Rate my startup: PagerDuty.com - <AUTHOR> If you've ever done pager/on-call duty, you're probably familiar with a tool like PagerDuty.  PagerDuty collects email alerts from your monitoring tools and sends out automated phone calls and SMS messages to the person currently on-call.  The app supports many of the usual amenities in an alerting system, such as retry of unanswered alerts, on-call rotations, and automatic escalation of unanswered alarms.
Many large tech companies like Google and Amazon have sophisticated in-house on-call management and alerting systems. We have tried to build something similar for small and medium-sized businesses running critical systems.
One of the big challenges in building PagerDuty was making it simple and intuitive to use. If you find the setup process (or any other part of the system) confusing please let us know.
http://www.pagerduty.com <comment><USER3> Looks very nice -- as a feature suggestion, a floating number that automatically routes to the currently on-call staff would be a great addition.

As an aside, I find the best way to avoid regular failures and decrease the necessity for a large operations staff is to put the individuals responsible for building the system on-call for when it fails. Your operations staff is woken up when a server crashes or a hard drive fails, and your engineers get woken up when their code crashes in the middle of the night.

If you don't do this, the costs of writing poor production code have to be levied across departments by management, rather than avoiding externalities entirely and letting engineers and operations deal with the direct impact of their implementation choices.

Of course, this is ultimately a wash if you don't also institute development methodologies to help reduce the number of production-impacting bugs, rather than simply relying on engineer's reactive fixes to one-off issues.

<comment><AUTHOR> Hmm... what do you mean by "floating number"? What we do right now is route all alarms to the engineer currently on-call. Each person can set up their own notification sequence so they get alerted using any combination of phone calls, SMSes, and emails.

<comment><USER3> A floating phone number that can be handed to, say, 24-hour support staff, that will automatically direct incoming calls to the on-duty engineer.

The value is that when support staff has real phone numbers available to them, they tend to dial historically responsive individuals directly in order to get a problem resolved, thus creating a negative feedback loop -- if you ignore notifications and phone calls, you get called less by support staff in the future.

Having a floating number -- especially if we could get statistics on who answers and who always ignores them, and if the number could "call up the chain" automatically when nobody answers, would be a useful tool to solve this issue.

Of course, the preference is that human staff doesn't need to call anyone, but it still happens.

<comment><USER4> Hi, this is Andrew, one of the co-founders of PagerDuty.

That's an interesting idea. We've actually thought a bit about adding phone- based triggering to PagerDuty (via a 1-800 number + access code). The idea was to make PagerDuty useful to non-IT businesses like plumbers that also have the concept of out-of-hours on-call duty. From your comment, though, it sounds like this kind of feature would be pretty useful even in the IT world.

</comment></comment></comment></comment><comment><USER5> This is a great tool. I really like the idea of parsing the email address for what type of alarm to use. That makes this straight-forward while at the same time making it incredibly easy to integrate with any existing alarming system.

The reply via SMS feature is excellent and something that I always want in any monitoring system.

I'm curious about the security around the email alerts, can anyone send to the specific email@example.com or can you add at least a 'FROM:' check?

You probably have this on your road-map, but if a ticketing/worklog system could be integrated with this, you could add an incredible amount of value for folks working on the problem in real time.

<comment><AUTHOR> We don't have a FROM check at the moment. I'm not sure how helpful this would be, since it can be arbitrarily spoofed by an attacker.

The email addresses for alarms are editable; if you get spam to one of these addresses, you can change the address. We were also thinking of adding an option to obscure the email address by adding a uid to the end. An example would be email@example.com.

We also offer regex-based filters on both the subject and the body, so you can configure an alarm to only trigger if a certain keyword appears in the message.

<comment><USER5> I like the uid idea or even having a unique passphrase in the subject of the email.

Granted, I'm thinking of monitoring systems on a much larger scale where even a single instance of spamming can keep the entire dev team up at night. I do not see this being a problem for the smaller targeted audience that you are going after that will initially only set up a handful of alarms.

</comment></comment></comment><comment><USER6> I think the idea is solid, but since I'm not in your target demographic, the only useful criticism I can offer is:

Your front page is very busy. There's many different kinds of text and pictures in so many places, I don't know where to look. Does the "feedback" link need to be in such an unusual place? I understand that you want to convince potential customers that your product is a good one, but if you throw too much information at people, they'll ignore everything you have to say.

<comment><AUTHOR> Thanks for the feedback scott_s. I thought the left middle side of the page was a pretty standard position for the feedback link; I've seen a lot of other sites that do this.

I do like the idea of making the design more minimal. I guess we are somewhat worried about the possibility of not explaining well enough what our product does.

<comment><USER6> I don't like floating elements like that; it's distracting. When I first load the page, it's _just_ lined up with the 'H', 'w' and the sign-up graphic. That feels out of place. Personally, I don't like floating elements like that because it violates what a website is, to me. I want to navigate through information, and I bristle when information is forced on me like that.

Consider the amount of "special" things you have:

\- Floating feedback link on the left

\- "Sign Up" link/tab is highlighted red. (This also means I have to use some small cognitive effort to realize "Home" is black because I'm there, "Sign Up" is highlighted, and the rest are normal links.)

\- "call you" in the blue banner is both bold and italic

\- Lead-in text is bold

\- "calls you" in lead paragraph is bold, italic and green

\- green check marks for the features list

\- Play button on your UI graphic

There's nothing inherently wrong with any one of these things, but they're all design elements that say "I'm important! Look at me!" But when I see seven competing things evenly spread out over the page saying "Look at me!" my first reaction is to give up and look at nothing.

I think it's possible to include the same amount of information, just presented in a clearer way. Personally, I think the star of your show are your UI pictures.

Of course, keep in mind I am, like you, a hacker, not a designer. But I'm taking the time to explain what I see because I think you've come up with a neat idea for what sounds like an untapped market, and I'd hate to see you run into problems because of simple presentation issues.

<comment><USER7> I agree with the positioning of the feedback tab. It's not so much that it is "out of place" but rather its just in a bad place at the moment. It's right between "stop sleeping through outages" and the big green sign up button. This is your headliner content, there should not be some flat rogue turned-sideways feedback tag conspicuously thrown over it.

As for the other points. Well this is clearly a 37 signals approach. If nothing else, it is good for SEO. I think most users will click on the video first anyway. So all the content acts to complement the video, which is a good thing.

</comment></comment></comment></comment><comment><USER8> This is awesome! I wish I had something like this back in 2003-2005 when I was one of four people on shared pager duty. Nowadays I just write perfect code ;) (and we have a dedicated and awesome ops team).

A couple suggestions...looking at your prelim pricing page, the prices look good, but I can foresee a problem with the notification system that accidentally sends way too many alerts. How will you accommodate that? It would be nice to have a grace period or some way of saying, ok we realize it was a mistake, we'll let this one slide but the next time you will be bumped up automagically to the appropriate pricing plan.

Also how easy is it to integrate with existing notification tools like Nagios or Cacti? Or is it just tied to email notificatons from those systems? That would be a downside if it's the latter. I've worked at orgs with truly crappy email systems that are down more often than not. Sending an email blast for a production system outage is likely to get it canned by the sysadmins.

Finally how does the phone call alerting work? Is it text-to-voice? Or pre- recorded messages? Is it customizable?

<comment><AUTHOR> We tried to design PagerDuty to minimize the possibility of message storms. We did this by decoupling the sending of alerts from the reception of triggering emails. Specifically, we don't generate new phone calls or SMSes if an already triggered alarm receives a new triggering email.

As for the pricing plans, we don't plan to bump you to the next plan if you exceed the limits. We have overage prices for each type of message (phone/SMS). So, going slightly over your quota isn't going to cause a really big bump in your fee.

Currently, PagerDuty only integrates with monitoring tools using email. We do have several customers sending their Nagios alerts to us. We are also planning to build a Nagios plugin to better integrate Nagios with our system.

We haven't actually found the email integration to be a big problem so far. What some of our customers do is set up some external network monitoring tool (i.e. Pingdom) to make sure their mail servers are up and running. Those services are in turn hooked up to a PagerDuty alarm so that we can notify the right person if a site's mail server or external connectivity fails.

Phone call alerting is text-to-voice. It tells you which alarm went off, and also reads you the subject of the error. What kind of customization are you thinking of?

<comment><USER9> I understand the desire to stop message storms, but in my 5 minute use case, I hit that and perceived it as a limitation and it makes it probably not usable for me, as I already have a good monitoring/notification/paging system that I was trying yours out as an additional notification vector. (That might place me squarely out of your target market, in which case you should ignore this feedback. :) )

Let's say I already have an existing monitoring service that sends emails on network events. I might decide to hook in your service and send my network faults there.

I get "port XX on switch YY link state down" and that gets routed through the system. One minute later I get "office of the CEO video conference network down" but pagerduty never sends that to my mobile device because I'm busy looking at the one port down alert.

Yes, I realize there's a technical solution to create multiple pagerduty trigger email addresses, but at a minimum, I'd encourage you to be more clear about that feature/limitation.

Overall comments: several UI elements were "not pretty" looking on IE7, and some of the call to action graphics "Create your first alert now" were bright yellow and rectangular yet not clickable. No deal-breakers, and I was certainly able to quickly get setup and trial alerts coming.

<comment><AUTHOR> Hi sokoloff, thanks for the feedback.

We actually support having the same email address for multiple alarms in the system. We also have regex trigger rules for each alarm, which are based on the subject and/or body of the trigger email. This means that you can set up a single email address, and trigger one alarm if "port XX on switch YY" is down, and trigger a different alarm if the "CEO video conference network" is down.

It might be easier to discuss your requirements over email. My address is alex[at]pagerduty[dot]com.

</comment></comment></comment></comment><comment><USER10> I looked into this and really like the idea of the service, but found there was one shortcoming that I couldn't get around. Perhaps I missed something, but I needed a much shorter escalation window than 15 minutes. If my site is down, I cannot wait for 15 minutes for the next person to be notified if the original person doesn't respond. It needs to be within 3-5 minutes, maximum. Perhaps this was configurable and I just missed it.

I really like this service and should the escalation change I would sign up in a heartbeat, it's exactly what I was looking for.

We left a comment on UserVoice, but I thought it couldn't hurt discuss here.

<comment><AUTHOR> Yes, we do support custom escalation times. You can set the amount of time that the Primary on-call has to respond to an alert (after which it is escalated to the secondary). Likewise, you can set the time that the Secondary on-call has to respond to an alert, before it is escalated to the tertiary.

This is configurable under the Settings tab.

</comment></comment><comment><AUTHOR> Clickable link: <http://www.pagerduty.com>

<comment><USER11> Meta HN discussion: this problem often crops up when people are doing "rate my startup" type posts. They want to post an intro blurb for HN people, so they can't link to the website. Does this smell of a feature waiting to be added to HN, or is it people using it "wrong"?

<comment><USER12> I agree that this should be discussed. One problem though is that it's not a problem in a normal web browser with a mouse, because it's really easy with a script or just a couple mouse clicks. It's just a problem with mobile browsers like the iPhone's.

</comment></comment></comment><comment><USER13> I especially liked the idea of taking action from the phone. And the site looks nice and clean. Do you know of any competitors in that field?

<comment><USER13> But the logo sucks. Pretty much a lot. Spoils the impression.

<comment><USER14> I second that, the logo looks like it's ancient. It looks completely out of place in amidst the web 2.0 look and feel of the rest of the page.

<comment><USER15> It looks a bit retro - but strikes me as being easily recognizable and suits the topic quite well.

Perhaps they should A/B test the logo - try <http://www.markiter.com> (shameless plug)

</comment></comment></comment></comment><comment><USER16> This is a no-nonsense product that people actually need in the field. I think small companies would find this indispensible, the preliminary pricing seems really attractive compared to competitors. And once small companies become big, I don't see any reason to switch to more expensive products either! This one has enough features even for the most critical applications.

</comment><comment><USER17> A couple of suggestions:

1\. Have the lightbox title text be more readable. Right now it is white on whatever is on the page.

2\. Have the call to action at the bottom of the page favor the sign up process. I would reuse the green button from the top of the page and leave the "learn more" link as text.

3\. The email based integration feature is fairly meaningless on its own. It is redundant if it is covered 3 items down with "Alerts via phone call, SMS, and email" I would personally cull out the overlap and have just a few key features on the right. Really only put the stellar features that you offer.

4\. To keep the logo more web 2.0 like the rest of your interface I would have the text framed in what looks like a pager but make the pager look 2.0ish.

Overall it looks as if this might be successful. I am not really in the market for it but I could see some smaller businesses jumping on board.

<comment><AUTHOR> Great suggestions, thanks for the feedback.

</comment></comment><comment><USER18> Your service looks awesome, especially the "we'll keep nagging you until you f...ing respond" aspect. I've looked at a lot of similar services in the last few months (you have no idea how relevant your startup is to me at this time), and I definitely am interested.

One thing I'm wondering about is why you have no international calls. I would love to pay (a lot) more money if you could support international calls. Without that, the service is only half as useful, and I will sleep only half as good during the night. :-)

<comment><AUTHOR> Yep, thanks for the feedback. We will definitely add international calling soon.

</comment></comment><comment><USER19> This looks very useful in keeping your monitored issues from getting dropped/missed b/c someone forgot to change the oncall phone number for that week,etc.

<comment><USER20> I was thinking about this the other day -- something like a Google Voice would work well for a support phone type of operation. I haven't done support in a long while, but last time I did, we would physically hand off a phone, which made for interesting times.

With either the newly oncall or the previously oncall being able to update the number, that handoff now becomes virtual.

<comment><USER4> There are a few problems with the phone handoff idea, though. One of the problems is there's no safety net: if the guy who has the phone doesn't pick up for some reason, the alert can't auto-escalate. That might be fixable with something like Google Voice, but I don't think they give you a way to manually escalate an alert if you know you can't handle it in time. In both cases, you probably have to manually roll over the number when someone new comes on-call, instead of having the system do that automatically from an on-call schedule.

We've actually been anxiously waiting to try out Google Voice up here. Unfortunately, they haven't yet extended their coverage to include Canada.

<comment><USER20> Sorry -- I didn't mean to imply that Google Voice was a competitor, rather to say that a Google Voice-like service (with many tweaks) would work perfectly for this goal.

</comment></comment></comment></comment><comment><USER21> Design is way too similar to the 37signals homepage...that was my initial impression. Will dig deeper into the site now.

<comment><USER21> actually, i take that back - it did immediately remind me of a previous homepage design of theirs...not the current one though

<comment><USER22> It looks like peashootapp.com which looked like basecamphq.com...

<http://peashootapp.com/>

<comment><USER7> wow, it does not _look like_ peashoot. It is a near-exact clone of the site! I'll leave my personal opinion of the matter at the door..just saying!

</comment></comment></comment></comment><comment><USER23> This looks really neat but it's not a runner for us as it's a 3rd party hosted solution.

Do you have any plans for a packaged version which companies can host themselves?

<comment><AUTHOR> Hello ook. Just shoot me an email at alex [at] pagerduty.com, and we can work something out.

</comment></comment><comment><USER24> Good idea, great start. I needed something like this in my own app and was considering building it myself. I'd prefer to use some other app to deliver these features tho. You should seriously look at a few of these points. I am breaking my comment into 2 logically separate comments (separation of concerns, too much of a coder :D)

<comment><USER24> Service features

\- You are assuming direct consumers of your service. Think of indirect consumers too. Other startups who can piggyback on your offering to add value to their own product.

\- Give an api where I can tell you the email message, sms message, various escalation options, option to repeat email/sms/phone after some delay if nobody responded. Also consider an SMTP api interface too. Not much of an effort for you if you already have the http api present.

\- The api should also accept email addresses, mobile numbers and phone numbers. I might be signing up paying customers and using your app to send them alerts. I should be able to do this without having to register each of these email/phone numbers to you. Think of your pricing in this scenario.

\- People mentioned ticketing system integration. Great idea. Extend it further. Also have an option where u will send the response back to the originating application.

<comment><AUTHOR> Thanks for the feedback pradeepgatram. We are planning to add the ability to integrate PagerDuty with external products (most likely products in the monitoring space). Please send me an email to alex[at]pagerduty[dot]com if you'd like to know more.

</comment></comment></comment><comment><USER25> Just signed up our small startup for this. We had a server on Amazon go down last week really hard - so hard that monit never said anything and we only knew because an external server does pinging on it every half hour or so. Will give this a try for more prompt phone calls!

</comment><comment><USER26> Don't show incremental user numbers in URLs for commercial services. It's nice to know you were one of the first to sign up for a community thing, but it's offputting when you're paying :/

The yellow boxes under "Follow these steps to get started..." look a little godaddy-ish

<comment><AUTHOR> Makes sense, we will fix the user number thing.

As for the getting started steps looking godaddy-ish, is that a compliment? :P

</comment></comment><comment><USER25> Set this up with some guys in my company and we're giving it a try today. So far, after going through the interface quite a bit, I decided that it's kind of confusion to reason about who is going to be called when. For example, you have timeouts for escalation and timeouts for consecutive notifications - <USER2> what point in your notification chain for a specific user does the escalation happen? Is it only after all types of contact have been exhausted? Or will secondary on-call be notified after the admin-settable X minutes (default 30) no matter what primary does?

</comment><comment><USER16> Your "feedback" button on the left of the main page overlaps the "Stop sleeping through outages" text when my browser window is not full-screen, this could be moved a little to look more professional.

</comment><comment><USER27> Have you considered having a plan where you actually pay "per alarm"? It would be appealing and you can still make easy money. I have in mind $10 per alarm or so.

<comment><USER26> A thousand times yes! Allow free signup, and send me a $3 SMS when an alarm goes off, avoiding any need for credit card billing.

Another option would be to have a purely prepaid plan, where your account gets debited based on alarms/users per-period, and per-incident. I'm definitely going to use this service while it's free, but I don't think I'd pay $120/year for it unless I had a web startup.

</comment></comment><comment><USER28> Awesome...I was just wishing for something like this yesterday...will definitely be giving it a shot.

</comment><comment><USER29> Looks like you're getting great feedback here, congrats. Without giving away proprietary info, is it possible to give some technical details such as what backend technologies you use, and who you're using to send SMS & phone calls?

</comment><comment><USER30> It seems easy to use but also flexible enough. What are your plans for pricing?

<comment><AUTHOR> The pricing page is here: <http://www.pagerduty.com/plans>

It is linked off of the FAQ, from the question "How much are you planning to charge for PagerDuty?". We didn't make any links to the pricing page off the main page because we want as many people to try the product out while we are in beta.

</comment></comment><comment><USER31> So what software manages the pagerduty for pagerduty? :-)

<comment><AUTHOR> I've been thinking of writing a blog post about this for a while... probably with the title "Who Watches the Watchers" :).

We use Wormly to monitor our site, email and DNS. We also have an exception reporting system which alerts us about any 500 errors in the site. We also alert if phone call or SMS messages sit in our event queues for more than 3 minutes after the scheduled delivery time.

We also have redundant data centers and rapid rollover to the backup systems in the event of a data center outage.

We don't use PagerDuty to do the alerting and schedule the on-call though. We alert everybody in our team via SMS and phone if any of the aforementioned alerts go off.

</comment></comment><comment><USER32> Do your phonecalls and SMS'es work outside the US?

<comment><USER4> We support two-way (i.e. we send you a message on an alarm, and you send back a message telling us to suppress, resolve, or escalate the incident) SMSing to most of the world. Unfortunately, we can only do phone calls to the US and Canada right now. We're looking at adding international phone calls in the near future, though.

</comment></comment><comment><USER33> Nice idea! Good luck.

I would make "phone calls, SMSes, and emails" much more prominent though. It took me too long to find how I would actually be alerted. There is a lot of fuzzy text on the site that makes it hard to scan.

</comment><comment><USER34> love the idea, great work.</comment>


Show HN: How to get control of your digital photo collection - <AUTHOR> http://photo-sorter.appspot.com/

<comment><USER2> I think there's already a Show Duplicate files in Picasa. What does this do that it doesn't? Does iPhoto have a duplicate finder?

<comment><AUTHOR> Its not about duplicate photos - almost every photo manager can do that.

But consider this - I've got over 25000 unique photos, never really been looked at or sorted. Nothing ever deleted.

I could use Picasa to go through them individually and tag/upload/share the good ones, but I'd have to remember where I was up to.

I could set up tags Good & Bad and tag them all like that and if Picasa could show me all the untagged photos that would help.

What PhotoSorter does is simply this - step through each photo one at a time and flag it as a keeper or not.

You can exit and resume from where you left of at any time, and export the flagged photos at any time.

So I'm using it as a convenient way to reduce my crazy photo collection to one that is worthy of loading in Picasa and manage/share there.</comment></comment>


The House Just Voted to Bankrupt Graduate Students - <AUTHOR> https://www.nytimes.com/2017/11/16/opinion/house-tax-bill-graduate-students.html?smid=tw-nytopinion&smtyp=cur <comment><USER2> Where's the law of physics that says the accounting practices and rules that states and universities presently use are set in stone?

The upshot of this is that the universities will have to change their accounting and bookkeeping. State legislatures might have to actually get off their duffs and pass some measures on an emergency basis. It's work for them, to be sure, but this is not an insurmountable problem.

In light of this, I think the headline is sensationalistic at best, misleading at worst.</comment>


Apple Sued Over Vanishing Texts After iPhones Swapped Out - <AUTHOR> http://www.bloomberg.com/news/2014-05-16/apple-sued-over-vanishing-texts-after-iphones-swapped-out-1-.html

<comment><USER2> Good. Apple deserves to be sued everytime they act like d*cks. This is unacceptable behavior from them. I've always thought that if they had 90 percent market share in the mobile market they'd act a lot worse than Microsoft ever did.</comment>


Ask HN: How do you scale up as a freelancer? - <AUTHOR>

My question is, how do I continue to sell my services and deliver them when my hours are completely booked and I can't take on any more projects?
The obvious thing is to outsource, but how do you distribute the earnings from a contract? For example, say you win a contract for $100,000, of what percentage should be paid to a subcontractor? Do you have to disclose how much the contract is worth and how much the subcontractor is getting paid? Would the subcontractor want to know how much he's getting paid vs the contract, would this affect his incentive? How many projects would an average subcontractor (web programmer) take on, and is it possible for them to work on more than one project at a time?
Or should you hire one subcontractor for each new project and put him on it?
Before I did freelancing, at my last job position as an developer, our boss told us to make sure our hours are close to 40 hours a week because he got a contract for 1000 hours and that we don't need to be pressured to rush through the project, is this cheating the client? Sometimes we would finish the work much faster (10 hours a week but bill for 40 hours), is the client getting ripped off? Should he be billed for less because we saved so much time?
When you are selling your development services, is it easier to sell when you have built a team of coders?
I actually really enjoyed getting prospects excited and explaining the technical details, and then asking for the sale. My long term goal is to sell development services and give work to a team of subcontractors.
There's so many questions rushing through my head because I am excited at the future of crossing the line that defines "engineer" and becoming "sales" or maybe a boss (whoa whoa whoa keep your pants on son!)
If anyone can answer some of these questions or in general how you dealt with such situations, that would be so awesome. I had these questions for a while now, wondering how agencies are able to take on many projects at once and charge huge fees. Of how much of that project fee is actually going to the people who do the work? <comment><USER2> Patrick McKenzie (patio11) wrote about this topic in one of his newsletters. It is a must read.

[https://training.kalzumeus.com/newsletters/archive/consultin...](https://training.kalzumeus.com/newsletters/archive/consulting_1) (You can jump to the section "Scaling A Consulting Business")

He also did a podcast with Brennan Dunn on the same topic:

[http://www.kalzumeus.com/2012/10/10/kalzumeus- podcast-3-grow...](http://www.kalzumeus.com/2012/10/10/kalzumeus- podcast-3-growing-consulting-practices-with-brennan-dunn/)

      Would the subcontractor want to know how much he's getting paid vs the contract,
      would this affect his incentive?

Finding good & reliable subcontractors is hard. When you do find such a person, my suggestion is to be as transparent as possible with them. The most probable reason why this person (who we think is good) is subcontracting is either they can't get high value engagements on their own, or don't like the rigmarole of finding good clients. If that is the case, they _should_ understand the markup being charged by you.

In the end, if it is a win-win situation for both, they would understand and be happy with it. Of course, the assumption here is that they are reasonable but that you'll have to judge after working with them for a while. I write this as a person who'd prefer working as subcontractor at this point of time.

<comment><USER3> Those links are really an excellent place to start. Patrick (patio11) and Thomas Ptacek (tptacek) have also talked extensively about this in HN comments, and as far as I know are open to questions by email.

Two things that I can emphasize off the top of my head are:

1) It is easier to sell features, or weeks of effort, as opposed to billable hours. Billing by the hour is asking for nitpicky accounting. Bill by the week, or by the project (if you are confident about scope and effort) and you can simply exchange money for delivered value.

2) If you "hire" someone as a subcontractor, they are effectively trading some of their earning potential for paycheck security and not having to deal with rainmaking. This is similar to the deal a day job offers. Hopefully they understand this, but you should definitely understand this. You will be absorbing the bulk of the risk and responsibility. Relative pay should reflect this.

</comment></comment><comment><USER4> I agree selling hours doesn't feel right. Rather than bore you with yadda yadda, please go through the following slides: [http://www.slideshare.net/AnttiKirjavainen/a-minute-of- our-t...](http://www.slideshare.net/AnttiKirjavainen/a-minute-of-our-time-or- what-we-need-to-unlear-about-software-contracting) , [http://www.slideshare.net/juhailola/agile-contracting- killin...](http://www.slideshare.net/juhailola/agile-contracting-killing- bureaucracy) .

That might give you alternative ways to think about contracts. In short, because we aren't contracting right, all parties end up disappointed. I would say this is one of the main reasons why software projects fail. We sell too big projects (more likely to fail), buyers don't know how to buy (or what they need), we specify too much beforehand (and then stick with that...). There are so many traps.

Speaking of outsourcing it all depends on what kind of a relationship you want to build. I think some of this depends on legislation (ie. hire vs. buy). Construct incentives so that they are win-win.

<comment><USER4> Blog post related to the first slides: [http://thehoustonway.com/2013/02/25/fixed-scope-fixed- price-...](http://thehoustonway.com/2013/02/25/fixed-scope-fixed-price- contracts-never-worked-in-it/) . Maybe that'll help.

</comment></comment><comment><USER5> I too have had to ask myself this question. But generally my conclusion is that I would try to hire contractors when I'm reaching capacity, i.e. consistently 50+ hours a week of work (don't forget you still have to spend some time that isn't related to generating income, i.e. invoicing, accounting, proposals, etc). Try to work with sub-contractors, who you know you can hire in an ad-hoc basis, but are still of a high quality.

Once you start to reach the next level of growth, i.e. consistently 70+ hours a week of work I would look at hiring someone full time, or at least first in a longer term capacity.

</comment><comment><USER6> Freelancing is essentially piecework. It always comes down to dollars for hours, though the rate may be high. People quit for better jobs or to start their own business. Computers don't.

Therefore it doesn't scale in the way SAAS or an application might.

</comment><comment><USER7> I had a friend who had a decent size consulting company and then a rather big name client didn't want to pay after he already paid the workers. When he started trying to collect they sued him. I'm not trying to discourage you but it's a whole different game. if there's a communication breakdown your stuck in the middle. What happens if your subcontractor codes something won't release the code until you pay him/her more. Also if someone is overseas what recourse do you have if they don't deliver? Are you going to sue them in another countries court system? Your first thing might be to consult a lawyer and a good accountant?</comment>


Facebook May Roll Out Video Chat - <AUTHOR> http://mashable.com/2009/05/15/facebook-video-chat/

<comment><AUTHOR> The real question is: will this be a feature of the quality that facebook has been doing lately? Or is it going to be unreliable for a long time before it actually works?</comment>


Medical Equipment Crashes During Heart Procedure Because of Antivirus Scan - <AUTHOR> http://news.softpedia.com/news/medical-equipment-crashes-during-heart-procedure-because-of-antivirus-scan-503642.shtml <comment><USER2> "Merge says the antivirus froze access to crucial data acquired during the heart catheterization. Unable to access real-time data, the app crashed spectacularly.

The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the medical unit's side."

Here's how I read that: The programmers of this piece of software assumed that some I/O operation would never fail and when it does the program shits itself. So instead of hardening their software to withstand loss of telemetry gracefully, which would cost time and money for the company, they just give instructions to disable scans on their folder.

Odds are good that somewhere this scan will happen (and it did). Either IT doesn't read the release notes or goofs the configuration or an antivirus update clears the white list. Might not even be the antivirus that interferes with the telemetry briefly.

But instead of having resilient software it's "the anitvirus software's fault" or "it's IT's fault" when something goes wrong because of their bad management/engineering decision.

<comment><USER3> Software shouldn't necessarily try to account for errors in that manner. Usually, the most graceful thing to do is to exit cleanly.

For example, if there is a massive amount of data, it has to be stored on disk. It's too large to keep in memory. And if the point of the program is to transform that data in real time, then it has to have access to the disk.

The antivirus basically unplugged the disk. What can it do to recover? There's nothing to be done.

It should be able to survive that situation, of course. When the disk is plugged back in, it should be able to restart without any problems. But I think that's a different kind of resiliency than what you're referring to.

In this case, the only way to recover would be to copy the frozen data to a new area of the hard drive, assuming it retained read access. But such complexities result in brittle implementations, prone to acquiring bugs. What if the disk space runs out? So you check beforehand whether there's enough space. But what if some other program starts consuming disk space in the middle of your copy operation? And so on. It's an endless spiral of design complexity.

The situation in the article seems closer to hardware failure than a design oversight.

<comment><USER2> > When the disk is plugged back in, it should be able to restart without any > problems. But I think that's a different kind of resiliency than what you're > referring to.

Yes and no. I was referring to restarting internally when the error condition went away but restarting the app and waiting for telemetry to return can be a valid solution.

Think of your torrent software. If you crank your firewall to block it while it's running it will not crash. If your disk fills up it won't crash. When the network comes back or more drive space if freed it will restart it's internal mechanisms. You wouldn't want it to restart in these conditions. If it runs out of memory however choosing to exit might be the best recovery mechanism.

I think a life critical medical application can at least strive for internal restart and do an external restart if all else failed. The article stated they had to reboot the machine to get it back. Now that's way worse.

> The situation in the article seems closer to hardware failure than a design > oversight.

Hardware failure is almost always a permanent condition. This was a "my I/O stopped briefly and would have came back if my code could handle it".

<comment><USER3> During a surgery, the program doesn't have the luxury of showing a screen that says "No telemetry available." Such a program would be considered equally unreliable. Worse, it would lead to confusion: "Why is the telemetry unavailable? What does 'Error Code 2931' mean?"

A spectacular crash immediately led to pinpointing the problem: The antivirus.

If the program's sole purpose is to transform a massive amount of data in real time, it must have disk access by definition. It can't not have disk access. What would you suggest it do?

<comment><USER2> Yes it does! Showing "no telemetry available" is exactly what it should do. Crashing = unreliable. Reporting an error condition = reliable.

Immediately? Took them 5 minutes to reboot the computer. The scan of the folder would take seconds let alone minutes. Pinpointing the problem is secondary. Not killing the patient is primary.

> If the program's sole purpose is to transform a massive amount of data in > real time, it must have disk access by definition. It can't not have disk > access.

And that is the mind set the programmers of the software had. You have to take care of error conditions. The processing can't have no disk access but no disk access can occur temporarily or permanently. What can you do? Pause the processing part of your program. Or make the processing part treat "no data" as valid input and display something else.

Imagine taking that viewpoint with an ECG machine: This machine displays a heart rate waveform. So it must have a heart rate input. If there is no heart rate we'll just crash requiring a 5 minute reboot.

Hell no! Draw a straight line and set off a buzzer!

<comment><USER4> I agree with you, but the flat line might not be the best example because that has a very specific meaning (asystole) that doctors will take certain actions based on without necessarily trying to verify it manually when time is already critical. You should never be able to confuse an error message for anything else.

<comment><USER2> > You should never be able to confuse an error message for anything else.

Exactly. Which is why "Can't read file sensors.dat" is way better than just crashing. Crashing is one of the worst error messages you can get because you don't know what happened.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> /rant/

I can't tell you how many times we've chased down field problems that ultimately were the result of antivirus scans. It's been so bad, that one of the first questions we now ask when we get a tool-down report is "is there antivirus running and what is the configuration?"

Bringing Windows into the architecture of any type of capital equipment control system is a bane. A scourge. I mean to say, it really is a misappropriation of software. Imagine, "Yeah, Frank only knows VB, so that's what we used for the aircraft's cockpit GUI."

/xrant/

<comment><USER6> This

This machines costs hundreds of thousands of dollars.

There should be no excuse for using Windows. None.

I would not be surprised if the "antivirus" thing was some PHB requirement

<comment><USER7> Is there a reason to believe that choosing Windows was a bad decision?

The bad decision was installing antivirus software. Otherwise, most any modern OS would be fine. This machine probably shouldn't be connected to a network (if it was), the USB ports should be disabled; data can come off on burned CDs, autorun should be disabled, etc. That's how you deal with IA concerns on a standalone mission-critical system, not by installing antivirus.

<comment><USER6> You're right. My bet is that they use windows because they want to save or get something from the machine (either to a USB drive or network)

And I would have followed the same steps you mentioned. The machine could work with Windows.

Windows CE might have been a better pick, so you can have things like RO filesystem, etc

"There is no reason to use Windows" is, as you mentioned, not a bad decision in itself, but since they do it the lazy way, it is awful. Not sure if there's an out-of-the-box way of firewalling everything in the Windows versions available at the time that machine was built

<comment><USER8> A lot of those machines have Windows embedded in them, because a lot of doctors and nurses are really, really bad with technology and cannot use anything more complicated than Windows's familiar user interface. Training involves "OK, now use the mouse and double-click this icon on the desktop to start the program."

I wish I was kidding.

<comment><USER9> Windows is a familiar interface for computers. Is there a good reason for not using a familiar user interface?

<comment><USER10> Huh? Of course there is. "Familiar interface" isn't even a functional requirement, it is only of secondary importance for any system. Actual functionality is much more important.

As an aside, if "familiar interface" is your only requirement, I'd suggest to install a door handle or light switch.

<comment><USER11> Your comment may sound sarcastic on the first read, but I agree with the point; don't use Windows when what you needed could be done with a micro controller or a physical circuit. Not sure if the application here fits that at all, but I've definitely seen things like you-do-it check-outs, ATMs, billboards, etc running Windows. I would think that these systems would be much better off with something like a hardened micro controller running a remote display system vs a multi-gigabyte operating system.

With Windows 10, this problem will likely get a whole lot worse. What do you do when MS pushes a forced update to your deployed devices and it bricks some of them? [http://m.theregister.co.uk/2016/05/06/microsoft_update_asus_...](http://m.theregister.co.uk/2016/05/06/microsoft_update_asus_windows_7/)

What about when you can't disable Cortana (without breaking the start menu) and you're in a HIPAA / PCI environment? [http://winaero.com/blog/how-to- uninstall-and-remove-cortana-...](http://winaero.com/blog/how-to-uninstall- and-remove-cortana-in-windows-10/)

As we've seen with things like SCADA, switching from Windows is not a silver bullet, but in terms of minimizing the complexity and attack surface, Windows seems to be starting at the opposite end of the spectrum.

<comment><USER10> Oh, I didn't even mean my comment to be about Windows vs dedicated OS, at least not directly. When administered correctly and properly fenced off, using a modern Windows system is not a cardinal sin. Although I will admit that Windows 10, with its non-optional feature cadence, brings additional uncertainty.

However, I do question "it looks like Windows" as a valid rationale for what appears to be a single-purpose machine. I don't think it's likely that staff are using the operating room equipment as a desktop machine, so presumably they only care about the in-app user interface. And an application interface can be made to "look like Windows" regardless of what OS it's running on.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> [https://xkcd.com/463/](https://xkcd.com/463/)

The whole structure is wrong. I used to work in medical equipment repair. Windows Embedded is running so many devices it's not funny. But it's not _just_ Windows that's the problem.

I put a linux-system on a PACS network to diagnose equipment. It was a headless, and we _asked_ the IT group to block it off from the Internet.

Hospital IT: "Does it have antivirus?"

Me: "..."

<comment><USER13> List of FDA medical equipment recalls for 2016

[http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...](http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm480134.htm)

At least three of them are Class 1 - May cause death

And all of those are software related, none run Windows

[http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...](http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm481966.htm)

[http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...](http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm489108.htm)

[http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...](http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm485790.htm)

<comment><USER14> That is astoundingly horrifying, especially the Class 1's which were distributed for over five years.

<comment><USER13> I read every recall, food and medical, from 2000-2015 for a university research project. tbh I'm surprised anyone is still alive !

</comment></comment></comment></comment><comment><USER15> Let me surprise you, with the code quality that sometimes is running in what is actually 'life-critical' software.

Back in the nineties, I wrote a nice piece of some 300kb of C code, for DOS/x86. It was a complete software package, controlling medical equipment that was testing speed of blood coagulation. These tests are crucial in the patient post-operation recovery.

This piece of C code had some hardware control code, some statistics, a bit of math, some visualisation, GUI, etc. Normally, you'd imagine a team of 2-3 people, carefully written test cases, dedicated QA person, and a year of time to write something like it. And independend lab, that would certify the thing. Well... in that case, yes, there was independent certification... but...

It was just one developer, and I was 13, when I wrote it ;) During after- school time, in around 4-6 months. And I must say, I still sometimes have chills, when I think of the code quality, and, um, unorthodox solutions of 13-year-old myself. Yes, I've had some years of experience at the time, both writing software and designing hardware, and advice from my parents, who both could write software. But, at the time, I've had zero formal training, aside from reading K&R and PC XT manuals ;). So, you might imagine the code quality ;) Even, no need to imagine, I actually still have it somewhere in the archives :)

<comment><USER16> I understand why you probably don't want to put it up, but boy would it be fun to look at the code you're describing.

<comment><USER15> I probably will put it up. It's a nice inspirational story for teens out here. Doubt there'd be any repercussions, no one cares about some random code on GitHub. And the equipment is hopefully taken out of service years ago, it was more than 20 years back. I wish I knew how long it had been used, but there've been only about 10-20 units sold, I think.

I vaguely remember adding extra features for a year or so (like adding support for HP laserjet printer). But one of the founders of the company (on the business side) had some health problems, and I guess that had played role in very small number of units sold. The only feedback that I've had, is pretty much that my father took me to a lab once, that had a unit deployed, for a support call. And I've seen some real printouts with patient names, from the unit. The lab assistant seemed to be happy with the device. I remember them showing me some blood plasma and teaching me to count cells, during lab tour ;)

</comment></comment></comment><comment><USER17> Is it going to take more deaths to convince people to learn from the Therac-25[1]? If you aren't designing for _safety first_ , you have no business working on medical devices or anything else that might be a dangerous when it misbehaves.

[1] [http://sunnyday.mit.edu/papers/therac.pdf](http://sunnyday.mit.edu/papers/therac.pdf)

<comment><USER18> I am not the parent poster, but may I ask why is this comment being down- voted? I'm not speaking for the parent, but he or she seems to be implying that medical equipment with anti-virus software with automatic updates (used as such) may potentially compromise a patient's safety, and may be indicative of further bad design practices, which could result in, at worst, death. Is this somehow off-topic, or not worthy of discussion?

<comment><USER17> That's exactly right. The article mentions that the doctors were fortunate enough to have _five minutes_ during which they could reboot the device. If they were in the middle of some other procedure that had tighter time constraints, a reboot could have _easily_ killed the patient.

Just like the Therac-25, this isn't about a single problem (the antivirus or the race condition in the Therac-25's software). Designing for safety has to happen at all levels of design. Using Windows (or Linux, or any other complex OS) in a medical device shows that the designer wasn't even considering the safety of major parts of their design.

Designing medical devices with an OS that can be infected with malware (and thus need an antivirus) is the same kind of idiocy that puts a car's steering and brakes on the same CAN bus as the music player and emergency radio. It's a sign that the designer needs either more education or a different job before someone is injured or killed.

</comment></comment></comment><comment><USER19> There are a couple of things here from my POV, first - I would replace the head of their IT and any senior IT staff - who seem to look for the quickest- then-cheap solutions. Dumb ducks who don't spend the extra time understanding the importance of the infrastructure and the software they install. And also replace the service vendor, if they have one.

I've seen this happen time and again, where companies have some 3rd party service vendors who would install AV software on anything they can get their hand on, even a microwave or coffee machine - just to tell the client "my bill is expensive, but you can feel secure, we installed AV". I despise these folks with a passion.

The problem is not Windows. It's a lack of knowledge and understanding. Simple.

For god's sake - it's 2016 - dump the Anti Virus software. I am gonna make t-shirts this summer with this ;)

<comment><USER20>
        I would replace the head of their IT and any senior IT staff

It's a very good bet the senior IT team were following orders from somewhere else in the chain here.

</comment></comment><comment><USER21> Why on earth is medical equipment running standard Windows? This is the ideal location for some basic RTOS or even just an embedded Linux. Seems like a huge cost and risk for no gain.

<comment><USER22> It's cheap to find Windows programmers and even cheaper to find ones that are not hindered by knowledge about software quality and safety. That's not their fault; no-one ever told them something like that exists.

<comment><USER23> >"hindered by knowledge"

This is a great phrase. "Joe was hindered by knowledge of what a p-value means and so didn't claim he discovered a key to understanding the disease."

</comment></comment></comment><comment><USER24> Antivirus scans are one of those things added on IT checklists to cover their ass whenever something wrong happens.

But it rarely is useful. It only causes problems. We've seen so many issues related to virus scans throughout the years it's crazy.

What's better is to lock down the servers with only minimal access. I haven't used virus scan on my main desktop for over 10 years because I don't click on weird emails and I don't go to sketchy websites ever. Sure there's the risk of malware from ads I suppose, but I'm not that worried.

<comment><USER25> Most of the time IT is just implementing policy from the CIO, which is basing it on the requirements of the company's insurers. Insurance companies require some very annoying things like Anti-virus. It's like having a lock on your office. You do it so the insurance company will pay you if someone comes in and steals your stuff.

<comment><USER26> It's more like the requirements cronies put into defense contracts to make sure the contractors make a lot of money.

The reason "security requirements" documents require antivirus is that companies like Symantec make sure they're in the right position to be the ones asked when someone is writing up a security requirements document, so that their answer can be "make sure you install antivirus (and here's the contact info for our volume licensing center)."

</comment></comment></comment><comment><USER27> >> The antivirus was configured to scan for viruses every hour, and the scan started right in the middle of the procedure.

>> The company claims that they included proper instructions in their documentation, advising companies to whitelist Merge Hemo's folders in order to prevent crashes from happening, so it seems that the whole incident was nothing more than an oversight on the medical unit's side.

So "RTFM"? Not very helpful.

</comment><comment><USER28> > they included proper instructions in their documentation, advising companies > to whitelist Merge Hemo's folders in order to prevent crashes from > happening, so it seems that the whole incident was nothing more than an > oversight on the medical unit's side.

And the hospital included full instructions to the software company on how to properly perform a heart transplant, so they were baffled why the programmer just let his teammate die of heart failure.

Come on, this kind of stuff should be a zero-configuration hardware-based black box, with its own buttons, screen, etc. --- not something that needs to be (or even can be) connected to something outside the vendor's total control.

</comment><comment><USER29> This situation is even funnier(and sadly very seriously flawed) in Japan.

Medical equipment require an authorization to use. Any change to the medical equipment requires another authorization or it's prohibited.

By "any change" , it includes Windows Update(it changes the system obviously).

The result: they use anti-malware software to protect(or rather, believed to protect) unpatched Windows.

At least one anti-malware software company(Trend Micro), marketing that their software can protect the medical equipment in such situation.

<comment><USER30> But... what about AV/malware definition updates? Doesn't that fall under "any change"?

<comment><USER31> and what about security updates to the snakeoil they sell, eg. [https://bugs.chromium.org/p/project- zero/issues/detail?id=69...](https://bugs.chromium.org/p/project- zero/issues/detail?id=693)

</comment></comment></comment><comment><USER32> Putting antivirus on equipment at all indicates a much bigger problem.

That the equipment is somehow configured to be susceptible to viruses.

<comment><USER33> Well at least in EN62304 the installation of AV on medical devices is recommended. The whole thing reads like as if it was written by people who picked up a few buzzwords and read a few articles in a computer magazine.

</comment></comment><comment><USER34> From the linked report :

 _Based upon the available information, the cause for the reported event was due to the customer not following instructions concerning the installation of anti-virus software; therefore, there is no indication that the reported event was related to product malfunction or defect_

I beg to differ. I'd consider a momentary loss of file I/O due to lock contention causing a machine to require a reboot a shocking defect in - say - a word processor (which, notably, do not have this problem). That this risk is apparently known and the vendor's sole mitigation is to document a 'Don't do that then' is absolutely 100% an indication of a product defect, even in the absence of an actual occurrence.

</comment><comment><USER35> this reminds me of IT crowds bomb disposal robot: [https://www.youtube.com/watch?v=z88b96ECZCE](https://www.youtube.com/watch?v=z88b96ECZCE)

just perfect

</comment><comment><USER36> I don't think they say this device is controlled by Windows but it must be. Why professional software and instruments even consider using Windows is beyond me.

</comment><comment><USER37> We've had issues with the latest versions of kaspersky. A burst of network activity is almost guaranteed to crash a machine.

It took us a while to isolate Kaspersky 10, and it's not even any particular component inside of Kaspersky, but only when all features are enabled. We tried different permutations of features to try and isolate the cause of our crashes, but as soon as you have any one feature disabled in, the crashes stop, Very frustrating because ultimately our clients laid the blame at my feet (new software feature, new release, blah blah blah), and not exactly much you can do in the way of hardening against this particular crash, the app generates a burst of network data, and boom, blue screen/instant reboot.

</comment><comment><USER38> I worked at a financial company that ran its production Oracle database servers on Windows in the same network as the staff (no firewall) and ran virus checkers on them. Performance was terrible of course.

</comment><comment><USER39> Okay, seriously, I need to say something, because I doubt most of the people commenting in this thread have ever dealt with either health IT, healthcare software, or any of the related nonsense.

There are kinda four flavors of machine setup I ran into while in that field: big server banks for on-site hosting (think huge enterprise VM farms, for data warehousing and record storage and virtual desktop hosting), care provider systems (think like tablets, doctor office computers, nurse workstations, room workstations), cart computers (used for things like running the sonogram or cardiogram equipment, or for other studies), and actual integrated devices (for, say, data collection).

The care provider systems are usually comically locked-down, tablets and phones having the meanest management software they can (no apps, limited connectivity, remote wiping, and so forth). Workstations tend to be centrally managed, have images pushed regularly (ha!), and often use AD and smartcards to handle authentication. One place I've seen took this a step further, and basically just booted users directly into a VM hosted on the server farms mentioned earlier. You can't use USB devices, you have highly-regulated clipboard access, and so forth--this is done to prevent HIPAA breaches. Which is kinda silly given other workarounds, but whatever makes people feel safe and the CIO happy. These workstations run some enterprise version of Windows, probably 7 Pro. Those silly-long extended service agreements you see on Microsoft? Hospitals are some of the people keeping that alive, and they will pay _obnoxious_ amounts of money for the privilege.

The cart computers are typically like the workstations in terms of functionality, but they may have software specific to the device they're talking to. They might not be as locked down (e.g., only acting as thin clients to a remote VM), but they are still running Windows.

The device computers may run some kind of RTOS. In some cases, they'll be running a customized Windows CE installation--which is totally reasonable. There are a lot of good guarantees that that can give a development shop, least of all that they can call up Microsoft instead of StackOverflow and say "Hey, this function does x, it's documented as y, and we're paying you a lot of money, so what the fuck?". Windows Embedded (which is I think the successor, am not sure).

In all of these cases, _Windows itself works pretty damned well_.

It runs the software everybody needs, it has the enterprise deployment stuff figured out through decades of improvement, and really there is no reason to be scoffing at its choice.

Now, if folks have goofed up and thrown a stupid AV policy on the machine, _that 's_ a different question entirely. Health IT is _full_ to the brim of people basically just punching a clock and being unable to get anything done in a reasonable amount of time. Sometimes, they do awesome things, but mainly they are just custodians standing between doctors and really really stupid policy decisions that seemed good at the time.

EDIT: Removed unrelated example at top.

</comment><comment><USER40> Wtf?

"The antivirus was configured to scan for viruses every hour, and the scan started right in the middle of the procedure."

Who configures an antiviurs for an hourly scan on a doctor's computer?

<comment><USER41> It wasn't even a doctor's computer, it was apparently an operating-room equipment computer.

</comment></comment><comment><USER42> Why is there a virus scanner on a PC inside the operating room?

Don't tell me that PC is connected to the internet...

<comment><USER43> I was going to ask this as well. Why does this PC need to be connected to the internet? If it doesn't need to phone home while operating as a heart monitor then there is no need to have antivirus or have this PC connected to the internet.

Also, plenty of devices not connected to the internet run Windows: ATM's, Billboard, Monitors, etc.

Dumb IT is to blame for this mistake.

<comment><USER44> > Also, plenty of devices not connected to the internet run Windows: ATM's, > Billboard, Monitors, etc.

I hate to break it to you, but, in practice... these things are all typically connected to the internet.

</comment></comment></comment><comment><USER45> "A critical medical equipment crashed during a heart procedure due to a _timely_ scan triggered by the antivirus software installed on the PC to which the said device was sending data for logging and monitoring."

That should be _untimely_. The opposite of timely.

</comment><comment><USER46> For what it is worth, Merge is now part of IBM Watson.

[http://www.merge.com/News/Article.aspx?ItemID=660](http://www.merge.com/News/Article.aspx?ItemID=660)

Welcome to the Health Cloud Powered by Watson.

</comment><comment><USER47> How can a medical device be certified for running on 'user hardware' (=uncontrolled environment).

Something is probably missing from the article. IMO, the device in question wasn't critical at all, and a failure could be expected.

</comment><comment><USER48> I see a bunch of folks talking about whether PCs are connected to the Internet and "why was it running antivirus in the first place?" It's called Defense in Depth.

It Does Not Matter if the device is connected to/able to reach the Internet.

First, it probably can reach the Internet in some way simply by being networked. I don't think I've ever seen a medical office (can't speak about hospitals) where medical diagnostic equipment was on a fully-separate network able only to talk to other network equipment and specified data destinations (PACS servers).

Second, I'm not concerned about unpatched, unprotected machines being infected from the Internet. Odds are they're running a restricted version of Windows, with a custom shell and a lot of stuff stripped out. I'm concerned that they're going to be infected by another machine on the network that's gotten infected. With all the past SQL Server security issues a decade or more ago, how many people think those SQL Server boxes could be directly reached from outside the local network?

The conjunction of those two is that even if you firewall all that stuff off, the PACS servers are still on both networks, and are probably running much more interesting and vulnerable stuff than the device controllers.

Sure you can fully wall everything off - it's really easy, just do your X-rays onto film, burn your MRIs and ultrasounds onto CDs, and print your EKGs for later scanning. Oh, and listen to people complain about how out-of-date your systems and procedures are.

There are other factors that come in as well - sure, every device manufacturer could provide fully bespoke diagnostic displays developed from the ground up in artisanal software shops providing full employment for assembly programmers working on embedded systems, along with cohorts of graphic designers creating glorious steampunk-styled interfaces. That's a beautiful dream, keep having it.

For the rest of the world, creating a UI on that custom embedded system running on something from RIM/Blackberry (yeah, they own QNX) is just going to get them crap from people because of A) how clunky it probably looks and B) How could they even consider allowing direct user interaction with the RTOS that was chosen to ensure that the dangerous bits in contact with patients/radiation/irradiated patients were safe?

There's a beautiful world out there somewhere where everything is safe and secure and seamless and updated. The rest of us live in worlds where Joe in Marketing's PC gets infected with something that allows an attacker to start scanning the network for unpatched vulnerabilities on any system, which leads to an out-of-date install of IIS on a legacy server that hasn't been updated because there's no longer a contract with the vendor (or no vendor) but it's around because there's a statutory requirement to keep the data on that system for 7-10 years.

There's a lot of ugliness out there. Antivirus is a way to try to ensure that when (not if) some of it hits you the repercussions are minimized.

<comment><USER10> _it probably can reach the Internet in some way simply by being networked_

That is simply untrue, you can (and in many cases should) have unroutable subnets. But even if true, that only slightly changes the question: why is operating room equipment networked in the first place? That you've never encountered a proper setup doesn't excuse not having it.

<comment><USER48> I phrased that badly - it's not that they can reach the Internet, it's that with the exception of true high-security fully-airgapped locations, if the machine is networked then it's almost guaranteed that the Internet (or something on it) can effectively reach out and touch that machine even if it's only via other systems.

I don't work in a hospital environment, haven't for more than a decade and wasn't interacting with clinical systems even then, but my understanding is that a very significant amount of medical equipment was networked even then, and was at least in theory capable of streaming HL7-formatted data to other internal systems for reasons of patient care, billing, or both. How much of that happens in the real world instead of being theoretical is something I can't say, but I'm sure in the 15+ years since I was working with HL7 that hospitals and equipment haven't gotten less networked.

</comment></comment></comment><comment><USER49> Microsoft must be relieved this wasn't yet another Windows 10 upgrade horror story.</comment>


Facebook's Zuckerberg slit a goat's throat? Wow. - <AUTHOR> http://latimesblogs.latimes.com/technology/2011/05/facebooks-zuckberg-slit-a-goats-throat.html <comment><USER2> lobster, chicken, pigs, goat.... . The billions allow to go beyond the limits that exist for normal people. Interesting state of mind - 20 something, everything is possible and no limits (that he has no moral limits the history of Facebook creation is the evidence to)

</comment><comment><USER3> It beats Ballmer's chair hurling I guess.

</comment><comment><USER4> Slow news day at the LA Times.

</comment><comment><USER5> The thing about stuff like this is that people think that Zuckerberg is somehow unique. He is not - the only thing unique about him is how much money he has.

Most people, given the amount of seemingly limitless funds would surely be doing similar things.</comment>


Stop Coding on Pigs - <AUTHOR> http://bowery.io/posts/Dev-Prod-Parity-Real_world

<comment><USER2> Neat idea? Question though. My work process for every project is to have a vagrant file, and a docker container. The vagrant file has almost the exact same shell script that I use when setting up a production environment. (There are a few extra security scripts I run that I don't need to run on my virtual box).

So when spinning up an instance of the project I need on a new machine, I go through the following steps:

1) Install Orcale VM Virtual Box

2) Install Vagrant

3) Install cygwin and necessary libraries

4) Install git

\---- Up till this point, everything I need can be carried on a pen drive and be done in under 15 minutes. I could probably automate it further but there's really no need to ---

5) Clone git project

6) Run vagrant up

And that's it... That really is it. I now have a production environment that stays synced. The vagrantfile almost never ever changes. The docker container does change, and then it's a simple pull. Guaranteed, bower probably syncs stuff with 1 less step but I'm still not convinced that it's a major leap ahead in managing the problem of dev/prod environments.

This really isn't intended as a negative comment. It's more a question of, how does bowery compare to my current work process.

Also, I'm a super basic in this area still. An experienced systems person who would actually be in charge of this stuff in a big company would probably have a much more efficient way of getting a new hire on board (a script to automate all the above for example).</comment>


Researchers explain why bicycles balance themselves - <AUTHOR> http://www.news.cornell.edu/stories/April11/bicycle.html <comment><USER2> This publicity release mis-advertises what is new here.

From the publicity release: _Now, a new analysis says the commonly accepted explanations are at least partly wrong. The accepted view: Bicycles are stable because of the gyroscopic effect of the spinning front wheel or because the front wheel "trails" behind the steering axis, or both._

From a Wikipedia article (<http://en.wikipedia.org/wiki/Bicycle_and_motorcycle_dynamics>): _In 1970, David E. H. Jones published an article in Physics Today showing that gyroscopic effects are not necessary to balance a bicycle._

In fact, Jones' article addresses the steering axis question, as well.

What appears to be new here is the mathematical analysis. From Jones: _I have not yet formalized all these contributions into a mathematical theory of the bicycle..._

</comment><comment><USER3> I had Ruina as a dynamics prof many years back. Good teacher, Good class.

I still remember that he was interested in self walking robots at the time, powered only by gravity and walking down a slight slope.

<comment><USER4> How do those work? With the Jansen linkage?

<comment><USER3> I remember a three legged version, with the inner leg out of phase with the outer two. This is a more refined two legged version, <http://www.youtube.com/watch?v=_2pAMe_5VeY> .

Power here is gravity, in the form of a slight slope on the surface it's walking on. The walking form is all from dynamic motion, no electronic control.

It looks simpler than a jansen linkage, much more like the physiology of our legs. (and there's a funny story there, Prof Ruina had a limp when he taught the class, because he had implanted studs in the bones of one of his legs so that they could motion capture the bone motion when he walked. Not sure if the limp affected that.)

</comment></comment></comment><comment><USER5> This is awesome: I have seriously been searching for an explanation on this ever since I was a little kid and my dad bought me my first bike at about 3 years of age and immediately removed the training wheels.

</comment><comment><USER6> > They built a bicycle with two small wheels, each matched with a counter- > rotating disk to eliminate the gyro effects

...to double gyro effects... or I missed something?

Two conter-rotating disks will compensate each other, BUT they must be perfectly aligned, is not?

In their bicycle, upper disk produces about 2x of gyro effect comparing to lower disk gyro effect, because it moves with about 2x larger amplitude comparing to lower disk at same incline, thus we still have about 2x-1x=1x gyro effect.

They should try their system on skates with two tiny blades instead of wheels.

PS.

Sorry for my English - I am Ukrainian.

PPS. System need to spent some energy to restore vertical alignment of inclined body.

Thus they need to add small incline to bicycle and then find where motion energy is spent by bicycle to restore vertical alignment. If bicycle will unable to restore vertical alignment then it is not stable.</comment>


Regret Analysis of Stochastic and Nonstochastic Multi-Armed Bandit Problems - <AUTHOR> https://arxiv.org/abs/1204.5721 <comment><AUTHOR> There's a lot of talk about "AlphaGo" and "MCTS" around here. But people should understand that MCTS is built on top of a particular statistical problem called the "Multi-Armed Bandit Problem".

The Multi-Armed Bandit Problem describes a gambler who is trying to optimize their gains. There are a finite number of slot machines in front of the gambler, and every slot machine has a different probability of winning.

What strategy should the gambler adopt to maximize their winnings? In general, the various algorithms balance "Exploitation" vs "Exploration". Exploration looks for better machines, while Exploitation plays the machine with the best statistics gathered so far.

In the case of MCTS, the different branches of the search tree are seen as a multi-armed bandit / different slot machines. UCT (Upper Confidence Bounds applied to Tree Searches) is the UCB algorithm (described in this survey) applied to a search tree.

Marketing experts have also used the Multi-armed bandit as a mechanism for A/B testing, determining the best placement of ads.

Finally, there are applications to business and research opportunities. Which research efforts should be funded for example, is very much a multi-armed bandit problem.

As such, the Multi-Armed Bandit Problem is a fundamental component to a lot of Hacker News discussion, even if people don't yet realize it. That's why I'm posting this excellent survey by Bubeck1 and Cesa-Bianchi, which can provide a good introduction to the Multi-Armed Bandit Problem.</comment>


Ask HN: How do sites obtain their initial content? - <AUTHOR>

This has perplexed me for some time. Whether its Wikipedia or Yelp, I'm always late enough to the game that when I arrive for the first time, there's already a wealth of content. But they had to start somewhere...so how does a company build up its initial data set so it can properly and adequately serve even its first users with useful content? What's a good rule of thumb for knowing how much content you need for a minimum viable product? Say if you were to start Yelp over from scratch...how many reviews would you have started with in San Francisco before you opened it for its very first users? <comment><USER2> "What's a good rule of thumb for knowing how much content you need for a minimum viable product?"

Analytics can tell you if people are showing up.

From a strictly guerrilla perspective just add your own like a religious fanatic. Everyday just devote X number of hours...and treat it as important as the tech development itself.

Other than that,you have to realize a lot of successful companies are started by founders (serendipitously) branching off of prior situations that are uniquely specific to them. There is a good tech nation episode where they talk about how the "guy in the garage" narrative of many big companies (that I will leave unnamed) are largely a myth - these people all had connections and worked in places that allowed for them to blossom ideas in environments that were conducive to their success. This isn't to suggest that being a guerrilla, an engineer or idea man isn't part of it, of course it is, just that there is more involved on a case-by-case basis.

So "Yelp" may have had any number of things to get the ball rolling that is under the radar.

</comment><comment><USER3> If the site has user-generated content, you should open it to users from the very beginning. The early adopters will get a certain satisfaction out of nabbing those early reviews. You'll likely have to prime the pump with some paid writers in the beginning, until the site gains popularity.</comment>


Moves to shut down on July 31st - <AUTHOR> https://moves-app.com <comment><USER2> Lol from their own FAQ[1]:

` What does Moves joining Facebook mean?

Moves will continue to operate as a standalone app, and there are no plans to change that or commingle data with Facebook.`

1: [https://movesapp.zendesk.com/hc/en- us/articles/202443288-Wha...](https://movesapp.zendesk.com/hc/en- us/articles/202443288-What-does-Moves-joining-Facebook-mean-)

</comment><comment><USER3> The data can be downloaded at [https://accounts.moves- app.com/export?download=true](https://accounts.moves- app.com/export?download=true)

But, apparently, Move-O-Scope is not able to download any new data: > Error: he API package 'xmpp' or call 'CreateChannel()' was not found.

I am wondering if any of the other connected apps can still be used to display the data.</comment>


Mysterious number 6174 - <AUTHOR> http://plus.maths.org/issue38/features/nishiyama/

<comment><USER3> It's not so much a question of mathematical use. In mathematics ideas are normally judged for implications for the rest of the field. This leads to a self perpetuating notion of what's important (things are important simply because they are). The notion of rearranging the digits of an integer has absolutely no mathematical significance. Because we represent numbers by strings of digits it's a very intuitive idea but I can promise you it will never lead to "significant results" as pe the current academic notion of mathematics. Furthermore mathematics has always been a search for generality. The more general a concept is the more cases to which it can be applied and normally the more impressive it is the mathematical community. I personally find this substantially more reasonable. Rearranging the digits of a number isn't even general to the concept of integers. It's dependent on the fact that we write our numbers in a base of ten. If this theorem held in other bases (like binary numbers) then that would be kind of cool.

On another note the author uses the word kernel when I think he wants "fixed point". Kernel doesn't really have a meaning in this context.

<comment><USER4> To jdoliner:

Please add some information to your profile so I can place your comment in some kind of reference. I love that you write clearly and to my untrained, therefore naive, eyes your arguments seem valid. But without an understanding of where you are coming from, I do not want to necessarily accept what you say on face value.

I mean no insult, I just want more information.

Cordially, <USER4>
<comment><USER5> What difference do his credentials make?

If you want to know if something is true, do research, don't just assume that someone's credentials make everything they say true.

<comment><USER6> Personal opinion coming up ...

I find this attitude an incredible strength in the hacker community, but also occasionally a real weakness. It leads to a complete dismissal of a source of information, and that, surely, can't be right - namely, the mindset and knowledge of the person making the statements. When making decisions you should use all the information available.

Yes, some information should be tagged as "hearsay" (you can't check the person's credentials) and some should be marked as "suspicious," but simply throwing it out is wrong.

When you teach or train it is critical that you know people's background so you can pitch the explanations and demonstrations at the right level. When you listen to someone, you should assess what level of confidence to place in what they say.

Work since Shannon has shown that the most efficient communication of information (as opposed to data) is achieved when the sender has an effective model of the receiver, _and the receiver has an effective model of the sender._

Certainly many advances in breaking ciphers are achieved by knowing more about the source. Cryptographers know not to throw away information, even when it is suspect.

You can dismiss this, or go and research it. Does it sound interesting? Should you ignore it? Modern information theory says you shouldn't. You don't know my credentials, so you have to make that decision in a void. If I told you my credentials, would your opinion remain completely unchanged? Modern information theory says it shouldn't.

Yes, be skeptical, but use what information you have.

All of it.

<comment><USER7> ah, but then there is google:

<http://www.google.com/search?q=riderofgiraffes>

"User Profile for: riderofgiraffes UserID: 383529 Name: Email: Registered: 1/11/07 Occupation: Mathematician Location: UK Total Posts: 350"

So much for that vague reputation, unless of course you've been fibbing ;) and / or someone else liked your moniker as much as you did, but I somehow doubt there are multiple riders of giraffes.

I fully agree with the above by the way, it feels just right.

I always tell my kid to distrust all sources of information, including his dad (there is a pardox in there somewhere) and to gather his own facts if the issue warrants the effort.

<comment><USER6> But such a search is uninformative for the author in question. If I had used a pseudonym you would have had no such additional information.

My point remains. With no credentials, with no idea of the author's background, you must perform independent verification. With some idea of the author's background, you have more information, and can decide whether the information is likely to be trustworthy, or at least worthy of pursuit or verification.

I am concerned that hacker culture teaches "Trust no one, verify everything." I think it is thereby unnecessarily impoverished.

<comment><USER4> I typed up a similar response.

<http://news.ycombinator.com/item?id=481272>

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> What would an "explanation" be? An explanation with lower Kolmogorov complexity than the operation itself. That system of equations is probably all the "reason" you're going to get, since it's hard to get simpler than that.

If you're looking for something more humanly profound, how about this: "Arbitrary operations on integers can yield arbitrary results." That's actually profound (in the Zen-like way a tautology can still be profound) in the context of "human understanding" and how people argue with numbers, but it would take a long time to explain why, if you don't already know.

</comment><comment><USER9> Interesting.

Feels like a more mysterious version of Collatz conjecture :) which is - <USER2> with a positive integer, iterate as such:

      x = (x & 1) ? (3*x + 1) : (x/2);

and you will eventually end up at 1.

<http://en.wikipedia.org/wiki/Collatz_conjecture>

</comment><comment><USER10> Call me naive, but I have always doubted the mathematics significance of rearranging the digits of an integer. When you rearrange 1234 to be 3241, you have lost all meaning.

What _real_ mathematical operation involves rearranging digits in an integer?

<comment><USER11> Who ever thought that x^3 transformed into 2x^2 would be useful one day? Of course I'm being facetious in this example, but the simple rearrangement of the mathematical expression above has profound implications for how we interact with the world.

Yes I know that there is a whole derivation to the simple derivative example I've given, but who is to say that the 6174 transformation might have preceded an actual use?

Who's to say that this odd mathematical transformation actually leads to something useful one day?

<comment><USER10> I don't really see the connection. Your example is the derivative of a function, and what I am saying is that rearranging 1234 to 3421 doesn't mean anything to me.

Now you have some new number who's only relationship to the old number is that it's one of (4 _3_ 2)-1 possible permutations of it. Other than that, what's the significance?

<comment><AUTHOR> The numbers in the article aren't rearranged arbitrarily, they're sorted to ascending and descending order.

</comment></comment></comment></comment><comment><USER12> The meaningfulness of rearranging the digits in a base-10 representation is fully and sufficiently demonstrated... by coming up with an interesting non- obvious mathematical fact that depends on rearranging the digits in a base-10 representation. Meaning is something you get out of a math trick, not something you put into it.

</comment><comment><USER13> Downvoted for implying there's anything mathematically special or interesting about base 10. Okay, I can't really downvote, but you get the idea.

<comment><USER7> first off, this is not about 'base 10', it is about interesting patterns found in series of digits, similar (but different) interesting patterns can be found in series of digits in other bases.

Secondly, if every time a mathematically oriented person stumbles upon something interesting instead of figuring out why they would respond like you just did mathematics would grind to a halt really quickly. After all, that's how math started - that curiosity about patterns - and mathematicians really can't help it but they have to figure out what causes this. There may be a trivial answer, or something profound may be found out, who is to know in advance what will come of it.

To everybody else the circumference of a circle may as well be three times its diameter.

</comment></comment><comment><USER14> "...it also has one more surprise up it's sleeve..."

Fail.</comment>


Apply HN: Natural advertising for small businesses and personal websites - <AUTHOR> Problem: Advertising is hard and is getting harder as more money is spent on internet advertising. At the same time, ad blockers are quickly spreading and maybe will soon kill all the sources of advertising, bad for personal websites, bad for small companies using Adwords.
Solution: Think affiliate marketing. Now think manual advertising contracts. This service would combine these two to get some level of automation in the process.
How would it work?
(Imagine this service is hosted at natural.com, which is obviously not true). A blogger writes about the topic of fishing for beginner fishers. He talks about things the wannabe fishers must buy and places they must go. Every time he talks about a product, he puts a link to natural.com/<product-name>, or when he talks about a place, he can use something like natural.com/<place>, maybe he can also create more complex link patterns, but let's stick to these for now. These links are going to redirect the clicker.
Advertisers would bid for these pre-placed links. Read the rest of the example at https://gist.github.com/fiatjaf/10e61297e060373fabf4ee1cc2f1ad16, because HN has a character limit. Only two paragraphs more, but doesn't matter. They key ideas are here.
Other markets where this could clearly work: food blogs; programming blogs; travel blogs; hack-your-life sites; personal development blogs; clothing and fashion blogs; any blog or site about hobbies or practices like yoga, painting, martial arts, hunting etc.
Progress: No progress at all. I realize the network-effect of this thing is damn hard to beat, but at the same time it is something that I see working in small scale, so it is probably doable.
Market: Bloggers; small business; local, non-tech small businesses. Later, big companies that sell a lot of different things, big content websites (newspapers, magazines etc.).
Team: One developer with many ideas, this one being the only one hard enough to be worth posting here. <comment><USER2> OK, let me try to paraphrase your idea:

The traditional internet advertising model sucks. But if I'm reading an article by somebody who recommends a product, I am much more likely to want to click on a link based on their recommendation. I can get the product and the writer can get paid for that link. Your site will be the broker for these ads, with a focus on simplicity.

I get this, I think it's reasonable that people would want to sell those ads and I can imagine clicking on those links sometimes.

To get started you should just go talk to some bloggers who already promote products, and offer them to swap the link and get paid for it. A lot of them are probably already using Amazon affiliate links, so you may want to offer more money, or find people who aren't using Amazon.

<comment><AUTHOR> I think you got it better than me.

</comment></comment><comment><USER3> Sounds similar to other content-targeting ad networks. There's even one (or a few) that will inject links into the body of text with ads. How will you beat these established players?

<comment><AUTHOR> I had forgotten about these. But they are artificial and sound artificial. People who are more used to browsing the internet don't trust them and don't click on them.

<comment><USER4> What stops a company like bitly from doing something like this? How would you compete with them?

<comment><AUTHOR> What stops Google?</comment></comment></comment></comment>


User Interface Design patterns - <AUTHOR> http://ui-patterns.com/ <comment><USER2> Their webpage makes me believe they don't know so much about UI design patterns as of 2016.</comment>


PHP 5.4 Has A Built-In Development Web Server - <AUTHOR> http://digitizor.com/2011/12/22/php-54-built-in-erver/ <comment><USER2> I spend most of my time writing either erlang or node web apps, its terribly annoying when I switch to python / php / ruby and get told I have to configure some web server to get started. I have had a ruby/python app start a development server but still suggest I configure against apache for production

Its an absolute dream to be able to just download an application, compile it, start it, point nginx at it and bam, its live

<comment><USER3> TL;DR: if possible, create a develop environment which is as close as the live environment

I think developing servers are only good for people writing libraries or frameworks to get started. I might understand that people want to choose a small and easy to set up webserver to get going when starting developing a website.

But, in my opinion, as soon as you're getting serious, there's nothing better than developing on a system which as close as possible to your live environment (hardware is hard to mimic, so are websites running in the cloud) including same webserver and software configurations.

Of course this means that you either:

a) have any influence on software installed or b) know what is installed and how it is configured on the live system

I encountered several bugs which happen to be only on staging / live server, but which I did not encounter in my development environment. Why? Different OS. At this point, I'm trying to recreate my live-systems in virtual machines as close as possible. This is not perfect hardware-wise, and software still might behave differently, but it's damn close.

Another plus: I'm on a rolling release distribution and software packages are updating fast. This can be problematic when developing websites and applications. All my server-software is in the VM. I can choose when and what to update, problem solved. It also keeps my desktop clean, no stuff installed for developing purposes.

There's nothing worse than developing on a windows* machine and deploying on a unix-based os.

* nothing against windows developers. Point is: different OSs behave differently.

<comment><USER2> I definitely agree, when I was talking about erlang + node.js I was talking about developing with production web servers that are embedded in your application

</comment></comment></comment><comment><USER4> This seems nice but I just don't see myself using this over WAMP/MAMP. It's a cinch to install and of course gives you a mysql setup right away to start your codes. Plus it's likely closer to your production environment anyway (if you're on LAMP). So what's the real use case for this then?

</comment><comment><USER5> And some idiot somewhere is going to use it in production in 3... 2... 1...

<comment><USER6> What do you think is so magical about Apache that qualifies it for production use?

Just to annoy you, I think I'm going to setup a netcat instance where I type the response to HTTP requests when I'm in the mood.

<comment><USER7> _What do you think is so magical about Apache that qualifies it for production use?_

Years of bugfixing and at least some attempt to be hardened against common attacks?

</comment></comment></comment><comment><USER8> here is an even easier way: sudo apt-get install lamp-server^

<comment><USER9> That's not easier for a variety of reasons, the first one being it only works on OS distros with apt.</comment></comment>


Group buying: Fad or future Facebook?  - <AUTHOR> http://edition.cnn.com/2011/TECH/web/01/06/group.buying.2011.prospects/index.html Group buying websites enjoyed massive growth in 2010 grabbing new customers and the headlines as the sector's biggest player, Groupon turned down a reported $6 billion offer from Google in early December. <comment><USER2> "It brings offline and online together in a very unique way, which banner ads simply don't do. It's definitely opening people's eyes up to the way e-commerce can be transactive," Aitken said.

People may _like_ Facebook, but we're still very social creatures, and we do _crave_ human interaction. Probably why we _may_ be seeing more intertwined real-life/interweb stuff soon.</comment>


Pro-Indian 'fake websites targeted decision makers in Europe' - <AUTHOR> https://www.bbc.com/news/world-asia-india-50749764 <comment><USER2> I'm pretty sure they were in fact real websites.</comment>


The Codex Quetzalecatzin Comes to the Library of Congress (2017) - <AUTHOR> https://blogs.loc.gov/maps/2017/11/the-codex-quetzelecatzin/ <comment><USER2> Thank you, LoC!

As a casual reader of history, I was surprised to learn that the Aztecs (more properly, the Mexica) have recorded their pre-Columbian history. It is very nicely summarized in the book "A Rain of Darts" by Burr Brundage [1].

[1] [https://utpress.utexas.edu/books/brurai](https://utpress.utexas.edu/books/brurai)</comment>


Ask HN: Your Project/Startups Teamwork - <AUTHOR>

In your current project/start-up how is your team work managed.
What tools do you use? How do you communicate?
How's the work division? Entire project split in to large chunks and each person individually developing that part, Or Entire project in to tiny tasks and everyone attacking task by task together.
Of course lot of these depend on the project at hand, but I am curios to get a very general overview. <comment><AUTHOR> I'll start off, tiny team spread apart geographically.

We use Redmine as central hub for tracking progress, planning, wiki and forum for discussion and documentation. Google docs a bit for architecture and general info. IRC as official meeting room.

Subversion for code repo, Redmine also as svn's browser.

Project broken in to several primary chunks, and each person is fully in charge of one or two pieces. Design and Develop on our own with a interface between the parts.

</comment><comment><USER2> We use Git, Lighthouse, and a self hosted wiki. We also all work in the same office.</comment>