Ask HN: Which VPN? - <AUTHOR> Which VPN do you recommend? <comment><USER2> This is a great resource for comparing VPN options, with a focus on privacy and security: [https://thatoneprivacysite.net/vpn- section/](https://thatoneprivacysite.net/vpn-section/)

Be wary of folks recommending individual services... the VPN market has been hot in the last few years, and most recommendations should be treated with a fair bit of skepticism.

<comment><USER3> That was a great site. I liked the option for a colorblind readable chart, I have a few colleagues that have to use plugins and other weird gadgets differentiate red and green. Also bonus point for the CC license.

</comment></comment><comment><USER4> IVPN (Gribaltar), Mullvad (Sweden) or PIA (U.S.) are the best bet for most users IMO. They are all fast, no logging, and have good apps.

IVPN, Mullvad are not in U.S. jurisdiction if you are concerned about that. Most people are not and just want a VPN to hide shit from ISP, etc...

Although PIA is U.S. based, they keep no logs and then they have their famous "FBI" case which they did not provide anything to them.

I myself personally use IVPN, but I have used Mullvad as well.

[https://thatoneprivacysite.net/vpn- section/](https://thatoneprivacysite.net/vpn-section/)

This is the best resource for vpn reviews, ignore everything else.

Also [https://www.privacytools.io/](https://www.privacytools.io/) is great overall and they do have a vpn section

[https://www.reddit.com/r/VPN/](https://www.reddit.com/r/VPN/) has a bunch of more info as well.

<comment><USER5> > Although PIA is U.S. based, they keep no logs and then they have their > famous "FBI" case which they did not provide anything to them.

You know the NSA just puts a gag order and connects directly to the targets infrastructure. Doesn't matter that PIA doesn't keep logs, NSA's prism is logging everything.

<comment><USER6> I do not know this and many others probably do not. Would be great to see a source with proof that this has happened with PIA.

<comment><USER7> Just stay away from USA. They can do anything they like with their dumb laws.

</comment></comment></comment></comment><comment><USER8> Lots of prior info available

[https://news.ycombinator.com/item?id=14974383](https://news.ycombinator.com/item?id=14974383)

[https://news.ycombinator.com/item?id=13425728](https://news.ycombinator.com/item?id=13425728)

[https://news.ycombinator.com/item?id=13249523](https://news.ycombinator.com/item?id=13249523)

Also DIY options :

[https://github.com/ttlequals0/autovpn](https://github.com/ttlequals0/autovpn)

[https://github.com/jlund/streisand](https://github.com/jlund/streisand)

[https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

[https://github.com/Nyr/openvpn-install](https://github.com/Nyr/openvpn- install)

[https://github.com/robbintt/popup-openvpn](https://github.com/robbintt/popup- openvpn)

[https://github.com/sovereign/sovereign](https://github.com/sovereign/sovereign)

</comment><comment><USER9> I have a Streisand[1] server running at DO, it's been good. People also like Algo[2] but I haven't tried it.

1: [https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand)

2: [https://github.com/trailofbits/algo](https://github.com/trailofbits/algo)

<comment><USER10> Algo all day every day, good stuff, use it.

<comment><USER11> Yep, this.

</comment></comment></comment><comment><USER12> I use a self-hosted OpenVPN install on a Digital Ocean droplet to simply encrypt traffic (UDP/443) from my ISP. One plus is that I have a clean US IP address that isn't blocked by most services. This is just for security and geolocation, not anonymity.

For anonymity I use Private Internet Access as they have a fast network, lots of locations, and no logs. They're also very affordable.

I also use IPredator sometimes since they're the same folks that run Njalla and I simply like to support them.

</comment><comment><USER13> I haven't used it extensively, but so far MullvadVPN has worked well for me and they are one of thatoneprivacysite's top recommendations

<comment><USER14> I'm using Mullvad. On the plus side, their servers are the most reliable I have seen, and they provide IPv6 addresses (behind NAT, which is reasonable for privacy). On the minus side, since November 2017 they intercept DNS queries and answer them themselves (hence you can not use DNS service of your choice), unless you connect to a specific undocumented OpenVPN port (1400 or 1401) available on a small but diverse subset of their servers.

<comment><USER13> Interesting. Good info to know. Have they specified a reason for intercepting DNS?

<comment><USER14> I believe I can quote the response to my support request:

«We added iptables rules to hijack all DNS requests on port 53 going via the VPN tunnel, this is to protect users having set a DNS server unknowingly (or by malware). We are aware that not all users want this behaviour, and we intend to add an extra port that OpenVPN listens on, where DNS hijacking will not happen.»

Some VPN providers (including Mullvad) have a client-side feature called DNS leak protection that configures the system to use the provider's DNS server. I don't know how Mullvad decided that this was not enough, and they are justified to intercept DNS. (Note that for the server-side intervention to work, the client side must be configured not to use ISP DNS, hence the client- side DNS leak protection is a prerequisite.)

</comment></comment></comment></comment><comment><USER15> NordVPN -- it's one of the best IMO for security/company location. I also made my decision via the spreadsheets and analysis from the already-mentioned [https://thatoneprivacysite.net/vpn- section/](https://thatoneprivacysite.net/vpn-section/)

It's $79 for two years, but they also have per-month subscriptions.

<comment><USER16> I got turned off by their tv commercials. They are really marketing towards the "clean your PC" crowd

<comment><USER17> Their tv commercials are so bad I got turned off by vpn.

</comment></comment></comment><comment><USER18> There's no reason for anyone even moderately saavy to use a commercial private VPN. It's really insecure and expensive. Just use Streisand on a DigitalOcean droplet, AWS, etc.

[https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand)

<comment><USER19> Tunnelling through a hosting provider doesn't provide any additional privacy. It just moves your exposure.

Perhaps I am unusual, but I trust my ISP with my privacy more than I trust the typical hosting provider.

I understand that this doesn't apply to most of the US because of your monopolistic ISP problem. In other places though, I don't think a blanket "just tunnel through a hosting provider" recommendation is appropriate.

<comment><USER18> >Perhaps I am unusual, but I trust my ISP with my privacy more than I trust the typical hosting provider.

You're lucky in this regard. Having no choice but Comcast, the number one threat to my privacy is my ISP. So that makes tunneling to an outside VPN very useful. I trust DigitalOcean far more. Although in a different situation I think you're absolutely right.

</comment></comment></comment><comment> m-p-3 Depends what is more important to you.

If it's for anonimity I've been told PIA is a good option.

If it's to bypass georestriction and protect your traffic from being snooped by your ISP or any clients that could attempt to sniff your traffic, hosting your own on a VPS is a good option. OpenVPN, OCserv or Outline (based on shadowsocks) are some options.

Links

\-----

[https://openvpn.net/index.php/download/community- downloads.h...](https://openvpn.net/index.php/download/community- downloads.html)

[https://ocserv.gitlab.io/www/features.html](https://ocserv.gitlab.io/www/features.html)

[https://openvpn.net/index.php/download/community- downloads.h...](https://openvpn.net/index.php/download/community- downloads.html)

[https://getoutline.org/](https://getoutline.org/)

[https://www.shadowsocks.org/en/index.html](https://www.shadowsocks.org/en/index.html)

</comment><comment><USER20> To answer "Which VPN?" you first need to answer "Why VPN?" because there are a lot of different reasons for using a VPN.

If it's just privacy from snooping, you'll be fine with setting up your own VPS with OpenVPN. It's simple enough that any technical person can do it in a few minutes (or hours).

</comment><comment><USER21> Azirevpn[1] (Swedish based) Always been very fast for me. One of the first to implement wireguard I think, which they offer for free at the moment, tho I pay anyway for the service...

1: [https://www.azirevpn.com](https://www.azirevpn.com)

</comment><comment><USER22> Any VPN is better than no VPN. But I use Private Internet Access. The interface has gotten really slick in the last year - very nice to use. You can pay using random anonymous gift cards (essentially cash). And they are the only VPN that has been tested in the court of law (they were ordered to turn over all the records they had on a customer, and they did - nothing).

<comment><USER9> PIA also donates to FOSS projects/organizations[1] and has open-sourced some of their own projects[2]

1: [https://sfconservancy.org/news/2016/mar/02/PIA-LCA- matched/](https://sfconservancy.org/news/2016/mar/02/PIA-LCA-matched/)

2: [https://pia-foss.github.io/](https://pia-foss.github.io/)

<comment><USER2> PIA is also US-based, which makes it a no-go for some folks since they fall under US jurisdiction.

</comment></comment></comment><comment><USER23> What's the purpose of the VPN? If travelling to China or other strictly censored countries, I'd recommend [https://foxshadowsocks.com](https://foxshadowsocks.com)

</comment><comment><USER24> ProtonVPN is super good

<comment><USER25> And there's the free tier which has served me well too.

<comment><USER24> If you sign up you get native mac client (beta)! Really good piece of software, much more teliable than Tunnelblick

</comment></comment></comment><comment><USER26> Check these links:

[https://torrentfreak.com/vpn-services-keep- anonymous-2018/](https://torrentfreak.com/vpn-services-keep-anonymous-2018/)

[https://thatoneprivacysite.net/vpn-comparison- chart/](https://thatoneprivacysite.net/vpn-comparison-chart/)

[http://vpnspeedtest.org/](http://vpnspeedtest.org/)

</comment><comment><USER27> Express VPN if you don't want to bother with setting up your own server.

If you want to setup your own server, then Streisand.

I used both and they work well. Using ExpressVPN right now in China.

</comment><comment><USER28> Proton VPN is rock solid. I recently made the full switch off gmail to Proton email, and signed up for the VPN as well. It's worked great so far.

</comment><comment><USER27> Don't use strongVPN. They shared my info. Got a letter from some Hollywood lawyers after someone had been running a torrent download over my VPN (would share my WiFi on and off from my phone with visiting colleagues, if they had trouble with our corporate VPN and someone probably had a movie torrent download or seed running in the background by mistake).

</comment><comment><USER29> Vague question can only lead to a vague answer, but I've been happy with AirVPN.org for my particular use case and needs.

</comment><comment><USER30> TorrentFreak writes up a comprehensive review and interview with all the popular vpns, [https://torrentfreak.com/vpn-services-keep- anonymous-2018/](https://torrentfreak.com/vpn-services-keep-anonymous-2018/)

</comment><comment><USER31> Other than that one privacy site already mentioned, Wirecutter did a good analysis recently:

[https://thewirecutter.com/reviews/best-vpn- service/](https://thewirecutter.com/reviews/best-vpn-service/)

</comment><comment><USER32> I have wireguard setup on a DO instance of <wherever region I need>. It is very fast and easy to setup for technically inclined : [https://www.wireguard.com/](https://www.wireguard.com/)

</comment><comment><USER33> I used Astrill while in China and it worked good and the cost wasn't bad. Works on most all OS's.

[https://www.astrill.com/](https://www.astrill.com/)

</comment><comment><USER34> I currently use IPVanish. I'm pleased with the uptime and service. Every now and then I get disconnected and everything reverts to using my normal connection, which isn't very secure.

</comment><comment><USER35> Earlier today [https://news.ycombinator.com/item?id=17091618](https://news.ycombinator.com/item?id=17091618)

</comment><comment><USER36> I created a subjective guide based on my experiences which might be useful to you:

[https://vpnreport.org](https://vpnreport.org)

</comment><comment><USER37> I used to pay for IPVanish but now I'm using Algo with much better speed. Some websites also block requests from commercial VPNs.

</comment><comment><USER38> Your own hosted VPN, run one from home for free using a $5-10 raspberry pi zero.

Or $60 on DigitalOcean or Linode a year at $5/month.

</comment><comment><USER39> Have been using windscribe - I use it sparingly.

But any vpn should be treated with skepticism as many have noted here.

</comment><comment><USER40> Specific use case thread: which VPNs have worked for you in mainland China?

<comment><USER27> ExpeessVPN works fine. using it right now in china.

</comment></comment><comment><USER41> SomaVPN - currently in beta Based on Algo and Wireguard

<comment><USER42> link?

</comment></comment><comment><USER7> I use bahnhof VPN (Swedish) and they are well known for standing up to pressure from government.</comment>


To Get More Entrepreneurs Writing, I Launched a Blogging/Wordpress Bundle - <AUTHOR> http://appsumo.com/34/

<comment><AUTHOR> As part of my crusade to get more people and companies blogging ([http://onstartups.com/tabid/3339/bid/14208/Why-Every- Entrepr...](http://onstartups.com/tabid/3339/bid/14208/Why-Every-Entrepreneur- Should-Write-and-9-Tips-To-Get-Started.aspx)), I helped Noah put together an awesome blogging bundle. Basically went and got every tool you should have to get started writing :). Email email@example.com and we'll give you 10% off.

Oh also, if you're an HN user and have a wordpress theme/plugin or any piece of software related to blogging, email me: email@example.com, would love to get it included. Helps aspiring writers and helps you get visibility. Happiness all around :)

</comment><comment><USER2> I hate to be a cynic on a great contribution Jason, but I can't help think you're doing this _To Get More Entrepreneurs Writing, About PadPressed_. Or at least, more attention for PadPressed in the WordPress world.

Ulterior motives aside, it's a great offer, good work on putting it together. Best of luck with PadPressed.

Disclaimer: My thoughts are heavily influenced by having just read your piece on how to pitch TC and get press.

<comment><AUTHOR> I see how that might be a thought, but it's actually the opposite. AppSumo is absolutely awesome for SaaS businesses as it's a customer acquisition technique- get them hooked for 3 months with what amounts to an extended free trial. If they like it, they stay.

For downloadable stuff, like PadPressed, it's not the best thing in the world, especially when we're surrounded by even more awesome people like WooThemes.

I helped do this, just because I want to see everyone get these tools + blog more. Simple, straight forward :).

</comment></comment><comment><USER3> This is a great deal! I'm buying this for the included WooThemes wordpress themes. I've used them before, their themes are well coded and are constantly being updated.

</comment><comment><USER4> Awesome bundle. Almost triggers the Paradox of Choice...</comment>


Make your Google Docs a Google Drive - <AUTHOR> http://www.gdocsdrive.com

<comment><USER2> This was linked to yesterday, and then the link went away, and it was marked as [dead], so I'll say again what I said there:

So it seems terrific up until it asks me to sign in with my Google Account and provides fields for email and password.

So that's a killer right there. It needs so oauth or whatever the cool kids are calling it these days.

Give me some oauth and I would check it out. I'd also suggest a 30 day trial, or even better, seriously, since the $19 payment is for a lifetime license, you should consider a 90 day trial period, let me get good and hooked and then yank the line.

I have paid for additional google storage, and this tool could be invaluable for allowing me to make use of that storage, but I need oauth, and I would prefer a 30 - 90 day trial.</comment>


The Unreal Engine Wiki is now permanently offline - <AUTHOR> https://forums.unrealengine.com/unreal-engine/announcements-and-releases/1739154-changes-to-the-official-unreal-engine-wiki <comment><USER2> This is bad, very bad. A complete and utter disrespect for people who poured in their blood and sweat in creating the content for them and for free. Migrating only "top" content is insufficient and so ignorant. The value of wiki is almost entirely in long tail. Vast majority of Unreal engine is undocumented where you get all kind of issues few have seen before. If it wasn't for the community creating content _for them_ , it would be unusable for many users. To salt the wound, they aren't even telling you exactly why they are doing this. Why making read-only archive is so hard, at very minimum. Didn't expect this from Tom Sweeney's company.

<comment><USER3> Looks like the post got updated with some reasoning:

> Why can't we put a read-only archive online currently? The Wiki, even in > it's read-only state, was presenting security risks, and it was deemed > necessary to take it offline.

<comment><USER4> So crawl the Wiki pages, grind out static HTML copies of them, and make _those_ available. Not many security risks associated with static HTML.

What am I missing here?

<comment><USER5> The only other "security risk" I can imagine such a read-only wiki could present is if it documents something that could be considered "risky" from a security perspective. That would make this more of a censorship situation.

<comment><USER6> > We still have the data, and as mentioned above, we will work to migrate the > top content into various official resources. In the meantime, we're > investigating how we can make this content available, even in a rudimentary > way.

This indicates otherwise.

</comment></comment></comment></comment></comment><comment><USER7> The thing that seems super strange to me is that they don't seem to have warned people they would do this, the first comment is

> This isn't very helpful, Amanda! I know that the wiki wasn't optimal, but > there were many wiki pages developers like me had bookmarked for years > beacuse they contained comprehensive and easy information, which is now > missing. Why not just keep the wiki read-only online? Just to retain the old > pages? I'm pretty lost right now without some of these articles and I don't > understand why the only option you had was to completely disable it. Please > think about opening it up again just for read. I don't care about the > maintenance mode, but the wiki was an important learning point, which is now > gone.

If you don't want to support the wiki that's fine, you don't owe anyone hosting, but if you're going to dump it, atleast give someone the opportunity to scrape the site and host it themselves.

<comment><USER8> Such a solution presents a bit of a challenge though, given that you'd be 1) broadcasting a security issue, and 2) possibly compounding it by presenting your audience with some really disagreeable news.

I can at least see why they'd hesitate to leave things up, depending on the anticipated risk and likelihood of addressing it in reasonable time.

Edit: Downvote if it makes you feel better, but this is really how groups execute on problems like this without taking time away from other important projects. "Security issue? Extensive fixes needed? Take it down!"

<comment><USER9> "We're going to shut down the wiki starting xx/xx."

Don't need to explain, don't need to make a fuss - just announce and move on.

<comment><USER8> Doesn't that also just open up a lot more community feedback/pushback? I'm thinking somebody saw it coming in any case and made the call.

<comment><USER10> Hackernews is shutting down in 45 seconds. Please save the pages of any bookmarks now

</comment></comment></comment></comment></comment><comment><USER11> I had to decom a major wiki in a very large company not long ago. I can give you four reasons why these things happen, possibly without notice.

1) The wiki software and database have been abandoned for years. There is no maintenance and no further release.

2) It will stop working shortly. Like, it doesn't start on Ubuntu > 14 or current MySql at all.

3) It already stopped working and/or the content is already lost. Can be an accidental deletion or the 10 year old server passed away.

4) Security vulnerability. Remote code execution / SQL injection in the wiki software. That can't be fixed because point one.

I wrote a longer blog post on software death cycle in companies [https://thehftguy.com/2019/12/10/why-products-are- shutdown-t...](https://thehftguy.com/2019/12/10/why-products-are-shutdown-the- case-of-verizon-and-yahoo-groups/)

<comment><USER12> It shouldn't be hard to save a static copy of the actual HTML and replace the dynamic site with that though. Or at least give others enough time to do the same.

<comment><USER13> Not that hard?

You'd need to process each page then data mine it.

<comment><USER4> HTTrack ([https://www.httrack.com/](https://www.httrack.com/)) makes tasks like this trivial.

<comment><USER14> It doesn't run a full browser engine so it won't work with the vast majority of websites.

</comment></comment></comment></comment></comment><comment><USER15> Sounds like someone accidentally deleted it and they have no backup. Instead of admitting to not having a backup, they can just say it was intentionally shutdown, and ask their staff to salvage whatever is available from archives.

<comment><USER16> My first thought as well, but my second thought was why wouldn't they own up to it? Surely they know that owning up to something like this earns them much more respect and positivity from the community than "taking it down" for no good reason, or worse trying to cover it up.

<comment><USER17> (a) that's a lot easier to say than do, fear is powerful and (b) no, they wouldn't get any respect for Not. Having. Backups.

</comment></comment></comment><comment><USER18> I always wonder why companies do stupid things—like this.

At the very least, put it in read-only maintenance mode, with a big disclaimer at the top saying so.

But to just _destroy_ information, information about _your own product_ , is…well, it's stupid. Profoundly so.

<comment><USER19> In my experience this sort of decision is always driven by sales / marketing people deciding they want to funnel the users into some other part of the site that nobody currently uses because it's not as good.

<comment><USER20> Not necessarily sales/ marketing, but an Old Thing is not a new thing you'll be praised for, it's just another annoying cost that comes out of your budget. Maintenance is _boring_.

Building a New Thing comes with excitement and praise.

Microsoft has done this so long their own people strongly recommend using URLs in [https://aka.ms/](https://aka.ms/) their long term link maintenance software, so that when yet another "exciting" change happens to their entire Microsoft web site you can still find all the vital documentation. Maybe their "Knowledge base" articles for example, will become a Wiki again, and then a social networking site, and then a blog the week after, and then a different Wiki with newly inscrutable URLs. But the aka.ms link can be updated so that you don't need to spend an hour navigating.

The more important maintenance becomes to a company's actual financial health the more senior management rebel and become sure their destiny is to radically reinvent the company. If directors did their actual job (working for the shareholders, for whom "exciting" aka "massively loss making" isn't the goal) the very next thing you'd hear after the CEO announcing the company has a new name, new branding, new logo, would be the Chairman arriving to tell everybody actually it's not a new name, new branding or new logo, just a new CEO, sorry, no big leaving do he was escorted off site by security.

</comment></comment></comment><comment><USER21> Really stupid. UE4 documentation is generally crap and the wiki resources were quite invaluable. It might be outdated information but it at least gave you a starting point to figure out where to look in the source for more information.

</comment><comment><USER22> Since I started using Ogre3D I always had a hard time settling down to feature rich engines like unreal or unity.

I don't know how often, giving beginners access to a space shuttle, will it lead to a successful project that can compete with non-indie game developers.

There is also a fine line between an indie team of developers who can benefit from those tools, and experienced game developers who would not need them.

It seems unreal and unity are just very capable, but cheap, tools that are well-marketed towards students and beginners. The problem is, once those developers learned to use those tools, they are still unable to develop a game without those tools, which is a huge win for unity and unreal.

Generally I tend to believe unreal and unity only enable developers to make games that will never be able to compete with more established and skilled game developers. I think it's a pretty sad situation, because initially I really believe indie games were able to compete with those big studios, but they're not, and I think unity and unreal are responsible for this. It seems the whole FOSS mantra/paradigm/philosophy has a lot of trouble penetrating the field of game development, maybe because games are heavily monetized towards consumers, unlike other softwares. It bothers me.

<comment><USER23> What engines are you suggesting make it easier to create those games that compete? My experience is that UE4 and Unity are both enabling of indie developers to make very high quality games. The only real limitations are how much effort you put into the art. UE4, while hard to code for, is still orders of magnitude less work than coding all the rendering, animation, and hardware logic from scratch. There are of course other engines, but they are either devoid of the features you need to compete with AAA titles, or have severe performance limitations.

<comment><USER24> Do you think Godot is either missing necessary features or has severe performance limitations?

<comment><USER25> Currently its missing necessary features. The roadmap looks good but I can't ship on a road map.

<comment><USER24> I've been looking at Godot for a hobby project. Could you please describe what features you need from it that it's missing?

<comment><USER25> The biggest for me is the fact they're rewriting the graphics stack. The churn is enough but I also just don't like "fixed"/"simplified"/"helpful" tools that hide the underlying platform. Unity's shader language is extremely ugly but at least I can use raw GLSL if I have to. I've had to use custom pragmas to get certain acceleration features to work on Samsung hardware that doesn't seem possible in Godot. Hopefully the updates with Vulkan will have more flexibility.

That said, for a hobby project it seems fine.

<comment><USER26> Hi, I'm not very proficient in graphical programming, but godot docs say this

> Godot uses a shading language similar to GLSL ES 3.0. Most datatypes and > functions are supported, and the few remaining ones will likely be added > over time. Unlike the shader language in Godot 2.x, this implementation is > much closer to the original.

[https://docs.godotengine.org/en/3.0/tutorials/shading/shadin...](https://docs.godotengine.org/en/3.0/tutorials/shading/shading_language.html)

Godot is relatively new and definitely "not there yet", but at least with its open nature you can do `git clone godot-doc.git` and no top manager can take it away from you.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Unity is in a comfortable position with newer lines of business from VR, architecture, and animation along with its strong position on the long tail of desktop, console, and mobile gaming. They have the marketplace to beat and a userbase beyond comparison. I believe this enables Google-esq behavior and its disconcerting at best.

My son was really into Unity development for a while, but he got discouraged when they deprecated their entire networking stack without providing a suitable replacement (since August 2018) and are even removing support from old LTS releases.

For a multi-billion dollar company to suddenly take down a wiki that hundreds of man-months went into creating, that is visited millions of times each year, with no warning or archive- that is open user hostility. They can certainly afford to keep it around in read-only mode as a static site. An intern could run wget and have a mirror up in a few days tops. If there is unmoderated content they are worried about, they can afford to clean it up. This is wrong.

<comment><USER28> Unity or Unreal?

<comment><USER29> They're talking about both at different points..?

<comment><USER30> I don't think so, hence the accusation of "Google-esq behavior" and such.

They seem to be a concerned parent who's mixed up.

<comment><USER27> I was mixed up about who owned the wiki, sorry folks. Unity networking is still broken. My son did try to move on to Unreal, but he never made anything of substance with it. He got interested in developing with 6502's and got out of 3D games for now.

</comment></comment></comment></comment></comment><comment><USER31> > So why can't we put a read-only archive online currently?

> The Wiki, even in it's read-only state, was presenting security risks, and > it was deemed necessary to take it offline.

[https://forums.unrealengine.com/unreal- engine/announcements-...](https://forums.unrealengine.com/unreal- engine/announcements-and-releases/1739154-changes-to-the-official-unreal- engine-wiki/page2#post1739689)

<comment><USER32> Seems like a poor excuse. You can make a read-only version of a Wiki without running wiki software. Just mirror the HTML.

At the very least they could have made this open source

<comment><USER33> It would've been trivial to crawl the forum and dump the resulting WARC files into the Wayback machine to provide a permanent archive. This is just apathetic laziness on their part.

[https://github.com/ArchiveTeam/grab- site](https://github.com/ArchiveTeam/grab-site)

<comment><USER34> Pretty sure the wayback machine already has a full archive

<comment><USER33> I haven't enumerated all of the Wayback captures for the forum yet, so I can't speak to how recent and complete the archive of the forum is.

</comment></comment></comment></comment></comment><comment><USER35> I used the wiki extensively in my last UE4 project. It had its warts, but it also had valuable information that _did not exist anywhere else._ Taking this down without a torrent mirror or a grace period is phenomenally harmful to the community. Bad move!

</comment><comment><USER36> Looks like the waybackmachine got some of it at least

[https://web.archive.org/web/20191212230615/https://wiki.unre...](https://web.archive.org/web/20191212230615/https://wiki.unrealengine.com/index.php?title=Main_Page)

</comment><comment><USER37> I never understand why companies do this. Its very developer hostile.

Are they having financial problems? Surely Fortnite is keeping the lights on...

Could be a signal of underlying management confusion/instability. Might need to reassess.

<comment><USER38> You could host that wiki for ten bucks a month.

<comment><USER37> Depends on traffic/content, but yeah text is cheap.

Might grab a copy of the archive for reference then local host it. We've got a ton of internal references that will be broken.

We haven't touched UE for about 10 months.

<comment><USER37> Not sure why someone disagreed without a supporting comment.

Every line is fact.

</comment></comment></comment></comment><comment><USER39> The lack of a static copy of the wiki really sucks but it's understandable that a mediawiki install would be pulled indefinitely. Mediawiki racks up a dozen CVEs in an average year and even a single one of those is an opportunity to perform watering hole attacks on _every_ UE licensee. Getting RCE on a single UE customer's machine is an opportunity for million+-dollar industrial espionage - it's not uncommon for someone to get a copy of a game's source code and try to extort the developer for cash. We generally only know about the cases where the extortion fails...

It's possible that really aggressive security measures could mostly prevent that but even if you were to patch weekly that won't stop someone from pairing an undisclosed mediawiki attack with some other attack that isn't well-known. A game studio's machines are probably using LTS versions of Firefox or Chrome w/slower update cadence, which potentially means multiple days of vulnerability even after an exploit is patched.

Also, now that Epic processes credit card payments (Epic Store, etc) it's possible the mediawiki install would prevent them from passing PCI-DSS audits.

</comment><comment> AA-BA-94-2A-56 Here is the Linking DLLs wiki page discussed in the forum thread:

[https://web.archive.org/web/20181004001430/https://wiki.unre...](https://web.archive.org/web/20181004001430/https://wiki.unrealengine.com/Linking_Dlls)

</comment><comment><USER40> Someone mirrored it: [https://michaeljcole.github.io/wiki.unrealengine.com/](https://michaeljcole.github.io/wiki.unrealengine.com/)

</comment><comment><USER41> Microsoft did a similar thing with ASP.NET site. There were quite a lot of old articles for ASP.NET WebForms that were really good references or if you were working with someone that was new to WebForms you could just point them to a particular article and say "read through this, this has almost everything covered on how to do this".

Very frustrating.

</comment><comment><USER42> That's a great way to get people to use Unity instead. Which everyone already should.

</comment><comment><USER43> Bonehead move. Leave it up as read-only and mark when pages are out of date so users can look for up-to-date information elsewhere. Hope they come to their senses and re-upload a read-only archive of the documentation

</comment><comment><USER44> Khan Academy's internet traffic increased 250% over normal on quarantine.

Unreal Wiki must be experiencing similar trends. The real reason it was shut down.

</comment><comment><USER45> Kinda silly,good documentation is what, partially, will win the engine wars if we can call it that and Unreal is not exactly crystal clear.

</comment><comment><USER46> It's a shame most people didn't hear about this; I don't suppose the archive team got any of this?

</comment><comment><USER47> One of my first paid programming jobs was writing extensions to the Wiki engine used by the Unreal Wiki (TWiki).

RIP

<comment><USER48> Not twiki, looks like MediaWiki to me. Wonder what attracts people to MediaWiki anyway. Horrible and insecure code all over, easy to break into. Only maintainable with massive manual administration costs. And hundreds of Wikipedia editors.

On the opposite I once maintained phpwiki which never had any security problems, and all my known instances still work fine after decades. No much need for massive manual interventions. lots of admin plugins. XSS attacks impossible. I ran backup jobs for the DB (berkeley db was 30 faster than MySQL) and as HTML archive. So even if you have to put it down for php maintainance, you can trivially replace it with a readonly dump without any action buttons and without any PHP.

<comment><USER47> It was definitely TWiki in 2001. They must have migrated

</comment></comment></comment><comment><USER49> Using any propitiatory/corporate systems feels more and more like living on a volcano.

</comment><comment><USER50> April Fools?

</comment><comment><USER51> There's no backup floating around online, cached somewhere? Like waybackmachine?

</comment><comment><USER52> Regardless of the reasoning the message for indies is clear: Time is running out.

</comment><comment><USER53> "security risk" \- So they're just trying to hand-wave a bluff at a huge community of developers? No one believes this. edit: also I feel bad for this community manager having to lie and apologize

<comment><USER54> I am the co-maintainer of an OpenSource project called AwesomeWM. I took down our wiki years ago due to:

* Constant vandalism

* Dubious user created content rendering computer non functional

* Trolling edits to cause breakages to people copy/pasting shell commands

* SPAM

* Maintaining the wiki

Before that we forced users to log-in for edits, then forced moderator approvals for everything, then forced moderator approval for new account. Then gave up and retired the Wiki.

So no, wiki are not free content. They are a pain, especially when your community tend to have many trolls/hostile individuals like the gaming community. It's not "downright lies" all the time.

<comment><USER55> Completely off-topic, but thank you for your work on AwesomeWM, together with all other contributors! It is a fantastic piece of software and I always use it on all my Linux installs.

About maintaining wikis, that is indeed a problem. In addition, most wiki software I used has extremely clunky administrative tools which make moderation way more challenging than needed.

I used to maintain a tiny private wiki for a previous job, and even in a very small operation (10s of users), it was a disproportionately large maintenance burden.

</comment></comment></comment><comment><USER56> What's the story here and why is this newsworthy?

</comment><comment><USER57> self-destruction measure completed

</comment><comment><USER58> "We hear your concerns and frustrations. And we missed an opportunity to give you notice prior to the Wiki page coming down, and for that we apologize.

So why can't we put a read-only archive online currently? The Wiki, even in it's read-only state, was presenting security risks, and it was deemed necessary to take it offline.

We still have the data, and as mentioned above, we will work to migrate the top content into various official resources. In the meantime, we're investigating how we can make this content available, even in a rudimentary way.

Some individuals from the community have already reached out to explore a community-hosted Wiki. We are following up with these folks and are evaluating next steps to see what may be possible here as well. "

Well you always learn new ways to express incompetence. They do know that you can render wikis into static HTML pages?</comment>


Stephen Fry: Steve Jobs - <AUTHOR> http://www.stephenfry.com/2011/10/06/steve-jobs/single-page/

<comment><USER2> This is a rare and wonderful eulogy. We can nitpick over the details of Fry's grasp of the Apple way, but today it is probably better just to appreciate what Fry gets right about the phenomenon of Steve Jobs. I think one thing he gets right, the thing in any case of most importance to me, is the attitude that Jobs brought to the things he did. The phrase "insanely great" has been knocking about in my brain as a kind of touchstone for that attitude since I first heard it used of the Mac in 84. I was a kid, but the phrase stuck with me, like the voice of conscience, becoming a constant challenge to do better. Beyond the macs and the pods and the phones and the pads, what I feel most grateful to Jobs for is the fact that he supplanted the old clarion cry "good is not good enough" with the much more powerful idea: "great is not great enough." There are other powerful ideas, including the antonymous "Just ship it!" Perhaps the challenge of living well and doing good is to somehow respond to the imperatives implied by both ideas. "Just ship it!" is a useful antidote for the procrastinating and hesitating conscience, but the romantic in me appreciates more the restraints placed on whatever forces lead us to accept mediocrity by having the ideal of the insanely great held before us the proper measure of human achievement.

</comment><comment><USER3> Make sure you read the anecdote about Tim Berners-Lee at the bottom.

<comment><USER4> easily the best part.

</comment></comment><comment><USER5> Stephen Fry has a talent with the written word that rarely disappoints. Of the many articles, obituaries and anecdotes about Steve Jobs I've read today, that one is the most compelling read.

</comment><comment><USER6> You know, I'm generally a huge fan of Fry's, but this article left much to be desired. He was simply factually wrong on a great many points.

"If different companies are making the firmware, software, chips, screens, operating system, radios and cases the results will always be far less coherent and usable devices."

I hope he's just being sloppy with his language (unlikely for Fry) and not _actually_ suggesting that Apple makes all of these components. The latter would suggest an insufficient level of familiarity with the products he extols to be taken seriously. He sounds very much like the ignorant "fanboi" he laments that some will call him.

"The frustratingly silly patent wars that are raging around the world between Google, Samsung, Apple and dozens of other companies would be a sad obsequy to Jobs's colossal achievements, but with such gigantic sums of money in so huge a market at stake it is little wonder that others will do all they can to "crack" Apple."

What? He seems to think that Apple is the _defensive_ party in the patent mess? Again, a disconnect from reality that is disappointing from someone I hold in such high regard.

I usually quite enjoy Fry's writing, but this piece was sloppy and poorly- researched, if indeed it was researched at all. Disappointing.

<comment><USER7> That's not how I read the second point.

As I understood it, he is saying the fact that Apple is the offensive party in the patent mess is a sad obsequy to Jobs's otherwise colossal achievements.

<comment><USER6> Read the second part of the second point again.

"but with such gigantic sums of money in so huge a market at stake it is little wonder that _others will do all they can to "crack" Apple._ "

<comment><USER8> Steven Fry's point seems to be that others are copying Apple. Apple then asserting its patents is seen as a expected result.

<comment><USER6> I think that's a reasonable, if extremely generous reading of his words.

</comment></comment></comment></comment></comment><comment><USER9> What a fitting tribute from the only other artist whose death is certain to make me cry. I hope it never happens.

<comment><USER10> It may, some day.

<comment><USER11> It will. Some day.

<comment><USER10> Perhaps.

</comment></comment></comment></comment><comment><USER12> Amazing piece.

I've always had this mental image of all the tech greats knowing each other personally. I presumed Tim Berners-Lee and Steve Jobs had long discussions over a cup of coffee or beer. I'm somewhat bummed that's not the case.

</comment><comment><USER13> _The quality I especially revered in him was his refusal to show contempt for his customers by fobbing them off with something that was "good enough". Whether it was the packaging, the cabling, the use of screen space, the human interfaces, the colours, the flow, the feel, the graphical or textural features, everything had to be improved upon and improved upon until it was, to use the favourite phrase of the early Mac pioneers "insanely great". It had to be so cool that you gasped. It had to feel good in the hand, look good to the eye and it had to change things. It changed things because it made users want to use the devices as they had never been used before._

Steve Jobs once said

 _When you're a carpenter making a beautiful chest of drawers, you're not going to use a piece of plywood on the back, even though it faces the wall and nobody will ever see it. You'll know it's there, so you're going to use a beautiful piece of wood on the back. For you to sleep well at night, the aesthetic, the quality, has to be carried all the way through._

The fact that the customer agrees with that is a testament of how deeply Jobs spirit is entrenched in Apple's approach and philosophy.

</comment><comment><USER14> "In most people's vocabularies, design means veneer. It's interior decorating. It's the fabric of the curtains and the sofa. But to me, nothing could be further from the meaning of design. Design is the fundamental soul of a man- made creation that ends up expressing itself in successive outer layers of the product or service." -- Steve Jobs

I desperately wish I was capable of seeing deeply into the meaning of that statement. I appreciate design, design thinking, human factors, etc..., but not nearly enough to understand it as the "fundamental soul," or how _it_ (what?) _expresses_ (how?) _itself_ (who?).

If anyone here can provide a few words, or a pointer to some great communicator of design, I would very much appreciate it.

<comment><USER15> Well I suppose he could just mean he has some principles in mind about what a device should feel like to own. For instance the iPod, it was such a leap in usefulness of pocket music players, and this was reflected in not just the technology (1000 mp3s) but also the UI and the physical controls and the build quality and the stylishness. I say stylishness because I think that kind of is part of 'usefulness'... it looked cool to be seen with an iPod, esp. with the white headphones.

In contrast they could have just been like 'oh, great, we have a harddrive that can hold 1000 songs and still fit in your pocket easily!' and put out something that looked and handled like a brick.

But going back to what he wrote, he mentioned interior design, so he was probabaly thinking about architecture. You could have a boring building and make it look nice inside, but isn't it so much better when the architecture itself is amazing and then everything else just builds on that or compliments that.

</comment></comment><comment><USER16> I used his quote in the short remembrance video of Steve Jobs I made using iMovie last night...

If anyone's interested: <http://www.youtube.com/watch?v=edaQyINe5oQ>

</comment><comment><USER17> I like the "awful prophets/awesome profits" contrast. Cleverly phrased. It really underlines the truth about the tremendous success Apple has with all kinds of people, all over the world, no matter what all the "haters" say.

</comment><comment><USER18> Wasn't ðis ðe guy who has recently advertised for ðe Free Software Foundation? Woman, ðy name is inconstancy…

<comment><USER19> Maybe, but for such an entertaining and productive bipolar technology enthusiast, I'm happy to drop the normal consistency requirement.</comment></comment>


Introduction to Hurd translators - vezzy-fnord https://www.debian.org/ports/hurd/hurd-doc-translator

<comment><AUTHOR> This concept of translators looks very similar to FUSE (Filesystem in Userspace) in Linux, I wonder how it differs, is it easier to write?

And how about the context switch cost? being used to Linux, I'd think that the execution flow has to jump back and forth between kernel and user space to call the translators, and again and again if you chain them?

<comment><USER2> FUSE is more general, I think, insofar as it provides a filesystem abstraction for anything you like. Whereas this looks more like a layer that sits above an existing filesystem (like a FUSE overlay).

(Edit: Emphasis on the "I think"!)

<comment><USER3> FUSE is _less_ general, as it only allows implementation of filesystem drivers. HURD translators should allow implementation of almost arbitrary drivers in userspace (such as device drivers or network stacks).

HURD is a micro-kernel so almost everything that traditionally lives in the kernel on Linux systems would be implemented as a translator in a HURD system (apart from very low-level virtual memory and CPU management).

<comment><USER2> Neat :) Thanks for the correction</comment></comment></comment></comment>


Show HN: A tool to create printable UI mockups and wireframes templates - <AUTHOR> https://github.com/alexadam/printable-mockups <comment><USER2> This is so badass! I love using pen & paper for mockups.

FYI, I just shared your project on Product Hunt: [https://www.producthunt.com/posts/printable- mockups](https://www.producthunt.com/posts/printable-mockups)

I think the design community there will find it really useful!

</comment><comment><USER3> This is very well executed.

One suggestion: maybe add an empty block for a placeholder to make space for notes.

<comment><AUTHOR> Thanks! The Notes block is the next thing I'll add to it

</comment></comment><comment><USER4> Is there such add-on for Inkscape?[0]

On GitHub found only few Inkscape add-ons for creating interactive mockups.[1,2,3]

[0] [https://inkscape.org](https://inkscape.org)

[1] [https://github.com/jonathanmann/inkscape_app_mockup](https://github.com/jonathanmann/inkscape_app_mockup)

[2] [https://github.com/garrett/magicmockup](https://github.com/garrett/magicmockup)

[3] [https://github.com/ajashton/Inkscape-Mockup- Toolkit](https://github.com/ajashton/Inkscape-Mockup-Toolkit)

</comment><comment><USER5> One of those simple yet brilliant things I wonder why it hadn't been invented yet.

<comment><USER6> Aren't those ideas the ones that are always the most successful businessess too?

<comment><USER5> If one can continue to crank out those simple genius ideas, yes. And if one has the rest of the skills necessary to run a business.

</comment></comment></comment><comment><USER7> Lovely work! Can we have arrows too please? So we can build the flow between screens into the document

</comment><comment><USER8> Seems like if this was to become a product/service you could offer a service like [https://www.uistencils.com/](https://www.uistencils.com/) but with custom layouts.

</comment><comment><USER9> Very cool! Now I want one which is a full online version :)

<comment><USER10> yay ! direct import into marvel app :)

Also, might be due to inexperience in the field but why import/export in JSON ?

<comment><USER11> So you can load previous configured pages with its settings and mockups.

<comment><USER9> Dude imagine this: Canvas on top of this with free drawing and save the results in json-gz all in frontend technology. Save trees, unleash creativity!

</comment></comment></comment></comment><comment><USER12> This could be useful.

For all of the electronic communication in my company, once things get to a certain level of management, they want to see stuff on paper.

</comment><comment><USER13> This is really well done. And +1 for the suggestion of placeholder spaces for notes. Great work, thank you for sharing this.

<comment><AUTHOR> Thanks! The Notes component is on the to-do list

</comment></comment><comment><USER14> This is a great idea.

You could probably turn this into a product if you were to print out notebooks where pages were the templates.

</comment><comment><USER15> This is fantastic! Very useful, especially for those of us who still think best with pen and paper.

</comment><comment><USER16> Cool, although I noticed the output PDF is fairly blurry. Can this be made crisper?

<comment><AUTHOR> The blurriness is a problem… With the pdf library I'm using (jsPDF) I cannot export the SVG directly so I convert it to an image and then embed the image in the pdf. To solve the problem, I can increase the converted image's resolution but then the pdf becomes huge (~20 MB, for example). There is a 'quality' parameter in the code, maybe I'll expose it in the UI and you can find an optimum value. I'll try to find a way to export or 'write' the svg data directly in the pdf, I think it's the best way to do it.

<comment><USER17> This maybe? [http://pdfkit.org/docs/vector.html#svg_paths](http://pdfkit.org/docs/vector.html#svg_paths)

</comment></comment></comment><comment><USER18> Is it common to use jQuery with React? I'm relatively new to React.

<comment><USER19> I don't think it's common to start a new project with both jQuery and React, or actively develop jQuery and React modules in the same project, but it is probably quite common for projects that initially used jQuery to gradually move modules to React.

</comment></comment><comment><USER20> Love it. Working out UI issues analog like this really helps sometimes!</comment>


Wordzen – An executive assistant for your Gmail account - <AUTHOR> http://www.wordzen.com

<comment><USER2> Is there a typo in "Gmail Proofreading/Editing Example 2"?

>Thank for asking

Should that be "Thanks for asking" or "Thank you for asking"? Or is what Wordzen have used correct?

<comment><USER3> Hi! It is incorrect -- thank you for pointing that out. I'll get that fixed on our website later tonight. That was a sample from one of the very first emails we edited when we launched a few months ago. We now have controls in place to prevent minor errors like that.

<comment><USER2> It's an interesting service. I wish you all the best with it.

I fear that I wouldn't use it sufficiently to warrant paying for it. I write more HN and Reddit posts in a week than I've sent emails in the last year.

That said, I'd be tempted to use it as a good proof-reading service for important emails if it weren't too expensive to use ad-hoc.

However there are at least two people I would hope would sign up. Their emails (and my sanity) could do with it!

Likewise if you did Facebook updates too, I'd be tempted to pay for some friends on my feed to use your service.

I trust you'd have no issues with using British English for spelling, if requested?

<comment><USER3> Understood. As you know, it is free for now, but I'll likely offer an ad-hoc system as well as a monthly subscription service when I do start charging. When that happens, we'll prefer credit card over "cheque". That's an interesting note about Facebook...I'll have to research that some more.

No issues on the British English mate. It would be an "honour" to serve you and your friends. :)

</comment></comment></comment></comment><comment><USER4> Just tested it out, and it works like a charm! They will have to charge eventually, just wondering what the price point will be.

<comment><USER3> Hey - glad you like the service! Yes, eventually we'll have to define a business model. Still working on that part.</comment></comment>


Minecraft Griefers Demolish 1:1 scale model of Denmark - t-3-k http://www.gamenguide.com/articles/10794/20140502/minecraft-griefers-demolish-denmark-map.htm <comment><USER2> This story was submitted[0] four days ago, but got no traction and sank without trace. The only comment[1] was mine, and I repeat it here:

        I know this is something of an internet meme, and hence
        somewhat out-of-place here on HN, but, in short:

            This is why we can't have nice things.

        It would be really cool if we didn't need passwords.  It
        would be really cool if we could have globally editable
        documents that stored and connected all our knowledge.
        It would be really cool if we ... well, you get the idea.

        What if clever people, really clever people, stepped up
        and started to think at a level higher than the single
        point fixes and managed some sort of meta-fix.

        How clever can people be? Anyone care to speculate?

[0] [https://news.ycombinator.com/item?id=7687378](https://news.ycombinator.com/item?id=7687378)

[1] [https://news.ycombinator.com/item?id=7687637](https://news.ycombinator.com/item?id=7687637)

 _Edited to correct tpyos._

<comment><USER3> Why complain about people being creative in a creative environment? Is there no place for fun?

<comment><USER2> So wading in to someone else's construction and destroying it counts as "fun"? Kicking over someone else's sandcastle counts as "fun"? Kicking someone else's car to put a dent in the door is "fun"? Torching someone's house is "fun"?

Slippery slope, drawing the line, yadda yadda yadda, I'm interested to see what people think is "fun" and where they would draw the line. Given that it had no protection, how does destroying it gain or prove anything?

Finding weaknesses in a system that's intended to be secure is different, destroying something simply because you can is something I genuinely don't understand. No challenge, no victory, no benefit. I someone can help me understand the mindset of the griefers I'd be grateful.

<comment><USER4> They did something, and a bunch of people noticed it. You're their victory.

</comment></comment></comment></comment><comment><USER5> Things like this always bring to light a particular side of the internet population that is fascinating to watch but very frustrating to participate in an activity "against".

These people immediately take an incredibly negative approach for their own short term enjoyment without any apparent thought of the longer term effect of their actions, and what people will do to counter that style of behavior generally making things worse for everyone, both grierfers and legitimate players.

I'd be curious to know what kind of "motive" for want of a better word underlies these kinds of actions, and why this destructive "fun" is so popular on these "infinite freedom" style games in particular.

<comment><USER6> Have you never seen kids destroy each other's sand/Lego castles? Motives: curiousity, impulse, social exploration etc.

</comment></comment><comment><USER7> > Moving forward, the map will have to be rebuilt. Said Hammeken, "We don't > have a complete overview yet, but we'll probably choose to reconstruct > Copenhagen and the other cities."

By this wording, it seems they will rebuild it by hand instead of restoring a backup. They have backups, right?

<comment><USER8> I picture Denmark hiring a bunch of minecrafters to go in and manually rebuild Copenhagen block by block.

<comment><USER7> And suddently they hear a SHHHHHHHHHHH...

</comment></comment></comment><comment><USER9> Slightly OT, but the UK national mapping agency has created a minecraft model of the UK [1] (minus Northern Ireland).

[1] [http://www.ordnancesurvey.co.uk/innovate/developers/minecraf...](http://www.ordnancesurvey.co.uk/innovate/developers/minecraft- map-britain.html)

<comment><USER10> Oherwise known as "Great Britain".

/pedant

<comment><USER9> I know. I'm British...

I used that form of words because, for most readers, the term "Great Britain" isn't well defined, and is often incorrectly taken to denote the same entity as the "The UK". I also don't like the "Great" prefix because it appears aggrandising, even though the derivation [1] disproves that.

[1] [http://en.wikipedia.org/wiki/Great_Britain#Derivation_of_.22...](http://en.wikipedia.org/wiki/Great_Britain#Derivation_of_.22Great.22)

<comment><USER10> Fair enough, but there are plenty of people that don't know.

</comment></comment></comment></comment><comment><USER11> They didn't create a backup? Seriously?

<comment><USER12> The backup is Denmark. They only have one copy, but the medium is extremely resilient.

<comment><USER13> You say "resilient", but all it'll take is for the sea levels to raise a couple of meters to wipe it out

<comment><USER14> Nope, it will still be there, just wetter.

</comment></comment></comment></comment><comment><USER15> There are children who make sandcastles and children who knock them down. It happens so early, you'd swear they were born that way. I just imagine the latter are getting started early on their political careers.

<comment><USER16> I see a child as a blank page. You can turn that into poetry or into Mein Kampf depending on the amount of love/nurturing/open-mindedness.

Now if you'll excuse me, those trees ain't gonna hug themselves.

<comment><USER7> > Tabula Rasa

Using Latin is much cooler, and as bonus, you can smugly snigger at other people. How do you really spell the "rasa" part? With a hard R?

</comment></comment></comment><comment><USER17> In short, "this is why we can't have nice things."

</comment><comment><USER18> Proving that my previously down voted to hell comment about this being a waste of money was correct...

</comment><comment><USER19> This was never educational in so much as it's just a game. Kinda bored with people just making up pedagogy cause.

What's more boring and uneducational than a recreation of your country with a bunch of blocks. The attempts of the article to make it educational and fun for students are laughable.

What's fun, interesting and educational is messing around with it and seeing possibilities.

Personally I doubt anyone would have even visited if this hadn't happened. This kinda made it interesting and put it on the map so to speak.

And possibly this is exactly what the makers wanted, toss it out there, see what happens and go with it.

</comment><comment><USER20> Hahaha, I'm sorry but that is a bit amuzing. I mean, what did they expect?

Kind of thought that would happen when i read the Rules for being on the server.

<comment><USER21> Small countries like Denmark tend to have a much more well-behaved population than large countries. I.e. they queue nicer, they are more likely to return something they found, etc. (game-theoretic research suggests that such a culture is a symptom of having a high likelyhood of meeting again - <AUTHOR> offering more opportunities to punish bad behaviour).

That background might explain their optimistic expectations.

<comment><USER22> Excuse me, but what is this based on? Do you perhaps mean small communities? Because I can tell you from my experience being Swedish in Sweden (~9M inhabitants), that your assumption seems to be false.

<comment><USER23> I'm Swedish too, and I disagree. I have often heard that Americans (and others) are surprised at the willingness of most Scandinavians to follow the official and unofficial rules of society. We are likely blind to it as we experience it every day.

<comment><USER22> What are you disagreeing with? The question of what Hermels assumption is based on?

I'm open to the idea that my opinion regarding the environment I live in might be biased/skewed and I might not see a representative part of the society or that I be ignorant about what I see; that's why I asked what Hermels assumption was based upon.

P.S Was there any tone to my initial post?</comment></comment></comment></comment></comment>


They Live Alone in Ghost Towns - <AUTHOR> https://www.nytimes.com/2020/06/15/style/ghost-town-vacations.html <comment><USER2> Living the dream! Except lack of drown delivery from next grocery, hours away.

<comment><USER2> Err... _drone delivery_ I meant...</comment></comment>


KMSpico Windows 10 Activator Free Download - <AUTHOR> http://windowsgeeks.com/win-10-activation-kmspico/ <comment><USER2> Totally legit! Yeeeeah, suuuuure!!

Quote:

      Activate Windows 10 with KMSpico:

      *Turnoff your antivirus software.*

      Download KMSpico Here and install it.

      Go to the location where you have installed it, commonly in C: Driver.

      Open it and click on Red Button.

      You will listen the voice message after clicking.

      Restart your PC and that's it.

</comment><comment><USER3> Since there is no source, nor official distributor, there is too much risk that you install a well-hidden trojan.

</comment><comment><USER4> Please don't steal our software, hacker news is also no place for such garbage links.</comment>


The paradox of meritocracy - <AUTHOR> https://www.weforum.org/agenda/2016/03/the-paradox-of-meritocracy <comment><USER2> only time I've ever heard somebody use meritocracy they usually use it to justify why things worked out for them.</comment>


Nationalist.org hacked - <AUTHOR> http://nationalist.org/ <comment><USER2> Does every inconsequential defacement need to make the news?

<comment><AUTHOR> Inconsequential to you maybe.

</comment></comment><comment><USER3> buy why ?

<comment><USER4> Apparently because "fascists".

<comment><USER5> do you need a better reason?

<comment><USER4> nah, works for me.</comment></comment></comment></comment>


Physics and Blockchain - <AUTHOR> https://hackernoon.com/blockchain-and-physics-i-85713d31f07c <comment><USER2> This is cool...</comment>


Psychiatry needs its Higgs boson moment - <AUTHOR> http://www.newscientist.com/article/mg21829140.200-psychiatry-needs-its-higgs-boson-moment.html?full=true&print=true

<comment><USER4> If our knowledge of mental disorders ever approaches the level of physics, it will most probably happen because of the efforts of neurologists - <USER2> scientists who do rigorous investigation via the scientific method - <USER3> psychiatrists.</comment>


Ask HN: How to hire early engineers? - <AUTHOR> I'm working on a weekend-project-turned-startup which has early users who have committed to paying (I know "committed to paying" != "paying", but I'm confident in my ability to get paid users)
The money from paid users is not enough to hire an engineer, it's barely enough to pay for hosting. I have realised over the past month that I'm an inefficient engineer myself. I cannot balance sales (which is priority #1 at the minute) with programming. I built V1 by myself but I need to work with other engineers to take this to the next level.
I am averse to the idea of "Sweaty equity" being an engineer myself I believe cash is cash, equity is "not cash". How do you go about convincing engineers to work with you when you're in a situation to not be able to pay? Goes without saying, I am happy to provide ample equity. <comment><USER2>
      committed to paying == paying

if you ask them for money to pay for development of the project with the understanding that they are paying for the development. If they say "no" then the problem doesn't really solve a highly painful problem for a market that is flush with cash on hand. Or to put it this way, if a problem is costing those potential customers $15k a month, throwing $15k at a likely solution is a reasonable investment for a company with reasonable cash flow. If you're going to focus on sales, then closing sales will make it easy to hire engineers to deliver the product.

Good luck.

</comment><comment><USER3> Raise money to pay the engineers.

<comment><USER4> Agreed. Your options are:

1) Beg and borrow from the people who love and trust you in the hope that either (a) you'll repay them or (b) they'll forgive you - this is known as a friends and family round.

2) Find some rich people and convince them that they will make lots of money (in tax-efficient ways) if they lend it to you - this is known as an angel round.

3) (In some countries this is still possible) Go to the bank and explain to them the viability of your idea.</comment></comment>


Payment iframe - the easiest way to insert Stripe into your website - <AUTHOR> http://www.paymentiframe.com/ <comment><USER2> Please don't use this. There is nothing stopping paymentiframe.com from taking your customer's credit card numbers.

<comment><USER3> By using this, you're saying that you trust cperciva more than you trust Stripe. I'm confident that neither are going to try and deliberately steal your credit card numbers. But furthermore, you are saying that cperciva is going to protect paymentiframe.com from hacks better than stripe is going to protect theirs.

Myself, I'd place a lot of trust on cperciva, the former FreeBSD security officer, a guy who has written papers on security flaws in Pentium 4 processors. ([http://www.daemonology.net/hyperthreading-considered- harmful...](http://www.daemonology.net/hyperthreading-considered-harmful/))

[edit] paymentiframe.com's FAQ now includes this:

Why should I trust you with my credit card entry form?

You probably shouldn't. This is more of a proof of concept — but you might also want to use the CGI script to generate an iframe which you download (along with the bits it links to) and serve up as a static file from a server you run (but make sure you get a separate domain name for it).

<comment><USER4> > Myself, I'd place a lot of trust on cperciva

Sure, but you can just compare the two sites' external measures of security, and they're not even close.

Stripe domains:

\- Pass optional HTTP security headers (like X-Frame-Options on manage.stripe.com)

\- Are pinned to Chrome's HSTS list ([http://src.chromium.org/viewvc/chrome?view=rev&revision=...](http://src.chromium.org/viewvc/chrome?view=rev&revision=84125)) and pass a Strict-Transport-Security header

<comment><USER5> Aren't you comparing Colin's iframe with a level of security unobtainable to normal Stripe developers? If you just use Stripe's JS interface the way they tell you to, you're not strictly speaking benefiting from Stripe's HSTS or XFO; your site still needs to defend against clickjacking and SSL stripping.

I feel like Colin built this little thingy to solve a real problem --- that by adding Stripe to his site, he was giving Stripe control over his site, and his site hosts information more sensitive than credit cards --- and people are piling on because his solution to his little problem doesn't solve _every other imaginable security problem_.

This would be less galling if the kinds of sites using Stripe today weren't almost uniformly rife with application security flaws that defeat most of the good intentions that Stripe has.

</comment></comment></comment></comment><comment><USER6> > one of the basic principles of security is to avoid trusting people > unnecessarily

And asking customers to enter their CC details on your domain doesn't break this rule?

> a form will be submitted to your server with a stripe_token for you to > process

I'm assuming it just sends the Stripe token, and not CC info? If it does send CC info, I assume it's compliant with all the laws and regulations in every country?

<comment><AUTHOR> _asking customers to enter their CC details on your page doesn't break this rule?_

It doesn't break that rule for me. It is a reason why other Stripe users might want to think twice before using the iframe I host, of course.

 _I'm assuming it just sends the Stripe token, and not CC info?_

Yes.

<comment><USER6> > It is a reason why other Stripe users might want to think twice before using > the iframe I host, of course.

Well that's the point really. You say that a "basic principle of security" is to "avoid trusting people unnecessarily" which is exactly what this service you have created is asking people to do.

<comment><AUTHOR> I'm not asking anyone to use this, just making it available to people who want it and showing off a concept which people can re-implement themselves.

<comment><USER6> Do you not think the way you have presented it is encouraging people to use it?

I love Stripe, I love people hacking and creating new cool things but an emerging trend I'm seeing with Stripe is that people are really not taking the security of the CC numbers their customers have entrusted to them as cautiously and as securely as they should.

<comment><AUTHOR> It's available for people to use if they want, sure. I expect Stripe to offer a similar service soon too (at which point that issue goes away, since people are already trusting Stripe with their card details).

I'm trusting people to decide which risks they want to take -- I'm providing tools, not dictating policy.

<comment><USER7> Maybe the FAQ should include a "Q: Why should I trust your domain to host this for me? A: You shouldn't. This is a sample, you should implement it yourself for security."

<comment><AUTHOR> Good point, added. I thought it was obvious, but given some of the comments here, I guess it wasn't obvious enough.

<comment><USER7> Thanks!

I think it's obvious to most people here, but Stripe's targeted at essentially everyone. It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in".

<comment><AUTHOR> _It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in"._

I'm not sure that someone would be automatically wrong to do that. People should be aware that using paymentiframe.com means trusting me to not steal their customers' credit cards and trusting me to keep the site secure, but if someone makes an informed decision to place that trust in me, I can't say that they're necessarily wrong to do so.

As I said: Tools, not policy.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

<comment><USER9> By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised?

By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.

<comment><USER10> And you can accomplish the same thing by using an iframe that you have full control over.

Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.

<comment><USER5> That is true, but the point is that the only thing that is going to be compromised is the data that would be going to Stripe.

I know it is shocking to many of you to hear this, but the data Stripe collects is not really the most sensitive information on the Internet.

The point of the iframe is to contain the damage from any possible compromise. If PAYMENTIFRAME.COM is insecure (heh), you still aren't going to lose user sessions to your actual application.

<comment><USER10> No, just potentially their credit card information.

<comment><USER5> Again: that is not always the most sensitive things users have. I give my credit card to random people who work at gas stations. I do not give them passwords.

<comment><USER10> Just because it isn't most-sensitive doesn't mean that breaching the data isn't a problem.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Iframes can leak key presses to an evil parent frame:

<https://www.owasp.org/index.php/Cross_Frame_Scripting>

> Every key press the browser user makes in the example.com frame, while > trying to log into example.com, can be captured by the attacker, and > reported back to evil.com.

But this is irrelevant - user can't verify if the domain of the iframe is trusted. If the attacker can modify the parent frame javascript he can just replace the iframe with a phishing page.

<comment><AUTHOR> The point of a payment iframe is to keep javascript _inside_ the frame from doing anything evil to the site _outside_ the frame, not vice versa.

</comment></comment><comment><USER12> This is a lovely form. Ideally, Stripe would offer something like this as a way to quickly generate a nice cc entry form with the intention that site owners would put the generated code directly on their site, or that stripe would host the service themselves. After all, you're already trusting them to run the service, might as well trust them to run the form too.

Not that it's terribly hard to build a stripe-compatible form...

<comment><AUTHOR> _site owners would put the generated code directly on their site_

That would defeat the protection which the Same Origin policy gives you (since the iframe would have the same origin as the rest of your site).

 _or that stripe would host the service themselves_

Yes, that would be much better.

<comment><USER12> I meant that they'd put it directly on their pages, no iframe needed. Agree that it'd be much better if Stripe just did it themselves.

<comment><AUTHOR> _I meant that they'd put it directly on their pages, no iframe needed._

At the expense of loading third party javascript directly into their pages, you mean?

<comment><USER12> Yeah, I guess that misses the point of isolating the javascript, doesn't it? So, the idea is good, but has to be offered by Stripe to really minimize any exposure.

</comment></comment></comment></comment></comment><comment><USER13> I would never ever use this. Too much of a security risk.

</comment><comment><USER14> Would using this service affect one's PCI DSS compliance?

<comment><AUTHOR> Not based on my understanding of PCI DSS.

<comment><USER15> Merchants are either required to be PCI DSS compliant themselves or outsource their card-handling only to third-party entities who are PCI DSS compliant themselves.

So, one of two things is true:

\-- Paymentiframe/tarsnap is a PCI DSS compliant third party

\-- the merchant is intentionally violating the PCI DSS rules by sending credit card data to you

So, which is it?

<comment><AUTHOR> Nobody is sending credit card data to me. I'm serving up a form with javascript which sends the credit card data directly to Stripe.

</comment></comment></comment></comment><comment><USER16> I have to agree with everyone here that this doesn't make sense. I'm currently working on integrating Stripe into my application to create a subscription system. By far the easiest part has been payment form. In their tutorial they have a basic form that you can plug into a .html file and create test customers within minutes. It's laid out in 3 well documented steps in that link he calls "daunting".

</comment><comment><USER17> <http://www.wepay.com/api>

<comment><AUTHOR> Yes, we know that you work for WePay.

<comment><USER17> Thanks. Great to be popular

</comment></comment></comment><comment><USER18> This may be even more unsecure. Who would like their user to put in their creditcard information on a unknown site?

The change for that paymentiframe.com get comprimised I see is way higher, than Stripe is getting comprimised.

<comment><AUTHOR> _The [chance] for that paymentiframe.com get compromised I see is way higher, than Stripe is getting compromised._

We'll have to agree to disagree about that. Not that there's anything wrong with Stripe's security, but I know a little bit about the subject too. :-)

</comment></comment><comment><USER19> Or use authorize.net's iframe module and save a ton of $ on Stripe's ripoff fees.

<comment><USER20> <http://www.authorize.net/files/cybersource_pricing.pdf>

Ignoring all those extra fees and charges unrelated to a single payment, Authorize.net charges 2.19% + $0.27 in the best case (qualified domestic Visa). In the worst case (non-qualified international MasterCard), they charge 4.49% + $0.2685.

Even only considering the best case, Stripe's 2.9% + $0.30 doesn't seem 'ripoff' to me.

</comment></comment><comment><USER21> If I was Stripe I'd be politely asking you to take this down. It's using their trademark (presumably) without permission and encouraging their users to do something very inadvisable.

Offering to host this seems like a really bad idea.

I know you're well meaning and trustworthy, but this shouldn't be run by a third party. For long term reliability reasons as much as security.

<comment><AUTHOR> I showed it to people at Stripe before announcing it.

<comment><USER22> Showing it "to people at Stripe" and getting permission to use it are two different things.

<comment><AUTHOR> I asked if it was OK; they said it was.</comment></comment></comment></comment>


Ask HN: Secondary monitor for travel? - <AUTHOR> I know (and have experience with) working with a second monitor increases productivity dramatically. However I am currently a student and need to get around to my classes. Has HN had any experiences carrying a secondary, USB-powered monitor for use with a laptop, in order to increase programming productivity? <comment><USER2> I could imagine using a tablet with some remote app, maybe? Haven't tried it though.</comment>


Get your wasted time back. Here's how - <AUTHOR> http://theleangrownup.com/2012/08/21/value-stream-maps/

<comment><USER2> "Shorten the time between external input needed, and external input available"

This is project management 101, and does not mention the pathological issue: if dev A is waiting for approval on code A, then he will go off and do work on lower priority code B, C, D. And they will wait, piling up the amount of work, making it look like the company requiresmore project management, better communications, more layers of managemnt and priority.

Basically Scrum has tried to evolve as a IT lead solution to pathological project management.

<comment><AUTHOR> Agreed. And the more layers of management and process a company puts in, the less likely they are to understand the benefit of just getting people to work through Product A from start to finish, without asking people to change context to Product B,C and D (which are lower priorities) and back again, losing track of the objective behind the product in the first place.

Context switching brings with it a loss of clarity in the purpose of each product you're working on. It drives an attitude of just working through a task list rather than driving towards the real goal of each product.</comment></comment>


Building a Device Lab (2015) - <AUTHOR> http://buildingadevicelab.com/ <comment><USER2> So... look at Google Analytics, buy the devices you see, plug them into the wall, and buy unlocked devices? Not sure why that required an entire domain, several pages and multiple eBook formats.

<comment><USER3> It's a non-trivial problem to provide all the devices with enough electricity and network bandwidth _and_ know how to handle soft & hard resets for devices that were never designed to run like servers. Yeah, a book isn't needed for managing just a few phones, but definitely needed as the number of devices increases.

<comment><USER2> With enough electricity and bandwidth? A phone sitting on a bench usually uses five watts at the absolute most - while charging.

Assuming you have an 1800W circuit (pretty standard) that's almost 400 phones. Even if you're in a Victorian-era home with ancient wiring and a 1000W circuit you can run two hundred phones off of that.

Also, having been to a bunch of device labs (and having my own mini one in my apartment with 15-20ish devices) bandwidth is never a problem. You typically only use one at a time, or with a shared lab maybe three or four at once.

The most effective "device lab" is a box of Androids and a few of the latest iPhones, with some chargers and a nice powerbank. You can just take the phones back to your desk and use them there.

I also have never met anyone who uses phones as "servers". In my experience you grab a phone, test something, and put it back, no? Maybe if you're before a big deploy you test on everything you've got.

I'm also not talking out of my ass here - I've made the CSS framework that's compatible with the most devices by far (including IE5.5 and certain versions of the Nintendo DS browser.) Testing it requires a tremendous number of physical and emulated devices. If you want to take a look, it's at [http://mincss.com](http://mincss.com)

</comment></comment></comment><comment><USER4> I don't understand why anything more needed to be said past looking at Google Analytics, unless the target audience was unfamiliar with electricity.

The titled intrigued me and I thought it'd have much more information on things like automating test builds and using unique device/OS features, not how a company worth almost billions can save a few hundred dollars by ignoring 20% of its users.

</comment><comment><USER5> I guess that is the new thing. An entire domain for your blog post. Am I missing something? Wait this is from 2015, I guess I did.

<comment><USER6> I imagine it helps when you've written a book to register the domain name for its title.

<comment><USER5> Oh my mistake, it looked and read exactly like a blog post.</comment></comment></comment>


Is new Facebook Groups design a whitewash of a certain image/b/oards? - <AUTHOR>

That's what it looks like to me. The bumping style. How information is added to the stream and commented on. Replace picture uploaded with normal profile picture or attachment? what do you think. <comment><AUTHOR> social friendly version.

to me its almost a "we can do it"-style recession solving, network connecting update. (job-wise)</comment>


Asia's Greatest Fear: A U.S.-China War - <AUTHOR> http://nationalinterest.org/feature/asia-flames-us-china-war-10621?page=show

<comment><USER2> No mention of nuclear weapons.

I'm not sure I can treat this seriously.</comment>


Joseph Pilates worked on his exercise system in a WWI prisoner-of-war camp - <AUTHOR> https://narratively.com/the-acrobatic-immigrant-who-invented-pilates-in-a-prisoner-of-war-camp/ <comment><USER2> I took Pilates for a few years in Manhattan because it was extremely helpful for core (abdominal) strength.

I found that there is tremendous variation in the quality of the instructors, some of whom were very specific ("controlled") in movements, and others who were kind of a liability. Also, there were plenty of studios on ClassPass, but many of the top instructors only hold private lessons, so there was a much higher tier that I've never experienced.

Overall I recommend it for anyone looking to cross-train for strength and flexibility, but do try a bunch of studios to find the instructor that works best for you.

<comment><USER3> Any Youtube instructors you'd recommend?

<comment><USER2> I've never looked at any videos. I personally would not feel comfortable trying the exercises without proper supervision since there is a lot of neck movements (I have a herniated disc).

And while you could do mat exercises at home, a studio will have the spring- based machines, like towers and reformers.

</comment></comment></comment><comment><USER4> Somewhat related. Newton did some of his good work while being isolated during the plague.

[https://www.thehindubusinessline.com/news/variety/how- social...](https://www.thehindubusinessline.com/news/variety/how-social- distancing-advocated-during-the-great-plague-led-to-newtons-theory-of- gravity/article31081259.ece)

</comment><comment><USER5> Great submission,I had no idea about the genesis of this physical discipline. Well written and enlightening story.

</comment><comment><USER6> Pilates will not help you in an event that requires you to be at your physical best. Strength and speed will. Powerlifting, Olympic weightlifting, bodybuilding, and gymnastics/calisthenics/bodyweight training for strength. Running, swimming, rowing, and cycling for speed. CrossFit for both. You want a strong core? Do overhead squats with a 61-kg/135-lb barbell. Do strict toes- to-bar. Do an L-sit for 60 seconds.

<comment><USER7> CrossFit seems like a bunch of nonsense with poor form that people largely do so they can talk about it.

<comment><USER6> CrossFit uses strict work as part of their training, such as strict pull-ups, strict toes-to-bar, etc. There are even strict versions of their famous benchmark workouts. One of them is "Cindy, Strict!" ([https://www.crossfit.com/190111](https://www.crossfit.com/190111)). My score was 12 rounds + 5 strict pull-ups + 10 push-ups + 12 air squats (387 reps).

<comment><USER7> Seems like "Part of" is the key word, and it also appears as though the goal of each day is to tell people about it in the comments. A solid calisthenics program would probably be more valuable imo.

<comment><USER6> I love calisthenics. I do the Recommended Routine over at Reddit Bodyweight Fitness: [https://www.reddit.com/r/bodyweightfitness/wiki/kb/recommend...](https://www.reddit.com/r/bodyweightfitness/wiki/kb/recommended_routine). I do this routine in addition to my Olympic weightlifting training. I do CrossFit for fitness testing and for that HIIT stimulus, not for "training" training.</comment></comment></comment></comment></comment>


A serverless architecture with zero maintenance and infinite scalability - <AUTHOR> https://medium.com/teletext-io-blog/a-serverless-architecture-with-zero-maintenance-and-infinite-scalability-b00c2ceb4c2b#.751mbzmx6 <comment><AUTHOR> An article about our serverless architecture and the benefits of having no servers at all</comment>