Learn SQL Interactively on Khan Academy - <AUTHOR> http://cs-blog.khanacademy.org/2015/05/just-released-full-introductory-sql.html <comment><USER2> This is great!

I created [http://sqlteaching.com](http://sqlteaching.com) , so it's wonderful to see Khan Academy's take. If anyone from KA would like to chat with me about SQL tutorials or anything else in general, feel free to reach out- firstname.lastname@example.com

<comment><USER3> I love your site and plan to use it as a teaching tool for my Wed Development course I'm teaching.

As a request, are you working on a user system to record completed lessons? As an extension, are you looking into making a classroom management system akin to Codecademy? I'd love to create a classroom, have students log in, complete the necessary lessons and have the means to know where they are in the overall plan.

If you'd like some help getting that going, let me know! I'm in the process of developing typing exercises for my courses to give students extra practice with the basics.

<comment><USER2> Hi tsumnia,

Thanks for the feedback! One nice thing about SQL Teaching is that it is _completely client-side_. This is possible because somebody compiled SQLite to JavaScript: [https://github.com/kripken/sql.js/](https://github.com/kripken/sql.js/)

Thus, I would have a bias against adding a classroom management system which would require some kind of backend database that I would need to keep running (funny, I know).

However, SQL Teaching is open source [https://github.com/rhc2104/sqlteaching](https://github.com/rhc2104/sqlteaching) , so I would update the site if you were to add the feature, or you could just take the JavaScript files and integrate it into your site!

<comment><USER3> Not funny at all! Its something that I am toying with on my end as well. I'll have to play with it this summer and let you know if I get anything rolling!

</comment></comment></comment></comment><comment><USER4> I'm doing the course, as it's something I haven't learned in depth yet.

They mentioned pronunciation : 'S-Q-L' vs 'sequel'. I've always pronounced it S-Q-L. The lecturer implies there's no right answer, that 'sequel' is historical but 'S-Q-L' is preferred for international use.

The annoying thing, though, is that in writing a choice has to be made. If someone pronounces it 'S-Q-L' then to read 'a SQL query' is weird -- it should say 'an SQL query'. And vice versa for someone who pronounces it 'sequel'. 'an sequel query' isn't right.

So, in writing, what is correct? 'An sql query' or 'a sql query'?

<comment><USER5> This is a question for English.StackExchange.

[http://english.stackexchange.com/questions/5265/an-sql- serve...](http://english.stackexchange.com/questions/5265/an-sql-server- database-schema-or-a-sql-server-database-schema)

[http://english.stackexchange.com/questions/1016/do-you- use-a...](http://english.stackexchange.com/questions/1016/do-you-use-a-or-an- before-acronyms)

That said... As a native English speaker, I can infer your pronunciation from which of the options of "a" and "an" you decide to use.

FWIW, "an" is appropriate for any word starting with a vowel sound (whether or not it _actually_ starts with a vowel) and inappropriate for any word that doesn't. "An historic" drives me nuts, but I'm one of _those_ jerks. (My mother was an English teacher - I never stood an chance!)

<comment><USER6> On some level, I think you can still apply the "starts with a vowel" rule for SQL, since in this case "S" is really standing in for "ess" (assuming you're not saying "sequel", which I've never gotten into the habit of doing).

<comment><USER5> Yes - exactly my point. It _is_ interesting to learn, as another commented somewhere in this thread, that my brain just invokes the appropriate "sequel" vs. S.Q.L. just from whether or not someone includes the ever-so-important "n."

<comment><USER4> It's not automatic for me, which is why I found it annoying enough to ask. If a writer writes 'an SQL query', that doesn't bother me at all, but if a writer writes 'a SQL query', it takes me a while before I start hearing it in my head as 'a sequel query' \-- until then, it just sounds wrong.

Worse is that some writers seem to mix it up, use both periodically.

</comment></comment></comment></comment></comment><comment><USER7> This was posted sometime ago and I really enjoyed : [http://sqlbolt.com/?rp](http://sqlbolt.com/?rp) I will definitely check out Khan's academy course as well!

<comment><USER8> I like that SQLBolt starts with querying (Khan does not). Even though a logical proceeding would start with CREATE and INSERT, many/most people will probably never do anything more than SELECT.

</comment></comment><comment><USER9> Wow, KA hits another one in the outfield!

The audio that highlights part of the code is awesome (much better than watching a passive video), and the fact that everything can be executed in real time is awesome. Good job!

<comment><AUTHOR> Thanks! That environment is all open source, if you're ever looking for some OSS bugs to tackle :-)

[https://github.com/Khan/live-editor](https://github.com/Khan/live-editor)

<comment><USER10> Is the recording and playback of course content part open sourced somewhere?

<comment><AUTHOR> The recording part is there as well, in particular [https://github.com/Khan/live- editor/blob/master/js/ui/record...](https://github.com/Khan/live- editor/blob/master/js/ui/record.js) These slides give a little high level overview of that: [https://speakerdeck.com/pamelafox/teaching-programming- onlin...](https://speakerdeck.com/pamelafox/teaching-programming-online- codemotion) (slide 26)

<comment><USER10> That's great, thanks for pointing in the right direction, and great job btw!

</comment></comment></comment></comment></comment><comment><USER11> It's great to see KA getting involved in teaching SQL - I really think there's too little SQL literacy out there amongst devs in general.

I created [http://pgexercises.com](http://pgexercises.com) a while back, which goes up to some relatively tougher exercises. I'd be very happy to help out with KA's effort if it would be useful. Email is in my profile.

<comment><AUTHOR> Oh, nice! I'll add that to our final article in the course, for folks that want to learn PostGres. I'm hoping this course is a starting off point for people, and they can get more advanced with non-KA resources.

<comment><USER11> That's very kind of you - thanks!

</comment></comment></comment><comment><USER12> This is great... but I am torn because, as someone who has spent a lot of time with databases, I feel like there are many mistakes that can lead to confusion.

First, it's not teaching standard SQL, it appears to be teaching MySQL. That means any user who tries out any other system will immediately run into confusing error messages about the double quotes. Not ideal, and totally unnecessary -- sticking to standard SQL should work reasonably well in MySQL anyway (at the beginner level, at least).

Second, in the section "Creating Tables and Inserting Data", the teacher jumps into surrogate keys immediately. Again, I feel that is unnecessary and will just lead to confusion. The beauty of a relational database is that it connects with the real world; and having arbitrary numbers floating around destroys that beauty.

I really hate to criticize, because I really support the effort. Hopefully my feedback is useful.

<comment><USER2> Khan Academy is using SQLite (because there is a JavaScript version of it)

<comment><USER12> Can't they use the standard single quotes then?

<comment><USER13> [https://www.sqlite.org/lang_keywords.html](https://www.sqlite.org/lang_keywords.html)

</comment></comment></comment></comment><comment><USER14> Imo every developer should be comfortable with sql, upto joins at least. Basic data modelling is also invaluable.

<comment><USER15> Serious question...what kind of developer can you be without knowing SQL?

<comment><USER16> Big Data Developers can use Spark, Cascdading or Pig to do pretty advanced data warehouse, analytics, ETL tasks. Web app developers accessing databases can use an ORM e.g. Hibernate to abstract away the SQL layer or use JSON to query MongoDB, CouchDB etc.

You could write every application under the sun without knowing a single bit of SQL.

<comment><USER17> One can't seriously use an ORM without knowing SQL, because they all come with their own proprietary incomplete wrapper language (HQL, etc.). ORM simplicity breaks down the moment you push them even slightly hard.

Big data analytics is increasingly done with Hive's SQL dialect, or Impala, or Hawq. Beyond all of these, relational data modelling is an essential skill for anyone building server side applications if you have to deal with information management, whether you use SQL or not.

</comment></comment></comment></comment><comment><USER18> So far my experience is that getting a SQL query correct is fairly easy and usually fun but that the real difficulty, e.g., for SQL Server, is for the rest:

(1) Installation.

Grim. Barbed wire enema.

Wiped out my Windows boot partition requiring that I reinstall everything starting with the Windows DVD.

(2) Security.

The stuff with _users_ , _logins_ , etc. and nearly everything in SQL Server Management Studio was clear as mud. In the end:

(A) Assume that basically what is there is essentially old _capabilities_ and _access control lists_ , imagine how they might work, and make that a first guess. It helped.

(B) Use SQL Server Management Studio only for passively reading but never for actual _management_ where change things.

(C) For each of the important steps in setting up security, do searches on the Internet, find standard text SQL statements, and try those. Save and profusely document the statements that do work.

(D) Do _system management_ only with SQL statements in simple text files and executed with the SQL Server command line utility SQLCMD.EXE.

(3) Connection String.

The last time I had to get a SQL Server connection string to work took a solid week of throwing things against a wall to see if they would stick. The effort was an unanesthetized upper molar root canal procedure.

<comment><USER19> If you want to get an understanding of basic SQL without all that overhead, you can try Microsoft Access.

<comment><USER20> Oh god, no more Access. Access has a weird semi-dialect of SQL where it's insanely picky about how you position parenthesis in multiple join statements. I found it impossible to get a query right without the graphical query generator, and that's after routinely writing 5-10 table joins in T-SQL. No thanks, I'd recommend Sqlite over it anyday for a lightweight database. Works great on command line or in any of dozens of helper tools on any platform, and it's Free.

<comment><USER21> I agree with the SQLlite recommendation.

</comment></comment></comment></comment><comment><USER22> Does anyone know of a good data modeling course like this? I understand SQL, but I think I could still improve at data modeling.

<comment><USER23> Try Jennifer Widom's online course on databases:

[https://lagunita.stanford.edu/courses/Engineering/db/2014_1/...](https://lagunita.stanford.edu/courses/Engineering/db/2014_1/about)

</comment></comment><comment><USER24> It reminds me of the interactive SQL tutorial GalaXQL.

[GalaXQL]([http://sol.gfxile.net/galaxql.html](http://sol.gfxile.net/galaxql.html))

</comment><comment><USER25> We also have an interactive online SQL course at CodeHS (completely client side as well). You can check it out at [https://codehs.com/sql](https://codehs.com/sql) or try out the first hour free at [https://codehs.com/hoc](https://codehs.com/hoc)

</comment><comment><USER26> very nice. and if you're looking for a sql job, check this out, still in beta:

[http://www.jobdensity.com/QueryGrid.aspx?q=661&t=sql&qt=5/11...](http://www.jobdensity.com/QueryGrid.aspx?q=661&t=sql&qt=5/11/2015%207:41:56%20PM)

</comment><comment><USER21> Could somebody confirm that SQLite is used to the course? By the way, this seems great!

<comment><AUTHOR> Yep, confirmed. Here's a blog post by Brian who implemented the SQLite support in our editor: [http://www.brianbondy.com/blog/id/168/sql-on-khan-academy- en...](http://www.brianbondy.com/blog/id/168/sql-on-khan-academy-enabled-by- sqlite-sqljs-asmjs-and-emscripten/)

<comment><USER21> Thanks pamelafox</comment></comment></comment>


The TTY demystified (2008) - <AUTHOR> http://www.linusakesson.net/programming/tty/ <comment><USER2> One of the most important commands I learned was "reset", especially when I was working with _anything_ that would want to do something special. From the man page:

"When invoked as reset, tset sets cooked and echo modes, turns off and raw modes, turns on newline translation and resets any unset characters to their default values before doing the terminal described above. This is useful after a program dies a terminal in an abnormal state."

Except, it is also useful when you exit something like a Serial-Over-LAN session, after watching the BIOS do inappropriate things to your terminal window.

<comment><USER3> If the SOL client is leaving the terminal in that state, it's almost certainly broken. The only time it's acceptable not to clean up after yourself is if you literally can't, because you've been whacked with a signal you can't handle (SIGKILL); or because you've _tried_ to clean up and for some reason the correct sequence of restoration calls has failed for some unknown operational reason.

<comment><USER4> Some edge cases:

\- cat /dev/urandom (cat can't reasonably tell if you've piped to another command that expects raw binary data or a terminal that expects to be left in a sane state)

\- ssh remotehost cat /dev/urandom (ditto)

\- Emergency exit to avoid data loss when detecting e.g. memory corruption (lesser evil)

\- Hardware bugs/failures erroneously emitting escape codes (memory bit flips, loose RS-232 connections)

You're of course correct that the vastly preferred thing to do when practical is to clean up when reasonable to do so - and it's probably reasonable to do so.

<comment><USER5> cat could tell but it probably wouldn't be a good design. Calling isatty is easy, and I think GNU cat already does so and buffers differently. But how can it tell what raw binary data did to your terminal? First you'd need to program all the different terminal types into cat (probably by using termcap) which isn't great simple "Unix" design to begin with. Then you can't just reset the terminal after running cat. You need to see if the binary data screwed up the terminal. That isn't in termcap and is probably intractable in the general case.

While catting actual random data is contrived, using ssh is not. What if the connection is broken while you're in vi. Vi switches to the alternate screen and then scrolling stops working. If you don't know what happened it's not clear why. How can ssh fix this other than acting like tmux and parsing every terminal command sequence? I'm not convinced there is a simple fix.

This doesn't even get into encoding issues. Some UTF-8 sequences are terminal commands. The UTF-8 encoding for U+00DF (the German eszett) contains a sequence which will cause some terminals to wait for a termination byte you wont ever send.

Plan 9 had the right idea: do away with terminal command sequences altogether. But that only works there because you can take your "terminal" and turn it into a GUI window.

</comment></comment></comment></comment><comment><USER6> > Beware, though: What you are about to see is not particularly elegant. In > fact, the TTY subsystem — while quite functional from a user's point of view > — is a twisty little mess of special cases.

I wonder if it is about time someone tried to build something more elegant. If someone was inventing something like the TTY subsystem from scratch today, with no requirements for backward compatibility, what would they do differently?

<comment><USER7> I'd want to investigate not relying on in-band signalling for terminal control. So, perhaps have two input streams: stdin and stdctrl?

Also, it'd be tempting to try and add more structure, but I honestly think bare streams of bytes are the right abstraction at this level.

<comment><USER8> Careful: when you have OOB signalling, how do you keep the control codes in sync with the data, bearing in mind that both streams may be buffered differently?

<comment><USER9> That's a good point. I think ultimately it would still need to be pipelined as if it were in-band. Perhaps synchronization codes with a timestamp/uuid that corresponds to point-in-time against the data.

</comment></comment></comment></comment><comment><USER10> This isn't entirely relevant to the article, but I hope some shell/TTY expert might read this, and know the answer :)

Hypothetically, could a TTY, in combination with the help of a shell, be able to separate the stdin, stdout and stderr of every running program? By default the shell could do what we normally see, but then easily (with some kind of GUI control) let me pull a particular program's stdout/stderr out to a seperate window, including (if I stored it) all it's previous output, and redraw the current terminal removing that program's output.

I've always been tempted to do something like this, and I'm curious if there is any massive reasons it's simply not possible.

<comment><USER11> Are you trying to do mathematica notebooks for the shell? There's no easy way to do this, you have to run each command into a separate pseudo-tty. You can only do this with a combination of a special terminal emulator and a special shell that only runs inside the special terminal emulator. You can't do this and then just use bash.

<comment><USER10> Oh, I know it would be a serious undertaking (I'd probably try hacking it into fish, because I've looked into it's code-base). I was just wondering if it's hypothetically possible, and why no-one has done it :)

<comment><USER11> I don't know. The reason I haven't done it is because it's too much work, there is no pleasant way to do GUI programming and I don't have a clear design for how the UI.

</comment></comment></comment></comment><comment><USER12> If you're interested in the history surrounding the TTY, I just published a newsletter about it on Friday which you can read (without signing up for anything) here: [http://www.rubyletter.com/newsletter/2017/02/03/terminal.htm...](http://www.rubyletter.com/newsletter/2017/02/03/terminal.html)

</comment><comment><USER13> This one is a bit of a classic, for the last 8 years (apart from in 2015) it has been on HN at least once a year:

[https://hn.algolia.com/?query=TTY%20demystified&sort=byDate&...](https://hn.algolia.com/?query=TTY%20demystified&sort=byDate&dateRange=all&type=all&storyText=false&prefix=false&page=0)

<comment><USER14> Maybe worth another api entry (maybe 'frequent' or 'classic')?

</comment></comment><comment><USER15> Should add "(2008)" to this.

<comment><USER16> Why? The only reason to put a date on a title is when the content itself is of historical interest, or may no longer be accurate.

</comment></comment><comment><USER17> Thanks for the submission, I've missed this previous times it has been posted.

I'm currently in the process of writing my own shell so if anyone has any other good resources you'd recommend then I'd be hugely grateful :) (the simpler the better too hehehe)

<comment><USER18> When writing shells it's possible to invoke standard libraries on both ends of the circuit to handle these communications/protocol issues without having to rewrite them.

<comment><USER17> I've got file streams working, that's the easy part. However I'm having issues with console applications that detect and require a PTY. Also handling ncurses is causing me a bit of bother.

</comment></comment></comment><comment><USER19> I stumbled across this a few months ago while implementing basic TTY resizing and ended up learning way more than I needed to. Super impressive, thorough article. :-)

</comment><comment><USER20> ASCII was invented in 1963, so the author's statement that Telex was ASCII- based is probably wrong. Is the rest of the article also as inaccurate?

<comment><USER21> According to Wikipedia, it seems that ASCII was first used by AT&T's TWX teleprinter network, that previously used another encoding, ITA2.

The keyword is "evolved into" as a long chain of changes, from Morse code, Murray code, a plethora of other variants of encodings and transmission methods, eventually standardised into ASCII on top of a modem in 1963.</comment></comment>


Startup Investor Rankings - <AUTHOR> http://mattermark.com/app/Benchmarking

<comment><USER2> Mattermark is something of little relevance to me but how good is the data? They recently produced a list of the fastest growing startups in my local community and the results were pretty odd. Companies with huge measurable growth beaten by, literally, new starts just a few months old with no revenue and few customers.

Granted I don't know what yard stick they used to come up with the list but to me on the ground in the community the list seemed way off and widely ridiculed.

</comment><comment><USER3> Measuring public-facing growth is cool, but it doesn't seem particularly useful for measuring investor performance. It's like measuring someone's driving ability using the shininess of their car collection as a proxy.

<comment><USER4> It doesn't really looks like the goal is measure financial performance. I think it's kind of an interesting idea considering how odd the valuation process can be for a company that has no revenue but tons of growth.

</comment></comment><comment><USER5> Could someone explain why "signals of growth", or as in this case "momentum", would be relevant to anyone? I understand that actual growth stats might be difficult to get hold of, but I think I'd rather have 200 of those than 200 000 "weekly growth of web traffic, mobile downloads, inbound links, employees, and social media".

<comment><USER6> I'd suggest "signals of growth" & "momentum" are a proxy for a site that has repeat traffic & systematic word of mouth. You can't maintain the momentum of growth unless you retain a significant number of new visitors.

If new visitors are developing the habit of repeat visits, thats a strong signal the startup has discovered a formula that strikes a chord with their niche/market.

</comment></comment><comment><USER7> Is the page rendering properly for others? I currently see the list of companies right justified, then the bar graph part after all the companies have been listed.

Chrome 31.0

(edit: displays fine on Firefox)

edit2: 12:09am looks like they fixed it

<comment><USER8> 12:33 - still broken for chrome.

<comment><USER9> same

</comment></comment></comment><comment><USER10> Not trying to rain on the parade, but could this ever include weighted rankings by a fund's % ownership in a given investment. E.g. a fund that owns 10% of Uber should rank higher than a fund with 5%, everything else being equal.

That said, it's probably much more important to have _any_ investment in Uber (to continue the example) than whether you have a handful % more/less than another fund.

</comment><comment><USER11> AngelList should be in this ranking. Especially because FundersClub, a direct competitor, is at the top.

Yes there is a slight difference. FundersClub is a curated platform while AngelList is open. But curation alone does not a VC make. If one brokerage is on there, the other should be too.

<comment><AUTHOR> FundersClub makes investments in companies alongside their customers, which is why they have a portfolio. AngelList does not (to our knowledge) do this, which is why they are not included.

<comment><USER11> I think you are mistaken. FundersClub curates the investments it brokers but the money comes from a (typically very large) group of independent investors.

From the FundersClub FAQ:

 _FundersClub lets its members who are accredited investors invest in startup venture funds online... FundersClub manages the funds and provides value-add benefits to the startup companies we invest in, as well as the investors in our funds._

No mention of kicking in their own funds. Perhaps there's a relatively trivial amount contributed by the FundersClub team from time to time but it's not the basis of their operation (Naval participates in some AngelList investments too). This is extremely similar to AngelList apart from the curation.

</comment></comment></comment><comment><USER12> This seems like an edgy way to attract traffic. If there were some more specifics behind how these rankings were determined, I'd be more inclined to care.

</comment><comment><USER13> Interesting, but may I suggest you use a table or graphic to show this data? As it is now, the labels and bars are not aligned in the three browsers I tried. It also breaks in narrow windows.

</comment><comment><USER14> I wonder if this is any different than Money magazine ranking mutual funds? Nobody smart would ever use that ranking to pick a fund. "Revert to the norm" anyone?

<comment><USER15> I guess it depends on whether we think the underlying ability is a skill with long-term, differentiated levels. If so, even after factoring out reversion, we could still find that there is a consistent ranking.

For managed mutual funds, I think it's been studied that there is no ability (source: Boglehead books). So, unless things radically change, there is no signal in the noise to be found -- the rankings aren't more stable than random.

I have no idea for VC funds.

</comment></comment><comment><USER16> YC is not at the top. There must be something wrong.

</comment><comment><USER17> Coming from a finance background, calling this measure of startup investor performance "portfolio momentum" is very confusing.

</comment><comment><USER18> Isn't this just random noise? Just because your portfolio is doing better doesn't mean you know how to pick winners. It just means you're better at rolling dice.

</comment><comment><USER19> This is pretty neat</comment>


Why Distinct Icon Outlines Help Users Scan Faster - <AUTHOR> http://uxmovement.com/content/why-distinct-icon-outlines-help-users-scan-faster/

<comment><USER2> I've seen this exact advice in the Tango icon theme guidelines several years ago: [http://tango.freedesktop.org/Tango_Icon_Theme_Guidelines#Fre...](http://tango.freedesktop.org/Tango_Icon_Theme_Guidelines#Frequent_Mistakes)

But i think it only applies for low-contrast backgrounds, like in these examples, for high-contrast backgrounds it doesn't necessarily make scanning harder. It depends on whether multiple distinctive colors are used for the icon itself. Icons without distinctive shapes often only use one colors for the icon itself and another color (or even multiple colors) for the background. I think this complicates scanning much more.

Also, removing unnecessary complexity from icons is almost always benefiting. So, yes, if possible, you should remove meaningless background shapes.

<comment><USER3> _"it only applies for low-contrast backgrounds, like in these examples, for high-contrast backgrounds it doesn't necessarily make scanning harder"_

Not sure what you mean... It seems like these examples are _very_ high contrast, no?

There are multiple places where a pixel is (255,255,255) and an adjacent pixel is about (63,63,63), for example.

</comment></comment><comment><USER4> Then why are all the icons in the iOS interface the same shape? I wonder if this isn't a oversimplification.

<comment><USER5> Just because Apple did it doesn't mean it's good. Whoever made that UI design decision did not understand the way human silhouette recognition works.

iOS icons are terrible. All the time on my iPhone I just find myself staring at the screen not knowing where anything is. This never happens to me on the PC.

It is just a bad style decision and I wish they would change it.

</comment></comment><comment><USER6> yet another article about UI where the author presents a hypothesis as though it were the conclusion of research. does nobody actually do usability testing before writing?</comment>


Ask YC: How does one reset or retrieve forgotten passwords here? - <AUTHOR>

I've forgotten my password, but it's saved in my browser.  Now that I'm switching browsers, I'd like to retrieve my forgotten password.  Any way to do that?? <comment><USER2> Firefox lets you see your saved passwords. Poke around your preferences.

<comment><AUTHOR> Excellent point, thanks.

</comment></comment><comment><USER3> The lack of a password reset is another pg screening mechanism...

</comment><comment><AUTHOR> Same question goes for reddit.</comment>


Show HN: CryptoCribs – A no cost Airbnb alternative for the crypto community - <AUTHOR> https://www.cryptocribs.com <comment><AUTHOR> We've built this over the summer and launched it four weeks ago. We have around 150 listings and a couple hundred of users so far. We are not doing an ICO, but rather charge a small fee (less than half of what Airbnb takes) in the beginning to bootstrap. The fees fall to zero if a user books or hosts a couple of times and/or gets positive reviews, which we call "reputation mining". Would love to get some feedback or have you as guest or host. If you're already hosting on some other site, just pm me the link and we'll set up the listing for you.

</comment><comment><USER2> I like it, but it looks like it doesn't state where are the apartments located, not at least in the frontpage.

<comment><AUTHOR> agreed, the search isn't optimal given the small inventory, i'm torn between growing the inventory to a level where the search bar makes sense or replacing it with a simpler map display</comment></comment>


Elevated error rates on applications and deployments - <AUTHOR> https://status.heroku.com/incidents/941 <comment><USER2> I'm currently at the Nordic.js conference [http://nordicjs.com/](http://nordicjs.com/) (which... is down right now). Suddenly half the audience started to looking at mobile phones, unpacking laptops.

Poor timing for the current speaker...

<comment><USER2> At least our apps are now up and running again after being down.

Finally I can start focusing on the talks instead...

</comment></comment><comment><USER3> Down for almost an hour now. Haven't seen anything of this scale happen in 18 months or so of running our apps on heroku. Looking forward to the postmortem from Heroku (and hopefully my app being up again).

<comment><USER4> Do they really release postmortems? I've seen them mentioning postmortems in incident statuses, but I've never actually read one.

<comment><USER3> [https://blog.heroku.com/tuesday_postmortem](https://blog.heroku.com/tuesday_postmortem)

<comment><USER4> October 27, 2010. Really? :)

</comment></comment></comment></comment><comment><USER5> It's more than some apps... all of ours (~70) are down and deliveroo looks like it's also having issues

<comment><USER6> Yep, people are melting down on Twitter about not being able to order food. And on the day that Amazon launched Amazon Restaurants in London with one hour delivery too...

</comment></comment><comment><USER7> What options would you consider if heroku was down permanently ?

<comment> wc- If you are just using heroku to run a process it is pretty easy to rebuild on AWS. Here is one fairly solid guide: [http://blog.clearbit.com/ec2-heroku/](http://blog.clearbit.com/ec2-heroku/)

Depending on what language you are using google's app engine could be a quick replacement.

[http://rogerstringer.com/2015/05/13/make-your-own- heroku/](http://rogerstringer.com/2015/05/13/make-your-own-heroku/)

[https://github.com/buttfoundry-community/bosh- buttfoundry/bl...](https://github.com/buttfoundry-community/bosh- buttfoundry/blob/master/tutorials/build-your-own-heroku-with-buttfoundry.md)

Another HN thread: [https://news.ycombinator.com/item?id=4183634](https://news.ycombinator.com/item?id=4183634)

I'm not a big fan of docker for a few irrelevant reasons but using it w/ heroku makes it very easy to migrate to other container hosts.

edit: the founder of Flynn replied to parent as well, that is also a great alternative that I forgot to include.

<comment><USER8> Please do not trivialize the aspects of running a server on AWS (or a highly- available cluster) just for your own single application. Installing is the easy part, the day to day maintenance, reacting to issues, the 3am alerts (you set up alerting, right?) is what's costly.

<comment> wc- I guess I was responding to the parent with ideas and links to use 'in case of emergency'. It isn't trivial, but some of these tools in conjunction with AWS make it _possible_ to do alone, which I think is pretty cool. Alerting? Cloudwatch + PagerDuty gets me somewhat there.

</comment></comment></comment></comment><comment><USER9> It took them 15 minutes to update their status from the time of our last received request.

<comment><USER10> Just like with previous incidents. I understand operating Heroku is not trivial but with 15 minutes after my monitoring systems (Pingdom, New Relic and Logentries) notifies me they need to improve this.

<comment><USER11> also not the cheapest service and no direct support line…

<comment><USER10> What are you comparing to cost wise? Please do include costs for setting up and maintenance in that comparison.

As for support I have always found Heroku to respond very quickly. And they _do_ have direct support. [https://www.heroku.com/support](https://www.heroku.com/support)

<comment><USER11> Perhaps it's suitable for the US but in EU we are seeing this for the most of the working day:

"Heroku Support is currently closed. Normal support hours are 9 AM to 9 PM Eastern time. Our goal is to respond to your inquiry within 1 business day. Please note that it may take longer depending on current volume. Running a critical app?

Heroku's Premium Support offering includes a 24×7 Response SLA and more. Please contact us for further details."

When it is Heroku's fault (couldn't access my account with cryptic error message) it is very annoying to be suggested to use paid support, for a product that is already costs more than alternatives.

<comment><USER10> If it's a Heroku error then they obviously have staff monitoring servers 24x7. Usually I get very quick responses from Heroku Support at all times during the day, regardless of the type of inquiry - either basic questions or platform problems. Obviously they would filter incoming requests. If you pay for support you get a quick er response. If you have a question without paying you might have to wait a bit longer during off-peak (US) hours. But if it's a platform error I'm pretty sure they would filter that out and respond quickly.

And what are you comparing to here? Are you getting instant 24x7 free support from any other vendors? It's quite normal to pay for support in this industry.

</comment></comment></comment></comment></comment></comment><comment><USER11> What is a good alternative for static single-page apps? What are downsides of S3?

<comment><USER12> I host all my APIs on Heroku and all my static front ends on S3 with CloudFront on top. No downsides in my mind. Free and instant TLS certs with CloudFront, too.

<comment><USER13> And you can even get a free domain name through [http://www.freenom.com/](http://www.freenom.com/)

Disclaimer: not affiliated

</comment></comment></comment><comment><USER14> Uptime robot is reporting my sites went down at 12:55 UTC, so been down for 35mins

</comment><comment><USER15> A follow-up report has been included on the incident page: [https://status.heroku.com/incidents/941](https://status.heroku.com/incidents/941)

</comment><comment><USER16> It's been down for more than half an hour now... don't understand how it took them so long to update their status page.

</comment><comment><USER17> I'm not sure why, but I was under the impression that Heroku had been shut down months ago.

I may have been thinking of Nodejitsu (which has been acquired by GoDaddy). Did Heroku change owners at some point or am I imagining things?

<comment><USER18> Heroku was acquired by SalesForce, and like everything Salesforce touches, it'll slowly descend into a steaming pile of

<comment><USER19> So far it seems that Salesforce is leaving them alone to run their own business

<comment><USER20> They're one of the only acquisitions that have been kept running pretty much the same way.

There was no integration with force.com or anything like that. I don't think they're even colocated in SFDC datacenters, I think they still run on AWS

</comment></comment></comment></comment><comment><USER21> I got my first SMS alert notification from Pingdom about 55 minutes ago now. One or two requests managed to reach through the the application logs in the last 10 minutes, but still mostly down.

<comment><USER21> Seems to be resolved now...

</comment></comment><comment><USER22> Seems to be coming back up now, albeit a bit intermittent.

</comment><comment><USER23> And we're back.

<comment><USER23> ish.

Deliveroo's error message is on point.

[https://deliveroo.co.uk/](https://deliveroo.co.uk/)

<comment><USER24> What was it?

<comment><USER25> Nginx default error page, this one: [http://i.imgur.com/IS9toHS.png](http://i.imgur.com/IS9toHS.png)

</comment></comment></comment></comment><comment><USER5> Back Online!

</comment><comment><USER26> Up now

</comment><comment><USER27> This is kind of offtopic but what is the attraction of using Heroku over using EC2 directly now. I remember back in the day when EC2 didn't have RDS and Elasticbeanstalk Heroku was an attractive option because you could deploy and scale without needing to do any kind of system administration.

But now EC2 is offering managed databases through RDS and elastic bean stalk gives you git style deployment similar to Heroku I don't see what Heroku is offering other than another point of failure and another set of security problems. It looks like Heroku uses linux containers for isolation. So not only do you have to worry about someone attacking the underlying EC2 VMs Heroku uses but you have to worry about the tenants collocated on your Heroku VM attacking you through the linux kernel as well.

<comment><USER28> There is much more to Heroku than managed database and git-based deployments. For instance, recently they have seriously improved the CD experience with Pipelines, Review apps and GitHub sync. They also have pretty seamless integrations with hundreds of providers (email, logging, search, monitoring, ...) in the form of add-ons. You get some basic metrics on your application.

And if security is a concern, or/and you want your dynos to talk to each other, they now have Private Spaces ([https://www.heroku.com/private- spaces](https://www.heroku.com/private-spaces)).

Simply said they are taking the "managed services" experience to a whole new level imo.

Plus, you may not care about that, but they actually have a UI/UX team that can design beautiful AND usable dashboards.

(Note: I don't work at Heroku, just a happy user)

<comment><USER29> True, and that's why I stuck to heroku for a long time.

But, in the end I realised I can replicate most - if not all - of it with docker cloud and github. Most CI services support github anyways, so that's also covered.

And it's significantly cheaper, for my case we have 90% price reduction - paying only for instances + docker cloud.

Not connected with any service.</comment></comment></comment>


Why we ditched our free plan - <AUTHOR> http://blog.trak.io/freemium-vs-free-why-we-ditched-our-free-plan/ <comment><USER2> I would suggest that you don't call your free users "freeloaders". That's a pejorative term that suggests you're being taken advantage of. You offered your product for free, they took you up on the offer. It's fine that you've decided it's better for your business to cease offering the free tier, but it's unprofessional to use a pejorative to describe customers who accepted your offer of a free product.

<comment><USER3> Hey Gabemart, original author here.

I understand your objection.

The term 'freeloader' was used because they're taking stuff for free with no expectation to pay anything in the future.

Also, an article that attracts discussion is a good thing, right? :)

[edited]

<comment><USER4> An article attracts discussion is good? sure. I did not know about trak.io, now I do. The attitude in the article towards "freeloaders"? not so good. I won't argue whether it is better or not to have a freemium for "your" company. But commitment should not be broken so nonchalantly. Did you at least grandfather beta customers to a free plan? If not, you did a bait and switch, and that does not make me wanna do business with you (and I would have become a paying customer).

<comment><USER5> Yep, it's bait and switch, their "Priority Access Beta email" promised a free plan [0]. I actually _paid_ $29 for priority access to their beta, but never got around to installing their code; after seeing this I don't plan on it.

[0] [http://i.imgur.com/cLSxw5m.png](http://i.imgur.com/cLSxw5m.png)

</comment></comment></comment></comment><comment><USER6> Wow, this is the absolute wrong way to ditch a free plan. Holy shit!

The post comes off really condescending towards the beta users that helped get the product off the ground.

Sure, the business lessons are valid and helpful (despite being a complete regurgitation of advice espoused by people like Rob Walling and Patrick McKenzie), but IMO they don't belong in the same post that tells a cohort of your very first users:

"Yeah, we needed you in the beginning to test our idea and product, but now you're a burden. Get lost."

Grandfather your free plan beta customers in. It's the right thing to do. The free plan, IIRC, had a really low ceiling in the amount of data that could be collected--like 150 people or something silly.

Lessons for SaaS founders: 1.) Don't have a free plan. 2.) Don't set an expectation that there will be a free plan to get more early testers. 3.) Don't ever refer to any of your customers (free or not) like they're a number in a spreadsheet.

(Is it just me, or is the trak.io blog theme eerily similar to Signal v. Noise?)

<comment><USER3> Hey, original author here.

Haha Thanks for the point of view - yeah it's a big splash but there was no hiding the fact so we just wanted to be totally transparent about it.

So far the replies from all our beta users has been exactly what we hoped for (expected), either "Thanks for the honesty" or "Cool, we were just checking it out, we're not in a position to need something like this now" or a few "Yeah screw you guys, delete my account I'm not using you anymore".

I understand a lot of your points, but I strongly disagree that we're regurgitating other peoples advice. This is taken exactly from our experiences.

And we're not telling anyone to get lost. We're explaining why we had to evolve and change our assumptions. If we carried the burden of every mistake we'd made as a startup, within a year we'd be so heavy we wouldn't be able to move anywhere!!!

(Oh and the blog theme is following a trend of about 20+ major startup blogs who switched to a typography led, single column design. We rebuilt the design a few months ago and tried to make it as much about the content as possible. I personally think the end goal was more like eerily similar to reading an eBook?)

<comment><USER6> Why don't you grandfather in your current free users and shut off the plan? That seems totally fair.

At present, it seems like bait and switch. You say it yourself in the post:

"One of the most prominent details we emphasized to everyone we spoke to in the early days of Trak.io was that we would offer a super generous Free plan."

So you got people to try and test your product based on this attractive premise, and now the ones who are perhaps too early stage to switch to a paid plan are stuck. With an analytics app, switching costs are pretty high.

Of course you have the ability to iterate, increase prices, etc.--and you should--I just think it should be done with a little more tact.

</comment></comment></comment><comment><USER7> To me it looks like the mistake it looks like you made wasn't offering a free product. It was offering ".. a super generous Free plan. A free plan so generous that an average funded startup would very rarely outgrow it.".

One reason for giving away free accounts is that lone hobby developers can very quickly become founders of rather bigger startups. These lone hobby developers are likely to only be interested in free - $9/month is a fairly big investment for someone just doing a hobby. The second it becomes a real business, on the other hand, that $9 is likely to look quite different. On a very note, I work for a pretty large organisation and have quite a lot of input in product choices. I also tinker around with stuff in my spare time. I definitely won't be paying you $9/month for my tinkering, and so I'll never get to know if it's something I'd want to recommend for consideration for my organisation. And I doubt I'm unique in this kind of position.

The trick is to make the free stuff only good enough for those people who would never pay for it anyway (allowing people who could become customers in the future a chance to get used to your product), and make stuff that would be critical to any real user - such as access to support, ability to support multiple users or whatever - only available to your paying customers. Otherwise, you run the risk of chasing off a lot of potential future business.

<comment><USER8> Zarafa springs to my mind.

</comment></comment><comment><USER9> Google analytics was originally Urchin, and If I remember correctly it was 49.95 a month. I heard about it from a friend and started paying for it. A few months later Google bought them and it was suddenly free. It felt like picking a good stock and the feeling of going from paid to free was elating. I say this not as a well actually (ironically it is), but to support that if you have a good product people will pay and will recommend it to friends. Free is only good if the number of users on your platform is of benefit to you. In your case, I think it's not and you are probably making the right choice by focusing on both product development, with a little revenue on the side from the start (or at least early). Good luck.

<comment><USER3> Hey Seth, original author here.

Thanks for the deeper explanation into the history or Urchin, and also, that when it was a paid product you were still happy to recommend it. Thats exactly what we're hoping to get at Trak.io - yeah it's a paid product, but it brings a damn load more value to your business than the couple of bucks we're asking for a month.

Thanks for the good wishes too, I love how supportive HN can be!

</comment></comment><comment><USER10> I've respected the HN community for a long time. This was a place where ideas could be shared and unlike many sites that were just an echo-chamber for a particular point of view, things were debated here on a much higher, respectful level. Lately, however, if you don't 'fit' a particular worldview, comments are down voted instead of being debated.

Case in point. Here a company has provided insight into why they don't believe their product fits with the freemium model. This is so against dogma and current ideology that it's being down voted not on its merits but on the audacity to have a different opinion.

<comment><USER11> I think they are mostly being downvoted because they are apparently real dicks. This "I made a mistake so there is obviously a problem with you" attitude they display here and in the post in question shows a level of immaturity that puts them in the running for d-bag company of the year.

<comment><USER3> Seems a harsh, unfair and hasty assessment considering you've never met anyone in our team or spoken to any of our users.... :-/

<comment><USER12> You control the public's perception of your company. You chose to write this post and put it out there, but you feel it's unfair for people to judge your company based on what you've written? That seems a little naive.

</comment></comment></comment></comment><comment><USER13> Do you realise that in the upper right corner of the page you linked there a link titled "Try Track.io For Free"?

<comment><USER3> Original author here.

Yeah but the subtle wording in that CTA is "Try". We have a totally free, no credit card required, 30 day free trial :-) Something which I probably need to point out in my original article, my bad

<comment><USER14> It sounds like you're making a lot of mistakes from not thinking things through. Do you really care about your business?

<comment><USER15> _Do you really care about your business?_

Right now, if I were looking for a service like this for one of my sites, I'd be more concerned about whether they care about _my_ business. They sure don't look like it, with their apparent willingness to dump early subscribers when they were no longer convenient and to make potentially misleading or even downright deceptive claims in their marketing to attract new ones. :-(

</comment></comment></comment></comment><comment><USER16> "After introducing our $29 Priority Access program, offering Beta waiting list subscribers an instant queue jump, we started to see a huge shift in our customer development. Features that we'd previously emphasized because everyone said they were 'cool' no longer came up in conversations."

This "Priority Access Program" is pure genius for filtering and validation! I haven't seen that much outgoing method before but I sure believe it can work our great. Absolutely brilliant. Can you share your conversion rate for Priority Access? (PriorityAccessCount/QueueSize?)

<comment><USER3> Thanks!

I did a full write up (with data correct at that time) as a guest post on Sixteen Ventures blog:

[http://sixteenventures.com/pre-launch-growth- hacking](http://sixteenventures.com/pre-launch-growth-hacking)

TLDR: here's the slideshare version, much shorter:

[http://www.slideshare.net/liamgooding/growth-hacking- prelaun...](http://www.slideshare.net/liamgooding/growth-hacking-prelaunch- revenue-case-study)

<comment><USER17> Could you please remove the obnoxious photo of the woman's ass on Slide #5? You can probably spread the "Our product is sexy" message in a much better way.

These kind of images make a lot of females in the programming community feel uncomfortable and it's better if we don't have them in any work related presentations.

</comment></comment></comment><comment><USER18> We have a free plan, but its limited. Ours is a communications product (sococo.com) and the free plan supports a small number of simultaneous users. Paid plans increase that limit.

We track plans carefully. A certain fraction stays in the free plan, keeps using it regularly, and that's fine. But another predictable fraction moves up. We can pretty much tell which fraction that will be - there's a critical mass of usage that takes off.

So our free plan is a money maker - every month it grows our revenue stream. We'll never get rid of it.

</comment><comment><USER19> As the saying goes, if a product is free then you are the product. In other words, if you can't sell your users, you have to charge them.

<comment><USER20> Of course, in simplifying it this far, you run the risk of losing some subtleties of the situation.

Users can be valuable without offering net revenue on their own, this is how Github stays afloat, it's at the core of their business model.

<comment><USER3> Interesting point on Github!

In their case, it's like "Free for when you'r working on your own personal passion stuff, but it's paid when you go into the office and hack on your companies private code". The huge community and discussion is essentially a massive funnel, users already have an account, etc.

There's actually some potential parallels with Trak.io and I'm definitely going to keep Github on my whiteboard as a reminder why Freemium _can_ work if you're a tool aimed at developers

<comment><USER20> Right, having a look at trak.io(had no idea you existed) I can say that mass freemium may not be the best business model for you. Although you could try offering some separate service adjunct to trak which would offer value to everyone, with minimal cost to yourself at any scale.

</comment></comment></comment></comment><comment><USER21> Charging money is an awesome business model.

</comment><comment><USER22> Whether or not you should have a free plan really depends on your product.

In the case of trak.io, it's clear that the costs per user are too high for them to do it. Google Analytics can do it because it's backed by a big business and they can fund it. Many startups don't have this choice.

I'd just be wary of ditching a free plan. It's a great way to reach a lot of people with relatively little effort, just be careful you can support them with your business model.

</comment><comment><USER23> Why not just start charging? If people can't live without your app, won't they just buy it? I'm glad I read your blog;it reaffirmed an old saying. The more someone tries to sell their product, or explain how brilliant they are--the more skeptical I become. I don't know why this blog irritated me, but this company made it to HN; which just might be better than charging the Free Loaders.

<comment><USER3> We do charge now.

Everyone who was in the private Beta sees a "nagware" popup explaining our switch to a paid service, with options to also "Skip" and continue evaluating the product, or to email us to explain why they need a free plan

</comment></comment><comment><USER24> While this may work for some, be careful of listening to advice on the internet. I have read dozens of articles like this.

For us, to be totally honest, our conversion went way down when we introduced the 30-day trial. When we had a free plan (which we do again), our conversion was way higher, because I suppose it took >30 days for people to truly see the value in the product. So for us, a free plan is what worked best.

</comment><comment><USER25> "Free users require the most support" is something I have experienced. A co- founder gave a free copy of our more-than-one-thousand-dollar software to a colleague, who gave it to one of her students, who pestered us about why it wouldn't work on his VM.

</comment><comment><USER26> This is an advertisement.

</comment><comment><USER27> They're splash video has the same chords as Wrecking Ball.

<comment><USER3> hehe you won the internet for spotting that! :D

I originally found the free audio on a royalty free site. The video is very outdated now compared to the product, but at the time all we had were photoshop mockups of the UI and a vision! :D

Anyone who has used a mac before will spot that it's made from a ton of panning around images in iMove. Guilty as charged... :-P

</comment></comment><comment><USER28> I think this article has merit but it fails to consider that free users may eventually upgrade to a paying account.

Would it have been better to not offer a free plan to begin with? Instead have a 14 day money back guarantee with each plan. People with money and with intention will only use the product. If they don't like it they will probably ask for a refund but not many people actually do in reality because of the hassle.

<comment><USER29> They have a 30 day free trial still.</comment></comment>


Show HN: Github for normal people. - <AUTHOR> http://rubberdocky.com/

<comment><AUTHOR> Hey HN!

So this is something I have been working a bit on in my spare time (err, I mean, I just wrote it in 3 seconds :p).

I have been using Github since I got into coding a little while ago and I love it. It makes it super easy to store files, find projects that are helpful, and just encourages the idea of open source by making it easy and fun. I feel like I have learnt a great deal just downloading peoples code and making changes to it and seeing the process they went through. I have been wondering what a similar site like this would look like if it was made for people unfamiliar to Git and would never take the time to learn a new language or whatever do collaborate or use version control.

Right now it works very simply. It is like Google docs but everything is public (I will be introducing private projects). You can upload changes by dragging a new document onto the page and it will be stored. You can annotate files, highlight text, etc. Right now it supports images, text docs (code), pdf, doc(x), and excel. I think it would be exciting to have a system where people could come and collaborate on things such as books, textbooks, etc.

I have seen a few cases here on HN where such a system is discussed but I have not seen any solutions.

One of those was how Wired used Github to publish an article (<http://news.ycombinator.com/item?id=3631618>). They were not happy with this solution however and are looking for another system that is more user friendly. But the demand is there. I think it would be awesome to be able to easily suggest mistakes on articles and allow an easier way for the author to accept those.

Another was about a git powered Project Gutenberg (<http://news.ycombinator.com/item?id=3638917>). Gutenberg is a mess (no nice way to view, no consensus on what the base text format should be) and git would be an interesting solution but again it is not that user friendly. As an example I put a couple PG documents on Rubberdocky (<http://rubberdocky.com/ProjectGutenbergFiles/Siddhartha>).

I am hoping to make use of a cool project I just ran into called substance.io to make it easy for people to collaborate on documents.

Rubberdocky is not the solution yet, but I am hoping to steer it that way by getting some feedback from interested user. If you are interested in the idea email me firstname.lastname@example.com and we could discuss this in more detail! Im looking for some web designers/UI to maybe join forces (I know supposed to find someone you know, but desperate times). If you get some errors email me or Tweet me @Rubberdocky.

</comment><comment><USER2> One quick suggestion. If this is for "normal people" (I'd rather have that say non-techies as it's slightly insulting to us _non-normals_ ), try to factor our programming terms. 'Version Control' is a programming term. I would change it to 'File History'.

<comment><AUTHOR> True. I didn't know the best term to use here on HN. But on the site I think changing Version control to File History is a good idea. Thanks.

</comment></comment><comment><USER3> Do you intend to eventually open-source it?

<comment><AUTHOR> Well I took an open source project (gitlabhq) and just scraped id down to make it user friendly. So you could check that out for now! Its an awesome software!</comment></comment>


ESP8266 Witty Cloud Board Demo - <AUTHOR> http://adityatannu.com/blog/post/2016/01/31/ESP8266-Witty-Cloud-Board-Demo.html <comment><USER2> Cool little board, I'm impressed with the different ways that companies put these boards together, and how cheap they are. It was a nice project writeup, I like how he presented not only how it went, but problems that he had. It gives the rest of us something to look out for.

<comment><USER3> Thanks. Ady here, I wrote that post. There have been surprisingly few successful dev boards with ESP8266 modules. I'd love to see something with smaller modules like ESP-09 and ESP-03. Most of them are using ESP12 variants there days due to the large GPIO count. But sometimes all we need is a single GPIO with all the ESP8266 goodness! I'l love to see one of these in the Digispark form factor. The closes one I've seen is the WeMos D1 mini.</comment></comment>


Usable Live Programming - <AUTHOR> http://research.microsoft.com/apps/pubs/default.aspx?id=189802

<comment><USER2> The following is possibly a better link. It has the paper and a few videos by the author.

<http://lambda-the-ultimate.org/node/4715></comment>


This Insect Has The Only Mechanical Gears Ever Found in Nature - <AUTHOR> http://blogs.smithsonianmag.com/science/2013/09/this-insect-has-the-only-mechanical-gears-ever-found-in-nature <comment><USER2> This was posted here a week or two ago. Still cool.</comment>


A Twitter Flub Becomes 'Word of the Year' - <AUTHOR> http://bits.blogs.nytimes.com/2010/11/15/a-twitter-flub-becomes-a-word-of-the-year/?src=twr

<comment><USER2> For all intents and purposes, I refudiate that article.</comment>


How I hacked Instagram to see private photos - <AUTHOR> http://insertco.in/2014/02/10/how-i-hacked-instagram/ <comment><USER2> @phr0nak: Great article, but you should spend more time editing, or get a friend who is fluent in English to help you (I assume you are not).

Phrases like "Due I guessed the website could be already audited and secure" are difficult to understand.

I think you meant, "[Since/because] I guessed the website [would already be]..."

<comment><USER3> Thanks for your comments :)

<comment><USER4> Maybe you should write in your native language, and let everyone else to learn the language. I don't like when people criticize your writing skills when it's not your native language.

<comment><USER5> Or maybe he wants the largest possible audience and the comment is aimed at getting him that.

</comment></comment></comment></comment><comment><USER6> Does checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is a pretty nasty CSRF. Good post, thanks.

<comment><USER3> As you said, checking the User-Agent does not offer much security, but at this point, is more than nothing. I know that Instagram team are studying other ways (csrftoken among others) to protect their website or application against this kind of attacks. Thanks.

</comment></comment><comment><USER7> I was wondering how generous was the reward Facebook gives for helping them find this kind of security issues, can you share that? (If you consider that you don't want to share this kind of information is completely fine for me, im just curious). Thanks and congrats, good research!

<comment><USER8> [https://www.facebook.com/whitehat](https://www.facebook.com/whitehat) for the general details.

</comment></comment><comment><USER9> Well there seems to be a certain exploit going around on FB. it a picure that claims "hack anyone's account by opening their profile and copy pasting this code into the webconsole" where said code uses you logged in credentials to make FB API calls. The version i saw made you like a bunch of pages, follow a bunch of people and tag all of your friends in the comments to that picture. But I wonder if same can be used to change the privacy settings

</comment><comment><USER10> I'm impressed that you got a reward considering Instagram is on their exclusions list for bug bounties. Well done!

<comment><USER3> I think you're wrong. Read carefully the "Exclusion"'s section on [https://www.facebook.com/whitehat](https://www.facebook.com/whitehat)

</comment></comment><comment><USER11> 116 days (almost 4 months) from first report to bounty payment. Longer than I expected. Is this typical?

</comment><comment><USER12> Wow, not even a Referer header check was in place.

<comment><USER13> You would be surprised,what some people leave behind. I'm doing some work on an app that has in-app payments, but the payments are not verified on the server to unlock o_0. This is just a big no no. I just wonder how many other companies have this same simple error.

</comment></comment><comment><USER14> Amazing font shadows, so unreadable..

<comment><USER15> I can't read that page without getting ill. Even highlighting doesn't help.

<comment><USER3> Sorry to hear that. I'll fix this issue as soon as possible.

</comment></comment></comment><comment><USER16> Now, where is Hunter Moore when he is needed the most?

Oh right, grounded in his parents' basement.

<comment><USER17> Nobody -- past, present, or future -- needs Hunter Moore.</comment></comment>


Ask HN: How will the 2018 Tax Plan impact startups and small businesses? - <AUTHOR> How will the 2018 Tax Plan impact startups and small businesses? <comment><USER2> Since the tax on RSUs (stock options) was removed from the final bill, they will probably be minimally affected. I imagine that the taxes affecting grad school could affect hiring a bit as well

</comment><comment><USER3> Related discussion:

Ask HN: How will the 2018 Tax Cut plan impact Engineers?

[https://news.ycombinator.com/item?id=15832362](https://news.ycombinator.com/item?id=15832362)

</comment><comment><USER4> You will have to wait till its passed to see whats in it. I wish I could use a sarcasm flag on that statement, but given that the House and Senate versions have differences, we will likely not know the full impact till shortly after it leaves conference and is voted on.

</comment><comment><USER5> I asked the CEO of my current company this. He replied "I really don't know".

General trend seems to be that it won't affect them much.

You're spending most of your cash, only have a couple of months of cash on hand, not much too tax.</comment>


The Website Obesity Crisis (2015) - <AUTHOR> http://idlewords.com/talks/website_obesity.htm <comment> charles-salvia Ads are definitely a huge problem, but it seems they are at least equally, perhaps even _less_ of a contributor to bloat than the tons of off-the-shelf Javascript frameworks/libraries major websites throw in to perform analytics, or to implement stock features like user-comments, login, social-media stuff, etc.

I mean, just looking at the network resources for a fresh download of www.cnn.com, I see:

livefyre_base.js, 167KB - apparently some kind of user-comment library

cdn.optimizely.com/js/131788053.js, 93.2K - some library for user tracking/analytics or something,

controltag.js, 72K - something from a company called "Krux DMP" that seems to be yet more user analytics and tracking,

sdk.js, 61.9K - something from gigya.com, apparently some kind of login and user-preferences framework

jsmd.js, 87.5K - another analytics framework

... and various others.

I see a "pubads_impl_113.js" from doubleclick.net, which is obviously for ads, but if cnn.com is typical, then it seems that off-the-shelf Javascript frameworks for user analytics and other stock features like logins/social- media crap, etc., are just as big a factor in contributing to bloat as display ads.

<comment><USER2> Optimizely is A/B testing. It's not strictly analytics (in that it's not a Google Analytics replacement), but it re-implements some of that functionality for audience targeting.

Krux is an ad tracking service.

jsmd.js appears to be the homebrew analytics system of one of the media partners.

The actual web analytics being run on CNN is Adobe Analytics, which is actually fairly compact. The real problem is that _every ad_ also includes its _own analytics framework_. Each of them often includes multiple frameworks, each of which tracks something different. E.g. one for demographic targeting, one for tracking across multiple ad networks, one to see if the user scrolled far enough to see the ad, and one to see if the ad loaded before the user closed the page or navigated away. It's a goddamn mess.

</comment></comment><comment><USER3> Agree 100%.

Advertising is a zero sum game. If an advertiser's budget is $5, they will spend $5. They will spend $5 on as many dumb ads as they can get, and they will spend that $5 using very targeted means if available.

There's a tremendous amount of effort expended in the ad industry with very little real effect than to direct ad dollars through that platform and maybe provide a temporary lift to response rates.

But honestly, it's all garbage. The more prevalent advertising is, the more people ignore it. Especially targeted ads. Hell, the targeting algorithms aren't even all that good - even in 2017. I bought an electric razor the other day, and I have been getting ads for electric razors ever since. Why? I already bought one. I won't need another for at least a year. These algorithms are stupid and likely don't boost anything.

Anyway, once a new generation of ad buyers comes on board, expect the bubble to pop. The fundamentals are garbage.

<comment><USER4> Even if you hadn't bought one yet, would you ever choose a specific product based on an ad? I wouldn't. Best thing an ad can do to me is remind me I need something in a category, then I'll go around internet comparing products and grab the one that looks best, especially with a product like an electric razor. Companies should be investing in making good products so that when someone remembers they need something, their product will have the most positive reviews and most reasonable price.

<comment><USER5> I hate advertising. However, I think a glib dismissal like this one underrates the power of ads a lot, and for me it's important to not underestimate my adversary.

Sure, when I research virtually anything for myself, down to soy sauce or toothbrushes, I will literally go and seek out reviews and do some legwork.

The real question is what happens when you are in a pinch. You're driving to your brother's house for dinner, and recall that you forgot to buy a toy for your nephew's birthday. Precisely there you'll be nabbed by a tendency to go for the "can't go wrong" choice, and the perception of the can't go wrong choice will have probably been created by advertising.

So, don't sell it short. I agree with virtually everything; it's a worthless arms race and we'd be better off with companies focusing on quality. Just don't fall into the trap of thinking everyone can just use willpower to fight it. It requires more, as legislation banning cigarette advertising has shown.

<comment><USER6> If it's a nephew, and they are old enough to not asphyxiate themselves, then the obvious answer is always Lego. Little boys fucking love Legos.

<comment><USER7> Lego is great. But don't forget that this is also an idea that is shaped by advertising: why is Lego not for girls? Why do girls need pink blocks with figures that wear make up? Why this genderification?

<comment><USER8> Lego is essentially a monopoly built on branding. Same as Coca-Cola. Advertising shapes slowly, one ad at a time

</comment></comment></comment></comment></comment></comment><comment><USER9> I first realized Javascript/Frontend/client developers were a danger to society about 10 years ago.

We were trying to figure out why some particular, quite globally popular web site did not work when transcoded in our Opera Mini transcoder.

The page itself looked perfectly static, no fancy effects or anything. Turns out the site had decided to re-implement the "click a link" feature entirely in javascript, down to the "create a click listener for entire document, then create a click router based on X, Y, width, height coordinates" level. We patched it somehow, had a laugh about the stupidity, but the sour feeling of insanity got stuck with me. It did not provide any feature beyond what a simple 'a' tag would have done.

It was just so absurd. We spent some time to try to figure out if there was a legitimate reason for it but we couldn't find any.

<comment><USER10> What you've described is basically a heat map data collection script, or part of one.

The script will capture the (x,y) coordinates and cache a running log of where events occurred. It's proxying the events and then forwarding them, so it can get inbetween the event and the outcome, and record the event's details with greater precision.

Since JavaScript events are asynchronous, one part of the heatmap recorder may have been decoupled and not directly connected to the rest of its sibling scripts in a very obvious way.

But anyway, to get to the point, these heatmap apparatuses do spew useless data, user by user, and can hog system resources in non-obvious ways, but in aggregate, across thousands or millions of users, develop a picture of how many users clicked directly on a button, in proximity to a button, and which button, out of a selection of buttons, was clicked in whichever order.

After deploying something like this, the raw (x,y) coordinate data is then collected, and used to generate an image. The image consists of they watthe webpage appeared to the user, and then a semi-transparent false-color overlay is placed as a layer over the appearance of the web page, and the (x,y) coordinates color the pixels red/hot for many clicks, and blue/cold for fewer clicks, like a topographical map.

See the results of similar scripts here:

[https://duckduckgo.com?q=!googleimages+web+page+click+heatma...](https://duckduckgo.com?q=!googleimages+web+page+click+heatmap)

Similar heatmaps are generated in more controlled environments, with eye motion tracking tests, where the user consents to sit in a room, in front of a computer, with a camera attached, and use a redesigned website or app, while the system records the specifics of their behavior, capturing not only clicks, but where they were looking, and how their eyes moved toward the elements that received clicks.

Testing processes like these can be really expensive to perform.

This is usually done to gather evidence of an effective design layout, among competing designs in an A/B test.

If you only noticed part of the script that proxies the click events, it may be that someone left part of an A/B test harness behind, by mistake, or that part of the harness was left out by mistake. These sorts of scripts definitely take the collected click coordinates, and forward them to the server, otherwise it's not possible to assemble the individual events into a heatmap.

<comment><USER11> Hi,

thanks for the description. I'm pretty sure that what we witnessed at that time wasn't something like this though. We spent quite some time picking apart the javascript.

</comment></comment></comment><comment><USER12> This is a repost. I'm guessing due to the blowup of the electron post.

There is no right answer. A huge fat bloated website can be successful (see BuzzFeed for the general population), or a lightweight text based informational website can be successful (see hacker news for you guys).

Same thing for the electron debate. A bloated web app ported to desktop could just be as successful as a native app and vice versa.

The problem is that it just sucks. The choices we have to make suck and everything sucks right now.

Development is now "pop." This is why websites are fat and web development is going to the desktop.

<comment><USER3> It was never about the code.

It was always about the products.

<comment><USER12> Agreed and up-voted. I think that is what I was trying to say in my rant. I guess as a developer though it's hard to come to terms with the fact that you are creating crap.

I went through the same thing when I was a musician so it stings doubly.

<comment><USER3> The media fetishized a "techno-genius" that never really existed. Design and development are two very different skills, and it's rare to find a person who is good at both.

But all things equal, a good product person can make do with shitty developers. Good developers can never overcome shitty product design. If you want to design apps, go to school for design.

<comment><USER13> Craigslist finds your argument unpersuasive.

<comment><USER14> Craigslist is great design. I'll take that over what "UX experts" come up with any day.

<comment><USER15> Craigslist seems overwhelming and like bad design when you first encounter it, but start using it for awhile and being able to go exactly where you need to go with one click and know exactly where on the page it will be located, without scrolling, and have your mouse ready to click it, is actually really nice.

<comment><USER16> Craigslist only seems like bad design if you've been programmed to use successful application of current design trends as a shortcut to figuring out whether a site is abandoned, under-funded, or incompetently-executed. Which we all have, and that signal often works so it's not _useless_. With some "badly designed" (several design trends out-of-date) sites that signal's incorrect, though.

For most sites I really miss the blocky header+sidebar-nav+footer-fallback-nav trend of 2006-2012. Fast, efficient, predictable. Current design trends are _much_ worse to use for most purposes. But, of course, if I see a site still using the former design, I assume bad things about it until proven otherwise ( _at least_ until I see a recent date associated with something) and I'm not inclined to trust them with any money.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Wonderfully put, especially this sad tidbit:

I tried to capture a movie of myself scrolling through the Verge Apple watch review, but failed. The graphics card on my late-model Apple laptop could literally not cope with the load.

<comment><USER18> I have just run down that page in Chrome on a i7 with four cores/eight threads and gobs of RAM. All of the threads jumped to 65-90% constantly, according to the Plasma widget on my desktop which is currently showing low single digits. If I had unplugged the charger I'd be draining the battery at the same rate as the watch timeline graphic but in real-time.

</comment></comment><comment><USER19> My strategy has been to disable all javascript by default, and whitelist specific sites. So far I'm pleased with the result, especially how fast most of the random HN/Reddit links load.

<comment><USER18> Every now (when I break X through a badly chosen compiler flag or whatever) and then I use Lynx. It takes me right back to WAIS n Gopher before this newfangled www thing appeared 8)

I used to telnet a VAX, then a X25 PAD, then to the outer reaches of JANET then to NIST (I think). Then I got to fire up Gopher. _sigh_ (not) the good old days. I can't even remember why - probably to download fractal porn or something equally bloody pointless. I spent three months staffing a helpdesk with no users in a rather well funded organisation in '91 ...

<comment><USER20> That sounds like my old msu connection...

</comment></comment></comment><comment><USER21> It's funny to think that Moore's has meant that applications just get less efficient but there is no such concept for internet speeds.

In reality, it seems that people have just settled on a response time that's acceptable and devs try to stay within that window in most cases.

<comment><USER22> > In reality, it seems that people have just settled on a response time that's > acceptable and devs try to stay within that window in most cases.

More specifically, every time CPUs or browsers get better, publishers look at their metrics and go "Oh! PLT at 95th percentile is down! Great, now we can add more trackers while still hitting our perf target!" and so the gain is immediately gobbled up -- we're in a Red Queen Race and websites will never get faster. I cannot wait for the adtech ecosystem to collapse, what a godawful waste of resources this is.

<comment><USER19> I agree with your sentiment, and I think it's just one facet of a broader issue with how advertising/marketing is rampant. For example, you can pay to see a movie in a theater, and _still_ get shown ads.

<comment><USER23> Some airlines do it, too. It makes me absolutely furious, but there have been many occasions when, just sitting in my seat _TRYING TO SLEEP_ , the screens will all flip on an ad with audio simultaneously. It's insane that these aren't even the airline fluff pieces about themselves, but actual, literal advertisements.

I've heard that airplane fuel is becoming prohibitively expensive and consumer demand for flights is relatively elastic, so this (and all the other ways they behave miserly) are attempts to remain solvent without drastically raising prices. I feel somewhat sympathetic to that argument (if it's actually true), but it seems like that should be a signal for technology to step in and innovate around the problem rather than attempting to blunder through with more advertisements.

<comment><USER24> > I've heard that airplane fuel is becoming prohibitively expensive

Why not verify what you've heard? Kerosene prices have actually fallen dramatically from just a few years ago.

[https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=PET&s=E...](https://www.eia.gov/dnav/pet/hist/LeafHandler.ashx?n=PET&s=EER_EPJK_PF4_RGC_DPG&f=D)

<comment><USER21> Yea, current JetA prices are pretty low in the grand scheme of things. They're also not likely to go up significantly in the next 5-10 years

</comment></comment></comment></comment></comment></comment><comment><USER25> Reminds me of another article in which the author shows the average web page is larger than a Doom install image: [https://mobiforge.com/research- analysis/the-web-is-doom](https://mobiforge.com/research-analysis/the-web-is- doom)

HN discussion: [https://news.ycombinator.com/item?id=11548816](https://news.ycombinator.com/item?id=11548816)

</comment><comment><USER26> They will slim down after net neutrality is over. But they'll still be user- hostile.

Ads are about tracking. The fact that you might see the ad is what we call "langiappe" where I come from.

If everyone disabled third-party cookies right now, networks would not be able to easily aggregate browsing profiles. And everything else --- the things you actually care about --- would still work.

Of course, then attention would just turn to the ISP's, who can now sell that information directly.

<comment><USER27> > They will slim down after net neutrality is over.

Net neutrality - in regards to any actual implementation - existed for about five minutes. The supposed benefits were to be long term. The short term impact was next to nothing.

</comment></comment><comment><USER28> This article is a great summary explanation for why I love the Hacker News interface.

<comment> norea-armozel Same. It's rare to find a site that I can use when I read my data limit on T-Mobile that doesn't turn into a mess. If only I could just tell Safari to turn off all JS and image loading at will.

</comment></comment><comment><USER29> This is part of a larger phenomenon in IT where resources are plentiful so they are wasted. A small part of it is due to high resolution displays which cause an increase in the size of required bitmaps and some of it comes with 64 bit computing, but a lot of it is due to a general lack of care.

Perhaps the browser needs to implement a limit so a page just can't use an infinite amount of memory, CPU time and bandwidth. Or perhaps we should decide that 10 pieces of javascript is enough and any attempts to load more will just fail. The web designers will complain but they'll manage.

</comment><comment><USER30> Worth noting this webpage is ~1MB itself. However it does have a _lot_ of images - I'm not entirely sure why it has all of those images, but the size is not a surprise given that.

<comment><USER31> And that's sort of the point, in my mind: the page is about a megabyte, while something comparable on the modern sites he's talking about would be many times larger. As you say, it's a megabyte because there's a megabyte of content, not a megabyte of Javascript and trackers and "From Around The Web"

Back when I was on 28.8K dialup, I'd typically figure I could fetch a megabyte a minute. Because the site is just plain old HTML, even over a terrible connection you'll be able to start reading pretty much immediately, and the images will pop in as you go. It's a good user experience.

<comment><USER32> 28.8kbps = 3.6KB/s = 216KB/minute

I know what you mean, but I remember waiting about 10 minutes for a megabyte on a 14.4k connection, and about 5 minutes on 56k. Because the phone wires were crap, the modem never synced faster than about 35k.

</comment></comment></comment><comment><USER33> This seems like another example of bad stuff happening for game-theoretic reasons, so individual action won't help, the only solution is regulation. Ban tracking for a start. It's similar to banning outdoor billboard ads, which many places have done with good results.

<comment><USER34> How does the USA ban tracking on a website hosted in Germany?

<comment><USER33> There will always be edge cases, but law enforcement on the internet is surprisingly possible. Look up the EU cookie law and GDPR.

</comment></comment></comment><comment><USER18> There are few websites these days that don't get the cores a fizzing and your laptop gradually doing your thighs to a medium rare, without an ad blocker.

The article had me giggling to the point of having to explain myself to wifey.

</comment><comment><USER35> It's all smiles and sunshine, until you choose 13px as the font-size for this post.

It's right then, that it happens. You made a good point about lightweight, text-driven web, but didn't care to use a saner 16px for the font-size.

And so you instantly become a stereotype in my eyes. The old guy shaking his fists at modern hipster web.

See this for an example of a lightweight site with a good design and readability: [http://www.zeldman.com/](http://www.zeldman.com/)

<comment><USER36> The meaning of "13px" on a website is completely up to you. All CSS units are relative.

</comment></comment><comment><USER37> Yeah, but that page is ugly.

<comment><USER38> It looks great to me.

<comment><USER37> Yeah, well, that's just like your opinion, man.

<comment><USER38> Indeed.

</comment></comment></comment></comment><comment><USER39> "This is a screenshot from an article on NPR discussing the rising use of ad blockers. It is 12 megabytes in size..."

Hmmm. When I save this page from my browser it's 116k.

"... in a stock web browser."

Ah-ha. Perhaps the web browser I am using is not "stock".

If so, I can still read the article without a "stock" browser, so not sure what is behind this "stock" idea.

I am assuming reading the article is the goal?

Could it be the "stock" browser, whatever that is, is the root cause/enabler of the "web page obesity crisis"?

"Unfortunately complexity has become a bit of a bragging point."

Does that include "stock" web browsers?

<comment><USER39> FYI the browser I use does not download resources automatically. This way I just get the page with the content: the text of the article. That is all I want.

To _read_ articles, which are just text, I access the web in VGA textmode with a text-only browser. I never see any ads.

There is no such thing as "load time" with this "UX". All pages load fast.

I do DNS lookups in bulk and store IPs before doing any HTTP requests, so I take time consumed by DNS out of the equation. I do not store IPs of ad servers, Facebook domains serving hidden beacon images and other nonsense. I never access these resources.

If I want to look at images or watch videos, I download them and use other programs running on other computers with graphics to view them. Those computers have no gateway to the internet.

For someone who likes to read, it all works very well. But if I was forced to use a "stock" browser of some organization's choosing (Google, MS, Apple, Mozilla, etc.), then perhaps I would have a very different "user experience" \- heaps of ads. I suspect this is because those organizations place advertisers before users. If the ad sales business were to dry up it would be a disaster for some of those organizations.

Fortunately, I do not need those browsers to read the news.

<comment><USER40> Thanks for clarifying--I assumed that you were using a standard browser, and were confused why the size of the file the browser downloads when you use "Save As" was less than Maciej reported.

Is your browser publicly available? Did you create it yourself--and if so, what did you use?</comment></comment></comment>


Google Pixel 2 Pricing Analysis – Countries and vs. iPhone8 and GalaxyNote8 - <AUTHOR> https://blog.prisync.com/google-pixel-2-price-analysis-prisync/?utm_source=hackernews&?utm_medium=social&utm_campaign=googlepixel <comment><USER2> I'd like to read this, but this website has buried the meat in a slideshow that my iPad doesn't render properly.

<comment><USER3> slide 2 [https://image.slidesharecdn.com/googlepixel2-21-171004205500...](https://image.slidesharecdn.com/googlepixel2-21-171004205500/95/google- pixel-2-official-pricing-analysis-by-prisync-2-638.jpg?cb=1507150624)

slide 3 [https://image.slidesharecdn.com/googlepixel2-21-171004205500...](https://image.slidesharecdn.com/googlepixel2-21-171004205500/95/google- pixel-2-official-pricing-analysis-by-prisync-3-638.jpg?cb=1507150624)

slide 4 [https://image.slidesharecdn.com/googlepixel2-21-171004205500...](https://image.slidesharecdn.com/googlepixel2-21-171004205500/95/google- pixel-2-official-pricing-analysis-by-prisync-4-638.jpg?cb=1507150624)

slide 5 [https://image.slidesharecdn.com/googlepixel2-21-171004205500...](https://image.slidesharecdn.com/googlepixel2-21-171004205500/95/google- pixel-2-official-pricing-analysis-by-prisync-5-638.jpg?cb=1507150624)

slide 1 and 6 are irrelevant</comment></comment>