Where or when do you guys find your most genius idea(s) for your startup? - <AUTHOR>

Is it while browsing this forum? While attending a conference? While hiking in the morning? After you lost your job? You tell me! I'd love to hear some of your stories. <comment><USER2> After I'm frustrated, when the frustration is a result of a need that is badly served by the industry.

<comment><AUTHOR> Yes, I have that too, but most of the solutions I can come up with are either too hard to realize or basically unrealistic :)

<comment><USER2> What is hard to realize for you ?</comment></comment></comment>


Common Bash Pitfalls - <AUTHOR> http://mywiki.wooledge.org/BashPitfalls

<comment><USER2> It's the problem of nested DSLs (sed, tr, globing, bash's own control commands etc): you need to quote (escape) each DSL's meta-characters like crazy.

It's a scary, horrific nightmare. Sure, you can learn all the intricacies, but what a waste of your cognition! There must be a way to do it with clean abstractions (assuming the unrealistic liberty to redesign all unix commands). But... I have a suspicion that the horror is intrinsic to the problem, and bash strikes a legitimate trade-off between brevity and safety. It would take some work to be sure about this.

<comment><USER3> Based on no evidence whatsoever, my gut tells me that trying to set up a tidy system of abstractions to clean up the problem would produce something closer to a programming language than a shell language. On the other hand, it's possible that exposure to *nix has simply impoverished my imagination when it comes to things like this.

</comment></comment><comment><USER4> The quoting rules in the Plan 9 shell rc are much saner. Bourne and C shell quoting rules are a recipe for trouble. Sloppiness (e.g. leaving out quotes, using the wrong kind of quotes) works about 99% of the time which leads you to think your code is correct.

The big difference is that rc does not expand the result of variable expansion. I've been planning to write a rc derivative that had job control for a long time now. So far, I've never had enough spare time.

</comment><comment><USER5> Is Bash scripting still relevant today, other than working with and understanding legacy code? Why wouldn't I use something like Python or even Perl instead?

<comment><USER6> Shell scripting is as relevant as it ever was.

Python or perl scripts are fine if you are doing more complex and "algorithmic" stuff, but for automating system administration tasks, I often find that shell scripts are simpler and more concise.

But shell scripting isn't just "scripting" (as in ".sh" files with commands). A proficient unix user/sysadmin will often build one-shot commands using features other people thing are only useful in batch scripts. Actually this is something I find baffles both the Windows-types and the people that solve every problem with "perl -e".

<comment><USER7> You're right about people needing to understand bash and Unix commands - I've seen two 20+ line Perl scripts that run the equivalent of 'date -I' and 'nc' respectively.

That said, I believe bash is somewhat limited for system administration - which I know is very odd amongst system administrators - but please let me explain why.

Using the shell on a Linux based OS in 2009, you miss out on:

* filesystem events (inotify)

* hardware events (dbus)

* config for programs with tree structured configuration (lxml)

* config for programs with sqlite based configuration

* RPM / yum beyond what their command line apps expose (and perhaps dpkg/apt too, but I need to investigate this further).

...as the commands / shell function libraries to handle these are often immature compared to the equivalent APIs. As a result, you get sysadmins causing unnecessary load by polling a file repeatedly at intervals (eg, via a cron job) rather than letting the kernel tell them when their file has changed.

I'm hopefully giving a talk about using richer languages for system administration at PyCon 2010 - I'd love to hear any thoughts or opinions on these matters fron HN readers.

</comment></comment></comment><comment><USER8> Thanks for this post. I'm new to doing bash scripting and this is very helpful.

<comment><AUTHOR> I've got the O'Reilly bash book, it's well worth getting.

<comment><USER9> the only university text book i've held on to.

</comment></comment></comment><comment><USER10> The only one I didn't know about is the problem with:

         echo "hello world!"

I'm surprised history expansion could reach inside the quotes.

<comment><USER11> You need to use single quotes. !, $, `, \ are expanded inside of double quotes.

<comment><USER10> I know about variable and command substitution and escaping, it makes sense that those expand inside " but not ' - but history expansion, something seemingly inherent to the interactive REPL, seems out of place here.

<comment><USER12> There is no difference between a script and the REPL.

Besides, you'd expect variables to be expanded inside normal strings -- why special-case the other expansions?

<comment><USER10> I'd expect them to be handled in the same "phase" as alias expansions. See here for one example of hackery with aliases, that take advantage of their different expansion phase:

<http://www.chiark.greenend.org.uk/~sgtatham/aliases.html>

</comment></comment></comment></comment></comment><comment><USER13> Most of those aren't specific to bash.

<comment><USER14> Correct -- many of these are also problems in Bourne or Korn shell.

I guess by virtue of being the default shell on most Linux distros, "bash" is now seen as a synonym to "Unix shell programming".

<comment><USER15> I see it more as: people who have problems while working with Bash will go to the Bash wiki, even if the mistake they're making could be made in other shells.

<comment><USER14> That's probably the case. Also, all of them being supersets of the Bourne shell doesn't help either.</comment></comment></comment></comment>


Why Object-Oriented Languages Need Tail Calls - <AUTHOR> http://www.harukizaemon.com/2009/12/why-object-oriented-language-need-tail-calls.html

<comment><USER2> Why is there even an argument about this? Not being able to make a recursive call without potentially blowing the stack is a major drawback in any language. I'd venture to say it's a "bug."

And TCO is so handy in so many instances that it's silly not to have it. And you gain performance.

<comment><USER3> _Why is there even an argument about this? Not being able to make a recursive call without potentially blowing the stack is a major drawback in any language. I'd venture to say it's a "bug."_

You aren't going to like Python:

      I don't believe in recursion as the basis of all
      programming. This is a fundamental belief of certain
      computer scientists, especially those who love Scheme
      and like to teach programming by starting with a "cons"
      cell and recursion. But to me, seeing recursion as the
      basis of everything else is just a nice theoretical
      approach to fundamental mathematics (turtles all the
      way down), not a day-to-day tool.

[http://neopythonic.blogspot.com/2009/04/tail-recursion- elimi...](http://neopythonic.blogspot.com/2009/04/tail-recursion- elimination.html)

(I'm not advocating this view, just pointing out that there are programmers who appear in all other respects to be reasonable, intelligent, contributing members of computing society who actually feel that TCO is a bug, that 1000 calls ought to be enough for anybody, and so forth.)

<comment><USER2> I don't like this in a lot of languages. But it's not a showstopper, just an annoyance to be aware of.

That said, there should be no reason not to have _your new modern programming language_ support tail calls. It's short-sighted, and can negatively affect more than just the trivial recursive case.

So, new programming language inventors, if you're reading this, support tail call optimization and proper tail recursion from the beginning. Your language will be better for it.

<comment><USER4> > there should be no reason not to have your new modern programming language > support tail calls

There's many valid reasons not to support TCO. The first one that comes to mind: it makes generating stack traces more difficult.

Another reason: the JVM doesn't natively support TCO. This means to implement it you'll either need to use a trampoline (e.g. Erjang) or convert recursion to iteration (e.g. Clojure)

The latter isn't too difficult, but when tail recursion merely provides an alternate syntax for iteration, and mutual tail recall recursion isn't supported, is there really as much of a point if your language is something like Ruby and already provides multiple means of iteration?

<comment><AUTHOR> > There's many valid reasons not to support TCO. The first one that comes to > mind: it makes generating stack traces more difficult.

> Another reason: the JVM doesn't natively support TCO. This means to > implement it you'll either need to use a trampoline (e.g. Erjang) or convert > recursion to iteration (e.g. Clojure)

So you avoid a 35 years old functionality that makes many procedures smaller, faster and more understandable just to make the compilers simpler?

Isn't this one of the usual tradeoffs where you (should) prefer having the compiler doing the boring and dirty job of converting a recursion to a loop, with all the bookkeeping of maintaining the state and making it thread-safe, simplifying the life of the application programmer at the expenses of the compiler programmer?

</comment></comment></comment></comment></comment><comment><USER5> I remember one of the PLT Scheme guys talking about how without TCO in OO languages you can't even express state machines without creating new state holder objects.

In a way, without TCO you must manually abstract each step and the next one and drive the stepping from outside. Not too unlike using an iterator instead of asking a collection to call f() for each entry.

Having read what he said I too feel that TCO is a very nice addition to other language features.

<comment><USER6> Relevant LtU thread: <http://lambda-the-ultimate.org/node/3702>

<comment><AUTHOR> Sadly it links a blog entry on the old projectfortress.sun.com site (available at [http://web.archive.org/web/20110716163344/http://projectfort...](http://web.archive.org/web/20110716163344/http://projectfortress.sun.com/Projects/Community/blog/ObjectOrientedTailRecursion) but without the nice formatted code snippets).

Too bad that the new project fortress blog at oracle.com is almost empty and filled with garbage (non-processed TeX sources).

<comment><USER7> Yeah, does anyone know what the deal with that is? I was really enjoying following Steele's notes on Fortress. I hope that neither the language nor the blog has been binned.

</comment></comment></comment></comment><comment><USER6> mirror of the post by Guy Steele: [http://www.eighty- twenty.org/index.cgi/tech/oo-tail-calls-20...](http://www.eighty- twenty.org/index.cgi/tech/oo-tail-calls-20111001.html)</comment>


Feedback Canvas: A tool for receiving honest feedback from your team - <AUTHOR> https://stanete.com/feedback-canvas <comment><USER2> Genuinely, who has time for this? It sounds like a great form of feedback, but I can't imagine spending so many developers time on "group therapy" for an individual.

</comment><comment><USER3> Ugh, sounds like you've joined a cult. Brutally honest feedback can be damaging, beware.</comment>


Do you use robo advisors to invest? - <AUTHOR> One of the pioneers of Robo Investing, Hedgeable, shut down recently. WorthFM and some more robo advisors shut down a while back.<p>Do you invest in low-cost index ETFs or do you invest with robo advisors? <comment><USER2> Both. 401k is at a traditional broker, I use a robo advisor for my IRA and yet a third broker when I want to own something specific.

I don't put a lot into the IRA so it's mostly just a long-term experiment to see how well it does compared to how I have my 401k invested. I've been more than happy with how it has performed though.</comment>


Ask HN: How do I become better at using a whiteboard? - <AUTHOR> I've noticed that some of my colleagues are very impressive whiteboard scribblers, being able to do quick-and-dirty flow charts or mind maps that communicate their thoughts and ideas very clearly. Me, on the other hand, often find myself with scribbles that confuse even me. Have you found yourself in a similar situation and actually managed to improve your scribbling? <comment><USER2> Sounds like you may have two possible issues and I can't tell which one the question is about.

1\. You have difficulty explaining or articulating your ideas in general 2\. You have difficulty translating your thoughts into physical interaction on the whiteboard.

For the second one, I just think of the whiteboard as a place to bookmark or store the stack of a discussion. Usually the rest flows from that idea for me.

</comment><comment><USER3> My tip would be to keep a pad of paper on your desk and jot out ideas before implementing them.

Use the pad of paper as much as possible and then you get practice in converting thoughts into pictograms. Because you draw for only for yourself there is no fear of failure.

Its actually quite natural -- we used to live in caves and we drew pictures of the animals we would hunt.

Edit: I used to be terrible with whiteboards.

</comment><comment><USER4> Sounds to me that you need to slow down. Respect yourself enough to believe that your colleagues' time will be well-spent if they give you their attention.

Could be too that you need to brush up on your drawing/diagramming skills...</comment>


Long-Term Consequences of Spectre and Its Mitigations - <AUTHOR> http://robert.ocallahan.org/2018/01/long-term-consequences-of-spectre-and.html <comment><USER2> > I think it would be a grave mistake to simply give up on mixing code with > different trust labels in the same address space. Apart from having to > redesign lot of software, that would set a hard lower bound on the cost of > transitioning between trust zones. It would be much better if hardware > mitigations can be designed to be usable within a single address space.

I wonder what software redesigns he has in mind. As far as I can tell, best practices are already trending toward only one trust zone per address space. Some might argue that that's the whole point of multiple address spaces. I suspect that Spectre will accelerate this trend.

I do know how difficult this kind of change can be. The example I have in mind started before Spectre, and is unique to one platform. On Windows, developers of third-party screen readers for the blind are going through a painful transition where they can no longer inject code into application processes in order to make numerous accessibility API calls with low overhead. This change particularly impacts the way screen readers have been making web pages accessible since 1999. For the curious, here's a blog post on this subject: [https://www.marcozehe.de/2017/09/29/rethinking-web- accessibi...](https://www.marcozehe.de/2017/09/29/rethinking-web- accessibility-on-windows/)

<comment><USER3> According to a blind friend of mine, the web, despite the constant touting of it as being great for accessibility, has been a total disaster for accessibility. As you point out, windows applications have much better accessibility (and Microsoft still cares) than most webpages.

<comment> nils-m-holm I have slightly impaired vision, so I need a 30pt font to be able to read comfortably, and the web is already a disaster in terms of accessibility. There are lots of sites that I cannot use, because of overlapping content, unreadable text, hidden buttons, etc.

<comment><USER4> Does Firefox "Reader View" feature help you in any kind of way? Or is it that reading isn't the issue, but browsing around is?

<comment> nils-m-holm Reader view often excludes figures that are important for understanding a text, so this unfortunately is not an option for me.

I have set my font size to 32pt and do not allow web sites to use smaller fonts or typefaces other than my preferred one. Also, I have set text color to green on black, which is easiest to read for me. You would not believe how many web sites do change background color, but do not set text color, leaving me with bright-green on white text. :/

Then, a large font causes components to overlap, rendering text and buttons inaccessible. Disabling style sheets does not always help, either (and turns every modern web site into a complete mess). Semantic web? LOL.

Javascript, as others mentioned, is a huge problem, because it somehow seems to be able to bypass my font and color settings. I have it turned off all the time now and just do not visit sites that require it. Well, more time for more interesting things! A silver lining in every cloud! :)

</comment></comment></comment></comment></comment><comment><USER5> One thing curiously missing from this article is ARM's laudable in-depth analysis - [https://developer.arm.com/support/security- update](https://developer.arm.com/support/security-update), and their efforts ([https://developer.arm.com/support/security- update/compiler-s...](https://developer.arm.com/support/security- update/compiler-support-for-mitigations)) to bring in architecture-neutral compiler intrinsics to address variant 1.

<comment><USER6> Perhaps I probably should have mentioned that, but I think the array index masking approaches are going to prevail.

<comment><USER5> That's assuming the only thing you want to prevent is speculative bounds overrun. Even with masking, you can still leak the secret in the array from the path not taken? Do you see evidence of gcc or clang gravitating to the MS approach?

In many ways, spectre is one more kind of attack on code that doesn't properly separate validating untrusted input from acting on that input, except unlike overruns and TOCTOU races, this is microarchitectural.

</comment></comment></comment><comment><USER7> The article is by someone with no involvement in the CPU business. We need to hear from CPU architects and manufacturers. This is a fundamental CPU design defect and needs to be fixed in silicon.

<comment><USER8> I'm not a CPU architect, and I'd agree with you that Spectre variant 2 should be fixed by CPU designs, simply because software is helpless against it. Luckily, fixing it shouldn't be too expensive, it just requires tagging the BTB with the trust zone.

But Spectre variant 1 is really a consequence of the CPU working correctly. For a large number of branches, perhaps most, we _want_ loads to proceed during speculative execution. This is because the code accesess the same or closely related data on both sides of the branch, so priming the caches during speculation is very valuable even when the branch is mispredicted.

I remember reading a study of different binary search implementations which is probably the clearest example of this: when the data is laid out in a heap layout (with child nodes next to each other in an array) the branchy variant of the code performs better than the branchless variant due to this cache priming effect.

What CPU designers could and should probably help with is providing instructions to cheaply mark the (comparatively few!) cases where this speculative execution behaviour leaks secret information.

<comment><USER9> > What CPU designers could and should probably help with is providing > instructions to cheaply mark the (comparatively few!) cases where this > speculative execution behaviour leaks secret information.

How can we, as software developers, find these cases in our multi-megabyte code bases, and how can we be sure we haven't missed any?

<comment><USER8> You could ask the same question about any class of security bug, so unsurprisingly I'd answer more or less in the same way.

For example, if you're paranoid, make your compiler be conservative, in the same way that you might address buffer overflows by using a language/compiler that inserts bounds checks everywhere.

If you're less paranoid and/or more worried about performance, invest in static analysis tools or languages with augmented type systems. After all, you only have to worry about Spectre variant 1 when handling attacker-controlled data. Tracking type info like this is already done by existing static analysis tools.

Finally, if you're not handling attacker-controlled data at all - which is the case for a lot of performance-sensitive code - you really don't want to (and don't have to) do anything about Spectre variant 1.

By the way, this is really the big difference between the two Spectre variants, and why it's a shame that they fall under the same name. Variant 2 affects _all_ code with indirect jumps/calls, even code that doesn't ever touch attacker-controlled data. That's a _huge_ difference between the variants.

Anyway, the bottom line is that you shouldn't punish the performance of all code over a class of security bugs that a lot of code isn't affected by. Buffer overflows haven't stopped us and shouldn't stop us from writing performance sensitive but security uncritical code in unsafe languages either.

<comment><USER7> _You could ask the same question about any class of security bug, so unsurprisingly I 'd answer more or less in the same way._

No. the problem here is that the code isn't wrong. The CPU is wrong. Whether or not the CPU will leak data depends on the make and model of CPU. Most MIPS CPUs and many ARM CPUs don't have this problem. Some AMD x86-type CPUs may not. It has to be fixed on the CPU side.

This could introduce Intel to a world auto manufacturers know well - recalls. Intel has been there before, with the floating point bug.

<comment><USER8> You don't actually have an argument though. Why is the CPU wrong? Because you say so? And btw, you're wrong about this not affecting ARM or AMD. It affects everyone with speculative execution (we're only talking about Spectre variant 1 here - if you're confused about that, please go back to my first comment in this thread).

Look: When other side channel leaks were found, e.g. people recovering RSA or AES keys from plain cache timing without speculative execution, maybe there were people similarly arguing that it's the CPU's fault. They lost that fight, too. Today, the uncontested consensus is that cache timing leaks are the code's fault, for good reason.

Because what are you going to do, stop building caches? Obviously not, they exist for very good reasons. The same is true for speculative execution. What do you expect CPU people to do? Rip that out entirely? Be real. (Please, seriously think about that: what is it that you actually want CPU people to do? Don't just handwave!)

This kind of discussion is why Linus Torvalds regularly flames security people.

</comment></comment></comment></comment></comment></comment><comment><USER10> >> browsers are trying to keep the problem manageable by making it difficult for JS to extract information from the timing channel (by limiting timer resolution and disabling features like SharedArrayBuffer that can be used to implement high-resolution timers), but this unfortunately limits the power of Web applications compared to native applications.

I don't see a problem with that. "Web applications" are inherently untrusted code. If it were not for untrusted code these attacks would not be an issue, so it doesn't seem unfair for a mitigation to negatively affect them.

<comment><USER11> I consider any computer platform that cannot run an "untrusted" application in a manner that doesn't endanger its user (within certain limits - e.g. it's practically impossible to limit what _kind_ of internet traffic the application can do, or what kind of scams it can make the user click through), a failed computer platform.

In particular, browsers could always run JS in a separate process that's appropriately virtualized (i.e. has limited access to host information and resources).

<comment><USER12> This leaves a big hole. Many malicious packages will solicit trust from the user.

That is, we seem to be plagued by misplaced trust moreso than untrusted applications.

The analogy to civil engineering is we trust building makers. Few of us enter buildings we don't trust to stay up around us.

</comment></comment></comment><comment><USER13> It's interesting to pair this with Adrian Sampson's (an academic who works on hardware architecture) thoughts, particularly his musings about other vectors:

> The second thing is that it's not just about speculation. We now live in a > world with side channels in microarchitectures that leave no real trace in > the machine's architectural state. There is already work on leaks through > prefetching, where someone learns about your activity by observing how it > affected a reverse-engineered prefetcher. You can imagine similar attacks on > TLB state, store buffer coalescing, coherence protocols, or even replacement > policies. Suddenly, the SMT side channel doesn't look so bad.

[http://www.cs.cornell.edu/~asampson/blog/spectacular.html](http://www.cs.cornell.edu/~asampson/blog/spectacular.html)

</comment><comment><USER14> Could someone please explain to me why there is so much focus on Spectre vulnerabilities in Javascript and not really any on HTML/CSS, when it seems that a server could also be able to cause the client to perform speculative execution via pure HTML? Or is it not possible for some reason? The focus on Javascript as though it's somehow special is rather baffling to me, making me wonder whether I'm really understanding the fundamental issues. (?)

<comment><USER15> >The focus on Javascript as though it's somehow special is rather baffling to me

One of the most common ways major ad networks get compromised to the extent that they serve malware to hundreds of thousands of web users (this happens at least once a year) is that they hotlink to JS libraries, that hotlink to JS libraries, that hotlink to _more_ JS libraries.

If you use a script blocker, it's not that uncommon to see that once you get down far enough, scripts are being loaded from bare IP addresses rather than domain names. Every now and again, someone compromises one of these deep- nested hotlinked JS files and maliciously modifies the javascript, and random sites all over the web dutifully serve the malware.

It's not that I don't trust the first-party website owners, more like I don't trust their friends friends friend.

<comment><USER16> This is so annoyingly true. So when you start to allows scripts because you need the website to work, you reload and then see a bunch of new scripts were loaded that you didn't see before. It's a total shitshow.

EDIT: I would love a list of minimum required scripts for certain sites. It's painful to fight through what I need- and I really resent it when I am a PAYING FUCKING CUSTOMER.

</comment></comment></comment><comment><USER17> In my opinion, the worst long-term consequence will be that even having newer CPUs with the issues fixed in hardware, we'll have a performance impact because of code compiled to work with both old and new CPUs. Just like the case of having a new CPU with fancy features unused because of code compiled to be backwards compatible.

<comment><USER18> Intels C compiler could generate code that detects CPU features at runtime years ago, I think the current GCC can do the same. Binaries only have to become a bit more bloated to store both versions of the compiled code.

<comment><USER17> Runtime checks cost CPU cycles as well.

<comment><USER19> The runtime check only needs to be done one during program execution.

<comment><USER17> So you mean having two executables in one? A la Apple "fat executables"?

<comment><USER20> No, it's on a per-function basis. On program startup it does the necessary checks (CPUID etc.) and sets up the function pointers appropriately (see the IFUNC mechanism in the linker).

See e.g. [https://lwn.net/Articles/691932/](https://lwn.net/Articles/691932/)

<comment><USER17> That's OK for code e.g. you know it could benefit from SIMD usage. However you can not tag every function of user code for safe/unsafe mode. Also, optimizations would increase the mess (inlining, unrolling, etc.). Generated code would be a "Frankenstein".

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> I doubt Intel will be lowering their prices, or refunding anyone a portion of the price of their previously purchased CPUs, that's for sure.

Look what happened after the VW diesel scandal ('dieselgate'): VW had to pay for repairs, and pay buyers (my friend bought one of the cars and got about $6k IIRC). Some people even went to jail.

Intel (or any other CPU maker) will probably not suffer similar fates. This situation is a bit different, because they may not have known about the problem. Still, everyone who bought a CPU is going to get a 10-30% performance haircut because they made a mistake. And Intel isn't going to have to pay for it.

<comment><USER22> Volkswagen deliberately engineered their cars to falsify government emission tests. What intel did was negligent. Volkswagen was malicious. These are very different. I don't see them in remotely the same boat.

<comment><USER23> "Negligent" is even too strong.

Per dictionary.com, the legal definition of negligence is "the failure to exercise that degree of care that, in the circumstances, the law requires for the protection of other persons or those interests of other persons that may be injuriously affected by the want of such care. "

What Intel did was not recognize that a specific attack possibility existed. Nobody else recognized it either, for a decade. That's not negligence. That's failure to be omniscient.

</comment></comment></comment><comment><USER24> Obligatory: [https://millcomputing.com/topic/meltdown-and- spectre/](https://millcomputing.com/topic/meltdown-and-spectre/)

</comment><comment><USER25> Does anyone know how things are going in GPU land? Don't they support concurrent separate protection domains these days too?

<comment><USER26> No OoO speculation though.</comment></comment>


Fiverr is a happier marketplace than Upwork as there is no race to the bottom - <AUTHOR> https://freelancemag.blogspot.com/2019/05/fiverr-is-lot-more-graceful-and-happier.html <comment><USER2> Flimsy anecdotal account. Funny that this person's Fiverr account has gigs like "I will develop a web app for you (starting at $20)", which for me epitomizes the "rush to the bottom" that the writer bemoans.

<comment><AUTHOR> $20 is for a standard prototype or a quick wireframe, its a marketing strategy to bring to client to the discussion table. I don't do full web app gigs for that price! The other two packages (standard & premium) is where most of the development happens.

<comment><USER3> Great strategy! I'm guessing you are referring to these packages [1] These rates for me as a western european still look incredibly low. or are these still prototyping prices?

[1] [https://www.fiverr.com/prahladyeri/develop-a-web-app-for- you](https://www.fiverr.com/prahladyeri/develop-a-web-app-for-you)

<comment><AUTHOR> Yep, this incredibly low price is just for creating a rough prototype (which the client is typically never interested in). As I said, once the client comes to discussion table, I then bring the topics of well-maintained and commented source code, unit and integration testing, benefits of cloud hosting on AWS, etc. and then we start forming real estimates.

</comment></comment></comment></comment><comment><USER4> It is better alternative than upwork for people with niche area development skills. Clients come to you instead of submitting proposals. Fees is a bit high but that's fine.

</comment><comment><USER5> So instead of you submitting a proposal you make a profile and they come to you. So... How does that change the dynamic of cheap asses only hiring the lowest cost workers and workers racing to the bottom?

</comment><comment><USER6> Still stereotypical capitalist exploitation of workers through economic arbitrage.

<comment><USER7> Maybe so, but please don't post unsubstantive comments here.</comment></comment>


Reddit Revamps Its Sponsored Link Platform - <AUTHOR> http://techcrunch.com/2010/04/28/reddit-revamps-its-sponsored-link-platform-with-some-help-from-the-oatmeal/

<comment><USER2> Yet they still won't take non-US advertisers. Reddit claims "legal issues." In 12 years of buying online advertising from the US, I've never seen such a restriction before. What are they doing.. giving away free prescription drugs with every order?

<comment><USER3> I'm in Canada, and I didn't have any problems.

That said, it was a waste of $20, I didn't get any sales.

<comment><USER2> I brought up the US-only issue before on HN and a couple of people reported success using it from overseas. Yet someone from Reddit was incredulous and couldn't understand how that would work.. perhaps I should just try it ;-)

<comment><USER4> Yahoo Publisher Network, Facebook (for the first 6 months) and a few other networks have had US only policies, partly due to advertising restrictions (tobacco, pornography and such) but partly to handle the inventory and scaling.</comment></comment></comment></comment>


Ask HN: Why is there no working fork of the AOSP email app? - <AUTHOR> To be frank it the stock AOSP email client is more user friendly and has better functionality compared to the only other open source email client for android that is out there, K-9 Mail. <comment><USER2> Well that's because most roms ship a customized version of it.. Like crDroid or Dirty unicorns..</comment>


The Republic of NULL Island - <AUTHOR> http://www.nullisland.com/ <comment><USER2> [https://news.ycombinator.com/item?id=11600396](https://news.ycombinator.com/item?id=11600396)

</comment><comment><USER3> It sounded really interesting until I found out that it doesn't really exist: [https://en.wikipedia.org/wiki/Null_Island](https://en.wikipedia.org/wiki/Null_Island)

</comment><comment><USER4> I'm still trying to figure out the heraldry of their flag. Is orange being used as a metal and gray as a fur? Either way, I'm not liking the design. Because of the similar brightness in colors, if you tried to look at that flag from far away, it might not look like it even exists.

</comment><comment><USER5> "Africans are not seafaring people."

Citations very much needed, because it looks like this is just plain wrong.

[http://usatoday30.usatoday.com/news/science/anthro/2001-01-0...](http://usatoday30.usatoday.com/news/science/anthro/2001-01-07-e-african- seafarers.htm)

[http://indian-ocean.africa.si.edu/](http://indian-ocean.africa.si.edu/)

</comment><comment><USER6> The image is that of Mayor Island, an New Zealand island volcano.

[http://www.gns.cri.nz/Home/Learning/Science- Topics/Volcanoes...](http://www.gns.cri.nz/Home/Learning/Science- Topics/Volcanoes/New-Zealand-Volcanoes/Mayor-Island)

</comment><comment><USER7> Is this really the homepage of the real Null Island? Why isn't it on the .null TLD? [http://wiki.opennicproject.org/dotNullTLD](http://wiki.opennicproject.org/dotNullTLD)

<comment><USER8> Probably because people want to actually reach it, so they used a TLD that people already have access to without additional configuration.

Alternative DNS roots seem amusing, but not even slightly practical.

</comment></comment><comment><USER9> Zero Zero Island: [https://en.wikipedia.org/wiki/Colonel_Bleep](https://en.wikipedia.org/wiki/Colonel_Bleep)

</comment><comment><USER10> do we realise that so many people will read this and not realise its not real?

misinformation can be amusing, but its also harmful :/

<comment><USER4> Thankfully there are sites like php.net[1] that tell the truth: " _null_ doesn't exist."

[1]: [http://php.net/manual-lookup.php?pattern=null](http://php.net/manual- lookup.php?pattern=null)

<comment><USER11> [http://php.net/manual-lookup.php?pattern=God](http://php.net/manual- lookup.php?pattern=God)

<comment><USER4> The difference here is that null is a valid term in PHP. No comment about God objects.</comment></comment></comment></comment>


Welcome Lichess Boards – A new way to play on Lichess - <AUTHOR> https://lichess.org/blog/XlRW5REAAB8AUJJ-/welcome-lichess-boards <comment><USER2> I just read a write-up of some chess drama ([https://www.reddit.com/r/HobbyDrama/comments/f9uv4d/chess_sp...](https://www.reddit.com/r/HobbyDrama/comments/f9uv4d/chess_sponsor_of_major_online_chess_events_turns/) ) and one of the plot points was that lichess doesn't accept electronic boards in their ranking system - you had to use their online client.

Now that's untrue. The timing is surprising/odd to me - I feel like there's some connection or twist waiting to be revealed here.

<comment><USER3> Their blog post (linked in the post you linked) states that you've been able to use electronic boards for a while.

[https://lichess.org/blog/XlE48hEAACIAQv2F/regium- extraordina...](https://lichess.org/blog/XlE48hEAACIAQv2F/regium- extraordinary-claims-require-extraordinary-evidence)

I'm curious on where that "plot point" comes up? As far as I can tell, Lichess is the only one that _did_ support electronic boards. In fact, in the blog post linked in that one, it says that Lichess has supported electronic boards being used for ranked play since 2018:

[https://lichess.org/blog/WvDNticAAMu_mHKP/welcome-lichess- bo...](https://lichess.org/blog/WvDNticAAMu_mHKP/welcome-lichess-bots)

<comment><USER4> Where does it say that?

2018:

> Lichess Bots cannot:

> Participate in tournament or simuls

> Use lobby seeks or pools

> Appear in leaderboards

It says bots can play, but have a modified rating points system, so you couldn't use a bot/board for your human account.

<comment><USER3> Lichess Bots can:

        Play casual and rated games with other players

</comment></comment></comment></comment><comment><USER5> To save others some time: USB chess boards tend to cost a few hundred bucks [https://www.chesshouse.com/collections/electronic- chess?sort...](https://www.chesshouse.com/collections/electronic- chess?sort_by=price-ascending)

<comment><USER6> Is there a version for Go?</comment></comment>


Ask HN: Non-".com" TLDs - <AUTHOR>

What are your opinions of startups whose domains end in .ly, .tv or .io (or the many others)? Do they seem less legitimate to you or does it not affect how you view them?<p>If you do think differently of startups with whose domains end in something other than ".com" what are your reasons? Of the more popular TLDs, which ones seem the MOST legitimate (which are the "least bad")? <comment><USER2> This question can be highly debated, but here's my take...

Yes, alternative TLDs are cool for us nerds, but it's horrible for any startup in the consumer internet space. Most "regular" people are not familiar or comfortable using them. More often than not, people will meet you with a blank stare when you tell them your website is example.io.

I once spoke with the founders of Vol.ly (since acquired) and they said their name choice was a nightmare. Their company was pronounced Volly, but every time they would have to take time to explain their domain was v-o-l dot l-y. This is annoying for the founders and instantly forgotten by the user.

There's a reason why most startups that begin with non-.com domains eventually switch if they gain enough traction.

All that being said, I don't think it's logical to purchase an expensive .com before your company proves its success (or raises an absurd amount of money). Take your time, and get creative to find a workable .com, or get a domain that will still make sense if you ever want to purchase the .com. For example, served.io (no disrespect to them) could never change to servedio.com.

However, if your not in the consumer space, then I think alternative TLDs are a much more viable option. You're not depending on eyeballs for your startup's success. And if your target market is technology folk, it's even better.

<comment><USER3> I agree, but in our scenario, served.com is available for purchase - price? who knows.

<comment><USER3> Oops, I meant served.co/.net/.org. But, like I said earlier and others have mentioned.. no need to go after those big names unless you get some decent traction.

</comment></comment></comment><comment><USER4> We are in the process of building our startup for QR codes at QR.io.

Being an SEO/SEM guy for years, I was worried about Google snubbing a .io domain in SERPs. In the two weeks that the new site has been online, we've floated up from page 50+ to about page 5 for our most-targeted keyword phrase (QR code platform).

You do lose the ability to tell Google that it a US-targeted domain in Google Webmaster Tools like you can for non-country TLDs.

We went with it because data payloads of QR codes can be quite small (especially in MicroQR codes) and every character saved is potentially an exponential gain where it comes to unique identifiers in a URL shortener.

</comment><comment><USER5> Short 2-letter TLD's are practical and shorter. .TV is cute. .LY is fun but could feel too "political" to some. Also - registering and relying the whole business to domain registered in unstable political jurisdiction could be prone to "blackouts" :)

I registered: C.GG a few years ago because i wanted to make my own shortener that would be very easy and fast to type on the keyboard (letter C and G are conveniently on the left side of keyboard, and dot on the right). But never got to use it though yet.

Each one has it's own reason!

Gleb

</comment><comment><USER6> This question comes down to marketing, if the largest portion of your growth will come from search, social links, and web advertising then I think they are fine. They are really bad for national branding campaigns like radio and TV, where linking is not an option. It is interesting that Overstock is pushing hard for a re-brand to O.co. It's a great name, if they can pull it off and change consumer habits it will help other brands gain legitimacy in branding. As such though they have their work cut out for them.

<comment><USER7> > if the largest portion of your growth will come from search, social links, > and web advertising then I think they are fine.

Bingo. Such novelty domains can be a dog to promote via any non-clickable medium.

On my whim in March last year, we went and created <http://getlocalne.ws>

In the early days, getting the word out about it was like a chore (and a half). Shortly after launch, a local newspaper, a popular magazine and a national TV channel here all wanted to cover it. Between them, I remember confirming and re-confirming the domain/URL about a dozen times ! :)

Even during and in the immediate aftermath of all that coverage, the traffic was hardly anything to write home about - peaking to just about 1500 per day, slowly tapering off to stabilize at around 250 or so. I attribute this low impact to the facts that 1) the domain is not a .com and 2) all 3 media that covered it were non-clickable.

Interestingly, once the search/social and other online sources started kicking in, the traffic levels started rising steadily, almost week-on-week (presently at about 5k/day).

</comment></comment><comment><USER7> Quite an interesting point, thanks for bringing it up.

I'd say most domain extensions other than .com, .net, .org (and .edu, .mil, .gov) would fall under either ccTLD (country-code TLDs) or vanity domain categories.

If memory serves me right, the first creative use of such a domain that achieved good visibility and large-scale commercial success was del.icio.us, or am I missing any others before that?

</comment><comment><USER8> If your marketing is mostly online and you're targeting more geeks, then a cool foreign domain is fine.

If you're targeting the masses, and marketing in print, then you need something more obvious which is easy to phonetically speak.

Having said that, I've seen some awful "dot-coms" read out on TV ads and radio ads over the years...

</comment><comment><USER9> Careful with .ly, the website you serve on a .ly domain name must conform to the laws of Libya. A URL shortener, vb.ly, was seized in the past for linking to adult materials: <http://www.pcmag.com/article2/0,2817,2370354,00.asp>.

</comment><comment><USER10> We use .me - first because it makes sense for our name and because it was available. At the time, the .com version was held by a broker but fortunately for us, he let it expire and we were waiting! We still use the .me but direct the .com

</comment><comment><USER3> I use a .io for my startup (served.io), and the reason why I picked it is because of its "coolness" factor. No need to spend thousands or millions to obtain the .com at this time.

<comment><AUTHOR> Yeah .io definitely has that "coolness" factor right now. Nice landing page BTW. How are you liking launchrock?

<comment><USER3> I think it's fantastic - meets my requirements and is free - I'd probably pay a small fee for it though, very useful.

</comment></comment></comment><comment><USER11> I just bought PostWith.Me a few months ago. I think that this domain is alot easier to remember as it's a play off the domain extension.

</comment><comment><USER12> I really like the possibilities with .it

<comment><USER7> .es can provide some great plural possibilities too.

Even .info (that was considered to be spammy some years ago, don't know now) can offer some great ones. A throw-away reg fee of $1 to $2 (first year) makes it all the more attractive. :)</comment></comment>


Twitter now worth over $40 billion - <AUTHOR> http://finance.yahoo.com/q?s=twtr

<comment><USER2> Yea so much for the inevitable 'it's a bubble' arguments. Stocks like Facebook, Linkedin, Zillow, and Trulia that the pundits called 'obvious' bubbles are trading 50% or higher than their IPO price. This throws more water on Garry Shiller's argument that bubbles can be predicted or that betting against 'obvious' bubbles is profitable. Only in hindsight can we proclaim something a bubble. Even if an overvalued stock does fall you can still lose all your money shorting if you get a margin call, because the price can rise much longer than you can remain solvent as attributed to John Maynard Keynes.

Personally, I'm long Twitter by selling covered calls. Pretty much if Twitter stock stays above $70 I will make $10k by the end of January.

<comment><USER3> I'm a bit of a noob when it comes to this kind if thing, but would you care to explain how you go about "selling covered calls".

The how, where, why and the what's of this kind of financial transaction would be really interesting to know.

<comment><USER4> "Selling a covered call" is when you own the stock and then write/sell a call, using the stock you own as collateral.

For example, TWTR is currently $73/share. Suppose you own 100 shares of TWTR. The March 2014 85 strike call has a bid of $7.90. Suppose you sell one 85 strike TWTR call for $7.90. (1 call equals 100 shares.) You immediately collect $790 in premium. Your cost basis in your TWTR shares is reduced by $7.90 per share. (for capital gains tax purposes)

If TWTR is above $85/share in mid-March 2014, whoever owns that call option will exercise it. You sold your TWTR shares for $85/share, even if the actual price is much higher. You effectively sold it for $92.90 per share, because you also collected $7.90 when you wrote the call.

If TWTR is below $85/share in mid-March 2014, the call option expires worthless, and you keep your TWTR shares and your $7.90.

It's a covered call, you already own the shares, so your loss is limited if TWTR skyrockets. If TWTR goes to $200/share, you lose big on the call, but that is offset by the shares you own.

Superficially, this seems like a good trade. You get $7.90 now, and if TWTR goes up, you sell at a price you're happy with.

However, this is AN IDIOT TRADE. You might as well just write Goldman Sachs a check directly if you're going to do such stupid things. Why? In the Black- Scholes formula for pricing options, the "average gain" of stock equals the risk-free rate. However, on average, stocks go up MUCH MORE than the risk-free rate. When you write a covered call, you're giving up all the upside.

On average, the stock goes up by more then the premium you get for writing the call, making this an idiot trade.

The whole point of being in the stock market is that you make good picks and get a 100% or better gain. You give up that upside when you write the covered call. The premium you receive for writing the call does not offset (on average) the missed gains.

When you write the covered call, you still have the risk that the bubble pops and TWTR crashes. But, you miss out on all the potential upside if there are many greater fools willing to buy it later.

</comment></comment></comment><comment><USER5> And Yet, Apple is only worth $500B, at the same valuation Apple would have worth over $20 Trillion.</comment>


Opera downloads double due to European browser choice screen - <AUTHOR> http://my.opera.com/chooseopera/blog/2010/03/18/the-choice-screen-effect

<comment><USER2> yep I read this.. I still don't think it's exactly fair though. Should there be a ballot screen for windows media player next? Or paint? Or notepad? Or minesweeper?</comment>


30c3: To Protect And Infect, Part 2 (New Snowden revelations from Applebaum) - <AUTHOR> https://www.youtube.com/watch?v=b0w36GAyZIA

<comment><USER2> The last 10 minutes blew my mind. The rest is just profoundly infuriating.</comment>


Ask HN- was the site down this morning? - <AUTHOR>

I was unable to access it until around noon central time here in Houston. Was it just me? <comment><USER2> Various ISPs, including Comcast, Sonic.net, and a few others aggressively cache DNS entries (including SOA records) for longer than the 30 minutes we specify.

If you continue to have problems where the site completely times out - you get nothing back - then use better DNS servers:

[https://gist.github.com/kogir/7237218](https://gist.github.com/kogir/7237218)

</comment><comment><USER3> Yes: [https://news.ycombinator.com/item?id=6640210](https://news.ycombinator.com/item?id=6640210)

</comment><comment><USER4> I am from Houston and I noticed the same.

</comment><comment><USER5> \- Yes, I believe so.

<comment><USER5> \- It was down 3 times for me today.</comment></comment>


How do we explain email to an "expert"? - <AUTHOR> http://sobersecurity.blogspot.com/2016/08/how-do-we-explain-email-to-expert.html <comment><USER2> 1\. It's a massive exaggeration that it's dangerous to run your own email server. Now, he doesn't explain why he thinks that it is, but I guess there would be two major categories, both based on the assumption of vulnerabilities: (1) your server could be abused against others (yes, but so could your laptop or smartphone) or (2) your own emails could be at risk of being leaked (yes, but the solution to that obviously is not to directly give them to someone else instead).

2\. None of that is actually solved by simply trusting someone else to run your email servers for you if you also can't judge whether they are doing it properly and, in particular, in your interest.

3\. If you think that trusting someone else to run your email servers for you is an acceptable solution, that is functionally equivalent to trusting someone else to provide you with a software package to run on your email servers. Everything that someone else could do on an email server that they run for you, they could just as well package into, say, an install CD image, which you then could use to run your own functionally equivalent, hopefully well- configured and well-updated, mail server.

So, I would think, this is at best an argument against putting together your own mail server from distro packages, and configuring everything yourself, maybe.

Other than that, there is no fundamental reason why you would need to know email RFCs any more for running an email server than you need to know them for running an email client. In either case, knowing them can help you with figuring out some problems. But also, in either case, if the software is good, the programmers should have taken care of reading the RFCs for you, so you don't need to, for the most part.

<comment><USER3> >Everything that someone else could do on an email server that they run for you, they could just as well package into, say, an install CD image, which you then could use to run your own functionally equivalent, hopefully well- configured and well-updated, mail server.

Gmail won't give you their entire software stack (also good luck running it even if they did). Neither will any of the other big players.

<comment><USER2> Are you saying that gmail are the only ones who know how to run a mail server?

<comment><USER4> You were claiming "they could just as well package into, say, an install CD image" which is likely not going to happen, so he was just giving an example.

The perfect spam filter Gmail has its probably based on data and ML analysis, not a simple software you can put on a CD and install on some little server; so even if someone who works there wanted to help you they probably can't do it.

<comment><USER5> GMail's "perfect spam filter" is so bad that it is the reason my institution moved away from Google services. It's also the main reason so many people consider it 'impossible' to host your own email.

It's anything but perfect. It's a black box, with no user-serviceable parts inside. Completely useless for any organization with needs that deviate from Joe User.

<comment><USER6> How would you implement a spam filter?

You can sort of turn off spam filtering on incoming emails but I don't most people or organizations would want that.

> Completely useless for any organization with needs that deviate from Joe > User.

Maybe but being slightly over aggressive means a world in terms of user happiness. Think about email before Gmail. How much junk did you see in your inbox? There is a lot LESS today. Joe User would be very happy if they dried to think about it for a second.

<comment><USER2> > How would you implement a spam filter?

What do you mean "implement"? You are aware that there exists free spam filtering software that you can install, like, say, spamassassin (which has been around longer than gmail)?

> Maybe but being slightly over aggressive means a world in terms of user > happiness.

Dropping legitimate emails is good for user happiness? You have strange users. I imagine if the post office decided to throw away some letters "slighty over aggressive[ly]" ... there are people who would be happy if that happened?

> Think about email before Gmail. How much junk did you see in your inbox? > There is a lot LESS today.

I see maybe one to three spam mails per day, with nearly zero false positives (maybe one per year). And that's without gmail. Obviously, I could reduce that to zero spam, at the cost of increased false positives, which is not a sensible option as far as I am concerned, deleting three mails per day isn't really all that much work.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Be wary when something is described "too hard", but the describer doesn't/can't give specifics on why it is too hard. If a person can't give a generally understandable description of the difficulties, one has to ask whether they understand the topic well enough to make a pronouncement of hardness.

> Then you'll understand there are no experts.

I disagree. There are, but experts have to keep learning in order to maintain their expertise.

<comment><USER8> This line is what got me:

> There are literally more topics than one could read in a lifetime.

Literally no part of that sentence is accurate.

<comment><USER9> Especially considering, all documentation and concepts regarding email have been written/designed in a single lifetime.

<comment><USER10> That's no guarantee, given that they have been written/designed by multiple people in parallel.

</comment></comment></comment></comment><comment><USER11> Horsepuckey. Hosting your own data services is not dangerous, if you do your homework. Email is not _that_ complex (compared to something like a federated Kerberos environment), and there are several good, concise, HOWTOs, books, etc on the subject. Running your own stack makes you a first-class citizen of the 'net, and more people should do it.

<comment><USER12> > Hosting your own data services is not dangerous, if you do your homework.

Well, sure, not dangerous like underwater welding, or electrical powerline installation or something, but it's something that requires constant attention to do right.

Even people who do their homework and start out vigilant, can eventually develop entropy and then 3 years later you get a message from your host telling you your machine is being used for spam - like this guy who is also coincidentally on the front page:

[https://news.ycombinator.com/item?id=12384880](https://news.ycombinator.com/item?id=12384880)

Sure, it's not _dangerous_ , but it's awfully time consuming if/when things go wrong.

<comment><USER11> > Sure, it's not dangerous, but it's awfully time consuming if/when things go > wrong

Perhaps, but that can be said of most things. Model rocketry, glass blowing, hell even woodworking. That doesn't mean people shouldn't roll up their sleeves and get into it because 'some megaultracorp has perfected the process', for some incredibly generous definition of 'perfected'.

Running your own server does in fact take some time and a little bit of elbow- grease, but scare-articles like this does nothing to further an open internet. As the tech-elite (for the most part), we should be encouraging folks to host their own data, learning how 'those damn computers' work, and do our best to raise the next generation of engineers, sysadmins, devopsen, docker deployers, or even just computer dabblers 'right' so they at least have some concept of How The Internet Works(tm) beyond "oh, send this dict to an API...". If hosting your own email server is too scary for you at this time, suck it up, do it anyway, and figure out what needs to happen to make it better for the NEXT guy. Write down what breaks and when. Publish that data. Let us learn from your fail, as you learn from ours. Holler at your nearest Google or Comcast or Centurylink engineer, suit, or peon to un-fsck their infra. It's not glamorous work, but it is necessary.

<comment><USER12> I agree that people should be encouraged to learn how things work. In the past I have run my own mail server, and I'm aware of the time and effort involved.

As fun as it was, I now find it less hassle to just outsource that to a third- party that specialises in it.

</comment></comment></comment></comment><comment><USER13> > most of #3 knows running your own email server is pretty dangerous

I think this could be phrased better. Or at least expanded on what "dangerous" means here. Someone breaking in is just one tiny part of it. Getting incoming emails dropped due to misconfiguration is another. Then there's the whole issue of getting your mail accepted.

After such comment there's always a few people ready to say that it just worked for them and they don't have any issues. That's great. As long as they actually know that's the case (how often do you test for your mail being silently dropped? how often do you send copies to yourself on gmail, yahoo, etc and verify they don't go straight to spam), and as long as nothing around their network changes (two spammers in your /24 means you're suddenly being filtered, someone changes description of your range to dialup and you're being filtered, etc.).

Running your own email long term can be easy, hard or a full time job. And that can change day to day. "pretty dangerous"? No... Closer to: suddenly requiring a great deal of work while you're wondering if you dropped an important document.

</comment><comment><USER14> Are there any good email servers which aren't horrible legacy messes? No UUCP support, no M4 macros, no ancient C code?

I once looked at writing an immediate email forwarder in Go, a mail forwarder for servers that don't receive mail. It would, upon receiving a message via SMTP but before replying with a status, open a connection to forward the email, and return the status of the send to the input SMTP connection. No local message storage at all. Runs in a jail. It's not hard to do this as a minimum viable product in Go. But all the anti-spam stuff you need today makes it a far larger project.

It would be interesting to write both that, and a pure SMTP to IMAP server. No local mail access, just pure IMAP. Together, the two programs add up to a mail server much simpler than most today.

<comment><USER15> Depends what you mean by "ancient C code" \- if it's basically Sendmail you're complaining about (and given the m4 mention, that seems likely), then there have always been other options.

Both qmail and postfix have security models pretty similar to the ones you describe - the process that accepts the mail in either has almost no privileges. See here for how postfix does this: [http://www.postfix.org/OVERVIEW.html](http://www.postfix.org/OVERVIEW.html)

<comment><USER16> Yep, qmail may be old but it can do all the new tricks, and it can work like you say. [https://cr.yp.to/qmail.html](https://cr.yp.to/qmail.html) steep learning curve but it'll do it all and the design is great once you "get it".

</comment></comment></comment><comment><USER17> It would be interesting to know exactly how one could get owned by running just an email server. It's been forever since there has been any server that could be attacked with just SMTP. IMAP has a login, as does that buggy PHP webmail program.

There just isn't much of an attack surface there.

The real problems are spam and convincing other mail servers to accept your email.

<comment><AUTHOR> There have been remote code execution exploits in mail servers before, Exim most recently. There probably are more hiding somewhere in one of the many layers that are needed for modern email servers.

<comment><USER18> That isn't difficult to manage though, unless you consider running _any_ server to be insecure. Use your distribution's MTA package and turn on automatic security updates. Done.

<comment><USER19> Unless they are too slow, then you get to pick up the pieces.

Since a server is a much juicier and visible target than any client, expect attacks.

<comment><USER2> > Since a server is a much juicier and visible target than any client, expect > attacks.

Why do you think that?

Isn't a web browser that has access to your gmail inbox just as juicy as your self-hosted imap server?

I don't really see why a "server" would somehow be inherently a more interesting target. Google's servers, sure, they give you acess to billions of mailboxes, but your own private email server?

</comment></comment></comment></comment></comment><comment><USER20> I'm in the process of setting up my own e-mail infrastructure. I have maildir, certificates, IMAP, SASL, TLS, and antivirus working, with anti SPAM and the web GUI left to do. I built and configured the MTA and the IMAP server to use a SQL database to do their table lookups. On a platform where I had to architect, compile, link, and package everything myself, because I didn't want Sendmail so I ripped it out and then had to seamlessly integrate the MTA of my choice with the OS. (I used to admin Sendmail for a living back in the day when SASL and TLS were science fiction.)

It's a nightmare. I postponed this for 15 years knowing how bad it will be. It's far worse than that. During the last two years while I've been trying to figure it all out, I seriously thought about ditching e-mail altogether. The last year was spent reading various documentation.

The DNS MX records aren't even in yet, and I already see port scans and hack attempts on port 25, probing for security flaws and configuration errors, already trying to exploit my MTA infrastructure.

And before I go live, I have to recompile OpenSSL, SASL, antivirus and the MTA at the minimum, to get all the security fixes rolled in. I'm not even done yet, and the antivirus engine is already complaining that it's outdated.

It's a nightmare.

<comment><USER2> > The DNS MX records aren't even in yet, and I already see port scans and hack > attempts on port 25, probing for security flaws and configuration errors, > already trying to exploit my MTA infrastructure.

So? How many webservers are constantly _trying_ to exploit your web browser infrastructure? It's just that you don't have a log file that's telling you about it, but that doesn't mean it's not happening. And in any case, it doesn't really matter. Just because someone is testing whether your web browser is some ancient internet explorer, doesnt mean there is an actual risk to you, unless you are running an ancient internet explorer.

> I'm not even done yet, and the antivirus engine is already complaining that > it's outdated.

Just forget about antivirus, it's snakeoil anyhow?

</comment></comment><comment><USER3> That chart has some issues [http://danluu.com/dunning- kruger/](http://danluu.com/dunning-kruger/)

</comment><comment><USER21> Every time I read an article like this (the "I am certainly not writing this to defend Hillary Clinton, [but let me use the piece to subtly defend Hillary Clinton]"), I check the author's professional associations:

 _Nat Meysenburg is a technologist at New America's Open Technology Institute_

Ahh yes, "New America", who runs that again? Oh right, long-time Clinton lackey Anne Marie-Slaughter who was "devasted" when she thought Hillary criticized her a little bit that one time [0], along with Google's Eric Schmidt who runs a stealth startup for Hillary [1] named "The Groundwork" complete with an Illuminati-esque logo [2]

[0] [http://www.politico.com/story/2015/11/hillary-clinton- emails...](http://www.politico.com/story/2015/11/hillary-clinton-emails- slaughter-216285)

[1] [http://qz.com/520652/groundwork-eric-schmidt-startup- working...](http://qz.com/520652/groundwork-eric-schmidt-startup-working-for- hillary-clinton-campaign/)

[2] [http://thegroundwork.com](http://thegroundwork.com)

<comment><USER22> Isn't it a little cruel to these people's agency to reduce them to "Clinton lackeys"?

Not to mention that it's pretty normal to feel at least a bit bad when someone you were working for and admire says you're whining whenever you talk about your difficulties.

Plus I'm pretty sure Schmidt is beholden to no-one at this point. "Fuck You" money is an understatement....

Though I can get these people rationalising a defence due to emotions, I don't think there's a big web of conspiracy. Popular people get defended by a lot of people...

<comment><USER23> I enjoyed how you attacked his use of the word lacky while ignoring his accusation.

Kind of like how he was explaining how the author didn't outright defend Hillary, but subtley did defend Hillary.

</comment></comment></comment><comment><USER24> He really doesn't describe why it can't be done other than some vagueries. I'm willing to bet a good chunk of people here could run a fairly secure email server (it's not like Google hides it's emails from the NSA anyway.)

</comment><comment><USER25> I'm toying with setting up my own email server so that I can use all the prefixes for my domains. Ideally it would make managing my actual mail so much easier.

However. I know setting it up is a PITA. And if I move to it I am stuck with it.

The various mailinabox solutions sound great, but I can't quite tell if they do what I want _and_ email is too damn complex to vet myself. And they need an entire bloody box because they don't play nice with containers apparently (on last google) - all to securely parse some text files. Overkill or what.

</comment><comment><USER26> I haven't found a cloud email service which will let me keep my procmail filters. (A group-3)

<comment><USER27> Fastmail lets you write sieve filters. Not exactly the same but you could port them over, right?

</comment></comment><comment><USER28> Came here thinking I would learn something. Learned literally nothing reading this article.

Reminded me of this other gem article: [http://www.clickhole.com/blogpost/if- black-lives-matter-isnt...](http://www.clickhole.com/blogpost/if-black-lives- matter-isnt-racist-hate-group-then--4610)

Basically trying to prove a point with very... umm... poor arguments :)</comment>


Lessons Learned from a Shark Tank Survivor - <AUTHOR> http://neiljoglekar.com/lessons-learned-shark-tank-survivor/

<comment><USER2> How would you address their concern that you should have been able to raise 250k from SV VCs? Also, Shark Tank valuations seem so low compared to Valley (or YC) valuations that I'm curious how you came up with the offered terms.

<comment><AUTHOR> I did answer it, but they edited it out. I think it probably deserves another post.

</comment></comment><comment><USER3> A former client was on Shark Tank. The pitch in-studio was 2.5 hours and of course only 7 minutes was aired. The interest it generated (in terms of downloads) was enormous. It nearly filled the Heroku database during the show - which we quickly upgraded after it aired.

A good metaphor for the negotiations before and after airing and the actual on-air pitch is an iceberg. 5% is visible on-air and 95% of the interactions with the sharks and their team is never public. What actually happens in terms of an investment may never be made public - from promise to make a deal that falls apart to an on-air rejection that is later turned around into an investment.

<comment><AUTHOR> I that's a pretty apt description - there is a lot that goes into this behind the scenes.

</comment></comment><comment><USER4> I find that Shark Tank is a great learning experience just from a viewers prospective. I think, even with the added dramatic flare, that you can learn a lot from the 5 sharks that are sitting in that room at any given time. It is an enjoyable free class on entrepreneurship, as well as a view inside the mind of a millionaire to billionaire that one does not get access to very easily.

Unfortunately I think a large amount of that education is lost on the general TV watching public.

<comment><USER5> Unfortunately, it is not free. You have to have cable to watch it in most cases.

<comment><USER6> Its on ABC. You don't need to pay for cable for access to ABC.

</comment></comment></comment><comment><USER7> The pajama idea seemed to play pretty well for you, I noticed it when watching the episode. All of the sharks seemed surprised by both of your backgrounds after the first impression.

How much of a bump in sales/interest have you gotten from being on Shark Tank?

</comment><comment><USER8> I'm not sure if it was cut out but you didn't seem to explain how your product determines the appropriate time to wake you up.

</comment><comment><USER9> I wish i knew what the hell he's talking about, but ABC doesn't like dirty foreigners being interested in their content it seems.

<comment><USER10> More likely the production company (Mark Burnett or whoever's running it nowadays) did not negotiate the overseas licensing with ABC.</comment></comment>


Rails 2.2 Released - 27 Links and Resources To Get You Going - <AUTHOR> http://www.rubyinside.com/rails-22-released-27-links-and-resources-to-get-you-going-1354.html <comment><USER2> The new Rails release appears to have some great stuff in it -- definitely time-savers for those people already up-to-speed with Rails. At the same time, the dynamic state of Rails makes it difficult for small dev teams to keep up with the state-of-the-Rails-art, IMHO. I spent some serious time with Rails and always wondered if I was writing sub-optimal code. There are so many ways to approach any programming task with Rails, that I, personally, felt like I could never definitively prove that my way was the best way. And, every time a new release came out, I had this feeling that I should go back and change all of my code to take advantage of all the new features (in addition to making the changes necessary to make it compatible with new releases), which pretty much negates many of the productivity benefits afforded by Rails. If, for example, I had rolled my own i18n solution, would I now go back and rip it out and replace it with Rails' solution or keep it in place?

In the end, as some people do, I wrote my own framework (in PHP) and couldn't be happier. Yes, I don't have a lot of the bells and whistles of Rails and others, but my framework is stable, I know the optimal way to utilize it, and when I do update it, I do it with knowledge of how the changes impact the code that is built upon it.

I drifted a bit off topic I guess. My point is that, while I appreciate the 27 links (out of perhaps hundreds of soon-to-be available links on the new upgrade) that help people navigate the fresh Rails waters, I have to wonder... is the fact that hundreds of people feel the need to document their experiences with rails updates, how to utilize the updates, and the gotchas associated with the updates, an indicator of a hidden cost of using Rails that negates some of the benefit?

<comment><AUTHOR> I would upmod you with several points of my own karma for this if I could :) Yes, you're right. The upgrades come some thick and fast that code soon goes out of date and can even be viewed by the community as "bad" - yet it was using standards that were "good" months earlier!

The way I tend to look at it is like a car. If I have an old app, I treat it like an old car. I'll keep it updated where necessary, but I'll stick to the style of its times. If lots of new gee-whiz features are needed, I'll start a new app. This is less than ideal in certain environments, but if you're agile, working on your own projects, or have the right mindset, it's quite refreshing.</comment></comment>


Spectral Evidence for Hydrated Salts in Seasonal Brine Flows on Mars [pdf] - <AUTHOR> http://meetingorganizer.copernicus.org/EPSC2015/EPSC2015-838-1.pdf <comment><USER2> It was already known that liquid water can exist on about half of Mars, though in a very narrow temperature range (around 0C).

The green and blue bits have the adequate pressures for liquid water to exist:

[https://upload.wikimedia.org/wikipedia/commons/2/2c/Mars_top...](https://upload.wikimedia.org/wikipedia/commons/2/2c/Mars_topography_%28MOLA_dataset%29_with_poles_HiRes.jpg)

Very narrow phase-space in which liquid water can exist, the yellow rectangle is conditions on Mars:

[https://i.imgur.com/BeDg1KM.gif](https://i.imgur.com/BeDg1KM.gif)

</comment><comment><USER3> This isn't the big news scheduled for tomorrow, is it?

<comment><USER4> My layperson's opinion is that it is.

The paper reports data indicative of transient liquid salt* water flowing on current day Mars (as in, in the past year), answering the "mystery" of the apparent daily sand flows in pictures previously seen.

That's sort of huge, because wow at confirming liquid water there pretty much right now, but it's also a bit of a hollow thing to reveal, as it's just solid confirmation of something strongly suspected for many months.

* Exactly _what_ salt is not super clear, I think? Mg-perchlorate and Mg-çhlorate are mentioned, but the exact mineralogy isn't able to be stated from the current results.

<comment><USER5> Yeah, it's cool, but it's not really a "major announcement."

Still, science marches forward.

<comment><USER6> From my perspective this is pretty major. It was not very long ago that we had no proof of liquid water on any other rock in our solar system.

<comment><USER7> We know that Enceladus and Europe have liquid water.

<comment><USER6> The proof for both is from this millenium (from Galileo and Cassini probes). To me it's still fairly recent. While I find the principle of induction does trivialize lot of mathematical calculations I cannot apply the same principle of non-wonderment to discoveries made in the material world.</comment></comment></comment></comment></comment></comment>


The Next Engine Yard Programming Contest is Live - <AUTHOR> http://www.engineyard.com/blog/2009/programming-contest-and-the-challenge-is-measure-rails-momentum/

<comment><USER2> A pretty bad idea for a contest. Mass-scraping twitter gives a clear advantage for those who know the right people and an awful waste of time for everyone else. The last one was cool. I want to do the last one again.

</comment><comment><USER3> yawn.

</comment><comment><USER4> Pass.

Sounds like they've been reading too many Google interview questions.</comment>


Strategy: Drop Memcached, Add More MySQL Servers - <AUTHOR> http://highscalability.com/strategy-drop-memcached-add-more-mysql-servers <comment><USER3> I would tend to disagree with that strategy.

First, memcached is fast. Allocations are made in O(1) time (think: scales infinitely) and is non-blocking. Anytime you want to look up an object, you just call for it.

With sharding, the process is more difficult. First, you query for the shard of the object, then you query that shard. OK, not too bad. What happens when you want to get all the friends of Adam? Well, you query for Adam's shard, get the list of his friends, then query for each of those friend's shards, then query each of the friend's shards for their data? Ugly, slow, gross! OK, so you denormalize! Only problem with that is that you then have to do a lot more queries on writes (which are the hard part to begin with). Plus, what if you want to search for users named 'Bob'. Well, typically sharding involves a setup like table, pk, shard - to relate an item to which shard it's on. If you're looking up by the primary key, you're gold. Not so much on the other fields. Yeah, you can query each shard, have it send back results and combine them yourself - in fact you could even automate that process in a proxy - <USER2> it isn't the most wonderful solution.

That scenario in memcached works much nicer - mostly because memcached is basically a sharded database to begin with. You don't have to look up which memcached server an object is on. Just pass it the ids you want ('person:5', 'person:22', 'person:900') and it will grab them from the appropriate shards and send them back! The problem is that memcached doesn't keep multiple copies so it can't be used for persistence. No problem, MySQL will handle that!

What's really missing from the whole debate is that when you get to a certain point in your application, you just don't get to query like you used to. With memcached or sharding, you're going toward limiting yourself to keys - somewhat similar to Google's BigTable (a dumb store).

With AppEngine, Google took a huge step to making this more usable to programmers. By adding an index on each field (with the option for indicies on multi-field lookups), AppEngine allows you to have a sharded database without sacrificing some querying capability. So, the big question is, why isn't someone developing a system that works like that - spews your data all around, but keeps an index available for some query capability? In fact, AppEngine's datastore queries work shockingly similar to views in CouchDB - look at how scanning a range is done in each and you'll get an idea.

In the meantime, MySQL/memcached in combination allow me to take advantage of both sharding and querying with relative ease. So, I save Bob as a friend of Adam in MySQL, then I update the entries in memcached for each of them by querying MySQL for their records and friend_ids and put {'id': 12, 'name': 'Adam', 'friends': [1, 212, 78, 51]} and {'id': 212, 'name': 'Bob', 'friends': [12, 491, 51, 999]} into memcached. When I want Adam and his friends, I run two memcached calls - give me 12, give me (1, 212, 78, 51).

That isn't perfect, but it can be a lot easier than sharding. At some point, it becomes requisite to shard, but it's not fun so why not use memcached along the way? "Don't prematurely optimize" comes to mind.

</comment><comment><USER4> Better strategy: drop MySQL and move to postgres.

<comment><USER5> This seems to be the mantra of the PostgreSQL fanboys.

I use PostgreSQL. I have found, in my experience, that it has superior join performance when compared with MySQL and that's what is important to be in my line of work. That said, I'm not silly enough to think that performance = scalability. Neither MySQL or PostgreSQL scale naturally. They require strategies to be implemented whether that be sharding, caching, replication, etc.

This just isn't a useful suggestion for scaling.

<comment><USER6> There is so much ink spilled about going through conniptions to scale mysql and postgres. I really wonder if anyone has actually bothered to confirm that it's not better to just buy some big iron and run db2 or oracle once you hit scalability problems. There are a ton of corporate data centers running oracle/db2 handling WAY more throughput than your web app ever will, and they're not using memcached or sharding.

<comment><USER7> It's a build-buy decision, right?

When you're seven guys sitting in a garage eating pizza, you build it because it makes the most sense.

If you've got a million records going through an hour and you're making the big bucks, get the commodity solution as close to wholesale as you can.

The problem is that if you're giving away your app for free, you're spending dough -- perhaps lots of it. Then you're stuck on the back-end of the curve, scrambling to tweak every little bit you can.

<comment><USER6> > It's a build-buy decision, right?

Exactly, but the entry level DB2 and Oracle solutions are not super cost prohibitive and time is money. We're talking about a pretty low man-hour investment in futzing with MySQL before you'd have been better off calling an IBM rep. If you're doing some popular free web app maybe you can stick a "powered by IBM" icon in the corner and get the stuff for free. Remember those?</comment></comment></comment></comment></comment>


Building a Python Web Application, Part 1 - <AUTHOR> http://blog.paulbonser.com/2008/06/26/building-a-python-web-application-part-1/

<comment><USER2> Read how I built Reddit River using Python at:

[http://www.catonmat.net/blog/designing-redditriver-dot- com-w...](http://www.catonmat.net/blog/designing-redditriver-dot-com-website/)

(source code included)

<comment><USER3> very cool! thanks for the link.

</comment></comment><comment><USER4> Odd... this page is broken in safari.

<comment><USER5> I'm glad someone else saw it. I thought it was one of my Greasekit scripts.</comment></comment>


The Sin in Doing Good Deeds - <AUTHOR> http://www.nytimes.com/2008/12/25/opinion/25kristof.html?_r=1

<comment><USER2> If an organization is turning a profit for its owners or shareholders then it's a business, not a charity. That's a definition, not a moral judgment.

There are lots of businesses that do good work for people. The tricky part is when you're soliciting for donations, you just need to be extremely transparent about where the money is going.

What we need is not a rethinking of what a charity can be, but a rethinking of what a business can be.

<comment><USER3> My first business was designed with two purposes: to earn a profit, and to support artisans in developing countries. Was it a business or a charity? Well, its legal structure was 'business' but its purpose was not only to earn a profit for me. I would consider it a failure if it had only helped myself, because that was not why I started it.

So I don't care whether you call it a charity or business. What is important is clearly understanding your purposes and means and making damn sure you communicate them well to the people who matter for your success.

The important realization I had was that it doesn't matter what traditional expectations are. As long as I stayed within the law, my limits were simply defined by the agreements I could make -- with artisans, with customers, and with all the other players in-between.

Later on I went to university, and that was the first place I was confronted with this inane idea that it was a structural necessity for a business to be driven solely by profit, etc. etc. -- as if this was an immutable law which transcends human nature and society.

I didn't get into business only to live up to expectations that society has created, as though I was a gas waiting to expand to fill whatever chamber I was put into. I got into business as a way to express myself through thought and action in whatever ways might lead to the most impact.

</comment></comment><comment><USER4> I think part of the fear regarding for-profit aid organizations is this: the pursuit of profit will create an incentive for organizations to follow the money.

As a result, more resources would be allocated for the problems in more wealthy nations (ie. cancer), while problems in poorer regions would be neglected (ie. maleria). The same problem would exist even within a nation through existing class divisions.

While this schism already exists today, an increase of for-profit aid organizations/charities will probably exacerbate this divide.

In the end, this discussion opens a whole host of ethical issues and philosophical questions. Life is rarely simple.

</comment><comment><USER5> Obviously people aren't very aware of how much the CEOs of various not for profits make. The CEO of United Way for instance makes over $500K. All of this can be investigated on Charity Navigator.

</comment><comment><USER6> _In the aftermath of a wave of criticism, his company collapsed.

One breast cancer charity that parted ways with Mr. Pallotta began producing its own fund-raising walks, but the net sum raised by those walks for breast cancer research plummeted from $71 million to $11 million._

But because his company collapsed, the true comparison figure that Mr. Pallotta raised became $0 million. As a business, it didn't succeed. And he's blaming the world. People often give to charities to feel charitable, and having a profit-motive undermines that - even if the result is that less money is raised. This is because people making donations are often fulfilling a need to give and help people - not by what is best for those being helped. The latter requires a kind of ruthless saint, quite different from the human motivation of brotherly love.

In contrast, ordinary businesses helps people, or else no one would give them money. A fantastic example of this is Grameen Bank "microcredit": [http://www.grameen- info.org/index.php?option=com_content&...](http://www.grameen- info.org/index.php?option=com_content&task=blogsection&id=8&Itemid=170) Usury (interest for credit) has got to be pretty much the opposite of charity, yet it seems to do tremendous good.

</comment><comment><USER7> The problem is that there are many qualified people in charity work who make barely-subsistence wages who would likely do an as-good or better job with far less pay.

So, for the most part, my guess is that $500,000+ salaries are a form of rent seeking, and are not justified in the so-called marketplace.

It'd be nice if someone could crash together the stats and see if this intuition bears out. You know, look at percentage of donations used to actually help their stated cause, and see if having a super-star CEO actually results in a more well-capitalized charity.

I doubt it, but I depend on evidence, not ideology.

<comment><USER8> Did you read the article at all?

Take the case of the breast cancer charity which, from the article, was pulling in $71mm from charity walks using his services. They stopped using his services and continued the walks and are taking in $11mm now.

You might argue that several other variables might have also changed, but a 6.5x factor is hard to ignore.

<comment><USER7> I read the article. I wouldn't call one anecdote data, though it's about 1/10,000 of a good start.

<comment><USER9> That's a little harsh. It was a pretty significant anecdote - a 6.5x decrease with the only clear change being Pallotta's company-charity being forcibly stopped from continued involvement. Is there room for other plausible reasons to have caused the drop? Definitely. And of course if, hypothetically, Pallotta's company-charity was involved with sufficiently many causes, you would even expect there to be at least one anecdote with such a substantial drop. But to call it "1/10,000 of a good start" is much more unreasonable and illogical than thinking the anecdote might be of worth.

<comment><USER10> _a 6.5x decrease_

That would be negative 5.5 times, or 5.5 times below zero.

</comment></comment></comment></comment></comment><comment><USER11> Renumeration is tricky for charities.

In a public company, and to a large extent a private company, the bottom line is the bottom line. Investors invest, and they want money out of it. As long as it's legal, anything goes to get that profit.

In a charity the bottom line is providing some much less tangible benefit to someone or something. The bottom line is a much fuzzier concept. The benefit is harder to gauge than when you're just looking at a number of currency units.

<comment><USER12> Indeed. People give money to charities because they want to help a cause, not because they want to help the chief executive get paid lots of money.

<comment><USER13> No. That's exactly the point: people don't give money to charities to help a cause, they give money to _feel good._

If they gave to help a cause, then they would support whatever (reasonably ethical) methods best helped that cause. The fact that so many donors bitch about frankly miniscule CEO compensation proves that the majority of them are not in it to improve the world -- or at least that there are other things they want out of their donation.

<comment><USER3> I don't know anyone who actually gives just to feel good. Feeling good is a by-product of giving, but only because you've done something worthwhile (or so you believe).

That people bitch about CEO compensation doesn't mean they don't want to improve the world. They bitch _because_ they want to improve the world, and they believe that high CEO compensation (as they perceive it) is a modern evil that stands in the way of improvement.

<comment><USER14> I agree.

Also, they bitch because it's hard to measure performance directly. The best we can do is often look at the % of administration vs programs vs fund raising. Even there you can have a lot of funky accounting.

If you really want to get into it, we can look at the names & brochures of the individual programs. Going all out, we might news search the names of the programs to see what news references we come up with.

We know that charities are inefficient. But we can't work out who or how. Charities don't have ROI or p/e. So we look at things like CEO salary.

</comment></comment></comment></comment></comment><comment><USER15> [http://www.amazon.com/Uncharitable-Restraints-Nonprofits- Con...](http://www.amazon.com/Uncharitable-Restraints-Nonprofits-Contemporary- Perspectives/dp/1584657235)

</comment><comment><USER16> It's not that complicated: If you are collecting donations from people (i.e. they give you something for nothing), then you must not make a profile.

If you are getting your money in other ways, then go for it.

<comment><USER17> It's not that obvious where to draw the line. Executives of charities need to get paid. And because charities deal with large amounts of money, mismanagement can be very costly. By increasing the salary of the executives you can get more qualified people. As a result, the charity becomes more efficient and effective and everybody's happy.

Often charities have billions (?) of capital. If they hire a local private bank to look after the money they will have to pay for it, and the bankers will be driving porches. But if they manage the capital in house they suddenly can't compensate people for it similarly, because they're still a charity?

Charity.

Raise money: OK

Spend money: OK

Save money, use part of savings as bonus: Evil?

I haven't really thought this through, so my logic could be flawed. Still, I think that most charities should become more business-like. (Good) Businesses are, after all, all about creating value.

<comment><USER16> No, they are paying people to make more money with investments or whatever - that's fine, do what you want - the money comes from the investment income, it doesn't matter if it's inhouse or out.

But if you pay people from donations directly then it's not OK to pay a lot.

Are you paying people to get more donations (no good), or are you paying people to make more money in some other way - including by saving you money (...more efficient and effective....), then it's fine.

Basically if by paying people you will end up needing to collect less donations - or you use those more effectively, then I'm fine with it.

But if you pay people to work on methods of getting more donations in the first place, then I'm not OK with it (if it's excessive, more then a few %) - even if it means you have more money in total.

<comment><USER18> >But if you pay people from donations directly then it's not OK to pay a lot.

Unless the donator is aware of the fact that you are paying your employees with the donations, and choose to give anyway. In fact, most large charities have employees who get paid, usually out of donations :). But you don't make your decision based on their management process, but based on the service they provide you; namely aiding some cause on your behalf.

You don't decide whether or not to buy a burger at McDonald's based on what percentage of your dollar goes to the CEO, but based on the quality of the service they may provide. Same with charities. If a charity can get away with paying exorbitant amounts to their CEO and still be the best value per dollar, people will donate, and it won't be wrong. Maybe the reason they do so well is that they were able to hire great high level management.

However, to convince people that you were going to spend their money one way and then actually spend it another is fraud. If you paid McDonald's for your burger, and they didn't give it to you, you would be within your rights to sue. At the very least you wouldn't go back. So it is with charities.

It is perfectly fine if you feel that a particular charity spends too much on management, and therefore decide not to donate your money to them. I realize that you may have been stating your personal opinion as to how you decide which charities you donate to, and that's fine. But to then claim in newspapers or other places that because they don't match your standards they are objectively evil and should be shut down/boycotted is a completely different thing. I think that is more what the article is about.

<comment><USER16> But I do actually make my decisions based on their management process. Personally if they spend more than 5-10% of the money on administrative expenses I don't donate. And BTW that cuts out the vast majority of the charities, I think (wild guess) that most spend around 50%, and some as high as 75% (police fraternities for example (again, wild guess)).

The newspaper example, I think, was more a case of the person not being upfront about it.

Also, I personally think that if the charity money did not go to him, it would go somewhere else. So by him consuming 50% of the donations for his own pocket he is reducing the amount of charity money in the world.

Others might disagree and say that if he didn't get the donation, no one would. So you might as well allow him to exist.

If that's your opinion fine. But I feel that even if the second case is the real one I _still_ am not OK with it (but I think the first one is what actually happens).

</comment></comment></comment></comment></comment><comment><USER19> Wow. An editorial on the NY that makes significant economic sense and goes against the liberal ideology. This is a first.

On the op-ed itself. I don't understand why anybody considers profit evil if said profit is not gotten through fraud or coercion. Exactly what is so evil about making money? Furthermore, all donations to charity are completely voluntary _and private_. Whether for-profit charities are evil or not is not something to the public at large to decide. We have no business passing judgment on any charity unless we happen to be one of the donors (and even then, clauses from their contracts apply). Lastly: if I was donating to a charity, I would not be concerned by how much they got in profit or how much their chief manager was paid. I would be interested in what I was giving them money for: how effective they were is helping the people they claimed to help.

<comment><USER20> > I don't understand why anybody considers profit evil if said profit is not > gotten through fraud or coercion.

For example, Marx said that more capitalism logically leads to subsistence living conditions for the workers. He gave arguments for this. I think they are mistaken, but if you are wondering why people think profit is evil, that's a reason. Marx said that without fraud or coercion, and just free trade, most people will have very bad lives.

And, yes, obviously one can live in the US for a lot less than minimum wage, and be doing a lot better than the subsistence conditions Marx had in mind from his own time period. So Marxism is blatantly, factually inapplicable to the US (whether that's b/c Marxism is false, or b/c the US has been saved by it's non-pure capitalism with govt intervention is not obvious just from the plain facts). Why people are blind to this is a tough question.

<comment><AUTHOR> I think the capitalism today is much tamer than the capitalism was in Karl Marx's time. My opinion is based on this [http://en.wikipedia.org/wiki/List_of_most_wealthy_historical...](http://en.wikipedia.org/wiki/List_of_most_wealthy_historical_figures)

At the time of Karl Marx, the wealth built by Rockefeller and Carnegie is such a big portion of wealth of the U.S. But when you look at Buffet and Gates, they are not as wealthy as Rockefeller and Carnegie were. Besides Gates and Buffet's influence on political power is limited.</comment></comment></comment>


American "economic refugees" are increasingly retiring abroad - <AUTHOR> https://www.cbsnews.com/news/retirement-crisis-economic-refugees-why-more-americans-are-retiring-abroad/ <comment><USER2> No surprise here. I took a year off to travel through central and south america and noticed:

America cost of living is really high, healthcare really expensive. You get a much better value on $ in Central or South America, and can collect SS or fly home to get medical - or get it locally for cheap. There are cities like san miguell de allende or san cristobal that are primarily expats in awesome climates.

If you don't have much savings, you can have a much higher quality of life in retirement in mexico or Colombia than europe/us.</comment>