How Lean Startup Forced Me To Leave My Country - <AUTHOR> http://20minus.com/wp/2011/03/20/how-lean-startup-forced-me-to-leave-my-country/

<comment><USER2> I found the article a bit of a puzzle - I must admit I cannot understand his final point. The author talks about how he moved to the SF bay area, and says:

"So this is how instinctively craving for the Lean Startup's feedback loop, i decided to leave my home country and get to the place where internet startups are built."

Isn't the internet, where internet startups are built? That's were all your users are. That's where all the revenue comes from. I thought the whole point of startups, was that anybody with an idea could create one without having to live in a certain place, or have lots of money and connections.

However I admit, that I live on the other side of the world from SF, and the probability that I don't 'get it' is high. Can somebody who is in SF explain what you can do there, that you can't do from anywhere else in the world with a net connection?

<comment><AUTHOR> Hey Luke! Thank you for your comments, i am the author of the article. Which would happen to be a perfect answer to your question... Among limitless other things, you can get feedback and support on your efforts in SF... more on that on another post i made on "Why Europe Leaks Startups to US" <http://goo.gl/8ijbm>

But now that i am in SF i can draw you a picture comparing the two situations. When i was back in Greece, working on my Consumer Internet Startup product was like operating the Pathfinder rover on Mars. If it got stuck in the mud it could take weeks, months, or forever to get started again...

On the other hand, being here in SF, working on the same product is like driving a Land Rover on Mars with me in it! In the unlikely situation that i'll get stuck in the mud, i'll have helicopters lifting me off in less than 30 minutes.

But then again, why not have someone 'local' explain the difference? :)

<comment><USER2> Hmmm, from reading your other post, it sounds like you can create a start up anywhere, but if you want to make the 'next big thing', you will get a bost from being in SF, because, there is a bigger network of people working on startups, thats where the money is, and thats where the coders are.

Would that be correct?

<comment><AUTHOR> exactly!

</comment></comment></comment></comment><comment><USER3> How did you get a visa for the US? This is still a big issue for EU based founders that want to move to the valley.

<comment><AUTHOR> Hey rmoriz! I plan on bloging about that exact issue right after my next blog... Rss on ;)

<comment><USER4> Would you mind elaborating ever so slightly about your visa situation?

When people leave such big cliff hangers it makes me secretly despise them for their ability to get me transfixed until the next blog post.

<comment><AUTHOR> So you are the spoiler type of guy :P

* Not one single path exists * Each one takes his own unique path * If you are to find it you will find it

</comment></comment></comment></comment><comment><USER5> I believe Thanasis gives a good insight of his efforts to find the right path. Great article. As in most situations there is no "right" path.

For people asking on what is the big difference to do something outside a major innovation hub, this is something been discussed so many times. In fact this question is self-contradictory, because the guy that wrote it, reads HN a SF news incubator, which in fact started off from another city and moved to SF! They should have an idea why they did that. In fact they explained how beneficial this move was.

Now off course there are other hubs of innovation, but everyone has his own reasons for deciding.

</comment><comment><USER6> Nice article. How are you doing today with users and feedback?

<comment><AUTHOR> Hi Alex! I am in an ever accelerating pace since i set foot in the U.S! I am glad i made that decision</comment></comment>


A/B Testing on 4chan - <AUTHOR> http://boards.4chan.org/gd/res/51935

<comment><USER2> Should be noted that threads are ephemeral... so this might disappear after a while. Not sure what the turnover's like on /gd/ though, so it might be around for a long while.</comment>


Demystifying agile, top 7 myths. - <AUTHOR> http://www.makinggoodsoftware.com/2010/11/07/demystifying-agile-top-7-myth/ <comment><USER2> I don't think there's much value in articles such as this. This one in particular uses an incredible amount of vague language (What do you mean by "agile"?), and sets up a number of straw men (Did anyone ever claim retrospectives fix everything?).

This kind of writing always seems to me to be trying to limit discussion in some way. It pretends to criticize a certain approach by bringing up problems that don't really exist (or aren't important), but implicitly accepting the basic principles of the thing they're criticizing, thus framing the debate. On one side we have the total religious fanatics who apply Agile to everything, and on the other are the sensible agilists, who don't think that "retrospectives fix everything". Okay, that's a debate you can have but it's an extremely narrow spectrum of opinion. If you're really trying to reach people who are "agile-averse", then you ought to argue for your approach _with them_ and demonstrate that your way has merit.

<comment><USER3> Personally I don't think he wants to limit the discussion or even make a point - it rather looks like he writes whatever baits more people.

</comment></comment><comment><USER4> A lot of what people write about "agile" processes tend to be written keeping in mind teams/people at traditional companies. Very few of these are helpful in a "startup" environment.

So a pro tip to make sense of such articles - imagine being part of a big team at a big company while reading. They will start making a lot more sense.;)

</comment><comment><USER5> All very good points. And I agree there seem to be a lot of misunderstandings even now.

How about, though:

2) Agile does have a good process for estimation. Estimating by relative size removes all those "unknowns". This does allow for a velocity that doesn't vary between iterations. I have three teams that have a velocity that on varies 10% between iterations. There is more to Agile than just Estimation. There is the commitment that a team makes to deliver. So, even if their estimates are off, the team is more likely willing to put in the extra time to meet the commitment. Remember, in Agile you commit to product, not points.

With regards to accurate: it isn't supposed to be accurate. It is supposed to be reliable.

4\. With regards to documentation, no light design, etc. This stuff always seems so mis-understood. Agile says you do enough documentation/design to make it to the next game. But yes, not a silver bullet.

5\. Agile requires any issues brought up by a retrospective to be placed in front of the backlog. I guess if management isn't willing to allow that, then they aren't following Agile. In the end, it is really all about execution which has nothing to do with Agile itself. Agile just affirms that you need to continually reflect and improve on the process itself. It doesn't explain how to manage that.

6\. It is true this would be silly to say. And there is Behavior Driven Development (BDD) which requires you to test your system from end to end. There is also continual integration (CI) which allows "heavy tests" to be run periodically as opposed to continually during development.

Please note, I didn't make these "rules". I just follow them and it has worked really well for me.

</comment><comment><USER6> Agile is such a generalization. There are many practices below Agile such as Scrum, XP, Lean, Kanban, DSDM, FDD, etc.

Agile itself is just a set of principles. The actual implementation still require some processes.

I don't think people should attack Agile as a whole, but they should focus on which practices they chose. For example: Scrum is an agile practice for Project Management. But in order for a shop to use Scrum, they must implement certain practices from XP. XP more of an agile practice for Software Developers.

There are shops which implement only SCRUM but not the XP part. That is to say that they implement the whole Sprint, Retrospectives, Backlog, Stand-up meeting, but they did not refactor bad code, they did not try their best to have an automation in place. At the end of each sprint, they never test the whole app, they only test whatever the sprint accomplished. This is even worse than the previous practice.

I wholeheartedly agree with those who have been burned by management who thinks that SCRUM or XP will make things better in a short time. I hate to say this but it takes a very long time for a company to change their culture and mindset (depending on the size of the company and what the company does: product vs service).

If your company is switching to something new, make sure they know that methodology inside out. Make sure they met the pre-requisite. Make sure they are willing to sacrifice their time and money for a while.

Otherwise, get your resume ready cause the ship will sink faster than before.

On the other hand, some people might not agree with this but when you have one of these processes in place and everything in your engineering department runs well, that doesn't mean life is good. When the company is not doing well, your senior engineers who receive a big-fat check every month might be a good candidate to be let go. The reason is because your intermediate and junior engineers have already known everything inside out (cause one of the practice in Agile is to share knowledge, cross-functional team, or whatever).

Be aware that it could be a double-edged sword.

</comment><comment><USER7> Some relatively lucid observations there. (Disclaimer: I'm an expert. I was into Agile before it got named that.)

There's one point that I starkly disagree with:

> "Hero developers" make most of the big differences made in software > development.

Wait, did I say I disagree? Hero developers make a big difference all right - for the worse. Nothing breeds bad management like the one guy who pulls through when the team can't. Managers come to rely on them, and therefore on sheer blind luck, when the name of the game is to _engineer_ success, by putting together a solid team.

<comment><USER8> Put this into context: are your experience from working at a big company? Do you even know any super-performer software engineers?

</comment></comment><comment><USER9> I don't know, may be it is just me, but I noticed people here at HN don't have respect about agile. Is this the case?

<comment><USER10> It depends; sometimes, you'll see a huge pro-agile crowd, other times, not so much. This is accentuated if you s/agile/tdd/g;.

I'd wager this is largely due to how one is first exposed to agile methodologies. I'm young enough that I stumbled across agile as a way to solve problems, and so it sounds pretty good to me. However, my slightly older colleagues remember agile as the Newest Management Fad, with high priced consultants, seminars, certifications, and your boss paying lip service to change while still Not Getting It to match.

I like agile's philosophy, but I can certainly see lots of criticisms of Agile.

<comment><USER11> My first experience with Agile was a housemate describing this amazing new design system that meant he could get right into coding without any tedious planning and sort everything out later.

He created a startup for his pet project, eventually managed to get one customer for his product and then realised his idea was fundementally flawed and would never be commerically viable or even supportable.

That is still my impression of Agile - full speed ahead, buzzwords to maximum power and hope for the best.

</comment></comment></comment><comment><USER12> He missed one important point: Agile is an agreement between the customer and developers, it's not magic. A few years ago the customer would tell you: "I want all the features by this day, I don't care about iteration".

Even now, many customers just want the perfect product at the end of the contract.

<comment><USER13> Which customer would tell me that? Which of my customers have you spoken to? None apparently. The Agile way, make stuff up and fling it at people.</comment></comment>


Drone Racing and the Augmented Future of Sports - <AUTHOR> http://readwrite.com/2016/02/22/drone-racing-league <comment><AUTHOR> With this and father.io, how much will we be seeing video games being played out in real life by folks wearing VR headsets at home?

Does that even make sense to us yet?</comment>


Why IT Jobs are never coming back - <AUTHOR> http://www.networkworld.com/news/2010/120910-why-it-jobs-are-never.html

<comment><USER2> Well, I don;t know if networkworld i the best source for recommendations on the state of the market. Further, IT is a pretty nebulous term. Given that it is networkworld, I am going to assume that they are particularly talking about system admin, db admin type roles. While those are not my direct fields, it appears to me that as of lately, there has been a sizable uptick of employment activity for software developers. Whether this is due to the quantitative easing money being in the market or not, I don't have the requisite skills to deduce but there is most certainly an uptick in activity, that seems to contradict the conclusion of this article.

</comment><comment><USER3> <http://news.ycombinator.com/item?id=1989246>

</comment><comment><USER4> maybe because they're all in ireland</comment>


iOS machine learning platform moves into beta - <AUTHOR> https://skafos.ai <comment><USER2> This looks really cool! If you need a tool like that on both Android and iOS, I had a great experience with Fritz. [http://fritz.ai](http://fritz.ai)

</comment><comment><USER3> TL;DR value prop:

1\. Push for coreML - live update apps with models, approve your app w/ Apple just once

2\. Heavy metal for training your coreML models - createML on a laptop stops making sense pretty fast

</comment><comment><USER4> This looks interesting! A couple questions:

How does this compare to CoreML? What are the advantages of running models on- device vs in the cloud via an API?

<comment><USER5> Not all models need to run on the device - of course. BUT there are a few that make a lot of sense. It all depends on speed and what you want to offload to the device. Example, a more quickly responsive (even when offline) image classification (eg is this poison ivy or not) model is best on device. Or in an AR-kit app. Or privacy, like not wanting to ship a medical image across the pipe and so on.</comment></comment>


Need new users to try social bookmark site Relinked - <AUTHOR> http://relinked.com <comment><USER2> Wouldn't this be a really good place to allow a log-in with an existing social a/c (eg Twitter, FB, G+, ...) to avoid the annoyance and security hazard of _yet another_ new online a/c?

<comment><AUTHOR> Yes, thanks for pointing it out. Working on this.

</comment></comment><comment><USER3> What problem does this solve? I'm having a hard time finding a practical reason to use this.

<comment><AUTHOR> I was tired of always seeing the same top list on sites like Reddit. Relinked allow you to remove what you have seen or what you are not interested in. Concentrate on the stuff you like.

<comment><USER3> Does it hide it on reddit? Or on an internal list?

<comment><AUTHOR> Its an internal list. You can however customize your account, see only certain topics, even block domains entirely, giving the power to the viewers instead of the sharers.

</comment></comment></comment></comment><comment><USER4> What is the reward / points for? I was not clear on the site.

<comment><AUTHOR> When sharing links, if users like it, you get points that can then be used to further promote your links. Your links will show up higher in streams and have more chance of beign seen by users following those streams. Thanks for asking. I'll work on explaining this better.

</comment></comment><comment><USER5> Nice easy to remember domainname there, btw

<comment><AUTHOR> Lol! Thanks! I'm proud of it. Now, if only I could get this thing going! :-) Cheers!

<comment><USER5> What I don't like so much is the dark theme and the actual design looks a bit... duh. That's what stops me from actually signing up. In fact, dark "social based" websites, make things look rather amateuristic then anything else. Take any example you like: reddit, twitter, pinboard, etc.. no dark themes.</comment></comment></comment>


I just quit a company that was never (formally) made - <AUTHOR>

Hi
I'm a 16 year old app developer. In April of this year, I made a deal with my father for 50% of my company if he bought me a MacBook to make apps on, as well as start an LLC for the apps. I agreed to that deal because there was nothing to lose. I just wanted to make apps.
*Skip to now
For the past months, I've been learning, developing, and publishing apps. I've put as much work into it as I could sometimes working for more than 12 hours at a time. BUT I was blinded by the work and the rewards I might make in the end from realizing that my father hasn't done anything for the company since April. I've been telling him every week to start an LLC. I wanted to make things as fast as I could, but I now see that he just wasn't into it as I was. I was willing to do anything for the company which wasn't even made, but he'd been waiting for months to actually do something for the company.
So, I quit. I didn't feel like working with (although something it felt like I was working for him) that doesn't have enthusiasm to jump into making the company. I don't know if he was afraid of the risk or something else.
I also just gave him his investment back (the MacBook). I'm also going to have to pay him taxes from money I made earlier this year (January) by selling some of my stuff.
I want to continue making apps (I actually just want to work on one app that I want to spend 100% of my time on), and start on a new venture/company. I'll be spending the next couple of months finding a job to get enough money to buy a Macbook.
And that's how I quot a company that was never (formally) made. <comment><USER2> I'm a father. I have three teen-age children: 17, 15, 13. I'm a business owner.

I'm also a lawyer and I know what it takes to create and maintain an LLC. It's a big fucking pain in the ass, and it is totally irrelevant to the success or failure of a business.

Maybe you can't see the view from your father's side of the equation. Nor can I -- I do not know you and we have never met. But I can guess what is going through his head.

What I do know is that I deeply want my children to succeed in life. I'll bet your father does, too.

I'll also bet that he doesn't give two fucks about owning 50% of a company with you. I'll bet in his eyes the company is 100% yours, and he wants nothing but the best for you.

He didn't invest in a company to buy you a MacBook. He gave you a MacBook because he's your dad and he loves you and he wants you to massively succeed in ways he never did.

He's watching you work hard, and I'll bet he is thrilled at every achievement, big and small. He's probably thrilled just to see you get down and grind hard. Do you know how rare that is in a 16-year old? That is gold to a dad.

He was probably crushed when you gave him the MacBook back. Because that meant you were quitting. I hate it when I see my kids quit. He doesn't care about getting his investment back. His investment is you. He loves you.

You had a company that you 100% owned. You quit. Your reason for quitting is because your father did not give you something you do not need. That's stupid on stilts.

Don't do that. If you quit now you will keep quitting when you are 18. And 22. And 30. And 45. And 60.

You published apps. That means you have a business. A business is one or more people producing something that other people (customers) think is valuable. They vote for your efforts by giving you money to show that they value what you produced.

You have a business. Don't throw that away.

You have a father who loves you. Don't throw that away, either.

<comment><AUTHOR> That's just confusing because I didn't give up the MacBook willingly. I told him I didn't want to work on it anymore with him because he didn't seem to into it as much I had hoped. I even gave him the offer that I'll stay if it was split 70/30, but he said no. He's even taking it another step by only allowing me to access the Internet for school now.

<comment><USER2> Heh. Wait until you're a parent before you think you understand the situation.

Internet privileges are removed by parents because they see their kids flaking off and not getting stuff done. Not because they are mean.

It is a giant thankless pain in the ass to have teenagers. And it is the best thing in the world. I had dinner tonight with my three and almost shed a tear in the restaurant from happiness. And I have a flakey kid -- much like you I suspect. :-)

Good luck, buddy. It is a long and wonderful life. Treasure these lessons, as puzzled as you are right now. You are only puzzled because you misinterpret reality. That will change.

</comment></comment></comment><comment><USER3> I would have given a lot for the opportunity you've been given. To have no bills, no worries, no responsibilities AND have the time to learn! I beg you to reconsider. If you haven't made any money yet then there is no reason to start a company. A company is a response to an income problem. You don't have that problem yet so let it go.

Make some apps, as many as you can. keep them small. Don't bite off more than you can chew. Get feedback on everything you do. Get feedback on what you plan to do. The skill you are trying to learn is to really understand what people want and then turn that into an app that speaks to their needs.

Please please please reconsider! I wish you all the best.

<comment><AUTHOR> The thing is, it wasn't going anywhere. I couldn't make any apps that costs money (since I needed to make the company first to get an EIN).

<comment><USER4> What do you need an EIN for? Is this an app store thing? In most cases your SSN serves as an EIN. If you really need an EIN, you don't need an LLC for that. [http://www.nolo.com/legal-encyclopedia/when-does-sole- propri...](http://www.nolo.com/legal-encyclopedia/when-does-sole-proprietor- need-ein.html)

<comment><AUTHOR> I can't, because I'm not 18. And he doesn't want to use his.

<comment><USER4> Where'd you hear that there's an age limit on applying for an EIN? And you didn't say why you need one.

<comment><AUTHOR> I tried using my own SSN, but they said I wasn't old enough. You have to send in that info for tax forms and such.

</comment></comment></comment></comment></comment></comment><comment><USER5> Hmm, difficult situation. Your father didn't keep his end of the bargain. I agree that you can't just let that go; a deal is a deal.

Sounds like firing him and moving on is the right thing to do.</comment>


Deep Learning is Revolutionary - <AUTHOR> https://medium.com/@olivercameron/deep-learning-is-revolutionary-d0f3667bafa0#.lp887f8kq <comment><USER2> I'm most impressed with the sharpening of images.

</comment><comment><USER3> Not sure how to delete mine. I shared your's link on Udacity SDC slack</comment>


You're tired because your lizard brain knows that Zoom meetings aren't natural - <AUTHOR> https://www.hanselman.com/blog/YoureTiredBecauseYourLizardBrainKnowsThatZoomMeetingsArentNatural.aspx <comment><USER2> Personally, I think a lot of people not used to long meetings are now forced to participate in them. I don't think it's any 'worse' then in-person meetings, it just people are suddenly having to attend meetings everyday. Previously, those same people might have had 1 or 2 meetings a week...

Btw - I don't own a web cam, and I use a wireless headset (2.5Ghz, over the ear). So I can be on meetings and go outside for a smoke, wander over to make coffee, etc. I find it really makes the daily 'status' meeting stuff a lot more bearable.

<comment><USER3> In face-to-face meetings, you can do the whole body language rapport physical communication thing that is completely lost in a screen wall of avatar-sized facial swatches.

<comment><USER2> >you can do the whole body language rapport physical communication thing that is completely lost in a screen wall of avatar-sized facial swatches.

I'm not sure I follow? Most meetings I've been to, everyone is sitting at a table, so you only see them from the chest up? I find online to be less stressful then in person. At the very least, you can mute your mike so you don't fart loudly in the middle of the meeting :-P

I think that suddenly having to be on your 'best behavior' or having to 'present to the group' everyday causes most of the stress people talk about. Speaking in front of groups seems to be a big one just by itself. Toss in the fear of doing something stupid and losing a job/customer/contract in the midst of a lousy economy and I could see it potentially being stressful.</comment></comment></comment>


China's Bold Push into Genetically Customized Animals - <AUTHOR> http://www.scientificamerican.com/article/china-s-bold-push-into-genetically-customized-animals/ <comment><USER2> Now that we have crispr:

China: the birthplace of the next eugenics revolution.

Mark my words.

<comment><USER3> A recent attempt by Chinese scientists to modify human embryos showed serious problems with that strategy. From the paper [1]:

"...the efficiency of homologous recombination directed repair...was low and the edited embryos were mosaic. Off-target cleavage was also apparent... Furthermore, the endogenous delta-globin gene (HBD), which is homologous to HBB, competed with exogenous donor oligos to act as the repair template, leading to untoward mutations. Our data also indicated that repair of the HBB locus in these embryos occurred preferentially through the non-crossover HDR pathway. Taken together, our work highlights the pressing need to further improve the fidelity and specificity of the CRISPR/Cas9 platform, a prerequisite for any clinical applications of CRSIPR/Cas9-mediated editing."

Maybe we'll find a system that's better or we'll modify Cas9 somehow to stop these off-target effects, but for now it's not really viable.

[1] [http://link.springer.com/article/10.1007%2Fs13238-015-0153-5](http://link.springer.com/article/10.1007%2Fs13238-015-0153-5)

</comment></comment><comment><USER4> My biggest fear for genetic engineering isn't the making of super soldiers via increases in strength, intelligence, and beauty. It's breeding well-behaved children. I think most parents want well-behaved children that listen to their parents. I also believe that many times society has leapt forward because of revolutions spurred on by deviants and trouble makers who were probably not model kids.

</comment><comment><USER5> This is one of several areas where scruples would put the West at a significant competitive disadvantage in the years to come. I'm not sure whether there's any palatable solution. Can we see to it that we do not become monsters in the process of fighting them? I have doubts.

I think concern for ethics in scientific research will fall by the wayside in the face of a serious challenge to the current distribution of global power. If the Chinese begin engineering genetically superior soldiers (assuming such a thing remains sensible in an era of drones and robotic ground forces), the West will do the same. What an unfortunate vision of the future.

<comment><USER6> Unfortunately, as the article states, China has these ethical issues too. When I hear all the fear mongering around these new technologies it just reminds me of puritans and witch burnings. There is so much potential here to make the world a better place, and we still let "fear of god" hold us back.

</comment></comment><comment><USER7> I think, It is good news for disease like Marfan syndrome.

</comment><comment><USER8> Splicing from Batman may one day be real...but in the process lots of things will probably go wrong when you try to play God.</comment>


Show HN: Engineered.At - Tech dev blog aggregator with an HN-style interface - <AUTHOR> https://engineered.at <comment><AUTHOR> I have a lot more to do on this but figured hey let's share it since it's online.

This is a feed aggregator of about 500+ blogs that are pulled in automatically and fed through an HN/Reddit style interface.

Was a fun little thing to build with Rails. Nothing fancy, just using Turbolinks and Rails SJR for some ajax stuff.

Please submit your blog if you have one!</comment>


Building mindfulness into the Asana culture - <AUTHOR> https://medium.com/@moskov/mindful-sana-e5932912d1df <comment><USER3> The term "co-creator" (at the end of the article) jumped out to me as an ideal way to treat all employees of a company. If everyone's ideas about company processes are valued and integrated, that creates an atmosphere of respect and allows everyone to invest in the success of the processes. Sounds like a great work environment.

<comment><USER4> Does that mean everyone gets stock?

Ah. Thought not.

I have no issue with meditation or mindfulness.

I have huge issues with trying to combine them with for-profit strive-and- drive hit-the-goals success culture. To me, that's a contradictory and frankly crazy-making combination.

The last time I saw something similar was when Lululemon tried to make yoga- culture and positivity obligatory. That was not so successful at making employees treat each other well:

[http://www.huffingtonpost.com/stewart-j-lawrence/when- yogis-...](http://www.huffingtonpost.com/stewart-j-lawrence/when-yogis-kill- the-grisl_b_1077457.html)

I don't doubt Asana is a cool place to work. But I don't think it's necessary to use jargon from other cultures and spiritual traditions to make people happy and get stuff done.

I find the approach culty and creepy, and unless rewards are being distributed with the workload, I also question whether it's fully informed at best - <USER2> entirely sincere, at worst.

<comment><USER3> Not sure how mindfulness and "strive-and-drive" are incompatible/contradictory. Isn't one of the goals of mindfulness to take time to ensure everything is working as efficiently as possible? And I feel rewarded when I impact work processes, when I'm able to share my ideas and see them discussed and implemented. Monetary reward is not the only motivator or measure of fulfillment for people. (And I don't even work at Asana)

Also the lululemon piece seemed to be about the company creating a marketing campaign with whatever made-up version of yoga most improved sales, which seems far from the internal practices that are discussed in this article.

</comment></comment></comment><comment><USER5> For those interested in mindfulness, I recommend the book Search Inside Yourself. It's based on the course at Google by the same name, as mentioned in the article. It's an easy read and I found it actionable in everyday life.

</comment><comment><USER6> Really great read. Agree with almost everything written. The only part I'd find hard to implement would be the pre-meeting meditation... I've tried once to have a colleague, a certified Yoga instructor, to have short Yoga sessions in the morning with everyone, but it quickly became a joke, not a real thing.

<comment><AUTHOR> That specific point was about Google. At Asana, we offer 1:1 and group Yoga sessions, and some people get together to meditate. A lot of people take it quite seriously, but it's in no way pushed on anyone.

</comment></comment><comment><USER7> All the techniques in this article could have been discussed just as effectively without introducing an ambiguous and frankly suspicious term such as "mindfulness". Being open and honest about conflicts, facing uncomfortable facts, and allowing people to have a say in things could all be described simply as "good business" or "common sense". Relying on a buzzword such as "mindfulness" betrays a religious agenda.

<comment><USER8> How is "mindfulness" a religious term? When you're "mindful" of something, you're conscious or aware of it. It's in the dictionary. Seems like the perfect word for describing a process of greater awareness...and if that word also happens to be used in Buddhism and Yoga to _mean the same thing_ , well, that's hardly a coincidence, is it?

It's not as if they're talking about practicing Ganesh worship.

<comment><USER9> The word as used in the dictionary isn't religious, but 99% of the people are using with connotations of a sort of religious-mystical-woo.

(I refer just to the noun-form "mindfullness" and not all forms of the word, e.g. "to be mindful of [some specific thing]".)

Reading the article made "Asana" sound less like a business and more like a slightly creepy cult. Which, hey, if that helps them make money then more power to them, but they should be very careful that this kind of thing (meditating before meetings?) doesn't start turning into discriminatory hiring practices.

<comment><USER10> 99% might have connotations like that to it, but that doesn't prevent large healthcare groups etc. from using it. E.g. Kaiser Permanente offers courses in "Mindfulness Based Stress Reduction", and so there is plenty of non-religious training material available for mindfulness meditation.

Even some of the best introductory resources on mindfulness meditation from Buddhist sources are refreshingly free of "religious-mystical-woo", or careful to separate the woo from the practice. E.g. my of my two favourite introductory resources, one (Gil Fronsdal's podcasts "Introduction to Meditation") specifically jokes about "the 'B'-word" and mentions buddhism just barely for context, and the book Mindfulness in Plain English mentions Buddhist traditions only for historical context.

As an uncompromising atheist and skeptic, this is the reason I ended up with mindfulness meditation over alternatives.

<comment><USER11> The concept of a/theism might be orthogonal or irrelevant, depending on the viewpoint, to Buddhism.

By the way "uncompromising atheist and sceptic" sounds like a contradiction, at least in the sense of _scepticism_ as the discipline of always questioning things (in general, not specifically when it comes to things like Buddhism, which I won't give an opinion about whether it is worth to investigate or not). But I guess it isn't really a contradiction if it is _scepticism_ as in _close mindedness_. But it's good that you've found some material that caters to your specific sensibilities and cultural background.

</comment></comment></comment></comment></comment><comment><USER12> This probably explains why Asana has such a complex and convoluted (read: horrible) user experience. It sounds like it breeds a culture that is too afraid to upset other people, so bad ideas never get shot down.

I can't believe that a company that dog foods its own product to develop the product isn't easier to use. I know everyone has different styles of working and organizing data, but for me, Asana is so bad...</comment>


Does Electronic Brainstorming Work?  - <AUTHOR> http://blog.wikibrains.com/wordpress/index.php/does-brainstorming-work/ Many critics argue that brainstorming is counter-productive, but they've failed to consider possibilities of crowd-sourcing the creative process. <comment><USER2> Very cool. Lightnings and thunders.</comment>


Microsoft to 'warn' Windows 10 users not to install Chrome or Firefox - <AUTHOR> https://www.theverge.com/2018/9/12/17850146/microsoft-windows-10-chrome-firefox-warning <comment><USER2> 462 comments currently on the front paage: [https://news.ycombinator.com/item?id=17967243](https://news.ycombinator.com/item?id=17967243)

</comment><comment><USER3> I welcome this addition from Microsoft. I think nothing will push users toward Linux faster than annoying garbage like this.

<comment><USER4> Or to IE...?

Non-powerusers can't install linux. If they switch OS it will be to OS X

</comment></comment><comment><USER5> This is shocking.

So Microsoft is using their smart screen tools to recognise the exes and then warn you.

<comment><USER6> Not sure if you are joking but MS is tracking every _.exe you open.

Got to your account -> privacy -> download and you see all _.exe files you opened.

<comment><USER5> Yes. But the idea was that they use it for malware blocking. Not to try and stop you from using another web browser.

</comment></comment></comment><comment><USER7> Horrible!! They should just follow Apple and outright ban anything other than a wrapper around their own browser, like Apple does on iOS.

</comment><comment><USER8> It's Microsoft. They been doing this sort of thing for at least 25 years. They haven't changed, even if they've fooled some people. It's part of their DNA.

[https://en.wikipedia.org/wiki/AARD_code](https://en.wikipedia.org/wiki/AARD_code)

</comment><comment><USER9> Will this be in the real release? Looks like a anti-trust case for other browser vendors, like MS got fined for including IE with Win 98.

</comment><comment><USER10> I mean they already say your not secure if you don't use OneDrive. Nobody complained then - so why not further abuse "security" features.</comment>


Big Bang particle discovery closer : CERN - <AUTHOR> http://timesofindia.indiatimes.com/home/science/Big-Bang-particle-discovery-closer-Scientists/articleshow/14065674.cms <comment><USER2> Infinite redirect on this link... :(</comment>


On Grouponzi - <AUTHOR> http://parislemon.com/post/6187955938/on-grouponzi <comment><USER2> This may not apply to this market, but I think it's still insightful:

"Here's a model that we've had trouble with. Maybe you'll be able to figure it out better. Many markets get down to two or three big competitors—or five or six. And in some of those markets, nobody makes any money to speak of. But in others, everybody does very well.

Over the years, we've tried to figure out why the competition in some markets gets sort of rational from the investor's point of view so that the shareholders do well, and in other markets, there's destructive competition that destroys shareholder wealth.

If it's a pure commodity like airline seats, you can understand why no one makes any money. As we sit here, just think of what airlines have given to the world—safe travel, greater experience, time with your loved ones, you name it. Yet, the net amount of money that's been made by the shareholders of airlines since Kitty Hawk, is now a negative figure—a substantial negative figure. Competition was so intense that, once it was unleashed by deregulation, it ravaged shareholder wealth in the airline business.

Yet, in other fields—like cereals, for example—almost all the big boys make out. If you're some kind of a medium grade cereal maker, you might make 15% on your capital. And if you're really good, you might make 40%. But why are cereals so profitable—despite the fact that it looks to me like they're competing like crazy with promotions, coupons and everything else? I don't fully understand it.

Obviously, there's a brand identity factor in cereals that doesn't exist in airlines. That must be the main factor that accounts for it.

And maybe the cereal makers by and large have learned to be less crazy about fighting for market share—because if you get even one person who's hell-bent on gaining market share.... For example, if I were Kellogg and I decided that I had to have 60% of the market, I think I could take most of the profit out of cereals. I'd ruin Kellogg in the process. But I think I could do it.

In some businesses, the participants behave like a demented Kellogg. In other businesses, they don't. Unfortunately, I do not have a perfect model for predicting how that's going to happen.

For example, if you look around at bottler markets, you'll find many markets where bottlers of Pepsi and Coke both make a lot of money and many others where they destroy most of the profitability of the two franchises. That must get down to the peculiarities of individual adjustment to market capitalism. I think you'd have to know the people involved to fully understand what was happening."

-Charlie Munger

<http://ycombinator.com/munger.html>

<comment><USER3> I think it all comes down to how effectively branding and marketing have destroyed the EMH. Airplane tickets are fungible they're easy to compare on price. They're also expensive enough that people take the time to shop around. However because of the regulators no brand of airline is unsafe.

Buying an expensive branded cereal is probably not a completely rational action IF you could identify equally good no-brand cereals you'd save money. But certainly in the west the cost is such a small part of most peoples spending that they don't bother.

</comment></comment><comment><USER4> _Yes, the amount of money they're spending on customer acquisition and retention is absolutely insane. (And the amount owed to merchants is especially troubling.) But look at what they're up against. Pretty much single major player is now coming directly at them — including the company that tried to buy them for several billion and was turned down, Google.

Facebook is charging fast too. LivingSocial. Etc.

They need to get out in front of this. And that's what they're trying to do._

If your explanation for why they are losing money is that they're _doing what needs to be done_ then that's fine, but you're forfeiting the 'defensible moat' argument. They're losing money because a bunch of established businesses could come in and take over if they don't. That part doesn't make them a ponzi scheme but it does make it a bad business to be in.

The part that makes it a ponzi scheme is that they are now seeking more investors even though the vast majority of the money from the last few rounds went to earlier investors. That's pretty much the dictionary definition of a ponzi scheme:

 _A Ponzi scheme is a fraudulent investment operation that pays returns to separate investors, not from any actual profit earned by the organization, but from their own money or money paid by subsequent investors_ <http://en.wikipedia.org/wiki/Ponzi_scheme>

There is nothing wrong with taking _some_ money off the table so the early investors/employees aren't operating under undue risk, but the scale of cash- out at Groupon is more than a bit fishy.

 _edit:_ As a side-note the actual original Ponzi scheme was supposed to be profitable through arbitrage of buying and selling Postal coupons: <http://en.wikipedia.org/wiki/International_reply_coupon>

<comment><USER5> "If your explanation for why they are losing money is that they're doing what needs to be done then that's fine, but you're forfeiting the 'defensible moat' argument. They're losing money because a bunch of established businesses could come in and take over if they don't."

It's not one argument or the other - that's a false dichotomy. It could be that, _right now_ they're still vulnerable, but are doing what needs to be done to build their "defensible moat".

And in fact, this makes perfect sense. They're a _very_ young business, they're spending a lot of money building their economic fortress. The fact that they aren't profitable is surprising, but for such a young company not _too_ surprising.

"There is nothing wrong with taking some money off the table so the early investors/employees aren't operating under undue risk, but the scale of cash- out at Groupon is more than a bit fishy."

I agree, but I'm not sure I get this argument. Isn't this something that the investors decide? I mean, it's not like the founders were duping anyone. They went up to some VCs, asked them to buy a big portion of their shares, and the VCs agreed (after thoroughly looking at the numbers, I might add). The investors seemed fine with it and considered it a good investment nonetheless, so what does it prove? Nobody was duped here.

I think the only difference between what's happening now with Groupon and what usually happens with small startups is the scale of money involved. Groupon is similar to other young companies, but a lot more money happens to be involved.

<comment><USER4> _They're a very young business, they're spending a lot of money building their economic fortress. The fact that they aren't profitable is surprising, but for such a young company not too surprising._

Ok, I'll give you that. _Maybe_ this is money well spent. I think you will see arguments both way on this one. I personally don't think it is.

 _Isn't this something that the investors decide? I mean, it's not like the founders were duping anyone._

Even if you tell the public, "Full disclosure: I'm running a ponzi scheme, you want in?" it's still illegal.

The scale of money is disconcerting but the actual behavior that is being rewarded is what concerns me. If fully appreciate that I might be wrong here, but I need to hear a better explanation of why I'm wrong.

<comment><USER5> I'll be honest, I'm probably much less qualified than you to say whether their money is being well spent. I'm just betting that the investors, who _are_ pretty savvy, _do_ know whether their financials are good. Of course, you're suggesting that the investors are in this because they believe future investors will pay them back, and so on, but I think the people investing in Groupon are doing so for solid reasons.

'Even if you tell the public, "Full disclosure: I'm running a ponzi scheme, you want in?" it's still illegal.'

Someone mentioned in another comment that a Ponzi scheme, by definition, means that people don't know it's a ponzi scheme. The commenter contrasted this to a pyramid scheme, where everyone can know. Is that true?

In any case, I thought it worthwhile to copy this form Wikipedia:

"A bubble: A bubble is similar to a Ponzi scheme in that one participant gets paid by contributions from a subsequent participant (until inevitable collapse), but it is not the same as a Ponzi scheme. A bubble involves ever- rising prices in an open market (for example stock, housing, or tulip bulbs) where prices rise because buyers bid more because prices are rising. Bubbles are often said to be based on the "greater fool" theory. As with the Ponzi scheme, the price exceeds the intrinsic value of the item, but unlike the Ponzi scheme, there is no person misrepresenting the intrinsic value. With the greater fool theory in mind, some may invest even though they believe the securities are overpriced due to a bubble."

In other words, the only thing that really changes between a Ponzi/Pyramid scheme and a bubble, is that investors think there is actually something of value underlying the investments. Obviously, many people disagree, but I'm not sure that we shouldn't give savvy investors the benefit of the doubt. Especially investors who have a lot more access to proprietary information, and who have had a lot more time to look over Groupon's terms.

* Note: I wrote a lot of things about the definition of a Ponzi scheme which are probably obvious to you. But I'm just now, with all this talk, starting to dig into what these mean exactly, so all of this is new to me.

<comment><USER4> _I'm just betting that the investors, who are pretty savvy, do know whether their financials are good._

You should probably stay far away from Wall St for your own good. The savviness of the investors should be a warning sign, not one that instills trust. Remember, in an IPO, they are the ones on the other side of the handshake. They have every incentive to fool you.

As for your other points. A ponzi scheme is like Bernie Madoff where you pay off early investors with the money from later investors. I don't believe being open with how the money works would change that. Pyramids are usually where members are pressured to get even more members because a percentage of the new hires' sales goes to the person who brought them in. The bottom of the pyramid cannot get their investment back because they run out of "greater fools". It's all a bit confused because if you buy into Groupon you also get ownership of a business which may or may not be worth something.

We really can argue about the semantics of these labels but really what it comes down to for me are these two questions: Is this a healthy business, and have the founders acted in the best interest of the business? To me the answers are I don't think so and absolutely not. I don't trust an executive team that would allow 90% of a non-profitable company's runway to go into their own pocket with my money.

They've acted in their own self interest to which many would say "whatever, it was a fair trade". I want people the people who think that way to realize that sometimes we restrict trades that are "fair" regardless of how stupid you are for getting into them. Roulette is a losing game but it is a fair game. We also restrict and regulate it heavily.

Anyway, I think we're in agreement on this: it's really interesting to talk about. :-)

</comment></comment></comment></comment></comment><comment><USER6> Some thoughts on this:

A. Spending on customer acquisition is building real barriers to entry.

I tend to agree with DHH that the barriers to entry will never be high enough in the daily deal area. Also, as Groupon seeks to stay ahead of daily deal competitors, it cannibalizes its own business model – namely, the artificial scarcity and urgency of daily bargains reverts to more and more on-demand variety. We see this already.

B. Spending on direct sales is building a valuable collection of local merchants.

Others have built directories of local businesses before. The Yellow Pages, Yahoo are examples. Yelp, etc. are more modern examples. Can Groupon unlock a profitable business model from their collection?

C. Spending on marketing is building enough public goodwill to transcend value propositions altogether.

Groupon is a great brand name, so far. Public goodwill is damn fickle, though. I'd like to think that consumers require a real value proposition from their favorite brands, but I'm not sure that they always do.

When it comes to daily deals, I doubt consumers will chose Groupon over a better deal, just because of the Groupon name.

<comment><USER7> _When it comes to daily deals, I doubt consumers will chose Groupon over a better deal, just because of the Groupon name._

On this count, it's worth remembering that extreme bargain hunters have very low loyalty to vendors. It's what allows them to take advantage of the best deals. Which is why I think a lot of businesses have been disappointed in the results from Groupon deals, and why the moat around Groupon is pretty shallow, given how much they've spent.

<comment><USER8> Eh. How much Groupon disappointment do you think comes instead from brick & mortar small businesses being utterly unacquainted with the high-volume low- conversion sales model of the web? Because that seems like the thesis behind Groupon: give local biz a taste of how customer acquisition is tuned and scaled on the web.

I'm a loyal customer of several well-known, well-regarded small businesses in Chicago, and _none_ of them have the marketing savvy of the least-successful successful web startup we can think of.

So in that regard, I think the people who worry about the disloyal deal hunters miss the point a bit. That's the flip side of the 5-10% conversion rate: the 90% who bounce. Web people don't flip out about this. Local biz does.

Remember, the most popular current alternative to Groupon is advertising. The only reason local biz people don't flip out over advertising effectiveness is that nobody knows how to figure it out.

</comment></comment></comment><comment><USER9> I don't see Groupon, or any of the clones as a good investment, for a very simple reason: there's no network effect. In the social realm, thats really the key. Social networks like LinkedIn, FaceBook and Twitter increase their value with each additional user. Telephones are also a classic example of the network effect. Groupon does not become more useful to me the more users it has. Possibly, it becomes more useful to merchants but from the merchant's I've discussed this with, other sites simply offer them better terms and, therefore, more profit.

Personally, I think sunchild had a great point by addressing that the artificial scarcity is gone. Myself, and my peers, have now reverted to buying these deals on-demand. If I want a massage deal, I head over to YipIt (an aggregator) and do a quick search. I don't waste my time reading their emails.

SwellJoe and GentleBen also addressed the same issue: lack of loyalty. My biggest complaint as a person on constant data overload is that Groupon (I use the Android app) now sends me over a dozen deals per day, half of them for suburban restaurants which I would never patronize. Its no better than coupon books or every other "deal" marketing ploy now.

</comment><comment><USER10> I'm pretty sure there are "Groupon for X" companies in YC. So clearly people see that there is money to be made.

I'm not exactly sure why everyone is hating on Groupon. Why not hate on Zynga for coping other games? Why not hate on Linked In's 500 P/E IPO that has already lost 25% off it's high?

The daily deal marketplace may not end up being a winner-take all market. But will having the biggest subscriber list give Groupon an advantage? Once they flip the switch from growth mode to profit mode, who knows what might happen?

I assume the hate is mostly just misdirected jealousy because it seems "so obvious anyone could do it." But like Andrew Chen's recent post, it's not easy to build both your consumer side and your merchant side. Anecdotally, I've heard many of the top 10 deal sites have trouble lining up their next day's deal.

While the daily deal industry is far from perfect yet, Groupon certainly unlocked a space that a lot of people are jumping into. And I assume that someone will figure out how to do it right for both merchants and consumers in a profitable, sustainable way.

<comment><USER11> "Why not hate on Linked In's 500 P/E IPO that has already lost 25% off it's high?"

I assume the hate is partly financial advice of sorts, and there's no great need to harp on Linkedin after its stock goes down. Besides, there was hate on Linkedin just before and after the IPO.

</comment></comment><comment><USER12> I worry about Groupon but not for the reasons here. Regarding the financials, it could easily ratchet down acquisition and marketing spend and be very profitable. The barriers to entry arguments are very superficial. Sure, just programming a competing service and closing a few merchants is not that hard. But building an 8 figure mailing list is not easy. Finally, some suspected and I'm inclined to agree that the otherwise ridiculous payoff of early investors and employees might be explainable as necessary to turn down the Google offer.

My main concern about Groupon is the core proposition may not actually work in the long term. There are all sorts of problems with fatigue, inherently cheapskate customers, high rates of existing customers, worsening economics, etc.

</comment><comment><USER13> what justifies taking ~300 million off the table (and that's just 1 person) and then going back to ask for more a short time after? sounds like the investors were keen to exit and make their buck ASAP. i don't think that is a good sign in general. andrew mason took a much more reasonable payday.

</comment><comment><USER14> Does anyone here have any loyalty to one group-based buying service over another? I certainly don't.

</comment><comment><USER15> In reference to this part:

"Yes, the amount of money they're spending on customer acquisition and retention is absolutely insane. (And the amount owed to merchants is especially troubling.) But look at what they're up against. Pretty much single major player is now coming directly at them — including the company that tried to buy them for several billion and was turned down, Google."

Wouldn't a proper business model dictate just about the opposite? When trying to build a profitable customer base, you should focus on keeping customer acquisition costs DOWN, not spending 3x revenue on it. For example, Super Bowl ads just don't seem like an appropriate way to spend money for them right now.

This is nearly identical to what happened in the last dot com crash. Sure, Groupon does have significant revenues, but they haven't proved (to me anyway) that these revenues are sustainable without their massive expenditures.

We've heard numerous times that Groupon considers its sales force to be a major asset, partially justifying its valuation and forthcoming IPO. Maybe. However, unless that sales force proves to be a strategic asset to a customer- facing feature, whether it be cheaper or more interesting deals than the competition, I don't see a multi-billion dollar value there.

</comment><comment><USER16> "You cannot overlook the fact that they're also making hundreds of millions of dollars each quarter now"

I don't understand this "oh but they're making $4 billion so they must be a great company!" argument. If my business plan is to pay people $2 and have them give me $1 back, I could also make $4 billion (and I'd be loosing $4 billion in the process, but that's just "marketing expenses"…).

<comment><USER17> It's not the usual use of the term "making money" in business, either. If you run a restaurant that has $5m in expenses, and $5.5m in revenues, you're making $500k, not $5.5m.

</comment></comment><comment><USER18> I just feel as if the only justification for this new round of founding MG brings to the table, is that a) they will be able to cut back spending (=profit) and b) Google and Facebook are producing similar products, so it must be something good. Personally, I'm convinced by neither arguments and would argue that it isn't just risky, but pretty much doomed to fail (or rather, be a really bad investment for the public).

</comment><comment><USER19> Google doesn't offer to buy Ponzi schemes for six billion dollars.

<comment><USER20> I suspect Google was looking at the possibility of modifying it to fit in with their advertising business. I can envision several ways that could have worked out.

<comment><USER8> That's a little weasely, because the people calling Groupon a Ponzi scheme tend to talk about how minimal their competitive advantage and technological "moat" is. Google can build stuff. Why'd they try to buy this?

<comment><USER21> It wouldn't be right to assume that because Google has many smart people, everything they do as a result is smart. Google is hardly an innovative company anymore. In fact, they seem mostly to be coasting on existing models and paying lots of people mostly just so that they don't work for existing and potential competitors.

<comment><USER8> I think this is a fallacy stemming from the fact that Google's initial products were _so unbelievably successful and important_ that they are likely to be permanently hard to top. I do not agree with you that Google is no longer innovative, and I particularly disagree with the notion that they are so uninnovative that they'd believe they lack the technological prowess to compete with Groupon.

<comment><USER21> Oh, I don't mean to suggest that at all. I'm just trying to suggest that an offer from Google doesn't, to me, at present imply that the offeree has any special merit. Google is cash-rich and can use cash strategically.

</comment></comment></comment></comment></comment></comment><comment><USER22> The fact that there are so many clones isn't proof that Groupon's business model works, it's just proof that there are no barriers to entry. Compared to Google and Facebook, their mailing list isn't much to brag about either. If they had impressive churn rates, you can bet we'd be hearing all about it by now. The fact that they keep those numbers secret is highly suspect, in my opinion.

Also, paying hundreds of millions out to early investors is exactly what they should NOT be doing if they're trying to "get ahead" of their competition. If they had any faith in their own business model, they'd put it into the business and expect even higher returns.

<comment><USER23> I agree with most of what you said, but it's not highly suspect to want to keep something as vital as churn rate secret from your competitors.</comment></comment>


YTRCP – The Necessary Toolkit for Content Creators on YouTube - <AUTHOR> https://www.producthunt.com/posts/ytrcp <comment><USER2> Like this! I use to be pretty big into YT creation (made over 100 vlogs), but I never quite found a tool like this to use. You clearly know your audience, because I found these two things incredibly helpful as a YT creator: [https://www.youtube.com/user/chrisjohnsonct](https://www.youtube.com/user/chrisjohnsonct) (social proof of who I am)

First of all, I LOVE the thumbnail explorer! Often, you create a thumbnail on your computer and then have to export it to your phone to put it on Instagram, or other purely mobile sites, for marketing and promotion, but with thumbnail explorer, I can easily grab any of my videos thumbnails without access to my computer!

I thoroughly tested the random comment picker, works like a charm... Always wondered how people picked comments. This lifts all the emotional weight of picking someone in your audience.

Seriously, this site is fast as hell!</comment>


Show HN: Baby Name Together – Find easily the name of your baby - <AUTHOR> http://www.linkinet.eu/app/

<comment><AUTHOR> We started a Headtalker campaign. It would be awesome if you can share it. Thanks for your support ! [http://goo.gl/GdEI3M](http://goo.gl/GdEI3M)

</comment><comment><AUTHOR> Thanks ! My wife was pregnant last year and we were never agree on any name. That's why I created this app and in 20 minutes we were agree for a name :) Hope it will help other parents !

</comment><comment><USER2> This was kind of depressing all those fucking names and my fiance and I couldn't find one in common.

Other than that, I think it's an awesome idea.

</comment><comment><USER3> Cool idea! It has always been the cause of war in the family...</comment>


Ask HN: Which newsletters are you subscribed to? - <AUTHOR>

Here are the ones I am subscribed to: Benedict Evans Dan Hon Alexis Madrigal Roo Reynolds<p>Am I missing something out? <comment><USER2> Have you checked out the following ones?

[http://www.pythonweekly.com/](http://www.pythonweekly.com/)

[http://www.nosqlweekly.com/](http://www.nosqlweekly.com/)

[http://www.founderweekly.com/](http://www.founderweekly.com/)

[http://www.raspiweekly.com/](http://www.raspiweekly.com/)

Disclaimer: I am the curator.

</comment><comment><USER3> I've subscribed to some of the newsletters curated by Peter Cooper a few months ago. I find the articles to be much higher quality than the average blog post.

[http://rubyweekly.com/](http://rubyweekly.com/) [http://javascriptweekly.com/](http://javascriptweekly.com/) [http://html5weekly.com/](http://html5weekly.com/)

</comment><comment><USER4> For me, [http://piweekly.net](http://piweekly.net), [http://embedsysweekly.com](http://embedsysweekly.com) and of course [http://llvmweekly.org](http://llvmweekly.org) (which I author).

</comment><comment><USER5> These Python-oriented newsletters are like a goodie bag in my inbox every week:

[http://www.pythonweekly.com](http://www.pythonweekly.com)

[http://pycoders.com](http://pycoders.com)

</comment><comment><USER6> I miss NTK and it'd be great if there was a modern version of it.

[http://www.ntk.net/](http://www.ntk.net/)

</comment><comment><USER7> None. Why should I? Rather I like bookmarking useful sources</comment>


Ask HN: What are some things we could build to make housing more affordable? - <AUTHOR> <comment><USER2> A platform that allows a person's employer to assist them with obtaining a mortgage. For example streamlining the application process, loaning deposits, repayments directly from salary and subsidising repayments.

Its a good employee retention tool for an established company and presumably having the company in the mix reduces risk of non-repayment and can lead to better deals on the interest.

</comment><comment><USER3> Profitable industries in rust belt cities where housing is cheap but unemployment is too high.

</comment><comment><USER4> Smaller homes. Seems like you can buy a tiny home, or a mcmansion and nothing in between. 600-800 sq ft home on a regular foundation would be a good start.</comment>


Announcing Flutter Release Preview 1 - <AUTHOR> https://medium.com/flutter-io/flutter-release-preview-1-943a9b6ee65a <comment><USER2> I've been using Flutter for a few months now, and have not felt this productive in years. Being able to iterate so quickly on real or virtual devices has changed how I design and development a UI. I can set out with a mock-up and almost immediately start to feel why it isn't perfect and just use it until the feel is right. The productivity bonuses are sometimes hard to explain to people who haven't yet tried Flutter and it's tooling.

This announcement of preview 1 is coming at a great time as I am launching my first app on iOS and Android next week.

<comment><USER3> Dart is by far the most productive cross-platform web technology I've ever worked with. We got the same (quite complex due to the domain requirements) core codebase for web client, IOS, Android, and on the server side is well. Had we chosen to go with the more traditional combination, the effort to keep everything in sync would rise exponentially with the complexity of the project.

<comment><USER4> What frameworks are you using for the web client and the server?

<comment><USER3> Web client: our own mini-framework developed on top of dart:html (we needed maximum flexibility there, for simpler UI we could have used an existing framework)

Server: shelf

</comment></comment></comment></comment><comment><USER5> Unfortunately, I kind of feel torn: On one hand, I love flutter as a concept[1]. It removes a lot of the baroque from mobile development (no need for the whole RecyclerViewer construction for every list! No Fragments! Doesn't require Android Studio to start working!) but I hate the language (dart). After using Kotlin (let alone Rust), It feels like moving back to Java (no non-nullable types) and in some ways it's actually worse than Java (threads are extremely heavy weight, every interaction with native code is async and slow).

I wish there was:

1\. A good Kotlin language server (unlikely, as the company behind the language is an IDE company).

2\. A good reactive Kotlin GUI library (meaning, with the ergonomics of Flutter (as in, I don't have to work with Fragments and their lifecycles, just use views)).

3\. A good JVM interpreter (to speed up Kotlin/Java compilation)

[1]. No I don't use Flutter to "write two apps for the price of one", as most (of my) apps are just a front-end over a back-end server, so they don't have any special logic worth saving between iOS and Android. I just find Flutter easier to work with relative to Android.

<comment><USER6> I'm on the Dart team (though I wouldn't necessarily take my comment to be an official statement of the entire team).

 _> (no non-nullable types)_

I really wanted [1] to get those into Dart 1 (way back before Swift and TypeScript even existed), but I couldn't convince language team at the time that it was worthwhile.

When we moved to a stricter, sound type system with strong mode, we hoped to get non-nullable types into that and ship them with Dart 2. But, as you can imagine, migrating millions of lines of code from an optionally typed, unsound type system to a sound, reified static type system is a hell of a lot of work. (I'm not aware of any cases where it's been done at this scale.)

We weren't able to fit non-nullable types into that schedule and into our users' migration pain tolerance. There is only so much you can drag them through, and just getting to strong mode was a lot.

There is still a desire to bring non-nullable types to Dart. It probably won't be soon because we want to give our users a break from migration, and give our implementation teams time to take advantage of the new type system. But I haven't given up on them, and our team's new focus on static ahead-of-time compilation makes them more important than ever.

I agree that Kotlin is a really nice language. I hope we can catch up to them with Dart and exceed them in areas.

[1]: [http://journal.stuffwithstuff.com/2011/10/29/a-proposal- for-...](http://journal.stuffwithstuff.com/2011/10/29/a-proposal-for-null- safety-in-dart/)

<comment><USER5> The thing is that the longer you wait, the harder it will be to migrate, as the codebase size grows (and once you leave beta, people assume that the language is finalized and won't be too happy being forced to refactor their code when Dart 3 comes out). But as it is, I doubt that the nice parts of Kotlin will ever make it to Dart.

<comment><USER7> Yes, it's really sad that a language as young as Dart already has such problems :/

<comment><USER5> It's because the language was made to compile to JS, and competition to JS, so appropriate tradeoffs were made.

For example:

1\. JS is single-threaded, with extremely heavy threads only recently made available. So Dart is single threaded, with extremely heavy threads available.

2\. JS is weak-typed, so Dart was made optional typed. Remember, it was made before typescript, so they probably didn't expect that such type-heavy features as ADT would interest people.

Kotlin does the same (for example, internal immutability would be much nicer, but since the JVM doesn't support that, neither does Kotlin).

</comment></comment></comment></comment></comment><comment><USER8> This release follows Airbnb posts describing their deep experience in React Native and why they ended up abandoning it: [https://medium.com/airbnb- engineering/sunsetting-react-nativ...](https://medium.com/airbnb- engineering/sunsetting-react-native-1868ba28e30a)

Based on the issues they've had with React Native [1] I believe they would've had a better experience with Dart and Flutter which also has a fast iterative dev experience with a productive language that lets you build both iOS and Android Apps from a single code-base. But in contrast to RN, Dart 2 is statically typed and AOT compiled into native ARM which enables better performance and doesn't have any of the JS VM issues Airbnb kept running into. I also prefer Flutter's x-plat approach of drawing all their widgets with Skia as it also mitigates the UI widget inconsistencies they would've had if they tried to wrap native widgets. Flutter widgets follow Material design by default but can also be themed to look like native iOS widgets ([https://flutter.io/widgets/cupertino/](https://flutter.io/widgets/cupertino/)).

React Native nails the development experience but is plagued with issues which isn't clear if it's because it's architecturally flawed or that it's just poorly resourced and Facebook only cares about resolving their own issues.

I've been burnt by the lack of support in React Native indiscriminately closing issues, which stopped me from wasting my time reporting any more issues and eventually stopped using React Native altogether.

I've been pleasantly surprised by Flutter, it does what it says on the tin, enables a productive dev environment for creating Native Apps from a single code-base and in contrast to my RN experience their support has been stellar, several team members responded to my queries immediately with solutions and workarounds.

The biggest issue I've run into coming from JS/RN is not being able to use reflection due to iOS's AOT restrictions for which you'll need to use code-gen to workaround. Also I prefer JSX for designing UIs, whilst Dart's object declarations enable a kind of code DSL it's not as composable as using a declarative XML markup where you can freely move widgets around to design UIs. Ultimately I hope they provide a similar language feature for using an XML- like markup as an alternative for (and just transpiles to) object declarations.

      [1] https://medium.com/airbnb-engineering/react-native-at-airbnb-the-technology-dafd0b43838#4b2b

<comment><USER9> > Facebook only cares about resolving their own issues

One could argue that Google suffers from this weakness as well.

<comment><USER8> Hasn't been my experience with Flutter, it looks like a well resourced project with a very talented team who are committed at building a high-quality and productive tool for developing Mobile Apps and are actively supporting their existing user base.

React Native feels like an in-house development project they've open sourced but don't have the resources to resolve external issues so they've instituted a policy of routinely indiscriminately closing and signalling their intentions to never fix them and by extension removing any visibility of which issues still exist and from anyone else being able to resolve them either. They've done this for 1000's of issues - not going to invest in a platform plagued with issues that stands no chance of being resolved.

<comment> nevi-me I think proactivity and a knowing a good platform to ask questions in, helps. For some of us, the difficulty is often whether to ask on StackOverflow or to open a bug on Github.

An overflow of Github issues can lead to some issues going unnoticed (depending on whether issues are regularly triaged by a team).

For example, I have a Flutter Android app that has an infinite notification loop bug [1]. I've struggled for many hours (spread over a few weekends) trying to figure out what was wrong. I eventually opened an issue on GH after giving up.

After a few days, I decided to post a question on SO, and someone from the Flutter team saw it. The issue might have gone unnoticed for a bit if I hadn't done so (especially given its obscurity). I believe so because popular projects on GH get a lot of issues, and yours might get buried if someone doesn't pick it up immediately.

The other thing is that when we open issues, and project maintainers try to work with us, we often delay in responding to them. That over time, leads to issue clutter, and probably developer fatigue.

So perhaps we can be better citizens by being more proactive, given that someone who's often paid a lot is taking time to help us with issues.

\---

I agree with your point on RN and in-house development.

[0] [https://play.google.com/store/apps/details?id=za.co.movingga...](https://play.google.com/store/apps/details?id=za.co.movinggauteng.mytrain) [1] [https://github.com/flutter/flutter/issues/18524](https://github.com/flutter/flutter/issues/18524)

<comment><USER8> I'm not referring to technical support questions, I'm referring to actual issues with verifiable repros which works everywhere else (inc. their debugger). They dismiss issues with core functionality like their W3C fetch API not being able to maintain long-running HTTP connections which breaks solutions relying on them like SSE [1]. They originally closed it making it known they have no intentions on ever fixing it and have since locked it preventing anyone else from being able to comment on it either.

RN enables a fast development model but you'll continually skate into an open mine field of issues where you'll end up wasting time on putting out fires and diagnosing issues only to discover they're known issues they have no intentions of fixing so you'll be spending time on implementing workarounds mitigating broken UX experiences in your App instead of focusing on delivering end-user value. Given the 1000's of issues that have received similar treatment I suspect React Native is just an architecturally flawed experiment and why we'll continue to see more users abandoning it. Hopefully they wont have wasted as much effort and resources as Airbnb's multi-year investment who despite having a large enough dev team to maintain their own fork was still unable to make RN work for them.

[1] [https://github.com/facebook/react- native/issues/12912](https://github.com/facebook/react-native/issues/12912)

</comment></comment></comment></comment></comment><comment><USER10> As someone who has spent some time inside the Windows 10 environment working on UWP applications, I always thought that Xamarin would someday be my goto whenever I have the opportunity to dive into Mobile development. I am comfortable with C# and I have always felt happy writing in XAML.

But looking into Flutter, I think it's undeniable how smart this project truly was. Even if it isn't backed by a popular programming language, since Dart obviously does not fall on that category.

<comment><USER11> Have you looked at Uno?

[http://platform.uno/](http://platform.uno/)

C# & XAML UWP layer with Xamarin for mobile. The company behind it has been using for a few years to produce apps and recently open sourced it. I'm intrigued and weighing it against Flutter for my next bit of mobile experimentations.

<comment><USER12> This thing seems to be a layered cake of leaky abstractions. Flutter is actually the opposite.

</comment></comment></comment><comment><USER13> I'd love to play with Flutter but issues like this keep me at arm's length. Hopefully when this kind of thing is finally resolved I'll be able to give it a closer look.

[https://github.com/flutter/flutter/issues/6827](https://github.com/flutter/flutter/issues/6827)

<comment><USER14> State restoration pretty damn important too. Say for example, the user goes into multi-window on Android. If they were doing anything important on the screen, that would just be wiped out.

<comment><USER15> While it's common to restart on all sorts of config changes like multiwindow or layout changes on Android, flutter specifically configures it's android activity to not restart. So going into multiwindow works just fine, and the framework handles redrawing and resizing.

</comment></comment></comment><comment><USER16> I've been using flutter now for a few months and I love the workflow I can get in, quickly iterating and seeing the changes immediately. A side effect of the hot reloading I found is that I am able to build quickly and not worry about the style until later because I know changing the style is relatively easy and quick to iterate on itself.

If you use VSCode, it really is a first class citizen, which makes me happy as I am most familiar with that editor.

Overall I haven't been this happy with development in a while.

<comment><USER17> Have you used RN?

</comment></comment><comment><USER18> Anyone else remembers the original Flutter app that lets you control music with hand gestures? Google bought them and only kept the name apperently.

[https://flutterapp.com](https://flutterapp.com)

</comment><comment><USER19> Dart's interesting enough if I can actually use it for both Fuchsia and Web [1], but I find the following statement misleading: "Dart's type system, like the type systems in Java and C#, is sound [2]." Java's type system is not sound [3], nor is C Octothorp's [4]. What gives?

[1] Though what happened with Chrome is a shame: [https://news.dartlang.org/2015/03/dart-for-entire- web.html](https://news.dartlang.org/2015/03/dart-for-entire-web.html)

[2] [https://www.dartlang.org/guides/language/sound-dart#what- is-...](https://www.dartlang.org/guides/language/sound-dart#what-is-soundness)

[3] [https://dev.to/rosstate/java-is-unsound-the-industry- perspec...](https://dev.to/rosstate/java-is-unsound-the-industry-perspective)

[4] [https://stackoverflow.com/a/23968075/775282](https://stackoverflow.com/a/23968075/775282)

</comment><comment><USER20> It might sound stupid, but I'd really like to see flutter for desktop as well. Web too, hell why not?

<comment><USER21> You may appreciate [https://github.com/google/flutter-desktop- embedding](https://github.com/google/flutter-desktop-embedding)

<comment><USER22> Or this: [https://github.com/google/flutter-desktop- embedding](https://github.com/google/flutter-desktop-embedding)

I'm also working on a similar project.

<comment><USER23> Not sure if you meant to, but you posted the same link.

<comment><USER22> Whoops sorry - I mistook the link for this one: [https://github.com/flutter/engine/wiki/Custom-Flutter- Engine...](https://github.com/flutter/engine/wiki/Custom-Flutter-Engine- Embedders)

</comment></comment></comment></comment></comment><comment><USER24> If they at least replaced _@Override_ with _override_ keyword, it is not like Dart had to deal with backwards compatibility of 5 language versions.

</comment><comment><USER25> Has anyone used both Flutter and NativeScript/React Native?

I'd be really curious to hear some experiences and why you prefer one over the other.

</comment><comment><USER26> I wonder what happened to Rikulo UI cross-platform framework for Dart: [http://rikulo.org](http://rikulo.org)

</comment><comment><USER27> I love Dart and used flutter for a few months but once I hit the lack of native support for maps, I had to switch to native iOS development. It was a great learning experience for prototyping quickly but hitting a wall with maps was not OK for any high fidelity app.

With Airbnb's announcement around React Native, I feel like native dev is still the way to go.

</comment><comment><USER28> So this is different from the Flutter product I backed on Kickstarter? Confusing...

[https://www.kickstarter.com/projects/flutterwireless/flutter...](https://www.kickstarter.com/projects/flutterwireless/flutter-20-wireless- arduino-with-half-mile-1km-ran)

</comment><comment><USER29> Is there anything that Dart does particularly well in a project like this that justifies its use over TypeScript?

<comment><USER30> Check out this blog post from earlier this year: [https://hackernoon.com/why- flutter-uses-dart-dd635a054ebf](https://hackernoon.com/why-flutter-uses-dart- dd635a054ebf)

</comment></comment><comment><USER31> Is it safe to say, they are probably ramping up the fuchsia development too?

</comment><comment><USER24> Just noticed that [https://flutterstudio.app/](https://flutterstudio.app/) only works properly on Chrome, what a surprise.

<comment><USER32> Works just fine in Safari and Firefox Nightly for me. Consider reporting your browser configuration to the author? [1]

[also notice that it is in no way affiliated with Flutter and done by somebody in the community]

[1] I can't find any way to contact the author, but here is his blog post about the Studio [https://medium.com/@pmutisya/flutter-studio- version-2-41cce1...](https://medium.com/@pmutisya/flutter-studio- version-2-41cce10fcf3d)

<comment><USER24> I tried, but won't bother with Medium subscription just to post a comment there.

Doesn't work on Edge or FF stable.</comment></comment></comment>


Router that anonymises Internet activity raises $300,000 on Kickstarter - <AUTHOR> http://www.theguardian.com/technology/2014/oct/14/anonabox-router-anonymous-kicktstarter-privacy-internet-activity

<comment><USER2> A compelling story, but kind of a crappy article. Is there better coverage somewhere?</comment>


2 steps to better API Error Codes - <AUTHOR> http://apiux.com/2013/03/28/2-steps-api-error-codes/

<comment><USER2> Here's the website I always refer to for http status codes httpstatus.es

<comment><AUTHOR> That's an interesting HTTP status codes cheat sheet.</comment></comment>


Two Billion Records Exposed in 'Smart Home' Breach - <AUTHOR> https://secalerts.co/article/two-billion-records-exposed-in-smart-home-breach/5e204721 <comment><USER2> (tech) people tend to laugh at me/pull the tinfoil hat card for putting my dlink/iot stuff behind a very restrictive, dedicated, iptables filtered, hostapd based custom network running on my pi zero w that isn't allowed to talk to the home network or internet at all.

As mentioned by others, I guess it really needs severe identity theft/abuse with vital services until people realize that today's IoT 'plug & play' is worse than than the level of 'plug & pray' we've seen in the early PCI/USB/Win98 era (that only impacted your local device functionality).

<comment><USER3> The first consumer router that supports a VLAN specifically designed for iot devices should sell well. Who will be first?

<comment><USER4> Why would regular VLAN support not work to secure or segregate IoT devices?

<comment><USER5> It would but most consumer devices don't support VLANs and if they did no consumer would know how to configure them.

If you do need low cost VLAN-capable gear I've had success with TP-Link switches and Mikrotik WiFi APs.

</comment></comment></comment></comment><comment><USER6> > a misconfigured and Internet-facing Elasticsearch database without a > password." If this wasn't bad enough, a Kibana web-based app, there to make > navigating through the data easier, had no password protection.

That's not even really 'exposed in breach', that's just 'exposed'.

<comment><USER7> If the Kibana app wasn't exposed I could surely host my own and connect it to the same exposed Elastic Search.

It's like saying "someone stole my keys ... and if that wasn't bad enough they got the key ring!"

<comment><USER6> I think in some sense having an admin interface exposed as well as the admin API is 'worse'.

I completely agree that it doesn't make it less secure, but it does make it more.. 'oh come on'. I mean, nobody who was using it legitimately realised?

</comment></comment></comment><comment><USER8> You know what they say: it's the 'S' in 'IoT' that stands for security.

<comment><USER9> this is simply server security... the application happens to be classed as IoT, but this is has nothing to do with the IoT aspects.

<comment><USER10> If the functionality of your home depends on a privately owned, 3rd-party server, then I'd say it very much highlights the potential risks of IoT devices / applications.

<comment><USER11> My electricity, gas, water etc all come from 3rd-party providers and work just fine. Probably because they're all heavily regulated.

(FWIW I don't have any IoT devices in my house)

<comment><USER10> They work just fine because you don't need to log in to your electricity meter to turn your lights on.

</comment></comment></comment></comment></comment><comment><USER12> IMHO more disturbing than the lack of security is the fact that people will willingly put these products in their house that phone home to a central database.

I'm not into the whole IoT thing but if I really had a need to control something from anywhere on the Internet, it would not rely on a centralised third-party service.

<comment><USER13> I will immediately tell my Mom to not rely on such services and install something else.

<comment><USER14> You mock, buy that's exactly what you should be doing; telling your mother she doesn't need an IoT toaster.

<comment><USER13> That's not the point I made to the statement he made so your comment has nothing to do with this.

</comment></comment></comment></comment><comment><USER15> >It's unknown if anyone has taken advantage of the vulnerability (yet) and, as of July 1, the database was still accessible with no password protection.

And this article had been published today... The database had been closed a day later on July 2.

Here the the original report instead of a Forbes article: [https://www.vpnmentor.com/blog/report-orvibo- leak/](https://www.vpnmentor.com/blog/report-orvibo-leak/)

<comment><USER16> It most certainly has been taken advantage of. Bots crawl the internet checking for services on default ports without a password.

I was an victim of this recently when I got reports that my web app was down and when I investigated it I saw there was a password on redis preventing the app from connecting. I then found out the redis docker container was accepting connections from the outer internet with no password and someone had connected in and set a password on it (Probably just to alert me to the fact it was exposed). Thankfully there was basically nothing in redis so no user data was exposed.

</comment></comment><comment><USER17> The Twitter account "internet of shit" tracks these sort of things.

Mark my words, eventually the world is going to see some sort of Fukushima scale internet of shit disaster caused by poor security/architecture. I'm not sure what form it will take, maybe mass pwnage of a device as commonplace as Amazon echo or Google home, but it will be bad.

<comment><USER18> Agreed. We're putting devices that needs to be highly secured, ideally network separated in the hands of normal people. People who either don't know that they should updated their routers, or simply don't care.

At the same time, IoT devices are being sold by companies who think that a 10 years support cycle is "a long time" and who frequently will drop support for devices when new models are released. The same companies often have terrible models for customer support.

I was at a presentation of Microsofts Azure Sphere OS. The presenter proudly proclaimed that they would have 10 year support cycle. Apparently I was the only one in the audience who felt that 10 years is at least 5 years short of what is needed.

<comment><USER16> 10 years is probably longer than most of these iot companies have been around. Most of these devices probably get 1 year updates max before support being dropped.

</comment></comment></comment><comment><USER19> They were trying to expose more than 2 billion records, but had to stop when the record count went to -2 billion.

</comment><comment><USER20> How do researchers just "come across" these massive data dumps

<comment><USER21> Brute force search and intuition for areas to target (eg. likely open ports, dictionary attacks)

<comment><USER22> Does brute forcing still work these days? I thought the wild-west free-for-all scanning days would have ended, as ISPs (or someone in the routing chain) would block such attempts? I haven't tried since the 90s because I'm slightly paranoid about being classified as an evil hacker. Somewhat relatedly, my bank recently wouldn't let me login (cryptic error message) because they started using a "trusted IP scanner service" in the UK which had marked me as a proxy, probably because I was running a Tor Relay last year. I had to send multiple unblock requests, all of which were denied with canned responses that no, they won't reclassify my IP. Only when I mentioned that I couldn't login to my bank account did they finally unblock me. Point of my story is that it sure feels like more gatekeepers are being implemented to stop "nefarious" operations.

<comment><USER21> The thing about standard practices is that they don't come as standard. For every 10 fort knox, there's at least one place with the side door left ajar. You only hear about those instances when a hack makes the news in a sort of reverse survivorship bias

<comment><USER22> So you're saying I could brute force scan IPs for vulnerabilities and won't have to worry about being denied access by e.g. my ISP, CloudFlare, AWS, etc?

<comment><USER21> There will be access denials, but don't use your laptop IP and change up when it becomes a blocker. IPv6 has so many anyway you won't run out

</comment></comment></comment></comment></comment></comment><comment><USER3> > The information in the database belonged to Orvibo

Would things meaningfully become more secure if we had a legal framework under which the information in the database belonged to each consumer? Or would a simple click-through license make that moot?

</comment><comment><USER23> Does anyone know a decent tutorial or explanation, how to "secure" one's network with IoT devices in it?

For instance, all my lights are controlled using IKEA's TRÅDFRI solution. Also, they are integrated into my own HomeAssistant instance (dockerized), which runs on my Unraid machine, which also hosts my data shares. Then we have FireTV's, Echo's, we have a Xiaomi vacuum robot, and so on. The FireTV should be able to access the data shares for playing back movies. Alexa can control our lights, too.

I'm still struggeling to find a "one size fits all" solution.

<comment><USER24> VLANs would help, but you need routers and switches, and APs that support that.

You would restrict/allow certain ports between VLANs, only allowing the port traffic you want.

<comment><USER25> And be careful with switches. You also (at least ideally) want switches which don't expose their own management interface to your isolated VLAN (usually this is called 'management VLAN' as a feature description). My experience is that of the consumer level 'Web managed' switches, only the dlink ones do this.

</comment></comment></comment><comment><USER26> Further details here:

[https://www.vpnmentor.com/blog/report-orvibo- leak/](https://www.vpnmentor.com/blog/report-orvibo-leak/)

Which was posted a few days ago.

</comment><comment><USER27> Correct me if I'm wrong but isn't vanilla Elasticsearch open and insecure by default? and password/token security features are only available in some paid tier?

</comment><comment><USER28> How significant is the "two billion records" figure? According to the article, the affected smart-home provider mereley "claims to have more than a million users around the world". So presumably this database contains a lot of redundant information?

<comment><USER9> each user has many records.... from the numbers, I'm guessing around 2000 each (probably light-on... light-off... light-on... light-off).

</comment></comment><comment><USER29> People need to stop exposing their Elasticsearch clusters and Kibana to the internet. A lot of these "breaches" lately have been because of this.

I hope Elastic makes it more difficult to make your cluster public by default in future versions.

</comment><comment><USER30> I have never setup Elasticsearch or Kibana mysslf, but is the setup process _secure-by-default_? i.e. generate a random password or key by default, and then you have to go out of your way to unsecure it?

<comment><USER31> I hope it has changed since I set up elasticsearch v5, which supports neither authentication nor TLS without plugins.

<comment><USER32> Nope it's very much still unsecure by default.

<comment><USER30> Then aren't those services/products partly to blame? There should be very few legitimate reasons to leave those things unsecured, no?

<comment><USER33> I'd be hard pressed for blaming them tbh. I think the reasoning is that these are internal services you should put behind whatever measures you have put in place anyway and not expose otherwise. While the previous comment is technically correct about being unsecure by default, they also don't listen to the outside world (see [1], network.host) by default. I've always thought that makes sense for elastic tbh, security isn't their core business so by leaving that part up to you they avoid screwing it up.

[1] [https://www.elastic.co/guide/en/elasticsearch/reference/curr...](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules- network.html)

<comment><USER11> The same could be said about MySQL - but even that switched to entering a root password and disallowing root login, as well as not binding to any network interfaces until explicitly configured to do so. Of course this can all be overridden with simple config changes but it's relatively "secure by default".

(just to pick an example I'm familiar with).

</comment></comment></comment></comment></comment></comment><comment><USER7> Eerie as I am working on an unsecured ES instance and then I see this. My one is just for playing though. No sensitive data there :-)

<comment><USER24> What is the IP address?

;)

<comment><USER7> 220.127.116.11 :-)

</comment></comment></comment><comment><USER34> I wonder what's the worst possible scenario, having access to your home security cameras or more like using the email and password.

<comment><USER35> Email access, people watching meh... I doubt they see something they don't do themselves, access to email however is way more information and a gateway to more (online) access (probably including gaining access to cams)

<comment><USER36> Are you actually serious? If so, can you please post some pictures of your genitalia and face here?

<comment><USER35> The question was which would be the worst scenario, I gave my personal opinion.

I did not explicitly say I would prefer neither to happen, but I wrongly assumed that would not be necessary to write, my apologies.</comment></comment></comment></comment>


An unfair head start for your React Native apps - <AUTHOR> https://shift.infinite.red/ignite-your-mobile-development-32417590ed3e <comment><USER2> \- Awesome</comment>