent is to tackle problems before deployment. Do you > plan on any devtools integrations so it can be used as part of an automatic > CI/CD process?

A lot of the time, websites owners don't know there's a problem until their search results or Google Search Console updates. So I'm seeing it being used by developers to check localhost/development sites, then on staging for other problems, then on production when changes are made there. A command-line version to support CI/CD is something I'm really interested in as well.

> Also, does Checkbot dig into all dependancies or skip them like some others?

Can you expand on what you mean here?

</comment></comment></comment></comment></comment><comment><USER9> Seems really cool, I like this. One issue I'm having so far though is that after crawling my site it found one 404, and the link is (my domain)/page-not- found-test. It also says there's 0 inlinks to it, so I have no idea where it's getting the idea for this page from. It doesn't exist, but I've never linked to anything like it?

</comment><comment><USER10> I rapidly tested it. It's staying on my chrome. Good Job.

<comment><AUTHOR> Thanks, let me know how you get on!

</comment></comment><comment><USER11> Very nicely thought through and implemented i agree with you on the best practice point. Already forwarded to few folks and going to stay with my browser.

<comment><AUTHOR> Thanks! Let me know if you can think of any improvements I can make.

</comment></comment><comment><USER12> Works pretty good. Incidentally, I just locked myself from my own server. This double as a security tester! :o)

<comment><AUTHOR> On the left sidebar at the start you can modify the number of URLs crawled per second if that helps!

</comment></comment><comment><USER13> It's nice and fast! Are you actually using chrome to render each page or making requests some other way?

<comment><AUTHOR> Thanks! All requests are done from your own browser if that's what you mean.

<comment><USER13> No, I mean like render the whole page with JS and all, but from your FAQ it seems like you're not. Which is why it's fast, ha.

</comment></comment></comment><comment><USER14> Is there a version that works on Firefox?

</comment><comment><USER15> Awesome

</comment><comment><USER16> Really cool stuff. Here's some initial feedback:

"Avoid internal link redirects" -> All the errors I'm getting on my site are due to the login-wall on some of the pages because it's detecting /account/login/?next=... links as internal redirects.

"Use unique titles" / "Set page descriptions" / "Avoid URL parameters" / "Avoid thin content pages" / etc -> Same problem as above with login walls ("Sign in to ..."). I get why, but it's adding a ton of noise. I added /account/login to URLs to ignore but it didn't achieve anything, I'm guessing I must have misunderstood the syntax or it has to be an exact match or some such?

"Avoid inline JavaScript" -> I'm making quite a bit of use of the <script type="application/json" id="foo"/> pattern, which allows me to declare json objects in the body I can later parse in my scripts. This pattern doesn't have all the issues carried with inline js. Can you ignore script tags where the type= is unknown or application/json\ __?

hsts preload: This is picking up individual pages on the checked site as errors, even though hsts preload really is a domain-wide thing.

"Hide server version data" -> This is picking up "server: cloudflare" as an error. Means no site behind cloudflare will ever pass this which seems overkill.

"Use lowercase URLs" -> So, on my site you can access objects with IDs like youtube's (/id/vZEz7JoNnfgVo...). It's picking up all those as errors. Feels wrong?

UI: Not a fan of the "x inlinks / y outlinks / headers / recrawl / html / copy" links below the URLs on the results page. Low contrast, unclear what I'm clicking and where it's gonna take me. The "copy" button: What am I copying? (Clearly the URL as I tried it, but that'd be more useful as a clipboard button next to the URL for example)

Finally, I ran it on my company's blog and it ended up crawling a ton of the company's various exosites on different domains which wasn't super useful, especially since none of it showed up in the final results.

Hey, this is a really great tool. Fast, slick UI and very clear what it does. I'll keep an eye on it and would love to see what else it can do in the future.

Pricing: It's hard to see myself pay for this; not because it's not worth it (I think it is easily worth a dozen USD / site checked), but because it's so easy to look at what it does and think "Yeah, but, I can probably do all that myself, and if I don't, it's not so important that I need to pay for a tool to tell me what to fix". I think this is the curse of developing products targeted at developers: Devs will tend to think "I can do this myself // I don't need this". In fact, if you hook me up with a free account, I'll use it a bunch ;)

Shoot me an email (see profile) if you want to talk through some more feedback (especially UX feedback). You just provided me with a pretty cool service for free so I feel I have to give back :)

<comment><AUTHOR> Awesome, thanks for the detailed feedback! As you can probably imagine, tweaking the rules to work with every imaginable website configuration is an ongoing process so this is super helpful.

> All the errors I'm getting on my site are due to the login-wall on some of > the pages because it's detecting /account/login/?next=... links as internal > redirects.

> "Use unique titles" / "Set page descriptions" / "Avoid URL parameters" / > "Avoid thin content pages" / etc

Allowing Checkbot to login could help but I'll look into how to improve this.

> "Avoid inline JavaScript" -> I'm making quite a bit of use of the <script > type="application/json" id="foo"/>

Ah, thanks, this is an easy fix. I'm planning to add structured data checks in the future as well because checking you've configured these correctly on all your pages is cumbersome.

> "Hide server version data" -> This is picking up "server: cloudflare" as an > error. Means no site behind cloudflare will ever pass this which seems > overkill.

Yes, for what it's worth this is defined as "low priority" internally and the rule description is written to emphasise this. I could change it to only fire when there's version numbers in the headers perhaps. I agree knowing you're using Cloudflare isn't a big deal but some servers will advertise very specific OS and PHP versions for example.

> "Use lowercase URLs" -> So, on my site you can access objects with IDs like > youtube's (/id/vZEz7JoNnfgVo...). It's picking up all those as errors. Feels > wrong?

Yes, I'll need to think how to avoid that case. It's a good general rule when you're writing human readable URLs however so I wouldn't want to disable it completely.

> UI: Not a fan of the "x inlinks / y outlinks / headers / recrawl / html / > copy" links below the URLs on the results page. Low contrast, unclear what > I'm clicking and where it's gonna take me. The "copy" button: What am I > copying? (Clearly the URL as I tried it, but that'd be more useful as a > clipboard button next to the URL for example)

Hmm, any more suggestions on what to change here? I made these links prominent because they were common user actions and added tooltips to them to help describe what they do. I agree it's not completely obvious what they do at first but there's only so much space available. I experimented with only showing these when you hover over a table cell. I do want to add more shortcuts in the future such as a quick way to look up a URL on Google or on archive.org so I'll likely have a "more" button for extra options later.

> Finally, I ran it on my company's blog and it ended up crawling a ton of the > company's various exosites on different domains which wasn't super useful, > especially since none of it showed up in the final results.

Can you give more details here? Checkbot will probe <a href="..."> links to check they're working for example but shouldn't spider sites that are considered external. I originally had it crawling subdomains of the start URL but changed that default because it wasn't what most people wanted.

> Shoot me an email (see profile) if you want to talk through some more > feedback (especially UX feedback).

Great, let's keep in contact (see my profile as well)! Hopefully it's obvious UX is important to me too. It's been challenging to find a balance in showing the right amount of information on the screen while battling with the horizontal space constraints you get with long URLs. The "Avoid temporary redirects" report is a good example of this e.g. for each row, you want to know the redirect status code, the start URL, redirect destination and redirect path.

<comment><USER16> > _Allowing Checkbot to login could help but I 'll look into how to improve > this._

Wouldn't help in my scenario FWIW, my site is oauth-only login.

> _Hmm, any more suggestions on what to change here?_

I move the copy link into a clipboard button next to the url (like Github's "clipboard" button next to URLs), and make the remainder of the links prominent buttons. I would also avoid taking users to a separate page when clicking any of them; rather, open a "sub view" below the url (eg a nested list).

If you have less-often-used actions, you could also add a "..." menu on the right side, or next to the buttons.

> _Can you give more details here_

Try it against articles.hsreplay.net and look at all the URLs it ends up checking against, you'll see what I mean. It didn't end up spidering all of hsreplay.net, but it did go through a ton of it.

<comment><AUTHOR> > Wouldn't help in my scenario FWIW, my site is oauth-only login.

Would being able to set cookies or sending custom headers help?

> Try it against articles.hsreplay.net and look at all the URLs it ends up > checking against, you'll see what I mean. It didn't end up spidering all of > hsreplay.net, but it did go through a ton of it.

Hmm, so if you check "Explore" -> "External URLs" there's a ton of external links being checked for this URL. I'm not sure what you could do here except excluding hsreplay.net URLs from being checked.

Thanks for the other tips and examples, I'm actively working on this.

<comment><USER16> > _Would being able to set cookies or sending custom headers help?_

I don't think so. And if it's for SEO purposes, I don't care; these pages won't get crawled by Google anyway. I'm ok ignoring the URLs, but it'd be nice if maybe for example you detect there's a bunch of redirects to a pattern that contains "~login~" and ask the user if they want to add the login URL to the blocklist. I didn't have much success adding it myself.

<comment><AUTHOR> > these pages won't get crawled by Google anyway.

Hmm, how do you indicate this to Google? I'm thinking about how you could tell Checkbot to ignore pages like this.

> I didn't have much success adding it myself.

The "URL patterns to ignore" setting is just a JavaScript regex string if that helps. It needs some help text at a minimum.

A common scenario I see as well is you start a crawl, see the URLs flying by and think "oops, don't want to crawl those URLs". A cancel button would help but hopefully more can be done.

<comment><USER16> > _Hmm, how do you indicate this to Google? I 'm thinking about how you could > tell Checkbot to ignore pages like this._

I don't. I'm not sure how Google picks up on the fact that they're login walls. Maybe it's heuristics? Someone better at SEO than me could explain.

Re URLs to ignore: Ok, I see, that wasn't clear though. My two-fold suggestion is 1. Add a way to specify plain loose matching (eg. just /account/login/, skip the url parameters, etc) and 2. let me add that pattern after the urls have already been crawled (and make sure I can see which URLs are affected).

Keep in mind that this is pretty raw feedback and you know your product better than me, but I definitely don't think the URLs to ignore is usable right now.

I'm off to bed, I hope all that helped. :)

<comment><AUTHOR> > I don't. I'm not sure how Google picks up on the fact that they're login > walls. Maybe it's heuristics? Someone better at SEO than me could explain.

Google is likely following the redirect to the login page and seeing that the login page text isn't relevant to your search results at a guess. It's not a big deal if Google hides those pages but in Checkbot perhaps those are pages you want to examine so I'll need to think about what to do here.

> Keep in mind that this is pretty raw feedback and you know your product > better than me

This kind of feedback is amazing so keep it coming! Knowing the first thing you thought before taking the time to fully investigate a feature is super useful because most users would be gone already if they were confused.

> but I definitely don't think the URLs to ignore is usable right now.

Yes, fully agree with that. I think if you're dealing with regexes, you want a way to test them as it's too easy to make a mistake.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Hi, I have downloaded already but didn't test it yet. I will test as soon as I can.</comment>


Augmented reality powers a cognitive assistant for the blind - <AUTHOR> https://elifesciences.org/articles/37841 <comment><AUTHOR> Check out 'Video 1' under Results. It shows a man navigating through a building not known to him, guided by the AR calling out to him using spatial positioning of the voices.</comment>


Ask HN: How do you manage redux at scale? - <AUTHOR> Question for all the redux or Rx.js users...
How do you efficiently manage your state/actions when it gets super complicated?
I don't mean in terms of performance though, I'm interested in terms of how you make it so your codebase is still scaleable.
I've worked on/built 4 front-end apps now that were 100k+ lines of code and it always seems like redux becomes a large blockade to refactoring/features at some point.
It seems great if you know exactly what your code should do..but when you're a startup and refactoring features every couple months, it feels like Redux can actually hurt you more than help you.
I just had to trace down a component interaction that bubbled up to its parent component that called an action def that then was thrown in an action func thats outcome ran through a reducer that was monitored by an rxjs observable.. And all of this was just to remove an element from a page. I've got 7 files open and it took me 10 mins to trace something trivial down.
In scrappier times, I'd just call the $.delete and .remove() the element. Two small pieces of code, could even stick them in a React component and call it a day. If I needed to refactor the behavior, I could just open up it up and find it in a few seconds
I know redux is crazy powerful and can make some things really awesome and I've seen it first hand..my last team built a dope Redux app that was handling thousands of stock ticker updates a second with crazy performance. That said... it creates such a web of structure that it feels super hard to untangle when you need to change your state structure or refactor behavior around an action.
tl;dr keep me from switching back to vanilla js and the stone age <comment><USER2> It's hard to say what's going wrong without looking at actual code, but here are a few anti patterns to look out for:

DON'T use actions like methods or setters.

DO try to think of actions as simple events.

DON'T describe the -effect- of an action in its payload.

DO describe the -cause- of potential effects in the payload, and let your reducers handle the rest.

DON'T think of stores as singletons that you can poke at from the UI.

DO think of stores as convenient "views" into the full history of events in your app.

DON'T use actions as a way of announcing that some piece of state has changed. That's what `subscribe` is for.

Here's a great talk about scaling Flux: [https://youtu.be/Dm9NgjR5Jn4](https://youtu.be/Dm9NgjR5Jn4)</comment>


Ask HN: Best way to develop multi platform apps? - <AUTHOR> I was thinking of using Electron but see that a lot of people complain about it (memory hog, slow.. just saw it again in the slack thread).
Previously I used Adobe Air (long back) but it too suffered from same issues.
So what is the best way to create an app that can be compiled and distributed on Windows(exe), Macos (dmg), Android (apk), iOS (ipa?), Linux easily? <comment><USER2> [https://www.wxwidgets.org/about/](https://www.wxwidgets.org/about/)

</comment><comment><USER3> You can try qt.io (using qml)</comment>


Commit Logs from Last Night - <AUTHOR> http://www.commitlogsfromlastnight.com <comment><USER2> shit, shit, shit, shit, shit, shit

and ufck: [https://github.com/MannySchneck/parcheesi/commit/cb355025d6f...](https://github.com/MannySchneck/parcheesi/commit/cb355025d6f50c1e77eb702be75ed7333bcc8bbe)

</comment><comment><USER3> "Rewriting the Behemoth vaginal scene." not what I expected...</comment>


Show HN: Code Notes – A Gatsby theme for publishing code-related notes - <AUTHOR> https://zander.wtf/blog/code-notes-release <comment><USER2> Looks cool! I have been using Docusaurus[0] for this same exact use case for a while and although the primary use case is for documentation, the experience of writing notes is great too. You can write your notes in either MDX or Markdown. Search can be added using Algolia DocSearch[1] and deployment to GitHub Pages or Netlify or similar static site hosting platforms is a breeze. The only thing it's lacking is tags which I'm sure can be added with a little bit of work.

[0] [https://v2.docusaurus.io/](https://v2.docusaurus.io/)

[1] [https://github.com/algolia/docsearch](https://github.com/algolia/docsearch)

Notes: [https://rsapkf.github.io/notes/](https://rsapkf.github.io/notes/)

<comment><USER3> Docusaurus is so cool!

Probably a bit overkill for a simple blog, but it should be evaluated whenever someone is looking for a end-user friendly doc generator.

</comment></comment><comment><USER4> I've enjoyed all the recent HN posts about notetaking software! (Roam, org- roam, Obsidian, Zettlr, Code Notes...)

It seems the main point of Code Notes is to serve a static site, but I'd love to see the author turn it into an editor by hooking up a ProseMirror [2] instance :)

Out of curiosity, what solutions do others use for tags/categorization/full- text search of their notes? Code Notes seems to use FlexSearch.js [1].

[1]: [https://github.com/nextapps-de/flexsearch](https://github.com/nextapps- de/flexsearch) [2]: [https://prosemirror.net/](https://prosemirror.net/)

<comment><USER5> We're building a new note app on top of Quill. ProseMirror is great but it's lacking a little in out of box usability. We'll consider moving to another editor as we get more traction.

In our app, we have a dynamic flexsearch index for full text search, and support for filtering by tags in multiple ways while also doing full text search.

There are 3 techniques for categorizing. One, called contexts, is like a separate notebook. Tags and note data are totally separate from each other in each context. Within a context you have mentions (for people) and topics. Topics support heirarchy, so you can have Projects as well as projects/NoteBrook, as deeply nested as you want, and you can search for any level of nesting.

The search engine then supports full text search along with AND for tags at the same time.

If you register for an account, you also get instant sync to all your devices.

A new version is coming out this weekend, we're still in alpha. The next version will have note favoriting, deleting, and editing, along with some better workflow for nested tags. We expect to launch the Beta in June with apps on every major platform (desktop and mobile).

If you have a chance to give us a try, please let us know how you like it! [https://NoteBrook.app](https://NoteBrook.app) and the early access code is ALPHA2020. Email us at hello at NoteBrook.com

<comment><USER4> Looks great, I'll try to check again in a few days for the new version!

Other than tags/search, one thing that is very important to me is "first- class" math support, where I can enter LaTeX math notation that renders inline, but which behaves like text whenever the cursor enters the math block. In general, I always appreciate when editors locally "act like" a plain text file near the cursor, but abstract away all the markup wherever I'm not directly editing. Two editors that get this right are Typora (inline-level editing) and Jupyter notebooks (block-level editing).

I agree that ProseMirror has a steep learning curve, and there aren't currently enough open-source extensions available. Hopefully, with time, enough standard components will emerge. In the future, I hope to see a ProseMirror-backed drop-in Markdown editor become the default for browser- based editing.

ProseMirror doesn't currently have standard support for wysiwyg-math, but I've recently been working to change that [1]:

[1]: proof of concept: [https://codesandbox.io/s/quizzical- austin-m7n3t?file=/src/in...](https://codesandbox.io/s/quizzical- austin-m7n3t?file=/src/index.ts)

<comment><USER5> Thanks for the kind comments! I will put your vote in for this feature and bookmark the link for future reference. Our focus is on expanding the feature set in ways that are more emergent, so the UI stays very clean and straightforward and features that users don't use don't clutter up the interface. This seems like a good candidate for a feature that could be only available to those who need it and not affect the workflow of others by working similarly to the # flow.

Would a good workflow be to type a hot key to pop open a full screen editor for the math notation, like how the # or @ work when typed? Perhaps with a live preview as you type?

What would be a reasonable key to trigger that, is there a standard trigger key for math like there is @ for people and # for hashtags?

<comment><USER4> Normally there are two types of math: inline and block. Inline math is delimited with single dollar signs like $x+y=5$, while display math uses two dollar signs with newlines, like

        $$
        \int_a^b f'(x) dx = f(b)-f(a)
        $$

You can find some GIFs of the ideal behavior here [1], but it's understandable that such a thing might not be a priority for most users.

The next best thing would definitely be a popup! A natural toggle button would be $, though it may make more sense to only insert math on a quick double-tap of $, so users can still write about money :). Assigning it to CTRL+4 or similar might also be a good compromise.

[1]: [https://github.com/benrbray/prosemirror- math](https://github.com/benrbray/prosemirror-math)

</comment></comment></comment></comment></comment><comment><USER6> This is a neat theme and site.

I have a a google doc called "unix commands" that I just add stuff onto. It started as a text file in my home directory 30 years ago and has grown to pretty much any snippet of code.

I control+F to find stuff and that works ok. I'm not sure the level of effort to reformat to this theme would pay off in benefits of easier search and reuse.

<comment><AUTHOR> All notes in my theme are essentially markdown, so you'd have to convert what you've got. There would be an up front cost, but I think that the benefit might be worth it. Having said that, as you can see by the discussion on this thread, each person has their own preference for how they keep notes.

</comment></comment><comment><USER7> Two things I look for in a note-taking app:

\- How quickly can I create/update/delete

\- How easily can I search and read

I love how you have solved the second part. I have to ask, how do you handle the first part?

Do you keep one editor always open to quickly edit the markdown files?

<comment><USER5> We've got an app we're building, currently in alpha, that is tuned for both of these requirements. It is also super easy to get started. Try it out at [https://NoteBrook.app](https://NoteBrook.app) early access code ALPHA2020. The version in production right now has real time sync, full text search, and heirarchical tags for organization. Note creation is super streamlined and on mobile you just hit enter 3 times at the end of a note to create it. On desktop, you use ctrl+enter.

Email us at hello at NoteBrook dot com if you want to be on the mailing list. New version launching this weekend with favoriting, deleting, and editing support. Beta out by end of month with apps on every major platform.

We are obsessed in our design with making everything as fast and streamlined as possible. For example, deleting notes is similar to gmail where it instant deletes instead of showing you a modal of "are you sure?", but gives you an "undo" snack bar at the bottom if you didn't mean to delete it, and you can search and find the note later with a deleted note filter if you ever do want to undelete it later. There is not a separate "note list" view, you can always see the full text of recent notes and can search filter all from a single page. Our entire side menu is just signup/login/sign out right now, everything else about the app is driven from the main UI!

Please give it a try and let us know what you think we should add next. Right now, we're planning on adding image and file upload, markdown and code support, and full screen editors after we launch the beta with apps.

<comment><USER7> Sure, I signed up. Trying it out!

</comment></comment></comment><comment><USER8> Looking good! I'm currently using [Notable]([https://github.com/notable/notable](https://github.com/notable/notable)) for markdown-based note-taking. I have its root directory pushed to a Git repo to sync across multiple machines, working well so far.

</comment><comment><USER3> Looks cool!

To add a alternative: Docsify

It's not optimized for notes(tags are missing), but it does offer a large amount of community addons: [https://docsify.js.org/#/awesome](https://docsify.js.org/#/awesome)

<comment> m-localhost This reminds me a bit of mdwiki [http://dynalon.github.io/mdwiki/#!index.md](http://dynalon.github.io/mdwiki/#!index.md) which was just an index.html in a folder of markdown files.

</comment></comment><comment><USER9> That line doesn't work:

        git clone email@example.com:MrMartineau/gatsby-starter-code-notes.git code-notes

but this one does:

        git clone https://github.com/MrMartineau/gatsby-starter-code-notes

<comment><AUTHOR> Thanks for catching this. Not sure how I managed to make that error. Fixing it now.

</comment></comment><comment><USER10> who honestly keeps "notes" like this

<comment><USER11> It's something I haven't tried because I can already predict the outcome. I'd get into for a few weeks, I'd put a bunch of stuff in there, but I wouldn't be able to break the muscle memory of just using Google/DDG when I need to know something. Then I'd inevitably give up.

Respect to those who do it and it works for them though.

<comment><USER12> Ever came up with your own snippet when Google/DDG search failed to deliver?

<comment><USER11> Absolutely but then the answer I need is in git.</comment></comment></comment></comment>


Sci-Hub, spiritual successor to Aaron Swartz, angering publishers all over again - <AUTHOR> http://arstechnica.com/tech-policy/2016/04/a-spiritual-successor-to-aaron-swartz-is-angering-publishers-all-over-again/ <comment><USER3> So many of these discussions take it for granted that publishers don't do anything of value. This blog post, by an open access advocate, was for me very illuminating on what value they actually add ([http://cameronneylon.net/blog/polecon-of-oa-publishing-i- wha...](http://cameronneylon.net/blog/polecon-of-oa-publishing-i-what-is-it- publishers-do-anyway/))

Quoting from that link: "One of the big challenges is discussing the costs and value added in managing peer review is that researchers who engage in this conversation tend to be amongst the best editors and referees. Professional publishers on the other hand tend to focus on the (relatively small number of) contributors, who are, not to put too fine a point on it, awful. Good academic editors tend to select good referees who do good work, and when they encounter a bad referee they discount it and move on. Professional staff spend the majority of their time dealing with editors who have gone AWOL, referees who are late in responding, or who turn out to be inappropriate either in what they have written or their conflicts of interest, or increasingly who don't even exist! .... Much of the irritation you see from publishers when talking about why managing peer review is more than "sending a few emails" relates to this gap in perception. The irony is that the problems are largely invisible to the broader community because publishers keep them under wraps, hidden away so that they don't bother the community."

I'm sure there must be some way to achieve this and also make the content freely available. But whatever system replaces the current one has to deal with these issues too.

<comment><USER4> > I'm sure there must be some way to achieve this and also make the content > freely available. But whatever system replaces the current one has to deal > with these issues too.

Post-publication peer review could solve all of these (and the access issue too!). I'm still not convinced of the superiority of pre-publication review by only 3 (usually quite busy) people max.

<comment><USER5> I don't understand. What is the difference between post-publication peer review and no peer review? What is a journal for if the papers are not peer reviewed?

<comment><USER6> The simplest workflow I can think of:

1) Publish with no review

2) Open for review

3) If review is passed, tag as reviewed and bundle all those into a special reviewed section (which can be cited)

4) Reserve the right to remove from reviewed (some later reviewer finds major flaws etc.)

You'd have to handle the dynamic nature of papers (git-like) but in essence I'm thinking of a website with "all submitted papers" and a checkbox for "reviewed papers only". I think that would be valuable and people would likely leave the checkbox on by default.

I'm also curious if the review has to be blind in this model. I think it would be more valuable if the reviewers actually signed with their names and the review feedback was open as well. Shifts the value from being in a prestigious journal to being successfully reviewed by a smart/reputable person. Ideally doing these reviews would then become reputation building as well.

</comment></comment></comment></comment><comment><USER7> Sci-Hub has been discussed a great deal on HN:

[https://hn.algolia.com/?query=sci- hub&sort=byPopularity&pref...](https://hn.algolia.com/?query=sci- hub&sort=byPopularity&prefix&page=0&dateRange=all&type=story)

There were other major threads that don't come up in that search, e.g.:

[https://news.ycombinator.com/item?id=11279903](https://news.ycombinator.com/item?id=11279903)

[https://news.ycombinator.com/item?id=11074638](https://news.ycombinator.com/item?id=11074638)

[https://news.ycombinator.com/item?id=11070192](https://news.ycombinator.com/item?id=11070192)

[https://news.ycombinator.com/item?id=10424276](https://news.ycombinator.com/item?id=10424276)

But the current article looks like it adds new information, so we won't treat it as a dupe.

<comment><USER8> You are going to make ColinWright very happy if you show up all the dupes like this :-)

<comment><USER7> It was but a small portion of all the dupes.

<comment><USER8> :-) Do you have an internal tool that helps you find dupe stories?

I personally don't mind duplicates because the conversation on most HN articles is usually very insightful and almost always interesting. In fact, I often go back to old stories just to read the comments. I'd love to go back to old duplicate stories just for that reason :-)

</comment></comment></comment></comment><comment><USER4> the parallels to swartz sound like overdramatization. she created the website for people (like me) who dont have access to all the libraries and dont want to spend a lifetime searching colleagues with access. there is just too much science nowadays to justify paywalling it. its a very practical matter for scientists to be well informed. i am split whether i like this publicity. on the one hand, it may lead to closing it down, on the other hand it might finally force the hand of regulators against _the scientists who publish only behind paywalls_.

To anyone who tries to defend elsevier here on the grounds of capitalist justice: hold your horses, you are defending a greedy corporation that offers nothing to science. think about this: the fee for making a paper 'open access' in , say, cell journals is $5000 per paper, even though elsevier does not pay the writer, does not write or format the paper, does not edit any images, does not review the content, does not correct the paper. i.e. you pay $5000 for hosting one pdf file, possibly 2 (it gets worse, some grants e.g. the erc grants require open access and high impact factor, hence shelling more money to elsevier). this is not an issue of copyright, its about an outright crazy system which forces scientists behind paywalls because funding sources explicitly require it.

if you think only commercial publishers have the gift of curating good science, look at elife, an open access journal with reasonable fees, a great website, and multiple high profile papers already. please dont defend businesses that are literally potentially harming your health.

<comment><USER9> Defend Elsevier? I think not.

I am currently working with a startup that has to do with prescription drug refilling. Obviously, interactions between drugs and such can have fatal consequences if not understood, so we responsibly are providing that information to our users.

Elsevier provides an API for that data, but wanted to charge around _$40k /year_ for access. Our business model is of course free to users (we charge the pharmacies a modest monthly fee)

$40k/yr simply too damn high...so potentially life-and-health saving information is kept from the people whom need it the most.

Yes we did eventually find a lower cost provider, but as far as shedding tears for Elsevier?

Hell fucking no.

<comment><USER10> Suppose you needed 40k/yr of AWS computing time and couldn't afford it. And suppose someone hacked into AWS and redistributed it for free.

As far as I can tell, if the argument you made is correct, you should support the same argument that says the AWS hacker is right.

(To address the two obvious rebuttals, viz 1. Marginal cost and 2. Sci hub is getting data from those who have a subscription, merely in violation of ToS:

1\. Marginal cost for AWS is likely low, if there's any unused CPU time. 2\. Change the scenario slightly to someone signing up for a bunch of free AWS accounts and handing those out. )

<comment><USER9> My "argument", if I was even making one, was that the cost to Elsevier to provide an API, is a _tiny_ fraction of $40k/yr, and thus their business practices and model is all about rent-seeking and not about saving peoples lives, which I personally find disgusting.

<comment><USER10> If hypothetically, Amazon was making 80% margins on AWS, would that make them disgusting?

Edit: note that Elsevier's margins are around 30-40%; I don't know if the particular API you wanted has higher margins.

<comment><USER9> In general, no, unless of course they were using that margin in a way that endangered low-income people's health.

I mean really...I can't believe I have to defend this position.

There is _obviously_ certain types of data that should be provided as a public service to all of society...is this even to be debated?

<comment><USER11> This.

It is part of the fabric of scientific research that findings are shared. Science is overtly collaborative. Every scientists specifically builds on the knowledge of others, and shares what they discover with the world.

Governments and a variety of organizations fund research with the express purpose of discovering new knowledge that ultimately benefits everyone.

That's the WHOLE POINT of publishing a paper. At a fundamental level, scientific publishing is about trying to share the results of your research with the scientific community.

The funding is tied to the act of publishing, having nothing to do with how people consume the papers. Charging people above cost to read the published research is antithetical to the whole idea of how the world does science.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> So what about scientific textbooks? Not undergraduate ones, but the really narrow topic ones that are used in graduate classes as reference materials for professionals. They're frequently written by author(s) who are partly to fully funded on government grants, and they too are very expensive, as some journal articles are. Are these fair game for distribution on Sci-Hub too?

<comment><USER13> I don't think anyone who has written such a book has ever made a significant profit from it. The attitude among researchers in my field, at least, is that all such books are a labor of love.

With this in mind, it sounds like a perfect use case for sci-hub.

<comment><USER14> Among the academics I work with there is general disgust with the likes of Elsevier. Uni pays them to do research. Then has to pay again to Elsevier et al to use it for teaching.

Swartz created the push for open access (and bad reporting that this ars article doesn't mention the mass resignations at Elsevier over that issue as far as I can see)

So this site is only a good thing in my opinion.

<comment><USER15> Lingua's Editors & Editorial Board Members: [http://www.aplu.org/news-and- media/News/aplu-statement-on-re...](http://www.aplu.org/news-and- media/News/aplu-statement-on-resignation-of-linguas-editors--editorial-board- members-in-protest-of-elseviers-pricing-policies)

Elsevier response: [https://www.elsevier.com/connect/addressing-the- resignation-...](https://www.elsevier.com/connect/addressing-the-resignation- of-the-lingua-editorial-board)

<comment><USER14> You see. Right there: ... The article publishing charge at Lingua for open access articles is $1,800 USD. The editors had requested a price of 400 euros, an APC that is not sustainable.

.. Morons are as good as claiming Wikipedia is not sustainable because they don't charge editors 1800$ to edit an article...

</comment></comment></comment></comment></comment><comment><USER16> Perhaps controversially, I'd say this is one of the biggest problems facing the world today (ie. inaccessible research papers).

Where is the real money and influence that we need in order to change this?

<comment><USER17> > Where is the real money and influence that we need in order to change this?

Civil disobedience

</comment></comment><comment><USER18> I typed in a doi to a paper I co-authored, and I was proud to see my work pop up. So it works.

</comment><comment><USER19> Interesting, time to research Robert K. Merton to understand deeper: _" The world is broken, and money always wins. [...] I would like to reference Robert K. Merton, the founder of sociology of science. He studied ethos of research communities. And what he found is that communism is one of the four important ethical norms (along with universalism, disinterested, and organized skepticism) that makes science work. By communism, he meant the common ownership of scientific discoveries, according to which scientists give up intellectual property in exchange for recognition. I think that his work is very relevant to what is happening in science now."_

<comment><USER19> BTW, here's Merton's explanation [pdf]: ([http://sciencepolicy.colorado.edu/students/envs_5110/merton_...](http://sciencepolicy.colorado.edu/students/envs_5110/merton_sociology_science.pdf))

</comment></comment><comment><USER20> This is like an mp3 search engine for academic research.

Is there a Soundcloud for academic research? Sounds like a no-brainer idea to me.. with comments and annotation possible against the actual text. Also, users could also upload audio (eg podcasts) and video (eg lectures and presentations).

You could build up really powerful communities as well that could peer-review on demand (for a fee.)

Quora has shown that experts can gain a following on a single site.

Maybe some type of open-source site for different areas-of-study that is unified in a single mega-site (like Jobberbase was at one point.)

<comment><USER21> > comments and annotation possible against the actual text

fermats library does this and allows users to suggest papers for discussion. Most papers listed are high profile, though community participation seems low, not the best ux. Highest commented story has 62 comments on 'Ideal Money' by John Nash. [http://fermatslibrary.com/](http://fermatslibrary.com/)

<comment><USER20> Thanks for link.

I think comments do add value, especially for the author looking for feedback, moreso than perhaps the reader. Soundcloud has time-based comments on tracks and also general comments. Both are important. Amazon's book reviews also work well.

Another important aspect of research is references/bibliography and it would be great to have an in-text access to a reference. eg a popup that can reveal the exact quote or piece of text that a paper is referring to. Doing reference cross-checks is something that can be very tedious but could be great at locating additional and interesting material for the reader.

Surely this use-case has been addressed in current journal UX..

</comment></comment></comment><comment><USER22> I would like to reiterate my points that I've made in a different HN submission on the topic [1]: Alexandra isn't in any way similar to Aaron Swartz, she's an opportunistic supporter of an oppressive regime. She is playing an "activist hero" card now, but in reality she's not even close to an "activist" in a common Western sense.

[1]: [https://news.ycombinator.com/item?id=11180762](https://news.ycombinator.com/item?id=11180762)

<comment><USER4> I agree that there are no parallels with Swarz, but it's true that inadvertedly her site has caused more stir and more impact than 15+ years of pushing for open access publishing. The ad hominem does not change that.

<comment><USER22> I totally agree with you on serendipity of scihub. However, it's the "Robin Hood" attitude (it's ad hominem right from the start) that disgusts me, and the linked article has a lot of it.

</comment></comment></comment><comment><USER23> To play devil's advocate, how is this kind of "civil disobedience" going to change the system? Why not pursue ways to legally change the system, e.g. new regulation on academic publishing?

<comment><USER8> The deck is stacked against those who want to change the system in such a way. Those who make massive profits from the existing system will fight tooth and nail to keep regulations from changing the system, and so any litigant or lobbyist for open academic publishing will be at a significant disadvantage from the very start.

Basically, civil disobedience on a grand scale that changes the entire market for academic publishing is the only real way to effectively change the system for the better.

Ironic really. If companies like Elsevier had charged reasonable prices for academic papers from the very start, then this would never have been as big an impact - certainly it wouldn't have been an existential threat to them.

I for one won't be crying any tears when such companies are rubbed out of existence.

<comment><USER23> The deck is stacked both ways it seems, just look to how Aaron Swartz was treated...

Another thing to consider is what market forces are at play in academic publishing. For authors, the currency is prestige and career advancement, and it's not clear how scihub could change that part of the market.

</comment></comment></comment><comment><USER24> I applaud this woman. What she does is brave and constructive. Sci-hub is a fantastic tool, easy to use and pleasant.

</comment><comment><USER25> It'd be great if it were implemented as a peer-to-peer protocol as it'd make taking the service down much more difficult.

EDIT:

Although making the service completely peer-to-peer might be impossible, it is possible to distribute articles in a peer-to-peer way. I'm considering an architecture which consists of a peer-to-peer network to share articles, and servers to download articles and put them on the network. In this architecture, even if all the servers got taken down at least the articles which have been shared would be accessible provided that the peer-to-peer network is alive.

<comment><USER26> Sci-Hub and other open access advocacy things are practically the ideal use case for IPFS. One and done. Whoever implements it, you're welcome for the idea.

Especially with Internet Archive involvement, IPFS should be quite compelling these days, even in its infancy.

</comment></comment><comment><USER27> I hope they can also make this into a common platform for commenting and asking questions about scientific papers.

Yes, there have been efforts that try to accomplish this, but something like this only works well if everybody is using it.

Perhaps wishful thinking, but I believe it would be fantastic if every scientific paper had a "home" on Sci-Hub.

<comment><USER4> She already has enough in her hands keeping this up. Someone will have to lend a hand (her being in russia seems to be deterring some).

P.s. now that you mentioned it, i had started building something like that: [https://sciboards.com/](https://sciboards.com/)

<comment><USER27> It seems you could be the perfect person to help her out :)

</comment></comment></comment><comment><USER28> How about open access but curation is the paid service?

Wouldn't that satisfy the publishers? If they are as good at curation as they say then they should be very happy

</comment><comment><USER27> Wouldn't it be much safer for her to put all the content on bittorrent? Or would there be a lack of seeders?

<comment><USER29> Library Genesis has torrent & edonkey URL's.

Yes, lack of seeders is a problem.

</comment></comment><comment><USER30> While there are plenty of problems with academic publishing, and the notion of making articles free and easily accessible is one I can certainly support, I do not see the rending such articles as free as a grand step in the general increase of knowledge as so many seem to think.

Making the articles available to all is not the same as educating all. You are only opening the gates to the niche crowd that already has some level of access to at least some of the articles via institutions. The level of background competence required to read academic work is what keeps the world ignorant and ensures the success and increasing erudition of the few. Unless you can devise a means of not only making academic material accessible but also eminently readable you are only, in mass archiving papers, preaching to the choir, so to speak.

You are making it easier for what is already a niche crowd to remain a niche crowd. Nothing more. Nothing less.

I'm not implying that this is something that shouldn't be done, nor am I saying it's not commendable to a degree, but I am suggesting the glorification that's heaped on this sort of thing, "free information from its chains—to give it to the masses free of charge." and "research Robin Hood" is a little gross when there are astounding issues with education at the ground level which prevent masses of people from getting into academic circles in the first place.

Furthermore, many people see: Big bad useless publisher. while that's true to some degree, far too many people ignore the complexities involved in publication proceeders. Sometimes careful and well-considered revision of existing systems is a better approach than outright anarchy and noble liberation of information.

When you dismantle one mechanism of publication you must implement another. The sheer volume of research that is published prevents any completely unguided system from being that effective. We could go back to old ways, wherein some journals were edited by an executive editor so to speak, but that doesn't seem so great either. Peer review has a lot of flaws, but to simply hope that publication will just work itself out when our current infrastructures are bypassed is far too naive in my view.

Even with peer review systems, gatekeeping, and money grubbing publishers academic dishonesty and turning over of papers, snuffing of other's works, and popularity contests all occur. Do we really expect such problems to disappear and not get potentially 10x worse in a completely open system? I'm not trying to advocate anything in particular here; not conservation of current, admittedly broken practice, nor radical upheaval and dissolution of all systematic forms of publishing. I am only trying to point out that publishing is a complex issue that is too frequently under-analyzed and, furthermore, it is assumed far too frequently that complete and unrestricted access to information, and complete freedom to publish anything whatsoever sans constricting publication or review procedure is automatically a good ting.

<comment><USER8> This argument doesn't make any sense. How is making publications that costs lots of money available to everyone "making it easier for what is already a niche crowd to remain a niche crowd"?

Your issue seems to be that there are problems with teaching people properly, but that's not making things worse for those who work outside academia - <USER2> anything, it's making it easier!

</comment></comment><comment><USER31> This is all about violating a license/copyright law. If we were talking about a large company using GNU/copyleft code and not sharing their changes back to the community, many people in the community would be demanding the law get involved (the Thesis Wordpress theme is a great example of this..which caused anger and outright hatred about 5 years ago in the HN community).

It's really difficult for me to stand behind any community that doesn't put all licenses on an equal footing. If you want the government to stop going after you for copyright infringement, you shouldn't be then using those same tactics to go after people violating the terms of your license.

This girl, Like Aaron Swartz, is nothing but a petty thief. It's pretty easy to put up a website with stolen papers/content.

The other issue is that it takes millions of dollars to fund the research for many of these papers. With no incentive to make money on the research, companies will either stop the research, or it will go completely private and there will be no access for anyone.

Many of these online revolutionaries really seem to understand how the world actually works. If you want to change it, start a research company and actually do the research yourself.

<comment><AUTHOR> > The other issue is that it takes millions of dollars to fund the research > for many of these papers. With no incentive to make money on the research, > companies will either stop the research, or it will go completely private > and there will be no access for anyone.

Most of the basic research being published is government funded and is conducted by universities or other academic entities, not companies. The publishing companies (Elsevier) aren't conducting any of the research; for the most part they are simply hosting manuscripts.</comment></comment>


'Ulysses' on Trial - <AUTHOR> https://www.nybooks.com/articles/2019/09/26/ulysses-on-trial/ <comment><USER2> was I the only one who thought of the app Ulysses and opinions about trial versions when I saw the title?

<comment><USER3> You need to read more bro</comment></comment>


What About Dick: Eric Idle releases film as a Louis CK-style $5 download - <AUTHOR> https://whataboutdick.com/

<comment><USER2> Fantastic. :D</comment>


Show HN: ts-prune – Find unused exports in a TypeScript project - <AUTHOR> https://github.com/nadeesha/ts-prune <comment><USER2> Ran against our production code, in under 1 minute the script finished and found 13 unused exports. I call that a success!

It also found a few false positives (module.ts files which are used in _app- rounting.module_ ) but that's an easy thing to check.

Excellent project!

<comment><AUTHOR> Thank you! Glad you found it useful.</comment></comment>


Did 40-year-old Viking experiment discover life on Mars? - <AUTHOR> http://phys.org/news/2016-10-year-old-viking-life-mars.html <comment><USER2> I often wonder why no microscope is ever sent to another planet?

<comment><USER2> Its been talked about for years apparently: [https://ntrs.nasa.gov/search.jsp?R=19740004389](https://ntrs.nasa.gov/search.jsp?R=19740004389)</comment></comment>


Ask HN: Do you have a yearly plan for your SaaS app? - <AUTHOR>

Just curious about this one.
I ran a yearly plan test for a month.  My findings were that this actually made for fewer conversions on the plans page, I assume because of the paradox of choice - people didn't know what to go for (the yearly plan was much better value than the monthly plan) and simply gave up trying to choose.
So I got rid of the yearly plan.
The irony of course is that the handful of customers who did choose the yearly plan actually contributed to one of my best months in terms of revenue.
Has anyone run tests like this?  What were your findings? <comment><USER2> _The irony of course is that the handful of customers who did choose the yearly plan actually contributed to one of my best months in terms of revenue_

I'm not an accountant, but you should recognize that revenue over the life of the subscription, not all in one month. The revenue you collect from a client signing up for a year's worth of service will have to pay for 12 months of expenses that the client generates, plus a reserve fund to pay for refunds, etc.

Take the example of a web hosting reseller with a $20/mo plan or $200/year. Each client costs $10/mo (bandwidth, storage, maintenance, support). If I get a client on the annual plan, I can't count that $200 as "money in the bank" because I'll have to consider that $10/mo in expenses ($120), plus the possibility that he'll request a refund after 3 months.

The solution is to collect the $200 now but recognize it in $16.67 monthly increments for the life of the annual subscription.

<comment><AUTHOR> true, and as as an accounting major I should know better (sadly I spent all my time playing Counterstrike instead of studying).

your example is sound, but using it as a model I guess my question is how do you weigh up what is more important:

1) Guaranteed 12x $16.67 payments over a year or 2) Monthly $20 payments where the customer can cancel at any time

This is the kind of thing that attrition / churn rates can help answer but - as is the case with many apps here I think - it's still early days and we just don't have reliable data for that kind of thing with only 2 or 3 months of operations under our belts.

</comment></comment><comment><USER3> How long did you run the test for? The reason I ask is I pay monthly for backpack (37signals) and after 4 months I'm considering a yearly plan. 37signals offer a lump sum option which to me is an even better option.

tl;dr: New signups may like the yearly plan after a few months, and lump sum payments (maby with varied discounts) may be something to consider.</comment>