NSA chief sidesteps queries on cellphone location tracking - <AUTHOR> http://www.bostonglobe.com/news/nation/2013/09/26/official-sidesteps-queries-cellphone-locations/09N2IlzgGjTT9pFq4XEN7K/story.html <comment><USER3> For the record, I am saddened to see that HN has given up on giving stories about this their proper place. There haven't been many stories on the topic rising to the top recently, and the few who did sank back down quickly, presumably under the weight of flaggings by people who'd rather read about Erlang or web design or funding topics or startup stories or obscure technological marvels or some other worthy topic (not sarcastic - I think those are fine topics to read about).

It is sad to see that in the end, distraction wins. Huxley was right - <USER2> world is going to turn bad before our eyes but we (as a civilisation) won't care, it's more fun to just read about what we like. We're just too good at producing stuff that we like to read, and at ignoring stuff that's uncomfortable.

Until this is resolved in some way, there should not be a day that passes without one of the top HN stories being about NSA spying.

<comment><USER4> There are plenty of places to talk about the NSA outside this site. The issue has taken over the conversation on so many discussion boards that I'd much prefer if HN doesn't get drowned out by the same. Especially if the actual content is mostly speculation.

<comment><USER3> Pray tell what those places are. I don't have any other such places.

Also, HN was drowned out for the first week or so. Then it became a steady trickle. Then a bunch of people, presumably such as yourself, decided that even that trickle was irritating to them and started flagging NSA stories on sight. Since then the trickle has died out, and there is nothing.

Obama and his cohorts can go back to bed in peace, knowing this was just another internet fad and, as predicted, the geeks are easily distracted by some new gadgets or talk of technical gimmicks.

<comment><USER5> >Obama and his cohorts can go back to bed in peace, knowing this was just another internet fad and, as predicted, the geeks are easily distracted by some new gadgets or talk of technical gimmicks.

Yes, because Obama and his cohorts were really sweating over what Hacker News thought about anything.

</comment></comment></comment></comment><comment><USER6> 1\. Since Snowden's revelations, we'll always have to assume the worst.

2\. Any answers from any of these government agencies must be assumed to be lies (except for admission of guilt, of course) or to be misleading.

So, the circus is almost certainly worth nothing anyway.

<comment><USER7> I heartily endorse items (1) and (2), but I disagree with your conclusion. At the very least, having a major paper put out the denials so publicly will allow folks to match the inevitable Glenn Greenwald or Bart Gellman shocking revelation with the original lame denials.

It's like Ben Franklin wrote, everybody's good for something, even if it's only as the "before" exhibit.

</comment></comment><comment><USER8> Ron Wyden would appear to be a patriot in the true sense of the word.

It's refreshing to see the "if you're not doing anything wrong, you have nothing to hide" approach turned about.

</comment><comment><USER9> They're not "tracking" your cellphones. You are voluntarily transmitting the location of your cellphones to telecoms, who can do whatever they want with it. It is not a "search" under the 5th (sorry! 4th!) amendment, because the information is the property of a third party. Also it's just metadata.

 _edit: This comment is meant to be sardonic._

<comment><USER10> Wrong amendment, "just metadata", "they're not tracking your cellphones"

Sheesh, no wonder you posted with a throwaway.

<comment><USER9> Sorry about the wrong amendment! I need a coffee.

I think the tone of my comment didn't come through clearly, I've added a disclaimer.

</comment></comment></comment><comment><USER11> How they gonna drone your ass if they can't track your ass?

In all seriousness - at the Aspen Institute talks former NSA chief General Hayden emphasized that location data is much more important than the content of mobile wireless traffic. So this tells me that if "they" know where you are, they can at the very least deploy assets to contain, apprehend, or neutralize a target. The US almost certainly used this technique to track and kill US Citizen turned al-Qaeda soldier Anwar Awlaki in Yemen (no due process/no trial).</comment>


Ask HN: Can I offer different prices to different users for the same product? - <AUTHOR> Do any SaaS companies use "Request Demo" or "Contact Sales" to offer different prices to different customers for the exact same product?
e.g. "If customer is a startup I sell ONE license at $50 but if it's enterprise I'll sell ONE at $5,000 just because I know they can afford it..." <comment><USER2> Lots of people do this and there's nothing wrong with it, but I think it's best to have up front pricing rather than "contact for quote".

One way to do it is have the Enterprise version have a few more features that are unlikely to be of interest to small companies or individuals.

Another is just to say the company size on your pricing page. If your company has 500+ employees it's $5000, if 1 person it's $50, if 2-10, it's $200, if 11-499 it's $1000 - or whatever.

Can also have per user, say $100 per user, but a single location site wide license for $1000, or a global site license covering all branches for $20000.

Or whatever prices you like. Look around and you'll find tons of companies offering each kinds of licensing.

</comment><comment><USER3> Yes, totally. This is common practice. A tip though. If you are attempting to connect directly with end users many folks are turned off by a "Contact Sales" _only_ option. You should have something that is totally self serve, like try for $50/month for a single instance, but if you need more seats please "Contact Sales". This gets people in the door. Almost every large company that does any type of enterprise sales will use this model of "Contact Sales" and gets a steep discount off some list price posted publicly.

<comment><USER4> That's probably the way to go. Once you hit five or six figures usually the lawyers will get involved anyway so they can then deal with all the haggling. But something up to high four figures I just want to be able to order it and be done without waiting for months.

<comment><USER5> > Once you hit five or six figures usually the lawyers will get involved > anyway so they can then deal with all the haggling.

This is a common misconception. The lawyer haggling usually has to do with non-monetary contract terms. Price is usually left to the business folks.

</comment></comment></comment><comment><USER6> IANAL, but this is exactly how B2B sales works... you offer an absurdly high MSRP then offer discounts with various incentives based on completely arbitrary things, with the average purchase landing nowhere near MSRP.

I'd be careful about pricing this way to consumers since states are now started to see pricing differences as discrimination. See: [http://nymag.com/intelligencer/2018/02/tinder-prices- discrim...](http://nymag.com/intelligencer/2018/02/tinder-prices-discriminate- against-old-people-in-california.html)

<comment><USER7> > you offer an absurdly high MSRP then offer discounts

Which is amazing. It's probably a lack of experience in B2B, but I tend to see prices as "take it or leave it", so if I see an absurly high price I go "Aight, that's a no", instead of trying to haggle.

It's just so inefficient having to haggle with every vendor to get real prices for a comparison.

Is the sales process anything else than just a huge money sink?

<comment> pickle-wizard In the B2B world, nobody pays list. I've seen some incredible discounts off list price, especially when buying in quantity.

One time I was buying some software licenses. List price was $30/seat. We needed 2000 seats. Which would list at $60K. By the time it was all said and done I ended up with 3000 seats for $10K.

</comment></comment></comment><comment><USER4> Most Enterprise vendors work that way but it always leaves a bad taste with me. When given the choice I will always go with a vendor who has clear and transparent pricing.

But realistically there is probably more money made in hiding prices and haggling a lot. Just be aware that the sales cycle will be much longer.

<comment><USER8> But I think they also cater how some big companies work. They have complex approval and compliance processes, asking there to get a service that costs 149,99$ might sound weird. Of course in that case the company might have a separate department for buying things and they might be more used to quotes.

</comment></comment><comment><USER9> Joel Spolsky wrote a pretty in-depth article about pricing which also covers the "How Much Money Do You Have? Pricing." case which he feels is a bad strategy: [https://www.joelonsoftware.com/2004/12/15/camels-and- rubber-...](https://www.joelonsoftware.com/2004/12/15/camels-and-rubber- duckies/)

<comment><USER10> Thanks for linking. Read through, and felt it was definitely worth the time.

<comment><USER9> No problem, I'm glad you found it useful :)

</comment></comment></comment><comment><USER11> Speaking as someone who does lot of vendor evals and purchases, I would see it as a structural red flag if I see prices go up as usage goes up (for a given set of features).

Different feature slabs (basic, advanced, enterprise etc) can be priced differently.

At any given feature slab, usual expectation is that after a certain scale, additional usage will be billed close to cost. The premium you extracted at lower end of the usage slab should cover your R&D costs, other overheads and your profits. If you care to up-sell the higher feature slabs, then you can offer a time-limited discount or trial while making it amply clear that this is a one-time discount etc. to facilitate trial.

Having a cost+ model internally and looking at your customer mix and competition in the market will help you price each feature x usage slab appropriately.

Remember that customers expect prices to always go down over a period of time (due to lowered hardware costs, better automation, depreciated/amortised overheads etc). So, it is better to start high and go low than try to do the other way.

</comment><comment><USER12> What about doing A/B testing with say $5 vs $7.5 for a product? The people who bought it for $7.5 will feel cheated when they find out it cost someone else $5. But at the time of purchase the product was seemingly worth $7.5 to the customer who paid for it. Isn't it fair to pay in relation to how much you value a product?

</comment><comment><USER13> Absolutely. It's called price discrimination, and there's a whole treasure trove of literature about it. Usually it's not the _exact_ same product, though, but rather something like "features that enterprise users need are extraordinarily expensive, everything else is relatively cheap". IIRC, single sign-on is an extremely common feature to use for this price discrimination.

Lots of non-SaaS companies use price discrimination as well. The biggest example is airlines, who will sell the same round-trip for different prices depending on whether or not the stay includes a Saturday night. Airlines assume that price-insensitive business travelers are generally unwilling to spend a Saturday away from home, and charge higher prices accordingly.

</comment><comment><USER14> Most enterprises need a very different suite of features that take a lot of time and $ to build. I don't think it's as cheesy as other people in this thread try to make it sound. Often, you need to deal with a lot more regulation, have data hosted on prem (potentially in a different country), scale in a very different way (I.e. think of how Slack starts breaking at a certain threshold). Risk mitigation is really different too, often startups are way more understanding if your service goes down or has bugs.

Funny thing is when enterprise customers start asking for so many features, you have to tell them "Sure, we can build it, but it'll cost $50k instead of $50", and surprisingly they write you a check, so you start building those features.

</comment><comment><USER15> The fact that you're asking this question indicates that you haven't yet figured out what your market will bear in terms of price. In ANY business the ideal price is one that customers will question but still pay. If they don't question, the price is too low. Keeping your pricing dark is the best way to figure out your numbers at this stage. This is a long winded explanation but the answer to your question is YES! You can set your price at whatever you think the customer will bear. Be confident. If you've got a great product, don't feel bad asking a lot of money for it.

</comment><comment><USER16> They sure do but that's why businesses that hide their pricing behind "Contact sales for a quote" are always the last option to get considered; it's like a giant sign saying " _We 're going to gouge you as much as we can get away with!_".

And, of course, if the customer finds out that other customers are getting better pricing, expect them to raise hell until they get the same price or better.

</comment><comment><USER17> In my experience, the 'Request Demo/Quote' or 'Contact Sales' is a bit more nuanced than just price differentiation. Especially when the product is offered by a young and/or small to mid-sized business.

First of all, building a company which can effectively sell to (and support) businesses as well as end customers is far from easy. Unless a company has a proven track record, I'd meet such claims with much skepticism.

Enterprise customer's expectations/requirements from a support, integration, availability, etc. perspective are completely different than those from an end-user. When going through those requirements, it comes down to finding the price at which those requirements can or are willing to be met. For example, an enterprise customer is likely to add clauses into the contract which deal with ownership changes, bankruptcy, option to transfer to a perpetual license (possibly with source code) in case of end-of-support, availability of consultancy services for integration to future tools, etc.

</comment><comment><USER18> Yes. It's known as 'value based' pricing.

When you see a 'contact sales' form it usually means professional sales people. Their job is trying to determine how much you are willing to pay based on how much you'll benefit from the product. But the pricing will not be $50 or $5000. Generally businesses aren't going to send professional sales people chasing a sub $10k deal.

Many SaaS companies don't want to create/maintain a huge professional sales apparatus, and/or they want to focus on getting a toe into places at $10/month/user and gradually growing through the entire company. So instead they try to slice the up the market based on per user costs, or making the specific features that businesses need really expensive. Building a pricing model that scales up quick.

</comment><comment><USER19> I would actually suggest a learning period for pricing. Basically youre going to iterate through several pricing models and youre not going to get it right your first try, so embrace that and figure out the best set of prices "for now".

\- make sure your unit economics work; you dont lose money on a sale unless its part of some intentional strategy (you need a pile of cash)

\- find some artificial scarcity features and at least separate your potential customers using one of these.

\- instrument your systems (sales and revenue) so you can get good stats on LTV, LTV:CAC, ARPA, etc.

\- after 6 months (or whenever you feel is appropriate) revisit pricing and revise your strategy.

</comment><comment><USER20> Note that this is a valid and even necessary strategy if onboarding or hosting or support costs are high and variable (for instance, onboarding requires custom integration with the customer's systems, performed by the vendor; or if you may have to spin up a variable number of servers to support their usage level; or for enterprise customers who may want to negotiate certain SLAs in terms of how quickly they can reach customer support via what avenues; etc).

Like many here, as a potential customer, I find this practice frustrating, tho.

</comment><comment><USER21> Yes. This is very common practice for enterprise software: price on value, not on cost, which means adjusting the price based on the user and their particular needs and pains.

</comment><comment><USER22> Maybe it's not the thing you are looking for, after I read your question carefully, but just wanted to mention that I do the same for customers depending on their country with Purchasing Power Parity to adjust prices. [0]

[0] [https://github.com/rwieruch/purchasing-power- parity](https://github.com/rwieruch/purchasing-power-parity)

</comment><comment><USER23> Every time I think about a price discrimination scenario either in SaaS, airline tickets, or booking a hotel, I see it in government taxation on individuals or corporations as well. If you make more, you have to pay more. Of course, the ones who pay more have some extra perks that come with the price.

</comment><comment><USER24> Tim Harford's Undercover Economist has examples of how to get people to self select:

[https://www.goodreads.com/book/show/70420.The_Undercover_Eco...](https://www.goodreads.com/book/show/70420.The_Undercover_Economist)

</comment><comment><USER25> It's best to have tiered pricing - add a few things as extra to the higher layer so there is additional value for the extra price.

Without that, I am not sure how this is sustainable unless you are in the "disposable services" business.

</comment><comment><USER26> Yep, very common. Even companies with upfront pricing (like AWS) will give custom discounts to enterprise users.

And for Startups, it's not uncommon to give discounts because sometimes you just want the logo.

</comment><comment><USER27> I recommend this book: The Strategy and Tactics of Pricing by Thomas T. Nagle Georg Müller

Not a short or simple read, but wonderfully covers working through all of the mechanics of creating pricing structures.

</comment><comment><USER28> No this is a bad idea. Price should align with the value customers get from the product. It needs to be defensible for many reasons but one of them is that your customers talk to each other.

</comment><comment><USER29> different prices to different users are foundational to the wedding industry and airlines/hotel, just off the top of my head. When I worked in travel a long time ago, there was a saying that if any 2 people paid the same price, somebody did their job wrong (paraphrasing - it was a _very_ long time ago)

In both of those cases however it's very easy for the vendor to cover their tracks. I imagine it would behoove you to do the same if you're taking a similar tack.

<comment><AUTHOR> My concerns generally revolve around the situation where users find out they've been charged different prices.

<comment><USER4> Nothing will happen in that case other than you maybe having to adjust the price.

</comment></comment></comment><comment><USER30> Yep, plenty of companies take a bunch of inputs (your budget, expected usage, potential revenue, how hard you negotiate..) and come up with a number based on that.

</comment><comment><USER31> In my experience most companies that hide their prices behind "request a quote" start out way higher and pretty much expect you to negotiate down.

</comment><comment><USER32> Even some consumer products do this, OkCupid charges you less for a premium subscription if your profile states you are a woman.

</comment><comment><USER33> Doesn't seem there's anything wrong with the approach. Why would you want to leave money on the table anyway?

</comment><comment><USER34> To answer your question as is, no - it would be dumb to have different prices for different users for the 'same' product. If you are certain that the value you provide is X dollars, then charge X dollars only - even if they are a 2 member team or a 1000 member team.

On the other hand - if you decide to move away from the license model, you can charge according to seats, etc.

</comment><comment><USER35> Publisher paywalls are also starting to experiment with this -- the price will raise or lower based on the user's income or propensity to subscribe.</comment>


RethinkDB 1.10: multi-indexing - <AUTHOR> http://rethinkdb.com/blog/1.10-release/

<comment><USER2> I kicked off a new project just a few days ago with RethinkDB -- absolutely loving it so far. This new release addresses a minor pain point and gives me confidence in my choice of data store.

In case `coffeemug is still checking in here, I'd like to put in a request to update the documentation page on drivers. The listed Elixir driver has been broken for a few months; a working one can be found at azukiapp/elixir- rethinkdb. Overall the page could be organized a bit better: putting the languages in alphabetical order and not duplicating the list (which pushes contributor names below the fold) seem like straightforward improvements. Thanks for all the hard work -- hope to be sharing my project and showing off some RethinkDB swag before too long!

<comment><USER3> These sound like very good ideas. I'll see if I can get them implemented. Thanks for the suggestions.

<comment><AUTHOR> A message has been dispatched to @mglukhovsky.

</comment></comment></comment><comment><USER4> Constantly impressed by the release speed and feature list. Thinking back to 1.4/1.5 (when I started using RethinkDB) and I wouldn't have believed myself had I seen the current features.

</comment><comment><USER5> [http://rethinkdb.com/faq/](http://rethinkdb.com/faq/)

WHY DOES EVERYONE RECOMMEND MYSQL? Seriously, its 2013, and postgres is right there in the land of amazing databases. Easy to set up. Easy to get started. And works so beautifully. Why do people mention MySQL. There is zero benefit to using it. Less than zero. It's harder to use than pg.

<comment><USER6> I've been using MySQL for over 12 years. It's easy to set up, easy to get started with, and works very beautifully.

Zero benefit, really, do you have to be so insulting?

<comment><USER7> I can't tell you how many MySQL users I've worked with where 50% of their dev work was doing complex caching and denormalization to avoid joins.

Now, as a MySQL user, you're saying to yourself "joins are slow". Yes. In MySQL, joins are very, very slow.

I mean, you could write a book on all the things MySQL does in a fundamentally broken way. It's a very long list. Generally, MySQL fans have only ever used a single database system, MySQL, and they extrapolate that it's completely brain damaged behavior is somehow a characteristic of relational databases. This is not so.

To be blunt, if you think MySQL works beautifully, I mean, will you at least admit that at least 95% of your experience is with MySQL? Anyone who had ever used any of Oracle, Postgres or even SQLServer could ever say that with a straight face.

<comment><USER6> I develop data management systems and one area of my job is to work with existing solutions and develop import/export routines, so I can assure you have I have a lot of experience across the entire spectrum of RDBMS's.

The MOST interesting thing I've found with the systems I've worked with is the insane use of SQL. Quite frankly, most developers have little to no real idea what they are doing when it comes to SQL, which is evident when you look at the rise of "NoSQL".

If you are a good software developer you will develop good software no matter the language. If you are a good DBA you will write good SQL no matter the underlying database system.

<comment><USER7> MySQL prevents you from writing good SQL..

If you have a nice normalized schema, you will need to do joins, sometimes involving multiple tables and joining to sub selects. With MySQL, this is just a disaster, so you can't have a nice normalized schema, or if you do, you have to stash data in a denormalized way somewhere.

<comment><USER6> I've written just as complicated joins with MySQL as I have Oracle, PostgreSQL, SQL Server etc etc all with very similar performance.

Can you provide/email me with some examples of what you are finding a "disaster" and I'll help find the flaws in the SQL or Schema, whichever it may be.

</comment></comment></comment></comment></comment></comment><comment><USER8> How is multi-indexing implemented? What kind of query performance can it attain?

This seems somewhat similar to hyperdex's search function. It is implemented through what is called hyperspace hashing. How would you compare yourself to hyperdex?

<comment><AUTHOR> An index in RethinkDB is an additional BTree that stores a record keyed by the value of the index, not by the value of a primary key. When you query by an index, RethinkDB looks the records up by looking at the index BTree instead of the main BTree. This is similar to how most RDBMSes implement indexes.

Multi-indexing is implemented by inserting multiple rows into the index B-Tree. So if your index for a document returns [1, 2], Rethink stores two records into the index BTree -- one keyed by 1, the other keyed by 2.

This is different from hyperdex -- we don't do any algorithmic tricks with spaces to make this more efficient. The model we used fit extremely well into our architecture, so @jdoliner just went ahead and implemented it.

Hope this makes sense -- great questions! (Also, love your username)

<comment><USER8> How do you handle distribution of documents among nodes? Say document X has 3 tags "A", "B", "C". Do you place all documents with tag "A" in the same node, all docs with tag "B" in the same (but potentially different) node, and all docs with tag "C"...? In that case you'd need to put document X in potentially 3 different nodes. Or do you not do that kind of "pre-sorting" and just send queries to every node asking for match for tag "A"? (I like my username too. I was surprised it was still available)

<comment><AUTHOR> Documents are distributed across nodes based on a primary key. Currently we use range-based sharding, but will be moving towards hash-based sharding soon. So, for any given document, we look at the primary key and determine where a document should be.

We store a secondary index for a shard on the same node where the master for the shard resides. So if you're storing users whose last names are between A-M on node A, all secondary indexes for users with last names between A and M will also be on node A. That means that for any secondary index query we have to contact all nodes that have shards for a table, but we do a number of systems tricks to make this really efficient.

<comment><USER8> > but we do a number of systems tricks to make this really efficient.

Can you talk about these tricks? I'd love to learn more about it.

</comment></comment></comment></comment></comment><comment><USER9> Brand new, written in C++, looks beautiful, nice client libraries, trying to steal all the best parts of other NoSQL databases? I'm going to give it a spin.

</comment><comment><USER7> Multi-indexing: index a single document by multiple values

So.. This is an inverted index. Not exactly a new concept, it certainly doesn't justify a new name. Unless, maybe, the people making RethinkDB didn't know.. no, that's impossible right?

Could a company commercially selling a database not realize they just reinvented a basic data structure?

Then again, the google query "site:rethinkdb.com inverted index" has no relevant results.

Maybe they think the name inverted index is more confusing than just inventing a new name?

<comment><USER10> They settled for the name since MongoDB calles it "Multi-key" index.

Most people would probably not be familiar with the name "inverted index".

</comment></comment><comment><USER11> How do you guys release such polished and worthwhile releases on such a regular schedule? It's rather impressive.

<comment><AUTHOR> Thanks. I'm one of the founders @ Rethink, and project/engineering management is my job. The dev team here is simply amazing. It's not false modesty -- I've been busy with some administrative aspects of the company for the past month and haven't been able to put any time at all into project management. The guys just took the issue tracker and ran with it -- I woke up this morning to discover that we've got a new release.

So, my hat is off to all the DB Rethinkers. It's an honor to lead such an amazing team.

EDIT: I do hire people and occasionally set the tone, so I deserve some credit :)

<comment><USER7> I strongly suspect that nobody thinks that when someone brags about the company they own it's any form of modesty, false or otherwise.

</comment></comment></comment><comment><USER12> Can secondary indexes be compound ?

<comment><AUTHOR> Yes!

      r.table('users').index_create('full_name',
                                    [r.row['first_name'], r.row['last_name']])

This indexes users both on first name and last name.

</comment></comment><comment><USER13> Is this similar to multi-column indexes in SQL?

<comment><AUTHOR> No -- multicolumn indexes are equivalent to compound indexes in RethinkDB.

RDBMSes don't need multi-indexing because they don't allow storing arrays of values in any meaningful way. Imagine having a row in a database that contains an array of values. For example, suppose that for every user you store an array of cities they've ever lived in. RDBMSes typically can't do that, but document stores can. If you'd like to efficiently find every user that has ever lived in Mountain View, multi-indexing lets you do that.

<comment><USER14> >For example, suppose that for every user you store an array of cities they've ever lived in. RDBMSes typically can't do that, but document stores can.

?? What? Are you talking about a junction table?

<comment><USER15> That's not storing a collection in a table. That's approximating the storage of a collection in a table by using standard RDBMS features.

If you think these are the same somehow, I encourage you to think about the number of disk seeks required for recovering the full collection in both cases.

<comment><USER16> If all you need is the indexed values, then most mature RDBMs's supports using covering indexes in queries and satisfying the query entirely from the index.

Since the point of B-tree's is to minimize disk seeks and packing values with the same key close together, the number of disk seeks can often be made just as small as if the collection had been stored in the "owning" record.

Secondly, whether or not it _is_ is an implementation detail. There's nothing inherently preventing RDBMSs from supporting "inlining" of collections from related tables. But in _practice_ most RDBMSs choose to support that exactly through the much more generic optimization of supporting queries using covering indexes...

In other words: It only takes a lot of disk seeks if you use a RDBMS that is lacking in features and/or haven't added the proper indexes.</comment></comment></comment></comment></comment>


Canon Hack Development Kit - <AUTHOR> http://chdk.wikia.com/wiki/CHDK

<comment><USER2> I used this on a Canon A480 to take periodic pictures while the camera was hanging from my Kite. The pics didn't come out well when I tried it, I think it was just way too windy. I'm sure I'll have another go later though.

The firmware is pretty neat though. You can just load it off SD card when you want to and not modify anything on the camera.

</comment><comment><USER3> I used this to nice effect on my Canon A590IS. It allowed me to overcome the 15 second maximum long exposure to get at least 64 seconds.(<http://www.flickr.com/photos/allseeingcuttlefish/3469157079/>).

I keep hoping someone will create a similar project focused on Nikon cameras.

</comment><comment><USER4> I really wish I could do some more hacking with this and some Eye-Fi cards. I had a research project focused on mobile group photography, Mobiphos (<http://nirmalpatel.com/research/mobiphos.html>) that I really wanted to use on high quality point-and-shoot cameras instead of just camera phones.

<comment><USER5> i'm sure you know but, fyi, canon a480 is not that high quality p&s camera.

<comment><USER4> I didn't intend to use the a480. These tools work on other Canon cameras.

</comment></comment></comment><comment><USER6> For those interested - I wrote a series on how to make HDR photos and mentioned using CHDK to do that with RAW files: [http://paulstamatiou.com/how- to-get-started-with-hdr-photogr...](http://paulstamatiou.com/how-to-get- started-with-hdr-photography-part-2)

</comment><comment><USER7> Very nice.</comment>


Moxie's Thoughts on Signal Pins - <AUTHOR> https://twitter.com/moxie/status/1281353114063257600 <comment><USER2> > This is similar to a larger pattern I've seen where projects that make no > attempt to provide privacy will never have any discussion about > security/privacy bugs that are discovered (can't have vulns if there's no > security to break!), and those that do will face periodic headlines.

</comment><comment><USER2> Correct title: s/Pins/PINs/

</comment><comment><USER3> So they work without metrics, and because of that had no idea that their focus group was out of focus.</comment>


Spendology: My Weekend Project - <AUTHOR> http://www.spendology.net Spendology helps users create a budget. The project actually took about 9 weeks working weekends and some nights. I came up with the general idea about a year ago.<p>HN has been very helpful in this process. I learned a lot about customer discovery and product development in addition to getting tons of motivation. <comment><USER2> Fatal error: Call to undefined function encrypt() in /home/kaa2102/public_html/data.php on line 109

<comment><AUTHOR> I think I cleared up this error. Thank you for taking the time to comment.

</comment></comment><comment><USER3> hahaha yeah right. "pay me $30 before you test my project" "and whatever you do don't use your favorite/main browser"

hahaha... no thanks

<comment><AUTHOR> Thanks for the feedback. I wish you the best of luck on your current and future projects. Cheers!</comment></comment>


Report Cards Give Up As and Bs for 4s and 3s - <AUTHOR> http://www.nytimes.com/2009/03/25/education/25cards.html

<comment><USER2> Everyone's bedazzled by the numeric grades, but I'd like to take a moment and gawk at the things being graded: "Decoding Skills", "Reading Engagement", "Basic Computer Skills", "Presentation Skills", "Research Skills".

I question the system's ability to grade based on such categorizations. "Reading Engagement" aka "Faking Interest In Boring School-Assigned Books" is particularly distressing of the set I can see.

(Yes, you read some interesting books in school assignments. So did I, but the bulk were pretty dull. I was and am an avid reader and faking an interest in The Scarlet Letter would probably have been beyond me. Fortunately, nobody actually required that of me.)

<comment><USER3> Yeah, it sounds like it is explicitly giving busywork it's own grade.

Teacher to Parent: "Well Johnny has a 4/4 math comprehension right now, so he knows everything we plan on teaching this year. But his math engagement has really gone down, to about a 1/4. So Johnny really needs to work paying more attention to what I'm saying in class"

</comment></comment><comment><USER4> "North Westall, a fifth grader, got 27 3s this marking period"

I'm glad they're giving a more realistic report and showing specifically what needs improving.

"while the top grade of 4 celebrates 'meeting standards with distinction.'"

However, meeting "standards with distinction" to me means you haven't met much. Of the standardized testing I've done (which admittedly was many moons ago), getting a perfect score wasn't saying much. It was truly a lowest- common-denominator type of standard. For our future's sake, I hope this is no longer the case.

However, if this comment is representative of what's happening:

"What happened was the high-performing students said, 'I don't have to work that hard' and they all stopped trying"

Then I fear there's no hope in such a system. This was happening even among the best of the best in my high school, where we often joked about "points per minute" to see how well you could do on tests or assignments in the shortest amount of time.

And I hate to say it, but what Dr. Guskey points out about the traditional way of grading:

"'The dilemma with that system is you really don't know whether anybody has learned anything,; Dr. Guskey said of grading on a curve. 'They could all have done miserably, just some less miserably than others.'"

Is even more true of the standards as I've seen them. You only get a chance to show you can excel at mediocrity.

</comment><comment><USER5> So we grade tests with two significant digits (0-100%). Then we partition these to a letter grade (<1 significant digit) Then we average the letter grades to a GPA with three significant digits. So what's a bit more confusion? Small wonder colleges place more emphasis on the SAT (3 digits).

<comment><AUTHOR> Actual quotation from a U.S. News top-25 university admission officer who visited my town last year: "The G.P.A. has become the most meaningless number in college admissions." Yes, the test scores continue to play a significant role in college admission, as one factor among several, because grade averages are hardly comparable at all from one high school to the next.

</comment></comment><comment><USER6> I once went to a magnet system that did something similar, presumably to prevent excessive competition for As when everyone was already exceptional.

I think the theory was "We teach algebra to 4th graders but there is _no way_ they'll figure out a 3 to 3 mapping on their own."

</comment><comment><USER7> The advanced elementary school I attended(15 years ago) did numbers. We always just saw them as a rewrite of letter grades.

<comment><USER8> Exactly. It's like reworking the scoring of the SAT from 1600 to 2400. If you have ANY kind of scaling system in place (which is integral in any kind of ranking system), it will always be converted.

</comment></comment><comment><USER3> I see nothing good about this. The only good purpose I can see this much information having is to split the class into many different sections by ability. And that will take a lot more resources than the new grading scheme is taking, so splitting up the classroom won't be a consequence of this.

If parents are really interested in having more information about how their kid is doing, I'm sure the teachers would be willing to talk with the parents. But this is just too much information, I mean a 14 page guide is needed to explain a one page grading sheet. It sounds very confusing.

</comment><comment><AUTHOR> I find it interesting that these "new" grades are linked to statewide standards, but there are still fifty different states setting these standards, so there won't be any comparability in these grades from state to state. I'm acutely aware of such issues as someone who moved to another state (twice) during my secondary education.

</comment><comment><USER9> About time. We had quite a few discussions with the registrar in my university about the benefit of converting a numeric grade to a letter grade (round to the neared quarter), which would then be converted back to numeric to compute the GPA.

</comment><comment><USER10> The only real change seems to be the removal of the concept of 'D'. This is understandable, D and F were interchangeable anyway.

<comment><AUTHOR> What the submitted article says the change is are two things:

a) division of each subject into several topics, with each topic being reported with its own grade,

and

b) setting standards for grading not in a norm-based ("curved") manner for each classroom, but in a criterion-based manner comparable across a whole state.</comment></comment>


$0.02 advice on how can you scale your business - <AUTHOR> https://www.linkedin.com/pulse/how-can-business-leaders-take-next-level-orgzit-nitin-verma <comment><AUTHOR> What is that stops you to take your business to the next level?

Nitin here shares what stopped him and how he overcame it, hat about you?</comment>


State Veterinarian Confirms Multiple Cases of Canine Brucellosis in Central Iowa - <AUTHOR> https://iowaagriculture.gov/news/state-veterinarian-confirms-multiple-cases-canine-brucellosis-central-iowa <comment><AUTHOR> _Brucellosis a zoonotic bacterial disease, meaning an infected animal can transmit it to humans and other animals through contaminated reproductive fluids._</comment>


Ask HN: Is it ok to use .org domain for commercial startup? - <AUTHOR> I want to use a .org domain for my startup (I will put some ads and premium services). Is there any legal issue? Or any other aspects that I should consider. <comment><USER2> There is absolutely no legal issue. The big three (org|net|com) are entirely advisory in nature [1]; the vast majority of customers couldn't tell you what they're supposed to advise. Google has historically used "presumed difficulty of getting this domain name" as a quality heuristic; this advantages exact- match domains on the big three (which are treated identically) and causes relative disadvantage for e.g. .biz.

Many folks on the VC-funded trajectory would tell you that there are brandability issues which would counsel you starting on, instead, getBETTERNAME.com or BETTERNAMEapp.com or something and tradition to BETTERNAME.com at any price once you have the ability to do so.

I built a company on a .org and ran it to sale, because the .com would have cost $30k and the .org cost $8.95. I can think of no difference it made over the lifetime of the business; my daughter's college fund, on the other hand, has a very clear view of the delta between the two.

[1] n.b. not true of all TLDs; .gov, .edu, and many of the geography-specific ones have various requirements to be able to use them

<comment><AUTHOR> Thanks @patio11, Can you please give me some domain names (.org) which is making money

</comment></comment><comment><USER3> Nonetheless, .org is for not-for-profit associations, while .com is for-profit corporations. .net is for networks, and .biz for businesses.

A lot of startups use .io, but unless they're located in or are addressing the British Indian Ocean Territory, they should not.

I choose my "providers" taking into account the tld classification. For example, my open source free software projects are hosted on framagit.ORG, not on github.COM. (Well, ok, since people are dumb and they all go to github, I also have clones there, but I expect the commercial github entity to shutdown that service and erase them at any time for any reason their shareholders may have).</comment>


Show HN: Find Web Development Jobs Matching Your Skills - <AUTHOR> http://webdevjobs.co <comment><USER2> I can't see the website for a long time.</comment>


Turning Out The Lights: Coghead - <AUTHOR> http://blogs.wsj.com/venturecapital/2009/02/19/turning-out-the-lights-coghead

<comment><USER2> The value of the TechCrunch deadpool is that they actually break stories. I'm not sure what the value of rehashing them on a WSJ blog is.

<comment><USER3> Normally I'd agree, but a comment on the WSJ post makes a significant claim that's directly at odds with the TechCrunch post yesterday: that SAP bought the company and shut it down. I have no idea whether there's any truth in that.</comment></comment>


Domain-validated SSL will soon be free from the large CAs - <AUTHOR> https://certsimple.com/blog/domain-validated-ssl-will-be-free <comment><USER3> Dammit.

No, I mean, this is great news, but I thought I could create value by listing the CAs that provide free SSL on this page: [https://paragonie.com/white- paper/2015-secure-php-data-encry...](https://paragonie.com/white- paper/2015-secure-php-data-encryption)

And soon I won't be. Dammit. And the worst part is, I can't even be angry about that, because it's subverted by a significant security gain.

<comment><USER4> >And soon I won't be.

You could pivot to in-depth reviews of the various providers.

I'm sure some providers will be a pain in the backside, some will be great, others somewhere in the middle, and all will have various differing support options, up-sell discounts to "premium" certs and so on and so forth.

<comment><USER3> That sounds like a great idea for a follow-up page (or alternatively, a great way to get sued for libel).

<comment><USER4> >a great way to get sued for libel

I'm pretty sure you're saying that with tongue firmly in cheek.

Just in case, though, even in the UK you're covered by fair comment:

[https://en.wikipedia.org/wiki/Fair_comment](https://en.wikipedia.org/wiki/Fair_comment)

<comment><USER3> And if I were to ever be brought into court, I would very likely lose more in legal fees than I make in a year, even if I win.

(I'm in America, where going to court and hoping not to end up destitute afterwards means you already lost.)

<comment><USER5> On the phone I once said, "In my opinion he is dishonest". I was sued in US District court. In total it cost me $3,000 and I got off easy.

My attorney thought I might win the case but a single day of court would cost $6,000 at the time. I settled.

<comment><USER3> Yeah, I don't have $3,000 to burn, otherwise I would have a mode of transportation that doesn't consist of:

        - <USER2>
        - asking a friend to drive me somewhere

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> There's a shift happening in the browser space as well to "downgrade" the UI for DV certs, much less green locks and bars and more gray and no red security warnings.

We're entering a world where every site has a DV cert (most likely for free with registering a domain) but that all of the things for which we now consider "needing SSL" will require an EV cert.

<comment><USER7> As long as browsers don't start popping up scary warnings about submitting forms to a site that only has DV certs, I think it'll be fine.

<comment><USER8> And hopefully soon they can pop up scary warnings for unencrypted sites.

</comment></comment></comment><comment><USER9> And yet Heroku still charges $20 per month on top of their usual fees just to host your certificate. This is why I've moved so many simple static sites to Digital Ocean droplets.

</comment><comment><USER10> About time! It's insane that CAs have gotten away with charging extortionate amounts of money for a couple paragraphs of text that cost ~nothing to generate for so long.

</comment><comment><USER11> If this is true, it's far better news than Let's Encrypt ever was. I tried the Let's Encrypt beta and was extremely disappointed that getting a certificate isn't possible with DNS records—you have to do the challenge response by serving a page from the live server. This is a non-starter for many use cases. If every CA is going to be offering certs free soon, at least one of them is bound to have a real API that's not encumbered by terrible tooling.

<comment><USER12> DNS-based challenges are coming, hopefully soon after the launch date[1].

[1]: [https://community.letsencrypt.org/t/shouldnt-verification- vi...](https://community.letsencrypt.org/t/shouldnt-verification-via-dns- record-be-a-priority/604/15?u=pfg)

</comment></comment><comment><USER13> That's great. Soon enough there won't be any excuse to not offer HTTPS.

<comment><USER14> I think there is already no excuse to not use HTTPs at this moment, no?

<comment><USER15> Some excuses:

      - It's somewhat complicated for a site to implement correctly

      - It mainly protects users who have already connected to a site once
        from a secure location and whose browsers support HSTS and other "fixes"

      - Circumvented easily via phishing

      - Does not prevent nation states from MITMing connection

      - Can only host one site per IP, without a wild-card or UCC cert
        (which not all clients support)

      - Makes caching difficult to impossible

      - Adds performance overhead

      - Potential for new attacks on the TLS layer
        (SSL Strip, STARTTLS Command Injection, BEAST, POODLE, RC4, CRIME,
         TIME, BREACH, Truncation, FREAK, Logjam, Heartbleed, BERserk,
         Root cert forgery, ChangeCipherSpec injection, Protocol downgrade,
         Certificate errors, Renegotiation, Triple Handshake,
         Virtual Host confusion, DoS)

      - General confusion by users as to what makes a connection secure

<comment><USER16> > Can only host one site per IP

[https://en.wikipedia.org/wiki/Server_Name_Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)

The rest of the excuses are basically 'it's not 100% perfect some of the time so why bother any of the time.'

<comment><USER15> Someone asked why somebody might not use HTTPS and i'm just saying what their excuses are. This isn't even a list of _reasons_ why people cannot support HTTPS, which includes public agency policies, legacy support requirements, funding limitations and lack of resources.

<comment><USER16> I'm not saying that you were putting them forward as valid, I'm saying that list should be ignored.

</comment></comment></comment></comment></comment></comment><comment><USER17> What about support for Certificate Transparency? Can we get that, too? Otherwise, Mozilla/EFF's CA is probably more trustworthy.

</comment><comment><USER18> And I don't know if this is much of a teaser: [https://twitter.com/Namecheap/status/667348562980810752](https://twitter.com/Namecheap/status/667348562980810752)

That could mean a few things, but either way, things are looking good for site owners.

<comment><USER19> Gives a 404. Care to say what was there?

<comment><USER18> Oops, they deleted it. It was a post from Namecheap answering somebody asking if they were going to support Let's Encrypt.

Original question: [https://twitter.com/matbacon89/status/667348413470650370](https://twitter.com/matbacon89/status/667348413470650370)

Person's response: [https://twitter.com/matbacon89/status/667348648741744640](https://twitter.com/matbacon89/status/667348648741744640)

In between, they _did_ say something like "You'll have to wait and see! :)"

I wonder if they deleted it in light of this blog post, which I find disingenuous: [https://blog.namecheap.com/ssl-from-namecheap-whats-the- diff...](https://blog.namecheap.com/ssl-from-namecheap-whats-the-difference/)

<comment><USER20> Hey - so I tweeted that...and to be very clear, nothing in that tweet should have been implied as a yes. But since it was potentially construed as a yes, it was deleted to avoid confusion.

<comment><USER21> In the blog post, you point out that you perform additional validation for your OV certificates while the free CAs do not. But since they are equally trusted by the browsers, how does that increase security for me?

On the other key differences:

\- Shorter lifetimes is actually an advantage, since it reduces the risk when your keys are compromised. Revocation is a mess, the only way you can be _sure_ that a certificate can no longer be used is when it's expired.

\- No wildcards is an advantage too, since you can give each service its own certificate and if one is compromised, the others are fine. If you're using an organization-wide wildcard cert, a compromise is much worse.

\- Limited flexibility - "you must have root access to your servers " is factually incorrect, the automated Let's Encrypt client is optional and you can request a certificate manually.

\- Limited support - why would I need a SLA for a certificate, anyway? The OCSP servers?

\- Management difficulties - while this is true now, the automation enabled by Let's Encrypt is likely to facilitate management, not the contrary. I'm currently working on a Puppet module which will automatically provision certificates for web servers, something which used to be much harder.

\- Build Trust with Purchased SSL - how do I increase trust by using a OV certificate? It's not like an average website user would look up the certificate details, and there's no functional difference between a OV and a DV certificate.

> The levels of encryption, validation, and trust that business and commerce > websites require are available only with purchased SSL.

Unless you're talking about EV certificates, I don't see how. There's no "level of encryption" which isn't available with a free CA, and the additional validation and trust do not matter unless it's a EV certificate. Even an EV certificate does not protect against MitM. The real answer is key pinning.

As a Namecheap customer, I'm disappointed by this blog post. It reads like an attempt to spread FUD about free DV certificates. I initially became a customer because I read good things about your business ethics, but this makes me question my choice.

<comment><USER22> As a Namecheap customer I was very very disappointed with this post when I read it yesterday. Also, it looks like they deleted a comment on their post from someone else who was disappointed and called them out on their FUD.

<comment><USER23> They've further edited the post to remove a lot of the misleading content, but not all.

<comment><USER21> Much better, but they're still arguing that somehow, non-EV certificates with identity validation are more valuable than DV certificates because users are going to look up the certificate details.

> We think that validation of a certificate's owner is an important point that > needs to be highlighted and discussed. Recent developments in SSL automation > are fantastic from a technical point of view, however, consumers need to be > educated on this new security paradigm and the appropriate signals to look > for when making a security determination. Looking for 'https' and a lock in > the browser bar, the traditional indicators that have been messaged as > reliable, may not be so reliable anymore when it comes to the consumer > definition of security.

This is laughable. It's been hard enough to get users to check for the presence of a security indicator _at all_. Most don't even know the difference between DV and EV, and EV certificates do have a strong visual indicator. OV certificates don't have any, except

Hell, _I_ might not realize in time that my online banking session only has a DV certificate today instead of EV and I'm a professional.

Sure, I sometimes check which CA a particular site is using, out of curiosity. But no normal user is ever going to do that on a regular basis.

> Additionally, any time we receive a report of abusive activity and/or fraud > involving a certificate, Namecheap works with CA's to investigate the > reported sites, and CA's often take quick action to revoke site certificates > as a result. This third-party revocation capability is important; it > provides an additional layer of post-issuance protection.

Soo... How does that protect me as a Namecheap customer? Buying from Namecheap doesn't mean that an attacker couldn't request a Let's Encrypt certificate anyway, unless you use cert pinning and you can do that with free certificates. There are some enterprise use cases where you'd just pin the CA instead of single certs, but those only matter at scale.

Namecheap is right about OV certificates being more trustworthy than DV ones, but the thing is - it doesn't really matter.

> Additionally, given recent developments, we strongly believe that additional > education is required on the correct signals for consumers to use when > making a security determination; browsers must necessarily shoulder some of > this responsibility,

Like.... EV certificates? C'mon, browser vendors aren't going to add _another_ security indicator just to protect your revenue.

<comment><USER23> Yeah, their points are all pretty shaky. I've been a fan of Namecheap for awhile because of their past support for a better internet, but it's extremely disappointing to see this post from them.

I guess I didn't expect them to put their profits over what's best for the web.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> _StartCom have given out free DV SSL for years - officially only for non- profits, but in practice for anyone who asked_

They would refuse to renew certificates every now and then if they deemed your use commercial though.

</comment><comment><USER25> I wonder whether spammers and phishers will make use of that? We often tell people to look for the lock symbol or "https" \- those will no longer be (weak) signifiers of trust.

<comment><USER26> Probably. Let's Encrypt has a pretty good response to that: [https://letsencrypt.org/2015/10/29/phishing-and- malware.html](https://letsencrypt.org/2015/10/29/phishing-and-malware.html)

</comment></comment><comment><USER27> Does anyone know who the two CAs this post mentions are?

<comment><AUTHOR> Yes, I do. :^)

</comment></comment><comment><USER28> And here I just renewed my DV cert for three years.

</comment><comment><USER29> non-wildcards will be free

Prepare for wildcards to cost a fortune to compensate.

<comment><USER30> Let 'em. With something like Let's Encrypt that uses an API to sign domains on the fly, I'm having a hard time thinking of a use case that would be appropriate for wildcards but not appropriate for this.

WC certs are already a ripoff anyways.

<comment><USER31> > I'm having a hard time thinking of a use case that would be appropriate for > wildcards but not appropriate for this.

Serving multiple sub-domains from the one IP whilst still supporting clients without SNI.

</comment></comment></comment><comment><USER7> Not quite on topic, but what the heck is with the bar graph at the bottom of the page?

[https://certsimple.com/images/blog/compare.svg](https://certsimple.com/images/blog/compare.svg)

The vertical axis isn't labeled and I can't tell what the bars are supposed to represent from the context? Is the vertical axis pain? Cost? Customer base?

<comment><AUTHOR> Thanks for the feedback Mike! It's speed. I've reverted the text back to the previous copy which was more specific.

Further info: ask anyone you know who's got an EV cert from a traditional provider: it's a slow, painful process. CAs typically quote 7-10 days. I waited a month for GoDaddy earlier this year, and many others have too.

CertSimple starts checking your details while you fill in the form, and flags a wide variety of issues _before you pay us_. Our average validation time is 5 hours.

During validation, we provide very, very specific instructions based on a number of aspects of your order and your company. People with .io domains and Swedes really like us. As do in many other situations where the EV process typically shows down.

We update in realtime during the validation, and the certs downloads automatically.

We're about to replace the graph with the wall of Twitter customers from our front page, so let me know what you think of that!

<comment><USER32> Maybe someone listened but it recently took 2 days to get an EV cert from Comodo via Namecheap. Some of that was probably due to having a registered company with a DNB Number - YMMV.

<comment><AUTHOR> It recently took 10 minutes to get an EV cert from CertSimple: [https://twitter.com/webster/status/667022550594113536](https://twitter.com/webster/status/667022550594113536)

Our average validation time is five hours.

Nobody else has our tech or does anything close. When they catch up to what we're doing now we'll be another year ahead.

<comment><USER33> Is there really much demand for that? If you want an EV cert you're going to be a big business with a lot of employees just to handle that kind of stuff. 2 days really isn't that long - getting internal signoff on the idea of using an EV cert probably takes longer than 2 days.

<comment><USER7> That seems kind of self-fulfilling. If the process is slow and bureaucratic then naturally only slow, bureaucratic organizations will get them. But maybe demand for EV certs would be greater if the process was more streamlined.

</comment></comment></comment></comment></comment></comment><comment><USER34> But to what agencies will they disclose the private keys?

We need a SSL system where there's both a CA-signed key and a self-generated and self-signed key. That would prevent both forged sites and CA-assisted snooping. CA-signed alone is vulnerable to Government wiretapping. Self-signed alone is vulnerable to site spoofing. Both together would provide some real security.

<comment><USER35> You can achive the exact equivilent of this today with HPKP and HSTS.

CAs never see your private key, they are incapable of giving it to the NSA.

<comment><USER34> My bad. Thanks.

</comment></comment></comment><comment><USER36> This is all good and well, but if we take a step back it pretty much means that anybody can get a DV certificate without any verification, which means CAs are useless, which means that DV certificate offer no more guarantees about anything than self-signed certificates.

Which is an excellent thing: maybe we'll finally be able to just use self- signed certificates ? And ask CAs for something where they _actually_ can provide value, ie EV certificates, for as long as we're okay to stay with this model ?

This should be a call to browser vendors: when this is more widespread, accept self-signed certificates as if they were DV certificates !

<comment><USER37> DV certificates does provide a service that self-signed certificates don't, though: they verify that the server controls x.com according to the public DNS system, not just according to the user's ISP/DNS server.

<comment><USER38> Strictly speaking, they verify that server controls x.com according to the CA's ISP/DNS server/any other parties in the middle instead of the user's ISP/DNS server/any other parties in the middle.

</comment></comment></comment><comment><USER39> It already is free. Just use CloudFlare.

<comment><USER40> I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring "iran". Seriously[0].

[0]: [https://twitter.com/matiaskorhonen/status/561063104596172800](https://twitter.com/matiaskorhonen/status/561063104596172800)

<comment><USER41> So 20 years later we are still stuck with this: [https://en.wikipedia.org/wiki/Scunthorpe_problem](https://en.wikipedia.org/wiki/Scunthorpe_problem) ?

<comment><USER7> It's always going to be around in some form, it's a clbuttic problem.

</comment></comment></comment></comment><comment><USER42> Let's Encrypt is a bit of a joke though. You have to renew every 3 months. Anyone who has used these certs knows what a huge pain in the arse it is to do even once a year.

"Oh but we'll work out some way to semi-automate it". Ok, where is it for those of us on cheap cpanel providers who barely know what we're doing? I though this service was for us?

<comment><USER43> > we'll work out some way to semi-automate it

no. It will be automated completely. You set stuff up once and the certificate will be kept up to date.

>Ok, where is it for those of us on cheap cpanel providers who barely know what we're doing

let's encrypt support will be added into cpanel or even into the web servers powering cpanel. All you'll have to do is check a checkbox or set a configuration file entry in the style of `enable_letsencrypt=yes` and you're done.

You won't have to care when the certificate expires. At that point 3 months starts to become interesting because expiration provides a nice hard cutoff date for revocation which works independently of OCSP and CRL availablility.</comment></comment>


Haskell on Windows - <AUTHOR> http://www.gundersen.net/haskell-on-windows/ <comment><AUTHOR> I made this submission myself (it is my own blog). The issues in this blog post took some time to solve, and was not obvious at the outset. I hope it can help others new to Haskell.

<comment><USER2> Have you tried the chocolatey package?

<comment><AUTHOR> I have not tried that, but most of the issues I address (if not all) would still be present since a packager/installer can't address them - only changes in the Haskell Platform itself can address these issues.

<comment><USER3> You should file some tickets with the Haskell platform folks. Some of these problems are beyond the scope of what HP can / should do, but HP, like many other bits of the Haskell ecosystem are entirely volunteer driven.

<comment><AUTHOR> I filed one with the ekg-maintainer and try to folow the development. Hopefully, the cabal path issue is solved when 2013.02 comes out.

<comment><USER3> So you want the Haskell platform install to edit your path variables? Write a patch and ask the Haskell platform folks if they'd merge it in. It's all open source. The best way to fix simple things is to fix them and send in a patch.

</comment></comment></comment></comment></comment></comment><comment><USER4> I am a Windows user but I am seriously considering buying a small mac computer (maybe macbook air but I want more ram) for open-source development. It's no surprise that today, many tools, many functional languages work best on Linux and MacOS. All the screencasts I watched recently were on MacOSX. I tried many things to have it both ways : VMWARE with Ubuntu : X Server crashes every time when I use the browser VMWARE with Mint/Fedora : Crashes before that VMWARE with MacOSX : The whole thing went into a crashing loop after 10 minutes.

Back to my snappy W7 I am.

<comment><USER5> If you're primary use will be OSS development then you're best bet is to buy a cheap PC and throw Debian on it. I'd go with the testing branch, which, despite the name, is very stable.

In my experience it's a lot easier to use existing OSS code on Linux than it is on OSX. OSX is a lot better than Windows, but I found I spend a lot of time on OSX debugging weird library problems and trying to get dependencies installed. A common problem is that I'll be trying to build/install a library, but it'll have a prereq that isn't met because Apple included an ancient version of it. Fink and MacPorts help a bit, but at that point it you might as well just install Linux, since they're basically emulating the various Linux package management systems, but they don't integrate with the OS very well.

On Debian I "apt-get install" the -dev package for the library I want to use, and everything works. And on the rare occasion a library isn't available through apt-get, building from source is almost always as easy as "./configure && make && sudo make install". Sometimes that'll work on OSX, sometimes it won't.

In the meantime you might want to try Linux or OSX in VirtualBox first. Sounds like your VMWare installation might be broken.

<comment><USER6> Mac ports and Fink? Apparently 2008 called and they want their stuff back.

<comment><USER5> Okay, I admit I haven't tried very hard to setup OSX for OSS development lately.

But at the same time you're making my point. I don't have to worry about it on Linux - I use my distro's built in package manager and it just works. On OSX you have to figure it out yourself.

</comment></comment></comment></comment><comment><USER7> Is it any easier to write gui code on windows now? I remember trying to write stuff with gtk a few years ago and it was incredibly painful to get anything to work.

<comment><USER8> The gtk bindings are easily installable with cabal install these days, so it's way easier now. Just download one of the all-inclusive GTK bundles, add the bin dir to the path, then 'cabal install gtk2hs-buildtools' and 'cabal install gtk'.</comment></comment>


Ask HN: Launch App during or after WWDC? - <AUTHOR>

My iPhone app is (finally!) ready for submission to the app store. Would you launch right into the noise of the WWDC, or wait until after it had subsided? <comment><USER2> I'd wait - actually a couple of weeks, if you can. Then the WWDC noise will have subsided and columnists and bloggers will be looking for new news.

<comment><AUTHOR> What about for soft launching? I wouldn't mind a little time to respond to any initial issues that show up.

Is there significant value in the first submission? In particular, for getting onto Apple's notable list?

</comment></comment><comment><USER3> Apple always suggest launching it after WWDC so it doesn't compete and get lost.</comment>


Amazon to deploy masks and temperature checks for workers by next week - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-amazon-com-masks-e/exclusive-amazon-to-deploy-masks-and-temperature-checks-for-workers-by-next-week-idUSKBN21K1Y6 <comment><USER2> Then workers should stay home with pay until next week.</comment>


Paying It Forward: Interview w/ Matt Lauzon, Founder & CEO of Gemvara - <AUTHOR> http://bostinnovation.com/2011/04/06/paying-it-forward-rob-go-chats-with-matt-lauzon/

<comment><USER2> FYI - if you're listening, you'll need your left speaker/ear plug working, as it's only playing in the left channel.</comment>


The latest "nightmare inducing" Boston Dynamics robots - <AUTHOR> https://www.youtube.com/watch?v=-h5qpXO3isM <comment><AUTHOR> Skip to the 3:45 mark.</comment>


Are Electric Cars Too Powerful? - <AUTHOR> https://cleantechnica.com/2018/06/29/are-electric-cars-too-powerful-tesla-model-s-involved-in-deadly-crash-was-traveling-116-mph/ <comment><AUTHOR> I think this is an interesting question in light of the latest Tesla update that allows an owner to limit the top speed of the car remotely. What prevents the manufacturer from limiting the speed, or any other aspect of the car, remotely at any time? And is this control a good thing or a bad thing?</comment>


How Microsoft can release just one version of Windows 7 - <AUTHOR> http://www.crunchgear.com/2009/02/03/simplify-simplify-microsoft-just-release-one-version-heres-how/ <comment><USER2> So basically it just looks like the vast majority of us will be getting Home Premium and being just fine with it.

I don't see why this is such a big deal, honestly. The reason that there's not the same number of flavours of Ubuntu, say, is because Ubuntu is aimed at such a small niche of people (and they STILL manage to have four versions: 32-bit desktop, 64-bit desktop, 32-bit server, 64-bit server).

Microsoft is trying to be all things to all people, which is honestly what their market dictates anyway. Having this many versions of W7 isn't ridiculous, it's a _requirement_.

<comment><USER3> OK so Ubuntu has 32 bit and 64 bit flavours. Different flavours for different architectures does not seem objectionable to me.

As for desktop and server, they are not different OSes (unlike Windows where the cheaper editions are crippled in some way). You can install server and add the desktop (apt-get ubuntu-desktop) or install the desktop version and uninstall the GUI and install whatever server software the server version includes.

It may be a better illustration of your point that there are a lot of versions of Linux out there, but then again, they are from different vendors.

Ubuntu is not aimed at a small niche. It is specifically meant to be a general purpose desktop OS. See bug #1: <https://launchpad.net/bugs/1>

In practice I know a wide range of people who use it from developers to ordinary home users.

</comment></comment><comment><USER4> Microsoft can get away with this while OS X and Ubuntu (and other Linux distros) can offer 'advanced' functions for free is because of their massive business base. Out of the box a Mac has a full RSA keychain service, encrypted VPN, file and printer sharing, hard drive encryption, and the ability to remotely install programs (although it does require a separately priced admin program). I bet that 99.9% of the people don't care about those functions on their Mac, but they're there. Even if for the sole purpose of supporting said enterprise features just so Apple themselves can use it in their office.

Of course I think Microsoft is just milking their business customers while most people will just get the Home Premium that Dell gave them because the general public really doesn't care about the above features.</comment>


The Acceptable Cost of the Right to Bear Arms - <AUTHOR> http://www.vice.com/en_uk/read/the-acceptable-cost-of-the-right-to-bear-arms-warren-ellis?utm_source=vicetwitter <comment><USER2> A bit late to the party, but since I respect you in things programming I should point out:

The author is _dreadfully_ ignorant. He calls AR-15 pattern rifles "a style of assault rifle preferred by special forces teams around the world" which is not true except in the broadest of senses because this particular design is the least reliable of any fielded (direct impingement vs. piston; besides us on Canada uses it by choice for obvious reasons, every other user gets them donated).

In calling it "a special forces weapon" he's trying to imply its use as rare, when the military version was adopted by the US _a half century ago_. Since the '60s, _everyone_ who goes through Army basic training learns how to shoot one, and we've been able to buy semi-automatic versions since the '60s I think, certainly since the '70s. There are well more than 4 million copies of this particular design in US civilian hands to date.

The more general style of assault rifles with intermediate power cartridges, which which the AR-15/M16 are but one example started with the Nazi "StG 44 (Sturmgewehr 44, literally "storm (or assault) rifle (model of 19)44")" (Wikipedia), includes the AK-47 and its descendants, and practically every modern army issues something like it. The British Army switched to one in 1994, before that they used a select-fire (semi- and full-auto) "battle rifle" with a normal, traditional more powerful cartridge.

I don't know if he realizes it, but he's comparing US murders and suicides with U.K. murders with a gun (and ignoring population sizes); this also ignores the minor detail that we're fundamentally different peoples. In our case a more lethally violent one, the US specified in method but not a gun murder rate is almost the total U.K. murder rate (<http://news.ycombinator.com/item?id=4935644>).

On the other hand, in the last century which just happens to coincide with the U.K. gun banning, violent crimes have skyrocketed to the point that outside of murder it's more violent than the US (!). According to historian Joyce Lee Malcolm in about 90 years the nation reversed a steady trend since the 13th Century of decreasing interpersonal violence.

Anyway, for some obscure reason, I'm not interested in advice from people this ignorant, who are also generations removed from even being able to use guns in self-defense (how long depends on which metric you use, there's the early _de jure_ bans through registration, the courts in the '50s and then Parliament in '67 outlawing using effective means in self-defense, to the total ban on handguns in '97).</comment>


Taking the 'D' Out of CRUD with Soft Deletes - <AUTHOR> http://scottsmerchek.com/2015/08/03/taking-the-d-out-of-crud

<comment><USER2> Let's go a step further: if we're worried about data persistence, should the table also be append-only? Soft deletes won't protect against a user manually wiping every field in their account.

<comment><AUTHOR> Right. I think updates are just as destructive, and oftentimes completely change the meaning on an entity. That's why I also wrote about using soft updates: [http://scottsmerchek.com/2015/08/04/taking-the-d-out-of- crud...](http://scottsmerchek.com/2015/08/04/taking-the-d-out-of-crud-with- soft-updates)</comment></comment>


Who caused the Bay Area's housing shortage? - <AUTHOR> http://extras.mercurynews.com/blame/ <comment><USER2> Not one mention of Prop 13? Poor reporting.

It's basically the rent control story writ large. Everyone who bought in the 20th century has such an "amazing deal" that they won't give it up unless you a) entice them with a better deal or b) gore their oxen and repeal 13.

<comment><USER3> How does prop 13 cause a housing crisis?

It certainly entices people to hold and rent properties they own rather than sell, but those units are still part of the housing stock.

I think repealing prop 13 for commercial properties makes sense as a way to raise tax revenue, but don't see doing so for residential property having an impact on housing costs.

<comment><USER4> There's a guy on my street that owns 27 houses, all bought in the 90s. While that guy is getting subsidized income by paying less taxes on high value property he is less likely to sell that property to developers who will build higher density housing. The same can be applied to the people who own vacation or retirement homes out here (there's a surprising amount of vacant property out here). The taxes that aren't being paid by all those people has to be made up for somewhere, so the taxes on new property owners are higher (as are the number if different fees and things like sales tax).

<comment><USER5> > The taxes that aren't being paid by all those people has to be made up for > somewhere, so the taxes on new property owners are higher

No, they aren't. Prop 13 limits maximum property tax rates to very low amounts as well as limiting assessment increases, so no jurisdiction is able to make up for artificially low assessments by jacking up the nominal rate.

> (as are the number if different fees and things like sales tax).

Mostly, it's state income tax, though state and local sales tax are also affected (there are general and program-specific revenue sharing mechanisms by which state revenue goes into local coffers to pay for local programs.)

<comment><USER6> Property value is reassessed on change-of-ownership.

Lower housing stock leads to inflated home prices, causing higher taxes paid by more-recently-purchased homes.

<comment><USER5> > Property value is reassessed on change-of-ownership.

Actually, it's reassessed annually, there is just a limit to annual assessment increases except with qualifying events.

Which doesn't change the fact that Prop 13 limited nominal rates to lower values than many jurisdictions (including core Bay Area ones) were before Prop 13; jurisdictions aren't making up with artificially low assessments on long- held properties with higher taxes on other properties. Yes, those other properties are assessed closer to full value, but it's not offsetting anything. If you cut the food you eat on weekdays by 50% and that on weekends by 66%, you aren't making up for the reduced weekend calories by eating more during the week.

<comment><USER7> This is an outlandish argument to make. Prop 13 contributes to shortage of housing stock. Shortage of housing stock causes prices to rise. In the event of any sale (existing property or new), the price will be higher than it would have been without Prop 13 in place. The same marginal tax rate on the new (or transferred) home now amounts to a larger amount than it would have otherwise.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> A self-centered desire to preserve an environmentally unfriendly suburbia at the expense of others who wanted to share in the region's prosperity contributed the shortage.

In the article the polls cited say that people think it was profit seeking developers and "technology companies who add jobs". Clearly instead of accommodating these desirable jobs we should give ample incentive for them to go elsewhere.

</comment><comment><USER9> The XXth century's "American way of life" myth, with individual homes in suburbs and a car to go to work. That just doesn't scale well, espacially with the geography of the Bay Area.

And if you're really looking for a "who": the car manufacturers who fuelled this myth through advertising.

<comment><USER10> Car _and oil_ corporations, and not just advertising: lots of lots of lobbying, too.

<comment><USER9> You're indeed right, but advertising is even more pernicious than lobbying: it makes people _love_ the problem.

</comment></comment></comment><comment><USER11> I dont understand whats the outrage is about. Bay Area / San Francisco housing market is tough because that area is special. Its special because its home to world's most innovative companies that pays its staff world's highest salaries. So it basically became an exclusive neighborhood for the wealthiest and most talented (demanded) people. And it stay special because those who are not in demand cant afford to live there. You think it will be better if housing became cheaper and all those who could not afford to live there now would be able to move there and turn the place into a shit show like Queens and Brooklyn have become? Overcrowded houses with too many cars on the street, all the double parking and chaos not to mention filth on the streets and the noise? You cant afford it for a reason, if you were needed there Google would offer you a salary high enough for you to be able to afford it. Everybody is basically in outrage that they cant get into and live in this exclusive, high class neighborhood but if everybody could afford to live there it would not be exclusive and high class anymore and those things that attracted you there back then would not be in place any more and the area would become into a place that you run away from in the first place.

<comment><USER12> Interesting that you think SF is special because Google is there. What made it special before Google existed? What made it special before computers existed?

It's geography, climate, and culture make it special. Tech companies don't get to show up and stake an ownership claim on this stuff. If the hippies told the hipsters "we were here first!", they wouldn't be entirely wrong.

<comment><USER11> tech companies are not the only thing making SF special but they are the main reason behind raise in housing cost of recent decades and turning the area into even more exclusive than they were before.

</comment></comment></comment><comment><USER13> Ah, I don't mind the new housing developments, what does become frustrating is having to deal with all the traffic generated by the kids going to school in the morning. Are there alternatives to mandatory school buses, any research into this?

<comment><USER14> Buses are better than each precious child being separately driven by an idle parent.</comment></comment>


Russia unveils 'Satan 2' missile, could wipe out France or Texas - <AUTHOR> http://www.cnn.com/2016/10/26/europe/russia-nuclear-missile-satan-2/index.html <comment><AUTHOR> I remember being a teenager back in the 1980's and the threat of a nuclear holocaust.

What dangerous times we suddenly find ourselves in. Russia is sabres rattling over US decisions, Trump or Hillary will be the next US Presiden, and now this. This missile has a range of 11,000 miles and can destroy over 250,000 square miles of the planet.

I only have prayer left in my arsenal to combat the madness we find ourselves in.

</comment><comment><USER2> It should be pointed out that "Satan" is our (i.e. the west's) name, not Russia's.</comment>


Dynamic Languages Are Static Languages (2011) - <AUTHOR> https://existentialtype.wordpress.com/2011/03/19/dynamic-languages-are-static-languages/ <comment><USER2> While the core theory of this article, that dynamically typed languages are just statically typed languages with just one type, is correct, its extensions are questionable at best. It tries to claim that it is somehow restrictive to have only one type. That is nonsense, anyone has sat down and tried to write code in both Python and Haskell can tell you it is much harder to get the Haskell compiler to accept your code. Now having such a strict compiler is great sometimes, and having a more forgiving compiler like Python's is also great soemtimes. But that observable forgiveness makes it obvious why it is silly to claim Python programmers are struggling against "the bondage of restricting attention to a single type."

<comment><USER3> Also Python seems to look like a dynamic language, but it isn't. The type system is really not as easy as the most other interpreted languages.

<comment><USER4> Don't confuse static/dynamic with strong/weak. Python is strongly typed, but it's still dynamic.

<comment><USER5> FYI: None of those terms actually mean anything.

Or, more accurately, they mean different things to different people.

There's unfortunately very little in the way of standardized vocabulary for discussing this topic in a meaningful way. My theory is that this reflects the religious nature of the discussion.

</comment></comment></comment></comment><comment><USER6> Having gone back and forth between statically and dynamically typed languages a few times now, I have to say that this comment sums it up for me: "expressing and enforcing invariants in the program itself is so helpful that it's just ludicrous to deprive yourself of them." It's the single biggest problem I have when I work in a "unityped" language.

<comment><USER7> I've gone through the same transformation but I think you aren't appreciating the larger picture. Having the ability to specify both compile time and runtime invariants are both useful features. Java is good at expressing invariants around datatypes that looks like hardware data storage but it is so restrictive around interfaces that it is easy to paint yourself in a corner. Since Java was the mainstream typed language, people saw what could be done in languages like Python without such enforced rails, that many people decided the expressiveness was worth the tradeoff. I think Java 8 is much better about the tradeoff, but ultimately I think we haven't invented the system for expressing invariants in a language that makes the best tradeoffs between expressiveness and flexibility.

</comment></comment><comment><USER8> This is not exactly the point the article talks about, but it's irked me for quite some time. When you see the documentation for a library in a dynamic language, it looks the same as if the language was static: the class of all the arguments and what the functions return is specified. So in the end you end up using it just like you would a static language, but with all the type checks done at runtime instead of before.

This doesn't make much sense if you want to avoid errors.

<comment><USER9> That's an overly broad generalization, and doesn't line up with my experience.

For example I don't see much about "classes" in MDN:

[https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Global_Objects/parseInt)

[https://developer.mozilla.org/en- US/docs/Web/API/Window/loca...](https://developer.mozilla.org/en- US/docs/Web/API/Window/location)

<comment><USER10> "Window.location returns a _Location_ object" "you can also assign a _DOMString_ to it" "The parseInt() function parses a _string_ argument and returns an _integer_ " "If string is not a _string_ , then it is converted to one"

Seems like this documentation talks about little else than types to me?

<comment><USER11> > "The parseInt() function parses a string argument and returns an integer"

This seems... factually incorrect? Shouldn't it say "a double"? (or a "number", which just means "double" in JS)

It might ignore any characters after a ".", but it's impossible to return an integer in JS...

<comment><USER12> No, it returns an integer. ECMAScript doesn't officially have a distinct integer type, but the number returned will still be an integer. Incidentally, most JavaScript implementations actually do have an internal integer representation, even though typeof will still just say it's a number.

</comment></comment></comment></comment></comment><comment><USER13> I like the fact that interpreting subjectively what 'Dynamic' and 'Static' means for a language, the author is able to pull a rabbit out of his proverbial hat ... except that we see the hole beneath the hat, and the rabbit is a dead rat. Clearly programming in Python vs C++ is a world apart in terms of how 'fast' you can get simple things up and running.

<comment><USER8> The author specifically says C++ is too restricted, and that it makes no distinction between the "class" and "type" the author is talking about.

C++ has no sum types (afaik, the language is so huge I might very well be wrong)

<comment><USER13> Be that as it may, the tone of the article is clearly written 'looking down' at the readers, and tries to rack up some points by showing 'how smart I am (author) to be able to correct most of you...'. If he simply described that the definition of the terms, with some examples and then lead into his point to correct the 'popular' assumptions, it would have been a lot better than feeling like you're being lectured from the pulpit on a Sunday morning.

</comment></comment></comment><comment><USER14> The author's stated reasons for why dynamic languages are used may be valid (I use them because the type of job I like to get usually does) but there are real advantages to them.

It is much easier to quickly prototype or experiment in a dynamic language. Note that I am thinking versus a language like Scala or Haskell where types are a integral part of the language. This applies less to languages like Java. You don't have to stop and figure out your types for every function and then go back and change them every time you figure out there is a better way to represent the data.

That being said, I get their 'Dynamic Languages really just have one type' argument. I understand what they are saying. Doesn't mean we can't still use the term dynamic to describe such languages. Words mean whatever we(as a group) want them to mean.

<comment><AUTHOR> "It is much easier to quickly prototype or experiment in a dynamic language."

I disagree. I can say what I mean with types, and if I didn't mean what I said, refactoring is a breeze.

"You don't have to stop and figure out your types for every function and then go back and change them every time you figure out there is a better way to represent the data."

You don't have to do this in languages like Haskell either. Type inference will help you most of the time when figuring out a function's type, and you don't have to use the type system as it was intended at first. You can have a prototype with Strings and Lists, the compiler won't be able to help you much though.

<comment><USER15> While Haskel has quite a few tools to help assuage issues like this, I can't help but think that niche tools do not define the genre. When I hear "statically typed", I don't think of Haskel, I think of C, C++, Go, Java, and Rust.

All of these languages offer tools to handle similar duck typing via interfaces or traits or polymorphism, but they are far from simple to use.

When Haskel gains a mindshare outside of its current niche, or the type inference becomes more broadly implemented in languages used across our industry, then let's talk about how it makes statically typed languages better and easier to use than "unityped" languages.

</comment></comment></comment><comment><USER16> You can apply this same idea to serialization formats. JSON doesn't have a schema. On the other hand, you can think of all JSON values as belonging to this Protocol Buffers schema:

        message JsonArray {
          repeated JsonValue value = 1;
        }

        message JsonObject {
          map<string, JsonValue> properties = 1;
        }

        message JsonValue {
          oneof value {
            JsonObject object_value = 1;
            JsonArray array_value = 2;
            bool is_null = 3;
            bool boolean_value = 4;
            string string_value = 5;

            // Represented as a string because JSON doesn't restrict the
            // range/precision of numbers.
            string number_value = 6;
          }
        }

<comment><USER17> So, this is something I've been thinking about recently: do you gain much by using Protocol Buffers (et al) for a client-side web application's communication with a server? Having JSON/XMLHttpRequest in the browser by default is such a boon that it'd have to be a lot better as a serialisation format for it to be worth it, but that might actually be the case?

</comment></comment><comment><USER18> This article feels a bit condescending. Like most things, it's a trade-off. While sophisticated types do have a lot of advantages over dynamically typed languages (I spend most of my time using languages like that), that doesn't mean there's no trade-off.

Dynamically typed languages are, in my opinion:

* Simple

* Typically require less design upfront

* Easier to get started with

There's real value in that. Perhaps not for the author. It's easy to scoff at languages like ruby, python or javascript and claim they're completely inferior to 'real languages', but there are completely valid reasons to use them. The real value comes from simplicity.

If you use a language where runtime/dynamic typing is a subset of what's possible, you lose that simplicity.

<comment><USER19> Exactly, another use is prototyping value. A language in which you can hammer a prototype out without thinking about or solidifying _all the exact_ details -- it's more about trying out the concept, after all -- is infinitely easier to prototype with. After testing if the concept works, move to a more rigourous type system so you can bulletproof it against possible errors, etc.

<comment><USER17> While I completely agree, the sheer amount of "proto-duction" projects that are floating around and that I've had to try and maintain over the years makes an interesting argument for statically typed languages, I think!

</comment></comment></comment><comment><USER20> The last line of the article: "Let a thousand flowers bloom - as long as they're all static."

More to the point, things that are formally equal to each other do not necessarily have equal value in certain uses. (For example, think about Stokes' Theorem. It says that an integral of a function on the boundary of a manifold is equal to the integral of the derivative of the function on the whole manifold. That's useful precisely because sometimes the integrals, while they have equal results, are not equally hard to do.)

A dynamically typed language may be formally equivalent to a static unityping, interpreting the tag at runtime. That doesn't mean that they're equally easy to use, though. When I want to do that kind of thing, I want to do it like it's dynamic, not where I have to do the book-keeping to _make_ it dynamic.

</comment><comment><USER21> And for those stuck using javascript but with they had static typing there is: [http://flowtype.org/](http://flowtype.org/)

The arguments for flow seem to resonate nicely with the points raised in the article.

<comment><AUTHOR> I shall stick with fay [https://github.com/faylang/fay/wiki](https://github.com/faylang/fay/wiki) and the like.

</comment></comment><comment><USER22> For me the big difference between dynamic and statically typed languages is catching bugs like:

        foo = bar()
        if foo:
          fooo = baz()

in a static language, you'd have to write int foo = and the third line where you have an assignment fooo would be caught by the compiler. Of course there's advantages to dynamic languages, like being able to write something like

        mydata = {}
        mydata['foo'] = {}
        mydata['foo']['bar'] = MyObject()

without a lot of boilerplate

<comment><USER23> That's what linting is good for, at least in JavaScript where you have optional "var" declarations: You can set jshint to flag as an error any assignment that isn't part of a "var" declaration (or any reference that isn't explicitly defined), which will catch (at compile time) any variable name typos.

It won't catch this.fooo, though, so it's only a partial solution. My editor has great completion, though, so as long as the string is IN the file somewhere, I usually autocomplete it. Way fewer typos that way.

I see there's a PyLint, so MAYBE it has a way of spotting typos like the one you cite? Not sure how it would work in Python, though, other than on variable reads.

<comment><USER24> Certianly lint handles this. Some lint checks are quite reasonably considered type constraints, even if they historically have been implemented seperately. In particular, uninitialized values and unused variables seem very much in the same theoretical space as linear types.</comment></comment></comment>


Wrong Again: 50 Years of Failed Eco-Pocalyptic Predictions - <AUTHOR> https://cei.org/blog/wrong-again-50-years-failed-eco-pocalyptic-predictions <comment><USER2> Ah, institutionalized climate-change denial spewing-points for the individual libertarian, ignoring the fact that our species is killing itself, along with everything else on the planet. Good show, old boy!</comment>


Arguments Against Owning a Home and Specialization of Labor - <AUTHOR> http://www.zacwitte.com/home-ownership

<comment><USER2> These arguments are persuasive, but there are two items that aren't well addressed:

1\. Principle-agent problem. If I have my own house, I'm more inclined to maintain it well. If I am a renter, I'm not inclined to, for example, change the furnace filter on a regular basis. If I'm a landlord, I don't have much incentive to treat a broken appliance as an opportunity to replace it with the optimal price / performance / efficiency replacement, but instead to simply repair it to functional or replace it with a low end item, because I can't capture the additional $10 / month the better one might be worth to the tenant.

2\. Predictability of future expenses. If you rent, you are subject to changing rents. If you own, your only uncertainty comes from tax increases and maintenance. You can insure against things like fire and storm damage, but you cannot insure against rising rents.

I rent, but it's misleading to argue in favor of renting and completely ignore the benefits in the other direction.

<comment><USER3> You make excellent points. Going off your first: In addition to maintaining a home you also -improve- your home. For instance I've painted every room in my house. My basement was only sealed when I moved in; it now resembles a construction site as I am partitioning it off into various rooms, adding walling, carpeting, electrical, so-on. This is _my_ home and I make it the way _I_ want to live. If one of my renters in my investment properties tried something like that, I'd wrap them up in destruction of property and violation of contract legal charges.

And there is one other HUGE incentive on owning your own home, it's YOURS. You won't get kicked out unless you don't pay the bills. I can not put into words the mental at-ease it puts when you know you own something, especially when that something is the roof over your head at night (That almost sounds consumerist doesn't it? lol). And before anyone commits to the fact that paying off a home takes 30 years, keep in mind it's like a credit card: if you pay the minimum payment, that's what you'll get. It's always good to pay a little more even if it's 'simply once in awhile'.</comment></comment>