Show HN: Add license key verification to your apps - <AUTHOR> https://github.com/furkansenharputlu/f-license <comment><USER2> Be very careful with licensing.

VMware early-on had licensing code that disabled a customer's app and cost them a lot of money. Licensing of enterprise features is best to have a nag screen and disable some future actions rather than drop a ban-hammer. They were forced to strip out that code and ended up with weak enforcement of licensing.

Telemetry and online verification are unacceptable to some customers of on- prem software. To them, it should work even if the vendor goes out of business.

Volume license keys should exist for large-scale deployment of on-prem software in concert with open sources surveillance (search engines and warez sites) of license keys and software to prevent abuse. Even then, it's better to reissue volume license keys to customers because DLP of an external entity is an essentially impossible task.. at least they will know there's a problem and may work to police themselves.

Stopping all piracy is undesirable because persons who cannot afford it but are in/direct decision-makers have the ability to sabotage sales and/or acquire an unfavorable impression of the brand. Piracy and leaks are indirectly helpful to overall sales and marketing. Keep it down to a dull roar, because some people and some factions of industries are more-or-less like Fight Club. If something is used commercially at-scale from a small vendor, support their survival with licensing fees... don't be Best Buy.

<comment><USER3> > open sources surveillance (search engines and warez sites)

That's the first time I've heard "open source" used to refer to a warez site.

Is this overloading of the term being seeded by someone in order to, in a roundabout way, discredit the open source movement? A few years ago there would have been an obvious suspect for such FUD, but they seem to have embraced open source these days, so that wouldn't make sense.

Weird.

<comment><USER4> Open Source surveillance means "looking for/at stuff that is openly published" \- e.g. looking on warez sites for keys being shared..

I'm pretty sure the term has been in use since the 1940s

<comment><USER3> Ah, I guess so. Thanks. Perhaps my tinfoil hat got in the way of seeing the context.

<comment><USER5> It is called some other terms depending on country, so it can be non-trivial to grok when you first encounter it.

(For years, I knew it as "White Intelligence")

</comment></comment></comment></comment></comment><comment><USER6> No to be harsh, but this is largely useless.

The biggest issues with in-app licensing is

(1) Binding licensing to the machine (or the user!)

(2) Making sure that your licensing check can't be NOP'ed by a l33r haxxor within 5 minutes of the release.

Tangential to that is (3) which is an ability to tolerate minor changed to the machine _and_ OS reinstalls without invalidating the license.

(1) and (3) aren't hard to solve, just need to decide which machine/OS properties a license should be to "latched on". Popular choices are MACs, HDD serials (from the ATA IDENTIFY block), SMBIOS IDs, MachineGuid on Windows, etc. Better yet, it's not a bad idea to bind to a _set_ of machine properties and then tolerate a change of _some_.

(2) is a domain of its own. Basically that's an anti-reverse-engineering task. It's not terribly hard to roll out something on your own, but you do need to know what typical hacks look like. From exe patching to process training / API hooking, there _is_ a substantial learning curve, but it's a quite interesting one.

That is the biggest part of any "license key verification" is not the actual "license key verification", but rather all the nuances that make sure it actually works as designed and doesn't affect users' experience in normal-use cases.

<comment><USER7> I really believe this is why SaaS is such a dominating business model now. Software licensing failed because it is technically impossible, and no amount of clever tricks will save you from determined groups / individuals. If it runs on your machine, you will be able to get it to run again without the licensing requirements. We saw large companies get pwned time and time again.

On the other hand, there is no way you can see what a SaaS backend is doing and replicate that locally. Sure, you can rip off the frontend, but that's just a thin client over the API anyways. The API is the proprietary product, and much easier to secure.

Even if a blackhat breaks into your SaaS repository and leaks your source code (which is generally a freak event, especially among businesses that take cybersec seriously) - what are your customers supposed to do with that? I wouldn't expect your average AirTable customer to be able to understand how to launch and maintain an AirTable instance.

It's just a better idea to serve your product over the Web. If you sell native applications, you can't expect to make as much money as SaaS equivalents.

<comment><USER8> This is not true for business applications and many customer ones.

Enterprises cannot risk legal problems. And home customers will buy licenses if price is fair.

</comment></comment></comment><comment><USER9> Is remote verification fully open over http with no user credential verification or rate limiting? If I were to implement remote verification in an app, I would want to have the user logged in to an account prior to adding a license key. You could accomplish this by putting the KMS behind a proxy but this seems like a likely attack surface if using this the way it's outlined in the docs.

</comment><comment><USER10> Personally I found LimeLM offering a pretty amazing and sophisticated product at very decent prices. Personally, I would never want to suffer the pain of keeping licensing servers running etc. :-)

In my experience, software licensing will just "get rid of the casual piracy" - but I could never see not having a licensing solution in software work for business...

Beyond protecting software I found it similarly necessary to take down illegal software copies. There are automated tools for that luckily.

Yeah, your software will be cracked sooner or later. But it is not all black and white and there are now really great sophisticated solutions out there that _minimize_ the frustration for paying customers whilst also protecting your IP...

<comment><USER11> _> I could never see not having a licensing solution in software work for business_

The most business-y of business-y tech businesses, Oracle, doesn't use license keys. Everyone can download pretty much any of their products. When they acquired the company I worked for, the first thing they did was to release master licenses to everyone for free. Saved us peons in the support trenches the aggro of dealing with a terrible license-server we embedded, the name of which I've mercifully forgotten.

How do they do it? Their audience are legitimate businesses who would rather stay on the right side of the law than save a few pennies here and there. And Oracle won't answer the phone unless you have a paid support contract.

Obviously this model won't work for everyone, but IMHO businesses who sell to businesses can live happily without license keys (and the stress/costs they generate on their support operations).

<comment><USER12> Oracle does not rely on companies' good intention, or their need for ongoing support.

They use contracts and audits to make sure they get what they're owed. If you can force companies to pay _after_ they start using something, then making it as easy as possible for them to expand usage is going to maximise your revenue.

Google 'Oracle License Audit' or 'Oracle LMS' to learn more.

<comment><USER11> Man, I worked for them, I know the score :)

And that's precisely what I said: they just use the law ("contracts"). Legitimate businesses don't want problems with the law. It's more effective, for Oracle, to carefully draft (and subsequently enforce) legal documents, than to add some rigamarole that will only make life harder for legitimate clients and their own support ops.

<comment><USER12> Right, but the cost of enforcement doesn't scale linearly with licence cost. If your median customer spends millions with you per year, you can afford to spend money on enforcement. If your median customer spends $10k/year, I don't see how you can compel them to submit to an audit, or how you can get positive ROI from enforcement activities.

This is one of the benefits of SaaS (for sellers).

<comment><USER11> You'd be surprised how far a couple of graceful but stern legal-looking template letters can go.

Of course SaaS is a solution, but that doesn't really apply to the type of software that requires license keys (i.e. standalone and likely behind the firewall).

</comment></comment></comment></comment></comment></comment><comment><USER13> Why MongoDB?

<comment> rooam-dev Why !MongoDB?

<comment><USER14> Because MongoDB is a document store and you really only need a key/value store for this.

Also because MongoDB started life preferring speed vs durability, which is a bad look for a database. They may have fixed that now, but I cannot forgive them for that.

<comment> rooam-dev "The best tool is the one I know".

<comment><USER14> Except when it's not. :)

<comment> rooam-dev I don't compare HTML vs. C here, obviously I am talking about databases. All personal feelings aside, there is no technical reason to NOT use MongoDB as a key value store if one has experience with it, because after release comes maintenance and learning a new tool while fixing production problems doesn't make sense to me.

</comment></comment></comment></comment></comment></comment><comment><USER15> I much rather have a license key tied to a preferred account then to a platform like Google/Apple. That's also allows for cross-platform licensing which is rare among apps.

</comment><comment><USER16> This is really cool - you should write a how-to blog on it when you have time. I think it could really help drive more adoption.

<comment><AUTHOR> Should I write it in GitHub wiki page? Or, is there any other place that you can suggest? Thanks a lot for the feedback!

</comment></comment><comment><AUTHOR> Should I remove remote verification entirely? Or, how can I adjust to make it more proper to use?

</comment><comment><USER17> I can prob patch this over in the time it takes to finish a mug of coffee</comment>


Why I'm not running Ubuntu yet - <AUTHOR> http://isaacsu.com/2012/02/why-im-not-running-ubuntu-yet/

<comment><USER2> He mentions a problem with suspend, but didn't post a bug number. If that's the case - that he didn't report it - then he's part of the problem. Mentioning the problem in a random blog host isn't going to help anyone.</comment>


Ask HN: How do humans think? - <AUTHOR> <comment><USER2> When humans learn anything, it is stored in their actual dissociation. Dissociations change, sometimes they last no longer than some seconds. A lot of repitition is nessecary to make these new memories available for many other dissociations, that process is called slow thinking. All memories inside the same dissociation are immediately available - fast thinking. The more permeable a dissociation is to others, the more associations it returns during thinking. The size of their short term memory defines the limit, how much of these associations humans can process and when a dissociation becomes unstable. Derealization is a possibility to stabilyze a dissociation (that cheese dome around us during tests in school). Depersonalization is the opposite, a kind of exhaustion, when it is no longer possible to keep up the actual dissociation and dissociations change every 5-30 seconds.</comment>


25 Is the New 21 - <AUTHOR> http://www.theatlantic.com/business/archive/2014/10/25-is-the-new-21/381421/

<comment><USER2> This begs a few questions such as: is it due to laziness of today's generation, is it because costs have increased much more than wages have or is it due to a factor largely out of the hands of this generation such as economic or market factors that favor automation/outsourcing/leaner workforces?</comment>


Ask HN: How much do you tech recruiters make? - <AUTHOR>

Most tech recruiters were never programmers. A very absurd minority were ever excellent programmers. It seems like there should be a market for recruiters who can actually find really good programmers. Are any of you in this market? <comment><USER2> I'm a Tech recruiter and former developer. I wouldn't have ever classed myself as an excellent developer but my experience is much more extensive than 99% of the people in this industry.

I'm happy to disclose my earnings simply because the HN community has always been very open and effusive to me in the past.

Keep in mind, I'm based in London, UK and I work for one of the worlds largest IT recruitment companies. I started this job in February (I have a few years of recruitment under my belt) and this year I will have earned approximately £60k before tax. Your first year with a new company is always relatively slow as it takes time to build new business. Next year I am targeted to bill a certain amount of money and should I surpass my target by 10% (which is what I feel I can realistically achieve) then I should end 2012 having earned somewhere around £80k. I work alongside a guy who has been in the industry much longer than me and he will comfortably earn £120k+ next year.

There are plenty of tech people who earn a lot more than me but the reality is I would never have been earning the same amount of money at this stage of my career if I had stayed working as a Developer. I've just turned 29 by the way.

<comment><USER3> Is the question how much is earned per placement or per year? Each is very dependent on the individual and firm.

In the US recruiters charge 15-30% of base and/or total comp...depends how good you are and your relationship with your client. Good US recruiters bill 300K+, great recruiters bill 500K+, and avg recruiters will bill 100-200K. How much you keep as an individual depends on the deal you have with your firm or if you are self employed.

The second part of the question ~ does being a developer make a person a better recruiter? My initial answer would be 'no'. In fact, I would argue that being a developer could hinder being a successful recruiter.

Understanding what your client is looking for is absolutely key to being successful. However, the skills that make you a good devlpr are almost polar opposite the skills that make someone a good recruiter. Being a recruiter takes a strong sales aptitude.

The other problem that comes to mind is a condition we, in the US, call 'experting'. It happens when you're candidate has 60-90% of what the client is looking for, but because you're too focused on delivering perfection, and because you know what perfection is, you neglect to send this place-able candidate in for an interview. Sometimes it's better to not know what you don't know.

Cheers

<comment><USER2> _However, the skills that make you a good devlpr are almost polar opposite the skills that make someone a good recruiter. Being a recruiter takes a strong sales aptitude._

The sales aptitude gets your foot in the door, a thorough understanding of your clients business and needs keeps you there. Your argument is one of a sales orientated recruiter grasping at straws.

A significant pay packet and a 1st class client list negates your argument that a technical understanding is a hindrance.

</comment></comment></comment><comment><USER4> My assumption would be the companies that know, rely on developers to be their recruiters and the ones that don't and use headhunters look at developers as resources and are OK with the churn until they find a cog that fits the machine. I don't think second rate organizations would even see the value in a good recruiter.</comment>


Vidly (YC S08) is now Treehouse - <AUTHOR> http://gotreehouse.com/

<comment><USER2> Any idea why it was renamed again?</comment>


MARISA: Matching Algorithm with Recursively Implemented StorAge - <AUTHOR> http://marisa-trie.googlecode.com/svn/trunk/docs/readme.en.html <comment><USER2> I imagine a compressed suffix array or compressed suffix tree using libsdsl (<https://github.com/simongog/sdsl>) would probably be a lot smaller/space efficient and faster.

<comment><USER3> Why do you think so?

</comment></comment><comment><USER4> It seems pretty much a trie implementation. Wouldn't the library be better served by having the word _trie_ in its name?

<comment><USER5> The name of the library is an obscure reference to a Japanese video game.

$ marisa-predictive-search keyset.dic -n 2 Touhou 15 found 975378 Touhou Touhou 5508004 Touhou_Hisotensoku Touhou

</comment></comment><comment><USER6> This seems useful, though I need something that does fast substring search as well. I don't think this does that.

</comment><comment><USER7> any interesting experiment using it?</comment>


Mainstream support for Windows Phone 8.1 is ending tomorrow - <AUTHOR> https://www.neowin.net/news/goodbye-mainstream-support-for-windows-phone-81-is-ending-tomorrow <comment><AUTHOR> 74% of Windows Phone users will be left without security updates! Good thing there haven't been almost any vulnerabilities up to now

[https://www.cvedetails.com/vulnerability- list/vendor_id-26/p...](https://www.cvedetails.com/vulnerability- list/vendor_id-26/product_id-23230/Microsoft-Windows-Phone.html)</comment>


Show HN: CyberWeb – Building a Web Browser from Scratch on Windows 2000 [video] - <AUTHOR> https://www.youtube.com/watch?v=5RhW4njFimw <comment><USER2> Man, I cringed when he (OP in this case) said that "it's honestly kind of insane that we require encryption for text based websites like .. let's go to Wikipedia." (Around 4m in the video).

I'm sorry, but no .. it's not insane that we require that in this day and age.

Otherwise, this looks pretty cool, will watch it further when I get the time.

EDIT: Answering his next question: "Why does it really matter?" One reason is simple: These pages link to login and registration pages. If it's not authenticated, and can be modified over the wire, then an attacker could just redirect you to a different "login" page. TLS/SSL authenticates that what you received is what you expected, and that's very important on the internet in this day and age.

<comment><AUTHOR> I definitely understand the concerns that make people want encryption for everything -- preventing governments and ISPs from messing with your content or spying on you. I don't want that either, and I'm glad we have HTTPS to help fight that.

But everything is a tradeoff, and there are actual downsides here. Nowadays, Chrome and Firefox try pretty hard to make you think all non-HTTPS sites are bad for you. What about old web servers that people never bothered to update? They effectively become "broken" without actually breaking. There's tons of great information on sites without updated certs that becomes that much harder to access because of this.

There's also the concern about your actual codebase. Hypothetically, if you're building an HTTP client from scratch, you can write, know and understand every line of code in your project yourself. If you want HTTPS support, you're basically forced to link with OpenSSL, and this is almost guaranteed to take the total percentage of "your code" in your project from 100% to less than 10%. (Probably more like 1%.) You no longer actually know what's going on in your program anymore. Maybe this isn't a concern for most people, but it does matter to me -- and I suspect there are a lot of people who would care a bit more if they thought about it for a few seconds.

So yeah, HTTPS is great. But everything is more complicated than it seems.

<comment><USER2> You're already linking against far larger libraries that you probably don't understand completely anyway! For example, glibc... So I don't think this is a valid excuse against the "HTTPS Everywhere" initiative.

<comment><AUTHOR> That's not always true, especially if you're working in an embedded environment or you have other needs (business or legal requirements, even just preferences) to control the libraries you link with.

In the case of this video series, I won't be using any C runtime library functionality at all -- just Windows API calls. Of course, there's always the operating system, which is big and opaque. IMO, there's a difference between interfacing with the platform and dragging in a bunch of other people's code. That's a personal call: it's not a clear cut line, obviously.

Speaking personally, I more or less know, in general (and for Windows, in specific) how operating systems work. I don't have a strong understanding of encryption, which is heavily mathematical. In the case of OpenSSL, I am not likely to understand what it's doing. In the case of message queues, threads and blitting bitmaps, there's not much mystery there.

Also, the comments I'm making are specifically about this project, not generally about how I think everyone should work. It's clear that this is an art project and not industrial software.

<comment><USER3> I don't think I disagree with you in principle, but since you are linking in the windows socket library already, isn't there built in support for SSL (`WSASetSocketSecurity()`, etc)?

<comment><USER4> He's on Windows 2000, though, which doesn't offer anything newer than TLS 1.0 support. Not really useful for the modern web.

</comment></comment></comment></comment></comment></comment><comment><USER5> This is awesome. I still remember asking what a/s/l meant back in the day when I started going on AOL Chatrooms (I must of been like 10). Havent heard it all that often since. One of the first things I kept wanting to do as a kid / teen was a browser. Nowadays there's so much that browsers support it's overwhelming.

<comment><AUTHOR> thank you! really trying to go for the time warp aspect while attempting to be as educational as possible. happy to hear you enjoy it!

<comment><USER6> I've just sat through it whilst working on something else, and found it quite entertaining. I too have fond memories of Tumpet Windsock, and early Web Browsers (such as Mosaic). I am also a fellow believer in just opening a socket and parsing the results directly as it totally gives you more control. It was also nice to see you showing people that building for the Windows UI is not that hard.

Keep going with this! I'm keen to see where you end up. Subscribed.

</comment></comment></comment><comment><USER7> This. Was. Awesome.

I did some Windows programming in VC++6 way back in the day, and watching you do File->New [empty] Project was super nostalgic for me. And I actually learned a bunch of things watching this video.

Kudos!

</comment><comment><USER8> Many years ago I threw together a WebKit based browser with the frontend written in C# with SharpDevelop on Vista. I found myself in the MFC code pretty quickly and can appreciate the similarities between this video and that, definitely a monumental task. Mine took ~48 hrs to compile as did Safari on Windows back then. The hardest parts were getting a passing JavaScriptCore build and fiddling with IDL to get things to render via GDI using interop. Once it's known to you how a browser works web development makes better sense. For instance in the WebKit code I found once it detected form tags it would jump to that first and then resume the rest of the markup after. In comparison with Chrome I found that Chrome would lower the resolution on all images to make things seem faster but WebKit didn't. Nowadays modern browsers have a lot of code to make popular sites run better like YouTube that will reformat old links to their newer format like in Firefox. It's interesting that after all Microsoft is taking this approach with Blink. To make a competitive browser nowadays it would have to pass tens of thousands of tests every build to avoid regressions: [https://stackoverflow.com/questions/2933444/who- wrote-250k-t...](https://stackoverflow.com/questions/2933444/who- wrote-250k-tests-for-webkit)

</comment><comment><USER9> Good stuff man. As someone who's been developing for the web since 1995, I appreciate any retrospective on the platform (dare I say it) and any efforts to keep its history alive! Cheers :)

I should mention that a buddy of mine hosts a site that is specifically designed to be a resource for people running old browsers [0] which links to useful stuff, discussion areas, etc.

[0] [http://altexxanet.org/](http://altexxanet.org/)

<comment><USER6> Oh! Darn it. I was 100% about to build something like this. I've even got an authentic non-intel server to run it all on.

Oh well. :(

<comment><USER9> haha, go for it man! The more the better. It's especially nice to have a bunch of sites available when firing up an old machine that just got running again! :)

</comment></comment></comment><comment><USER10> Windows 2000! You've got impeccable taste!

I still use it in a VM to this day.

</comment><comment><USER11> Yes! Thank you for posting this</comment>


Surface 3 Update - <AUTHOR> http://www.penny-arcade.com/news/post/2014/11/01/surface-3-update <comment><USER2> I do like the Surface 3; it's a lovely piece of hardware, Windows 8.1 is an improvement, and for a desktop OS, the touch interface is pretty good. It's the best Windows computer I've ever owned, but I still turn to my Linux laptop for coding; the tooling and packaging for the languages I use just isn't really there on Windows.

That said, they need to improve their messaging - this is the first time, as a Surface 3 owner, that I've heard about this Surface Hub app that lets me adjust my pen sensitivity (and I've wanted that for a while!).

<comment><USER3> >"but I still turn to my Linux laptop for coding; the tooling and packaging for the languages I use just isn't really there on Windows"

What have worked for me so far is having an Ubuntu VM on Hyper-V. I works really well and I have never noticed that is virtualized instead of being running natively.

</comment></comment><comment><USER4> It's a nice toy. I have the big bad 8gb RAM, 500gb SSD that work paid for. As a pretty much exclusively .net/visual studio dev, the experience for development, while the machine is powerful enough to handle it, is utterly abysmal. Visual Studio and SQL server (which uses the VS shell) does not support touch screens in any sensible or usable way. I'm not asking for gesture rich smart windows here, just being able to scroll a text editor with one finger. Every other MS app on there seems ok, just not the VS based ones. Nothing but text selecting when you're expecting to scroll. The physical keyboard is too flexible and cramped to use on your lap - despite all the marketing videos claims, and probably my single biggest annoyance is that when that physical typecover is installed, it still pops up the soft keyboard every time you touch a textbox, anywhere. That, and if your soft keyboard isn't set up right, many times it will take maximized or docked left/right windows and resize them, only to leave them resized once the keyboard goes away again.

So while I love to hear people say it's good for "creating content", as long as that content is a drawing, that might be true, but if that "content" is any kind of written work, spreadsheet, or coding task, it's almost useless.

Also, the version of OneNote that comes with it is so handicapped that it also borders on useless. For the price of these things and the advertisement of having Office on them, the pared down versions were a big disappointment.

<comment><USER5> Your complaints in the first paragraph, while valid, come from trying to use VS and/or other text input tools with touch - (correct me if I'm wrong). I'd be interested to also hear about your experiences with using it 'normally'. I.e. if you just put the surface+keyboard on a desk or your lap and treat it as a laptop without using touch, how usable is it for VS and the likes?

<comment><USER4> That's what I meant to say with the part about the flimsy/flexible typecover. It's quite tough to type using it on a lap, and the touchpad isn't very easy to use either. I tried the combo of typecover and pen - that was closest to most usable, but still just fell short. The other problem is that you're trying to balance a small (in width) stand between two legs, which practically meant squeezing my thighs together to not have it fall between them.

It's decent enough on a table top though, if used like a traditional laptop and you have a mouse or are patient enough with the pen.

<comment><USER5> Thanks for the info. I always had the impression the type cover was meant to be the proper 'lap' counterpart of the touchcover in that it would be sturdier etc but appears that is not the case. Thats not so nice. Still in the market for one though, I think. Let's see what the Surface Pro 4 brings :]

</comment></comment></comment></comment><comment><USER6> Kudos to Microsoft for going out of their way to support and improve an important product after launch. Microsoft certainly has a history of doing this with their larger initiatives like XBox, but in the PC industry, this kind of post product improvement isn't so common.

When was the last time you saw Dell really iterate on a product post launch in a meaningful way.

To revive the PC market, Microsoft needs to do what Apple did for the last 15 or so years - stop treating PC like a commodity market where you ship beige boxes to customers without much care to differentiation or a delightful end user experience.

Surface is easily the most interesting PC I've seen in probably 10 years in Windows' ecosystem. I hope Microsoft sticks with it.

<comment><USER7> Delightful end user experience you say? I happened to be visiting my father and to my surprise he pulled out a Surface 3. He turned it on and it ... spent 90 minutes rolling back some service pack because Dad had had the temerity to put the device to sleep when the service pack was being installed. Needless to say, all the end users in the family were delighted by this endless administrivia.

<comment><USER8> What happens if you power off an iPad (or any other device, for that matter) in the middle of a system update?

Atleast his mistake didn't brick it and Windows was smart enough to make sure that didn't happen.

<comment><USER9> Powering off is not the same as putting the device to sleep.

Windows offers a menu option to the user to sleep the device during the update. That is a design fault.

<comment><USER10> There is at least one good reason to do so. Imagine that you're installing an update and notice that your battery is so low it won't finish before it dies. Surely sleeping is better than allowing a loss of power?

In the worst case, the update is rolled back, which wastes time, but it's better than risking file system corruption due to loss of power.

Even if you don't get corruption, data loss is likely. For instance, you may have been browsing HN when power goes out. Will your browser's crash recovery carefully restore the comment you've been typing for the last 17 minutes? Maybe yes, but is every program you're running so careful?

This is not a design fault, at least in my opinion.

<comment><USER11> Other devices (e.g. iOS) will warn you if you try to start an update with low battery power, so you can't make this mistake in the first place. Besides, the device itself can spot a low battery (and act on it to ensure the system stays consistent), so why does there need to be a user option to put the device to sleep during the upgrade?

My guess is that Microsoft didn't think about this at all, leading to the rubbish user experience.

<comment><USER12> It doesn't just warn you, it prevents you from making that mistake.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Since I suspect not many artists lurk around here, let me just say this: the newly updated pressure curves make a _huge_ difference. It was one of the few complaints I had with the device. As it is, it's an almost perfect tool for artists. Say what you will about Microsoft, but this is a fine machine.

<comment><USER14> Have they improved the pen tracking? For example, using a ruler can you slowly draw straight lines at a 45 degree angle? [0]

In my experience with the SP3, the N-Trig pen tracking was far inferior to the Wacom pen in the earlier Surfaces. The poor tracking made my handwriting unacceptably sloppy-looking. I'm surprised artists can use it, but maybe you use mostly faster and longer pen strokes?

[0] [http://answers.microsoft.com/en- us/surface/forum/surfpro3-su...](http://answers.microsoft.com/en- us/surface/forum/surfpro3-surfupdate/surface-3-wavy-diagonal-lines-when- inking/78c138e5-50db-4544-a988-6023a84b9675)

</comment></comment><comment><USER15> As an artist, I still found the surface pro 3 heats up after using it for longer than 30 minutes, making drawing on the screen uncomfortable. I still have my surface pro 1, and it's usable with a glove, but I generally don't like drawing with gloves.

It's not a problem that I have with my Cintiq Companion Hybrid. I hope Microsoft fixes the heat issue at some point.

<comment><USER16> This is the reason I hope Apple guys mac a pen tablet, they are the only ones that take heating seriously, even at the application level.

Microsoft has so much legacy code when the mantra was "it does not matter how inefficient the computer is if development is fast", or "people just can add bigger batteries to laptops and the problem is solved".

<comment><USER17> >> This is the reason I hope Apple guys mac a pen tablet, they are the only ones that take heating seriously, even at the application level.

While I agree with you on Apple coming out with a pen, I totally disagree with you on the heating thing. My 2011 Macbook Pro is pretty notorious for heating issues resulting in crashes and gpu problems. A class action lawsuit was finally launched this week over those issues.

</comment></comment></comment><comment><USER18> Surface (and other high quality windows tabs i might not be aware of) are the only tablet is suitable for traditional PC work.

Other tablets are thinner, sleeker, lighter, or easier to use for CONSUMING content, but they're a poor substitute for creating content.

<comment><USER19> That's a silly attitude that even Microsoft isn't pushing anymore. How do you rationalize it against the rumored upcoming Office support for iOS and Android?

<comment><USER18> That might be true in the future, but speaking from the present, this is how it is.

For perspective, I have written Android apps using AIDE on a Nexus 7 and Nexus 5. I also manipulate docs and spreadsheets using google's systems (which are adequate for making quick edits, but not something i would sit down and write with for an extended amount of time).

<comment><USER20> I think that the AIDE IDE is a great piece of work! Admittedly, I have only created fairly trivial apps using the template projects, but it is amazing to be able to compile Java code and create a bundled Android application on my Android phone.

It seems to bother my son a great deal that I have always used Android phones and never an iPhone. It is the availability of things like AIDE that make an Android phone also functional as a "real computer."

</comment></comment></comment></comment><comment><USER21> Just today I was at a Microsoft Store and played with a Surface Pro 3 for the first time. I was quite impressed and almost bought it but when I looked up on the internet about running Ubuntu on it, there are few un-resolved issues. Such as the bluetooth doesn't work or wifi only works for the 2.4GHz networks. Overall I was impressed with the hardware, and would totally get one in the future when it's possible to run Ubuntu on it.

</comment><comment><USER22> Nice! I bought Surface Pro, thanks to Penny Arcade. I have 17" laptop with intuos 5 for heavy painting, but surface with manga studio is my go to for sketching and drawing. Manga studio with its brush engine really simulates real life drawing way better than PS. Specially on Surface Pro.

I decided to go with surface 1, because of the price and how next ones have not evolved so much. Around 400 euros gets you a decent, quite comparable with the latest ones. I would prefer bigger screen, but it is not 500 euro difference need. couple of things that still annoy me:

-border accuracy with the pen is awful

-touch keyboard is useless rubbish. Even on-screen is better, I didn't know it doesn't have real buttons before I purchased it.

-original pen has only one button(would not be problem without the next one)

-no intuitive way of using modifier keys while drawing/missing modifier keys and this slows everything way down. Maybe there is way to remap volume buttons, haven't tried it yet.

If you are thinking of getting one, take get surface 1 off from the ebay. It is cheap, if you don't like it, you don't lose money when reselling. It is not a tablet, it is a laptop, with tablet capabilities.

<comment><USER23> > _If you are thinking of getting one, take get surface 1 off from the ebay._

This is really bizarre advice, especially given that most of your complaints do not apply to the Surface Pro 3.

"border accuracy with the pen is awful" \- SP3 uses an entirely different pen technology

"touch keyboard is useless rubbish" \- Get the type cover instead. I'm pretty sure the touch cover isn't even manufactured for the SP3.

"original pen has only one button" \- Not the case for the SP3.

Disclosure: Microsoft employee

<comment><USER17> if you don't mind a bit of added bulk, I'd highly recommend the battery cover over the type cover. the SP1's battery life is not the greatest, and the added life the battery cover provides is well worth the premium.

<comment><USER22> I was looking into it, yes. it seemed the best option. havent got around to order one just yet.

</comment></comment></comment></comment><comment><USER24> Have had my SP3 for more than a month now and I'm so happy I bought one. I've seen the previous models and read Penny Arcade reviews previously and was never quite sold on it. I went to MS's TechEd conference and had a play with one.. Everything just worked. It's better than any laptop I've owned and more convenient to boot. I wasn't even sold on Windows 8 prior to this, but now - bring on the change!

The drawbacks: It runs hot. If you're watching a movie, it'll be fanning full speed. Having screen brightness to max will drain your battery in <4 hours. The kick stand is great but after a month of use it's no longer got that perfect rigid movement it once had, it moves slightly (< 2cm on the end) from what position I put it in. Paying separately for the keyboard which in my opinion is essential, and too pricey was annoying - but it's good quality and very nice to use. The end of the pen nib wears easily, however you can contact MS Support for free replacements.

That's it. In the scheme of things that's piss all drawback for a mobile device. I'd put the engineering behind it next to that of my Nexus 5 phone. It just works.

</comment><comment><USER25> The thing I disliked about my surface (owned a surface pro 1) was the lack of touch integration and Windows.

Touch integration - someone mentioned for VS/SQL server that the touch is horrible to even view text. The reality is that almost every application is broken by default. Only recently have Chrome and Firefox been useful with touch. The beautiful experience in IE and Explorer were the only places where that happened. It really sucked to be held back from doing something because the system started to fight me.

Windows - The above complain is more specific, but this is more my disdain for the Windows Platform. There aren't good touch OS alternatives to Windows for the surface, so Windows stays, and it's not very good at open source things. I prefer Linux, or even OS X like I am using now, over Windows and the surface.

~That said, I do like the surface if these things can be fixed Pros of the surface: \- The pen really was amazing, OneNote used it perfectly \- Gaming wasn't perfect, but it was pretty powerful for the size as well ... There's more but I need to do things. I've listed my complaints.

(screw reading through what I wrote. Post!)

</comment><comment><USER26> I've been taking a real hard look at it's gaming capabilities. Technically it's sound specifications wise that indicates it shouldn't have major problems with gaming with the exception of the Intel Iris Pro GPU which in many demos has show to be a pretty capable graphics processor. Yet there are details of the GPU that simply don't make sense for example how can it score so low on general firestrike benchmarks yet run League of Legends and Assassin's creed at 90FPS. It's even been tested playing WoW at 120 FPS in some instances yet a game that wouldn't at first guess be so demanding like Diablo 3 runs at a unexplainable low 20FPS, what makes that specific game so different? My guess is Particle or general physics which the GPU doesn't handle well however Starcraft 2 seems to run just fine which in my option should be the same as Diablo 3. Also most games are designed to default to CPU processing if bullet or PhysX options are not available. Maybe someone else can unravel this mystery.

<comment><USER27> It could have something to do with CPU throttling, though I'm sure there are other factors at play. Once the temperature crosses the threshold, performance will deteriorate significantly. My guess is the better performing games operating below threshold.

[http://www.youtube.com/watch?v=uC8rCeDMqFw](http://www.youtube.com/watch?v=uC8rCeDMqFw)

</comment></comment><comment><USER28> I have heard that Ubuntu works "OK" (which I interpret as "barely tolerable") on a Surface Pro 3. Does anyone have firsthand experience with that or another Linux distro on that hardware?

I have also heard of people running Ubuntu via VirtualBox or HyperV on a Surface Pro 3, which I'd expect to work as well as anything else.

<comment><USER29> the touch screen experience itself will give you the biggest trouble; the hardware itself is pretty compatible.

use of a touch-screen centric DE/WM (unity) would be advised, but other than that it should be OK.

</comment></comment><comment><USER30> I've been using a Surface Pro 3 for a few days. I bought it to eventually replace my laptop of 4 years, a ThinkPad W500 running Linux (Ubuntu, then Linux Mint Debian Edition).

For now I'm using it with Windows 8.1, and Ubuntu under VirtualBox. Supposedly Hyper-V would run faster but it disables Connected Standby so I'm sticking with VirtualBox until I get around to installing Ubuntu for dual-boot.

First thing I did in Windows was disable indexing and other background processes and it runs quiet and just warm most of the time (i7, 8GB RAM, 512 GB SSD). I'm happy with it in this aspect, the fan comes up some times but so does the W500, and the noise is much less intrusive. The T41 and W500 I've used have an annoying "yaauuuuuuuuuuuuuuuuu" sound, worse for the T41 in my recollection, but the Surface has a constant white noise that bothers me much less.

Then I installed Firefox, GIMP, Inkscape, Blender, and Emacs. They work very well. Still no pressure sensitivity in GIMP, even after installing N-Trig's WinTab drivers, both 64 and 32 bit versions, so I would not lose anything by using them under Linux, but the graphics under VirtualBox is quite slow, even with 3D acceleration enabled.

The pen is very accurate, the smaller parallax compared to Wacom helps in using it as a mouse, but for freehand drawing it's still worse, compared to a Wacom Intuos 3 (external USB) and to a Samsung Galaxy Note 10.1 2014 edition. I tried using the Galaxy Note as my main computer since I'm compiling in remote machines most of the time anyway, but I'm very disappointed with Android. Linux console applications work fine after you install one of the Debian chroots, but I've tried a GIMP-Inkscape-Xserver[1] bundle app for Android and the re-drawing is uselessly slow.

[1] [https://play.google.com/store/apps/details?id=org.gimp.inksc...](https://play.google.com/store/apps/details?id=org.gimp.inkscape&hl=en)

The biggest problem with the pen, now that pressure curves can be adjusted, is the wavy diagonal lines. This is not visible at 1:1 zoom, but when drawing freehand in Inkscape, when you zoom in it's absolutely obvious and you need to adjust the spline handles everywhere. I normally draw curves by adding the points one by one though, so for me it's fine.

I find the type cover excellent given the constraints. It's not as good as the W500, sure, but it's good enough for constant writing and programming with Emacs. It's better than the ThinkPad Tablet Folio Keyboard (USB) that I modified to remove the cover part. I'm considering getting a ThinkPad Compact USB keyboard because some of my usage involves positioning the tablet as a monitor, separated from the keyboard.

The touch screen is great and it's surprisingly easy to use normal applications just with your fingers. Not great, but I find it much more accurate than the Galaxy Note.

I've tried other combinations before to have both a retina-class display and Linux in a portable package: Toshiba AC-100 with Lubuntu + iPad 3 which was OK for LaTeX and then visualizing and browsing in the iPad, Samsung Chromebook 3 (ARM) + iPad which was an improvement for browsing on the laptop and console use (Ubuntu with crouton) and still allowed me to use LUKS encrypted external storage which Android doesn't, then Galaxy Note 10.1 with Debian chroot as mentioned above, and now the Surface.

My impression is that once I get it to boot in Linux with the type cover [2], bluetooth and 5GHz WiFi working it'll finally cover all my needs.

[2] there is a kernel patch already for it

<comment><USER31> Do you think that this would make sense for a typical Linux tiling window manager / text mode user?

The form factor is great. I'd like something that i can place in my desk, a bit far away from me, and attach a usb keyboard to. Much better ergonomics than a laptop.

For occasional use, I can use a soft keyboard when it's converted to tablet mode.

<comment><USER32> I'm using an SP3 to run i3, Arch (native, not in a VM). Dual booting when I need Adobe in windows. Didn't even have to disable secure boot.

I am keeping notes on the process here: [https://docs.google.com/document/d/1dX6WJ7GLwva58cTh8cCB13us...](https://docs.google.com/document/d/1dX6WJ7GLwva58cTh8cCB13usgHJktx497zmBI- bLEVk/edit?usp=sharing) (note the outstanding bug about the power/hardware buttons).

Here it is driving a 34" ultrawide: [http://i.imgur.com/oXLJkpP.jpg](http://i.imgur.com/oXLJkpP.jpg)

I found that there are a couple critical tweaks for me to be able to move back and forth between comfortable external and internal usage. If you give the SP3 a go, I'd be happy to share further notes/thoughts on this. Basically, I detect the current DPI when launching a terminal and set the font size accordingly so I'm not doing it manually (not that font size adjustment is hard, but it's critical to a smooth workflow to have things just work right). Same for browser launching. chrom{e,ium} needs to have a flag specifying the UI scaling at launch for me to use it comfortably on the internal display vs external.

<comment><USER31> Awesome! I'll try to get one from my employer. Or do you think it's worth waiting for a SP4 with a Broadwell Core M?

<comment><USER32> I long ago gave up on waiting for the next version of anything. That being said, I love power savings and if I stick with this setup (SPro with a mechanical keyboard) I will eventually switch to a Broadwell Core M model when it comes out.

I can get about 6-7 hours of battery on the SP3 under Arch, maybe more if I worked at it. I'm happy enough with it for now. Coming from a MBP15" (circa 2011) that had fans like a jet engine, even the loudest fan noise from the SP3 doesn't really phase me.

What does bother me a bit is the outstanding bug on the hardware button support.

If you are on the fence, you could reasonably wait for broadwell and this button driver issue to get worked out. I'm comfortable with the setup as is, but it's certainly bleeding edge :)

<comment><USER31> Sounds great. Stupid question, but is it possible to use a soft keyboard while in text mode?

<comment><USER32> If I didn't answer your question, feel free to ping me on email. There's a non trivial amount of tweaking I did to make this thing run the way I want.

<comment><USER31> Thanks, I will talk to my employer about this. They're quite slow. But I will eventually reach you through the contact details in the Google Drive document in case I want to figure out something.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> I still think the Pro 2 is a better compromise, esp. when you consider the price difference these days. You can get an i5 128GB for around 1/2 the price of the Pro 3 i7. The i5 doesn't get hot, too.

</comment><comment><USER34> It wouldn't cost much to hire some recent illustration or design school grads and have them do nothing but test the Surface all day and give feature and usability suggestions. Asking a busy person like the Penny Arcade artist to offer suggestions right before the ship date, and then use his suggestions in post-ship date fixes is just half assed.

</comment><comment><USER35> I would like to buy a Surface Pro 2* to use with Ubuntu. Do you think it makes sense?

* I specifically like a smaller sized Surface. Unless Microsoft will release a compelling update for a 10.6" model, I will stick with SP2.

<comment><USER36> No. I don't think Ubuntu can be installed with all required drivers to run properly. But that's more a guess. Also, the GUI of Windows 8.1 is quite nice for hybrid touch/mouse usage. So, for best and easiest GUI (touch or mouse)interaction Win 8.1 is better, but:

Linux shines with it's shells. The bash is by far the most productive environment I've ever used. Just install Virtual Box and run Ubuntu in it.

<comment><USER37> > absolutely no experience on the topic being discussed.

> still has an answer.

:)

[https://jaxbot.me/articles/running-ubuntu-on-a-surface- pro-2...](https://jaxbot.me/articles/running-ubuntu-on-a-surface-pro-2-off- the-metal-video-5-26-14)

the surface is a PC like any other. wacom even works out of the box. you just have some trouble with pressure settings. Touch screen is also a done deal on almost all windows laptops. never saw one not working in recent times. the wifi and audio are the usual suspects of linux hell. and in this case it was true, as it always is. but both could be worked around with know-to-work USB devices. though wifi seems to have been solved.

anyway, the link has a video.

</comment></comment></comment><comment><USER38> I really disagree with how MS pushes this device (laptop + tablet).

IMHO it's a lot better to look at it like a desktop machine which can transform to a tablet.

Instead of buying the type cover, think using the cash on the docking station instead. 8gigs RAM + i5/7 + SSD + 2 monitors + ethernet + full keyboard and a mouse. And you can unplug it to read/annotate pdfs, write OneNotes in meetings and other tablet perks.

If you can afford it, buy the cover too. It's nice in some situations where you might need the keyboard on the go, although I wouldn't expect too much from it.

<comment><USER39> The tablet itself already had USB and DisplayPort. Just buy a USB keyboard and Ethernet adapter, and you get everything you listed for way less than $220 the docking station costs.

<comment><USER40> Seconded. The official docking station is nice but you can basically do the same via the USB port

<comment><USER37> dock stations were never bought by cost conscious consumers. it is corporate spending, exclusively.

</comment></comment></comment></comment><comment><USER41> OTOH, I really wish they released a Service Pack 2 for Windows 7. It takes over 4 hours to download and install all the updates since SP1. I understand they want all of us to upgrade to Windows 8, but not at the cost of making existing user's life difficult

<comment><USER42> You can always slipstream the updates onto the installation media yourself.</comment></comment>


Why Miners Walked Away From the Planet's Richest Undeveloped Gold Deposit - <AUTHOR> http://www.businessweek.com/articles/2013-09-27/why-anglo-american-walked-away-from-the-pebble-mine-gold-deposit#r=read

<comment><USER2> The united position of Tiffany's and Walmart is interesting. Perhaps both are concerned that unrestricted flooding of the market will new gold will hurt both of their profits. Or is it altruism?</comment>


A new Lego set honors the women of NASA - <AUTHOR> https://arstechnica.com/science/2017/10/a-new-lego-set-honors-the-women-of-nasa-and-it-looks-pretty-awesome/ <comment><USER2> This makes me so happy. We need statues, currency, and all sorts of toys that make Powerful Women normal in society</comment>


Striking.ly - One page websites. - <AUTHOR> https://www.striking.ly/ <comment><USER2> I find their terms of service interesting

\---

COMMUNICATIONS FROM Striking.ly OR THIRD PARTIES

Striking.ly will utilize a Customer's contact information, including email and telephone, to provide Services. It may from time to time send to Customers special offers, promotional materials, system upgrade alerts, notices of changes to this Agreement, and similar communications. Striking.ly may, based upon the preferences of Customers, _provide email contact information to third parties which may offer services or products of interest to a Customer_. All Customers shall have an _"opt-out"_ right from having email contact information shared with third parties. Further, Customers shall have an opt- out right as to promotional and similar non-essential types of communications from Striking.ly. In the circumstance that a Customer desires to exercise this opt-out, contact may be made to email@example.com.

<comment><USER3> These terms are fixed now. We never share email addresses with third parties.</comment></comment>


600 Covid-19 cases, 0 deaths with hydroxychloroquine, azithromycin, zinc sulfate - <AUTHOR> Dr. Zev Zelenko, a doctor in a Hasidic community, has been using a similar regimen:
1- hydroxychloroquine,
2- azithromycin, and
3- zinc sulfate.
A report by Dr. Zelenko on his patients:
https://www.youtube.com/watch?v=4ulqf5NXhms
From the Youtube text:
PLEASE READ HERE BELOW IN VIDEO DESCRIPTION MY UPDATED OBSERVATIONS
To all governments, medical professionals, and patients:
Here is my outcome data since 3/18/20 – 3/26/20
669 PATIENTS SEEN IN MY MONROE, NY practice with either test proven or clinically diagnosed corona infection
0 DEATHS
0 INTUBATIONS
4 HOSPITALIZATIONS for pneumonia – patients are on iv antibiotics and improving
As of 3/27/20 6 am. As per WHO, CDC, ECDC, NHC
World statistics – 531,860 cases / 24,057 deaths = 4.5% death rate US statistics – 85,653 cases / 1290 deaths = 1.5 % death rate
Dr Zelenko statistics – 699 cases / 0 deaths = 0% death rate
PATIENTS TREATED WITH THREE DRUG REGIMEN
1- hydroxychloroquine 200mg twice a day for 5 days 2- azithromycin 500mg once a day for five days 3- zinc sulfate 220mg once a day for five days
CONCLUSION – TREAT AS EARLY AND AS AGGRESSIVELY AS POSSIBLE IN THE OUTPATIENT SETTING
Respectfully,
Dr. Vladimir (Zev) Zelenko
[Rudy Guliani interviews Dr. Zelenko:
https://www.youtube.com/watch?v=1TJdjhd_XG8 ] <comment><AUTHOR> I love how Giuliani takes notes and asks questions when he interviews Dr. Zelenko. Youtube's subtitle captioning is so often wrong and misleading! Giuliani's questions correct that somewhat and slow down the conversation so I can follow easily.

I really wonder how many little notepads Giuliani has and what kind of pen he uses?

</comment><comment><USER2> I can't believe the media has been downplaying chloroquine+ treatment since Trump tweeted about it. This medicine has shown nothing but promise for months now, since the first reports out of China.

<comment><USER3> Lol cause people like the idiot in Arizona are going to die from self- medication.

<comment><USER2> The guy who died from self medicating did so by consuming chloroquine phosphate in a mixture designed for aquarium cleaning. The fact that the media put it on full blast was nothing but a smear campaign. For once Trump was not acting foolishly for tweeting about a medicine which is literally poised to save millions of people during a crisis. There were already at least two papers with positive results at the time of the tweet, and we have a mechanism by which the drug may function.

Chloroquine is generally safe and well tolerated. And it is not hard to properly dose. People take it prophylactically when traveling to certain countries with non resistent malaria. The fact that some idiot killed himself should not be enough to limit our own rights to knowledge and potentially self treatment during a crisis where the government has unquestionably failed.

<comment><USER4> They overdosed is my guess. The woman reported they each took "a spoonful" in soda. A teaspoon is 4 grams. An overdose is 2 grams. I don't know why this isn't reported anywhere.

It was probably the right chemical, as far as I can tell there isn't an aquarium specific formulation, Chloroquine Phosphate is Chloroquine Phosphate. You could just as easily overdose on the prescription if you downed a handful of pills.

I'm upset they didn't report this correctly because now people can still die from an overdose and people who might have had access to the aquarium chemical might have saved themselves with proper dosage.

<comment><USER5> As I understand it, the aquarium cleaning product in question is a mix of formaldehyde, hydrogen peroxide, copper sulphate and chloroquine. It is used to treat the fish parasite Amyloodinium ocellatum.

Taking a spoonful of that stuff is always a very bad idea.

Even if one could find "pure" Chloroquine Phosphate without all the other stuff, Chloroquine Phosphate is not the same as Chloroquine Phosphate. You can charge or remove electrons and still call it Chloroquine Phosphate, you can put it into different crystal formations, and I am probably forgetting other tricks that exist in chemistry to completely alter the behavior of a drug.</comment></comment></comment></comment></comment>


People behave better when they think they're being watched - <AUTHOR> https://www.iafrikan.com/2019/07/08/moral-science-confirms-people-behave-better-when-they-think-theyre-being-watched/ <comment><USER2> ... because they live in fear</comment>


StumbleUpon 50% Bigger Than Twitter - <AUTHOR> http://www.readwriteweb.com/archives/stumbleupon_hits_7_million_users.php I really like StumbleUpon and, with no offense to Twitter, I think it's far more innovative.  More important it does much more to extend it's users' knowledge.  So why does Twitter get so much digital ink? <comment><USER2> I'm not exactly sure why the two would be compared. Isn't that like comparing the number of Worlds of Warcraft players to the number of Microsoft Word users? I understand that they're trying to make the point that StumbleUpon should be getting more press because it's bigger, but, honestly, there's only so much one can write about it. It's a nice little utility to help people discover content, but it's not disruptive by any means whereas Twitter is actually changing the way people, governments, journalists, politicians, and corporations do things.

<comment><AUTHOR> Because they are both startups and they both get coverage from the same tech news media. Which makes the inequality of coverage relevant given the amount of users.

Let me give an example to try to explain it better.

People always complain that Celebrities like Lindsay Lohan get far too much coverage by the mainstream media while important Government issues like the Stimulus package get too little coverage. The media's excuse is always "we're delivering what the public wants to hear." But if someone could somehow prove the public wants to hear about the stimulus package more than Lindsay Lohan it would make for a great counter argument against that menatality.

That's what this comparision is (with Twitter being Lindsay Lohan and StumbleUpon being the Stimulus Pacakge)

</comment></comment><comment><AUTHOR> I've always liked StumbleUpon and, with no offense to Twitter, I think the concept is far more innovative. More importantly I think it does a lot more to make it's users smarter. So I'm always annoys when Twitter gets so much digital ink while StumbleUpon gets almost none.</comment>


Starbucks "Tweet a Coffee" potential security vulnerability - <AUTHOR>

Starbucks has recently implemented a program allowing you to tweet @tweetacoffee to @... (https://www.starbucks.com/tweet-a-coffee).
This in itself seems innocent enough, but given the frequency with which Twitter accounts are hacked, this seems a potential security issue.
As a hacker, if I scrape Twitter for anyone who has ever used this functionality (basically anyone who has tweeted @tweetacoffee), I can see which account are tied to Starbucks, and subsequently target those accounts.
If I gain access to even a single one of those accounts, I can then send myself, or anyone really, money. Up to this point, when your account got hacked on Twitter, you basically just had to deal with embarrassing tweets or phishing attempts. Now hackers have direct access to your credit card.
Does anyone else agree with this, or am I totally out there on this? <comment><USER2> Yeah, same with all these new services popping up like Square Cash that if you have access to someone's email you can send money to anyway without any other verification.

I think it comes down to convenience outweighing the downsides. Since for most people it won't be an issue and for anyone it does happen to, they would simply notify their Bank immediately who would simply void the charges while they look into the fraud. I assume Twitter or Starbucks sends a receipt email after a Tweetacoffee occurs.

It would make sense to require users to enable double authentication in Twitter to be able to use the send money feature or in gmail to use Square Cash but doubt that would ever happen since people can already enable double authentication and the people who don't, don't know how to or don't want to and forcing them to would defeat the whole purpose which is convenience.

Good point though and will be interesting to see what happens with all of these services.

</comment><comment><USER3> Right, but this isn't really a vulnerability, just a fact of the matter that when an account has credit card info attached to it, it can be exploited. There are probably much easier (and less detectable) ways to steal money than trying to crack into Twitter accounts.</comment>


Block-level AIDS incidence map of San Francisco - <AUTHOR> http://www.sfdph.org/dph/files/reports/RptsHIVAIDS/20130114_sf_hiv/hivaids_atlas.asp

<comment><USER2> As a man who is safely out of the closet for quite a while now, has seen the scourge of AIDS amongst my circles of friends, and has spent a great deal of time effort and money educating and promoting safer sex... this is disheartening.

And I realize we're pretty safe from violent gay-bashing here in SF, but this would be a terrifying map to see in less tolerant regions. Even as it is I fear that it'll be immediately passed about amongst religious zealots as the Map of Depravity.

We've got a long way to go. :-/</comment>


Definining the Value of Community (Review of LeanCoffee Meetup in Toronto) - <AUTHOR> http://bigbangtechnology.com/post/defining_the_value_of_community

<comment><AUTHOR> Hi Everyone,

I'm the author of this article, and I'd like to get your feedback on this article because I worked really hard on it. I also think everyone can get something out of this article even if you don't belong to this specific meetup. Definitely geared towards startups who belong to meetup groups.</comment>


Private Equity Wants in on the Bailout? Spare Me - <AUTHOR> https://www.bloomberg.com/opinion/articles/2020-04-02/coronavirus-private-equity-wants-in-on-small-business-bailout <comment><USER2> Buffett on private equity:[a]

> For some years, these purchasers accurately called themselves "leveraged > buyout firms." When that term got a bad name in the early 1990s – remember > RJR and Barbarians at the Gate? – these buyers hastily relabeled themselves > "private-equity." The name may have changed but that was all: Equity is > dramatically reduced and debt is piled on in virtually all private-equity > purchases. Indeed, the amount that a private-equity purchaser offers to the > seller is in part determined by the buyer assessing the _maximum_ amount of > debt that can be placed on the acquired company.

> Later, if things go well and equity begins to build, leveraged buy-out shops > will often seek to re-leverage with new borrowings. They then typically use > part of the proceeds to pay a huge dividend that drives equity sharply > downward, sometimes even to a negative figure. In truth, "equity" is a dirty > word for many private-equity buyers; what they love is debt. And, because > debt is currently so inexpensive, these buyers can frequently pay top > dollar. Later, the business will be resold, often to another leveraged > buyer. In effect, the business becomes a piece of merchandise.

Left unsaid is what happens if things do _not_ go well. Saddled with as much debt as possible, the business by design has been put in a position such that it cannot survive even a modest decline in revenue without raising significant additional capital.

Therefore, if government assistance is not forthcoming, the economic shock of COVID-19 looks likely to put a majority of leveraged buyouts in bankruptcy.

[a] [https://www.berkshirehathaway.com/letters/2014ltr.pdf](https://www.berkshirehathaway.com/letters/2014ltr.pdf)

<comment><USER3> > Saddled with as much debt as possible, the business by design has been put > in a position such that it cannot survive even a modest decline in revenue > without raising significant additional capital.

I agree, but I think it's important to qualify what you mean when you say the "business can't survive". Because this implies that if a company can't meet its debt obligations that it will cease operations.

As long as operational cash flow is positive, then no amount of leverage or debt distress will halt the continued operations. The business might "fail" in the sense that the entity is legally re-structured and the equity owners, or even junior debt owners, are zeroed. But there's no reason in a country with well-developed bankruptcy law for this to have any impact on the employees, customers or operations of the business.

The issue with coronavirus and failing businesses is that it's causing many businesses to have negative _operational cash flow_. In this sense the business may fail and the operations discontinued simply because revenue is no longer exceeding expenses. But if the operations are cash flow negative (and capital markets are unwilling to extend financing in the hope of future cash flow) then the business will fail regardless of its capital structure or leverage.

<comment><USER4> I'm really curious what your point is, since the willingness of capital markets to extend financing seems like it'd be very related to a company's capital structure and leverage. Like, were the businesses in question not over leveraged, they'd find it much easier to find the capital to continue operations during a downturn.

<comment><USER3> > extend financing seems like it'd be very related to a company's capital > structure and leverage

This seems intuitively appealing, but is misleading. The Nobel-prize winning work of the Modigliani-Miller Theorem[1] that a firm's capital or leverage ratio does not prima facie have any impact on its weighted-average cost of capital.

[1] [https://en.wikipedia.org/wiki/Modigliani–Miller_theorem](https://en.wikipedia.org/wiki/Modigliani–Miller_theorem)

<comment><USER5> Well, you have to take into account more stuff than what's one the prima facie, like when all businesses have to run on 1/3 revenue, and (like in the example in the link) can't even afford the interest payments that are due. That tends to make capital more expensive.

</comment></comment></comment></comment></comment><comment><USER6> >But do they really deserve any part in a bailout?

Do any of these companies?

The whole concept of bailouts create bad incentives - to me that's more the crux of the issue. But if you're gonna do them anyway then I see little justification for including/excl some just because they're listed vs private.

Plus it makes way more sense to "save" the economy at grass roots level anyway. I'd prefer more of a suddenly expanded social safety net type situation. Similar to what the US is doing with corona checks and what Germany is doing with blanket guarantees tp try and prevent layoffs.

<comment><USER7> These two options for saving the economy: corporate bailout vs social safety net essentially correspond with belief in trickle down vs Keynesian stimulus. Stated even more bluntly, it is essentially whether you believe customers or assets are most important for business.

It is why the current path begins to resemble 1929 where consumer buying power spiraled downward. If the social isolation period ends with millions of consumers cashless, and in debt then there will be no one for businesses to sell to. In this cases, businesses would have to use any bailout money to employ people unnecessarily for the months it would take until consumers have spare cash: The months of paychecks it will take for them to pay outstanding mortgage payments, back rent, personal loans, credit cards etc plus interest on those. Bailing out consumers/employees avoids this convolution, does not assume that business will act in this uncharacteristic money losing way and, avoids extra expense/risk since consumer loans are higher interest rates/risk than government borrowing.

Furthermore, the trend away from brick and mortar toward online consumption may be enormously sped up by this social isolation period. In this case, many of the businesses bailed out will never fully recover. Consumer spending power is a much better way for the market to evolve than a government guessing which companies are will be viable at the end of this.

<comment><USER8> "trickle down" isn't a real thing, it's just a pejorative used against supply side economics, which is a mainstream economic view.

The basic account of "trickle-down economics", goes something like this. When you give a tax cut to a rich guy, he uses the money to buy party supplies for a celebratory yacht party. The guy who owns the yacht party supply store sees an influx of cash from rich guys spending their trickle down tax cuts on yacht party supplies and orders a pizza to celebrate, and gives the pizza guy a big fat trickle-down tip. As you can see, the tax cut started out at the rich guy, but before long even the lowly pizza delivery guy is getting a piece of that sweet trickle-down cheddar.

Notice an interesting thing about this account: it is fundamentally a _demand- side_ story. In this story, the trickling down happens as a result of people spending extra money on goods and services. It is not about creating supply. So it's _not even an accurate representation_ of supply-side economics. People rightly point out that it's a flawed story, because poorer people probably have a higher marginal propensity to consume than rich people, so you'd be better off giving the tax cut or equivalent transfer payments to poor people if you want to stimulate economic activity. Well, yeah, no shit, that's because this is a complete straw-man and no economist actually believes that this story is true.

What some economists actually do believe is that the path to prosperity is via the supply curve and not the demand curve. Making things cheaper to make and cheaper to buy makes people better off faster than just giving them money to buy things at existing levels of production. And the way to do that is investment—investment meaning, in the economics sense, spending on things like factories and equipment. There is a huge body of theory and evidence to support this idea—higher levels of investment do lead to faster growth. So supply siders believe that things like taxes on capital gains are harmful to the economy on the margin because they reduce spending on investment, and may even encourage spending on consumption, which is a bad outcome to the supply- sider. They also believe in reducing barriers on production—things like government regulation and income taxes. They also believe in, you guessed it, helping make sure that corporations don't go out of business amidst a once-in- a-century black swan event — call it a "corporate bailout".

<comment><USER7> For want of an equally familiar term, "trickle down" is all I had. Apologies if it is critical sounding.

The crisis will end with sky high unemployment, no consumer saving but massively increased personal debt. To raise the deficit solely so companies can make twice as many widgets with half the employees would be the worst possible response. And even this assumes supply side policies do what they claim.

<comment><USER8> > The crisis will end with sky high unemployment

Nobody knows this for sure.

At the moment, the official policy of the Federal (and most State) government is forced unemployment: a planned shutdown of the economy. To accommodate this, the CARES act includes $2400/month (on top of State UI) unemployment insurance, and that's not even including the flat $1200 check. If you live in Minnesota, you're looking at $5,360/month (!!!). The full state breakdown can be seen here [1]. In every state, the unemployment insurance is higher than the median wage. Businesses know this, and are proactively laying off their employees so that they may collect this benefit, with the intention of hiring them back once the planned shut-down ends. This can only happen if the businesses stay solvent, hence the corporate bridge loans.

[1] [https://imgur.com/a/AifRmdD](https://imgur.com/a/AifRmdD)

</comment></comment></comment></comment></comment><comment><USER9> What I learned in school growing up was that if I lose a bunch of money gambling at the casino with my credit card, I don't get a free bailout from the government. But maybe things have changed?

<comment><USER10> The privileged class knows that congress sells us out. The privileged class are just again working to rob the masses to wealth transfer more to the privileged classes. Happens every year, some more visible than others. Hopefully this is one time congress won't sell us out.

<comment><USER11> > Hopefully this is one time

> congress won't sell us out.

Uh, didn't it already happen, again?

Propping up aerospace and banks again with taxpayer money, sending only a fraction (call it a "token") to SMBs, with near unchecked disbursement powers, seems like they've continued on their same general strategy of wealth consolidation.

<comment><USER12> When the first tweets from the executive branch were "OMG we need to save Boeing!!!!" instead of "We need doctors and supplies!!!" that kinda summed up where the priorities were.

<comment><USER11> Exactly.

Made painfully clear with the messaging that "hey, a lot of people die from car crashes and the flu every year" directly followed by quotes of "these great American companies such as Boeing are NOT replaceable".

IOW: old and/or poor people are commodities easily replaced.

</comment></comment></comment></comment></comment><comment><USER13> If a company can issue stocks or bonds and needs to raise money, it should issue stocks/bonds instead of getting bailed out by the government. If no one's buying, talk to the Fed.

<comment><USER14> The problem is they were already operating on razor thin margins. Imagine people walking through their lives with only $10 of savings, and hundreds of thousands of dollars in debt. First time something happens, boom, you go bankrupt.

Same with PE companies. They leverage up to the highest possible values, and then a bit more. They knew the risks of doing so, but the risks were worth it because they would make so much money if they paid off. But they didn't paid off. Why should we bail them out?

In fact, is there something we can do to PREVENT these colossal leverage figures? Banks don't care, regulators can't do much about it, PE companies don't care, the companies being bought out don't have a say, and neither consumers.

<comment><USER15> It's disingenuous to say PE doesn't care. They have every incentive to preserve and generate equity value. That is literally their business.

However, the issue is employees are also hurt, not just equity and debt holders.

Edit: I don't see how you can disagree with this statement. Literally the only job of a PE firm is retain and create value for investors. They would be out of business if they did not do that. Hence, they care about preserving capital. With the caveat that this is in aggregate across the portfolio.

I don't disagree, however, that there needs to be significant regulation and social safety support for workers. I believe there needs to be significant changes to ensure we protect worker rights.

<comment><USER16> Buy companies, layoff and outsource staff. Over work those that are left. PE is already bad for employees.

<comment><USER15> I work at a PE firm. There are multiple strategies employed, but the name of the game is not to lose money. Disagree with the term "value creation" \- fine - but my point is there is zero incentive to lose money. Otherwise, they would be out of business in the long term.

I am arguing for worker protection. Not protection of equity value. You inherently take on risk by deploying it, and should accept the realities of that risk.

<comment><USER17> > Otherwise, they would be out of business in the long term.

... that would be a fine incentive _if_ we don't bail them out. Otherwise...

<comment><USER15> Totally agree, I thought we were arguing to bail out employees here. That's what I'm aware of based on what I've seen going on in the industry

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> If the real goal here is to save jobs, this is all completely irrelevant.

<comment><USER19> Has PE had a history of net job gain, or at the very least saving the jobs that were already there?

My impression, without any data on hand, is that PE firms tend to reduce the number of jobs overall.

<comment><USER20> As much crap as Michael Milken has gotten, I agreed what he said on junk bonds: Dollar by dollar, junk bonds did create a lot jobs. They funded risky businesses, in the same way venture capital does today. Problem arises when they are used in deceptive ways.

</comment></comment></comment><comment><USER21> Matthew effect in full flight.

[0] [https://en.wikipedia.org/wiki/Matthew_effect](https://en.wikipedia.org/wiki/Matthew_effect)

<comment><USER22> Capitalism is itself a pure unadulterated implementation of Matthew's effect. If you have capital of $X, you automatically are entitled increase in that $X. If you have $0 then you work day after day to find _your share_ of global wealth keeps dipping. This is typically gets sold as "risk vs reward" system while the fact is that if you had invested in S&P500, your investment is practically protected by the US Army and its arsenal of nuclear weapons. The risk of your $X reducing to $0 over any conceivable long term is practically nonexistant. You simply see your wealth grow unbounded without you doing anything at all. You can count of US government to get you out of ditch even though the vast majority of the population has no investments in S&P500. Sure, folks screw up as always but that's the capitalism in essence and it gets better as $X gets bigger.

<comment><USER23> Your premise just isn't true. A significant majority of Americans have investments in the stock market.

<comment><USER24> While that may be true, 1% of Americans hold 50% of total US equities. The wealth gap is wider than it has been in 130 years, that is not good.

</comment></comment></comment></comment><comment><USER25> I feel like this whole thing is a sideshow.

We should "bailout" based on just 2 criteria:

* would the business be viable if it weren't for corona and will it be viable after coronavirus?

* what's in it for us? We want equity, or juicy interest on the loan or you're industry needs to be a big net contributor of tax revenue.

We made a profit on the TARP activities. Let's do that again, then we can cut taxes and expand services. Who doesn't like that idea!

<comment><USER26> It is precisely because of the predictable government response to corona that many of these firms are viable at all. That is, many know that they can enter into what is essentially a "bad faith" debt obligation because they know a bailout will likley be available.

There hasn't been any real incentive to save or be fiscally responsible since the 90's. Spend as much as possible. Take on as much debt as you can. If things get bad you can either abandon ship and do it all over again or wait for a bailout which is almost ingrained in the system at this point.

In fact the more debt you have the less you have to worry.

<comment><USER27> Quite the moral hazard.

<comment><USER25> Only if the industry being bailed out can somehow profit from causing the next plague...

</comment></comment></comment></comment><comment><USER28> Perhaps they could find an opportunistic fund manager looking to invest in some distressed debt. Surely these PE firms know a vulture investor or two...

</comment><comment><USER29> We need more bankruptcy, businesses where the equity holders were too risky getting transferred to the debt holders. Force companies who want bail outs into bankruptcy, and if they let people keep their jobs let them hold some small amount of the equity when the company is rebalanced. Let the system work as designed instead of bailing out the bad decision makers.

</comment><comment><USER30> Y'all do realize that private equity portfolio companies include every single YC and venture-backed startup, right?

</comment><comment> ur-whale [https://archive.is/xnqEF](https://archive.is/xnqEF)

</comment><comment><USER15> It's not about bailing out the investments, but about preserving jobs. Fine, attach restrictions for taking bailout capital, but that should be the purpose.

<comment><USER31> You can get different types of "bail out" for different types of companies... It can be "much more expensive" for private equity firm than "normal" SME... You save as many jobs and you save a lot of taxpayers money

<comment><USER15> My point is no need to target preservation of equity value but instead ensure those facing job loss are supported. However, the current legislation doesn't allow portfolio companies to take bailout capital as a result of restrictions based on portfolio companies being "affiliates" of one another. Similar issues are faced by VC portfolio companies.</comment></comment></comment>


When Open Access Is the Norm - <AUTHOR> http://blogs.plos.org/scicomm/2015/04/13/hello-world/ <comment><USER2> "[P]roject leader Tracy Teal, a microbial ecologist and bioinformatician, cautions that GitHub is less than ideal for the purpose. "The capacity to share, track versions and do diffs makes it very appealing for collaborative document and lesson development," she says, "but it currently has too many technical barriers for people without programming experience. The activation energy to use it is just too high."

Maybe GitHub will continue to evolve in ways that lower those barriers. Or maybe open source alternatives, like GitLab, will enable that evolution. Although it hosts millions of open source projects, GitHub itself isn't an open source project. GitLab, though, operates under a dual license and offers an open source community edition. One way or another, the model of collaboration that GitHub has popularized is vital to the progress of science, and seems likely to prevail."

<comment><USER3> GitLab CEO here, I though that that was the most interesting part as well :) I started working with GitLab because developing git collaboration software in the open seemed the way the world should be.</comment></comment>


Task Management for Startups and Entrepreneurs - <AUTHOR> http://youtu.be/kxwHEeH5iRA

<comment><USER2> what's up with the horizontal "scrolling" I see in every other PM-related app lately? Did I miss a usability study?</comment>


Ask HN: What's the best way to start learning about / playing with GPT-3 and AI? - <AUTHOR> I've seen _awesome_ breakthroughs surrounding GPT-3 on Twitter, and there always seems to be energy in AI, but it feels like the field is impossible to start working on.
I'm not necessarily looking to deeply understand the math and technical details behind these algorithms, but want to learn how to play with them and find the limitations. I find there is little easily available on the internet that is between
1. Type in these commands and everything works perfectly 2. Read this obscure paper
Current situation: Recent college grad from Vanderbilt U, found a month between contracting as a SWE and starting as a PM at Microsoft. <comment><USER2> Try the [https://www.fast.ai/](https://www.fast.ai/) courses, its a mix between this is state of the art and teaching how to make an actual machine learning product.

They got an upcoming book, and I think that the epub is already out and the have the draft at github publicly available [https://github.com/fastai/fastbook](https://github.com/fastai/fastbook)

</comment><comment><USER3> [https://huggingface.co/](https://huggingface.co/)

is a great place to start</comment>


Building a Better Messaging System with Bitcoin - <AUTHOR> https://www.backed.io/posts/post/68

<comment><USER2> I see a lot of potential in a system such as this. Let's build it.

Would choosing an alternative crypto currency other than Bitcoin help with some of the recognized issues?

<comment><AUTHOR> I'm honestly not as well versed in what the latest alternative cryptocurrencies are as I used to be. However, I don't know of any that have solved the problem of blockchain bloat due to increased microtransactions.

I still think Bitcoin would be the best choice at the moment. It has a developer community that is actively working on solutions to the problems that keep it from being better suited to large numbers of microtransactions.</comment></comment>


Push Notifications Using JSON (Android) - <AUTHOR> https://refl.me/docs <comment><AUTHOR> Use the REFL.ME application and the data source in JSON to show messages and notifications on your mobile device in a simple and user-friendly form. The application works directly with web services, does not store messages on its servers, does not require registration and personal data.

<comment><USER2> I've been thinking about a similar application. Thank you.</comment></comment>


Does Depression Go Away on Its Own? - <AUTHOR> http://bigthink.com/devil-in-the-data/does-depression-go-away-on-its-own

<comment><USER2> No it takes a life of its own. Get help if you need it.

<comment><USER3> > Get help if you need it.

Certainly. But you might want to read the article. The study cited looked at 250 people in the Netherlands with recurrent episodes of Major Depression. It found that after two years about 80% of them had gone 3 months without an episode. And this was -- approximately -- true regardless of whether they had been treated or not.

(Yes, the world is full of people who tell those suffering from depression, "Just get over it," so it's easy to overreact to a title like the one on this article. OTOH, the article is _not_ saying, "Just get over it.")</comment></comment>