Goodbye, Mobile Phone Privacy - <AUTHOR> https://koshinan.com/goodbye-mobile-phone/ <comment><USER2> There's no substantial evidence of Wi-Fi radiation being harmful to us.</comment>


Only Mustang, Focus to survive Ford car cuts - <AUTHOR> https://www.detroitnews.com/story/business/autos/ford/2018/04/25/ford-cutting-car-lineup-earnings/34244867/ <comment><USER2> Thought it was just boomers buying trucks and SUV's. Have millennial's given up on cars?

<comment><USER3> Who needs a car when you can take an Uber?</comment></comment>


Kyle: A password manager for paranoids. - <AUTHOR> http://sceptive.com/p/kyle-a-password-manager-for-paranoids

<comment><AUTHOR> Hi, i'm the developer. :)

One point to add for misunderstandings is that listing animal names and passwords mostly protects you from keyloggers.

Even someone knows your master-key and all the details you use, it should monitor what you copy-pasted. Otherwise try/fail would be notified on limited environments if the attacker is not lucky enough.

</comment><comment><USER2> So instead of storing passwords it has a repeatable process for generating hashed passwords for a given host+account+port+master key?

One problem I see is that your favorite animal might result in a password that isn't allowed for a given site. But I assume the paranoid target user would never use such a site.

</comment><comment><USER3> I like this. It's similar in nature to what I'm looking to do with blot.pw (more information at [https://github.com/stuartpb/hashblot/wiki/About](https://github.com/stuartpb/hashblot/wiki/About) )

</comment><comment><USER4> Yeah. That looks really convenient and user-friendly </sarcasm>

</comment><comment><USER5> I didn't quite understand what it's doing. Can someone explain?

<comment><USER6> It seems to be a command-line tool to generate passwords based on the url (domain), username and some master password. The tool has a list of animals to add to the mix, this is probably all hashed somewhat like so pass_gen(domain, user, master_pass, for_each(animal)). You then see the password you can copy- paste into the password field next to the animal's name. You pick the same favorite animal every time and as such will be able to pick the same password every time.</comment></comment>


Show HN: Buy Gifts by Describing the Giftee - <AUTHOR>

http://www.GiftLizard.com
Core idea: Describe the person you're trying to buy gifts for and it matches gifts based on those descriptions.
How it works: items are tagged in many categories from descriptive, relationships (dad), jobs, hobbies, interests, personalities, places (garden).  Items that match any tag show up, the more tags an item matches, the higher up it shows.
Some notes:
Products are hand selected and manually added to the site.  The goal is interesting gifts and gift discovery.  If you know exactly what you want to buy, the traditional hierarchical search works just fine.
There are only 150-200 Items in the database right now and 300-400 tags, I am adding more as fast as I can, the women's (mom, girlfriend, women, girls) selection is a bit thin (if anyone has some ideas especially in this category let me know!)
Any and all feedback would be appreciated! <comment><USER2> Awesome idea man and I really dig what you have going so far. Inputting items by hand will def be an issues as there are millions of products out there. Do you think you could try to work with the Amazon Associates API and input gifts that way? I haven't really tried doing this before but you could possibly attempt to utilize that (or something similar).

As far as the UI goes I think it looks fairly clean. For me it's a personal preference to have all of the field top oriented and place the search results on the bottom (google esque). This also would allow you to have rows of 3 instead of rows of 2 as far as products go.

Just my 2 cents great work man!

<comment><AUTHOR> Thanks! I do use the amazon API (all products right now are on amazon) to backfill a lot of the info. I don't want to just 'dump' tons of items though because there are a lot of dupes. I looked at grabbing best sellers from each category as a means of seeding, but there is a ton of dupes (like all the different kindle versions). Tagging also became somewhat of an issue and most items have few-no tags. Also the description quality/length varies greatly.

Thanks for the UI suggestion, I will play with that idea and see if I can come up with a better top oriented/organized search/nav. I definitely would like more screen real estate for gifts.

</comment></comment><comment><USER3> "Buy Gifts by Describing the Giftee, the Gifter, the Gift, or the Activity" seems more like it. I didn't find anything to buy today, but I added an item I would like myself (a super-expensive cookbook), and had fun adding any tag that came to mind relating to myself(gourmet, cook, etc), the book (luxurious, exhaustive etc), or my desire for it (insane, unreasonable, etc).

Right now the products are all your choice - it's not that you have bad taste or good taste, you just need more, and more tags. How are you going to scale this? What about involving crowd-curation - inviting people shopping for someone else to first choose something THEY want on Amazon, and input that into GiftLizard with a cloud of tags that covers the nexus of object, desire, and person. That might help increase the range of your offerings in a hurry. I don't think that you would have added that particular book - which would make a perfect gift for me if my wife happened to be directed to this site - anytime soon.

<comment><AUTHOR> I added your book, thanks for submitting it :)

As I said, the inventory isn't that big, but it will only get better with a larger inventory. Scaling is the challenge. The other problem is maintaining quality and not turning it into a boring gift shopping site.

My current approach to scaling is finding people from different backgrounds and interests to add and tag gifts. I've got two people helping me right now to try and increase the inventory size.

Thanks for the gift suggestion and feedback :)

</comment></comment><comment><USER4> Images often appears stretched because they have the wrong aspect ratio.

<comment><AUTHOR> Thanks! I guess I need to add aspect ratio maintenance in the image resizer.

</comment></comment><comment><USER5> Really minor UI things -

How about making the price slider 'snap' to $10 increments? I couldn't intuitively get it to $150 (kept going 147 or 153) which was a tad annoying. Maybe start it at a lower number too, so there's no chance of a user seeing a page full of $1000 gifts and being turned off.

The site's a little generic, your domain screams for a good logo/mascot.

<comment><AUTHOR> I'll look at seeing if I can modify the slider to snap at nicer increments. It's just using jqueryUI slider, probably easier with a smaller range anyways.

I considered putting the mascot in the header but when I made it smaller, it just didn't work well. He's on the about page.

Thank you for the feedback :)

</comment></comment><comment><USER6> I think it is a great idea and I love the way it works. I look forward to you expanding the database. I am the worst gift-giver in the world and a site like this definitely gives me ideas through simple tags that I can classify the recipient by. Keep up the great work!

<comment><AUTHOR> Thanks :) Added another 50+ items yesterday, slowly but surely adding more. If you notice an area is lacking please let me know. I was testing it yesterday on some people and it definitely didn't satisfy some people but it gave me suggestions about what tags I needed to add.

</comment></comment><comment><USER7> After entering the tag in the search box (or pick it from the auto-complete) I intuitively press enter to add it to the filter, but that doesn't do anything. Maybe that's the way it's supposed to work, but it'd be nice if hitting enter worked too.

<comment><AUTHOR> Oh wow, not sure how I missed that bug. Thanks for pointing it out, I'll get that fixed.

update: fixed.

<comment><USER7> Now it works. Much better :)

</comment></comment></comment><comment><AUTHOR> <http://www.giftlizard.com> clickable

</comment><comment><USER8> I remember seeing an online store that offered me and my FB friends gifts based on our FB wall info. I was surprised to see quite a few gifts that were right up my alley, so to speak. So that is an option.

<comment><AUTHOR> Any idea where their gift suggestions were coming from?

<comment><USER8> Etsy has one: <http://www.etsy.com/gifts>

<comment><AUTHOR> neat. etsy is on a shortlist of places to add new items from, need to explore their API.

<comment><USER8> I am working on an app for their API, but it doesn't appear yet that Etsy has an affiliate program such as ebay or amazon.

<comment><AUTHOR> Yeah, that is one reason they weren't the first source.</comment></comment></comment></comment></comment></comment>


New engineered material can cool roofs, structures with zero energy consumption - <AUTHOR> http://sciencebulletin.org/archives/10313.html <comment><USER2> Word-for-word blogspam of:

[http://www.colorado.edu/today/2017/02/09/newly-engineered- ma...](http://www.colorado.edu/today/2017/02/09/newly-engineered-material-can- cool-roofs-structures-zero-energy-consumption)</comment>


Why do competitors open their stores next to one another? [4min video] - johnx123-up http://ed.ted.com/lessons/why-do-competitors-open-their-stores-next-to-one-another-jac-de-haan

<comment><AUTHOR> This is interesting in a fake world with flat demand. In the world we actually live in, the world is _very_ lumpy, and information about the disposition of lumps is not exactly trivially available, but information about the disposition of competitors is.

There are boring real-estate specific reasons why having two coffee shops on the same intersection is very unlike having one very big coffee shop at the same intersection, by the way, chiefly with regards to traffic flow. Traffic flow is a key consideration for "non-destination" commercial stores, like Starbucks. You don't get in your car to go to Starbucks, you get in your car to go to work, home, or your "third place" for the day -- perhaps that swanky restaurant you're visiting with the missus. (You will note that work/home/third place are statistically unlikely to be on corners, principally because there is a price premium for corners, given that they are commercially much more valuable for non-destination commerce than mid-street.)

Any Starbucks which catches your fancy while you're in your car can catch your business, but they're overwhelmingly more likely to be a) directly on your path between A and B and b) require a minimum of complicated driving to deviate from your path to their cut to the street (i.e. you statistically prefer a right turn straight into a store on your right versus doing a U-turn onto the other direction of a busy street, etc).

Given that you want simple turns into your place of business, it's trivially obvious why one would prefer having two streets for ingress/egress versus one street, which is only available on a corner. (Fun driving game: try to find any retail establishment on a corner which _is_ a location that the average customer would specifically get into their car to go there. Fun variant: attempt to convince them to sell their property to you, because you're already 50% of the way to flipping it to a bank/fast food restaurant/WalGreens profitably.)

There's another wrinkle: all corners are more valuable than non-corners, but all corners are _very much_ not equally valuable. How valuable a given corner is for a particular business is a _very hard problem_ to solve for. Some firms and individuals are very good at solving for it. A _very effective_ way to piggyback off of their expertise is to simply grab the corner opposite of them: while the lumpy world of geographically distributed demand for coffee is very non-trivial to access, the simple rule "If you see a Starbucks, to a first approximation, siting our next coffee shop across the street from it _will_ be profitable" generally works.

<comment><USER2> Where I went to college there was a Starbucks on the most prominent corner of the most prominent street that runs directly north of and within spitting distance of the main campus.

An independent coffee shop opened up on the opposite corner (actually one unit down from the corner). Within a year, the Starbucks had lost so much business that it was closed down.</comment></comment>


Tell HN: Why I attend conferences - <AUTHOR>

Yesterday I went to a conference (around mobile marketing) and despite having been to many of these and listening to talks that can be repetitious and include things you know and hear over and over, I'm very glad I went.
I won't make this into a blog-post entry so I'll be succinct on the reasons:
1. I go for the epiphanies. Sure I've heard the same stuff over and over but sometimes a particular string of words cracks the creativity crack and you get a solid, validated idea or improvement.
2. I go for the inspiration - the case studies are enough to make you want to do shit better.
3. I go for the people - My online persona (esp Twitter) is that of an asshole and I'm very much misanthropic but the interaction at these events and the forced friendliness leads to genuine connections sometimes. I was offered a job after meeting someone for the first time IRL that I've been following and have been followed on Twitter.
4. You never know who you'll meet and where conversations will lead. I was offered pitching time and genuine interest (in me and not a single one of my ideas, which weren't even discussed) by a VC.
Do you attend conferences? Why? <comment><USER2> Hey, what conference did you go to around mobile marketing?</comment>


Looking for translators - <AUTHOR> http://ivansuchy.blogspot.com/2007/06/looking-for-translators.html <comment><AUTHOR> I know it's off topic and I apologize but there is kind community of people here at Y so ... if you are interesting ... please let me know.</comment>


AI That Picks Stocks Better Than the Pros - <AUTHOR> http://www.technologyreview.com/blog/guest/25308/

<comment><USER2> My understanding of why the stock market is supposed to be good for society is that it encourages investors to invest in companies that need more capital. It has the nice side effect of allowing people to buy high value assets that are likely to increase in value over time, letting people save for their retirements, while simultaneously providing capital to companies that may need it. I fail to understand how a computer that holds on to stocks for < 20 minutes forwards either of those goals. Maybe someone can explain why this is a good thing to me, but this really seems like a perversion of what free markets are supposed to be good for. And again, maybe someone can explain why this would be a bad idea, but I'd really like to see a system where if you buy a stock you are not allowed to sell it for a fixed period of time that would be measured in months, and not seconds.

<comment><USER3> Market making. Suppose I decide I want to buy 3000 shares of IBM right now. I'll have made the trade within minutes, because I'll probably have bought it from a computer which holds shares for twenty minutes. Four years later, when I want to sell, I can sell it within minutes too, because I'll be selling it to another computer that will probably sell 'em off to a series of other computers, before eventually winding up in the pocket of another long-term investor.

If long-term investors were the only ones buying and selling shares it would be much more difficult to buy and sell shares when you wanted to. Net result: shares are a less attractive investment, IPOs raise less, economy suffers.

<comment><USER2> Thank you. That was the explanation I was looking for.

My next question then, is whether this flexibility to sell instantaneously is worth the risk of near instantaneous drops of 700+ points in the dow, as happened a couple of weeks ago. My gut tells me that letting computers have a free run of it is not good. But I'm definitely open to being convinced otherwise. And I'm definitely open to a better solution than you have to hold on to stocks for a month or more.

<comment><USER4> The high frequency trading (HFT) systems that seemed to cause the drop you mention also make it more expensive for ordinary investors to actually buy stock in the first place, thereby minimizing your potential return (as Buffett says, "you profit when you buy" or something to that effect).

There was an article on this a few weeks back where a guy in the know was explaining how such systems are a bad thing. Say you bid a price of $2 per share for a share that is currently at $1.92. Since the advent of HFTs, there's a much higher probability that the price you eventually pay will be a lot closer to $2 than to the current $1.92, (perhaps $1.98 or $1.99) whereas before HFTs you could get it closer to the current price. This matters particularly when you buy a lot of shares, and when you hold them for a long time, as the couple of cents difference compounds a lot over time.

I'm not an expert on the subject, that was my takeaway from it.

<comment><USER5> Basically what the HFT algorithms do is probe orders for their market limits.

Say you want to buy your 3000 shares, and you don't want to spend more than $20/share, so you enter your bid with a $20 limit. Your limit is supposed to be invisible to the market, only you and your dealer know it. But the HFT algorithms have a way to probe your order and uncover your limit.

The stock is currently trading around $15, so your order hits the exchange, and in the first few milliseconds, a HFT computer makes a micro-offer for 10 shares at $16, then 10 shares at $17, then 10 shares $20, then 10 shares at $21.

When the last offer is rejected b/c it's over your limit, the computer then guesses your limit is $20 and offers to sell you 2960 shares at your limit of $20.

All this happens in just a few milliseconds, and it just cost you roughly (2960x20 + $20 + $17 + $16 + $15) - (3000 x $15) = 59,268 - 45,000 = $14,268. That's 30% more than you would have paid had you been able to execute at $15.

It's basically cheating, and should be made illegal. Just one more example of how our markets are rigged.

<comment><USER6> Of course, if your limit was $15, it would have executed at $15. Or not at all, in which case $15 was not the asking price.

Remember, the price is a two-way street. It's what you are willing to pay, and it's what the seller is willing to sell for. If you say, "I would like to buy at $20" and your partner says "$20 is fine with me too", and the trade happens at $20, then the market is working perfectly. You could have gotten a better deal, but it's not what you asked for.

<comment><USER7> Let's say you're an institutional investor with an obligation to maintain a particular investment profile, and there's some event that forces you to rebalance your portfolio in a fairly dramatic way. You're used to working with stable portfolios with more or less predictable returns, and this might be a bit much for you to take on, so you decide to blow some of your management fee on some really smart consultants who can do the rebalance for you. They, in turn, have to figure out how to actually execute the plan that they come up with - there are going to be some pretty big orders involved, and if the market gets tipped off that this is going to happen, people are going to start hoarding their shares to drive the price up to screw you. So they start chopping the order up into much smaller orders and dribbling them out slowly, or looking for baskets of stocks that act like the stocks you really want, or trying to fill from dark pools, all kinds of crazy tricks (and they have to do the same kind of things on the sell side to finance all this).

Meanwhile, some even smarter guys at an investment bank just down the road know all these tricks, too, and have come up with a way to algorithmically spot them happening more accurately or more quickly than anyone else. So they start jumping in front of your trades, not because they want the stock, but because they know you want it and are probably willing to chase a rising bid for a while. Then all the other algorithms start to notice, and they start doing the same thing.

You, the friendly investment manager, are now financing both sides of what really amounts to one of the coolest deathmatches going, a bunch of math and computer geeks playing on your quarter and keeping a penny for the honor of letting you watch them do it. But you actually don't care, because it wasn't your quarter in the first place, and now that your fund is back in order, you're not going to get sued, and your customers, who had no idea that any of this was going on, and who may not even realize they're your customers, are back to paying 2% fees for (statistically likely) below-market returns.

In the past, these kinds of large trades would usually end up splitting the difference, with 'real' sellers earning a bit more than what they would have otherwise settled for and 'real' buyers paying a bit less than their actual ceiling. But now 'real' buyers end up paying close to their high bid, and 'real' sellers end up earning their low ask, with the bots fighting it out for the very thinly sliced middle territory.

In one sense, I do agree that this is an example of a market working perfectly. Algorithmic traders are exploiting an arbitrage opportunity between mainstream industry practice and cutting edge technical ability, and just like theory would suggest, they're making bank from it.

<comment><USER6> _In one sense, I do agree that this is an example of a market working perfectly. Algorithmic traders are exploiting an arbitrage opportunity between mainstream industry practice and cutting edge technical ability, and just like theory would suggest, they're making bank from it._

I think this is all there is to be said. Your trading has a pattern that makes them money. The algorithmic traders are going to use that information advantage to make money. That's the idea of the market; trying to extract as much value from securities as possible.

Even if you impose arbitrary trading limits, the big banks are still going to find a way to make money off of you.

<comment><USER7> There are lots of ways to make money that would ultimately harm the market that have been made illegal or have been banned by exchanges. Nobody has a problem with people getting rich from providing value, but there's a long history of patching the system when it looks like someone's starting abuse an advantage that doesn't return any value to the market.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Using data from five non-consecutive weeks in 2005, a period chosen for its > lack of unusual stock market activity

Doesn't this completely invalidate the results of this test?

Compare with: I've developed a system for testing whether or not any given number is prime. Using data from the numbers 5, 7, 11, and 17, ...

<comment><USER9> That was my first thought as well.

Actually my first thought was: In the other consecutive weeks, the system lost its shirt and jumped out the window.... twice.

</comment></comment><comment><USER10> > Using data from five non-consecutive weeks in 2005, a period chosen for its > lack of unusual stock market activity, here's how AZFinText performed versus > funds that traded in the same securities (which were all chosen from the S&P > 500):

This is silly. It's quite easy to generate an algorithm that would perform similarly. I wonder how it would have performed had it been run across the entirety of 2005 (or any year for that matter), and not just during cherry picked weeks.

<comment><USER3> Yes, I'd like to see it run across the entirety of the available data.

Also, if I came up with a method like this, and I actually had evidence that it worked, I'd be patenting it and selling it to an investment bank for _very large_ sums of money before I published the details.

<comment><USER11> Anthropic bias: The other thousand programmers that came up with such an algorithm used it or sold it to an investment bank; this is the first one that published instead.

</comment></comment></comment><comment><USER12> The research paper, which is a pretty good read, can be found here [http://www.robschumaker.com/publications/IEEE%20Computer%20-...](http://www.robschumaker.com/publications/IEEE%20Computer%20-%20A%20Discrete%20Stock%20Price%20Prediction%20Engine%20Based%20on%20Financial%20News.pdf) [pdf]

</comment><comment><USER13> I work in this field. That is not the first paper written about this system; the previous was "Sentiment Analysis of Financial News Articles", Schumaker et. al. This is not the only academic project describing something like this, see papers by Mittermayer and Lavrenko for other examples. Short summary of the results is basically this: you would have to be insane to trade purely on output of a system like this. There are multiple issues with this, the primary being that most of these systems do not and cannot distinguish documents leading the trend from those lagging the trend. Furthermore, to actually be able to trade on the indicators derived from news you need to encode the market expectation into your model, which is a separate (and difficult) problem. The margins these systems produce in simulated trading are small, and for some reason nobody takes transaction costs into account. This is not to say that systems like this do not exist in the real world - they certainly do, but the people that build and/or use them generally will not discuss the details, for obvious reasons.

</comment><comment><USER14> Shouldn't there be some way to flag stories as "headline is obviously false"?

<comment><USER15> I believe it has been discussed by pg as part of a proposed revamp to the flagging system. It'll happen eventually.

</comment></comment><comment><USER16> Don't index funds and completely random selections ALSO outperform most professional stock pickers?

<comment><USER17> Here's an answer:

<http://www.studyfinance.com/jfsd/pdffiles/v8n1/liang.pdf>

Apparently the random stocks outperform the "pros" picks after 6 months (the pros have the edge in the short term)

Actual quote from the study: "Results suggest that the pros selection statistically outperforms the random selection only in the one-week period. Over a six-month holding period, the random stocks perform better than the pros recommendations."

</comment></comment><comment><USER18> I read the title as "AI that picks _socks_ better than the pros". I was very intrigued. As I waited for the link to load I mused about what a damning report this must be for the fashion industry. Can a computer really out fashion the fashionistas? Alas, it was not so. The fashion elite are still unassailable in their fortress of subjectivity.

<comment><USER19> >I mused about what a damning report this must be

I think you mean _darning_.

</comment></comment><comment><USER20> These types of systems are now common in the market, and you need more sophisticated algorithms to make any money. They said that they picked 2005 because it had a lack of "unusual market activity." I bet they picked it because their system didn't work in later years, because there's too much competition to make money with their system now.

</comment><comment><USER21> here's one in Python:

import random

stocks = (ibm, apple, ...)

stock_to_buy = random.choice(stocks)

</comment><comment><USER22> So if I made a system that traded automatically and I was convinced that it would beat the market, how would I go about connecting it to the stock exchange? What costs would there be?

<comment><USER23> Something like this - <http://www.interactivebrokers.com>

</comment></comment><comment><USER6> I'd like to see what this looks like when run on bond derivatives from the early 2000s. I wonder if it would have been able to foresee the subprime crisis better than the big investment banks.

(My theory, as someone involved in the industry, is that emotion dictates 90% of whether or not someone is going to make a trade. This is why nobody noticed how bad the subprime bonds / CDOs were -- they bought them, so they must be good. I feel the same way about my telephone and keyboard ;)

</comment><comment><USER24> They don't detail the number of trades nor do they account for commissions or slippage.

<comment><USER25> And it's all simulated. Last I heard, placing orders affects the market, especially if you're working with more than a toy account.

<comment><USER26> It totally affects the market.

<comment><USER27> As in, 'it affects the entire market' or 'all of it affects the market'?

<comment><USER26> I was just agreeing vigorously with him.

</comment></comment></comment></comment></comment><comment><USER28> "Computer programs can gamble better than gamblers"

Sorry to say, but I'm completely unsurprised by this - statistical analysis is the most sensible approach to the problem. Gamblers tend to be less sensible and calling a gambler a stock market trading pro doesn't stop him being a gambler...

I'd also be wary of labeling pros in a system which will naturally produce "lucky" and "unlucky" individuals regardless of skill... at least some proportion of successful traders are just lucky. I can't measure it, but it seems very heavily implied...

</comment><comment><USER29> I wonder how well covered their downside is. Will a black swan make it blow up spectacularly, negating any previous gains?

</comment><comment><USER30> I have a question for all of you...how do so many of you know a lot about financial markets and finance...I made an Ask HN about it:

<http://news.ycombinator.com/item?id=1422453>

</comment><comment><USER31> Not really surprising. This been done before to some degree by Kurzweil and Schmidhuber and I'm sure others.

<comment><USER23> Any pointers?

<comment><USER31> Be really smart? No way in hell could I do this. You need a strong math, statistics, and machine learning background to begin with.

</comment></comment></comment><comment><USER32> Catch 22 - if this system is popularized, it will change the way stocks are traded, and in the process will damage its own value by destroying the control index.

</comment><comment><USER33> nit picking, but many of the words listed (such as "smaller" and "crude") aren't verbs.

<comment><USER34> From the article:

> (In his work, 'verb' is a technical term, and does not exactly correspond > with the conventional definition of the word.)</comment></comment>


Patents that kill - <AUTHOR> http://www.economist.com/blogs/freeexchange/2014/08/innovation <comment><USER2> The simplest solution would be to significantly shorten the patent duration for pharmaceuticals, and start it the day a drug gets FDA approval. This would uncouple two things that should have never been coupled in the first place: development time and window of exclusivity in the market.

<comment><USER3> Companies would (justifiably) still want provisional patent protection for the very long period between the idea's conception and FDA approval, to reduce the risk on their huge investment.

Thus, wouldn't this idea exacerbate the already rampant abuse of provisional patents?

Or if long provisional patents weren't allowed, then companies probably would avoid products with long FDA approval times, which is the very problem you're trying to solve.

<comment><USER4> > Companies would (justifiably) still want provisional patent protection for > the very long period between the idea's conception and FDA approval

I disagree. For drugs this wouldn't be a problem.

The company that invented it is forbidden from making money off a drug that is not approved, so they have every incentive to get the approval as soon as possible.

Other companies would not be prevented by patent law from producing the drug during the time, but they would be prevented by FDA regulation. And they would not be inclined to invest since they would know that the patent would issue as soon as the drug was approved.

<comment><USER3> Well, the international enforceability of US patents is already sketchy at best, and if the phamaceutical doesn't even have a patent at all, there's absolutely nothing stopping a company from producing and selling it in a country that doesn't have standards quite as tight as the FDA.

Also, your comment

> The company that invented it is forbidden from making money off a drug that > is not approved

raises another interesting issue. In the current system, a company CAN in fact make money off of such a drug, by selling the patent to someone else. Actually, many drug patents originate in universities, and then are sold to drug companies. I doubt the university lobby would be keen on losing that major revenue stream.

</comment></comment></comment></comment><comment><USER5> here is the original paper in case anyone's interested: [http://www.nber.org/papers/w19430](http://www.nber.org/papers/w19430)

And here is the abstract: Patents award innovators a fixed period of market exclusivity, e.g., 20 years in the United States. Yet, since in many industries firms file patents at the time of discovery ("invention") rather than first sale ("commercialization"), effective patent terms vary: inventions that commercialize at the time of invention receive a full patent term, whereas inventions that have a long time lag between invention and commercialization receive substantially reduced - or in extreme cases, zero - effective patent terms. We present a simple model formalizing how this variation may distort research and development (R&D). We then explore this distortion empirically in the context of cancer R&D, where clinical trials are shorter - and hence, effective patent terms longer - for drugs targeting late- stage cancer patients, relative to drugs targeting early-stage cancer patients or cancer prevention. Using a newly constructed data set on cancer clinical trial investments, we provide several sources of evidence consistent with fixed patent terms distorting cancer R&D. Back-of-the-envelope calculations suggest that the number of life-years at stake is large. We discuss three specific policy levers that could eliminate this distortion - patent design, targeted R&D subsidies, and surrogate (non-mortality) clinical trial endpoints - and provide empirical evidence that surrogate endpoints can be effective in practice.

</comment><comment><USER6> It keeps annoying me that nearly everyone (including Richard Posner [0] and notch [1]) says that 'medicine makes for the best case for patents'. I'm not convinced that patents are necessary for pharmaceuticals, and I'm trying to prove that's the case [2].

[0] [http://www.theatlantic.com/business/archive/2012/07/why- ther...](http://www.theatlantic.com/business/archive/2012/07/why-there-are- too-many-patents-in-america/259725/)

[1] [http://notch.tumblr.com/post/27751395263/on- patents](http://notch.tumblr.com/post/27751395263/on-patents)

[2] [http://indysci.org/projectmarilyn](http://indysci.org/projectmarilyn)

<comment><USER7> I don't know if you're familiar with Dean Baker:

"Patent monopolies are one mechanism to provide an incentive for innovation, however they are a tremendously inefficient mechanism."

[http://www.cepr.net/index.php/blogs/beat-the-press/health- ca...](http://www.cepr.net/index.php/blogs/beat-the-press/health-care-costs- dont-blame-the-free-market)

[http://www.cepr.net/index.php/Publications/Reports/financing...](http://www.cepr.net/index.php/Publications/Reports/financing- drug-research-what-are-the-issues)

<comment><USER6> thank you for those links. Incidentally Drew Curtis also outlines the dichotomy in policy pressures really well.

[http://www.ted.com/talks/drew_curtis_how_i_beat_a_patent_tro...](http://www.ted.com/talks/drew_curtis_how_i_beat_a_patent_troll)

I'm surprised that the first link of yours doesn't show the fact that Pharma companies make upwards of 10-16% margin which is high for the healthcare sector, versus Generics companies which make ~5%, in line with "companies in general"; and insurance companies which pre-ACA were making negative-~2% margins. It's hard not to believe that the ACA was just a bailout for insurance companies, in exchange for mild vilification.

<comment><USER7> >I'm surprised that the first link of yours doesn't show the fact

[https://encrypted.google.com/search?hl=en&q=medical%20patent...](https://encrypted.google.com/search?hl=en&q=medical%20patent%20site%3Acepr.net)

Dean Baker has written a _lot_ on patents in medicine, and in other fields as well. It would probably be interesting for you.

</comment></comment></comment></comment><comment><USER8> Why is (well, _should_. Literal "is" is reasonably clear) drug exclusivity handled separately from drug approval? Since the one is needed to make up for the costs imposed by the other, shouldn't they be handled as a unit under the same agency?

</comment><comment><USER9> "A clinical trial for patients with metastatic prostate cancer lasts only three years compared to an 18-year-long trial for those suffering from a milder, localised prostate cancer. Since a typical patent is in force for 20 years, firms only have two years of effective patent length left to commercialise a new drug against localised prostate cancer.

The data paint a bleak picture. The economists find that pharmaceutical companies conduct 30 times more clinical trials for recurrent cancer drugs than for preventive drugs"

<comment><USER10> How do you conduct a trial for a preventive drug? Just wondering.

<comment><USER11> Give a bunch of people the drug and a bunch of people a placebo, wait a long time (decade+), see if there is a statistically-significant decrease in the thing that it is trying to prevent.

<comment><USER10> It seems quite difficult to set this up. Who wants to take an experimental drug for decades? And if it's a rare disease you need a lot of people.

</comment></comment></comment></comment><comment><USER12> This is arguing for _longer_ patents for drugs, since the 20-year-long patent causes the industry to only look for drugs where you can get through development and trials quickly enough that they enough years left on the patent to make revenue.

</comment><comment><USER13> The solution to this is regulatory exclusivity. The big cost is going through the FDA process, companies could simply be granted a 15 year exclusivity once they've passed that bar. The FDA already has a process setup for granting this.

</comment><comment><USER14> In general, regular capitalism is best for progress, since government-funded operations don't have the same incentive to succeed, to avoid waste, etc.

However, for something like developing drugs, it may be worthwhile to have more government involvement. The article mentions how drug companies can focus on their profits to the detriment of society. One might even wonder if the Hepatitis C cure was priced so that not everyone could afford it, so the disease wouldn't be eliminated...

<comment><USER12> 1\. The drug industry not creating a drug doesn't stop a charity from developing it. (Bill Gates once wanted a drug developed that didn't have enough of a market, so his foundation paid out of pocket for it.) It's not "to the detriment of society" for them to pursue their own ends, and more than it is "to the detriment of society" that I'm typing away on HN instead of being outside picking up trash.

2\. Conspiracy theories about keeping diseases around are misfounded. a) The drug in only effective in _EDIT_ 97% of people. b) The patent will eventually expire. c) The price for the drug is cheaper than the lifetime cost of treatment, making it a win-win scenario. (Plus the eventual expiration of the patent will make this very cheap in the long term.)

<comment><USER14> 97% is pretty high, but I agree that it's not too likely that's the drug company's plans.

Note that the government grants the drug company a monopoly to sell their drug, so it makes sense to place some limitations on pricing, or at least negotiate like other government do.</comment></comment></comment>


Python IDLE Reimagined - <AUTHOR> http://inventwithpython.com/blog/2014/11/20/idle-reimagined/

<comment><USER2> I've always kind of wondered what IDLE is good for, seeing as how I've already got a perfectly good command line to run python from.

<comment><USER3> For Windows, it's easier to start IDLE than it is to start python from a command line, and the editor is better. It's still terrible, but at least it's better.

<comment><USER4> > For Windows, it's easier to start IDLE than it is to start python from a > command line, and the editor is better. It's still terrible, but at least > it's better.

I am pretty sure the Windows Python installer adds Python to your path. On my system, at any rate, starting Python on the command line consists of typing "python" and pressing enter. How can it get any easier?

That said, starting IDLE _is_ easier, because hitting Winkey + py + enter opens IDLE whereas there's the extra step of opening the terminal if I want to use it on the command line.

</comment></comment></comment><comment><USER5> Reminds me of DrRacket.

It's a good target for a learner's basic IDE.

</comment><comment><USER6> I've taught a number of newbies Python (including a team of data scientists) using IPython notebooks and it's convinced me that is the right way to do it. I can setup a few notebooks with datasets, database connectivity, etc. and all they have to do is point a browser at the URL and start hacking. There's nothing to download, no environment variables to set, and no packages to install / setup.

</comment><comment><USER7> From the article: _" I've started a wiki for an IDLE redesign project."_

What next, the Kickstarter? Usually, you actually _do_ something before issuing the press release.

<comment><USER8> Exactly my thinking.

</comment></comment><comment><USER9> > _Instant Google-search for error messages._

Now there's an idea. Does anyone have recommendations for getting a "professional developer grade" IDE to do that?

<comment><USER10> There's a official Visual Studio extension that does something similar[0]. It's surprisingly well received by the HN crowd[1], for a Microsoft product that is.

[0] [http://blogs.msdn.com/b/visualstudio/archive/2014/02/17/intr...](http://blogs.msdn.com/b/visualstudio/archive/2014/02/17/introducing- bing-code-search-for-c.aspx)

[1] [https://news.ycombinator.com/item?id=7253711](https://news.ycombinator.com/item?id=7253711)

<comment><USER11> at the intersection of vs extensions + python + surprisingly-well-reviewed-on- HN-for-a-microsoft-product, also check out [http://pytools.codeplex.com](http://pytools.codeplex.com)

</comment></comment></comment><comment><USER12> The redesigned version looks a little like OLPC's Pippy (which uses GTK) -- maybe some of that code will be useful:

[http://wiki.laptop.org/go/Pippy](http://wiki.laptop.org/go/Pippy)

</comment><comment><USER13> why not just use geany with python support, you can also enhance the python plugin and it runs on windows/linux.

<comment><USER14> Of course other text editors exist, but the author is looking for something that fits the same niche as IDLE, which means it needs to run everywhere that Python runs.

</comment></comment><comment><USER15> Devs are going to use the hell out of Search Google for Errors Option. That's a game changer.

</comment><comment><USER16> I have a perfectly good window manager. Let me use it, please.

<comment><USER14> You've probably also got a perfectly good text editor, so you're not the target audience.

<comment><USER16> If someone who pretty much exclusively uses IDLE for Python code editing isn't the target audience, who is?

And a text editor for Python code isn't "perfectly good". There are things that IDLE can do that text editors cannot. Name completion based on modules loaded, that sort of thing.

</comment></comment></comment><comment><USER17> Kind of like spider? Or Emacs? Or PyDev?

<comment><USER18> More like DrRacket.

<comment><USER17> I know DrRacket from back when it was called DrScheme and you had to manually set it from "extremely limited scheme-like language that won't allow you to do anything" to "actual R5RS scheme".

I found DrScheme and its cousin DrJava nice for beginners, but I think within the context of Python, IPython Notebook is just so much better because you can wire in some pretty pictures and formatting. Then again, the separation between "code that is meant to stay" and the REPL may be a useful concept that you want to teach beginners.

<comment><USER5> DrRacket defaults to the full Racket language. You have to switch over to use the teaching languages or the r*rs implementations, but Racket is there from the off, and switching languages is as easy as editing the #lang line at the top if you don't feel like arsing around with the GUI for it.

<comment><USER19> The defaults has changed in modern times (5 years ago?).</comment></comment></comment></comment></comment>


The ASP.NET Forms Authentication replacement Microsoft doesn't want you to see - <AUTHOR> http://blog.appharbor.com/2012/08/13/the-asp-net-forms-authentication-replacement-microsoft-doesn-t-want-you-to-see

<comment><USER2> Meta: This is a really awful linkbait title. Microsoft "[didn't] want you to see it" because they thought there was a vulnerability in it.

<comment><USER3> From the post body: "...Microsoft named no vulnerabilities and were primarily concerned that our motivation for replacing ASP.NET forms authentication..."

<comment><USER2> "We pulled the post on Friday because we got a note from people at Microsoft that they were worried the solution we had published was unsafe."

<comment><AUTHOR> The point is that that worry was never satisfactorily substantiated, so we have to look for other reasons why they wanted us to pull the post.

</comment></comment></comment></comment><comment><USER4> It would be great to see an extensible, "Devise" like solution for asp.net

<comment><AUTHOR> We'd love to get contributions so feel free to open pull requests for any extensions you would like to see.

</comment></comment><comment><USER5> Rails and Django: The superior web development frameworks microsoft didn't want you to replace asp.net with, but you did anyway.

<comment><USER4> I've spent a lot of time on both rails and asp.net mvc over the past year.

If you would have asked me 2 years ago, Rails was a clear winner, because of ActiveRecord Migrations, Heroku, MVC, RSpec, Gem Framework, great libs like Devise, Sunspot, Asset Management, and Ruby's dynamic features like hashes and DSL creation. On the downside, I had to code in Vim / RubyMine. Windows support is lacking and most Rails apps fail on Windows because of native compilation errors. I end up dual booting to Ubuntu which is a pain.

What VS had was a great IDE, strong typing and a clear language roadmap.

In 2012, things are a little less clear. * ASP.NET MVC4 is very similar to Rails * Both Azure Websites and AppHarbor support a lot of what heroku offers * C# 4 has dynamic language support * Entity Framework has migrations and is more mature. * NuGet and T4 Scaffolding has really taken off * F# is a supported CLR language, so if you like Python style coding, you are fine * MSFT is posting a lot more "core" code to open source repos (like Entity Framework)

I'd argue that Rails is still superior because the ecosystem is more vibrant, but a lot of that "energy" has moved to NodeJs. Ruby language improvements are murky and debugging is still challenging.</comment></comment>


Ask HN: Open Source Projects Looking for Help - <AUTHOR>

Let's start a monthly thread where open source projects can ask for specific help.
It's not required, but appreciated if this format if followed:
- Name of project
- URL
- Short description (Languages etc)
- Link to issues
- A few specific issues that you need help with. <comment><USER3> I have a lot of projects you might be interested in.

## MediaCrush ##

Open source video, audio, and image hosting.

[https://mediacru.sh](https://mediacru.sh)

Languages: Python, CoffeeScript, SCSS

Issues: [https://github.com/MediaCrush/MediaCrush/issues?state=open](https://github.com/MediaCrush/MediaCrush/issues?state=open)

Join #mediacrush on irc.freenode.net to chat about helping. There are tons of things, big and small, that need to get done.

## KnightOS ##

Kernel and userland for Texas Instruments calculators.

[http://knightos.org](http://knightos.org)

Languages: Assembly

Join #knightos on irc.freenode.net to chat about helping. Need help finishing up a bunch of small tasks (like better datetime math) and a few bigger tasks (like a writable filesystem).

## Craft.Net ##

Open source Minecraft client+server+utils, compatible with official software.

[https://github.com/SirCmpwn/Craft.Net](https://github.com/SirCmpwn/Craft.Net)

Languages: C#

Issues: [https://github.com/SirCmpwn/Craft.Net](https://github.com/SirCmpwn/Craft.Net)

Join #craft.net on irc.freenode.net to chat about helping. Exciting plans for Craft.Net.Rendering are underway, as well as plenty of other issues.

## LockBox ##

Secure file syncronization based on gpg, rsync, and your own ring of trust.

[https://github.com/SirCmpwn/lockbox](https://github.com/SirCmpwn/lockbox)

Languages: Whatever you want

Currently only done in concept. Get in touch if you want to help out: firstname.lastname@example.com

## Other ##

I have loads of other projects you may be interested in, all of which are open for pull requests: [https://github.com/SirCmpwn](https://github.com/SirCmpwn)

</comment><comment><USER4> \- pyhs2

\- [https://github.com/bradruderman/pyhs2](https://github.com/bradruderman/pyhs2)

\- Python library to programmatically query hive. Skills needed (python, java, thrift, c)

\- [https://github.com/bradruderman/pyhs2/issues?page=1&state=op...](https://github.com/bradruderman/pyhs2/issues?page=1&state=open)

\- I would like a contributor who understands thrift, and how to optimize it. I would like to remove the dependent libraries (sasl + thrift) by building them into the library itself. I would also like to have a resource that can help improve underlying thrift code to improve the library.

</comment><comment><USER5> \- Quill -

[http://www.quill.org](http://www.quill.org)

Quill is a free web application that provides interactive English grammar lessons. We have built 30 hours of lessons (www.quill.org/lessons), and we currently have 5,000 students using our site.

The site is built in Ruby on Rails.

All of our outstanding issues are at: [https://github.com/empirical- org/Compass/issues?state=open](https://github.com/empirical- org/Compass/issues?state=open)

There are a variety of issues, from small bug fixes to major features. If you're interested in the project, please reach out to me at firstname.lastname@example.com.

</comment><comment><USER6> Lumail, a scriptable console-based mail-client

[http://lumail.org/](http://lumail.org/)

There is a (small) issue list here: [https://github.com/skx/lumail/issues](https://github.com/skx/lumail/issues)

A simple(?) issue I cannot resolve relates to compiling under Mac OS X - <USER2> readline from the ports system, and that issue is tracked here - [https://github.com/skx/lumail/issues/179](https://github.com/skx/lumail/issues/179)

Any update from a Mac user would be most welcome.

</comment><comment><USER3> I'm partway through writing a bot to post this automagically.</comment>


The Original Mario Marathon for Charity Back For Year 6 Live All Weekend - <AUTHOR> http://www.mariomarathon.com/?rr=news.ycombinator.com

<comment><USER2> SWEET!!! I watched through Urgo last year but I wanted to see it again!

</comment><comment><USER3> Love Mario Marathon, everyone should check it out. :)</comment>


Shimon: A robot by Georgia Tech using DL to compose and play music - <AUTHOR> http://www.business-standard.com/article/international/a-robot-with-four-arms-and-eight-sticks-uses-ai-to-write-play-own-music-117061800393_1.html <comment><AUTHOR> Video link - [https://www.youtube.com/watch?v=Xy1Naexo3Bc](https://www.youtube.com/watch?v=Xy1Naexo3Bc)</comment>


Why Bottled Water Is So Expensive on Amazon Right Now - <AUTHOR> https://www.bloomberg.com/news/articles/2017-09-07/here-s-why-bottled-water-is-so-expensive-on-amazon-right-now <comment><USER2> _Amazon's algorithms are designed to spot unusually high prices – that is, high in comparison to other sellers on Amazon—and suspend those accounts. The expensive water is showing up because sellers with cheaper water have sold out and more expensive items previously buried in search results suddenly rise to the top._

I'm not sure what I would tell people who are upset about price-gouging. Should Amazon go out and buy water and sell it's own at a loss? It also seems weird to be ordering water from Amazon and hoping it beats the storm.

I remember in economics learning that certain people would rather the product not be on sale than to see it listed at an "unfair" price. Which seems to be the case here.

</comment><comment><USER3> Meanwhile, water jugs seem to be reasonably priced.

[https://camelcamelcamel.com/Reliance-Products-Aqua-Tainer- Ga...](https://camelcamelcamel.com/Reliance-Products-Aqua-Tainer-Gallon- Container/product/B001QC31G6) [https://camelcamelcamel.com/Coleman-5-Gallon- Collapsible-Wat...](https://camelcamelcamel.com/Coleman-5-Gallon-Collapsible- Water-Carrier/product/B000088O9Y)

And if UPS is still delivering, then you probably still have potable tap water to fill them up.

<comment><USER4> The only ones at that price are out of stock. Going rate from third party sellers is $50+ for a $15 container.

<comment><USER3> I have no idea what you are looking at, but I see them as under $20 with free prime shipping.

<comment><USER5> I see $130 for one of them and "Usually ships within 1 to 2 months." for the other.

<comment><USER6> The price could depend on where you live.

<comment><USER5> Amazon does not do that. (Except for a country as a whole.)

I'm sure they could, but they have never done so before. Their prices do change constantly - but for everyone at once.

</comment></comment></comment></comment></comment></comment><comment><USER7> People often forget that higher prices is the incentive that brings more product to market during a crisis. Demonize people selling bottled water at high markups and you disincentive people with lots of bottled water who were about to drive it across the country to address your shortage.

</comment><comment><USER8> Capitalism is cut-throat, there is no other capitalism in the West or the East. The only reason capitalism works a little better is because there is meant to be competitors in times of surplus. Evidently, no one has surplus of water to compete against price gouging and Amazon's logistical operations are unable to handle certain edge cases such as these.</comment>


Memory use and speed of JSON parsers - <AUTHOR> http://blog.ionelmc.ro/2015/11/22/memory-use-and-speed-of-json-parsers/ <comment><USER2> I did an experiment[1] last year that demonstrated JSON parsing only requires 1 bit on the stack per array or associative array encountered (as they are the two non-terminals that lead to different rules).

In my implementation, I let a 64-bit integer represent the non-terminal stack (then used recursion if it went over that). So you'd need a JSON structure that has "a hash of a hash of a hash ... pointing to an array" with a depth in the 60s before you'd get a recursion call. And the real program stack shouldn't take that much per call (I didn't optimize this part, so I'm not sure what the minimum is).

I only wrote a JSON validator, but my method should apply to cases where JSON elements are being placed into a data structure.

I'm pretty sure that a JSON parser could be written in C/C++ that requires less than 1kb overhead, where most of that is the string buffer.

I make no claims about speed though, as my concern was proving the bit part (I suspect speed using my method would be worse than the naive per character jump table).

[1] [http://web.cs.dal.ca/~sjackson/bitJson/JSON.html](http://web.cs.dal.ca/~sjackson/bitJson/JSON.html)

</comment><comment><USER3> Once you have more than 50MB of JSON, maybe it's time to switch to a streaming parser. While that's not going to give you more parsing speed, it will solve all your memory issues and if you are getting that data from a slow source (like the network) then you can even parse as you are reading it, which then would give you a considerable speed advantage.

<comment><USER4> Seems like a streaming parser wouldn't help too much in this case because all of the data was inside one terminal.

</comment></comment><comment><USER5> I had a very similar problem with Ruby and some of our workloads. I ended up utilizing this evented parser [1] to process smaller subsets of the JSON document and then clear them from memory. The result is a memory usage that is at most the size of one of these subsets (plus some overhead).

I have been wanting to generalize this approach with some open source software for some time, but I haven't gotten around to it. I think an attractive solution is for a user to specify a JSONPath [2] upfront about the types of subsets they are interested in. In the case of Ruby these chunks could then be yielded by an iterator and cleared, but I wonder if a more general-purpose CLI program which prints the subsets to stdout would also work if the subsets are small enough. But this adds another serialization/deserialization step.

[1] [https://github.com/dgraham/json-stream](https://github.com/dgraham/json- stream) [2] [http://goessner.net/articles/JsonPath/](http://goessner.net/articles/JsonPath/)

<comment><USER6> I did something very similar with XML in Ruby. All the libraries are either event-based (SAX, which is awful for actual parsing code) or snarf the whole document into RAM.

I wrote a simple SAX wrapper [1] that applies a (so far, extremely simplified) subset of XPath to the stream, then parses each match into a DOM using Nokogiri. Works exceedingly well, though it's not _faster_ than reading everything into RAM.

[1] [https://github.com/t11e/nokogiri-simple- streaming](https://github.com/t11e/nokogiri-simple-streaming)

</comment></comment><comment><USER7> In the project that I am involved[0], I have been doing stress tests with very large JSON messages. After evaluate a few options I came up that the project 'JSMN' was good enough for my purposes.

        https://github.com/zserge/jsmn

I am not sure if there are Python or another language bindings available but that library is very clean and simple to use. It does not perform memory allocations as you (the caller) have to provide the buffers so it gives you good flexibility.

[0] [http://fluentbit.io](http://fluentbit.io)

<comment><USER8> I've worked with jsmn, and it was really a pleasure. I loved that you had one big memory allocation up front (which could even be on the stack) and then no more. In my case I was filling in a data structure where I was comfortable capping the length of all list-like elements, so I also had just one big allocation for that.

Using it reminded me a lot of my days writing XML SAX parsers. I understand why some people don't like that pattern, but if you've ever written a Finite State Machine it will feel very familiar. Personally I like how the event- based model lets me break things up into little chunks.

</comment></comment><comment><USER9> I've made a plot from this data: [https://plot.ly/~PiotrMigdal/86/](https://plot.ly/~PiotrMigdal/86/) (I was having problems in comprehending all data at once).

</comment><comment><USER10> Title is missing ...and alternatives. That was the best part!

</comment><comment><USER11> I made a "JSON parser generator" a few months ago. There is no memory overhead because it just puts the json data straight into a C struct while it's parsing.

[https://github.com/marel-keytech/jsoncc](https://github.com/marel- keytech/jsoncc)

</comment><comment><USER12> I'd be curious to see how FlatBuffers lines up against MsgPack seeing as it requires just a single allocation and read.

Heck if you want to get fancy(and have access to mmap) you can just mmap() your FlatBuffer data and let the kernel handle paging it in/out for you for very low memory overhead.

</comment><comment><USER13> Sometimes you dont have a choice, say receive your data in Jason. In those cases, my experience is that ujson is much faster than the alternatives. Interesting that the author concludes the same for small objects but a different picture with bigger objects.

</comment><comment><USER14> The word "Python" should be inserted somewhere in the title.</comment>


Building a Side-by-Side Diff Tool - <AUTHOR> http://bit-builder.blogspot.com/2013/10/sourcediff.html

<comment><USER2> This is very cool.</comment>


Foursquare iPhone app sends passwords in plain text, don't use - <AUTHOR> http://martinkou.blogspot.com/2010/08/foursquare-considered-harmful-dont-use.html Did a Wireshark session vs. Foursquare for iPhone's traffic after reading the news today. Found something very unpleasant. <comment><USER3> Only tangentially related:

The other day I was trying to log on to a service I rarely use, and couldn't remember my password. So I started chugging through all the different passwords I use. Then I realized what a _horrible idea that is_. If the service wasn't benign (or if they were using plain text), I could have just let out ALL of my passwords.

Really, really stupid, but I wonder how many people do this, and how effective it could be as a way to collect passwords.

<comment><USER4> A similar case is typing in your email password by mistake when (trying to) log in to a site where your email address is your username.

<comment><USER3> Good point.

I've been thinking about lazy registration a lot. I'm considering implementing a service where the user will be prompted at some point to enter their email to be remembered, but making a password optional.

The service would be worthless to hackers, but I suppose griefers could still have some fun.

<comment><USER5> Instapaper does this; you only have to set up a password if you want.

</comment></comment></comment></comment><comment><USER6> Ok - so welcome to last year? I recall a PyCon talk on security a few years ago where one of the speaker's first slides was a list of passwords with the text "if this is your Twitter password, change it, then change your Twitter client."

Most of these startups treat the iPhone as if it were some magical device that's plugged straight into their API. I actually participated on a Get Satisfaction thread for Gowalla where one person claimed they liked that it was iPhone only (which dates how long ago it was) because it made it "secure" and couldn't be "hacked the way Foursquare can."

Needless to say, they were disabused of that notion pretty quickly when checked in at the Gug, the Apple flagship store in London, and my home within the space of 30 seconds. It literally took 3 minutes to figure out - most of which was spent setting up my iPhone to proxy through my laptop. They were (and keep in mind, this is back when Gowalla was still iPhone only) sending everything in clear text.

They also didn't regenerate session IDs for anything at the time. I logged out and logged back in, same session ID. I logged out via my iPhone, loaded up their site and changed my password, then logged back in, same session ID. Basically, once you had sniffed one session ID you were set. I tried it a week later and was still able to use the same session ID without any problem.

It's amazing that things like session hijacking are so unknown and unfamiliar to people people relying on web frameworks to do everything for them. At the time they were using Merb---I found out by hitting an "/unknown/and/unknowable/" page and seeing their backtrace output. Session hijacking is a solved problem, why they were subject to it I can't fathom.

</comment><comment><AUTHOR> Double, and triple checked. You can reproduce this yourself. I'm using a MacBook Pro for this.

1\. Plug your MBP to wired ethernet - you have one of these in your home, right?

2\. Open an ad-hoc network in your MBP, and share Internet access via that ad- hoc network.

3\. Connect your iPhone to your MBP's ad-hoc network, now it should be able to access the Internet via your MBP.

4\. Install and fire up Wireshark in your MBP - make sure to read the instructions or otherwise it can't capture packets.

5\. Get Wireshark to capture packets on the ad-hoc Wifi interface.

6\. Filter out the HTTP packets going to *.foursquare.com by adding the filter 'http.host contains "foursquare"'

7\. Fire up Foursquare on your iPhone, login if you haven't already

8\. Boom, you've just sent your password in plain text, over the Internet.

<comment><USER7> I'm doubtful. Have you quadruple checked?

</comment></comment><comment><USER8> 1) Foursquare was one of the most popular targets for DEFCON'S Wall of Sheep this year, next to Twitter. I believe the mayor of the con was also made the mayor of Sheeptown.

2) Their desktop site doesn't use SSL either, as my Unencrypted Password Warning Chrome extension ([https://chrome.google.com/extensions/detail/mjpinemnkjlppmem...](https://chrome.google.com/extensions/detail/mjpinemnkjlppmemjfabdaelpfgfjgkj)) will warn you, so it should come as no surprise that mobile doesn't.

<comment><USER9> Interesting extension, but Chrome gives an ominous "This extension needs access to your data on all sites." I assume this is necessary to be able to read the targets of forms.

<comment><USER10> Yeah, I got the warning on quite some sites incl. get satisfaction and even twitter at one point. Does it give false positives?

<comment><USER8> See the FAQ. It is unable to tell if a form submitted by JavaScript is in fact submitted securely, so it warns.

</comment></comment></comment></comment><comment><USER11> Foursquare's response: [http://blog.foursquare.com/post/990202740/changes-to- our-aut...](http://blog.foursquare.com/post/990202740/changes-to-our- authentication-system)

tl;dr version: Implementing HTTPS, should be live in "coming weeks'.

<comment><USER12> Incompetence of the highest order.

</comment></comment><comment><USER13> Well, that's the case for their regular website too! No SSL at all (<http://foursquare.com/login>).

</comment><comment><AUTHOR> I've been notified that Gowalla is also having the same problem - <USER2> unfortunately it's confirmed. I've uploaded another screenshot showing the same problem with Gowalla 2.2.1 on iPhone:

[http://lh4.ggpht.com/_UrFI48Xbj8g/THD6IyfkCYI/AAAAAAAAALg/ZT...](http://lh4.ggpht.com/_UrFI48Xbj8g/THD6IyfkCYI/AAAAAAAAALg/ZTgmRQ9bX98/s800/Screen%20shot%202010-08-22%20at%203.13.35%20AM.png)

Note that "Authorization: Basic" line - same problem with foursquare. If you're running the same procedures I outlined with Gowalla you'd see your own username:password right after the HTTP authorization line.

</comment><comment><USER14> What's the best way to handle this? Use HTTPS? I'm working on an app that will have a similar architecture.

<comment><AUTHOR> You can follow Facebook Connect's example. A few points there..

1\. Logins must be done on HTTPS. On the SSL level, the client must authenticate the server's certificate - i.e. the client must check whether the server's certificate is properly signed by a trusted CA, and whether the server peer name matches the name that's being connected to, e.g. api.example.com. This means nobody will be able to intercept the encrypted passwords via man-in-the-middle attacks (e.g. by hijacking a DNS and redirecting traffic to his fake api.example.com server).

With proper server certificate authenticate in place, only the person/company/server with api.example.com's private key will be able to decrypt the HTTPS traffic going into api.example.com. So as long as nobody working for example.com posts the private key on Slashdot or HN, nobody outside of example.com will be able to intercept the login passwords - assuming they don't have other security holes like SQL injection problems.

2\. HMAC or HMAC-like scheme based on shared secrets and sequence numbers. If you intend to let clients use your API via HTTP instead of HTTPS after the login step, e.g. for performance reasons - frequent HTTPS handshake can slow your app down a lot when you take network latency into account - you'd need to have a way to authenticate your clients on the clear without using passwords or just simple cookies.

What Facebook's HMAC-like scheme does is that they'll send a shared secret to you on HTTPS, in addition to just the open session key, when you login. Any FB Connect requests would have a session key, a sequence number, and an md5 hash of the whole requests appended to the session secret. Because nobody else knows the the session secret, the only person who can generate the correct md5 hash for that request is you. So even if an attacker can intercept e.g. a Facebook status update from HTTP, he wouldn't be able to change it or post something else to your wall later. The sequence number is there to prevent replay attacks so the attacker wouldn't be able to post the same message again.

<comment><USER15> RE: point 2, The Facebook Graph API (which will at some point deprecate the Old REST API) does not operate in this fashion. You receive an OAuth access token and pass it back to FB over HTTPS. Unlike the Old REST API, no MD5ing/secret key signing/etc. is required. And the sequence number passed to the Old REST API is _not_ there to prevent replay attacks - it simply needs to be a number larger than any of the previous messages' sequence numbers (as an attacker, I'd just pass in a very large value; in practice, everyone just passes the UNIX timestamp).

</comment></comment></comment><comment><USER16> Traffic captured at Defcon 2010 Wall of Sheep

POP - 4.3% FTP - 6.7% IMAP - 10% HTTP - 23% Four Square - 23% Twitter - 33%

</comment><comment><USER17> Foursquare doesn't support SSL at all. The best you can do is request a long- lived OAuth token, but even doing that requires sending the user's email/password in plaintext (although only once!).

<comment><USER18> Yea I mentioned this on twitter to one of their engineers a several months ago and he said it was "on their to-do list." Seems a little too important for that.

<comment><USER19> it's been an issue on their getsatisfaction page for 10 months ... <http://getsatisfaction.com/foursquare/topics/https-o65c> ...

</comment></comment></comment><comment><USER20> I hope all browser makers should show a warning message when user submit a form contain the field "password", if that action is not protected by SSL.

</comment><comment><USER21> Have you double checked? Seems weird, especially for a mobile checkin app that is much more likely to encourage using open wlans :/

<comment><USER22> Yeah, I have a hard time believing that this is accurate. Definitely scary if true, but I would like to put my faith in Foursquare having checked this box a long time ago.

Also: why, after millions of checkins over public networks, is this only coming up now? Surely someone would have got burned by this by now?

<comment><USER23> Probably just because it's not very practical and there is no obvious payoff. You would have to sit around a popular spot for hours with a laptop sniffing the wifi to collect logins. What do you do with them? For SPAM purposes it would be easier to just make new accounts. As far as I know there's not a whole lot of valuable information in a FourSquare account like credit card numbers or banking information. Seems like the only thing you could really do is embarrass people.

<comment><AUTHOR> A lot of people use the same passwords for GMail, bank, credit card, Facebook, ..., and Foursquare. So it's a big deal if you can easily collect passwords from any one of these services.

<comment><USER22> Exactly... I guess this is just another lesson that security of a network (in this case meaning all the different services we use) is only as strong as the weakest link. Certainly not going to be firing up the foursquare app for a while

<comment><USER24> Related to the "security of a network":

one of my Facebook friends got his account compromised recently and a scam email was sent to many of his contacts. I think the scammer got the FB account somehow, and found the email of my friend as well as the emails of his FB friends shown on FB (like mine…).

It made me realize that your info on Facebook is as safe as the weakest account of your Facebook friends. I'm in control of my own passwords and make sure that all my passwords are different. But I can't control my friends' password policies, which are probably very weak overall.

</comment></comment></comment></comment></comment></comment><comment><USER25> Is it easier or harder to intercept a password over 3G than wifi? (I'm just curious)

<comment><USER26> It depends. Obviously unencrypted wifi is trivial to sniff, and WEP encrypted wifi is only modestly harder. However, wifi _can_ be configured to be highly secure, with for example WPA2/AES, etc.

Both GSM and CDMA are encrypted, but I believe both have been broken and aren't considered as secure as something like WPA2/AES.

Keep in mind though, that it's not _just_ the trip over the wireless network that's at issue, it's also anywhere on the Internet between you and the service you're using (Foursquare in this case).

</comment></comment><comment><USER27> Oh you don't want to know how many apps are doing this. People just have no idea.

I wish service providers would _force_ app developers to use strong encrypted authentication channels.

</comment><comment><USER28> Guess what: unfortunately most websites do. If you share a password with a website that does, then game over.

</comment><comment><USER29> Good to know. I'm out.

</comment><comment><USER30> Unless you're reusing passwords (which of course you shouldn't be), this doesn't really seem any worse than any other unencrypted website login, or hijacking authentication cookies from an unencrypted connection. The latter you could even do with gmail until they defaulted to SSL.

If you were using, say, Hacker News on a public wifi without going through a VPN or so, I could trivially log in as you just by looking at the Cookie: headers you send to it. I don't need your password to post as you and I probably could even change it because HN doesn't ask for your old password, but maybe it requires email confirmation in which case you just need to notice. Of course, HN is a similarly low-key target as 4sq for this sort of thing.

<comment><AUTHOR> The damage of an intercepted cookie is limited to the site you're logged into - if I intercepted your Hacker News cookie, I can't use it to log into your bank account.

The damage of an intercepted password is much bigger. It's a fact that most people reuse passwords. You can't say the issue doesn't exist just because you shouldn't do it.

There're also services that are a lot more careful than that. e.g. Facebook Connect's API uses HTTPS for (at least) the login so you can't intercept the passwords, and then it uses an HMAC-like authentication so that even if an attacker can intercept any non-encrypted messages, they can't change it or impersonate you.

<comment><USER30> My point is I fail to see how this is an unusual or new situation. You can probably accuse millions of sites of sending passwords in the clear on login.

Besides: say I steal your HN (or whatever) cookie and hit _logout_ from your account. Your auth cookie is now no longer valid, you get a login prompt. You assume it's some kind of glitch and re-login with your password, which I intercept. Is that much better?

<comment><AUTHOR> Thing is.. very few people go into random restaurants and login (and I mean, login, in which you type in your password) to sites like Hacker News or Slashdot every day. The chance of you opening a public AP in a crowded place and getting back a Hacker News password is slim to none - I'm not saying it's safe though.

Foursquare passwords, on the other hand, is something you can very easily intercept in the open - due to the way it's used, and that it sends your passwords out every time you open it without you typing anything - that's already unusual. There're surely a lot more poorly secured sites and mobile apps, but something like Foursquare's authentication scheme is a big problem for its users.</comment></comment></comment></comment>


Bin Ladin's Bookshelf - <AUTHOR> http://www.dni.gov/index.php/resources/bin-laden-bookshelf

<comment><USER2> This is really interesting... Of all these books and other documents, I wonder how many he actually read. I'd love to see if there are any margin notes in the books, or any notebooks nearby.

I may not agree with his plan, but it's still worthwhile to understand his motives. He was obviously a uniquely talented person to be able to get the US sucked into a major war, with all the expense and trouble and lost opportunity that entails.

As an aside, he had a book on Adobe Shockwave. It make me laugh to picture him getting _really_ into Shockwave development and trying to find a job at some media firm in San Francisco.

</comment><comment><USER3> Bin Ladin's been coding!

No bitcoin books? No RoR? Dreamweaver is old school.</comment>


Porting Day of the Tentacle to Linux - <AUTHOR> http://cheesetalks.net/porting_dott.php <comment><USER2> I just bought this game last night. It's worth every penny (no DRM, and you can switch back and forth between operating systems without trouble; I've played on Debian Jessie native as well as wine..)

This is a funny but mildly challenging game that kids seem to like too, and it's not scary, adult, or violent; I half expected to see the Mystery Mobile pull up and Scooby and Daphne jump out.. or maybe Cruella De Vil. The music is a perfect fit.

I never played the original, but this seems like a nearly flawless remaster with great new art, audio, and animations and seems to be like a perfectly working Linux port. Even cooler, you can press F1 in any scene and see it morph into the old pixel art.

It's $8.99 at GOG while on sale[1]. Absolutely worth it and kudos to Cheese for a great Linux port.

1\. [https://www.gog.com/game/day_of_the_tentacle_remastered](https://www.gog.com/game/day_of_the_tentacle_remastered)

<comment><USER3> If you liked this, you might also want to checkout Grim Fandango if you haven't already.

<comment><USER4> And the first two Monkey Island games, that got a remake.

<comment><USER5> The remakes haven't been ported to Linux.

<comment><USER4> Oh, that's a shame. Got to keep playing the un-remade versions on ScummVM then.

</comment></comment></comment></comment></comment><comment><USER6> For those who aren't yet aware, Ron Gilbert and Gary Winnick (of Secret of Monkey Island and Maniac Mansion fame) are currently developing Thimbleweed Park - due to release in early 2017.

Dev blog here: [https://blog.thimbleweedpark.com/](https://blog.thimbleweedpark.com/)

</comment><comment><USER7> Nice write-up Cheese! And good work on the Linux port.

I'm Mark Cooke, CEO of Shiny Shoe and producer on both the Day of the Tentacle and the Grim Fandango remasters. If anyone has any questions about the production of the remasters I'd be happy to try to answer.

<comment><USER8> In technical terms: What is process of remastering an old game? How much of the old game do you use?

<comment><USER7> In the case of DotT a significant amount of the original game code was re- used. Both the C run-time as well as all the original SCUMM code, a domain specific language invented by a team at LucasArts for creating adventure games.

On top of that is a modern C++11 engine harness that inter-operates with the original code, provides platform services, adds a brand new rendering system and art pipeline for the remastered art, etc.

</comment></comment></comment><comment><USER9> This is an interesting article, and mirrors my experience of porting. I really loved seeing the advice from various other developers he consulted. It's a nice way to expand it from being just his experience to a more general statement about what it's like to port software. I never ported a commercial game, but did quite a bit of porting to Native Client. The parts about knowing your tools, knowing the project, and the process of porting are spot on.

One thing he didn't mention (or I missed it), is how it feels when your port starts to work. I found it to be thrilling to have a big pile of code that doesn't work at all, and it stays that way for a while, until suddenly almost everything seems to come together. It's very different from normal software development, which is more gradual. Porting software feels more like solving a puzzle.

<comment><USER10> It's interesting - I feel like I've experienced that more from working on my own games/projects than doing this port.

Perhaps it's difficult for me to reflect on that with regards to DotT at the moment - all I remember feeling whenever I got something working was relief, and that was usually fleeting because there was always something else that needed attention.

Poetically, I feel a little cheated that having the renderer work out of the box meant I didn't have an opportunity to get screenshots of any cool mangled visuals (although I am glad I didn't have to touch the renderer at all) :D

It's possible that I'll feel differently after the dust settles. If that happens I'll definitely update the article with some extra thoughts!

</comment></comment><comment><USER11> FTA: Ryan Gordon's Serious Sam porting changelog: [https://icculus.org/~icculus/dotplan/SeriousSam- CHANGELOG.tx...](https://icculus.org/~icculus/dotplan/SeriousSam- CHANGELOG.txt)

I need to step up my changelog game. This is fantastic.

</comment><comment><USER12> For some of us it feels like DoT came out yesterday and we had insane fun with it. But if you cite something and your peers just stare at you, you realize those peers are 10 years younger or more. This is a shame, I will certainly setup a friday afternoon session and see if I can get my younger peers into it.

DoT must never be forgotten.

</comment><comment><USER13> I love this game and the others from the Golden Age of LucasArts (monkey island, tie fighter, fate of atlantis etc).

</comment><comment><USER14> This artcle was surprisingly difficult to follow with all those comments</comment>


In Search of the Longest Subway Ride - <AUTHOR> http://www.wnyc.org/story/search-longest-subway-ride/

<comment><USER2> This might also be relevant to various interests: [https://subwayrecord.wordpress.com/2015/03/26/a-guinness- wor...](https://subwayrecord.wordpress.com/2015/03/26/a-guinness-world-record- diary-dr-strangeline-or-how-i-learned-to-stop-worrying-about-the-amateur-new- york-subway-riding-committee-and-love-the-mta/)</comment>


Mysql_real_escape_string wont solve your SQL injection security bugs - <AUTHOR> http://www.iodigitalsec.com/mysql_real_escape_string-wont-magically-solve-your-sql-injection-problems/

<comment><USER2> Dead link

<comment><USER3> Yeah? It works for me at [http://www.iodigitalsec.com/mysql_real_escape_string-wont- ma...](http://www.iodigitalsec.com/mysql_real_escape_string-wont-magically- solve-your-sql-injection-problems/) . Very interesting and clearly written article.

<comment><USER2> Post must have gone down and up again then :)</comment></comment></comment>


Show HN: Short-list of recommended tools, frameworks/languages - <AUTHOR> https://github.com/karmakaze/lang-tools <comment><AUTHOR> This started out being a reminder list of software tools and languages that I'm currently using, evaluating, or have used and then it sort of morphed into a short list of what to consider using on new projects.

I'd like to add any major omissions to this list. There are certainly things listed that are specific to my historical use and will get removed to make it into recommendations.

I'm trying to keep the list forward thinking as well as short so when there are multiple similar items choosing one where I have an opinion (e.g. Clojure rather than Racket/Scheme).</comment>


Stop Panicking about the Post Office - <AUTHOR> https://medium.com/@nharpermn/stop-panicking-about-the-post-office-8bcd689b9601 <comment><USER2> There is no panic about the (US) Post Office. The agency is under concerted attack by the President's men, and has already suffered serious damage. The President has explained in detail that a well-operating Post Office would prevent his re-election by delivering mail-in ballots favoring his opponent, and has acted to stop it.

<comment><USER3> Because the US Post Office couldn't handle even a Christmas rush of cards and packages. One ballot per person per year will absolutely crash that system.

<comment><USER4> That's the sort of thing that one would assume would create a news cycle, if the USPS failed to handle holiday shipping.

Chewing back through the archives of 2019 news, I don't see such a news cycle, or really anyone complaining about extraordinary delays. I do see that the Post Office did an unusual amount of gearing up because the distance between Thanksgiving and Christmas in 2019 shortened the peak shipping window ([https://www.marketplace.org/2019/12/05/six-fewer-shipping- da...](https://www.marketplace.org/2019/12/05/six-fewer-shipping-days-till- christmas-puts-pressure-on-ups-fedex-and-usps/)). But they appear to have handled it fine.

Here's their self-reported tracking metrics through 2019 Q4 on package delivery ([https://about.usps.com/what/performance/service- performance/...](https://about.usps.com/what/performance/service- performance/fy2020-q1-package-services-quarterly-performance.html)). No real deviation from their regular numbers indicating a performance drop.

What's our source on the notion that they got crushed by Christmas rush?

<comment><USER3> It was sarcasm. My point being if they can handle the Christmas rush, they can handle an extra ballot per person once a year.

However, I suspect that the "USPS needs funding" narrative was stoked so congress would provide funds to make sure the blockchain voting system the USPS is implementing runs smooth.

<comment><USER2> Sarcasm is against the HN CoC.

We have yet to see whether, in its damaged condition, it could still handle the Christmas rush. With sorting machines unplugged and shipped off to warehouses or scrapped, with employees forbidden overtime to handle fluctuations, with hiring frozen, it is far from certain it can still handle votes. That is by design.

<comment><USER3> Sorry, I forgot the "/s" at the end.

</comment></comment></comment></comment></comment></comment><comment><USER5> Can anyone with real knowledge of the subject corroborate or dispute this? Genuinely interested. The article makes a lot of sense, and if true, disputes the popular narrative. But there is a big "if" and I am not qualified to know if this is true (hopefully) or just really well crafted to hide the truth.

</comment><comment><USER6> But that would require disengaging the 24/7 chicken little fear narrative.</comment>


Making Android Games that Play Nice - <AUTHOR> http://android-developers.blogspot.com/2011/11/making-android-games-that-play-nice.html <comment><USER2> _Fixing this is trickier than it sounds. Some games wait for onWindowFocusChanged() instead of onResume(), which works pretty well on Gingerbread. But on Honeycomb and higher, onWindowFocusChanged() is sent when certain foreground windows — like, ironically, the volume control display window — take focus. The result is that when the user changes the volume, all of the sound is muted. Not the developer's original intent!_

 _Waiting for onResume() and onFocusChanged() seems like a possible fix, and it works pretty well in a large number of cases. But even this approach has its Achilles' heel. If the device falls asleep on its own, or if the user locks the phone and then immediately unlocks it, your app may not receive any focus changed messages at all._

This doesn't give me a lot of confidence in the framework decisions being made by the android team.

<comment><USER3> The solutions presented seem simple enough. Here's the "I must resume my activities immediately!" solution:

 _1\. Pause playback when you receive onPause().

2\. When you receive onResume():

2a. If you have previously received an onFocusChanged(false) message, wait for an onFocusChanged(true) message to arrive before resuming playback.

2b. If you have not previously received an onFocusChanged(false) message, then resume audio immediately.

3\. Test thoroughly!_

The documentation for onFocusChanged might be helpful for you: [http://developer.android.com/reference/android/view/View.OnF...](http://developer.android.com/reference/android/view/View.OnFocusChangeListener.html)

</comment></comment><comment><USER4> Alternatively, don't include background music in your game. I am usually listening to my own music anyway.

</comment><comment><USER5> Wow, new low for Javascript non-fallbacks. That page has no scrollbar in my default setting (Opera with Javascript disabled) so the text is cut off mid way through the post.

<comment><USER6> Agreed, almost as bad as the blank page used by some sites (like Google+ posts). In this case the workaround was the same.

In Firefox I was able to get scrolling by disabling the page style (View->Page Style->No Style). I'd imagine there's something similar in Opera.

</comment></comment><comment><USER7> Too short! I was hoping for more tricks and tips. I started learning Android programming by making a game. (<http://developingthedream.blogspot.com/>) It's tricky to get things like multiple activities, dialog activities, efficient service communication. Then of course, multiple displays and sizes. Also, different keyboard layouts, etc.

<comment><AUTHOR> Sounds interesting! Why don't you should write about it?

<comment><USER7> Hmm, I have been meaning to make a tutorial on something Android related. They tend to bring in traffic to my blog :p</comment></comment></comment>