Cutting the Gordian Knot of Web Identity - <AUTHOR> http://www.codinghorror.com/blog/2011/09/cutting-the-gordian-knot-of-web-identity.html <comment><USER2> There's a couple of _very different problems_ getting presented here.

1) Password management, which is a solved problem by geeks and normals alike. Geeks use password managers. Normals use three passwords.

2) Single sign-on, which is less medicine and more vitamin as far as things go.

3) Net-wide identity. HERE BE DRAGONS.

As soon as you start doing the most trivial possible quanta of work to resolve the OMG DRAGONS, you start compromising the system's utility for password management and sign-on.

You'll need, minimally, new UI for "What information about yourself should we share with $NEW_SITE?" and for switching between users/profiles. This will happen in ways your users don't really understand.

Among the many OMG DRAGONS:

1) Microsoft, Mozilla, and Google can get into a corner and say "Heya, federated identity would be the awesome!" all they want, but there are laws in the US, Japan, Europe, and points beyond which don't make "It is an open standard!" int a compliance safe harbor.

2) You know that whole Google+ thing about real names and people having multiple identities which don't necessarily intersect with each other? Yeah, um, that.

3) Speaking of which, how about the other intractably hard problems for pre- filled biographical information like e.g. human names? They're, ahem, a wee bit tricky!

</comment><comment><USER3> I'll take this one further level meta: why the hell does any site need to know "who" I am, period?

I know the obvious answer: for the advertising and marketing leverage. I'll do my own hand-wave here and say that this is specious, that there's a sufficiently rich predictive dataset based on other extant characteristics (browser type, IP location, on-site behavior) to do an adequate job of targeting ads to my instance of AdBlock+.

A large part of the reason I don't subscribe to sites such as The New York Times is ... I feel really uncomfortable having _my_ list of reading preferences on the news site available. That's discoverable in all sorts of ways (legal or otherwise), and I have to trust in the Times, its staff, temps, contractors, third-party business relationships, vendors, ISPs, systems disposal methods, etc., etc.... Multiplied by every site on which "I" have an account. Um. Thanks but no.

There's the issue of payment. Bitcoin is only the latest iteration of a digital cash. Many banks now offer one-time payment tokens. There's _no_ technical reason (though arguable usability reasons) for me to have to provide a shared secret (my account number and verification code) with every online (or offline) financial transaction. This system is proving increasingly fragile, and both online and offline systems have and will be compromised. Cash risks only the current value held. Credit/debit risks a future stream of compromised payments.

I'm moderately fine with the old-school world of pseudonymous passwords, especially with fallbacks of cypherpunks/cypherpunks, or cowbodyneil/cowboyneil (or BugMeNot) on sites. If nothing else, I'm sending a very clear signal that _I don't want my data mined and I don't trust YOUR systems for guarding against this so I'm invoking my own_.

There's still the closing problem of delivery. This can be managed by various means, including selective disclosure to the shipper only.

In the real world, we engage in complex transactions based on very limited identity and information disclosure. The person who makes my pencil (or ThinkPad) has no idea who I am or where I live, let alone much information about the other entities responsible for the production of the product.

The technologists here know that building a modular system with limited information disclosure based on what's needed to accomplish a given transaction, presented at the interface between operations, leads to a simpler, more robust, and ultimately better system. Why are we trying to design an online commerce system that's at such odds to these principles (see "ads/marketing comments above)?

</comment><comment><USER4> I wish he would stop referring to it as "Internet Driving Licence", that implies some level of skill & a test is required to pass it, and that you can get punished with penaltiy points, and that you're licence could be revoked. Perhaps "internet identity card" / "internet passport" is a better term?

</comment><comment><USER5> I'm not sure I like this solution very well. It's tied to a particular device and browser (unless you authenticate to the cloud or something, which means you have to deal with passwords anyway), and if someone sits at your computer they can log into all your stuff.

However, here's an interesting authentication solution I've been reading about lately[1] proposed by an actual security researcher. That blog post links to his peer-reviewed paper and to a talk that he gave.

The idea is basically to have a specific identity manager device he calls a "pico", with a little camera on it. Web sites can display a QR-code or something with its public key in it, you point the pico at it, and the pico authenticates with the site on its own. His proposal also includes weird "pico siblings" and stuff like that, which seems unfeasible to me, but some version of it as a mobile app might be interesting.

[1] [http://www.lightbluetouchpaper.org/2011/03/27/pico-no- more-p...](http://www.lightbluetouchpaper.org/2011/03/27/pico-no-more- passwords/)

</comment><comment><USER6> I'm a bit wary of any system that automatically supplies identity information to a website. Under a system like this, how would you decide 'I don't fully trust this site so give it a different email address and fake name'.

<comment><USER7> There is a confirmation step mentioned, you could choose an alternate identity then or generate a random one just for this site.

</comment></comment><comment><USER8> Mozilla launched browserID, but in reality its not much different from facebook, twitter, google, openid etc. Facebook and twitter give webmasters the promise of virality that's why they have been relatively successful.

Still, they are a nightmare. What if facebook decides to ban your domain? What if user's account gets hacked?

What if we changed the rules of the game a bit: Take your cookies and browser settings with you in a USB key. Websites know you by the session id stored in your browser-wallet. They don't even need to know your name or your password. You can use your friend's computer and fool around, without having to delete recent history and cache afterwards.

Or instead, store browser settings in the cloud, or in a secure P2P network. Login to the browser, not websites. Google sync does that partly, and it's convenient. No need to transfer bookmarks, settings and passwords when you get a new computer. Maybe that's where we are headed.

<comment><USER9> I have thought about that... but more and more, I browse the internet from some sort of closed system (iOS and Android devices). I also switch operating systems quite often. I doubt any solution, other than "just remember the damned password, you remember N of them, so you can remember N+1, right?" will work vertically on all of those.

</comment></comment><comment><USER10> Problem: I can never switch browsers without having to create new logins for all of my sites.

<comment><USER11> He suggests your identity data be stored in the cloud so all your browsers and devices can access it.

He doesn't mention whether or not you need a password to connect your new phone to your cloud identity wallet...

<comment><USER10> I didn't sense that he meant for the user to be involved in the cloud aspect, just that the browser stores it there so that it can persist beyond sessions, single computers, etc.

If the goal is no more passwords, what is the handshake mechanism to move my Firefox data to Opera?

</comment></comment></comment><comment><USER12> Current solutions to many-passwords problem are: * identity service like OpenID, Twitter, Facebook * Password Manager like LastPass, KeePass

I wonder if, at least in some cases, we could somehow get rid of identity requirement altogether: given a site that currently requires user accounts, change its mode of operation so that identity either doesn't matter at all or doesn't matter as much (the site is useful for anonymous users)

<comment><USER13> Educating developers to make sites that don't require login is a social solution. Those have historically proven less workable than technical solutions.

</comment></comment><comment><USER14> This idea doesn't address his complaint (expressed multiple times) about accessing from different devices. In fact, this makes that essentially impossible.

<comment><USER15> I think he's assuming that browsers defer password storage to some sort of cloud-based password storage service (presumably of your choosing). Hence the mention of needing to trust the cloud.

</comment></comment><comment><USER16> wouldn't some sort of public-key auth largely solve the problem of authenticating a user? I mean, I could give every site I use the same public key without worrying that they could then impersonate me to other sites.

Assuming I give them the public key rather than relying on some sort of CA system, we've also removed the problems inherent to authenticating through a third party.

As far as I can tell, the only problem with this approach is poor browser support. To my knowledge, the only public key systems that have wide browser support are tied up with certificate authorities and other stuff for actually verifying a real identity, which is a separate (and much more difficult) problem. It seems to me that if we just had something that worked like OpenSSH public keys that worked in a web browser, we'd at least have solved the problem of coming up with secure passwords for every site.

</comment><comment><USER17> I blogged about a solution to this about 9 months ago: [http://blog.theamazingrando.com/the-road-to-better- authoriza...](http://blog.theamazingrando.com/the-road-to-better- authorization)

Same idea: A browser (or extension) that knows how to sign up, and log in. Sign up would fill in the form from my choice of profiles (personal, work, fake). Log in would automatically use the saved credentials, and allow me to switch accounts from within the browser. Sync it to the cloud, or let me export/import it to another browser or device.

Edit: HN discussion of that post: <https://news.ycombinator.com/item?id=2128966>

</comment><comment><USER18> Why don't any websites add the option of just emailing me a link to login anytime I want to use the site. Effectively this is what happens with "forgot password" features.

<comment><USER19> because if your email account is hacked with a forgot password system you could discover it because your password would change, whereas with a login link someone could use it without you knowing.

</comment></comment><comment><USER20> Is there a mirror of this anywhere? I'm getting 404.

edit: never mind. It's back.

</comment><comment><USER21> Sometimes trying to make things too simple just adds complexity. A good password manager can do this without the same risk of identity theft and loss of anonymity. I think many repressive governments would love to have one central tracking option. Even if you could somehow insure that it would not be aboust you would want the ability of a local record incase of censorship or domain blocking by competing businesses. I am unconvinced that the Internet would not work without a reasonable level of anonymity. A secure log in is not required for every website you visit as the article seems to claim.</comment>


The future of the Crystal language - <AUTHOR> http://crystal-lang.org/2015/12/24/the-future-of-crystal.html?hn <comment><USER2> I don't know it is only me or its apply to others too, My own field is OS and I love it. But recently I am literally fascinated by whats going on in "Programming Language" field. Rust, Go, Nim, Julia, Haskell, Ocaml, Racket, Clojure etc (though these are not scientific research in PL community, but we can claim these are mostly result of scientific research). I wasn't aware of crystal . I literally Love them all and if I were going to an abandoned island for rest of my life , my only wish would have been : "let me play with all of these for rest of my life"

BTW : I looked at crystal syntax (I am talking about only syntax). Syntax designed extremely clear. I would say (my opinion, in short time I had to investigate crystal) maybe clear'er that python.

</comment><comment><USER3> The real reason they couldn't find anything when Googling the language in the future is because of the inconvenient naming. Every time I search for Crystal, I have to pick out the results from SAP Crystal Reports.

I wish more people took this aspect of their projects seriously. You don't need a short domain name, but your project does at least need to be Googlable.

<comment><USER4> It's the same with other languages as well: Go, Julia, Ruby (when I searched for some "Ruby Bangkok" meetups, I found thousands of offers to buy real rubies in Thailand. Same with frameworks: Phoenix, Sinatra, Iron, Gin.

After some time Google learns and shows you relevant results, but if you use Startpage or DuckDuckGo, you have to add "lang" or "framework" to search query

<comment><USER5> C is by far the worst...

Side Note: In DDG Lua doesn't need 'lang', you can type in a function name and it'll give you documentation in the 'instant answers' thing.

</comment></comment></comment><comment><USER6> If you're a web dev and want to build an API be sure to check out Kemal: [http://serdardogruyol.com/kemal/](http://serdardogruyol.com/kemal/)

<comment><USER7> a Sinatra for Crystal. Wonderful. Now if there is a Sequel equivalent… I'll be sold.

</comment></comment><comment><USER8> > Note that the above "if" starts with "if instance variables types remain the > same". But how can we know that? The problem is that the compiler determines > their

> type by traversing the program, instantiating methods, and checking what > gets assigned to them. So we can't really reuse the cache because we can't > know the final

> types until we type the whole program! It's a chicken and egg problem."

Maybe I'm oversimplifying it, but suppose you compiled a statement like...

a++

...into something like...

if a is an integer (which would presumably be something fast like "CMP [RAX],123; JNZ NotAnInteger") do "INC [RAX+8]", otherwise do more expensive stuff to look up the actual type and a function to use as a ++ operator?

As long as the programmer sticks to the same type, the compiled expression runs fast, and if they switch types midstream, it still runs, albeit with a performance hit.

<comment><USER9> You might be interested in deoptimisation: :)

[http://chrisseaton.com/rubytruffle/deoptimizing/](http://chrisseaton.com/rubytruffle/deoptimizing/)

This would have the effect that you describe (actually even faster than what you're proposing, by essentially trapping on all changes to the target to know ahead of time that deoptimisation has to occur), but it's not the world's most trivial feature to implement.

</comment></comment><comment><USER10> Taken from Github on the "why?"

We love Ruby's efficiency for writing code.

We love C's efficiency for running code.

We want the best of both worlds.

We want the compiler to understand what we mean without having to specify types everywhere.

We want full OOP.

<comment><USER11> >We love Ruby's efficiency for writing code.

Ruby's syntax is one of the worst parts of Ruby. [0]

>We love C's efficiency for running code.

Many other languages have efficient native code compilers, too. I don't know why people assume this is only a C thing.

>We want the best of both worlds.

>We want the compiler to understand what we mean without having to specify types everywhere.

This is good. I much prefer dynamic languages to static ones. Though I don't know if Crystal supports the best parts of dynamic languages like runtime program modification AKA live coding.

>We want full OOP.

Single paradigm languages feel very restrictive to me. I like languages that support many paradigms because different parts of programs call for different programming techniques. OOP in particular is a paradigm that I feel forced to use more often than I feel it's the right technique for the task at hand.

[0] [http://programmingisterrible.com/post/42432568185/how-to- par...](http://programmingisterrible.com/post/42432568185/how-to-parse-ruby)

<comment><USER4> > Many other languages have efficient native code compilers, too. I don't know > why people assume this is only a C thing.

I think it's just become very common to show C as the reference to show how fast are other programming languages, and everyone keeps it this way.

> Ruby's syntax is one of the worst parts of Ruby. [0]

For people who write the language, yes, it's incredibly hard to parse (and that blog post doesn't mention the new ambiguous things like keywords vs. hashes)

Yet, for people who use Ruby, it's very convenient and easy to read.

<comment><USER12> People used to find Perl convenient and easy to read too.

> Similarly, distinguishing puts ([1]).map {|x| x+1} from puts([1]).map {|x| > x+1} is handled by setting flags after skipping whitespace, and later > checking these flags to emit an LPAREN or an LPAREN_ARG token. As well as > semantic whitespace, flags are used for blocks, class definitions and method > names too.

What the actual fuck.

<comment><USER13> _What the actual fuck._

That's not particularly unusual, is it?

<comment><USER12> Significant whitespace, except to separate tokens, is unusual. Significant whitespace that is used for something other than delineating blocks is extremely unusual.

</comment></comment></comment></comment></comment></comment><comment><USER14> If I had to optimize parts of a ruby project, I think it would be much better to port the code to crystal than C or Go.

</comment><comment><USER15> Only just had a quick peep and play and I like it - looking forward to using Crystal more often on a tooling level.

Nice work to date...</comment>


Ask HN: Any good apps for time-zone syncing with remote colleagues? - <AUTHOR> I'm a team lead in a 100% remote team and I have a ton of calls across 20+ timezones with customers, team members and partners. Been using worldtimebuddy.com for timezone syncing, but it's not perfect. I spend an average 10 mins scheduling a call, which adds up to a lot of time wasted. What time zone app or workflow do you use ? <comment><AUTHOR> Just came across this app called Clocker and started using it. It's really good and suits my workflow! [https://apps.apple.com/us/app/clocker/id1056643111?mt=12](https://apps.apple.com/us/app/clocker/id1056643111?mt=12)

</comment><comment><USER2> It is designed for a different use case than yours, but I used [http://calendly.com/](http://calendly.com/) for scheduling calls across time zones when I was doing job interviews and it worked well.

<comment><AUTHOR> Yeah, I tried it. I work 3 days a week from 9 to 5 and 2 days I'm available from 7am to 11pm. I can't seem to set up these kind of settings in Calendly. Is it possible?

</comment></comment><comment><USER3> I use a combination of Slack and Gcal. Slack will tell you someone's local time. Gcal will show you when people's working hours are (if they're set) when trying to invite them.

<comment><AUTHOR> Yeah, most times those working hours in GCal are pretty outdated. Slack showing local time is meh. Prolly better if they show this person is 6 hours ahead of you or 4 hours behind you.

</comment></comment><comment><USER4> I've heard good things about [https://everytimezone.com/](https://everytimezone.com/) previously (no affiliation).

<comment><AUTHOR> Thanks! Doesn't suit my needs though

</comment></comment><comment><USER5> Try this [https://savvytime.com/](https://savvytime.com/)

<comment><AUTHOR> Thanks! Doesn't suit my needs though

</comment></comment><comment><USER6> [https://spacetime.am/](https://spacetime.am/)

<comment><AUTHOR> This is interesting, thanks for sharing!</comment></comment>


Simple Regex Language - <AUTHOR> https://github.com/TYVRNET/SRL <comment><USER2> I would be nice if it was possible to convert both ways so you could use it to explain existing regex.</comment>


Mixpanel (YC S09) Raises $65M to Build Predictive Data Tech - <AUTHOR> http://www.wsj.com/articles/BL-VCDB-16129

<comment><USER2> Congrats to Mixpanel on the raise. I have heard many great things from them and used them at a previous company. They've done a great job of making it a no-brainer for startups to start using more advanced analytics tools (not just Google Analytics) from day 1. I think we're all better off for the ability it gives product developers to improve their product based on actual usage--since it means the overall quality of products is far better than if vanity metrics drove all product decisions.

I noticed they mentioned Heap Analytics ([https://heapanalytics.com/](https://heapanalytics.com/)) as one of their competitors. We've been using Heap for over a year and it seems like the logical and magical next step in analytics. Mixpanel gave you smarter analytics on things you had the foresight to track, but Heap automatically tracks everything from the day you integrate it. That means you can get smart analytics even on things you didn't have the clairvoyance to start tracking 6 months ago, or didn't have the resources to insert tracking code in.

For startups, Heap's automatic and retroactive tracking is huge. It means we can iterate on product features and marketing/outreach schemes way more quickly while still getting insight into what's successful and what's not. It's not perfect--a couple times we've added special class names to our HTML elements so Heap can distinguish them, but that's still easier than adding manual tracking code--but it's a huge improvement over the old way.

I noticed Heap has a page comparing themselves with Mixpanel ([https://heapanalytics.com/compare/heap-vs- mixpanel](https://heapanalytics.com/compare/heap-vs-mixpanel)) but I don't see anything similar from Mixpanel's POV. I'd be curious to hear what Mixpanel's plans are in this area (automatic/retroactive tracking).

<comment><USER3> 100% agree with the theory of what you're saying, but in practice I've found that none of these new event-based analytics tools provide much value until you add custom attributes to the events. That is where you get the important slicing and dicing and segmentation.

Unfortunately, Heap's approach only captures the events automatically but can't capture the business-specific attributes that need to go on those events. Ultimately that will always require some human being to think about their business-specific problems.

<comment><USER4> (I'm a founder at Heap.)

This is an excellent point. Two things:

1\. Empirically, we've found that our customers rarely fall back on custom attributes. The vast majority of queries run in Heap (>75%) operate on automatically-captured events. To me, this suggests we've either: 1) cut out a significant portion of implementation work, or 2) enabled analysis that was previously _blocked_ by implementation work. If either (or both) are true, it's a win, and suggests that automatic event-tracking produces salient data out-of-the-box.

2\. That said, some metrics are important and _do_ require manual instrumentation. Coincidentally enough, we're about to launch a feature that solves the problem you mention and requires no extra implementation work. We're excited about it. Want to try it out on newrelic.com?

<comment><USER5> Doesn't NewRelic have it's own event-based analytics program (aka Insights)?!?

<comment><USER6> (ಠ ಠ)

</comment></comment></comment></comment></comment><comment><USER7> I really wish they would invest in helping their users answer the "Why" question more. Why did users click that link 5000 times? Why is this funnel dropping off? Why did the time-to-first-interaction increase?

These are questions for the business, but I feel like Mixpanel could add so much more context. "We noticed that 'time to first interaction' has gone down with 'watched home page video'." That would at least be a clue.

MP has the data, but all of that analysis is manual (or was, last time I used it).

<comment><USER8> This is in essence the "killer feature" of the analytics world, and it is hardly an easy problem to solve.

Before Mixpanel can even attempt to solve that though, they first need to tackle multi-channel attribution. Right now GA and Adobe are the big players who tackle it, and GA only offers dynamic attribution (ie. the holy grail of attribution) in GA Premium (which costs $150k/yr).

If you want a standalone attribution platform you're left with options like VisualIQ, Convertro, Adometry, etc., all of which have recently been acquired by big players in the space.

So yes, I'd love to see Mixpanel answer the "why." However the first step is to truly answer the "where" question and until they add those tools, their model is still fully last touch, and therefore dated.

Of course even GA doesn't use its attribution modeling capabilities outside of the multi-channel/attribution reports, so they still have a ways to go too. The big difference is, those tools are available today for free.

That said, congrats to Mixpanel. They made huge strides in the event tracking approach that GA has since gone on to borrow, and that is what any modern web analytics platform looks at these days because it simply makes more sense.

<comment><USER9> A plug for a former employer but I'd like to add optimine, [http://optimine.com/insight](http://optimine.com/insight) to your list of attribution platforms.

They've got an elegant and, as far as I know, unique modeling approach that avoids the first-touch/last-touch/path-analysis pitfalls.

<comment><USER8> I've heard of them before. Seems like they are largely for bigger players with offline touchpoints. How do they do with online SaaS companies with sales cycles 30-90 days out and a variety of content efforts, social media, video campaigns, etc.?

Also, would I need an ad server in place to properly attribute display or can they handle that on their own?

<comment><USER9> I think you are right they are targeting large advertisers with significant spend.

It's a unique approach in that they don't need a lot of granular attribution data, but instead use higher level aggregate data. As a result it's easier to integrate with all kinds of media campaigns.

You need to be able to provide impressions over time for your early funnel ads and conversions over time for your late funnel touchpoints. They use some econometric time series techniques to analyze and estimate the impact so you can focus on whats working.

<comment><USER8> Interesting, thanks for the details. Right now I'd give anything for a dynamic attribution solution that didn't cost an arm and a leg and could be used at the level of volume a SMB deals with.

GA's attribution tools are fun to play with, but at the end of the day they are still static models that don't evolve over time as they collect data.

</comment></comment></comment></comment></comment></comment><comment><USER10> Really impressed with their openness on the terms of the deal. He disclosed valuation ($865mm-post) / dilution (7.5%) and their balance sheet ($22mm). Very impressive terms for that matter. Congrats on the round and success with the business.

</comment><comment><USER11> Congrats to Suhail and team. They have done absolutely incredible work with Mixpanel, building the world's best analytics solution, starting from a tiny team and against stiff competition.

</comment><comment><USER12> It's an interesting idea - but I'm skeptical that they can create a generalized data model to support predictions across a wide variety of industries or verticals.

</comment><comment><USER13> 2015 is so going to be the year of personalization and actionable analytics. Seeing this stuff everywhere.

</comment><comment><USER14> Congrats to the Mixpanel team. They have always been very supportive when we've had questions. When we had a problem with a particular statistic a few months back, they actually came on-site to diagnose.

</comment><comment><USER15> Kudos to the hardworking team. I'v always thought that Google would acquire them, but their commitment and goal driven startup means a lot to their clients at this point, which is awesome.

</comment><comment><USER16> Mixpanel is awesome and rightly so their product is awesome!</comment>


Ultimatim from Russia: Ukrainian invasion unless surrender by 5am - <AUTHOR> http://www.reuters.com/article/2014/03/03/uk-ukraine-crisis-ultimatum-idUKBREA221AI20140303

<comment><USER2> Good news for Russian coders. Behind sanctions, with oil and gas exports banned, Western banks banned from loaning to Russia etc., coders will party like it's 1999!</comment>


Django Software Foundation announces membership drive - <AUTHOR> https://www.djangoproject.com/weblog/2012/jan/16/dsf-membership-drive-2012/

<comment><USER2> More freedom software projects should be have a foundation behind them, like GNU or Linux Foundation.

<comment><USER3> What are the benefits of having a foundation?

<comment><AUTHOR> There are two main reasons for a project to have a foundation.

Firstly, there's the legal benefits. The foundation can be the legal guardian of copyrights and trademarks associated with a project. Copyrights and trademarks have to be owned by someone -- even if you're open source. Having a foundation provides a way to have some public governance of those legal instruments, instead of having them held by an individual or private company.

Secondly, there's the community organization benefits. If anyone wants to donate money to a project, someone has to accept that money. Having a foundation provides a entity that can accept that money, and then distribute it. As an added bonus, it means that money can be donated in a tax-attractive way (the DSF is a 501(c)(3) not-for-profit, so donations are tax deductible in the US), which makes it easier to attract donations.</comment></comment></comment>


Reverse Engineering the Human Diet - <AUTHOR> http://www.earth360.com/diet_paleodiet_balzer.html

<comment><USER2> One of my first successful start-ups was software that helps make sense of the 35,000+ medical studies that are published each year. (The software helps find design flaws, does cohort analysis, helps summarize results, etc.) During that experience, I became very interested in nutrition research as a hobby. I basically learned that things I grew up eating were unbelievably bad for me. (I grew up drinking milk, eating meals centered around meat, with lots of refined, fried and sugary ingredients. Good old Southern cooking and Standard American Diet.) I also learned that much of what we are taught ("Milk for strong bones") is complete bullshit when you actually read the studies. Milk is really for osteoporosis and breast cancer.

We sold that company, and I stopped seriously reading on the subject. Recently, illnesses in my family (cancer and autoimmune diseases) have caused me to get into the subject again to an even greater degree. I've also experimented with my own diet for the last several years and I've arrived at a very different conclusion than this fellow.

There are tons of people that have an almost religious agenda about pushing specific diets. They are usually well-intentioned...they just really want to believe they are right. They publish pseudo-scientific articles like this one that have just enough logic in them to seduce people into believing them. The media is also horrible about publishing sensational (but poorly analyzed) nutrition research. They flip-flop their headlines so much ("Coffee Can Cure X", then "Coffee Causes X Cancer") that people finally just give up on trying to understand nutrition and they just continue eating the crap that they have always eaten. Which is amazingly sad, because proper nutrition is really the best medicine on earth.

I LOOOOOOOVE steak and ice cream, but a vegetarian/vegan diet has been shown in almost every study to be a more healthful diet in every respect. And the studies that fail to show that are usually flawed and/or underwritten by industry trade groups. There is no "perfect diet" for everyone...there will always be corner cases. Some people with specific genetic predispositions SHOULD avoid grains altogether. Apart from gluten sensitivity, there is the issue of molecular mimicry and genetic autoimmune issues, etc.

Modern people are dying of heart disease, cancer and strokes, though. Those illnesses are linked to higher consumption of meat (Paleo-coronary, anyone?), dairy, sugar, cooking oil, and refined foods. We are NOT dying of starvation, hypothermia, or tooth loss - which were probably some of the more pressing concerns in the paleolithic era. We are also living 2-4 times longer than our ancestors, on average, so we have entirely different concerns.

This is really a fascinating area of research...I've noticed that tons of computer hackers are also very interested in nutrition and body/diet hacks.

<comment><USER3> > a vegetarian/vegan diet has been shown in almost every study to be a more > healthful diet in every respect

Vegetarians have a higher death rate than meat eaters of the same socio- economic class at all ages.

Every study that looks at actual disease and death rates, and not assumed correlates like cholesterol, has found health benefits from high animal fat intake.

> heart disease, cancer and strokes, though. Those illnesses are linked to > higher consumption of meat (Paleo-coronary, anyone?), dairy

Population studies show decreasing rates of heart disease and cancer with increased dairy and meat consumption. Look at post-war Europe and Japan.

<comment><USER2> Um...citations?

I'm curious if you got these ideas from a certain organization that was started by a long-dead dentist? Your use of the phrase "assumed correlates like cholesterol" made me wonder. I guess you discount the Framingham study (or the few thousand follow-up studies that were published and peer-reviewed) that DO show a strong correlation between dietary cholesterol and heart disease?

I don't have time to post a few thousand citations that contradict your viewpoint right now, so I'll just start by mentioning the Cornell China Study:

The Cornell China Study is considered the most comprehensive study of health and nutrition ever conducted. It is a joint research program between Cornell, Oxford, and the Chinese Academy of Preventative Medicine. The data was from twenty plus years of research in 65 Chinese counties. It is often cited because of its size, scope, and the fact that there was such a wide range of diet data represented (high meat consumption populations on down to populations with little or no meat consumption, for example.) It found a strong correlation between increasing meat consumption and increasing disease and mortality. It is an interesting study. You should check it out.

American men eat a great deal more meat (10 to 20X in urban areas) than Chinese men, on average. American men also die of heart disease at almost 17 times the rate of Chinese men. This trend holds true, in the aggregate, no matter where or what time period you study. The countries with the highest meat and dairy consumption have the highest rates of cancer, diabetes and heart disease. Even in post-war Europe and Japan. Even accounting for genetic differences.

I don't want to come off as a TOTAL pompous ass, so I'll only cite more studies if you're actually interested or still want to argue with me. I spend between 15 and 20 hours researching nutrition each week, so it is a pet peeve of mine when I hear total BS passed off as truth. Like I said, proper nutrition is the best medicine on earth...even though eating properly is NOT necessarily simple, easy or fun. Wanting steaks and ice cream to be healthy does not make them so.

<comment><USER3> Apparently you have a problem with the source, but this pretty well dismantles the China study. <http://www.westonaprice.org/bookreviews/chinastudy.html>

Other major flaws are readily found through google.

Elsewhere it comes to light that Colin Campbell has ties to animal rights activists, calling into question his motives.

<comment><USER2> Yes, I have a problem with the source. I thought that might be your source based on your phrasing and the fact that there are so few that criticize Campbell's research.

I won't go out of my way to criticize the Weston A. Price Foundation, though. People can make up their own minds. I just find it funny that you question Campbell's motives, but not the motives of his critics.

Campbell has spent 50+ years as a scientist, largely funded by research grants from the National Institute of Health, and has arrived at the conclusion that diets low in animal products are healthier. Since a responsible nutrition researcher is likely to share and promote news that he believes to be both lifesaving and actionable, it is only natural that he would ally himself with other physicians that have also come to the same conclusion (Physician's Committee for Responsible Medicine) to spread that message. PCRM is a great organization, in my opinion, and their membership is composed of some of the leading physicians in the area of nutrition, including the physicians that are the only ones to have successfully reversed advanced heart disease without medication.

The Weston A. Price Foundation claims it is 'unbiased', in contrast to the PCRM. That is bullshit. Follow the money to smell the bias. The Weston A. Price Foundation's membership is largely composed of family farmers, including ranchers and dairy farmers. Do you think they might be a bit biased on the subject? You will notice that the foundation's homepage at <http://www.westonaprice.org/> currently has logos from eight companies that sponsor their conferences. What do we see? A meat company, a seafood company, a supplement company, a publishing company, etc. Yep, no bias there.

By the way, the link you give is for a review of the book "The China Study" by Campbell and his son, which is not the ACTUAL published China research study I was citing. Only a chapter of that book is devoted to the China research study. Campbell wrote a rebuttal to the review you cite, which is reproduced at:

[http://www.vegsource.com/articles2/campbell_china_response.h...](http://www.vegsource.com/articles2/campbell_china_response.htm)

Masterjohn then wrote a rebuttal to that rebuttal...and then Campbell wrote a response to that. It's all very tiring, actually, because anyone can just look at the research studies in the aggregate and see who is right based on the science.

</comment></comment></comment></comment></comment><comment><USER4> Citations needed. Otherwise this is the random ravings of a crank on the Internet. (Which is fine...that's what the Internets are for, but I don't have to listen to them.)

Sure, some of the suggestions are valid, but other assertions just aren't backed by science.

<comment><USER5> He doesn't sound angry at all. I've read similar discussions. Most foods in the supermarket are manufactured and flash-baked, not baked or picked. This really works and you'll feel great. Avoiding grains, milk, and corn syrup (found in sodas and juices, hot dogs, and other places you wouldn't think of) as well as all manufactured foods is exactly the best way to go.

The problem is, this can get much more expensive. I'd love to be able to follow that for sustained periods of time. On the other hand, everything you eat that's not manufactured gives much more energy throughout the day. Who cares how much 'heat' a food generates in calories? What matters is what kind of energy you get from it.

<comment><USER6> > He doesn't sound angry at all.

Mellow people can be crazy too. Though, whether he's crazy or not, there isn't a shred of evidence presented besides the picture of "tribal health" he paints.

<comment><USER5> I don't think he meant this to be a scientific paper, otherwise, as a physician, he could be liable for giving out medical advice. I can see how he would make this message appear informal. A lot of writing by nutritionists aimed at the general public is similarly informal and easy to understand.

I've read many stories and know that avoiding cereals, grains, and milk is a good idea for weight loss and sugar management.

I was able to google some sources. Note that pesticides may also introduce toxins. I'm with Steve Pavlina on trying things and seeing if they work. The advice seems to be true.

<http://www.nourishingourchildren.org/parents/cereal.html>

Like he said in the article, he doesn't mean toxic in the unsafe sense. He means toxic in terms of, it's not good for your body. He means it's not the natural way every species on earth has consumed this food for thousands of years.

<comment><USER7> That link is interesting but I can't find any evidence that it's true. How can I tell that he didn't just make up the story about cereal being bad? It seems like any easy experiment to reproduce -- just buy a rat and a box of corn flakes.

<comment><USER5> This article references both studies but includes sources.

<http://www.westonaprice.org/modernfood/dirty-secrets.html>

<comment><USER7> She just says, "Let me tell you about two studies which were not published."

Where did she learn about these two studies? It doesn't say.

Let me tell you about an unpublished study where rats fed cornflakes were able to live for 100 years...

<comment><USER5> I assume she was still referring to Paul Stitt's book:

"In his book Fighting the Food Giants, Paul Stitt has tells us that the extrusion process used for these cereals destroys most of the nutrients in the grains."

(three paragraphs later, the rat study)

"Let me tell you about two studies which were not published. The first was described by Paul Stitt who wrote about an experiment conducted by a cereal company in which four sets of rats were given special diets... "

Since the book and study described by Paul are about cereal, and both paragraphs are near one another, I think the study is better described in that book. And since the study is attributed to a cereal company, that explains why it went unpublished.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I've seen claims like this a lot: "There are races of people who are all slim, who are stronger and faster than us. They all have straight teeth and perfect eyesight. Arthritis, diabetes, hypertension, heart disease, stroke, depression, schizophrenia and cancer are absolute rarities for them. These people are the last 84 tribes of hunter-gatherers in the world."

Is that actually true though? It seems like the sort of thing that should be easy to verify or disprove. Whether it's actually caused by diet would be harder to prove, but if these people really are free of all those health problems, that would be quite remarkable and should be studied more carefully.

<comment><USER2> There is a really good book out right now called "Healthy at 100" by John Robbins that speaks to this very subject. It looks at several cultures that tend to have a larger % of HEALTHY centenarians, such as the Okinawans and Hunzans. It looks at what they eat, how they live, etc. It is good because he acknowledges the self-reporting errors in such studies ("Yeah, dude, I'm 110 years old!") and the impact of physical activity and social bonds on longevity, etc.

John Robbins is biased (toward vegetarianism/veganism), but his bias is based on sound principles (science, self-experience, environmental impact, ethics, etc.) The book is not preachy or anything, though. His other books are also really good. Especially if you're interested in the food industry, animal cruelty, nutrition and disease, etc.

He's a very interesting guy. He walked away from the Baskin-Robbins fortune to live a simpler and healthier life after his dad and uncle (Robbins and Baskin, respectively) both died of heart disease from eating too much of their own product. His one room, self-built cabin with second-hand furniture was featured on "Lifestyles of the Rich and Famous" and it became one of their most requested shows, to everyone's surprise. He's a pretty inspiring guy.

</comment></comment><comment><USER8> is it true that some of these other cultures don't suffer from schizophrenia and other illnesses like that?

<comment><USER9> It would be difficult to verify. Many cultures have great stigma associated with mental illness, and their people will go to great lengths to conceal it in their family. China is a prominent example.

<comment><USER3> A lot of these primitivists extolling stone age culture tribes praise their perfect health without mentioning the infanticide. Many (most?) stone-age technology tribes kill unhealthy infants. They have a definition of life that begins at age one. It would be impossible to isolate this effect from diet.

</comment></comment></comment><comment><USER10> See also Art Devany's writing, at <[http://www.arthurdevany.com/evolutionary_fitness/>](http://www.arthurdevany.com/evolutionary_fitness/>). He sometimes (but not always) refers in his blog entries to recent supporting research for the 'paleolithic' diet ideal. There's a lot of similarity to 'low-carb' diets that have been popular.

An overview of DeVany's health outlook is in the essay, <[http://www.arthurdevany.com/webstuff/images/RevisedEssay.pdf...](http://www.arthurdevany.com/webstuff/images/RevisedEssay.pdf>). Interestingly, in DeVany's view, endurance running (as in a marathon) is a very bad thing for long-term health.</comment>


Digging Through iOS Graphical Ressources - <AUTHOR> http://blog.manbolo.com/2013/01/21/digging-through-ios-graphical-ressources

<comment><USER2> Are developers allowed to use these resources freely in their own apps? I ask because "look and feel conflicts with first-party apps" has been grounds for rejection in the past.

<comment><AUTHOR> mmm... Good point, nevertheless you can already use some resources (like the refresh button, or the favourites icon). But icon, popover background, textures, buttons, should be safe because they're not too branded. For settings icon, it should be more prone to be rejected...

<comment><USER3> I don't think there really is a clearly defined boundary here.

I've worked on projects at past jobs where the designs demanded that we duplicate the look and feel of certain iOS system APIs and programs to a T. Apple passed those through approval without making a sound about those bits.

On the other hand, Tapbots has had an app rejected in the past for using a clock icon that looked a little like Apple's[1], back in 2009. And that wasn't an exact copy.

We're not going to get an official statement from Apple on this, so the best I can suggest is to tread with caution. Better to be inspired by than to flat out copy.

[1] - [http://tapbots.com/blog/app-store/a-well-timed-letter-of- rej...](http://tapbots.com/blog/app-store/a-well-timed-letter-of-rejection)</comment></comment></comment>


Study debunks notion that men and women are psychologically distinct - <AUTHOR> http://sinidentidades.tumblr.com/post/42395076857/study-debunks-notion-that-men-and-women-are

<comment><AUTHOR> I don't generally post "blogspam" (it's not my blog) but the paper is behind a paywall and the abstract is opaque jargon, so I thought the blog added some value here.

Edit: The link is the headline and also the same link is the second word of the blog. It goes here <http://psycnet.apa.org/journals/psp/104/2/385/>

Men and women are from Earth: Examining the latent structure of gender. Carothers, Bobbi J.; Reis, Harry T. Journal of Personality and Social Psychology, Vol 104(2), Feb 2013, 385-407. doi: 10.1037/a0030437

Taxometric methods enable determination of whether the latent structure of a construct is dimensional or taxonic (nonarbitrary categories). Although sex as a biological category is taxonic, psychological gender differences have not been examined in this way. The taxometric methods of mean above minus below a cut, maximum eigenvalue, and latent mode were used to investigate whether gender is taxonic or dimensional. Behavioral measures of stereotyped hobbies and physiological characteristics (physical strength, anthropometric measurements) were examined for validation purposes, and were taxonic by sex. Psychological indicators included sexuality and mating (sexual attitudes and behaviors, mate selectivity, sociosexual orientation), interpersonal orientation (empathy, relational-interdependent self-construal), gender- related dispositions (masculinity, femininity, care orientation, unmitigated communion, fear of success, science inclination, Big Five personality), and intimacy (intimacy prototypes and stages, social provisions, intimacy with best friend). Constructs were with few exceptions dimensional, speaking to Spence's (1993) gender identity theory. Average differences between men and women are not under dispute, but the dimensionality of gender indicates that these differences are inappropriate for diagnosing gender-typical psychological variables on the basis of sex. (PsycINFO Database Record (c) 2013 APA, all rights reserved)

</comment><comment><USER2> This is unbelievable blogspam. The linked article --

[http://sinidentidades.tumblr.com/post/42395076857/study- debu...](http://sinidentidades.tumblr.com/post/42395076857/study-debunks- notion-that-men-and-women-are)

\-- very briefly summarizes a study but without revealing its name, much less offering any links. A search online produces this much better but still flawed summary --

[http://www.rawstory.com/rs/2013/02/04/study-debunks- notion-t...](http://www.rawstory.com/rs/2013/02/04/study-debunks-notion-that- men-and-women-are-psychologically-distinct/)

\-- with the same title, and that has a link to the paywalled publication --

<http://www.apa.org/pubs/journals/psp/index.aspx>

\-- but this article also doesn't name the study or link to it. The above article says about the unnamed study: "Analyzing 122 different characteristics from 13,301 individuals in 13 studies, the researchers concluded that differences between men and women were best seen as dimensional rather than categorical."

So it's a meta-analysis, a technique with many pitfalls (<http://en.wikipedia.org/wiki/Meta-analysis>) unless precautions are taken not to combine studies and experimental groups that differ in ways that can destroy the meaning of any conclusions drawn.

Also, as is typical in psychological studies, the conclusions are phrased in ways that prevent any meaningful basis for testing or falsification by additional work. What does "dimensional rather than categorical" mean? Most likely it means the differences are a matter of degree, not kind, but that only changes the waffle-words, it doesn't turn the conclusion into testable, empirical science.

My advice? Ignore articles that don't link to their sources -- "psychological science" is unscientific and non-reproducible enough without the added handicap of not being able to read the original article.

<comment><AUTHOR> The headline is the link to the article. I've edited my other comment to add the abstract in full.</comment></comment>


Why isn't there a software union or guild? - <AUTHOR> We (software developers) wield an extraordinary amount of power inside organizations - but why haven't we banded together to harness this? With sexism, ageism, etc. we have a real chance to influence the workplace. I know that we find ourselves in a comfortable position doing work we enjoy but shouldn't we be worried about the wider society (poverty in the US, monopolistic practices, etc)? Mars colonization and asteroid mining is fine and all - but what's the point if society is devolving into a neo-Gilded age and a large portion of society isn't even able to have access to basic necessities (food, shelter, healthcare)? We have an important opportunity in front of us to enact real change - why don't we form a union or guild to achieve this? <comment><USER2> The answer to your question is multi-dimensional and very long. I am assuming your question applies to the US, as other countries do have unionized technology workers.

\- Historically Engineers were considered white collar, and draftsman, machine operators, and assemblers were considered blue collar

\- Software engineers used to be a distinct culture, different from both management (Jocks/Frat Boys), and blue collar workers - this has changed dramatically in the last 30 years and the divisions have blurred

\- Early hackers were egalitarian but distrusting of central authority, they were rebels, loner rebels do not form unions.

\- Ayn Rand, objectivism, etc. had a strong influence on computer scientists, engineers, etc. That influence has waned. It was once very common for engineering schools to have objectivist clubs, now they are rare.

\- Tech workers, despite being pushed to ridiculous hours, rarely looked at themselves as victims in the past. Sure you didn't shower for a week, but you were making bank getting to build new and exciting things. Today the job is less exciting and you are more likely to be maintaining someone else's mess than inventing something new.

\- Even if you were laid off in the 70s and 80s you felt very secure because tech was booming, you could go somewhere else. That changed in the 90s, despite the dot com boom, the balance finally shifted to where there were enough tech workers to not guarantee you would be be immediately hired elsewhere.

\- Unions are widely distrusted among the US population. Yes they gave us the 40 hour work week and weekends, but they are often seen as obstruction to change not agents of change.

\- A lot of people in the US simply don't like unions.

There are a lot of reasons to not like unions, but that was not your question.

I am personally in favor of unions in the private sector, but not in the public sector. I am against compulsory membership and believe unions should be more transparent.

Edit: also I was thinking about it and collective bargaining power for tech is probably even worse now than it once was because many companies could just move software engineering overseas.

</comment><comment><USER3> Software devs are just like the rest of the population. There is a wide spectrum of views. It's a mistake to think developing software binds us all together in values.

A better approach is to be specific issue based and attract devs that may have the same interests.

</comment><comment><USER4> I personally feel like there needs to be better consumer groups. Imagine if a million people grouped together to get a better deal at a bank or cable company. or better terms in a TOS agreement with an online company.</comment>


Ask HN: Is client computation a viable alternative to ads? - <AUTHOR>

Would it be a reasonable business model to have visiting users donate computational power (via the javascript vm in their browser) as long as they're browsing a site?<p>An possibly valuable and easily parallelizable task is brute forcing (mid to low level) encryption keys. <comment><USER2> How many page impressions add up to the equivalent of an hour of EC2 time? How does that compare to ads?

</comment><comment><USER3> How does it make money?

<comment><AUTHOR> Distributed computational resources have a value. For example, there is a list of scientific projects being conducted via many client computation: [http://en.wikipedia.org/wiki/List_of_distributed_computing_p...](http://en.wikipedia.org/wiki/List_of_distributed_computing_projects)

<comment><USER3> No of course, but those are research projects. I assume you're talking about a business, which implies commercial. Is the govt going to fund your business like they (directly or indirectly) fund these research projects, or will there be paying clients/customers? Who will need to crack encryption keys (or whatever..) often enough to pay you instead of setting up their own cluster? Ads make money because they make the advertisers money. Is searching for gravitational waves, or ET going to make someone money?

<comment><AUTHOR> Commercial opportunities include protein structure prediction for drug design, brute-force attacks for breaking security, and various simulations (geophysics, finance).</comment></comment></comment></comment>


Google Disables Intel Hyperthreading on ChromeOS - <AUTHOR> https://sites.google.com/a/chromium.org/dev/chromium-os/mds-on-chromeos <comment><USER2> This comes alongside:

* The overview page [https://cpu.fail/](https://cpu.fail/) , on Hacker News as [https://news.ycombinator.com/item?id=19911715](https://news.ycombinator.com/item?id=19911715)

* [https://zombieloadattack.com/](https://zombieloadattack.com/) , on Hacker News as [https://news.ycombinator.com/item?id=19911341](https://news.ycombinator.com/item?id=19911341) (The technical paper is hidden inside a collapsed part of the page and is at [https://www.cyberus-technology.de/posts/2019-05-14-zombieloa...](https://www.cyberus-technology.de/posts/2019-05-14-zombieload.html) .)

* [https://mdsattacks.com/](https://mdsattacks.com/) , on Hacker News at [https://news.ycombinator.com/item?id=19911277](https://news.ycombinator.com/item?id=19911277)

<comment><USER3> Thanks, we've moved comments to the main thread.</comment></comment>


Two Phase Spam: Spammers that Impressed Me - <AUTHOR> http://ezliu.com/my-favorite-spammers-world-of-tanks/

<comment><USER2> I think this is bullshit. Google search of "is the game called world of tanks?" only pulls up this one page. If it was some kind of viral spam campaign, more people would be discussing it in forums.

It's not spam. It's a misdirected email.

Either way, actual spammers should never be praised. If it was legitimately spam, then I wouldn't be impressed.

From the web site contact page of the original article, the author has email address "ericzliu on gmail". I can see how that could easily receive a mistyped email.

<comment><USER3> maybe the article is a stealth ad for world of tanks :)

<comment><USER4> That is what I was thinking. Clearly the email isn't really spam or a lot of people would have received it. But the blog entry is getting hits, and that is getting the name of the game out. So next step would be to see if Eric was working as a viral marketing consultant :-)

</comment></comment></comment><comment><USER5> While strategy is good, nowhere in this post we can actually see that it is a spammer. I get a lot of emails from people who think they are talking to someone else. These look like those.

Again, I agree this would be good strategy for spammers, just don't see how this is one of those.

</comment><comment><USER6> If you google the name of the "spammer" it looks like he might be a kid in high school. Seems like a misdirected email that led to the development an ingenious spamming technique.

"Is this the game that you were talking about?" _Link to blog post reviewing some random game that has an amazon affiliate link spammed all over the post_

Edit: Unless the spammer thought ahead and created and populated accounts around the internet pretending to be in HS so that we will now write off this spam as a misdirected email...

<comment><USER7> If _I_ were doing this, I'd joe-job some plausible looking kid's email address…

</comment></comment><comment><USER8> I doubt it was a spam. World of Tanks is owned by a quite big company. There are TV adverts for this game running in my country - they would not engage in such activities unless they really want to burn their reputation.

As for SEO benefits - I doubt that it would positively affect their ranking even if they were not widely known.

The only way that e-mails can be used for SEO (besides of buying links) is using the fact that Google is spying on the links you are sending. Every URL being sent through GMAIL is being crawled by Googlebot. This can be used to index backlinks.

In this case, there was no links inside.

<comment><USER9> >Every URL being sent through GMAIL is being crawled by Googlebot

This is demonstrably false.

Email a gmail address with a URL that only you know about. Then observe your server logs - you will not see GoogleBot at this URL

<comment><USER8> I've done this before and I know this works. Tested on many thousands of URLs.

<comment><USER10> I thought this was pretty interesting so I just tested this by setting up a Perl script that pretends to be a web server and having it printing out the IPs of anyone who accesses it while feeding them a 403 page.

After emailing myself a link to that server on Gmail, referencing a document that doesn't exist, I waited for over six hours. No hits were recorded from any source and I am unable to duplicate your results.

</comment></comment></comment></comment><comment><USER11> Darn that is effective! I think just posting the story to HN works really well also. I ended up googling the game and poking around the forums. Nice marketing scheme.

</comment><comment><AUTHOR> I wonder how this could be used in traditional marketing sense? He describes it as:

       First you plant the seed.
       Then you wait for it to grow into a plant.
       Then you …

You clearly couldn't use this approach, because it is a: disingenuous, and b: requires you to have a large number of people's emails. It's an interesting concept, especially in the context of traditional marketing.

<comment><USER12> Isn't this what most marketing does? Or at least all top-of-mind marketing (e.g.-plumbers)? They plant the seed--they don't expect you to buy soda or a car while you're in the middle of watching a television show, but they want you to make you inquisitive about it. e.g.-How would that new car drive? Wow, that looks fun. I should test drive that at some point--and then when you're in the market, you go test drive it.

<comment><AUTHOR> Yeah, I guess so, it's just this was such a poignant form of marketing it really struck me.

</comment></comment></comment><comment><USER13> ...or is it possible someone just sent you these emails as a mistake?

I doubt someone is actually sending bulk emails from a comcast account.

<comment><USER14> Yes, that's what I came here to post...

That actually happens sometimes. Someone used my email when registering for an online store, and now I get mail receipts for everything he buys. The thing is there's no way I can contact him. I tried contacting the store, but they didn't do anything about it either, so I just created a mail filter and got on with life.

I guess the real lesson in my case is: always validate your user's email address by sending it a confirmation link (by t he way, I think people using giant regexps to validate mail are missing the point). I see the point in letting the user log in right away (as soon as an email address and password are provided), but I think there still should be a confirmation email and the system should not send any email to unconfirmed addresses.

<comment><USER15> I would just reset "your" password, log in, and cancel the account. Problem solved.

<comment><USER16> That's what I usually do. I have a first initial + last name @ gmail.com account and tons of people sign up for accounts using my email address. Unfortunately, doing a password reset on for a bank account, cellular account, or the like is usually impossible without an account number or something else. As it should be, but it's really important that people use closed-loop sign- ins and allow people to remove their email addresses from accounts without logging in.

<comment><USER7> Must be a trial, going through life named "Norbert Ospam"…

;-)

</comment></comment></comment></comment></comment><comment><USER17> This is actually 3 phase spam.

Phase 3 is at the top of the page you are looking at (i.e. this one)

</comment><comment><USER18> Sometimes, they need to warm-up their accounts. This could have just been such a warm-up.

</comment><comment><USER19> I am always impressed (although often repulsed) by spammers. Getting someone to look you up on Google is a a clever way not only to get people to see your ads, but to solidify your position in the search rankings. Clever!

</comment><comment><USER20> This reminds me of an e-mail I go the other day:

        From: Tai Bei <firstname.lastname@example.com>

        Subject: Re

        Seeking for your cooperation.

</comment><comment><USER21> you might want to obscure screenshot as well.

<comment><AUTHOR> It's a little ironic that its courtesy to obscure spammer's emails.

<comment><USER22> A lot of spam mails are sent through hijacked white-listed accounts. If that's the case here, it's unnecessary exposure of someone else's email address.</comment></comment></comment>


Learn Docker Together Tomorrow (March 26) with the Community - <AUTHOR> https://www.docker.com/birthday <comment><AUTHOR> [Good for Beginner] It's Docker's Bday tomorrow and it's a free conference event where you learn the basics of how docker works and the internal.</comment>


Books new graduates should read - <AUTHOR> https://qz.com/984924/the-best-books-about-leading-a-successful-life-for-new-graduates-according-to-a-dozen-business-leaders/ <comment><USER2> I would recommend two books.

1\. "In Defense of Food: An Eater's Manifesto", by Michael Pollan.

New graduates are moving from an environment where others took much of the responsibility for choosing their food to one where they will be handling that. If they can establish good eating habits now, that will serve them very well for the rest of their lives. If they get into bad eating habits now, they greatly increase their chances of obesity, diabetes, heart disease, and probably assorted other problems.

2\. Something on personal investing. I haven't read this one yet (it's sitting on my Kindle waiting its turn), but based on comments I've seen here and elsewhere, perhaps "The Bogleheads' Guide to Investing" by Taylor Larimore, Mel Lindauer, and Michael Leboeuf.

As with eating well, investing is something for which good habits developed early will pay off (literally!) in the long run. Many people think investing successfully requires that you be some kind of financial genius, or have insider information, or that you have a lot of time to actively manage a portfolio, and this leads them to leave their money in savings accounts, or in CDs, or worse just sitting in a checking account.</comment>


SaaS Builders: Beware The Free Trial - <AUTHOR> http://derickbailey.com/2014/05/14/saas-builders-beware-the-free-trial/ <comment><USER2> I am a huge fan of the unlimited (duration) free trial. How many of us sign up for something, poke at it, forget for a few weeks, and then go back again more seriously? I'm sure I do it all the time. By the time I remember, I am most of the way through a trial period and haven't actually evaluated wether the product is a good fit for me or not.

Regardless of how long your trial runs, people really need to bake in resource limits. I assume most SaaS companies have offered (or will offer) tiered rate plans based partially on consumption, so if you are starting as a free-only beta, why not bake in some sane resource limits from the start? Some ideas for this might be:

* maximum podcast size/duration (10 min or 3MB free?)

* 4 free uploads, then you pay

* Retention period - free accounts only store data for 30 days from upload

Sure, you are still technically paying for the free folks, but you greatly limit the cost damage while providing reasonable motivation for people to move to a paid tier when they are ready.

<comment><USER3> the problem is often unlimited free trials == subsidized by paid customers.

I'm sure if Heroku, for instance, was a paid product without free trial,it would potentially cost less to paid customers. This and services like mongohq,mongolab,... clearly subsidize free accounts with paid ones.

I think the amazon free tier model is a better model.You have one year to mess around but you still have to pay if you abuse resources.

Of course in the podcast hosting space,things are different since there is a lot of competition. Not that much in the paas market,where good services are rare. Most paas suck,we all know which are the good and the bad ones.

<comment><USER2> Of course unlimited free trials are subsidized by paid customers. It is a marketing cost and is baked in to the CAC figure that every SaaS should known and understand.

The trick isn't removing free trials, or changing unlimited to limited. Instead, the trick is to find the sweet spot between costing as little as possible while offering enough functionality that someone can actually figure out if it might be worthwhile for their use without giving them too much that they never pay. It strikes me that the OP was too far to one end of the spectrum--knowing their demographic as they were hoping to, they offered a trial that was bigger than the average podcaster would ever use. Where is the incentive to convert if you can get what you need for free?

While I would never presume to know the OPs business like they do, from a strictly personal standpoint, I find great utility in the unlimited-time aspect if budgeted appropriately.

</comment></comment></comment><comment><USER4> I'm struggling to see why bandwidth is costing you so much. We have a dedicated server with 10tb bandwidth on 1gbps port for under $100 a month.

Also, if the podcasts are failing they can't be using much bandwidth? I think this is cognitive dissonance, you're complaining about free users costing you a lot of money in bandwidth yet apparently they are all failing (very few listeners?)

<comment><USER5> I'm serving files from Amazon S3. This gives me the benefit of world class storage and streaming, without having to own / run the servers myself. Bandwidth from them is "cheap" at $0.12/GB... but with an average podcast of 30 minutes being 25meg file, an episode with 1,000 downloads is 2.5GB of bandwidth.

i have a customer that averages 20,000 downloads per episode, and a bunch of others with close to 1,000 downloads per episode. it adds up fast.

<comment><USER6> Right, but if you go with a "budget" dedicated supplier of dedicated servers for cheap (probably based out of EU such as Hetzner/OVH) or out of the US (through someone who provides "unlimited" bandwidth), have everything through s3 as a backup incase the server has any issues, you will be able to save money.

25 meg downloads don't last very long, so the very worst is that your gigabit pipe gets caught for a bit - hell even a company like Linode does 2GB out for $160/m :).

S3 is very expensive for what you are doing, saying you don't need to own/run servers for things like a podcast is just pissing money into the wind.

<comment><USER5> "saying you don't need to own/run servers for things like a podcast is just pissing money into the wind." \- that's probably true. i may end up doing something like your suggesting in the future. right now, the streaming side of things is not something i want to concern myself with. i have other things that need my attention.

linode's $160/mo plan would cover me for a while. i'm transfering around 4TB a month right now, and that would cover 16TB.

thanks for the feedback and suggestions! this is something i'll need to keep in mind in the near future.

<comment><USER6> We might come across as brash, but we really want everything to succeed. :)

</comment></comment></comment></comment></comment><comment><USER7> I'm currently thinking that for my next SAAS project it's going to be pay up front with a 30 day money back guarantee. I've done freemium and 30 day trials and the data I got early made me think that people would convert and they didn't even though they would use the product every day. Maybe my pricing was bad or my sales technique was terrible. I don't know.

What I do know is if you price something up front you'll know right away if your sales pitch works and if your pricing is remotely reasonable.

I know the conversion rate without a free trial won't be maybe as high, but when you are looking to just validate a product and a marketing strategy, you need to know if it will turn into real sales. You don't have to have a free trial to sell a product.

<comment><USER8> This is a good compromise -- certainly better than the take-your-credit-card free trial that surprises you with a charge. 'Money back guarantee' has worked for a long time, particularly in pre-internet days.

<comment><USER7> What is really funny is when you think about it, we all buy things without trying them every single day. We make assumptions that a product will work or that it can be replaced/refunded when it doesn't.

Surprisingly, in the online world we think everything is different and that nobody buys things without a free trial of some kind, but over and over again I see products and services that sell without a free trial.

I think it's doing early stage products a disservice to assume you have to have a free trial to make money. When you are proving out if a product will sell, you need to know if people will pay you money for it, not if they are casually interested in trying it.

If it don't make dollars, it don't make sense.

<comment><USER8> The internet is similar to mail order but faster with a lot of tricky details (in the same way that mail and print have tons of tricky details). People don't change all that much.

'Free' gets you a lot of tire-kickers automatically, whereas a guarantee pre- qualifies the customers to the people who can afford to float you some cash. If they're a tire kicker, at least they're not a totally broke / budgetless tire kicker.

There are other free sweeteners that you can offer that aren't a free trial.

</comment></comment></comment></comment><comment><USER9> I agree that your free trial was at the very least much too long, and that the money back guarantee makes a lot of sense for a bootstrapped SaaS company [Jason from WPEngine strongly recommends this as well]; however, I would interpret some of your data a bit differently.

50% of your signups never uploaded a podcast, but once they did, 80% uploaded more than one. Your takeaway from this should be that you absolutely need to do everything you can to onboard the user and get them to upload their first podcast because once they do, they are much more likely to continue using the service. I am guessing that now that you have a money back guarantee your average customer will be more motivated than before, but you still need to work to build processes that help users get started and continue using the service, otherwise your churn is going to be horrible.

</comment><comment><USER10> The only problem I see here is that yours: You wanted customers to discover bugs but you didn´t think that this would cost you money.

As I see it, paying $400 a month for a "bug discovery" service is not that bad if it helps to improve your product. It is your expectations that are not in line with yours actions.

It is true that "people Don't Value Free Things", but it is equally true that you don´t value your customer´s time.

</comment><comment><USER11> Anyone know a good collection of SaaS articles like this? We're about to launch our first SaaS service and would love some battle hardened good practices.

<comment><USER12> As a marketer working with SaaS companies, I would caution you _against_ reading articles like this.

They make big generalizations (free trials are bad!) based on hindsight reasoning and very few data. For every article you find that says you should do X, you can just as easily find one that says you should NOT do X.

With that said, two good sources of information are Jason Cohen[0] and Patrick McKenzie[1].

[0] [http://blog.asmartbear.com/](http://blog.asmartbear.com/) [1] [http://www.kalzumeus.com/blog/](http://www.kalzumeus.com/blog/)

And if you're looking to have someone in your corner who has done this, give me a shout!

<comment><USER11> Thanks for the info and the offer!

</comment></comment></comment><comment><USER13> Whatever you do, just make sure that cancelling really is easy if you expect them to give you their credit card because consumers beware of scammy 30 days moneyback guarantee that are designed to make you jump through so many hoops that most give up, or worse, continues billing you until you manage to.

An example, eFax: a black hole of pure evil when it comes to cancelling: anyone who ever tried wants to murder kittens afterwards. Whatever you do, never ever _ever_ signup for that thing. Seriously. (At least in the U.S. there is the chat and twitter options, but in Europe, you're basically screwed unless you cancel your credit card).

</comment><comment><USER14> About to launch a Saas here as well and have been struggling in regards to the free trial thing.

I think it depends on the market and the business tastes of the founders/owners.

I've ran a couple of businesses, and I tend to agree with Derick that I'd prefer to get my money now, rather than at some point in the future.

This can be off-putting for some potential customers, but then again this depends on the market.

If I'm creating a vertically integration Saas in a very niche market, I think it's appropriate.

If I'm doing a social app, then you basically have to give it away to increase user acquisition, and book the cost of the new user as part of the user acquisition cost equation.

</comment><comment><USER15> It really depends on the market. My prior project went well with 10 day free trials. People installed it, it did what they wanted, so they kept it.

Current project...trials are popular, but getting people engaged in the trials is tough. Lots of engagement diet day..then it drops sharply off,many no amount of emailing bumpsup the return rate about a percent or two.

I think it depends on the market, the product and the price point. I think for free trials to work, the person has to have a recurring use for the product, and can easily get value after a short and simple install/initiation session.

<comment><USER16> Why 10 days, just a nice round number? (don't mean that disparagingly) or was there some statistical basis for it?

A lot of trials I see are 14 or 30 day, 10 not so much.

<comment><USER17> Just a guess, but maybe that it always gives the user a full calendar Mon-Fri to check it out?

</comment></comment></comment><comment><USER18> SaaS business is not based on some random failed example, but A/B testing, marketing, product development, and more. Any business come with risk and SaaS is the same.

</comment><comment><USER19> The problem about drawing any broader conclusions here is it appears to boil down to "Don't offer a 90 day free trial in the podcast hosting business because most customers run their course in 56 days" Not sure it really tells us anything about the effectiveness of a free trial for x days and pay vs a charge now with a 30 day money back guarantee

<comment><USER5> true! i tried to make that point at the very end of the post... maybe should have emphasized it more

<comment><USER12> I enjoyed reading the post, and was relieved to see the caveat at the end, but when you shout things like:

> "Beware The Free Trial ... SaaS builders! BEWARE!"

I don't think it's just a lack of emphasis... It's the presence of jumping to conclusions and offering that as a general lesson.

</comment></comment></comment><comment><USER20> I think the big caveat here is that the _space_ you're in makes it particularly dangerous to offer a free trial.

In other words, there are spaces where those costs are far more negligible, such that you could certainly afford 500+ abandoned free trials to convert 1 paid customer.

<comment><USER12> In other words, you need to understand your acquisition costs and your conversion funnel. Then you can decide what form of a trial--if any--makes sense for you.

<comment><USER20> Right, and maybe that's tough to do from the onset, but as you learn those lessons you can and should adjust.

So if your conversion rate is X and you offer Y and you're losing money, you probably need to reduce what Y costs (or can cost) you.

</comment></comment></comment><comment><USER21> Well, that was interesting. Now my thoughts.

What is he offering? Podcast hosting service? That's commodity. Of course it doesn't make sense to offer free trial if you are selling commodity-based service. How many hosting companies are there offering free trial? Hint: Not many.

However, if you are offering a service with lots of added value which has strong lock-in effect (it's difficult for customers to switch), then do free trials by all means. If you don't, you will eventually do anyway. Let me explain...

When your startup acquires first customers, you really want to be selective about who your first customers should be. Ideally you want to find "zero- maintenance" customers who just use your service, pay monthly and never really bother you so you can concentrate on growing your startup.

It's true your conversion rate will decrease when you do free trial because as a new product, your free trial will suck so much that hardly anybody will make it through (think 5% if you are lucky) but those that make it true will be the most forgiving and the easiest customers you will ever have.

If you charge up-front, many people who would normally drop off during free trial will try to make your product work by making various compromises. They have all the incentives to do so because that will avoid them hassle of trying to cancel their subscription and get refund.

But I'm afraid this will also kill your little startup. Now you will get needy customers who are not completely in love with your product, made certain compromises and basically hate you for tricking them into using your service and they will make you work hard for a few dollars they are paying you. Not to mention, your churn rate won't be anything to write home about.

You need to work hard to acquire new customers, and hardly work on supporting existing ones. Your startup can't afford your existing customers to be pain in the neck when you are the most vulnerable.

By the time you have a lot of customers, your free trial on-boarding process will improve so much that you won't even think of charging up-front anymore.

</comment><comment><USER22> It's interesting that this was a "failure" because it was supposed to be a customer acquisition strategy/business plan. I wonder how the math would shake out if you looked at it as a market research expense.

</comment><comment><USER23> Has anyone found any good ways to force free users to upgrade to paid? i have a SaaS with a freemium option that has led to 2500 free users and only 1% conversion to paid. The support costs of the free users far outweighs the paid revenue. My guess is most of those free users won't upgrade, but has anyone had success in cutting the dead weight/forcing upgrades?

<comment><USER24> Have you tried removing more features in the free version? It may be you solved the problem to almost all of them and they don't see a reason to upgrade. You need to figure out if is a pricing or a business model issue so you need to do a lot of testing. If you are talking about your WordPress Backup service, in one of my projects we provide WordPress services and I can tell you that most of my clients rarely get over 200MB. Also, if you have a dashboard or a newsletter, try running a special discount to older users (split test it). Hide the free version for a month or two and see if conversions increase.

</comment></comment><comment><USER25> I once used a SaaS—or whatever you call the abstraction on top of that—and ended up paying $80 for a "sample" EC2 instance of theirs that was just idling, after I had activated it a month earlier.

Soured me on trying out new platform services pretty damn hard.

</comment><comment><USER26> The salient point: author has replaced free trial with money back guarantee and his signups did not decrease!

Anyone has similar experience with removing free trial? I wonder if it's actually a trend or a single occurrence.

</comment><comment><USER27> I think he was right to offer the trial and then right to change strategies after the product got more refined. Can't jump to the top of the mountain in one leap. Still interesting data point!

<comment><USER5> good point. maybe a shorter trial to start with, for the early version though :)

</comment></comment><comment><USER28> Thanks for the info! So many people are fooled into parting with their hard earned money, and time. I guess that's capitalism?

</comment><comment><USER29> I strongly suggest you don't take ANY business advice from someone who decided to get into the podcast hosting business in 2013.</comment>


Why I switched from iOS to Android and why I am never going back… - <AUTHOR> http://lookatthemonkeys.wordpress.com/2012/09/29/why-i-switched-from-ios-to-android-and-why-i-am-never-going-back/

<comment><USER2> People with this argument (that Android is SO. MUCH. BETTER. because of $COOL_HACKABLE_FEATURES) _completely_ and _totally_ miss the point.

99% of the general public simply do not care about those features. Only hackers do. The hackers are not the market Apple is targeting.

Most people use very limited functionality in their phones, and just want them to work... and stay out of their way. Apple does this well, historically.

So... to say you're leaving iOS dev for Android dev... with all due respect, it's not going to matter in the market.

Good luck.</comment>


Show HN: coolLabs – 3rd party free, privacy focused and community driven project - <AUTHOR> https://coollabs.io <comment><USER2> I love the fact you are helping support anonymous data; it's really a good push and I hope you succeed!

<comment><AUTHOR> Thank you very much! We hope too!</comment></comment>


TRC post-mortem - <AUTHOR> http://pepijndevos.nl/2014/02/16/the-end-team-relay-chat.html

<comment><USER2> Sorry to hear. I think it's admiring to see how you tried to build a product, but lack of selling/marketing always creates a bump in the road to a successful product.

We're currently using Slack. It supports both IRC and XMPP, has a webinterface and bouncers. It also gives you more detailed stats about the users, has integrations with other services and so on: [https://slack.com/r/024fus8f-02566qu1](https://slack.com/r/024fus8f-02566qu1) (shameless referral link.. k, thx, bye).

</comment><comment><AUTHOR> I think "post-mortem" is over used, but it's HN-speak.

<comment><USER3> [http://www.merriam-webster.com/dictionary/post%20mortem](http://www.merriam- webster.com/dictionary/post%20mortem)

First known use: 1846

(next to "Party leaders are conducting a postmortem of the election to try to find out what went wrong.")</comment></comment>


Ask HN: How to secure a website? - <AUTHOR> So I'm new to deploying apps to production, I'm curious of everything I need to do to make a website secure. As of now, I only know to setup SSL, I imagine there is more beyond that. <comment><USER2> SSL doesn't have much to do with securing your website. If you are worrying about security, I would recommend to try to find solutions to solve the:

-integrity -availability and -confidentiality

Of your server and app. For integrity, look for file integrity monitors (OSSEC is a good open source project that does that).

For availability: load balancers, ddos protection, auto scaling are all things to look for. Products like CloudFlare and Sucuri can do it in the cloud for you automatically.

For confidentiality, try isolating your server, setting up firewalls to deny all by default, restricting access, keeping it updated, etc.

thanks,

</comment><comment><USER3> [http://guides.rubyonrails.org/security.html](http://guides.rubyonrails.org/security.html) is a good introduction for webapps written in Ruby/Rails and their countermeasures.

It's better to ask the same question on a <insert your programming language> forum or StackOverflow as most frameworks have countermeasures or configuration options included (salting password, inspecting HTTP headers, preventing SQL injection).

</comment><comment><USER4> Using Cloudflare / Sucuri in front of your website won't hurt

</comment><comment><USER5> lockdown all ports except 22, 80, and 443 with iptables.

setup a fail2ban to update iptable rules to detect repeated hack attempts and ban their ip address.</comment>


Stiffer road surfaces could cut greenhouse-gas emissions - <AUTHOR> https://physicsworld.com/a/stiffer-road-surfaces-could-cut-greenhouse-gas-emissions/ <comment><USER2> Interesting approach. When replacing Asphalt with concrete you have to produce more cement. Cement production is a massive CO2 contributor - approx. 7% of global CO2. Would be interesting to learn if that was included in the calculations. If not it would also be good to know how the overall reduction if any - would change.</comment>


T1ha: even more Faster and Better hash functions family - <AUTHOR> https://github.com/PositiveTechnologies/t1ha/blob/master/README.md <comment><AUTHOR> t1ha aka "Fast Positive Hash" \- In most cases up to 15% faster than StadtX, xxHash, mum-hash, Metro-hash, etc.

Simple benchmark is included (git close && make). The quality and speed could be checked by Reini Urban's ([https://github.com/rurban/smhasher](https://github.com/rurban/smhasher)) and Yves Orton's ([https://github.com/demerphq/smhasher](https://github.com/demerphq/smhasher)) forks of SMHasher suite.

Reasonable to note: t1ha have two injection points of each data word inside the loop of entropy sponge.</comment>


Analyse Asia Podcast #26: The Nintendo and DeNA Deal with Serkan Toto - <AUTHOR> http://analyse.asia/2015/04/11/episode-26-the-nintendo-and-dena-deal-with-serkan-toto/ <comment><AUTHOR> Synopsis: Serkan Toto of Kantan Games is back on the podcast to discuss the mega deal between Nintendo and DeNA which created a dent in the gaming space for 2015. We discussed the pre and post press conference, speculated the motivation in what pushed Nintendo to break its sacred code of not venturing into mobile games, and how their competitors will respond as a result of this deal. We also broke down the mechanics of this deal and Serkan offered his bullish perspective on Nintendo's future as a gaming company. While dissecting the news, Serkan helped to close the understanding on how LINE's curated games platform is not working against Kakao Talk from Korea which adopted the opposite model, and also discussed how SoftBank is a "Berkshire Hathaway" for technology investments with successful forays in gaming space with SuperCell and GungHo, not to mention their past investments from marketplaces to taxi apps all over the world.</comment>


The Entire Universe Might Be a Neural Network - <AUTHOR> https://futurism.com/physicist-entire-universe-neural-network <comment> aaron-santos There is a Feuerbachian quality to the ideas in the category "What if the universe works like an X?" X gets substituted with the misunderstood but prized tech du jour. We've gone from the clockwork universe[1] of mechanical philosophy[2] to the computational universe[3] and now taking a tangent to the neural network universe. If history is a guide, you can bet that what ever sufficiently exalted and misunderstood technology appears there will be an associated theory of the universe attached to it. It says more about us than it does about the universe.

[1] [https://en.wikipedia.org/wiki/Clockwork_universe](https://en.wikipedia.org/wiki/Clockwork_universe)

[2] [https://en.wikipedia.org/wiki/Mechanical_philosophy](https://en.wikipedia.org/wiki/Mechanical_philosophy)

[3] [https://academic.oup.com/pq/article- abstract/53/211/243/1610...](https://academic.oup.com/pq/article- abstract/53/211/243/1610975?redirectedFrom=fulltext)

<comment><USER2> It is possible to accept everything you say _except_ for the last sentence.

Technology is the result of the evolutionary process of the universe. If the process resembles its own result, that shouldn't come as a surprise.

<comment> aaron-santos Not sure if we're in agreement then. Calling out the analogy as Feuerbachian is essentially saying that the analogies between technology and the universe are anthropological framed around our own ideals and not some universal truths.

<comment><USER2> Right. And in the second half of my comment I explained why your reasoning is faulty.

You must think the natural and artificial worlds as being self-similar. Think them as one continuous, self-organizing process.

</comment></comment></comment></comment><comment><USER3> The entire universe is always whatever the people looking at it know of but don't understand. It was a god, once, i.e. some guy. Then it was clockwork. Then it was a computer, then a quantum computer. Now, a neural network.

What will it be next week?

<comment><USER4> Probably the genetic (as in algorithm) universe.

</comment></comment><comment> dawg- How does the saying go? When you have a hammer, everything looks like a nail?

<comment><USER5> If we ever make _any_ progress on general AI then everything might actually be a nail... But we're so very far from that.</comment></comment>


What someone says about you after the contract doesn't work out matters. - <AUTHOR> http://farmdawgnation.com/blog/2014/2/2/testimony

<comment><USER2> Corollary lesson: don't assume anything in the contract.

PHP website, you might of course assume it's going to be hosted on Linux. Who ever hosts PHP on Windows servers?

Oh, your client does? Nasty surprise if you find that out after signing the contract.

<comment><AUTHOR> Nope. Nothing was assumed. For the first few years of the contract we hosted it. They wanted to move to a Windows platform well after the application was built and in use for several years. The conversion to Windows was itself a separate contract.

</comment></comment><comment><USER3> Wow, what's the deal with PHP that it's that hard to migrate from Linux to Windows?

<comment><AUTHOR> With PHP itself? None. With that particular application we had relied on Apache's mod_rewrite and had some code that made some assumptions about how file system permissions worked. Not intentional assumptions, mind you, but assumptions just the same. So, naturally it blew up in our face. heh.</comment></comment>