Yeah, but he really knows his stuff... - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2009/03/yeah-but-he-really-knows-his-stuff.html

<comment><USER2> This is yet another post about stereotypical employees/coworkers. I don't like to think of people as hollow stereotypes that someone online can precisely nail down so as to dispense wisdom on dealing with them. Yes, I've worked with lots of people who sort of resemble the stereotypes and I'm sure all of you have, hence the popularity of such posts.

However, I urge everyone to please remember that stereotypes are templates and nobody fits the stereotype exactly. Everyone has something special about them that is worth considering. Just imagine if you do have a "mr. know-it-all" at your work who gets a bit frustrated when you ask him to do important but "boring" things like documentation or protocol compliance. Advice like this will suddenly put this person in your view as negative, despite the fact that "mr. know-it-all" is a very hardworking employee who is extremely loyal to your company. Nobody is perfect and thanks to this new stereotype that you just read about, you cannot help but compare him to the guy that "one everyone has to tiptoe around." Oh how you hate that stereotype and look, this "mr know-it-all" totally fits the description!

You could solve your documentation problem in some other way but once you fire this guy, you got two problems - you don't have a loyal, hardworking, "mr. know-it-all" anymore and you don't have the documentation on what he did and how he did it I'm no managerial-guru but I sure hope nobody starts firing their top tech people because of random posts on the Internet.

Of course, the hypocrisy here among most of us is that when a large company does fire key tech people from their staff, we all come in rallying for support of the tech folks, arguing "how can a company survive if they fire their lead tech!" Well, companies can survive. And yours could too despite the fact that you fired your key tech person as long as you have a good infrastructure in place. However, that doesn't mean your competition won't welcome them with open arms and now you got a third problem.

<comment><USER3> Exactly. The fun is in dealing with reality, not stereotypes. Life would be so much simpler (and boring) if everyone fit nicely in a little box.

At least in startup mode, where you obsess daily, hourly and minutely (?) about everything: should I fire John? Is John the best producer I ever had? But John just did something amazing yesterday, he saved the day. John is being a pain today. Had lunch with John, what a great guy.

You have to constantly look at the trees, look at the forest, and make choices. Tactical and strategic.

It's the same as parenting by the way. It's easy to read a book and see that by age 2, you should treat you kid in such and such fashion. Great, high-level advice. Except you interact with your kid constantly. When you're in a good mood and when you are not. We are back to tactical and strategy.

Bottom line: hire engineers who have great kids :-)

</comment></comment><comment><USER4> While I have nothing against the idea of "resolving" jerks/bullies, I think suggesting that deep technical skills and being an unproductive jerk are concomitant is insulting, and dangerously wrong.

Fortunately, this suggestion is made by a marketing guy, and everyone knows they're full of hot air.

<comment><USER5> But he doesn't suggest that:

"You'll find someone else who really knows this stuff. No doubt about it. And firing one intransigent bully is a lot less painful than shutting down an entire division next year because he paralyzed your decision-making."

<comment><USER6> Seth states that "Deep technical competency is overrated compared with the ability to make excellent decisions"

I'd rather say technical competency doesn't make up for destroying the team spirit. There are probably several movies, where the coach throws out the star of the team and gets a better overall team afterwards.

On the other hand it is important to know that technical competency is a requirement for excellent decisions.

<comment><USER7> > There are probably several movies

There are movies where folks believe in Tinkerbelle and that keeps her alive or brings her back to life.

</comment></comment></comment></comment><comment><USER8> I can work around bad attitude, but I can't work around incompetence. Besides, you do not gain true technical expertise without the ability to eventually recognize a good solution for one. So while you may encounter initial resistance when you broach a new idea to a good techie (usually because if he's good, he's already given the problem a lot of thought and hence really thinks his is the right solution) if your idea has merit, she will usually come around after cooling down a little. That has been my experience, anyway.

Conversely, if you think your idea is really good and he refuses to come around and is unable to give a logical reason why, then a) he's not really that good or b) he's good but you did not understand what he said.

</comment><comment><USER9> the thing is, the "he really knows his stuff" guy usually doesn't. He somehow convinced the top guys 5-6 years ago that he did, and now they think he shits gold, when in reality he is very mediocre by current standards

<comment><USER10> _now they think he shits gold_

What's worse is that _he_ thinks he shits gold... I've noticed that certain personalities tend to go this way as they learn something well - they use their knowledge it to feel better about themselves, as if the entire point of learning was to make up for insecurities. Once they know enough to sound knowledgeable, they stop learning.

The worst thing about this is, I think, that it becomes impossible to hire people smarter than them.

</comment></comment><comment><USER11> heh! a guy who makes a living blowing up obvious platitudes into book length anecdote laden "management advice" has a problem with technically sharp people (who as someone pointed out earlier here) he conflates with "bullies" (what an ill defined catchall phrase) and advocates getting rid of them.

Why am I not surprised?

</comment><comment><USER12> A platitude about platitudes: they don't apply universally. If I find myself in a management position where this situation occurs, I would not be so hasty to fire. There's more legwork involved to make a prudent choice in this situation than Seth lets on to. I'm just sayin'...

</comment><comment><USER13> Wow. This is one of the worst pieces of advice I've ever heard.

Don't hire him in the first place, maybe. But once he's there, if you don't have a replacement _already_ lined up and _combat-tested_ , firing him can easily shut down your company.

</comment><comment><USER14> > Deep technical competency is overrated

..

> ability to make excellent decisions

Ability to make excellent decisions comes from deep technical competency. Firing the guy who knows something about stuff leaves behind a bunch of guys who are not very likely to make the excellent decisions you are looking forward to. But there are people who _pretend_ to have deep technical competence.

</comment><comment><USER15> I agree with this. There should be no place for pains in the asses, no matter how smart they think they are. I remember when I was interviewing (seems so long ago), I got to interview with one of these kinds of guys. I felt so belittled after the process. Even though I liked the company (and found the best HR I've ever seen!!)--I said no to their offer. Not the team I want to be on.

</comment><comment><USER16> This looks like a one of "Murphys Laws of Work"

e.g. <http://www.bored.com/jokes/0241377.html> (Conway's Law #2)

</comment><comment><USER17> It sounds to me like he's talking about Bill Gates.

</comment><comment><USER18> Some people are worth 10 average people (some people are worth 100). If you want your startup to outcompete, you need them. You may have to put up with some amount of shit, but hiring talent is a non-negotiable requirement for business success.

<comment><USER19> That's true. It's also true that a single person can destroy the productivity of 10 other people no matter how talented and motivated those other 10 are. I think that is the point the article is trying to make.

<comment><USER18> Well, I thought that the cornerstone quote of the article was this:

"Deep technical competency is overrated compared with the ability to make excellent decisions and to create a culture where forward motion is valued and personal initiative is rewarded."

And, on average, I don't find that deep technical competency is overrated compared to...well, he's talking about social skills here.

At every stage of the hiring and interview and HR process, the deck is stacked in favor of social skills and social advantages. Is it better to be 25% more competent or to be 6 foot 3 inches tall at a job interview? The answer is unfortunately the second a lot of the time.

Yes, there are cases where one bad apple spoils the bunch and you need to get rid of him. In my experience, the bad apples are far more likely to be managers than technical people (think about it: what sort of person wants to boss others around?).

I see a much larger risk, for a medium-sized to large company, of driving out technical expertise by focusing too much on interpersonal skills. In fact, this may be exactly why larger companies tend to stagnate.

Smaller companies that survive more than a year or two already know how to focus on talent.

</comment></comment></comment><comment><USER18> To quote scripture: "Hast thou seen a man speedy in his business? Before kings he doth station himself, He stations not himself before obscure men!"

Modern paraphrase: Even Obama gets to put up with this guy's shit.</comment>


Ask HN: Best way to do a screenshare with 50 people? - <AUTHOR>

I'm running a sales presentation tomorrow where folks are going to watch a Power Point demo remotely.  We've been using Adobe's ConnectNow product for these and it works pretty well.  But it has a 20-person ceiling.
Just found out tomorrow's call is going to have 40 (!) people on it.
Adobe's got a crazy expensive thing that takes 3 days to provision.  Webex is telling me the same story.
Anyone have a better way to do this? <comment><USER2> <https://join.me/> might work for you. It has a limit of 250 people and it's totally free. Unfortunately there aren't any conference call capabilities with the free version, but they do offer a trial of the pro version, which does come with a call in number I believe.

Edit: I was wrong - the free version does give you a conference call number.

<comment><AUTHOR> Their installer fails on my Lenovo.

<comment><USER2> It uses Java, so it may be a problem with either the version of java that you have, or maybe machine permissions if you're not a local administrator.

<comment><AUTHOR> Will try another machine. This looks great. Just need to get it working.

</comment></comment></comment></comment><comment><USER3> Why not a private ustream/justin.tv + screen broadcast software? It won't look as professional as webex but will work for 50 people.

</comment><comment><USER4> I'm in active development on my startup at livelearn.tv that should be able to work though i haven't yet tested it with 50 ppl.

No cost. Shoot me an email if you are having problems and I'll help set you up for tomorrow.

</comment><comment><USER5> <http://www.gotomeeting.com/fec/webinar> 30 days free up to 1000 attendees

</comment><comment><USER6> Webinar

i.e. gotowebinar.com, they have a free trial</comment>


News Outlets Are Liable for Others' Facebook Comments, Australian Court Rules - <AUTHOR> https://www.wsj.com/articles/news-outlets-are-liable-for-others-facebook-comments-court-rules-11591007734 <comment><USER2> This will rapidly degenerate to "providing the capability to coordinate and control will be criminalized". Which basically means every means of net-based communication will become a potential minefield.

If I had to wager, an onerous law will be passed but simply unenforced in most cases, but kept on the books in order to be utilized as a "boutique" charge to allow prosecutors more leverage to try to cop a plea bargain Or compliance on a case by case basis. Much like possession of a firearm is used to amplify a crime even if the crime was committed without actively using or brandishing the firearm.

The rationale will be to prevent riots or inflammatory material from being able to propagate through communication channels; but even if the measure is successful, it just means that people really interested in causing mayhem will simply have the operational calculus shift toward "don't let them take me alive", which will yield a counterproductive result in terms of decreasing the appeal/frequency of violent extremist behavior. In fact, it'll make radicalizing even easier, as there will be even less chance for rational rebuttal, one, and two, it is far easier to look at a government clamping down on your ability to talk to other people and arrive at the conclusion that maybe they aren't the good guys.

Examples to support the measure will likely be the built In nature of delays in broadcasting allowing for the dumping of objectionable content in the radio and TV spheres.

Calling it now.

</comment><comment><USER3> Does the solution to turn off commenting negatively impact sharing news stories? Maybe another way: What is the business rational to allow commenting on news stories?</comment>


A new concurrent hash map - <AUTHOR> https://vmlens.com/articles/cp/computeIfAbsent_hashMap/ <comment><AUTHOR> [https://www.reddit.com/r/java/comments/havnko/a_new_concurre...](https://www.reddit.com/r/java/comments/havnko/a_new_concurrent_hash_map/)</comment>


Ask YC: agressive non-compete/non-solicitation agreement - <AUTHOR> I'm about to sign on to a NYC-based startup on Monday, and this part of the non-compete agreement they sent me raises a flag:

  Covenant Not to Compete: The Employee agrees that for a period of twenty-four (24) months following termination
  of the Employee's employment with the Company for any reason, the Employee will not, directly or indirectly, own,
  manage, control or participate in the ownership, management or control of, or be employed or engaged by or
  otherwise affiliated or associated as a consultant, independent contractor or otherwise with any other corporation,
  partnership, proprietorship, firm, association, or other business entity that is engaged *in any manner in the
  Business of the Company in any market (including the Internet market)* located in the United States as well as
  outside the United States in which the Company markets any of its products or services.
 Am I right interpreting this as saying that I can't work for internet related companies if I leave the company? Is this unenforceable boilerplate legalese that I shouldn't worry about, or something to discuss?
Another provision which bothers me is one that says I won't (for 24 months) "Employ, assist in employing, recruit or otherwise associate in business with any present, former or future employee". Is this something that's worth challenging?
I don't fully understand some of the other concepts in the agreement - things like definitions of "Reasonableness" and "Toll Period", which seem to be based on particular cases or laws - what is a good place to read up on this? <comment><USER2> I am a law student, not a lawyer, so this isn't perfect advice.

Non-competes basically contain three elements:

1\. Scope - what you can work on. This non-compete says anything that NYC company does.

2\. Duration - this one says 24 months

3\. Location - this one says anywhere.

Regarding #1, the court will likely hold that this is reasonable. A non- compete can keep you from working on what you know.

Regarding #2, 24 months is on the long side of acceptable duration. It isn't completely unreasonable, but it is long.

Regarding #3, this is a tough one. As a law student I have not dealt with internet non-competes. It makes sense to limit competition in a geographic area. For example, an agreement where a barber cannot open a competing barbershop next door is considered reasonable by the courts. But location doesn't apply easily to the internet. Where the business is matters less.

To research more, try to go to a law library. Go to the 'Hornbook' series. They are summaries of law across the United States. They are not actually law. You will need to see what rule actually applies to your jurisdiction. There are many Hornbooks (ones on contracts, torts, property, etc). You will have to look at the table of contents and index to see which one you need.

Second, in the law library, take a look at American Jurisprudence. It is similar to the hornbook. You will most likely need a law librarian's help with that one.

You can send me an email with more questions on reasonableness and toll if you want. My email is in my profile. I can answer questions much better if I can read the whole agreement and I know the background on the business.

<comment><AUTHOR> _My email is in my profile_

That part isn't visible publicly - could you put it in the "about me" section, please?

Thanks for the advice. The company is an "e-commerce portal", which rates products based on their environmental friendliness. What worries me, in particular, is that I "[may not work on anything] engaged in any manner in the Business of the Company in any market (including the Internet market)".

Edit: apparently, things that are capitalized like "Business" is here are defined elsewhere in the document.

<comment><USER2> Ok I updated it.

<comment><AUTHOR> ty :)

</comment></comment></comment></comment><comment><USER3> (1) Don't trust a internet discussion thread for reliable legal advice. Talk to a lawyer, even at a university or public-service law clinic, if you need the real info for your jurisdiction(s). So take anything here, including the below, with a grain of salt.

(2) Here in California, I have been given the impression California law prevents most non-compete clauses from being enforceable, on the theory everyone has a right to earn a living using their acquired (and often market- specific) skills. I have heard NY law is similar.

</comment><comment><USER4> Before you get a lawyer, have you tried telling them you don't like the clause? You're about the partner up with these people for (hopefully) many years. Start on the right foot and have a frank discussion with them and politely ask them to remove it from the agreement.

It's kind of a stupid clause, but it's likely their because they hired a lawyer and a lawyer is going to hand them boilerplate stuff that protects their clients... Not necessarily what's fair/normal.

</comment><comment><USER5> Just curious, has anyone here ever been in a situation where a company tried to enforce an NDA/non-compete on them? How common is the actual enforcement of these things? My guess would be that most companies would only consider this worthwhile if they think the ex-employee or contractor is doing something that would harm them (which of course could be a false accusation). I suppose if someone was really unprofessional they could use that power just to punish someone for leaving them, or to hang the threat of retaliation over their head to prevent them from leaving (but that seems like it must be illegal, or should be if it isn't).

</comment><comment><USER6> Noncompetes are unenforceable in California. In New York they are enforceable. This particular agreement would not hold up, but that won't prevent you from ending up in court. It isn't boilerplate, either, it is particularly egregious.

</comment><comment><USER7> I was recently asked to sign a non-compete by a New Jersey based company that stated I couldn't go work for or have a financial interest in, "any company that does product demonstrations".

That's a quote from the contract and it's not a joke. Taken at face value I wouldn't be able to work for pretty much any high tech company. I hired a lawyer who got this bone headed clause along with a couple of other pieces of junk tossed out. Cost $1000 in fees, but I sleep good knowing I can leave and go work for who ever I fancy anytime.

GET A LAWYER.

All the best

</comment><comment><USER8> That is completely unreasonable. It's also of very dubious legality.

If they are giving this sort of crap, you might want to take a pause to think about whether or not you really want to work with them.

If you still want to try working with them, feel free to rewrite the agreement with wording that you think is reasonable. If they don't like it, that will tell you something important, IMHO.

Note that some people will sign these sorts of outrageous contracts on the belief that, since it's not likely to be pursued even for the clauses that are enforceable, they'll just ignore it. Personally, I think that's dishonest and disingenuous.

Also, think about what this sort of clause hanging over your head is going to look like to your next (potential) job/funding-source/etc.? Whether it's enforceable or not, this kind of thing can throw a monkey wrench into your future endeavors and how you are perceived by them.

IANAL. Get competent legal counsel.

</comment><comment><USER9> Since it's a start-up, it's most likely that their lawyers just drafted this up for them, and the founders don't really know any better. Lawyers tend to be overly cautious this way, but entrepreneurs usually realize that running a business takes some risk. If they really want to hire you, it's likely that they'll be willing to change the terms. If they're not, then this is what should raise the red flag for you...

In any case, if the contract doesn't feel right to you (as it should) and regardless of whether it's enforceable or not, don't sign. Why put yourself in a position where you are likely to have legal issues in the future?

</comment><comment><USER10> Get a lawyer to read it for you. Also, negotiate; the contract they gave you to sign is an offer, make a counteroffer.

Do be prepared to walk away from an agreement that makes you uncomfortable, if someone wants to put you into a position where you effectively can't leave the job without suing them; that's a bad sign.

But definitely get a lawyer; if you don't have the right background to understand what the contract is saying, then don't sign it until someone who does can explain it to your satisfaction.

</comment><comment><USER11> That's the most outrageous non-compete I've ever read, and yes, you interpret it correctly. Don't even consider signing that. The bit about associating with other employees is more standard. I'd argue over that part too but it wouldn't be a deal-killer.

<comment><USER12> You haven't read too many then.

</comment></comment><comment><USER13> Just ask them to remove those clauses you are feeling uncomfortable with. You don't need a lawyer for this.

</comment><comment><USER14> I was told non-competes are 1 year and not enforceable in California. But definitely check before you believe me :)

<comment><USER15> A blanket statement like "non-compete agreements last 1 year" isn't really accurate -- they can often be shorter or longer than that. Additionally, the California legal status is irrelevant for this poster, as he's in New York.

<comment><USER16> If he signs a 24 month non-compete in New York and then takes a competing job in California within this period, is it legal? If he takes a similar job in Europe, is it legal? Can it be enforced?

<comment><AUTHOR> There is another clause covering that:

      15. Governing Law, Jurisdiction and Waiver of Venue. This Agreement shall be
      governed by, construed and enforced in accordance with the laws of the State of New York
      regardless of the fact that any of the parties hereto may be or may become a resident of a
      different county, state, or jurisdiction, and without regard to New York choice of law rules.

</comment></comment></comment></comment><comment><USER17> Would you like stock options with that?

<comment><USER17> I mean that any firm worried about you competing like that should aim to retain you as best as they can, and providing stock options is a conventional route in doing so. It also dissuades you from competing during and after employment, and to stay 'on-side.'

I was in a similar position to you but did not ultimately take the job. In my case, I already had a similar site going to the potential employer so could actually compete without too much effort. The employer was prepared to give equity only after 6 months work.

</comment></comment><comment><USER18> I would be fine with this... Provided they agreed to go on paying my salary for the 2 years in which I was unable to work.

<comment><USER8> :-)

However, if they've put this sort of crap into their employment agreement, I will bet dollars to donuts that they also have very onerous IP ownership clauses as well. I.e., be careful that they will probably claim to own everything that you do whether it's directly for work or not.

<comment><USER12> I'd say that this is 100% correct. Be wary.</comment></comment></comment>


Major Book Publishers Start Turning To Scribd - <AUTHOR> http://www.techcrunch.com/2009/03/17/major-book-publishers-start-turning-to-scribd/

<comment><USER2> Perhaps I'm missing something but wasn't the "publishing documents on the internet" problem solved long ago by The World Wide Web? Or is the purpose of Scribd to recreate the magical experience of reading various dead tree formats, even though it doesn't actually do that?

<comment><USER3> It isn't solved until it is wrapped in a proprietary, inaccessible, bloated format like Flash. Or rendered within Javascript so you can get cool page- turning effects. Or put in a PDF inside a PowerPoint which can then be downloaded via a link on a site. Or... I am out of asinine ideas.

<comment><USER4> Or a company might decide to try to solve the problem by gathering and indexing all of these documents so they are more accessible than if they were spattered over thousands of locations, unsearchable, and cost time and money to find.

<comment><USER5> Like Google?

<comment><USER4> Can you click a button and make Google index new content on your site?

Do you use Google video search before you use Youtube?

<comment><USER6> If you use Google Custom Search, you can get indexing on demand.

Also, if you use sitemaps correctly Google will update your content in its main index pretty quickly.

</comment></comment></comment></comment></comment></comment><comment><USER7> Every time there's a Scribd-related post on HN, the comments are negative and repetitive. I don't use the service either, but:

1\. It's successful, at least in terms of traffic, so it's worth watching and perhaps learning from.

2\. The web hasn't obliterated the old document formats (yet). Not everyone that has content in those formats has the time or inclination to replicate the layout in HTML, so Scribd is making distribution easier for them. It may not be solving your problem but it is solving some people's problem.

People here usually have a soft spot for YC funded startups; not sure why Scribd's treated like the disowned member of the family.

<comment><USER8> I'm going to be a devil's advocate.

 _1\. It's successful, at least in terms of traffic, so it's worth watching and perhaps learning from._

The lesson here is that if your concept is extremely general, you'll have success. Scribd went after a niche that was completely underused, and props to them: they got just as big as that plan would predict. That said, it's still not a good web site. It's not a particularly good role model for people who want to build their own web site, _unless_ said people have an idea that's just as large, and large ideas are hard to come by.

 _2\. The web hasn't obliterated the old document formats (yet). Not everyone that has content in those formats has the time or inclination to replicate the layout in HTML, so Scribd is making distribution easier for them. It may not be solving your problem but it is solving some people's problem._

It's solving the problem, but again: not well. Google's suite of PDF-to-HTML and slide displayers do a much better job of this than Scribd's iPaper does. Why that system hasn't been used yet for a public site I don't know: perhaps Google's scared of getting supersued again.

As I said on the other thread (<http://news.ycombinator.com/item?id=521565>) the real challenge is making PDF displays convert to HTML. I'm certain it's possible: hell, with SIFR you could even keep the PDF's embedded fonts. That's a really interesting challenge (and it's one that I'm working on, though its implementation will be radically different than Scribd's much more all-purpose viewer). The end result is that you'll get something that requires no custom displays, because it just works the first time.

 _People here usually have a soft spot for YC funded startups; not sure why Scribd's treated like the disowned member of the family._

We _encourage_ YC startups. Note how rarely we attack DocStoc, which is _way, way worse_ than Scribd is. However, HN isn't a site of happy encouraging people. We're all critics of everything, which is _awesome_. There are also pretty vehement Reddit critics, a few J.tv critics, a lot of people who make fun of OMGPOP, and on and on. So think of this like tough love. We'd love to love Scribd, but we won't tell it we do until it rehabs itself up. (I also suspect there's some jealousy of its success, along with some annoyance that they don't _need_ to take our advice, good as it is, because they're a behemoth without our help.)

<comment><USER9> I hope you're aware of sIFR speed issues when you're replacing multiple different instances of text. It dramatically slows down the browser. (And when dealing with PDFs, I wouldn't be surprised if on average you had to use 20+ sIFR flash objects.)

<comment><USER8> What do you mean, different instances of text? Do you mean different types of text that get rendered differently? Or does this apply also when you work with a large block of text that's all rendered a single way?

<comment><USER9> Basically, each block tag (h1, h2, h3, p, li, etc.) would create a new instance of sIFR, thus creating a new flash object on the page. For example, you can't use just one flash object for a long stream of text, if that stream of text is divided into paragraphs, because sIFR cannot internally give you the necessary margins or tabbing required for marking paragraphs.

The only case where you would have one flash object is when you have a single column of text which has the same font, same leading, and no margins throughout. Unfortunately, that won't happen very often.

</comment></comment></comment></comment></comment><comment><USER6> Hopefully they will use the money from this deal to turn their website into something that users don't hate.

<comment><USER10> The reader embedded in the Scribd site drives me insane.

<comment><USER11> Windows PDF viewing is problematic. Scribd's iPaper eliminates that problem.

Do you use Windows?

<comment><USER12> I do. Google Chrome and Safari both open PDFs very smoothly on Windows. Even in Firefox I am not sure Scribd is an improvement over opening plain PDF (it shows a progress indicator, but it might as well take more time to open in total).

<comment><USER11> Jesus, I don't expect groupthink from HN.

Be rational. Most users use IE on Windows. Even if you don't like it, that's the way it is. Adobe Reader 9 loading in IE can crash the browser. Don't believe me? Google "IE loading PDFs" and you'll see the huge number of users who have problems.

Flash is reasonably reliable in IE. Additionally, Scribd has the option of embedding ads in the PDF more easily by using the player, which gives them a path toward monetization.

When creating a business, you have to be realistic. This is not a techno- utopia where the best technology always wins. In the browser wars, IE is still the current leader. You have to live with it if you want to maximize profit.

<comment><USER12> Then you should have said "Internet Explorer opening PDFs is a pain point and scribd solves that". Fair enough, although I can argue Chrome is both much better solution to this particular problem :)

Personally I think scribd solves some problem _for publishers_ , while actually degrading the experience for a significant minority of the _viewers_. Their relationship with publishers have significant negative externalities, and this makes scribd at least somewhat evil.

</comment></comment></comment></comment></comment></comment><comment><USER13> "But these options aren't conducive to sharing content that you've discovered on the web, as they don't allow your to embed them in your blogs and websites."

False. The Google Book Search API allows you to do precisely that: <http://code.google.com/apis/books/>

Scribd allows user uploads though, and that seems to be their biggest differentiator right now.

</comment><comment><USER14> Why does there seem to be such anti-Scribd sentiment here?

<comment><USER15> A large amount of the content on scribd is actually plain text, or images. Wrapping those in a bloated proprietary flash 'player' is just evil.

Microsoft will probably buy them and wrap it all in a liberal layer of DRM and silverlight.

For me, Scribd is the caveat to "make something people want". It's undoubtedly popular with people who don't know how to share text/documents, but it's not good in the bigger picture.

<comment><USER4> Principle probably doesn't come into play when the majority of people want to consume or share information in the form of text, video and imagery. Using Scribd or Youtube is very much a proof that people have found an easy way to share their information. It seems you're confusing "don't know how" with "aren't doing it while abiding by the principles they should have".

I agree with what you wrote yesterday concerning weights and measures. "Leave people to use what they want to use."

<comment><USER15> It's different though. Youtube makes possible what wasn't already possible - sharing video.

Sharing documents online has been solved for quite a long time now. It's easy (If slimy) to create a walled garden and coerce people into using it, but it'd be nicer to just show them how to share documents online.

Seems like the issue with Scribd is that it enhances the user experience for average user, but for techies/early adopters, it makes for a far worse experience than the alternative.

<comment><USER16> How would you explain to a non-technie writer (with no knowledge of HTML or web hosting) how to share their word or pdf files? Seems whatever solution you come up would probably be similar to Scribd.

</comment></comment></comment></comment></comment><comment><USER17> Everytime I see a Scribd doc I run away like if I saw the devil.

HTML does a better job.

<comment><USER17> So, you say you need a format to transport a document, as one single file, from one device to another? (No talking about the beauty of hyperlinking but actually sending/storing)

And HTML doesn't offer that feature?

Ok, how about we all get together and propose the W3C to create a format BASED ON HTML, open source, free, not propietary, for everybody to use and improve upon?

How about that for an idea?

Like, instead of "Save complete page as HTML" which creates folders and hidden passages to hell, some option to save as HTMD (d for doc); where the browser serves as the document viewer with no other plugin or add on than the browser engine?

Where you can open an inspect that HTMD like we do now with "View Source"?

So when you visit a page you can "Save as HTML Doc" the whole page in one file, images included?

So we impulse a new breed of HTML doc creators, instead of PDF creators, scribd creators, nextpropietary creator, etc?

Where you can create your doc and just publish it to the web, because it is HTML and the web already knows it very well?

There, my brainfarts for the day...

<comment><USER17> Which wouldn't be that difficult after all, even a firefox plugin could do that.

\- Move all the JS and CSS inside the main doc.

\- Convert all images to src=data:

\- Some other minor tweaks

There you have it, one single file in all its HTML beauty</comment></comment></comment>


The 5 Second Test - <AUTHOR> https://2xcd.com/blog/5-second-test <comment><AUTHOR> Author here. Would love to hear your feedback!</comment>


Why Evernote Is Giving Up on Its Data Centers for Google Cloud - <AUTHOR> http://fortune.com/2016/09/13/evernote-google-cloud/ <comment><USER2> Only one sentence about the "why" and that's only half an answer.

"But Evernote wanted to take advantage of Google's higher level capabilities"</comment>


Prometheus: A Next-Generation Monitoring System [video] - <AUTHOR> https://www.usenix.org/conference/srecon15europe/program/presentation/rabenstein <comment><USER2> We started using Prometheus for a Go-based app in production a few weeks ago. So far, so good.

They recommend starting with PromDash [1], their Rails-based visualization tool, but I didn't find the console-based templates [2] very difficult to dive into (Although more examples would be handy).

Worth checking out, IMHO.

[1] [http://prometheus.io/docs/visualization/promdash/](http://prometheus.io/docs/visualization/promdash/)

[2] [http://prometheus.io/docs/visualization/consoles/](http://prometheus.io/docs/visualization/consoles/)

<comment><USER3> [https://github.com/prometheus/prometheus/tree/master/console...](https://github.com/prometheus/prometheus/tree/master/consoles) has all the public examples for console templates.

</comment></comment><comment><USER4> I've been slowly deploying this for server and network monitoring. The combination of Go's fat binaries and the exposition format have made it ridiculously easy to get started with (and almost immediately produced insights - PromDash became popular the moment people saw it working).

</comment><comment><USER5> We are using Prometheus as the central part of our logging and alert infrastructure. We have collectd inside individual docker containers feeding data to Prometheus via collectd_exporter. I hate yak shaving and there's been surprisingly little of it with Prometheus so far.

</comment><comment><USER6> Pull model kills it for me - I know I can use the 'push gateway' and setup a grep of 'exporters' but then you've just killed the 'easy to deploy' advantage.

I still think something like Riemann/Influxdb/Graphana is the best bet for a roll your own type solution. Riemann is a really flexible router/aggregator/alerter with realtime metric display and it can throw everything over to influx/grafana for dashboarding/time series analysis.

</comment><comment><USER7> This looks really cool, but I'm always instinctively turned off by the pull model.

\- Assuming metrics are stored in memory, they'll be lost if the app or server recycles. Of course, a push model should probably batch so there's probably some kind of overlap here.

\- I've heard pull is good for detecting if a server is down. The flip side is no automatic discovery and dynamic scaling where a server going down might not necessarily be a bad thing.

\- Security. Not super thrilled with exposing something that says "Hey come get my data".

<comment><USER3> > \- Assuming metrics are stored in memory, they'll be lost if the app or > server recycles.

Similarly if the server dies before sending the metrics, so that's a draw.

> The flip side is no automatic discovery and dynamic scaling where a server > going down might not necessarily be a bad thing.

That's more about top-down vs. bottom-up target discovery than the scraping itself, see [http://www.boxever.com/push-vs-pull-for- monitoring](http://www.boxever.com/push-vs-pull-for-monitoring)

As of Prometheus 0.14.0 which was released earlier in the week, Prometheus supports target discovery. [http://prometheus.io/blog/2015/06/01/advanced- service-discov...](http://prometheus.io/blog/2015/06/01/advanced-service- discovery/)

> Security. Not super thrilled with exposing something that says "Hey come get > my data".

That's a fair concern, though I'd expect your metric endpoint not to be internet accessible (and some of the push options will have a HTTP endpoint for debugging).</comment></comment>


Ask HN: Do startups actually do data science? - <AUTHOR>

I'm a Stanford MS candidate in CS. Are there any startups actually hiring for real data science positions? The term seems so overloaded to the extent that recruiters are ready to label anything from Excel to "data infrastructure" as data science. Where can I find a role working on actual ML problems? <comment><USER2> Well, you _can_ do "data science" in Excel, depending on what you take "data science" to mean. And infrastructure is part of doing data science. I don't think "data science" really means much of anything in practice.

You'll need to carefully define what kind of work you're interested in doing: text mining with NLP, predictive analytics, data mining, ML research, symbolic AI (yeah, that's still around as well), optimization type problems using genetic algorithms, etc. And then probe the company's job posts and dig in with the recruiters, and screen out the bogus stuff.

If somebody advertises for a "data scientist" just treat that as a weak signal that they might be a match, and work from there.

One thought to consider: Instead of working as a FTE in internal IT for some company, you might consider becoming a consultant. You could look at working for a company like Hortonworks or Cloudera, who both have services arms, where you could travel from company to company, working on different kinds of problems.

<comment><AUTHOR> You're right the term can mean anything, but I alluded to my meaning when I mentioned "ML problems".

Thanks for the tip about Hortonworks/Cloudera, I had never considered such a role but that's exactly what I want to be doing next year.</comment></comment>


Show HN: Easy interactive product tours with Bootstrap theme support - <AUTHOR> https://www.easyproducttours.com

<comment><USER2> Great product and neat work. Fair pricing, unlike others who are charging a lot more.

I would definitely use your service for my next client projects.

Feedback:

1\. __Do whatever so that users will know your app exists in the first place.

First get known to lot of potential users. Let them know your app exists in the first place, then think of Bmodels. Charge little to none!

This kind of app needs more visibility and recognition across the web. Then everyone will recommend and refer your app over-time. It should only get better over time. So don't charge more. Give it at a throw-away price. Reach all top blogs, top/newly launched products and give them to use free, with your branding. ( Your product is the easiest to get known, because of the nature of the app)

2\. Long-term: Build a branding around.

When someone thinks of product tours your app name should be synonymous with tours. Always think this way, and do whatever to achieve this. ;)

3\. Add a referral service.

If someone recommends and links back, give them 1 month extra? Don't pay back anyone for referring, but let them use your product more and spread the good message.

* And do reach me out, if you need any kind of help. :)

<comment><AUTHOR> Thanks for your comments.

1\. Yes, we are planning on writing a few blogs emphasising the need for product tours, which we will be including in our 'cold call' sales emails to newly launched apps.

2\. Branding: we chose 'Easy Product Tours' for easy remembrance and google- ability. We think we can build a decent brand around that name.

3\. Sounds good. We'll give some thought to how we can implement a refferal program.

</comment></comment><comment><USER3> What makes this worth paying for versus something free like Joyride: [http://www.zurb.com/playground/jquery-joyride-feature- tour-p...](http://www.zurb.com/playground/jquery-joyride-feature-tour-plugin) ?

<comment><AUTHOR> Differences as such are:

1\. User-tracking: we track which users have seen which tours and this data is persisted at our backend. So people are mot repeatedly shown the same tours and distracted from using your app.

2\. Apart from including the tour player script you dont have to make any changes to your existing page.

3\. We support using your aites own custom Bootstrap themes out of the box, so you dont need to spend time customiZing the look of your tours.

<comment><USER3> 1\. Joyride has support for cookies.

2\. It seems that if you were building a page to be a product tour, you could build the page to be a product tour.

3\. What exactly does that mean? What properties does your product inherit from the Bootstrap theme?

<comment><AUTHOR> 1\. What if your user switches between computers? Cookies are no longer available, and they will be shown the tour again.

2\. The difference is there would be a separation of concerns. The tour functionality should not be part of your app. It should be a separate layer.

3\. The tour tooltips will take over the CSS styles of the bootstrap theme you are using. So all the fonts, colors, button styles etc. will be similar to those you are already using on your site.

</comment></comment></comment></comment><comment><USER4> This is a good idea, and it looks like you've done good work.

But the design choices are a little baffling to me. Why are all the corners so sharp on everything? And what's up with the bright blue colors? I know that this is mostly because you're trying to not just use the Bootstrap defaults, but the result is inferior to the default theme. As soon as you can, try to get a designer on board.

<comment><AUTHOR> Actually, the tour tooltips take on the styles from whatever bootstrap theme that you are using on the site. Since we are using the cosmo theme, all the corners are sharp, and the blue colour is applied.

If you are not using bootstrap, or if you are using the default bootstrap theme on your site, then the colours and corners would be as defined in that theme.

We made it like this so that you dont have to waste time getting your tours to match the look of your site.</comment></comment>


A security vulnerability in Git that can lead to arbitrary code execution - <AUTHOR> https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/ <comment><USER2> A few important points that aren't mentioned in the post:

\- you have to tell git to use submodules for this to trigger (so `clone --recurse-submodules` or a manual `git submodule update --init`)

\- credit for discovery goes to Etienne Stalmans, who reported it to GitHub's bug bounty program

\- most major hosters should prevent malicious repositories from being pushed up. This is actually where most of the work went. The fix itself was pretty trivial, but detection during push required a lot of refactoring. And involved many projects: I wrote the patches for Git itself, but others worked on libgit2, JGit, and VSTS.

<comment><USER3> Thanks, peff, for the feedback. I pushed some changes to try to clarify that this does indeed require `clone --recursive`, and I added a note to credit Etienne Stalsman explicitly. That was an oversight in my haste.

<comment><USER2> No problem! Thanks for all your work on this.

I should have clarified above, too: there were folks from GitHub, Microsoft, and Google working on the various fixes.

<comment><USER3> The Git community is great because even though many of the interested parties compete with each other in some form or another, we always put that aside. And that's especially true for security issues.

</comment></comment></comment></comment><comment> gitlab-security The monthly security release for GitLab was today, and this release was coordinated with the Git security release. [https://about.gitlab.com/2018/05/29/security-release- gitlab-...](https://about.gitlab.com/2018/05/29/security-release- gitlab-10-dot-8-dot-2-released/)

In addition to our recently implemented monthly non-critical security release process (we already had a critical release process before), we are making a number of changes in how we secure GitLab.com, which includes expanding our HackerOne program this year to be a public bounty program. As always, we appreciate the contributions of security researchers.

</comment><comment><USER4> The initial Git for Windows 2.17.1 releases published on GitHub earlier today [0] apparently didn't include the patch. So just a heads up if you updated right after this was published: You probably want to make sure you have the fixed version (2.17.1.windows.2) [1]

Not sure why the erroneous releases haven't been removed? Seems a bit confusing.

[0] [https://github.com/git-for- windows/git/releases/tag/v2.17.1....](https://github.com/git-for- windows/git/releases/tag/v2.17.1.windows.1)

[1] [https://github.com/git-for- windows/git/releases/tag/v2.17.1....](https://github.com/git-for- windows/git/releases/tag/v2.17.1.windows.2)

<comment><USER5> The link on [https://git-scm.com/](https://git-scm.com/) still points to the old 2.17.0.

Chocolatey has the original 2.17.1, the 2.17.1-2 update is not yet approved.

Cygwin still only has 2.17.0-1. I wonder whether they were even part of the embargo.

<comment><USER4> For some reason git-scm.com is almost always slow at updating links to new Git for Windows releases.

I usually just track the repository's atom feed [0] and download urgent updates directly from there (git-scm.com eventually links to the releases published on GitHub anyway).

[0] [https://github.com/git-for- windows/git/releases.atom](https://github.com/git-for- windows/git/releases.atom)

Edit: The Git 184.108.40.206 Chocolatey package has now been approved [https://chocolatey.org/packages/git/126.96.36.199](https://chocolatey.org/packages/git/184.108.40.206)

</comment></comment></comment><comment><USER6> Perhaps it would be best if sensitive options such as the post-checkout hook could only be stored outside of the repository altogether. Given this vulnerability and the semi-recent .GiT/config vulnerability[0], I would not be surprised if other attack vectors are lurking under the surface.

Storing config data outside the repo would not be a foolproof solution, but it would probably make things a little safer. (Having the <repo_root>/.git folder has always felt a little bit "in-band" to me, and I don't like it.)

[0]: [https://news.ycombinator.com/item?id=8769667](https://news.ycombinator.com/item?id=8769667)

</comment><comment><USER7> The correct CVE numbers are CVE 2018-11233 and CVE 2018-11235. The microsoft blog mentions 11234, but thats not the git vulnerability.

<comment><USER8> I know this isn't Reddit, but I can help but point out that 11234 = average(11233, 11235)

<comment><USER9> That's most likely the result of how CVE numbers are allocated: in sequence.

</comment></comment></comment><comment><USER10> Another reason to train yourself to always think before you execute code you found on a site.

Too many of us are so used to _git clone_ 'ing a repo and building the software with _make_ or its descendants that we overlook the security considerations.

<comment><USER11> > Too many of us are so used to git clone'ing a repo and building the software > with make or its descendants that we overlook the security considerations.

The issue here is that the "git clone ..." allows for arbitrary code execution so the flow of 1) clone 2) analyze 3) make breaks at step 1.

Looks like it's back to tarballs for me.

<comment><USER12> Even with tarballs all it takes is one fuck-up in a script and your homedirectory is gone. In that sense nothing is safe. You could of course audit all the code that the makefile or build script executes but I really don't know anybody that would do that for anything beyond the trivial.

We've been totally conditioned to just wget some archive, unpack it and build it, and even if git clone takes it one step further in day-to-day practice there is no difference between the two.

<comment><USER13> I think the parent's concern is that there should at least be SOME way to audit everything. That doesn't necessarily mean that everyone ought to be doing it every time they clone a repo.

<comment><USER12> Most web interfaces to git will allow you to review the repo, if you blindly clone some repo that someone asks you to clone recursively I would see that mostly as a social engineering hack with the technical hook than a purely technical hack.

And depending on the sophistication you might want to do that in a chrooted environment or a VM.

<comment><USER14> There's no way to know if what you see on the web will be what you clone. The inspection must occur locally.

</comment></comment></comment></comment></comment></comment><comment><USER15> Over the past few years there's been a few vulnerabilities in Git that result from an attacker injecting hooks into a repo. I wonder whether it'd be possible / worthwhile to disable hooks by default, and only enable them on a per-repo basis.

Of course, then the goal just becomes attacking that whitelist, and all the complexity that comes with that. Security is hard.

<comment><USER16> A good starting point would be requiring a specific flag when executing any git command that should be attached to a hook. Something like git clone —-allow-hooks to enable post-checkout hooks ; or git commit —-allow-hooks to allow pre/post-commit hooks.

</comment></comment><comment><USER17> After reading the responses to my previous question, I'd like to know if there's a global way to turn off post-checkout hooks.

None of the use-cases I read are convincing enough to allow `git clone` to do anything but what its short man description says.

I'm not even thinking about security, just basic separation of concerns. If `git clone` leaves a script-hooked repo in an unusable state for building, I want to know up front so I can complain to the maintainer and get that problem fixed.

<comment><USER18> Hooks aren't part of the repo. The only way your copy of a repo will have hooks is if you put them there.

<comment><USER19> Not if you `git clone --recursive` an evil repo with anything < 2.17.1 (which is the point of the article and the reason of this discussion): then your copy will have hooks that you have _not_ put in.

</comment></comment></comment><comment><USER17> What's a (common) example use case for a post-checkout hook?

<comment><USER3> That's a really interesting question. I tried to think about that when I was writing this blog post and couldn't really think about anything. Perhaps setting some permissions on a file or running `chattr` / `setfacl` is the best idea I had, but I omitted any suggestions because I've never actually used a post-checkout hook in anger.

<comment><USER20> The post-checkout hook gets used for things like concatenating JS and CSS assets in a repository that's meant to house templates, i.e. a poor man's invocation of "make" whenever a user does a "git pull" without the user having to do anything extra.

It can also be used for other cases where you'd like to amend what git does by default when updating the tree. See this recent thread[1] where some users want to have mtime behavior on files that's different from git's defaults, and one way to do that is via a post-checkout hook.

1\. [https://public- inbox.org/git/20180413170129.15310-1-mgorny@g...](https://public- email@example.com/)

</comment></comment></comment><comment><USER21> I'm sure there are security experts out there who managed to create tools that scans source code to find eventual security vulnerabilities.

Although I'm not sure those tools could 'find' and build a vuln, but there could be ways to analyze an algorithm, and detect that it can do dangerous things it's not not supposed to do. A little like static analysis works.

I'm sure those tools are already built by the NSA at least, so they just have to peek into github repos, point out what code is vulnerable, give it to some developer to make an exploit. Done.

That way the NSA would clearly wins the cyber arms race, versus those pairs of eyes Torvalds was being quoted for, would surely be obsoleted.

<comment><USER22> See: [https://testing.googleblog.com/2016/12/announcing-oss- fuzz-c...](https://testing.googleblog.com/2016/12/announcing-oss-fuzz- continuous-fuzzing.html)

</comment></comment><comment><USER23> Cached since I can't load the page: [https://webcache.googleusercontent.com/search?q=cache:CO48Rd...](https://webcache.googleusercontent.com/search?q=cache:CO48Rd83tw0J:https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing- the-may-2018-git-security-vulnerability/+&cd=1&hl=en&ct=clnk&gl=uk)

<comment><USER24> And the announcement from the Git project is at [https://marc.info/?l=git&m=152761328506724&w=2](https://marc.info/?l=git&m=152761328506724&w=2). See also CVE-2018-11233 and 11235.

</comment></comment><comment><USER25> So to an extent, this is bad, you can be compromised by a malicious git repo, however given that most people already trust code cloned from git (or acquired from similarly untrusted sources like npm, rubygems, maven central etc) it may not change the equation that much.

If you run code without trusting the author, you're likely going to have a bad time.

<comment><USER26> Sounds like it could be devastating for shared git hosting like github, bitbucket, gitlab, and for anyone just mirroring repos.

<comment><USER25> Unless I'm reading it wrong the attacker still has to have a repo. under their control, then get the victim to clone the repo.

I'm not saying it's trivial , but more that people execute code from GH and similar alll the time without reading/evaluating , and this won't do any worse than that.

<comment><USER26> Let's say you sign up for a free account on a shared git-whatever.example.com and set it up to auto-mirror a malicious repo you host elsewhere. If git- whatever.example.com(1) had implemented its mirror feature on top of regular git, boom and you might get shell access on their server and full access to any and all private repos stored on the same service.

(1) could be any shared service like gitlab.com, github.com, bitbucket.org, etc

<comment><USER25> oh yeah, cool :) I was thinking about the issue from the perspective of an ordinary user of git, not of services that consume git repo's from other places.

I guess this will make some bug bounties for researchers who can find services that haven't patched quickly...

<comment><USER26> Seems like this actually happened on github: [https://twitter.com/_staaldraad/status/1001542421161930752](https://twitter.com/_staaldraad/status/1001542421161930752)

</comment></comment></comment></comment></comment></comment><comment><USER27> Hmm - the "official" git PPA isn't updated yet: [https://launchpad.net/~git- core/+archive/ubuntu/ppa](https://launchpad.net/~git- core/+archive/ubuntu/ppa). Wonder if this due to dependencies or oversight?

<comment><USER27> Ps. anyone running debian strech can get this via stretch-backports:

      echo "deb http://ftp.debian.org/debian stretch-backports main" | tee /etc/apt/sources.list.d/stretch-backports.list
      apt-get update
      apt-get -t stretch-backports install git

</comment></comment><comment><USER28> Am I the only one who didn't even know git submodules and recursive clones were a thing?

</comment><comment><USER29> What the link doesn't mention, that I can see, is what the first version affected was. Does this bug go back to the inroduction of submodules in git?

</comment><comment><USER30> Page is down -- anyone have a mirror?

<comment><USER31> Surely Microsoft should have enough resources to survive the usual HN-hug-of- death?

<comment><USER32> Maybe HN, Reddit and /. struck at the same time?

</comment></comment></comment><comment><USER33> It's probably not worth upgrading anyways.

</comment><comment><USER34> What I really love about this is that they give details of the vulnerability. They never do this in any Microsoft security advisories.

Guess when it's not your direct product this is OK.</comment>


Show HN: Her. Designs as you speak - <AUTHOR> https://helpmenow.herokuapp.com/

<comment><AUTHOR> Only works in Google Chrome.</comment>


Ask HN: What apps did/do you use for cold calling? - <AUTHOR>

Hi HN,
I spent a day making cold calls to businesses on behalf of a friend's startup the other day. I lost a lot of time between calls grabbing information about the next lead (from a pre-compiled list) and typing in the number.
A simple app to automate the above would have been great, but I couldn't find one that just does this and little else. The apps that I did find were either designed for large teams (and so too expensive for the 3 of us) or tried to integrate inbound calls (and so was unnecessarily complicated).
Talkdesk.com as advertised pretty much matched our needs, and will be what we probably end up using. But we can't find half the features that they promote, since all of their screenshots seem to be before some massive redesign. Their power dialling feature, for example, would be great - if we could find it!
Has anyone else ever needed such a simple tool? Has anyone found it? <comment><USER2> You could try phoneburner.com.

<comment><AUTHOR> Looks awesome, thanks!</comment></comment>


Ask HN: For privacy, would you use IE over Chrome? - <AUTHOR> <comment><USER2> IE is dead. Edge has replaced it. The defaults on Windows 10 settings is questionable already - so my suggestion would be to use Firefox instead of either chrome or IE/Edge. Brave is another choice (but it's built on chrome browser engine blink).

</comment><comment><USER3> Firefox.</comment>


Python TripleSec encryption - <AUTHOR> https://keybase.io/triplesec/triplesec_now_in_python.html

<comment><USER2> What do cryptographers have to say about this?

Also, it is not really triple encrypting anything. For example, lets say we have 3 functions x+7, x _3, x /9 and we apply these in turn to a secret value x. Is it triple calculated? Or triple encrypted? Or have we just created a new untested algorithm called (x+7)_3 /9? And note that we could simplify this to 1/3 * (x+7).

If you think of encryption as a twisting and tangling process, how do you know that the subsequent steps don't do some untwisted and untangling, in effect canceling out early encryption?

<comment><USER3> Let's just say that Ronald Rivest cannot answer your question, so the claim here is "If you believe the soundness of RSA (or any crypto for that matter), then you should believe TripleSec." This, of course, is because they are all based on the same axiomatic assumptions, which should leave you wanting to crack a book open.</comment></comment>


Effects of MP3 Compression on Perceived Emotional Characteristics in Music - <AUTHOR> http://www.aes.org/e-lib/browse.cfm?elib=18523 <comment><USER2> Before anyone jumps to conclusions, the paper is comparing the original audio with MP3s compressed at 112kbps and under, where the compression artifacts are very easy to notice.

<comment><USER3> was about to say this.

192Kbps VBR is the minimumn for transparency for me. i've been moving my whole collection FLAC -> Opus 160Kbps VBR (which is widely regarded as audiophile- transparent).

<comment><USER4> Same. It's crazy to me that people are saying that they can hear the difference between 24-bit 192khz recordings and something like 320Kbps MP3 or 192 VBR (which is what most of my personal collection is at). Back in the day on [huge;y famous private torrent tracker], FLAC and 192k VBR were the gold standards, with most opting for the VBR version. I personally have some VERY nice headphones, speakers, and sources (Senn HD800s, Westone ES60, KEF LS50, RME ADI-2 Pro, etc), and I can't hear the difference between this high-bitrate stuff and the lower encodes. I CAN hear a HUGE difference between bad recordings and good, but that doesn't stop me from enjoying my favorite albums. I have other headphones, speakers, IEMs, and sources for different needs, for example working out...I like my Jaybird Tarah Pros, and even though they're not "audiophile", I've still had tons of enjoyment with them doing things like skateboarding, mountain biking, and riding my motorcycle. Horses for courses. The HD800s is NOT great for bass-heavy music, so in that case, I'll switch to a Shure 1540 or Beyer DT1770, which even though they're more in the higher-end mid-fi range, have each brought me many hours of pleasure over the years.

This is a fun hobby, but it's possible to make it less fun by arguing on the internet with people about it. If it sounds good TO YOU, and it's worth the price TO YOU, then never let someone make you feel bad about it. Some people buy $10k cables (or "worse" imo, cable elevators [e.g. [https://forum.audiogon.com/discussions/the-finest-cable- elev...](https://forum.audiogon.com/discussions/the-finest-cable-elevators- you-ever-auditioned) ]. I think that those are ridiculous, but some people swear by them, and that's their choice. I'm the guy with the inner tube under the turntable playing with air pressure, because I love a good hack and have a penchant for DIY. I've built speakers that sound bad, but I've always learned something from every build. If you want TRUE REFERENCE sound, look up exactly what gear your favorite recording studio uses, and buy the same set-up. Otherwise, just have fun :)

<comment><USER5> I can hear the difference between them but honestly I listen to Spotify on highest quality setting (320Kbps I think?) for my everyday because it's convenient and already sounds great. I'm listening in an imperfect environment anyways with environmental noise from outside and a non-treated room. My main benchmark is does the codec give me listening fatigue which, for example, Soundcloud and 128Kbps does but 320Kbps doesn't.

As an aside people who swear by 24-bit audio don't even understand what bit rate does in context of audio. It's only useful in the studio context.

Edit: Not sure why I'm getting down voted. I can explain the difference as added sparkle in the transient high end frequencies. My hypothesis is that the presence of frequencies outside of the range of our ears affect the frequencies within our hearing range. It's pretty common to have to re-EQ the whole track after EQing one instrument in a mix so this concept is just being applied outside our hearing frequency spectrum Also I would like to point out that higher bandwidth audio doesn't necessarily sound better to me, just different.

<comment><USER6> I upvoted you, but you're wrong. 24bit audio depth matters, especially in jazz and classical recordings. You notice both subharmonics and superharmonics missing. Particularly when their phase is slow in time.

<comment><USER5> Case in point. The bit rate has to do with dynamic range not frequencies.

<comment><USER6> The reverberation of a single tone can be _in phase_ or _out of phase_. The results is observed as a beat frequency in amplitude.. not in tonal frequency, that's what why bitrate matters.

<comment><USER5> We use higher bitrates during recording to lower the noise floor, in turn giving more headroom in the mix. Once you mix down this becomes irrelevant because the difference between silent and full volume at 16bit is enough to cover the full capability in terms of sound pressure levels of the human ear. 1bit = 6dB which means 16bit is 96dB. As we don't start at absolute zero but with a background noise of the room at 30dB using the full dynamic range of 16bit at playback you risk deafening yourself.

In your example if your single tone is out of phase then 1) how do you control this at any bit rate and 2) this is controlled by an acoustically treated room and a skilled engineer during recording. When you listen on headphones you already eliminate this concern on playback and unless you are listening in a professional designed and treated listening studio you will always have some element of phase cancellation. This is the listening character of your room and will occur at any bitrate.

Read this [https://www.mojo-audio.com/blog/the-24bit- delusion/](https://www.mojo-audio.com/blog/the-24bit-delusion/)

<comment><USER6> You know - I agree with this article. Thank you for your thoughtful response.

I understand and agree that 24bits is enough for human perception. But something else is happening in MP3 encoding. Some sort of assumptions about human perception of dynamic range that are inaccurate. I am not expert enough to know precisely where. But I generally understand compression and I am an "audiophile".

Nothing in the article stands out as false to me. But I cannot help but believe it might be missing something.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Maybe slightly off topic but I would be curious to know what the artifact of lower bit rate mp3 encoding is actually doing. It's not aliasing, but it's in the 6-15khz range. I could only describe the sound of the artifacts as a flock of seagulls in the distance flying towards you.

Edit: found this which answers a lot of this.

[https://www.soundonsound.com/techniques/what-data- compressio...](https://www.soundonsound.com/techniques/what-data-compression- does-your-music)

</comment><comment><USER8> Relatedly, this article nearly a decade(!) ago mentioned that younger people of the time were preferring the sound of MP3 compression artifacts over higher-quality compression or even the original uncompressed audio:

[http://radar.oreilly.com/2009/03/the-sizzling-sound-of- music...](http://radar.oreilly.com/2009/03/the-sizzling-sound-of-music.html)

I suppose it's similar to how some people prefer the distortion of "tube sound".

<comment><USER9> Im sceptic of this slashdot classic. Was this ever verified independently?

</comment></comment><comment><USER10> As of today, if I need to compress, I use M4A/ALAC. This article may have been appropriate >10 years ago.

Most of the time I have good speakers and decently encoded sound, I do not have any real quibs.

<comment><USER11> Check out opus encoding - should be way better

<comment><USER12> The available research is incomplete.

The Opus "Comparison" cherry-picks the sub-128 kbps bitrates, where the format is evidently strong, but it doesn't include references for high-bitrate music compression.

Actually, even their (partial) diagram hints that there is virtually no difference at over-160 kpbs bitrates.

I'm struggling to find high-bitrate music compression (blind) listening tests lately in general; it seems that the internet crowd enthusiasm in the subject vanished in the last decade.

<comment><USER13> What do you mean by incomplete? What information do you lack? If you meant some tests of OPUS over 128kbps, then it's just there's no real need for it. Why would anyone want to add some 50-100% weight to your files for almost no audible increase in quality? In any case, lossy codecs are not meant for storage/critical listening.

Lack of enthusiasm in publishing tests can probably be explained by the ease of performing ABX tests by yourself with your own gear and exact listening conditions you're aiming for.

</comment></comment></comment></comment><comment><USER14> >Compression _effected_ some instruments more and others less

<comment><USER15> Affected [1] is correct. You could perhaps say 'Applying compression effected an undesirable change in some instruments...' \- the sound of the instruments is affected by the compression, but the _change in the sound_ has been effected by the addition of compression.

1\. [https://en.oxforddictionaries.com/definition/affected](https://en.oxforddictionaries.com/definition/affected)</comment></comment>


We are doing great on Windows 8 - <AUTHOR> http://blog.extendedresults.com/2012/12/12/we-are-doing-great-on-windows-8/

<comment><USER2> Must work at microsoft, only once actually mentioning the word "great" and "windows 8" in the same sentence do to make it seem better than it is.</comment>


Terraform Plugin to order Dominos Pizza - <AUTHOR> https://ndmckinley.github.io/terraform-provider-dominos/ <comment><USER2> Reminds me of _"What do you get if you send this code to a fully equipped LaserWriter type such-and-so"_ from _Stump the Experts_ ([https://en.everybodywiki.com/Stump_the_Experts#Sample_Questi...](https://en.everybodywiki.com/Stump_the_Experts#Sample_Questions))

</comment><comment><USER3> I had no idea there were public APIs for this.

I have a new challenge for this weekend.</comment>


Don't return your employer's laptop - <AUTHOR> http://www.sumologic.com/blog/company/work-here-get-a-free-macbook-pro

<comment><USER2> This makes a lot of sense. A hacker's computer is a very personal item. Most hackers will be in a situation where there is little distinction between the tools they use at work and those they use at home. There's also likely to be many hours of customization spent on a machine in the form of shell startup scripts, defaults tweaks, browser extensions with userscripts, software licenses, text editor plugins, and a bunch of hand-compiled (or Homebrew) software.

I take my personal MacBook Pro to work and back every day, despite it being a pain in the ass to lug around, because I can't imagine doing all the same tweaks, installs and settings on two machines. And I wouldn't feel comfortable with having my personal stuff on a machine owned by my employer either. So this seems like a great solution.

And yeah, let's face it, we do like the shiny. You'd be none too pleased if you joined a new company and they gave you a scuffed old machine with the previous users sandwich still living under the keycaps, would you?

</comment><comment><USER3> If only big corporations took the same line as you. I can't believe the last company I worked for (starts with A, one that Steve Jobs hated) re- appropriated my 3 year old scuffed, dented, damaged MBP to a new employee after I left.

I thought I could keep it as a write-off when I left the company cos I had warped the case in a bicycle accident and dropped a video camera on the keyboard so a few of the plastic keycaps had been smashed. It still worked fine and meant a lot to me but I wouldn't be too impressed if I had received that computer as an employee. It would show a basic lack of respect for the work I will be contributing.

</comment><comment><USER4> twitter-version: Sumo Logic gives their new hires a MacBook Pro. It's a signing bonus.

</comment><comment><USER5> They develop on laptops? Ouch.

<comment><USER6> Nope, most people have both a laptop and desktop. But they only get to keep the laptop :)</comment></comment>


A More Inclusive Repository - <AUTHOR> https://github.com/retrosight/learning/blob/primary/a-more-inclusive-repository.md <comment><AUTHOR> AKA wtf?!?

[https://github.com/Microsoft/calculator/issues/169](https://github.com/Microsoft/calculator/issues/169)</comment>


'Revenge Porn King' Hunter Moore Hit by Anonymous - <AUTHOR> http://www.foxnews.com/tech/2012/12/07/revenge-porn-king-hit-by-anonymous-hackers/

<comment><USER2> >"In a perfect world, there would be no bullying and there would be no people like me and there would be no sites like mine," he told the Betabeat tech blog. "But we don't live in a perfect world."

Woah, people actually use that to validate their actions? This must be the worst fallacious argument I've ever seen. What an idiot.

Edit: Thanks for suggestion

<comment><USER3> The more common version is people who say "Life isn't fair" while taking advantage of everyone else and generally being asinine.</comment></comment>


The Salyut 3 station was equipped with a "self-defence" gun - <AUTHOR> http://en.wikipedia.org/wiki/Salyut_3#On-board_gun

<comment><USER2> Soyuz had a gun, too, but it wasn't quite as impressive.

<http://en.wikipedia.org/wiki/TP-82>

EDIT:

And apparently they had another one in the works.

<http://en.wikipedia.org/wiki/Soviet_laser_pistol></comment>


Show HN: Write Games with Python in Godot - <AUTHOR> https://github.com/touilleMan/godot-python <comment><AUTHOR> If you don't know Godot game engine ([https://godotengine.org/](https://godotengine.org/)), you should definitly give it a try ;-)

Godot use a Python-inspired custom language for scripting called GDScript(it's not a NIH syndrome ^^: [https://docs.godotengine.org/en/stable/about/faq.html#what-w...](https://docs.godotengine.org/en/stable/about/faq.html#what- were-the-motivations-behind-creating-gdscript))

This approach works great but I felt "Python-inspired" is never enough so I made a plugin embedding the full Python interpreter in all it glory !

Now you can pip install the whole Python ecosystem (including binary packages such as Numpy or Pytorch) and use it into Godot.

Another cool thing about this is you can write your game code in Python to iterate fast on it, then use Cython later on to optimize it and get almost native performances !</comment>


Chefs and Soldiers Make Good Product Managers - <AUTHOR> http://firstround.com/review/why-soldiers-and-chefs-make-the-best-product-managers/ <comment><USER2> A pm job is conceptually one of the simplest jobs but one of the most difficult to execute.

I've worked with two great PM's and a shitload of mediocre to bad ones. Technical competence, organization, willingness to work for a team of engineers, and humility is what it takes.

The military calls it "servant leadership." They teach classes in it.

Ideally, the military has lots of servant leadership but in reality it does not.

Oh, and bless the good PM's, they're worth their weight in gold. The mediocre ones might as well not be there. The bad ones are actively destructive.

<comment> trevor-e The best product managers in my opinion are hands off. All too often I see PM's micromanage every little detail of their product instead of letting the engineers/designers (the experts) do their work. IMO the PM should be involved very little in day to day things and instead focus their time on user research, new features, feedback, etc.

<comment><USER3> I wholeheartedly agree. Sadly I have seen (and worked) in organizations that treat their engineers like they have zero creative thinking and merely use them as glorified typists.

I have had an inexperienced CPO ask me to pseudo-code JIRA stories for an engineering team. You can imagine that ask didn't go far...

</comment></comment></comment><comment><USER4> My experience: The organization was rigidly run which allowed good execution in the short run but blinded us to opportunities. So now the company is still around but all these companies that came afterwards exploited opportunities that we either couldn't see or wouldn't pursue and had much better outcomes. Also people saw this and left causing a talent drain. Reminds me of the saying that generals always fight the last war.

</comment><comment><USER5> I'm still convinced that a TV show runner might be a pretty good choice for running a software project particularly if they have experience with FX. I think they would get the creative part of the process and understand the business end.

</comment><comment><USER6> > There's a whole checklist Patterson looks for whenever he makes product > hires...

One of my main frustrations with non-technical PMs (chefs and soldiers probably apply, but not always) is when they aren't actual experts in the software business, in the business of code. There are Dunning Kruger effects in play.

The usual response is "find the smart people and listen to them" but hopefully everyone on the project is smart, in which case the advice isn't actionable. And the Dunning Kruger effect is a huge deal when trying to find the people that are specifically great at technical strategy.

Another response is to find a more objective way to find the best technical advice, whether through metrics or less specific track records. But building a good software product is complex and time-consuming enough that you get very few data points to work with. Sometimes the negative effects of bad decisions (massive technical debt, intractable legacy systems, retention problems, etc.) are indirect or won't really be felt until at least some of the personnel on the project has moved on.

A specific concern that a non-technical PM will underestimate is tooling. Unsupported dependencies, old language versions, old compilers, mostly broken IDEs, undersized build farms (if they exist), and so on typically happen when the people making strategic decisions can't code, or at least haven't coded lately. It's not always easy to know when to buckle down and fix something like that, but I often see equivalent (organizational-value-wise) feature work getting star treatment.

</comment><comment><USER7> So the biggest problem is slackers? That is why they make great PM's? What a joke.

> Making good decisions quickly isn't the only quality PMs need that military > or kitchen experience instills.

How can you make good decision unless you have intimate knowledge of the problem area. And to do that, you have to have come through the ranks.

What would a chef or military personal (depending on what they were doing) know about spinning up extra servers, choosing to go to cloud, or what scope to cut in a mobile app?

<comment><USER8> I couldn't agree more.

The worst project managers I've worked with have been keen on deadlines without understanding what they're asking for. They're more interested in schedules than understanding the details of the project.

The best project managers are ones that either know the domain inside out or are good at getting the best out of people (and that doesn't mean acting like a slave driver). I've never met one that had both, but I can imagine they aren't short of money.

<comment><USER9> The surprising thing about project managers who use the phrase "when-will-it- be-done" far too much is that they're often willing to help you with getting resources and getting help/cooperation "across silos" if you ask them in the right way.

They want the project to progress. Desperately.

From their point of view they're often powerless people surrounded by line workers that don't want to interact with them, yet they're somehow responsible for the success of the project. They're acutely aware that the meetings are often pointless for workers, deep inside, they know that coloring red/yellow/green rectangles on a gantt chart is of little value.

You can use that to your advantage if you make a request and frame it such that they can advance your progress concretely by helping you in some way that isn't possible for you to do alone.

<comment><USER10> In my opinion, those are PM who are incompetent because they can't pull and affect those people around them to come to an agreement that everyone is ok with. This type of PM (which is everywhere) is afraid of confrontation to their superior and often can't ask the right questions of their peers and ultimately pull the right resources (in or outside companies) to help out the rest of the team to move faster or done things right.

</comment></comment></comment></comment><comment><USER11> this piece literally tells only half the story — the execution part.

what makes a great product manager is the raw product level insights and instincts that very few individuals have about the product itself and the direction the world is actually moving in.

this is basically the conjoined triangles of success kinda BS.

<comment><USER12> I think it really depends. If you have a visionary at the top (say the CEO, CPO, VP of product etc) then you just need good colonels and lieutenants below. If you're relying on bottom up innovation (e.g. Google's 20% time) then you absolutely need a different set of skills.

</comment></comment><comment><USER13> Every time I see a PM related post I always think back to [https://www.khoslaventures.com/wp- content/uploads/Good_Produ...](https://www.khoslaventures.com/wp- content/uploads/Good_Product_Manager_Bad_Product_Manager_KV.pdf)

</comment><comment><USER14> As someone who has cooked at the Michelin level in NYC I just wanted to say thanks to the author(s), whoever that may be, and to the OP for sharing.

This came at the right time. I'd been reminiscing about my kitchen families across the country all week.

I also normally take my restaurant experience off of my resume but maybe I'll try putting it back in.

</comment><comment><USER15> I don't think the skills translate from a kitchen in the manner described. No doubt being in a kitchen environment is demanding, requires rigorous prep, can be high pressured, is high energy etc. These are attributes of the environment though, not the people within it. New people who enter the environment just adapt to it.

Having worked in tech and as a cook, being in an office environment can be draining and torturous and could turn Gordon Ramsey into the worst slacker. This is also due to attributes of the environment, and not the people within it.

If you want the personal attributes described (ability to work under pressure etc) then seek them from people within the corporate world, e.g. people who do field sales, because at least then there's a chance that these skills will remain.

</comment><comment><USER16> > Both the military and professional kitchens are environments where there's > zero tolerance for slackers and indecision

I'm fairly certain the military would be surprised to learn they lack slackers and indecision.

<comment><USER17> Yeah totally. Also the fact that people in military command authority by structure. Try doing that as a PM and you will immediately piss off all your XFNs and, in general, build an inferior product.

I think what these articles lack is that being a good PM is more about the process vs. what one knows. A good cook, for instance, would generally have intrinsic knowledge about flavors, cuisines, preparation, plating etc. The more the cook knows about these areas the better she is and would command respect. PMing, on the other hand, has very little to do with the domain of the area you are working on. It is more about the process you use to figure out the following - building out a long term strategy for the area you are working on, breaking down the strategy into smaller parts and prioritizing those, working with and convincing your eng, xfn & leadership team that what you have going is the right thing, being very data driven to figure out what is working and doubling down on it, focussing on a market which is large enough but where you are differentiated etc.

I am not saying a cook or military person can't do that but I would be cautious to generalize.

<comment><USER18> Tangent: What's an XFN? (Google and Wikipedia don't seem to provide plausible answers, and I'm pretty sure you don't mean "XHTML Friends Network"...)

<comment><USER17> Apologies for not being clear there. XFN means cross functional teams (design, research, product marketing, analytics, sales etc.) in my comment above.

</comment></comment></comment></comment><comment><USER19> In my experience, hiring enlisted folks has been super successful (especially coast guard veterans), while hiring commissioned officers has been, with one exception, poor. I'm referring to officers with substantial careers in the military, not ROTC folks who put in their time and bugged out.

This is despite the fact that given my background I know more commissioned officers than I do enlisted folks. I assume this is simply that to be successful in the military you have had to adapt to a bureaucracy and structure which is radically different from the business world _I_ live in. Certainly the risk/reward calculus is different. I am not trying to imply they are idiots.

</comment><comment><USER20> I won't hate too much on this article, but in my experience, the question always comes down to "How do you get there?"

How do you get to "being able to lead without authority"? How do you get to "always taking blame while giving credit away"? And so on.

By practicing, and making mistakes along the way.

Something that most corporate policies / deadlines don't accommodate.

Maybe the question companies should ask themselves is, "Why would someone whose qualities make them a good PM want to work for us?"

Good luck with that.

</comment><comment><USER21> Survivorship bias anyone?

"I hired a chef and military person and they performed well as product managers. Let's see what conclusions I can make..."

</comment><comment><USER22> I would add to that oil and gas project managers. When I moved to SF from Dallas I was astounded how little Product Managers assessed resource costs + risk to value. I get that it's a different world with different objectives but there were clear moments in the SV where some good old fashion blue collar project management would have made a significant impact.

<comment><USER23> Isn't the article about product managers, though?

</comment></comment><comment><USER24> Whenever there is a discussion about why there are a lot of bad examples of {{insert job description}} my bubble radar goes off.

</comment><comment><USER25> Usually I enjoy articles from firstround, but this article is kind of clickbaity. I see what they're getting at here but if their claim that chefs and soldiers make the best product managers is true... then most PMs be would be former chefs and soldiers.

</comment><comment><USER26> "Self reliant and a team player" \- that's what I think makes the best managers and what I strive for and this alludes to that idea. I can see the "chefs and soldiers" analogy. Independent within in a team in that you can take on a role when needed and run with it but always work within the confines of a team when available. I like it.</comment>


Exploring APIs of Knet.jl and Flux.jl in Comparison to Tensorflow-Keras - <AUTHOR> https://estadistika.github.io/julia/python/packages/knet/flux/tensorflow/machine-learning/deep-learning/2019/06/20/Deep-Learning-Exploring-High-Level-APIs-of-Knet.jl-and-Flux.jl-in-comparison-to-Tensorflow-Keras.html <comment><USER2> Wow, the training time difference is much larger than I thought it would be. The main reason I use Flux.jl is because of its flexibility to just throw existing Julia libraries into it (DiffEqFlux.jl for neural ODEs, neural SDEs, neural PDEs, neural jump diffusions, etc. took surprisingly little work). However, I assumed that the CPU kernels would all be relatively comparable between the different neural network frameworks. This is a quite a compelling example that, at least for small neural networks and little data, the overhead can be quite large (quite large as in 10x!).

As the size of the neural networks grow this will fade away due to spending more time in the BLAS kernels. However, for non-standard applications which don't spend their time mostly in a neural network (like many neural differential equations according to our profiling), this difference would make or break an application.</comment>


When She Ain't All Apples - <AUTHOR> http://www.agworld.com.au/2012/03/when-she-aint-all-apples/

<comment><USER2> "Of the 1600 IT buyers surveyed, 22% said they would be purchasing a tablet for their employees. Of those, 84% confirmed they would be buying Apple's tablet; iPad 3."

So what happens next summer when iPad 4 comes out? Do you toss them and get new ones?</comment>


BitIodine – Get more from the blockchain - <AUTHOR> https://bitiodine.net <comment><USER2> Great Idea. Unfortunately, the server seems to be unable to handle the load.

<comment><AUTHOR> Backend is up again, sorry :) .

</comment></comment><comment><USER3> This is some great work! As part of a school assignment a few years ago, we just barely scratched the surface of block chain analysis [1]. We stopped at loading the block chain into Neo4j, scraping public internet forums for donation accounts, and making simple visualizations. It's cool to see the idea taken so far.

[1] [https://plus.google.com/109389788036578433900/posts/hvhwFcp3...](https://plus.google.com/109389788036578433900/posts/hvhwFcp3Hdd)

<comment><AUTHOR> I wish I had seen this earlier! :) Thank you!

</comment></comment><comment><USER4> Apparently chemistry names are the new hot trend for startups. This is the third on HN within the last week. It's a pretty good idea though because the names sound like what they do; naptha makes sense as the name for an image extractor since naphtha is used for doing quick and dirty extractions while making drugs, iodine makes sense here because it's used to bring out more detail in samples when doing microscopy, etc.

<comment><USER5> Except if your target customer isn't a chemist.

<comment><USER6> It could potentially increase awareness of chemistry, the dangers of dihydrogen monoxyide not withstanding.

</comment></comment></comment><comment><USER7> I believe the word that OP was looking for in his title was "block chain". Not "blockchain".

Blockchain is the company name of one of your competitors.

One of the speakers at the Toronto Bitcoin Expo corrected his own slide during his own company's presentation concerning this matter. It was quite comical.

<comment><USER8> Unfortunately quite fuzzy due to that ridiculous website. I wish they hadn't done that.

<comment><USER7> And I wish I was the guy who first thought to buy blockchain.com back on March 8th, 2011.

It was certainly a wise business move.

</comment></comment></comment><comment><AUTHOR> Thank you extrapolate and ajaimk! Yes, the backend is suffering a bit - but it will be back in a few minutes.

This is just a very limited demo of what BitIodine can do! For more info click on "About" or wait till new features ("Get insights") make it to the web interface.

</comment><comment><USER9> Do you store the block chain in a SQL database as well as neo4j? If so, what SQL database are you using? I've written a tool that stores the block chain in PostgreSQL but INSERTs are getting a bit slow due to indexes. Maybe we could share notes...

<comment><AUTHOR> I am using SQLite (yeah) for blockchain data and the C++ LEMON library for in- memory graph operations. Every module is able to update incrementally.

</comment></comment><comment><USER10> Very interesting work. I might suggest you remove the `target="_blank"` from the links — if people want new tabs they can do so quite easily.

<comment><AUTHOR> You're right, done except for the footer! Thanks for your input!

</comment></comment><comment><USER11> Neat tool. I think it could definitely be enhanced with some visuals though, maybe on the cluster page you could graph related addresses or something.

</comment><comment><USER12> Very cool. Are you able to compute the shortest paths on fly?

<comment><AUTHOR> Yes, computation is done in memory and is reasonably fast, with some clever caching. Right now the backend server is overloaded - I am working on it and you will be able to try it with custom addresses very soon.

</comment></comment><comment><USER8> The terms on your website don't really mesh with the actual behavior of the blockchain. There is no "from" address, there is never a "from" address.

<comment><USER9> In this context, I believe the "from" address would be TxOuts which use a pay- to-pubkeyhash script.

<comment><USER8> That's not "from" an address though.

<comment><USER9> Why not? TxOuts are spent when creating new transactions, hence the "from".

<comment><USER8> "From" implies to users that _every_ previous output is owned by a person, is controlled by a person, or is even an address. None of these are always true (though they usually are), which leads to disasters like people sending "refunds" to shared addresses. It's not a concept in the reference client and should be avoided to prevent more confusion than blockchain.info has already caused.

If I spend a script with no hash160/p2sh address, where is it "from"?

<comment><USER9> Ah, I see your point now. I agree it can be confusing to a non technical audience but presumably, this tool is for people who have prior knowledge on how the block chain works.

<comment><USER8> It's probably best to avoid using the term anyway. Blockchain.info should really only be a technical tool but non-technical people seem to insist on using it and misunderstanding it.</comment></comment></comment></comment></comment></comment></comment>


Damn Vulnerable Node Application - <AUTHOR> https://github.com/quantumfoam/DVNA/ <comment><USER2> Seems to be a bunch of Express apps rather than a single application. Many just take arbitrary input from requests and do things on the shell. I'd hope (maybe I'm wrong) that most people are already aware that executing arbitrary user input is bad. See [https://github.com/quantumfoam/DVNA/tree/master/vulnerabilit...](https://github.com/quantumfoam/DVNA/tree/master/vulnerabilities)

</comment><comment><USER3> I was kinda hoping for node specific vulns. This does not seem to cover more than DVWA, WAVSEP or any other test suites/intentionally vulnerable web applications out there.

<comment><USER4> I just wrote PRs for two node-specific vulnerabilities:

[https://github.com/quantumfoam/DVNA/pull/14](https://github.com/quantumfoam/DVNA/pull/14) [https://github.com/quantumfoam/DVNA/pull/13](https://github.com/quantumfoam/DVNA/pull/13)

Let me know if that's what you had in mind.

<comment><USER3> I know very little node.js, but by the looks of it that is exactly the type of vulnerabilities I would like to see in a project like this. Kudos for the PRs.

</comment></comment></comment><comment><USER5> Well, skimming the vulnerabilities [1] didn't really see anything too interesting. Consider this "eval_remote" vulnerability:

       var e = require("express");
       var DVNA = e();
       DVNA.get('/', function(req, res) {
         var res = eval("("+req.query.e+")");
         res.send('Parameter eval():<br> ' + res);
       });
       DVNA.listen(6666);

Yes, if you eval your requests that is a vulnerability, but it is a trivial one. I was expecting some side-channel esoteric stuff that, reading the code, you wouldn't necessarily see the problem.

1 - [https://github.com/quantumfoam/DVNA/tree/master/vulnerabilit...](https://github.com/quantumfoam/DVNA/tree/master/vulnerabilities)

</comment><comment><USER6> Reminds me of Damn Vulnerable Web App ([http://www.dvwa.co.uk/](http://www.dvwa.co.uk/)) which my friend made whilst we were at university.

</comment><comment><USER3> the OWASP Broken Web Applications project (owaspbwa) is worth mentioning in this context. It's a collection of vulnerable web applications for web security training, demonstrations and testing. It can be downloaded as a VM from [1]. I don't have a lot of faith in sourceforge, but it seems to be the official source.

[1]: [http://sourceforge.net/projects/owaspbwa/files/1.2/](http://sourceforge.net/projects/owaspbwa/files/1.2/)

</comment><comment><USER7> It's beta, so don't put this in production (yet)!</comment>