Ask HN: Does anyone investigate open source packages before using in prod? - <AUTHOR> I'm curious to hear if anyone else does any due diligence before using open source packages in production? Not anything major - just checking for recent commits / activity, issue logs, etc. <comment><USER2> It's interesting to see so many people here checking the code of all their open source packages, so here's my take on it as a security consultant:

No, most people don't, they even have a hard time keeping library versions up to date.

<comment><USER3> Do you have a pragmatic approach that you typically recommend, considering that (without version pinning thousands of packages) anything could change from one day to the next? (even if a package was "good" today, it could turn "bad" tomorrow)

The best I've been able to come up with is to pick things that have minimal dependencies of their own. It doesn't eliminate the threat, but it does at least reduce it.

<comment><USER4> IIRC there is some kind of SaaS solution for this but right now I can't recall its name. Maybe someone else here knows?

Edited: I reached out to some security people and it seems like the following are popular tools for this use case: Snyk / Dependabot / Whitesource.

<comment><USER5> Github have a security check that scans your repo's dependencies and warns you about vulnerabilities too

</comment></comment></comment></comment><comment><USER6> Yes.

If you work in a secure environment or support critical infrastructure there are teams whose sole purpose is to approve/deny releasing software regardless of who wrote it. Such teams will typically require source code, written justification, senior management signed approval, and test validation. In the case where source code is not provided, such as closed source commercial software, the vendor will be required to accept liability for all losses due to their software as ratified by a signed contract.

</comment><comment><USER7> I normally read a good chunk, if not all of the code of a dependency before I add it to my projects except in the case of community standard things (in Ruby) such as ActiveSupport or Sequel. Going over a prospective dependency a few months ago bore fruit in proving why you should always do this. NewsAPI is a neat little API for fetching news whose docs just so happen to show a ruby gem. Being the lazy developer I am I'd like to use the gem than build another API client, but before I did that I read the source as one should. Low and behold what do I find but the evil eval in the code for a dirt simple API client. No thanks.

[https://github.com/olegmikhnovich/News-API- ruby/blob/master/...](https://github.com/olegmikhnovich/News-API- ruby/blob/master/lib/news-api.rb#L47)

<comment><USER8> Is this malicious? I'm honestly curious, as I don't have much experience still in the field. my answer to OPs question is NO , but I'd like to grow.

</comment></comment><comment><USER3> This article might be of interest:

[https://medium.com/hackernoon/im-harvesting-credit-card- numb...](https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and- passwords-from-your-site-here-s-how-9a8cb347c5b5)

</comment><comment><USER9> I am paranoid about security of all those packages, so yes, even before just downloading, I check the authors, activity and read the source code. Not always – e.g. I skip the source code if it's something big AND very reputable AND I decided that I need it such as scala/scala or facebook/react – but I do my best.

It's very annoying, it's not free, and it affects what kinds of libraries I use. My projects have fewer and smaller dependencies than typical because of these self imposed constraints.

On the upside, borrowing a pattern or a dozen lines of code instead of pulling a dependency that will remain 90% unused is really underrated. As is understanding how things work under the hood.

<comment><USER10> > My projects have fewer and smaller dependencies than typical

Taking a look at your at your github projects and build.sbt... this is quite an understatement.

<comment><USER9> Haha well tbh I just didn't feel the need for more deps in such libraries. It's a tougher choice in application code!

</comment></comment></comment><comment><USER11> I would be surprised if anyone has enough resources or willingness to do that for every open source package they are using. For companies that go through auditing, they can CTA by relying on products like Nexus IQ.

</comment><comment><USER12> Yes, in depth. Not just the packages but their dependencies as well.

<comment><USER5> Really? What about all the dependencies from those dependencies?...

For example, our company is working on an app that has 82 npm dependencies and over _17,000_ resolved npm packages...

It's absolutely ridiculous to investigate all of them... but it's also necessary if you want to be sure...

<comment><USER12> > Really? What about all the dependencies from those dependencies?...

Yep, all the way to the end.

I got the idea from a book called "Hollywood Secrets of Project Management Success" by James R. Persse. It's two books interleaved really, one is just a standard pitch for Agile methods (IMO), but the other is a presentation of the process that large film studios use to make movies. The movie industry is ~100 years old and mostly very good at bringing in projects on time and under budget.

Somewhere in there he talks about how they'll track their dependencies in a kind of "portfolio", I forget the details, but it translates in IT to a "dependency portfolio" and you would (if you're large enough) have an actual "Deps Dept." and a Deps Manager whose sole job is tracking dependencies and their updates and patches, etc.

> working on an app that has 82 npm dependencies

Ach! Well, see, there's your problem right there. :-)

Seriously though, one of the benefits of a dependency portfolio is to help you know when your system has gotten out of hand. The problems are still there even if you don't look at them, eh?

> It's absolutely ridiculous to investigate all of them... but it's also > necessary if you want to be sure...

Ya feel. ;-)

<comment><USER5> Thanks for the response, that's an interesting way to deal with it. How do you verify a dependency? Do you literally examine the source code? Make sure the build is reproduced? or just the meta data? (downloads, stars) has the portfolio actually prevented any vulnerabilities?

It's pretty common for JS projects to have thousands of transitive dependencies, I'm not sure keeping a private portfolio is much use. The entire open-source ecosystem is built on the foundation of trust, if I use a package that's being used by 500 other packages, I can have a high degree of certainty that the package is safe, and by locking the dependencies with yarn.lock I can prevent sneaky updates from entering the system.

Anyway maybe I'll look into the dependency portfolio, see how it goes.

<comment><USER12> Cheers!

> How do you verify a dependency? Do you literally examine the source code?

Yeah. It's part of the overhead of using the software. You also look at the history of bugs and how they were handled.

> It's pretty common for JS projects to have thousands of transitive > dependencies

Yeah, I know, and it's bonkers IMO.

> The entire open-source ecosystem is built on the foundation of trust

In practice, yes, but in theory, no. The whole idea is that you get to see the code you're running, because the guys who wrote it are clowns. Free Software started when RMS wanted to fix his printer and Xerox said, "No."

> if I use a package that's being used by 500 other packages, I can have a > high degree of certainty that the package is safe

I think history has shown that that reasoning is at best probabilistic, eh? You're gambling.

Now, of course, there are limits. Some things get a pass. Do we audit the source of the bash shell? No, despite the fact that it's maintained by a single volunteer.

> Anyway maybe I'll look into the dependency portfolio, see how it goes.

Check out that "Hollywood Secrects" book I mentioned.

<comment><USER8> Thanks for sharing. It would be very interesting to know some of the examples when it payed off. Could you please share?

</comment></comment></comment></comment></comment></comment><comment><USER13> Doesn't everyone? That's one of the annoying parts of using other people's code. You have no idea how good or bad it is until you have thoroughly vetted it.

</comment><comment><USER14> These comments feel skewed. I look for activity and support. Reading the actual code is typically far from my mind.

The time-opportunity cost isnt worth it on average

</comment><comment><USER8> In my case no. But I tend to use the big guns. I'm willing to learn though

</comment><comment><USER15> Yes, if there are no commits at all I know I'm stuck maintaining it.

<comment><USER16> Or it could be mature and stable software that doesn't need constant maintaining.

<comment><USER15> Maybe, but then I'd expect a small number of bug fix commits. Most software never matures in that way.

</comment></comment></comment><comment><USER17> Sort of. By the time you choose the package that info should be known.</comment>


HN Idea: Hard limit 5 comments/day, 2/day for new users - <AUTHOR>

As the site grows, you lose signal:noise ratio.
So, perhaps setting a maximum number of comments per day would help keep comment quality high.
Perhaps 2/day max for a new user, and a limit of 5/day total regardless of age or karma? You would give up some good points, including the occasional good back and forth. But it'd cut off arguments and I think people would be hesitant to write a silly quip, "good post" noise, or argue/flame if they know they're using up their limited breath by doing it.
Personally, I'm for quantity over quality - I'd rather learn five interesting points across fifteen good comments than ten interesting points across 70 comments, less than half of which are good. There'd have to be some testing on the numbers, but experimenting with some kind of comment limits might help hold back the tides of mediocrity. <comment><USER2> Such limits are a HUGE source of annoyance to users who want to become deeply involved in an online community. I've been in communities with such limits, and in many communities without, and those without thrive better.

I will note that as long as karma is what the site rewards, and as long as it takes submissions and comments to get karma, there are considerable incentives here to submit and (especially) comment. Exactly how to adjust karma rules so that quality is rewarded along with quantity (as for example by downvoting comments) is an ongoing area of investigation here and on other sites with karma systems.

<comment><AUTHOR> Interesting - I guess a major issue is that any comment that's not terrible won't get downvoted, which encourages people to make more comments than less if they want karma.

</comment></comment><comment><USER3> -1 I would rather not. Sometimes arguments or inane remarks are an annoyance, but I would not want a good post because someone hit an arbitrary limit.

<comment><AUTHOR> I'm upvoting you and offering this scenario for thought: At some point, there's 10x as many users here as now. How important is signal:noise? I really enjoy the points I learn here, but after being present on the site for a touch less than half a year (lurking before starting an account), I've seen how the site growing is affecting the quality and it looks dangerously like something that happened slowly somewhere else I used to enjoy greatly.

I think the end result is that you _will_ miss good comments, because they're never made if the noise gets too loud.

That someplace else I used to greatly enjoy:

Compare "Facing Losses, German Billionaire Takes Own Life" <http://news.ycombinator.com/item?id=422284> to "German mogul kills self over financial meltdown" [http://www.reddit.com/r/business/comments/7nrxi/german_mogul...](http://www.reddit.com/r/business/comments/7nrxi/german_mogul_kills_self_over_financial_meltdown/)

I picked that quickly as the first thread I saw on both Reddit and HN, but the comments on that Reddit thread are actually many times better than average Reddit comments, perhaps because of the serious subject matter.

And - Old Reddit was close to as good as current Hacker News. Really. If you weren't there back then, it seems strange to imagine such a great place becoming what it did, but that's the reality. I don't want it to happen here, or we'll lose good comments - not to arbitrary thresholds, but to good posters leaving.

Really, how many times do people write more than five excellent comments per day? There's some cases of two people having intelligent discussion, or an author replying to questions in a thread. Not sure how we'd address those cases. But I'm theorizing if there was a limit, people would adjust to stop making wisecracks, argue less, and make less "fluff" posts instead of not making inspired points.

</comment></comment><comment><USER4> So what's wrong with the existing rating system?</comment>


Bitcoin From Scratch – Part 1 - <AUTHOR> https://monokh.com/posts/bitcoin-from-scratch-part-1 <comment><USER2> I wrote a toy (but working) implementation of the Bitcoin algorithm here: [https://github.com/tlrobinson/tomcoin](https://github.com/tlrobinson/tomcoin)

The main logic is a few hundred lines of code: [https://github.com/tlrobinson/tomcoin/blob/master/src/node.j...](https://github.com/tlrobinson/tomcoin/blob/master/src/node.js)

A somewhat unique aspect is since it's written in JavaScript a node can run on the server or the browser, which makes for easy demos:

1\. Open [https://tomcoin.herokuapp.com/](https://tomcoin.herokuapp.com/) and [https://tomcoin1.herokuapp.com/](https://tomcoin1.herokuapp.com/) in two browser windows (the private key is stored in localStorage so using different domains ensures each gets a different wallet)

2\. Click "Start Mining" on one or both nodes

3\. Once you've mined some TomCoin (should just take a few seconds unless more people start mining) copy the public key from one node to the other's "publicKey" field, enter an amount, and click "Transfer"

4\. Wait for another block to be mined and you should see the balances transfer

(There's no persistence so the chain will reset when all the Heroku nodes idle out and other nodes close)

(It also just uses WebSockets to connect to the instances on Heroku, or in theory other server instances people are running. I meant to implement WebRTC for P2P between browser nodes but never got around to it)

<comment><USER3>
        const {
          mine,
          sign,
          verify,
          hash,
          validateProofOfWork,
          stripTxSignatures,
          generatePrivateKey,
          getPublicKey
        } = require("./util");

What does this do?

And will this really run in a browser? I think brosers don't have require()?

<comment><USER4> Es6 destructuring- should run in most modern browsers although I'm a Es5 transpiler fan still!

<comment><USER5> Most modern browsers have require()? I thought they only have import?

</comment></comment></comment></comment><comment><USER6> > The PoW is suffice if the hash begins with a certain number of 0s

This is a common explanation of PoW, but is actually incorrect. If you think about it, this would mean that the PoW difficulty could only increase (or decrease) by a factor of two. In reality, the block hash is simply interpreted as a (very large) number, and this number must be less than some other very large number (the "target"). So you _do_ end up with a lot of leading zeros -- but these are just a side effect, not the thing being measured.

<comment><AUTHOR> (author here) Absolutely. Thanks for pointing this out. If difficulty adjusted in factors of two, the ability of the network to accurately maintain its 10 mins blocktime become impaired.

I try to keep these concepts rather simplified to ease the reading and learning process. Perhaps there should be a note for these situations.

<comment><USER7> In defense of the explanation, sometimes it's asking for an unnecessary mental leap of the reader to think of a bit array as a number, especially if the reader is not accustomed to thinking in base-2 or base-16 number systems.

<comment><USER8> The hash is just a number regardless-- surely no one has any problem understanding any other number in the protocol as a number! :)

<comment><USER9> Even this sentence is just a number.

<comment><USER10> Really it's not because it's a sequence of glyphs first and foremost. It can be mapped to a number though.

<comment><USER9> Nope, no mapping necessary. 36 octets, so a single 288 bit number in base 2. (Big-endian, unsigned, I guess) Then convert to any base you want.

(I should have probably used 32 octets so that it fits neatly in 256 bits)

<comment><USER10> Isn't that a mapping? Because the primary purpose of the string of glyphs is readable by humans. Such representation is mapped to the numerical representation for storage in the computer. It may also be mapped to lines of ink written on a piece of paper for transmission

<comment><USER9> Oh, in my example, it's just a coincidence that the number was readable by humans! Other numbers may come out as complete gibberish.

The "mapping" you may be referring to is happening outside and subject to how your brain /your browser interpret it. (How do you know that when I posted the comment, that I didn't supply the raw bits of the number?! ;-))

Anyway, it was just a joke for low level-programmers I guess. Have a good day ;-)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> For people that need or want to know (really understand) in depth about Bitcoin without any previous background in Computer Science (for example, in Finance, investors, journalists, historians, curious people in general) I have to recommend Ted Nelson's "How Bitcoin actually works" (2014) from his series "Computers for Cynics" [0]. I enjoyed it. (+)

[0] [https://youtu.be/3CMucDjJQ4E](https://youtu.be/3CMucDjJQ4E)

(+) For the people with background in CS: it might be that the video at some point talks about the number of zeros instead of the comparison, but really, it does not detract a 'bit' from its value.

edit: formatting

</comment><comment><USER12> Here is a simple bitcoin implementation in ruby including the networking for interested, that I did some time ago:

[https://github.com/oguzbilgic/zincir](https://github.com/oguzbilgic/zincir)

</comment><comment><USER13> Clear, concise and to the point. Looking forward to reading the rest. If you finish the whole series and fix/improve the posts in this sequence using the feedback from here, I think it might serve as one of the go-to pages for technically inclined people who are interested to learn about Bitcoin and blockchains.

<comment><USER14> Except they're polarising as hell. Expect someone to chime in and state how they are a complete waste of time and energy.

<comment><USER15> That's generally true. The trouble is that your post more or less does to the thread what you're predicting that people will do to the thread—the polarity of the high-order bit doesn't matter much. It's best to abstain.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER16> [https://github.com/lhartikk/naivechain](https://github.com/lhartikk/naivechain) is a rather decent introductory implementation as well.

</comment><comment> ur-whale Love this way of learning about tech. : build one yourself (the truly noble way would be to try and build without having seen the specs, just from a description of what it does, but that'd take ages).

However: when it comes to implementations, the real hard part of the whole Bitcoin affair is where the gnarly details hide, namely consensu, and it is missing at this point.

</comment><comment><USER17> Mining part is confusing for me. Is POW is essentially to achieve difficulty level ? You do in this while loop until you have achieved this difficulty level ? Is this the primary factor that differentiates having various protocol in crypto ?

<comment><USER18> Yes. Proof of Work is required so that there is a global limit on the rate at which new coins are created.

<comment><AUTHOR> It also:

\- Acts as the primary mechanism to make the data in the chain immutable, as the cumulation of the work (chain of valid blocks) becomes harder and harder to reproduce.

\- Anti spam, i.e. you need to put something at stake (electricity and hardware cost) to participate in the issuance and transaction ordering

</comment></comment></comment><comment><USER19> Please finish this series! Especially the networking and consensus models it's an interesting read, really like that it's in Rust as I'm also learning Rust so it's nice to see the concepts in that language :)

</comment><comment><USER20> > the transaction needs to be "Signed" by the `from` public key

Is that so? The code actually signs with the private key. Although I might have misunderstood what that sentence refer to.

<comment><AUTHOR> Thanks, that was a mistake. I've corrected it.

</comment></comment><comment><USER21> Thanks for this info Monokh. Just want to raise a minor typo, which is the first line of code in "Signed transactions". I think it's missing two of the map keys.

</comment><comment><USER22> I really like the intention and good will behind the post but almost every part is incorrect (even on an abstract level not restricting to bitcoin). I feel like OP is yet another someone who needed the keyword "blockchain expert" on his/her linkedin profile and trying to justify it now with misleading and incomplete information.

<comment><USER23> This is HN; you are supposed to point out (like some people have in this thread about the leading 000 count) the incorrect parts, providing some links or explanation why they are incorrect. Many people probably clicked here to learn something and so it's helpful to point out what they should be learning instead of this if it is 'incorrect'.

</comment></comment><comment><USER24> It would be nice to be told what programming language this page is using.

</comment><comment><USER25> Bookmarking this one.</comment>


The Gervais Principle III: The Curse of Development - <AUTHOR> http://www.ribbonfarm.com/2010/04/14/the-gervais-principle-iii-the-curse-of-development/on-trail/the-way-of-the-sociopath/ <comment><USER2> <http://news.ycombinator.com/item?id=1267202>

<comment><AUTHOR> Ooops, will check my URL is canonical before submitting in future!

<comment><USER2> No sweat. Strange thing is that yours _looks_ canonical - somehow the extra two levels produce the same page.

<comment><USER2> The hypothesis that the site was simply chopping off the extra levels and stopping at the last slash that produced a page was bugging me. Tested it out, but no:

"You 404'd it. Gnarly, dude." (with one extra level, [http://www.ribbonfarm.com/2010/04/14/the-gervais- principle-i...](http://www.ribbonfarm.com/2010/04/14/the-gervais-principle- iii-the-curse-of-development/on-trail/) )

<comment><AUTHOR> A better URL for ribbonfarm to have used would have been [http://www.ribbonfarm.com/2010/04/14/the-gervais- principle-i...](http://www.ribbonfarm.com/2010/04/14/the-gervais-principle- iii-the-curse-of-development?on-trail=the-way-of-the-sociopath/)</comment></comment></comment></comment></comment>


China's army says it will focus on 'preparing for war' - <AUTHOR> https://www.news.com.au/technology/innovation/military/chinas-army-says-it-will-focus-on-preparing-for-war/news-story/152c1ffab86257248670986c7287c911 <comment><USER2> Well, you know what they say about wanting peace.</comment>


A pilot project for a new floating city will have 300 homes - <AUTHOR> http://www.businessinsider.com/floating-city-plans-seasteading-institute-peter-thiel-blue-frontiers-2017-12 <comment><USER2> I surely may be wrong in my prediction, but the thing I'm most fascinated about by these libertarian settlement plans is when they organically reintroduce all the government systems they wanted to escape in the first place.

Child me was always excited for the day I could break away from the government (parents) and spend all my money on vices like snacks and video games. College me did that and learned the hard way what adult me now practices: a responsible need for the restrictions my parents imposed upon me.

I really like some of the ideas of libertarianism. I think it's a valuable counterpoint to strong government in a debate that should go on forever with no real right answer. But I think these libertarianism to the extreme ideas are, at their core, irresponsible fantasy.

<comment><USER3> Think about the metaphor you've made. In it, citizens are the "children" and need it's parents (government) to restrict their freedoms since they are not able to decide for themselves what is in their best interests.

It's not about wanting to be like a child who spends all their allowance on ice cream. It's about wanting to be an adult who is free to decide what is in their best interests for themselves.

<comment><USER4> He didn't give a metaphor. He said that he once wanted absolute freedom and then he grew up.

The notion of "heaven on earth" is a childish one, regardless of ideology.

<comment><USER3> > He didn't give a metaphor.

In that case, I'm finding it difficult to understand what Waterluvian meant by saying:

> Child me was always excited for the day I could break away from the > government (parents) and spend all my money on vices like snacks and video > games. College me did that and learned the hard way what adult me now > practices: a responsible need for the restrictions my parents imposed upon > me.

Are you saying Waterluvian's parents are literally the government? Why is Waterluvian talking about parental restrictions? If not relating it to governments restrictions on its people, isn't that a non sequitur?

</comment></comment></comment></comment><comment><USER5> I just read a great book about seasteading:

[https://www.amazon.com/Seasteading-Floating-Environment- Libe...](https://www.amazon.com/Seasteading-Floating-Environment-Liberate- Politicians-ebook/dp/B0176M400A)

It will be expensive at first but long-term, the social, economic, and environmental benefits could be enormous. It's not just about one little island.

Socially, the idea isn't so much to promote one particular ideology, but to allow experimentation with lots of different economic and governmental structures, in an environment where people can easily move to the ones that work the best. The book points out that similar conditions brought us the advances of ancient Greece and renaissance Italy.

Aquaculture on the open seas looks very attractive; the economics work out well and it's great for the environment. And small island nations with good access to shipping and lots of economic freedom have tended to do very well in general.

<comment><USER6> what makes you think they won't nuke those out of existence as soon as they become successful?

<comment><USER7> Why would you nuke them, that's (literally) overkill.

But I suspect its failure (to keep out international criminal orgs), not economic success, that gets them raided by traditional nation-states.

<comment><USER5> Nobody's raided the Cayman Islands yet. I don't know whether seasteads would end up being offshore financial centers, but plenty of island nations are providing all sorts of financial services to criminal organizations without significant consequences.

<comment><USER8> The U.S. Government forced the Cayman Islands to expose people using the Island Nation as a tax haven, thus negating the benefits of the islands and large parts of the clientele have gone elsewhere. Since these are only expected to be a half mile offshore they are going to end up being subject to whatever nation-state they are offshore of. Were they to try this in the deep ocean I suspect rogue waves would be an issue. Either way this isn't likely to succeed politically, although I see no reason why technologically it wouldn't. It's more likely going to end up being a playground for the ultra wealthy to sometimes visit and say they have property on.

<comment><USER5> It could end up being a wealthy playground, but the people doing this stuff would consider it an utter failure if that's all they accomplish. What they really want to do is sequester billions of tons of carbon, provide billions of tons of food, and provide an economic opportunity for a billion of the world's poor.

I think whether that's possible depends mostly on how cheaply these things can be built at scale.

</comment></comment></comment></comment></comment></comment><comment><USER9> Did anybody else catch the part where this group is already selling cryptocurrency?

Looks like yet another ICO scam to me.

<comment><USER5> I would assume it's a scam if I hadn't read the book. There's a fairly large seasteading community, with a bunch of companies, real experiments, conferences, etc. The people behind this project are a major part of that.

</comment></comment><comment><USER10> Why are there so many people posting in this thread who seemingly want this project to fail? What do you have invested into it failing? To me this seems like a cool experiment, why not try it out?

</comment><comment><USER11> The best thing about a sovereign seastead is how any properly equipped Real County(tm) will roll up in a boat and just blow it away. It's like barbarian cities in Civ, essentially.

<comment><USER12> Unless they start doing stuff that is crime on the neighboring countries, I don't see why any of them would bother.

But they better have some protection against piracy.

<comment><USER11> Committing crimes is the basic activity of Libertarians. The point of getting rid of the rules is you want to do the things that are against the rules. If the other countries still have the rules then you have conflict. Especially considering one outcome of the Libertarian philosophy is pollution of air and water is to be prevented not by regulation but by the self-interest of the person who owns the air and water. If that person takes leave of their self- interest and starts dumping toxic waste into their personal water property, Libertarians have no solution to that pollution. And the neighbors are going to be mad.

<comment><USER5> So an easy defense is to avoid dumping toxic waste on your neighbors. I don't see why people assume seasteaders will be idiots.

Meanwhile coastal cities are dumping all sorts of waste into the oceans. Some of the seasteaders want to build offshore of those, and use forms of aquaculture which would clean up that waste.

<comment><USER11> Unfortunately pollution is not easily reversed. It's easy to say that if someone pollutes your water you'll sue them, but in reality it's unlikely that you'll be able to recoup your damages; pollution is often irreversible and the other guy doesn't have any assets anyway. Example: Libertarians love to hate RoHS and other lead controls. But one standard bar of lead is enough to poison tens of millions of people. Much better to prevent that, hence regulations.

You're right that coastal cities pollute. Large groups of people can make decisions as badly as small groups and individuals. It's an unsolved problem.

<comment><USER5> You just said upthread that rather than relying on lawsuits, nearby countries would "roll up in a boat and just blow it away" if a seastead polluted. If you're right then the seastead has a pretty good incentive not to pollute; if you think now that you're wrong then we have nothing to argue about.

In any case, for a long time the main industry for seasteads will be open- water aquaculture, which is completely nonpolluting in experiments so far, and able to clean up the excess nitrogen and phosphorus from agricultural runoff and coastal city waste.

</comment></comment></comment></comment></comment></comment><comment><USER13> Floating city projects seem to conceptualize themselves as "buildings, but on water". Seems ineffective to me.

An armada of ships strikes me as the cheaper and far more practical approach.

<comment><USER14> Snowcrash describes pretty well how a set of boats/ships would work for creating an independent society.

<comment><USER15> Of course that society existed only to break up and emigrate, it was hell on Earth, it requires an aircraft carrier as the center, and it was planned and executed by a mad billionaire with ambitions of world domination.

<comment><USER8> While President Trump may not have billions, he does have multiple aircraft carriers at his disposal and would love a place to put all the immigrants. I would suggest keeping the book away from Fox News or they may give him the idea.

</comment></comment></comment></comment><comment><USER16> Always found seasteading to be strange solution given the three poles of a) taking over the government or emir-ship of an existing island, b) building a geographically independent trading network not unlike a mafia or narco- paramilitaries with some anarcho-hedonist themed cruise ships, and c) starting a cult where converts do business with each other and resolve disputes using a ritualized parallel legal and taxation system.

Given these obvious precedents, it's difficult to see the problem seasteading solves.

<comment><USER7> Seasteading solves the problem that (1) requires and (2) and (3) historically have provoked conflict with the armed (military or law enforcement) forced of existing nation-states they seek to displace or operate within.

Seasteading doesn't obviously share that problem yet (which may just be because it's not been done enough and at large enough scale for have provoked notable responses.)

</comment></comment><comment><USER17> I had to close the article when it claimed the floating city will solve one of the worlds biggest problems - rising sea levels. Really?! Solve?! Is that supposed to be a joke? Just another ICO scam in time for their presale. No wonder Thiel has distanced himself from this garbage.

</comment><comment><USER18> The previous step to Rapture.

<comment><USER19> TBH, I can imagine an Ayn Rand inspired city to be pretty interesting.

<comment><USER20> Would an Ayn Rand inspired city reject states and promote individualism for decades, then finally accept help once it starts to fall apart?

</comment></comment></comment><comment><USER21> [http://inthesetimes.com/article/3328/floating_utopias/](http://inthesetimes.com/article/3328/floating_utopias/)

</comment><comment><USER22> Seems to me that they would be highly vulnerable to a hurricane (or tsunami).

There is no redundancy in such a concentrated piece of land.

Puerto Rico was (more or less) helped by the US government. Who will help these people?

<comment><USER23> Why is it that something like this brings people to act like it has all sort of unique problems that haven't been confronted dozens of times already?

How does French Polynesia deal with tsunamis? They have an alarm system and advise people to get to high ground.

On something like this, since it is all construction, you could also build barriers around it to minimize a tsunami.

<comment><USER22> I wasn't worry about the people, presumably in this day and age they would have ample warnings.

But who will pay for the cleanup operation, if there is no nation state to fall back to?

<comment><USER23> Why would it be devastated if it was designed for it in the first place? Why is it that you think tsunamis destroy every country they hit? French Polynesia has actually been hit by tsunamis before, you just don't hear about it because it isn't eventful.

Also Puerto Rico was hit by a strong hurricane, not a tsunami. It was also already 100 Billion dollars in debt and had recently defaulted.

Also how do you think neighborhoods of 300 houses already deal with natural disasters? Do you think their only option is to rely on aid from a 'nation state'? They get insurance.

It may be a far out idea with many problems that would have to be accounted for but lets use our very best judgement.

</comment></comment></comment></comment><comment><USER24> Where does the garbage and sewage go?

A few of the main functions a city provides is collecting garbage, and treating sewage. I don't see a word about them in the Business Insider article. Are there details elsewhere?

</comment><comment><USER25> I am not rich, but I can imagine living in such city and enjoying it. Amount of $60M, or even $120M doesn't sound something that should be hard to collect.

I imagine this being organized like Singapore, but looks like Dubai. I also don't think it is enough to just plop it somewhere, there should be thought on how it will function, what are benefits. Can it be place where superstars go to relax for example. Selling them 2M homes would be easy. It can be place for startups and conferences. I feel like more thought should be placed into this.

I think crypto makes sense for such project, but obviously potential for abuse are huge.

Obviously, one tsunami and this thing can be in serious trouble.

Again, given a chance to live there, or at least to spend some time and work and live there, I would take the chance.

</comment><comment><USER26> Doesn't pass my sniff test ... sounds expensive and who will pay for it test

</comment><comment><USER27> Have never heard of a seasteader that had actually spent significant time out on the open ocean.

</comment><comment><USER28> It sounds like every nightmare City from Bioshock.

</comment><comment><USER29> > Libertarian

> with its own government

What?

<comment><USER30> Libertarian governments are the bare minimum society finds acceptable. A libertarian government would maximize freedom and autonomy and only create laws to restrict directly infringing on other citizen's natural rights and freedoms.

<comment><USER31> Are there any practical examples of this theory?

<comment><USER32> The Somali government, for one. They don't have enough money for social programs or building inspectors, but have for the most part kept other governments out.

<comment><USER33> Not at all. Somali just has many different governemts fighting against each other.

<comment><USER34> I would argue that tribal leaders and mini governments form organically under systems with no or bare minimum government.

Make no mistake. Small Governments in somali fighting each other is the result of the initial establishment of minimal government. There was no grand plan of warring governments establishing checks and balances.

</comment></comment></comment></comment></comment></comment><comment><USER35> I'mma go watch Waterworld again

</comment><comment><USER36> I just want to mention that seafaring is the closest we can get to libertarian lifestyle. Even when due to the flag of your ship you are bound to a nation somehow, yet there is much more freedom than anywhere else. For example, your ship can be build entirely up to your standards and wishes, while a car or airplane is regulated down to the smallest part.

</comment><comment><USER6> It's sad that libertarians / ancaps are bullied out of the real world to do their experiment. These kind of experiments should be done on land.

<comment><USER37> > It's sad that libertarians / ancaps are bullied out of the real world

Uhuh. Though they just call that "thinking".

There is no "real world" form of utopianism. It's a dangerous adolescent form of thinking which requires purifying one's environment until it is All Good according to a single set of criteria.

All society-level attempts at this measure their results in millions of deaths.

<comment><USER6> By that standard we should have stuck with absolute monarchy. (you might want to think it over. I 'm sure the ancient romans said the same things, as did imperial russia)

<comment><USER37> Every change which has occurred has never resulted in a single pure ideology characterizing a civilization.

All change is plural and incremental, even so-called "revolutions" really just exchange the set in power for another set. They leave the plurality of really- existing power structures in place, whilst disturbing only a small number.

This is simply an incremental shift in power at the very top.

Utopian projects take pluralities of lifestyles and pragmatic political systems and attempt to unify them under a single consistent set of criteria.

It's something for the mind of an adolescent, to which this mode of thinking is common.

<comment><USER6> libertarians leave capitalism intact. You can say that government delegates is "a small number".

<comment><USER37> There is no "capitalism".

Society cannot be characterized by a coherent set of ideological principles. It is the behavior of human beings, which is highly plural and inconsistent when formalized.

There is no ideology to "leave in tact". By destroying the government you do not "uncover" some latent capitalism, you take the ways everyone is behaving -- have them repeat that behaviour -- but now without a government.

You'd find that to be a catastrophe.</comment></comment></comment></comment></comment></comment>


"Is PayPal good for your microISV business?" A short PayPal horror story - <AUTHOR> http://blog.apparentsoft.com/business/124/is-paypal-good-for-your-microisv-business-a-short-paypal-horror-story/

<comment><USER2> I've had similar problems with Paypal accounts in the past too.

Although it's an absolute joke I have found they only respond to formal legal threats. At one point they limited my account, with a couple of grand in it, in the same way (nothing in, nothing out, wait 180 days). So I sent them a letter basically saying "release my money or your staring down the barrel of a legal gun" and listed a whole load of lost earnings, recompense etc. I "would be seeking".

For the most part it was empty threats (I could probably have sued - but had no cash to do so) but someone actually rang me the day it arrived; never mentioned the letter but "a standard review of closed cases highlighted mine for reopening"...

It's idiotic.

<comment><USER3> It's actually not so terribly dumb. The point here is to prevent fraud. People who take the time to credibly threaten legal action are, I strongly suspect, much less likely to be engaged in fraud. Real criminals would just walk away from the cash (lest they attract more attention) and put up another site on another PayPal account.

It's more than just squeaky wheel syndrome -- PayPal is using the context of your communication to determine who you are.

Whether that's ethical or not is a separate question. But it seems logical to me.

<comment><USER4> sure, but it also cripples small businesses who don't really know any better. not every small-time merchant will have the wits about them to present legal threats.

<comment><USER5> Dunno, a legal threat is the first thing that came to my mind. I don't see a situation where someone collects money from your customers and refuses to give it to you any different from someone walking into your home, smashing your piggy bank, and taking your money. The second case is obviously a crime, so it follows that the first is too. When you are a victim of a crime, negotiating with the criminal seems like a bad idea. Getting a lawyer (or the cops) involved seems like a good idea.

So if I lost my "appeal" at PayPal, I would involve the real legal system, instead of their made up one.

(OTOH, if the OP got all his money back, then he was not necessarily wronged. Banks can refuse to do business with companies they are unsure about.)

<comment><USER3> Not to nit too much (because I think this is exactly the right thing to do) but threatening to sue someone isn't the same thing as accusing them of a crime. If someone is tried for larceny, the point is that they are punished by the state to deter future crimes. The goal is not to return the stolen property to the owner; that's what a civil suit is for.

And indeed, in the business world this happens all the time. Companies delay and defer payments to each other all the time trying to maximize profits. The situation usually comes to equilibrium without court action (e.g. "pay me for the last shipment or you won't get the next"), but it's really common. "Payment up front" is a consumer thing. B2B transactions are a whole lot more complicated.

</comment></comment></comment></comment></comment><comment><USER6> Time and time again I've heard these PayPal horror stories (and at www.paypalsucks.com). I am very leery of PayPal and make it a point to always transfer any balance out immediately, as their freezes seem like a nightmare to deal with. I wish Google Checkout had a more compelling product, and that there were a better solution for C2C sales.

<comment><USER7> I've heard horror story after horror story and yet I've never had any issues with PayPal. I've stored money there, used their Visa/debit cart and even opted into their money market option and made some money (off my money) for several years.

Factoring in anecdotal evidence like this (or mine) always has risks.

I'm sure you could find someone local who absolutely hates the bank you choose to have accounts with, but that doesn't necessarily mean you'll have issues.

<comment><USER8> I've read horror story after horror story of houses burned down.

I've been living in one for decades without any problems.

Factoring in anecdotal evidence like this (or mine) always has risks.

<comment><USER9> I've heard those stories too. That's why we have fire alarms.

When does the plural of anecdote become data? At least, there will be a point where we've got enough data points to start taking precautions.

</comment></comment></comment></comment><comment><USER10> I've processed about $80K in transactions with PayPal with my microISV with no problems. And I think they're better than all the other solutions. But I never keep a balance because I'm afraid of this sort of thing.

Something like this happened with a charity drive at SomethingAwful: [http://www.somethingawful.com/d/news/paypal-fiasco- summary.p...](http://www.somethingawful.com/d/news/paypal-fiasco-summary.php)

There's apparently no way to quickly talk to an intelligent person with the knowledge and authority to resolve a situation like this should one come up. It seems like with the fees they take out they could do a lot better.

<comment><USER11> Same here. I've been using them for years with no problems. These stories worry me enough that I do an annual review of the other options out there -- but none of them are as good as PayPal. I also don't keep funds in my PP account, as well as transfer them out of the associated bank account ASAP since there is the potential that they could drain that as well.

</comment></comment><comment><USER12> You may be able to avoid the biggest problem - which is money 'trapped' in the account by depositing all your funds, daily, into your bank account. Its called Daily Sweep. Wait, you've never heard of it? Oh yes, thats because not only is it -not- advertised or mentioned anywhere on the site but to activate the -option- it you need to call up on the phone!

But its quite easy to do once you know about it. With your biz paypal account call up and request activation of Daily Sweep. If the first person says they dont know what you mean keep asking, eventually someone will admit it (only took us 2 tries!) and set up the option. Now in your account activate it under your prefs.

Every day, the earnings will be Swept into your bank account, just like a Merchant Account. No guarantees they wont try to, say, pull money from your bank account tho...

<comment><USER5> Yes, what is to stop PayPal from requesting all the funds back from your linked account? Can you ask your bank to prevent this?

<comment><USER13> Bank accounts are free. I have my personal account, my business account and a "throwaway" account I use only for PayPal funds. When my PayPal balance gets over a few hundred $$, I manually transfer to the throwaway account and then to the business account. They can't touch the business account because (a) they don't know about it and (b) they have no authorization to touch it, so if they somehow managed to withdraw funds, I'd be at the local branch the next day screaming at the bank manager.

Make no bones about it, banks take unauthorized withdrawals very seriously!

</comment></comment></comment><comment><USER14> I suspect that PayPal is the payment processor of choice for all crooks and scammers. Thus, choosing them as your payment processor is risking your business reputation - they will always default to treating their customers with suspicion and if they have your cash in their coffers then they will sit on it given any excuse to be "suspicious" - that's the business model they operate within.

While the cost of processing payments is an issue (particularly with otherwise low cost software downloads) it is important to link your business to partners with a solid reputation for probity and good service.

<comment><USER15> The reason that PayPal survived and is still around is because they took a very risk averse attitude and pro-actively try to combat fraud. Most of their competitors didn't fail because of lack of customers, they failed because they couldn't handle the fraud.

If you want to get a more detailed view of the issues have a read of the interview Max Levchin gave to JL in Founders at Work.

<comment><USER16> There is a big difference between aggressive fraud protection and pooping on your customers. Being polite and handling mistakes intelligently doesn't mean they can't combat fraud effectively.

</comment></comment></comment><comment><USER17> The way I see it, for something as critical as payment infrastructure, it is simply not an option to go with someone who doesn't have a phone number where you can speak to a real, intelligent person who can act beyond the confines of a few support call scripts.

This is largely why we use a merchant account with a real bank (which has a dedicated account manager), and a gateway with quality support staff that always pick up the phone.

<comment><USER18> Absolutely. PayPal is fine right up until the point when they cut you off, and then you have virtually no recourse. A similar thing happened to me (though I was dealing in physical goods), and I was never able to get it straightened out. They kept asking for more info, I kept faxing it to them; it was never really clear to me what specifically they found suspicious or what I had to do to allay their fears. Having to interact by fax with people who have no authority or incentive to resolve the matter is awful; I think they hope you just give up.

</comment></comment><comment><USER19> I've dealt with this before, and it's absolutely ridiculous. Paypal should not be in business or allowed to operate. They go around acting as if they are "bank like", but in actual reality they do not have to adhere to bank standards. This means they can do things like this. I understand there are a lot of scammers and fraudsters out there. If they need to do something like this, they cannot make it a multiweek process that will most likely end up in you waiting 180 days for your money. They also need better communication with those that have had their accounts frozen. Using their system is utterly ridiculous and not being able to talk to the actual person making a decision is even worse. We're talking rightfully earned money that people rely upon to make a living, you can't screw around with a person's living like this. I see all these Paypal developer conferences and "developers love paypal" promotion going on, and I call complete fucking horseshit on it. There's no way a single dev or software company should go near your service with service+rules like this in place.

<comment><USER20> "developers love paypal"

Do they? Because I've never met one that does.

</comment></comment><comment><USER21> I am really glad that I've read this. I plan to build a bit unorthodox website and I was intending to use PayPal for money transfers between the users. After reading this I am almost sure that my PayPal account would get suspended at any decent amount of popularity. Can you point out some other alternatives? I was thinking about money bookers.

<comment><USER22> With Moneybookers, you'll have the problem that they'll be flagged by US banks as a gambling site. Repeatedly. One of my customers in Europe uses Moneybookers to pay me, because their fees are really quite attractive in comparison to PayPal. But because Moneybookers are in the UK and we all know what a gambling haven the UK is, I have to keep a constant eye on my bank.

(But my bank bounces every other payment to joker.com for the same reason. Amateurs.)

<comment><USER21> Does your bank reject payments to your account done with moneybookers and you have to explicitly remind your bank that you want those payments and then everything is ok?

<comment><USER22> Occasionally. I have to admit it hasn't happened in a while, but I don't use moneybookers that often.

</comment></comment></comment></comment><comment><USER23> Sounds a lot like the various AdSense horror stories. A recent one: [http://groups.google.com/group/android- discuss/browse_thread...](http://groups.google.com/group/android- discuss/browse_thread/thread/9f8fea67eab535c7/df44a3d3f59b0d01)

<comment><USER24> It's apparently very hard to scale any exchange system to exclude fraud and prevent false positives in a humane manner. AdSense, Paypal, Google Checkout, eGold, and Prosper.com have all failed to figure out how to do it reliably. You can throw fancy machine-learning techniques at the problem and isolate most of the unusual activity, but the problem then is how you filter that between fraudsters and the genuine good guys.

The basic problem is that if you're a low-margin Internet-scale transactional business, the marginal cost of distinguishing fraud from unusual non-fraud is higher than the marginal benefit from letting the transactions through. And if you're Paypal and you get the float on a bunch of locked funds without the need to following banking regulations, it's definitely not in your best interest to do.

</comment></comment><comment><USER25> What's an alternative to PayPal then?

<comment><USER26> Google Checkout, Amazon Payments, 2Checkout, Authorize.net, and other cc processors. Or get a merchant account.

<comment><USER27> Pretty much every big payment processor is viable so long as you have a US Bank account into which you withdraw your sales revenue—except a lot of us live outside of Bushland and thus the only option is either using a local bank/merchant account (expensive, complex, slow-moving, don't understand new technology, poor interface, etc) or paypal.

ApparentSoft is a developer based in Israel, like me. They probably opted to use PayPal because PayPal recently opened up the ability to withdraw directly to an Israeli Bank account -- something which all the ohter entrants on this list cannot do (with the possible exception of 2CO, haven't looked at them).

<comment><USER28> 2CO can do international wire transfers.

I use them as a secondary account because some of my customers refuse to use PayPal, and 2CO really sucks compared to PayPal. They haven't frozen my account, but their UI is crap, their fees are higher, there is delay before payment appears in my account, they keep a "reserve" when they do payouts, etc.

</comment></comment></comment></comment><comment><USER29> I've gotten to the point where I refuse to use PayPal for buying or selling products. --I can't even remember the last time I used them to do anything where it wasn't a hassle.

I suspect they probably see much higher percentages of fraud than other payment processors, and as such have decided they'd rather shut down accounts and reverse payments without warning rather than actually trying to detect and prevent fraud in the first place.

<comment><USER30> _> I can't even remember the last time I used them to do anything where it wasn't a hassle._

I can. It had never been a hassle to me. If there are several payment options available I choose paypal—it knows my shipping address and saves me from filling the same borring form again.

</comment></comment><comment><USER31> Description of high-risk third-party payment aggregation and why its not just PayPal that has a problem with it:

[http://www.braintreepaymentsolutions.com/blog/high-risk- mech...](http://www.braintreepaymentsolutions.com/blog/high-risk-mechant- account-third-party-payments-aggregation/)

</comment><comment><USER32> While I find PayPal's rates reasonably attractive and their interface to be... uhh... better than most other merchant account or payment processing sites out there, I just don't think I can trust them to handle payment processing for me on a business scale.

I understand as much as the next guy that a company like PayPal needs to take fraud seriously. But why not work with your customers so that they can prove themselves to be legitimate businesses with legitimate intentions? I know I'd be more than happy to provide PayPal with whatever information they need in order to ensure uninterrupted service, and to prevent my account from being randomly "suspended" one day without notice or without reason.

They should get their act together and make quality customer care available for all of their Pro customers.

</comment><comment><USER33> Wondering if anyone has a success story with PayPal?

<comment><USER34> It's been working pretty good for me.

Maybe I got lucky -- I got an excellent account rep when signing up for the API. She gave me a direct number to her desk and whenever I have a problem I call her and she fixes it.

I actually sent an email to PayPal's Executive Customer Service department telling them how great she was and how there probably wouldn't be so many paypal horror stories if they had more reps like her... and they wrote back with a generic apology for the problems I'd encountered.

</comment></comment><comment><USER35> I had a similar encounter of false accusation on Sedo.com trying to sell a domain. They apparently had "definitive" evidence of shilling and closed the sale. When I asked what that evidence was, they said the buyer had the same name as I did. Maybe it was bad luck, but who'd be dumb enough to shill with his own name anyways. It's not so much that I lost the sale that bothers me, but that the lady in Germany still thinks I was trying to shill. Perhaps I should have threatened to pursue legal action?

</comment><comment><USER36> Do business with your bank. You have a person you meet face to face whenever you need and who's going to crawl within the organization to fix that kind of problem.

What PayPal did is pretty logical given the number of fraud they get everyday. e-mail has got no legal value and from the outside what they did wasn't very rigorous.

<comment><USER37> > e-mail has got no legal value

How's that?

<comment><USER36> No signature.

<comment><USER38> .. only an electronic paper trail a mile long.

Email is absolutely of legal value.

<comment><USER36> I'd like you to exhibit cases where e-mail was ok to grant a copyright permission.

My lawyers always told me the following: everything formal must be fax, snail mail or signed with an electronic certificate (I declare and pay my taxes with the later for example).

Copyright handover is not just "ok we're going to buy you 2 computers" kind of e-mail.

<comment><USER34> And I'd like you to point out the law that says all contracts have to be written. With a few specific exceptions, they don't.

Sure, you _should_ get them in writing and signed to cover your ass, but an email contract is still perfectly valid in most cases. Just like a "handshake agreement" can be legally binding.

<comment><USER36> Which country are you referring to? In France this is not the case. If there is a disagreement and nothing is written down you're screwed.

edit: I've checked up a bit. There is such a thing as "oral contract" in French law but it's very strict and limited to certain transactions.

The legal definition of contract doesn't say if it must be written or not ([http://www.legifrance.gouv.fr/affichCodeArticle.do?cidTexte=...](http://www.legifrance.gouv.fr/affichCodeArticle.do?cidTexte=LEGITEXT000006070721&idArticle=LEGIARTI000006436086&dateTexte=20091217)).

It's extremely rare (read: never) to start a work without a signed fax or letter which basically says "ok, go ahead for that price".

That goes from a plumber who's going to fix your sink to me paying a designer to work on a web site. I guess in some cases an e-mail has got a valid proof, but it depends on the price of the transaction. You can confirm a 1,000 € job by e-mail, but I guess a 100,000 € transaction needs more.

What you need is a proof that the agreement occurred between the two entities.

When giving someone the right to sell your product, I'm quite certain than an oral agreement or even an e-mail is insufficient.

A printed e-mail sent by fax, let's just not talk about it. ;)

<comment><USER39> The point with this case is that the first 2 reps told me it's ok to fax emails. And then they closed the account.

And when I faxed signed paperes nobody wanted to look at them. Although they said "go ahead" and send.

The real problem is that the support personnel are not the one making decisions, are not telling the same, and you can't talk to the people who really do decide.

Plus, their action of closing my ability to receive payment (and provide service to my customers) without any warning is an extremely aggressive sanction, for no reason.

Let's close his account and then see if he was doing legit business. In the mean time, "we're sorry for any inconvenience this may caused you". When you're doing a 2-week promotion, getting an account closed even for a week for "inspection" is not an option. After 2 weeks we were back to normal low activity, without the bundle.

<comment><USER36> I'm sorry for your problem, it shows that they are not well organized, but as I said in my first comment the best is to work with your bank for online payment.

You can offer paypal as an additional payment system, but really, work with your bank. You know the guy/girl there, and they care more about your business than paypal, because your good business means money in their vaults.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER40> This happened to my company earlier this month. The categorization, not any particular activity, of my business tripped one of PayPal's safety triggers. PayPal was unapologetic and wildly unhelpful in resolving the issue (that didn't exist!) quickly.

</comment><comment><USER41> I once had my PayPal account "temporarily" suspended under similar circumstances. Usually, all you have to do is fax them/upload copies of documents verifying your identity and you should be set within a week, if you're persistent and diligent.

<comment><USER42> Did you not read the entire story?

<comment><USER41> I did, which is why I said "usually". This happened to me twice, and I've never had to go through so much trouble. Furthermore, as to letting PayPal know about a sale, it _is_ possible.

The first time I had an incident was because of a sale I ran, and PayPal limited the account I got it fixed in a week, just in time for a sale of another product. This time, I emailes PayPal telling them about the previous story and asking if there would be a problem. There was, and my account got limited for a second time.

What I did then was, instead of submitting documents, I uploaded a screenshot of my email correspondence with PayPal, and their response. One or two days later, my account was free.

</comment></comment></comment><comment><USER43> I have heard that if you notify paypal you may see a big spike, then when it gets auto-flagged, it will quickly be un flagged when they see the note on your file.

</comment><comment><USER44> Very disturbing and frightening read - especially because I've stumbled such horror stories about PayPal quite a lot the last couple of months.

</comment><comment><USER45> Welcome to your traditional merchant account.

Processors are all powerful.

Consumers are always right.

Businesses are expendable . . .

despite providing the fundamental opportunity for the processors to exist.

</comment><comment><USER46> This is why I use Amazon Payments. Unfortunately, their documentation is awful, but at least it's Amazon. They have a pride and reputation. I've never had a problem with them.</comment>


Forking Processes in Ruby and Randomness  - <AUTHOR> http://vccv.posterous.com/forking-processes-in-ruby-and-randomness

<comment><USER2> very interesting</comment>


The Adams Theory of Content Value - <AUTHOR> http://dilbert.com/blog/entry/the_adams_theory_of__content_value/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+typepad%2FihdT+%28The+Dilbert+Blog%29 <comment><USER2> "I predict that the profession known as "author" will be retired to history in my lifetime, like blacksmith and cowboy. In the future, everyone will be a writer, and some will be better and more prolific than others. But no one will pay to read what anyone else creates."

Hopefully the future for authors isn't that bleak, but I do see a major change on the horizon. I'm somewhat surprised that the "Social" websites like facebook haven't become breeding grounds for copyright infringement like the old social apps (IRC).

<comment><USER3> The curation of IRC was/is distributed. Facebook's is centralized, which makes them a more lucrative target. Also, the legal and commercial environments have changed.

The RIAA isn't going to go after gopher and BBS MP3 sharers any time soon -- a certain level of obscurity is close enough to nonexistence.

</comment></comment><comment><USER4> Charlie Stross recently republished a post by Milena Popova titled "Why Content Is a Public Good" [1] that I quite enjoyed, and think is relevant to this discussion. It goes into some detail on the true economic nature of content, and gave me a framework within which to think about it.

[1] [http://www.antipope.org/charlie/blog-static/2010/04/why- cont...](http://www.antipope.org/charlie/blog-static/2010/04/why-content-is-a- public-good.html)</comment>


How Mint Beat Wesabe - <AUTHOR> http://okdork.com/2010/10/14/how-mint-beat-wesabe/

<comment><USER2> I love getting this type of insight from someone that was there during such an important time for Mint.

A couple of questions:

 _Authority. We got thought leaders in personal finance to back us._

Can you give one or two examples of how you guys accomplished this?

 _Dave had a the killer idea of the content network (blog) which was a HUGE traffic generator and still is to this day._

Do you mean the Mint blog or were there others? If others, how many of them?

<comment><USER3> Luckily, I was writing in personal finance for a few years before I joined Mint so I knew most of them. Some of them included Ramit at <http://iwillteachyoutoberich.com>, Cap from <http://stopbuyingcrap.com> and Jim at <http://bargaineering.com> to name a few.

We just went and interviewed the guys above or asked thme for guest posts. You have to think how to serve their interests (traffic / exposure / relationships with a potentially cool company).

Yea, the Mint blog.

<comment><USER2> _We just went and interviewed the guys above or asked thme for guest posts. You have to think how to serve their interests (traffic / exposure / relationships with a potentially cool company)._

That totally makes sense. But if this is early in Mint's history then what's the benefit for them? I'm assuming it's not traffic or exposure since they already have it, right? This is a situation that applies to a lot of startups. What do they have to offer early on?

<comment><USER3> Everyone will do an interview. They want the links and possibly free traffic for minimal work. It did help that I personally knew them. Once you get interviewed, you are pretty likely to promote it if it's a good reference.

The issue is most people approach it with generic template emails and crappy questions.

</comment></comment></comment></comment><comment><USER4> I like that you shared the apathy and Excel insights. I learned this early on too. Even today in the PF space, I'd still say that's true and shouldn't inhibit anyone from trying to create something cool.

Thanks for adding the PR point too. I get tired of hearing the "Mint didn't spend money to attract users" line.

</comment><comment><USER5> this is a really great article and should be required reading for anybody thinking of starting up a company -- or considering joining a starup.

</comment><comment><USER6> I think the domain name ( mint -vs- wesabe ) is responsible for more of the Mint victory than people want to admit. I know when I try and turn people on to new services, that seemingly petty little detail has been the primary reason whether they adopt it or not. That fact of life kills you inside when you put so much blood sweat and money into a company - only to have people talking about how to pronounce your name in blog comments rather than what cool stuff you can do.

</comment><comment><USER7> It seems so simple. Yet I'm sure a lot of Marketing dudes get caught up in the hype that ends up being the "wrong community."

Say my customer is a bit of a laggard, What would you recommend doing to break through the traditional PR clutter in a very web 2.0 world? Is there a way to connect the two that makes sense and might provide value/ROI?

Thanks Noah.

</comment><comment><USER8> Really good and insightful post. Looking forward to the design post though you mentioned.

</comment><comment><USER9> Noah, excellent breakdown as usual. And I totally agree with your take (vs. Wesabe's post-mortem post).

I'm going to send your article to like a dozen people right now, that I preach this stuff to and don't believe me :)

</comment><comment><USER10> fascinating. no one ever explained to me in the thread about why wesabe failed, how the freaking name is pronounced.

how much $ did wesabe raise? (I'm too lazy to go to crunchbase)

<comment><AUTHOR> $4M Series A: USV (lead), O'Reilly AlphaTech Ventures. [http://blog.wesabe.com/2007/06/20/wesabe-raises-4m-in- series...](http://blog.wesabe.com/2007/06/20/wesabe-raises-4m-in-series-a- funding/)

$700k seed: O'Reilly AlphaTech Ventures. [http://techcrunch.com/2007/02/28/wesabe-gets-money-from- tim-...](http://techcrunch.com/2007/02/28/wesabe-gets-money-from-tim-oreillys- oatv/)

</comment></comment><comment><USER11> Very interesting article.</comment>


How many 32-bit RISC CPUs fit in an FPGA? Now vs. 1995? - <AUTHOR> http://forums.xilinx.com/t5/Xcell-Daily-Blog/Jan-Gray-s-New-LUT-Math-How-many-32-bit-RISC-CPUs-fit-in-an-FPGA/ba-p/432478 <comment><USER2> So, about 15 years ago I took a college course on microprocessor design, and our final project was to implement a simple microprocessor on an FPGA.

At the time, it seemed obvious that, over the next decade, FPGA's would work their way into general-purpose computing, so that (for example) Photoshop filters would simply reconfigure the FPGA to run blazingly fast. Likewise with games, or video codecs, or 3D rendering, or whatever else was processor- intensive.

But that clearly hasn't happened. Instead, GPU's took off as the main computational supplement to CPU's.

Does anyone here have any insight as to why? Is there a technological reason why FPGA's never turned into general-purpose hardware standard on every desktop and laptop? Has it been a chicken-and-egg problem? A standardization problem? Or something else? Do FPGA's still have potential for general-purpose consumer computing? Or are they going to be forever relegated to special- purpose roles?

<comment><USER3> Moore's law is quite amazing.

I believe there are 4 reasons why GPUs have taken off conventionally as compared to FPGAs:

1\. Last I checked, the FPGA vendors will not open their toolchains up, and not even document the bitstream formats. They will claim NDA, proprietary, etc. This has the massive side effect that you are stuck with their bloated, slow, crappy toolchains. If this were open, I guarantee hackers would be inventing all kinds of interesting ways to convert their software into FPGA bits.

2\. FPGAs are VERY hard to write and debug. You have to write your design in an HDL language (either VHDL or Verilog), and you have to use a software simulator to prototype the design on first (and of course these tools are either quite pricy or if free they are usually limited or hard to use). Then you can synthesize the design and download it into the FPGA for running.

The next problem is debugging your design. The entire internal state of the FPGA is only accessible through slow scan, unless you dedicate a portion of your design to "monitors", which tap the traffic and store their values into internal RAMs. So you may have to respin the design just to get more monitors to debug where the issue is.

3\. FPGA compilation is SLOW. When I used them professionally a few years ago, a Virtex5 could take multiple hours to resynthesize/place & route a medium- sized design. I believe that Virtex7 they are advertising could take over a day to respin if you change your design.

4\. Most new machines already have a built-in graphics with a GPU that can be utilized as a general-purpose GPU. No one ships FPGAs in any conventional computer.

<comment><USER4> (2) can probably be addressed with OpenCL -- Altera seems to be working an SDK[1] that allows you to write C code which, as I understand it, would compile to an image that you could then program on to your FPGA (or you could just compile for execution on a processor). So fortunately, no Verilog or VDHL necessary.

(3) is another issue, but I don't think the consumer would necessarily need to worry about compilation. The developer would just include the compiled programming files for different FPGAs in the application.

If you mean that it'll be slow on the developer's side, that's definitely a valid point. I'm sure, however, that you'll see FPGA manufacturers start to move toward remote compilations so that you're not necessarily limited by the hardware you have in-house.

[1] [http://www.altera.com/products/software/opencl/opencl- index....](http://www.altera.com/products/software/opencl/opencl- index.html#sdk)

<comment><USER5> More about (3):

Altera calls it "logiclock," Xilinx has a different term, but the idea is that you don't need to re-synthesize the entire FPGA for every change. In fact, you may not want to. If you are tweaking a certain region, you're usually happier if the place & route doesn't send your stuff through a route that then kicks off a line in another block so that the timings are now off in that other block.

For an FPGA the timing is how you measure performance and getting the best timings can take quite a bit of work. Being able to lock that once you've got it right is a big plus.

<comment><USER6> Xilinx's ISE calls it "SmartGuide".

It's kind of a mixed bag. It's worked okay for me if changes are truly minor, but if there are large changes to the logic it doesn't seem to be very good about "forgetting" what it learned from the previous pass. Three or four times this week I've had a design fail to make timing with SmartGuide, but work when doing P&R from scratch.

</comment></comment></comment></comment></comment><comment><USER7> Hi, Jan here.

pdq, the last time I built this design, with more fully elaborated processors (control units + multiplier FUs) it took three hours and 16 GB physical RAM on a Core i7-4960HQ rMBP.

<comment><USER8> Do you know if the process parallelizes well? If so, this seems like something that high-end temporary AWS instances could help quite a bit with.

<comment><USER7> With the Xilinx ISE toolset I am currently using (which Xilinx is deprecating in favor of the new Vivado toolset) it parallelizes/multithreads poorly. I understand that the place and route algorithm is based upon simulated annealing, in which you make small random perturbations to the current layout configuration, measure whether it is better or worse, and sometimes retain the new configuration, and sometimes roll back. This gradually evolves the system to a configuration which maximizes some objective function, avoiding getting stuck in a local maximum. It has traditionally been a challenge to parallelize this sequential algorithm through design partitioning because of placement and routing interactions between the partitions.

In some flows you can do a coarse floorplan of your design and route the submodules separately and then stitch them together. I imagine this is how the very largest devices are implemented in manageable design iteration times.

I don't usually worry about that, though. Since my design is just so many replicated tiles, I tend to do design iterations of 4- or 16-processor elements to test the impact on clock period / timing slack. That usually takes 2-3 minutes per design spin. Only once in a while do I place and route the whole chip to confirm some change doesn't impact timing closure.

</comment></comment></comment><comment><USER9> Fab tech has improved at an astonishing rate. The Willamette core (Pentium 4) from 2000 fit 42 million transistors in 217mm². Eight years later, Silverthorne (Atom) fit two cores and 47 million transistors in 25mm². That's nine Atom CPUs in the same space as one Pentium 4.

Today's quad-core Haswell is made of 1.4 billion transistors crammed into 177mm². That's almost 8 million transistors per square _millimeter_.

<comment><USER10> It seems like we're going to run into the limits of that by the end of the decade or soon after though. I've made quite a few submissions about this but nobody ever seems to read them :) I really wonder whether we are making advances with parallelism and other technologies fast enough to offset the oncoming barriers to shrinkage and speed.

My naive best guess is that when CPUs stop getting much faster the next wave of innovation will be on bus speeds. But I'm not a chip guy so perhaps my view of the problem is overblown, but I'm very interested in learning more about this from others.

<comment><USER11> > when CPUs stop getting much faster

If by faster you mean clock speed, they haven't been getting faster for a while now. Memory and IO speeds do lag behind, but we have caching to solve the former and SSDs to solve the latter. One pressing issue now is getting the power consumption down. This is especially important for laptops and mobile phones. FPGAs are pretty good at using less power, but you have to sacrifice a lot of performance and programmability.

<comment><USER10> Ah sorry, I meant in terms of execution speed not clock, and was thinking mainly of shrinking die sizes > more transistors > more operations per cycle. I apologize for the vagueness.

</comment></comment></comment></comment><comment><USER12> What practical applications does this have? Could we see something like Python's Theano? The latter is a library which is capable of turning symbolic representations of linear algebra into parallelized and optimized code for the CPU or GPU.

I think that these FPGAs, when put into consumer computers, will be more like "data centers on a chip" rather than processing cores. In a simple example they could run map/reduce type operations, colocating storage and computing silicon.

<comment><USER11> That's not really what FPGAs are good for. Unless you are using a really high- end FPGA (read: >$10,000/unit), the raw compute power is not going to beat a decent gaming GPU. The benefit of FPGAs is that you get very precise timing control, which makes then very good for software-defined IO and other latency- sensitive hard real-time applications.

</comment></comment><comment><USER13> I'm sure the future will be massively multi processor. I just wish it would come faster.

Although I'm quite sure those sorts of amazing designs are already well used by the NSA. I'm sure hardware research could be the real breakthrough in cryptanalysis.

</comment><comment><USER14> I wonder why Xilinx choose to use the j32 CPU in this example when they have better designs like the MicroBlaze, with about same size but faster and able to boot Linux.

EDIT: Oh I see. Microblaze is propietary and didn't exist back then.

<comment><USER7> Xilinx didn't choose anything, rather they simply linked to a blog (mine). These cores are more austere, smaller, simpler than MicroBlaze.

[http://www.fpgacpu.org/log/sep00.html#000919](http://www.fpgacpu.org/log/sep00.html#000919)</comment></comment>


Cyclotron: A web application for constructing dashboards - <AUTHOR> http://www.cyclotron.io/ <comment><USER2> I would like to share some thoughts on this based on experience of being a crusty old enterprise developer. The dashboard problem keeps coming back. I think the time might be finally coming for some dashboard framework to actually succeed.

A dashboard framework has been tried many many times. Here are some old ones just on the top of my head:

* Shindig aka OpenSocial aka Google Gadgets

* J2EE portlets

* OpenUSS

I'm not sure why Shindig aka Google Gadgets failed but one of the complaint we had on a product that I helped build that used Shindig is that business users did not want the complexity of customizing a dashboard. That is hard coded panels were good enough.

I guess just like many tech stuff (slack/irc, wiki) the timing and execution just wasn't right. I think now that might change given the plethora of devops, data driven biz, and generally improvement in tech awareness.

It would be nice if Cyclotron had some sort of spec (particularly language agnostic) but I guess that failed hard for the above.

For my own small company we use Kibana (the old one that doesn't require NodeJS), Grafana, and Jenkins.

Yes we use Jenkins as a dashboard. Jenkins is actually shockingly a good place for a dashboard because every time we build/deploy or kick off some kind of job we see the current status of stuff. I'm not sure why cloudbees hasn't taken advantage of this. I honestly think it is the best place to put devopsy like dashboards.

The other nice thing about Jenkins besides it actually kicking things off is the notification. IMO notification is almost more important and more useful than dashboards. The two should be not be far apart but for some reason in most systems they are.

<comment><USER3> Jenkins: the duct tape and WD40 of software automation.

<comment><USER4> I have seen people use it in some amazingly Rube Goldbergian ways for great success. It's a real credit to the project and the ecosystem.

Easy enough to 'just get the thing done', but as complex as you want it to be.

</comment></comment></comment><comment><USER5> How does this compare to something like Grafana? [https://github.com/grafana/grafana](https://github.com/grafana/grafana)

<comment><USER6> Can I just take a moment, and I apologise up front for singling you out for this one, to say how much I hate comments like this, even more that they get upvoted.

There's always some arbitrary software mentioned that is often barely related even tangentially and expect someone else to reply with the info.

If you want to know how it differs, YOU look it up and if the outcome of that research is interesting enough YOU post it. Don't expect other people to do it for you, or worse, make it so that the creator of something that might not even be the one linking it feels like they have to justify why they open sourced something.

<comment><USER7> I disagree 100% with you. I love comments like GP. Any new tool should be considered in comparison to the other tools one might use for the same job.

Is Grafana "barely related even tangentially"? No it is quite related.

Have the creators of Cyclotron considered how it compares to existing tools? Probably, and they should come forward and be open about it.

<comment><USER8> > Probably, and they should come forward and be open about it.

No software developer is obligated to do anything for any of us. It's on US to figure things out and share them as we see fit. Nobody cares if you are willing to invest serious time looking into it or not. Asking a leading question and linking to something _most_ of us have already seen is pointless. Defending it when a good argument was presented is also pointless. I hazard these discourses are linked to age.

<comment><USER9> Stop presuming that just because you're familiar with something that it's no longer worth bringing up. I've never used any of these tools and value the discussions about them that questions like the thread starter's allow.

Further, there are always new people looking to learn and grow. They shouldn't be looked down upon simply because others got there first.

What makes you think the question was a leading question rather than a genuine one? There isn't enough there to definitively determine the intent in any case, so it's up to whoever responds to decide which way of reading the question they will respond to, and that's an opportunity for the larger software community and for the developers of the projects in question to nurture thier communities. Just because it doesn't have value to you doesn't mean it doesn't have value to others.

</comment></comment></comment></comment></comment><comment><USER10> There's also [http://atlasboard.bitbucket.org/](http://atlasboard.bitbucket.org/)

<comment><USER11> this one looks good and it uses postgres

<comment><USER2> > this one looks good and it uses postgres

Where did you see that it uses Postgres? I think it stores its data in json files.

<comment><USER11> I checked out node_modules and found postgres there but I have not looked into the src to see how it's hooked.

</comment></comment></comment></comment><comment><USER12> There is also Redash [http://docs.redash.io/en/latest/](http://docs.redash.io/en/latest/) We are using it and it's awesome.

<comment><USER13> I was hoping that this would be a maintained fork of [http://dashing.io/](http://dashing.io/)

<comment><USER14> Well, there is the official fork - [https://github.com/SmashingDashboard/smashing](https://github.com/SmashingDashboard/smashing) \- Last commit 20th Nov 2016

<comment><USER15> Dashing was always my vibe. Good to see it's still being worked on.

</comment></comment></comment></comment><comment><USER16> Disclaimer: I work on Metabase.

Another open source option: Metabase [http://www.metabase.com/](http://www.metabase.com/)

We support most SQL databases and a bunch of others, plus upcoming support for Google Analytics.

</comment><comment><USER17> Why MongoDB for what is pretty much a front-end :( What's wrong with SQLite?

<comment><USER18> "The path of MongoDB is often the same: first the primary DB, then the configuration store, then it's finally removed" \- (friend of mine)

<comment><USER19> Expand. MongoDB is finally removed? Why?

<comment><USER20> I think the implication is that mongo is picked because it's "cool", and eventually everyone realises another tool does the job better

(e.g. regular sql database/redis/sqlite/etc)

</comment></comment></comment></comment><comment><USER21> There seems to be a plethora of these open source dashboard builder systems.

I just want to pay for a hosted version that isn't going to be $1k monthly and require me to build "plugins" to do something that is akin to an API call.

<comment><USER22> I want it to be a $1K/m so they can stay in business and build a sustainable thing I won't have to replace. That's still way cheaper than spending 1/4th of an engineers time per year on an open source dashboard.

<comment><USER23> In a business/enterprise context, why not use Power BI?

</comment></comment></comment><comment><USER24> Looks like a hosted equivalent of GeckoBoard[0], which I have used successfully for uptime and key metric boards that are displayed in common room dedicated TV screens etc.

One key is getting decent render performance on low-spec hardware (i.e. a Rasberry Pi). Not something you usually think about when building/evaluating a web app, but those low-spec "boxes" _crawl_ on most modern web-sites.

Yet there shouldn't be any reason why a dashboard couldn't be rendered on them!

I wonder how Cyclotron performs with it's JS heavy front-end on those types of dedicated dashboard devices?

[0] [https://www.geckoboard.com/](https://www.geckoboard.com/)

</comment><comment><USER25> Forgive my ignorance... what makes a dashboard different that a regular webapp?

<comment><USER26> A dashboard is a web app displaying aggregate data - usually on something like a digital signage display at a company's office - often includes 'vanity metrics' like web traffic data, Git commits, social media feeds, CI builds, etc.

<comment><USER27> To expand upon that, it's aggregating a variety of data sources, generally via disparate APIs, rather than creating its own database backed API.

So while most framework models are oriented around their own ORM, a dashboard is probably better off modeling a set of translators, and providing tools for adding new translators. Translators can take a random API, and convert into a normalized data type the rest of the framework can understand. And a good community will have a lot of these translators available.

Additionally, the dashboard framework can provide a variety of standard visualizations for the translators to send normalized data. Time series, histogram, pie chart, text, etc. And provide an intelligent layout engine for arranging a collection of these on a screen. Dashing, for example, allows a user to re-arrange dashlets.

tl;dr -- it _is_ a webapp, but the more limited scope allows for better tooling and your valuable engineers can focus the more productive uses of their time, like writing new visualizations or, more likely, new translators.

</comment></comment></comment><comment><USER28> Anyone know Baidu's echarts? [http://ecomfe.github.io/echarts/index- en.html](http://ecomfe.github.io/echarts/index-en.html)

</comment><comment><USER29> There is also [https://mondash.org/](https://mondash.org/), which is has a clever API that may be very useful in some cases.

</comment><comment><USER30> Nice! Some quick feedback:

* I'd default to the "light" theme, especially if you're presenting it against dark background. It will highlight the content better. * You could use some whitespace between the widget titles and the content. The text is sliding into the graphs. * Might be nice to use more than two colors for the graph content, or at least make one of them different from black, which is also the color used used for the tables and titles.

</comment><comment><USER31> This scared me a little bit. We've been doing a similar product [https://vida.io](https://vida.io). I think we've got a lot further with many components and dashboards, see [https://vida.io/explore](https://vida.io/explore). At the same time, I'm pretty excited to see someone has similar vision about custom data visualizations.

</comment><comment><USER32> To be honest I don't understand why should a dashboard framework need MongoDB to display widgets from external sources.

[shameless plug] We're also building an open-source dashboards framework [https://github.com/kittoframework/kitto](https://github.com/kittoframework/kitto)

</comment><comment><USER33> I like how you can change the Cascading Style Sheets pretty much on the click of a button. I am a bit behind the time, but I do remember Square's Cube to be good for time-series.

[https://github.com/square/cube](https://github.com/square/cube)

Those can be embedded into dashboards

</comment><comment><USER34> [http://zeppelin.apache.org/](http://zeppelin.apache.org/)

</comment><comment><USER35> On a side note, any site like HN for data systems, BI, dashboards?

Edit. To be clear I mean forums where business intelligence, data science, dashboard folks hang out. I work with Tableau and they have a big community, I am looking for sites less tableau centric...

<comment><USER36> What do you mean exactly?

</comment></comment><comment><USER37> Airbnb have a decent os dash [https://github.com/airbnb/superset/blob/master/README.md](https://github.com/airbnb/superset/blob/master/README.md)

</comment><comment><USER38> How is this different from potential alternatives like Geckoboard, Ducksboard and all those? Is it essentially not just another one?

</comment><comment><USER39> This seems pretty cool. Though running it as an intrAnet app is unexpected.

<comment><USER40> Though in many corporate settings, that's where you'd expect to see it. Many externally facing dash frameworks require too many dependencies; this one went lighter in some ways b/c they assume that it's behind a wall and in a trusted environment.

[http://www.cyclotron.io/faq.html](http://www.cyclotron.io/faq.html):

"Can I Use Cyclotron to Host Dashboards on the Internet?

It is not recommended to deploy Cyclotron as-is in a public setting. Cyclotron was designed to be used in a corporate intranet environment, rather than for public dashboards. In addition, it's possible to create malicious dashboards using the extensibility features of Cyclotron. Allowing untrustworthy users to create dashboards is not recommended."

</comment></comment><comment><USER41> It _requires_ mongodb to run, eeeewwww: [http://www.cyclotron.io/faq.html#without- mongodb](http://www.cyclotron.io/faq.html#without-mongodb)

Not something I'd trust as a primary datastore.

</comment><comment><USER42> what about openmct. iirc it was a complete dashboarding tool.

</comment><comment><USER43> Nice product

</comment><comment><USER43> Thanks for project

</comment><comment><USER44> I never understand why people choose MIT when they create something valuable and don't go for AGPL or GPL.

Looks good though :D

<comment><USER45> Since we are talking about licenses, is there a license that is as permissive as MIT but one that requires you to give credit for your work?

<comment><USER46> What do you mean by "give credit"? You have to name the original author with MIT somewhere:

<snip> _The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software._ </snip>

<comment><USER45> basically, what I would like is a license that's basically like MIT...but I would want my name + email + tool be listed in the about / licences section of anything created / used with my tools/projects etc.

</comment></comment></comment></comment><comment><USER47> I find the name slightly disrespective of people who develop and work with actual cyclotrons (particle accelerators). How is their application related to cyclotrons?

</comment><comment><USER48> That name may have a negative ring, as a cyclotron is also a cancer imaging device :

[https://www.mskcc.org/blog/how-new-particle-accelerator- will...](https://www.mskcc.org/blog/how-new-particle-accelerator-will-make- imaging-and-treatment-more-precise)

<comment><USER49> Cyclotron: [http://swatkats.info/encyclopedia/entries/cyclotron](http://swatkats.info/encyclopedia/entries/cyclotron)

<comment><USER48> XD

Megatron, anyone ?</comment></comment></comment>