Ask HN: Has anyone built a SaaS for local municipalities? - <AUTHOR> I'm building an aggregator for building permits and planning meeting notes. My business model is to sell alerts based on coordinates and/or search terms. Would love to hear from anyone bootstrapped selling a platform/SaaS to municipalities because we're considering also selling solutions to the public sector. I assume the sales process is long? <comment><USER3> I did. I had a startup selling transportation software to small cities (<40k population). Sale process was 6 months. The tender process is excruciating. You will need to meet them up to 5 times to get an informal yes (3 months), and up to 6 months to get a contract (only if they do not need to organize a public bidding).

If they need to do a public bidding because they did not planned to implement a service like yours soon, the whole process takes up to a year.

Cities all have a different tender process/rules. Most ask you to have an insurance of up to a 5 millions by event adding mostly 10/15k in expenses.

There was a lot of interest, but cities did not have the cash on hand to pay for my services. I was billing up to 100k/city/year.

Mostly, if you have a product that can be paid for by the federal government or the state, they will buy it in an heartbeat. Eg: if it helps handicapped people.

The good: the LTV is really long, 10+ years. Try to find a champion in the town hall, that person will help you setup your offer so that the different branches of the city are happy.

Also, overcharge. Cities love personnal support. You will spend a lot of time on the phone, talking to real people.

For more info, write me an email at bobberkarl(at)gmail.com

<comment><USER4> How do you afford the travel time? Seems like all the handholding would be quite expensive.

<comment><USER5> Local consultants. Hire a local engineering firm or PR firm or attorney as a representative to do the handholding. You hire someone who knows all the right folks with a good rapport and a grasp of the technicals. Even paying someone who normally charges $400/hr for a few weeks of work who has the right contacts can reap rewards. You can structure those consultants with a lower base rate and a commission upon success.

<comment><USER3> The problem is, in smaller cities, the local consultants are your competition. They are the one providing the cities with decade old technologies and ugly U.I./U.X.

Truth is, and i can't stress it enough, you are a 100% right. If you can find someone to cooperate with after you already beat him at the public bidding process, you did 90% of the personal relation work.

</comment></comment></comment></comment><comment><USER6> I sold to cities, counties and regional agencies in the U.S. for 30 years. Random suggestions:

* Do not wait wait for them to decide they need a solution and then engage; your business will die. Success comes from educating prospects, helping them understand the benefits -- hell, even helping them write the RFP, if they'll let you -- and being the preferred solution before the bidding process formally begins.

* Related: All of your meaningful sales will come from formal proposals submitted as part of an RFP process. You need to get good at being the insider who helps them write the RFP or you need to get good at writing better, more compelling (not cheaper, not fancier -- _more compelling_ ) proposals. Even better? Get good at both.

* Bob correctly referenced the fact that you'll have high insurance requirements. Don't let them faze you too much -- commercial liability is cheap. Errors and Omissions, on the other hand, can be pricey and you want to avoid having to have that if possible.

* Get very good at finding local partners, even if you don't need them. Big projects that leave some of the money in the community are more compelling.

* If you are not a woman or a minority, get good at finding local partners who are certified as women-owned or minority-owned businesses. Some public agencies set up their RFPs with an automatic point deduction from your score if you can't tick this box.

Happy to chat more if it's helpful.

<comment><USER7> Literally just commenting to save for future reference. Thanks for this.

<comment><USER8> If you click the time of the comment (x minutes ago) you get taken to a permalink for that comment. There you can mark it as a favorite, and later find it in your favorites in your profile.

<comment><USER9> Thanks for this, didn't know it was a feature.

</comment></comment></comment></comment><comment><USER10> Many years ago I was part of a SaaS startup for which local governments were one of our target markets. During our beta we quickly gained interest from the relevant department of the city and were then led on by them for the better part of a year before we went under. This behavior seems consistent with a lot of the comments that have already been posted.

One of the biggest hurdles for us besides the timeline, which I haven't seen mentioned yet, was compliance. The city had a very antiquated security checklist they wanted us to satisfy which was written exclusively for their existing on-prem software deployments in a MS ecosystem, and thus impossible to meet as a SaaS provider. I suspect many smaller municipalities will present you with the same nonsense. In our case, this was not what ultimately killed us, but based on this experience I would advise you to avoid putting all your eggs in one basket and perhaps avoid altogether working a government that is not ready for SaaS once you find out that is the case.

</comment><comment><USER11> My brother in law's brother is the founder of ClearGov which sells SAAS to municipalities for reporting budgets and such. If relevant shoot me an email, include some information so I can lay it up for him and I will make an email intro. Can't promise other people's time but never hurts to ask.

</comment><comment><USER12> At [https://apply4.com/](https://apply4.com/) we have a SaaS helping local municipalities streamline how they manage particular types of permitting, including permits for filming and special events.

The sales process has typically involved multiple in-person meetings (until recently, at least) and been very long with larger contracts needing to go out to tender.

Not sure if it'll be the case for you, but we often need to persuade multiple people from the department that will be paying for the software as well as one or more people from the municipality's central IT team (who naturally have rather different concerns and priorities).

</comment><comment><USER13> Worked on a startup doing something very similar--would recommend against it. As everyone else is saying, the sales process is incredibly long and most local governments just aren't used to buying SaaS. Local partners are important AND you'll need to be very good at sales: can't rely on marketing to bring in customers.

It's a hard business to bootstrap unless you have a large bank account to fall back upon for years while waiting for sales growth to kick in.

</comment><comment><USER14> Anything over a threshold requires bidding (usually rfp process). There are only like 20 cities that have money, everyone else is scraping buy. If you can deliver value for $100 / month, you can make money, otherwise you're looking at the rfp process. There are rfp aggregators like rfpmart and others that capture about 50% of the rfps out there. You should also be warned that there probably is competition out there even if you were unaware of it.

<comment><AUTHOR> rfp threshold is closer to 4000usd in Iceland. An annual contract could be rolled year-by-year under that, and there are 72 municipalities to sell to.

</comment></comment><comment><USER15> Worked on some of this in the UK a few years ago. Main complexity from a tech pov is hooking into whatever CRM and line of business and workflow/workforce management solutions the local authority uses. And then in public sector it's not unusual to have a requirement for open bidding for a solution.

</comment><comment><USER16> The first company in Switzerland I worked at in the mid 2000s as one of the first employees, did records and project managment platforms, intranets and CMS originally for civil engineering projects later for goverment agencies, cities, states, NGO, public schools and universities, etc.

Sales processes are long. 6 to 12 months if I rember correctly. But ones you sell, it might well be a 10-15 years subscription with a bunch of additional services like support contracts and customizations. Also it becomes easier ones you have the foot in the door somewhere and use word of mouth referals from there.

I don't know how well typical start ups do in this space, because of the stability requirements which might not be something you'd want to commit to. But it has been exellent for the fully bootstrapped companies I know.

</comment><comment><USER17> [https://neighborland.com/](https://neighborland.com/)

</comment><comment><USER18> I'm an investor in [https://permits.com/](https://permits.com/) which is that exact space but potentially different business model.

Regardless, it's hard to make inroads into _any_ government space if you don't already have experience in it. It's not nepotism or "backroom deals" but more just jargon, processes, understanding the buyer, etc, etc.. aka not unique to government at all.

When you're first trying to enter _any_ space, coming into sell is the hardest approach. You're viewed with suspicion. It's 100x easier (still not easy) if you're already a participant in some way.

</comment><comment> ben-gy Municipalities are my biggest client base for [https://covidcomply.org](https://covidcomply.org) \- I've been doing a spray and pray sales approach for this that has been going very well - <USER2> like to make things complicated but what I've found is most of the time the person on the other side is sick of the long complex processes as well which makes relationship based sales work well - this in references to Australian culture though - this might not translate to wherever you are based

</comment><comment><USER19> I was at a conference in Australia once (I'm an American). I met a company there that sold software to local governments.

I asked them if they ever considered expanding to the US. They answered something like this:

>No, because governments in America are constrained because Americans hate their government and get upset whenever it spends any money. Americans want their government to spend the least by buying the cheapest stuff, so dealing with them is more trouble than it's worth. No local government in America will ever invest in quality.

</comment><comment><USER20> Remix.com sells transportation software to local municipalities. I believe they have a ton of traction worldwide at this point.

</comment><comment><USER21> [https://en.wikipedia.org/wiki/Startup.com](https://en.wikipedia.org/wiki/Startup.com)

</comment><comment><USER22> [https://www.governmentwindow.com/](https://www.governmentwindow.com/)

Had to deal with them last year.

</comment><comment><USER23> Many small municipalities outsource their permits and inspections. It might be better to target those inspection/permit companies.

</comment><comment><USER24> Barcelona made this [https://decidim.org/](https://decidim.org/)

</comment><comment><USER25> www.peoplegis.com's peopleforms and mapsonline, on which is built everything from building permits and payments, workorder management and snow ops, to elder services, dog permits, cemetery management and a lot more. Incredibly flexible SaaS used by a lot of small-medium cities and towns.

</comment><comment><USER26> [https://opengov.com/](https://opengov.com/)

</comment><comment><USER27> Opengov is probably the market leader, and it's taken them a while</comment>


$1.5 billion: The cost of cutting London-Toyko latency by 60ms - <AUTHOR> http://www.extremetech.com/extreme/122989-1-5-billion-the-cost-of-cutting-london-toyko-latency-by-60ms <comment><USER2> The title of the post makes this sound frivolous, but it actually seems like a worthwhile endeavor. 60 ms * the number of packets sent back and forth is significant; and, as the article points out, it'll also add redundancy to the cable network between Asia and the rest of the world.

<comment><USER3> Absolutely. Voice traffic is a big consumer of IP bandwidth these days. The difference between a call made over a link with 170 ms of latency and 230 ms of latency is significant. In conversational terms, the average call participants will start being annoyed at around 300 ms. At 230 ms, any hiccup is going to make the call pretty frustrating. Shaving 30% off that latency buys you some headroom and better general conversational performance.

In a greater sense, voice can teach you a lot about the challenges of network various conditions. You can pick and chose a codec to work around a low bitrate, or even high loss rates, but when working with latency, you're stuck. This looks like $1.5 billion well spent.

<comment><USER4> Actually, the plan for this arctic cable is mostly driven by the needs of the financial-services industry in London and Tokyo (i.e. high frequency trading, ultra low latency direct market access, etc).

<comment><USER5> HFT is using colo servers sitting as close as possible to the servers actually handling the transactions. No one serious about doing HFT is even considering switching traffic for more than a few miles if they can avoid it. This cable has nothing to do with HFT.

<comment><USER6> If you are trading only one market, no. If you do arbitrage across two or more exchanges, then it matters.

</comment></comment></comment></comment></comment><comment><USER7> It looks like Artic Link is going to bring it down to 86ms [1] with an initial capacity (surprised they didn't talk about that) of 2FP x 8λ x 40Gbps = 640Gbps.

The Artic Fiber website is full of good information, including expected latency between a bunch of cities, and high level colocation options [2].

All I could find on the Russian initiative was this simple website [3]. Total available capacity is 100WL x 100 Gbit/s, but no idea what phase 1 will be.

[1] <http://www.arcticlink.com/home.html>

[2] <http://www.arcticfibre.com/service-offerings.html>

[3] <http://www.polarnetproject.ru/>

</comment><comment><USER8> The first benefit of global warming?

"Until now it has been impossible to lay cables in the Arctic Ocean, but the retreat of the Arctic sea ice means that the Northwest Passage is now generally ice-free from August to October..."

<comment><USER9> May not be the only benefit, during the Medieval Warm Period humanity benefited greatly from increased crop yields and milder winters.

<comment><USER10> > May not be the only benefit, during the Medieval Warm Period humanity > benefited greatly from increased crop yields and milder winters.

"Humanity" meaning Northern Europeans? The MWP led to prolonged droughts and floods throughout other parts of the world.

<comment><USER9> Other parts of the world didn't keep as good records, so the data is not great. A drought in north America seemed clear, but other parts of the world did not seem to be badly affected.

That's kind of the nature of change - some benefit, others loose. Anyway, I was just listing another example of a benefit, not trying to make a value judgment.

<comment><USER11> There is a hypothesis that the Angkor civilization collapsed due to the lake and wetlands around the city drying up. It is widely agreed that at the time the city around Angkor Wat was the largest in the world. The Angkor civilization collapsed at roughly the time of the Medieval warming period.

It is just a hypothesis but a very interesting one.

</comment></comment></comment></comment></comment><comment><USER12> Who pays for these cables? Is it the governments or are they entirely privately financed?

<comment> excuse-me Private. Either a group of investors do it and look for telco customers to rent bandwidth to. Or cable laying companies like Cable and Wireless will lay a cable if they have spare capacity and try and sell it. Or sometimes a consortium of telcos will lay a cable.

Outside china I can't see a government fronting money for a cable

</comment></comment><comment><USER13> This seems relevant: [http://www.ted.com/talks/kevin_slavin_how_algorithms_shape_o...](http://www.ted.com/talks/kevin_slavin_how_algorithms_shape_our_world.html)

It's a talk about how physical geography is being shaped by HFT...

</comment><comment><USER14> Whenever submarine cables comes to my attention, the one thing I'm always curious about is what happens when they break?

This article links to another they posted[1] and they then link to Wikipedia[2], and there's some exposition given on what happens when things break, but if these things are 3 inches thick and thousands of miles long, other than burying them and having ships nearby to go out and make repairs, is there anything special that the maintainers of these cables do to safeguard against damage? Has anyone covered that in a good article somewhere that I can read?

Not only that, but while a cable is broken, are there redundant cables along the same path, or is traffic routed around the problem via some long detour? Is there a way to see the cut-off from cross-continent round-trip time graphs?

[1]: [http://www.extremetech.com/computing/96827-the-secret- world-...](http://www.extremetech.com/computing/96827-the-secret-world-of- submarine-cables)

[2]: [http://en.wikipedia.org/wiki/Submarine_communications_cable#...](http://en.wikipedia.org/wiki/Submarine_communications_cable#Modern_history)

<comment><USER15> There are fleets of cable ships all over the world who are paid a retainer to repair breaks. When losses are calculated in tens of thousands of dollars a second (edit thousands per minute) it's worth it. On the off time they pull up and scrap defunct cables, as they can be a hazard to shipping traffic (think anchors).

<comment><USER16> _tens of thousands of dollars a second_

That seems a little on the high side.

A cable break is expensive, but not 1 billion dollar/day expensive.

<comment><USER17> No, not if it only costs $1.5bn to install one.

</comment></comment></comment></comment><comment><USER18> "All three cables will connect the United Kingdom to Japan, with a smattering of branches that will provide high-speed internet access to a handful of Arctic Circle communities."

I can see it now. You can get fiber in the arctic circle, but you can't get fiber in <insert local town> near <big city>!

<comment><USER19> It figures; it's an awful lot easier to lay cable under the sea than it is to do so in towns and cities.

</comment></comment><comment><USER9> For High frequency trading, wouldn't it be easier to just have a remote desktop?

Is there a reason the trades need to placed so far from the exchange?

<comment><USER20> I think you must realise that there are multiple exchanges involved in the 'market' which these traders operate in. The speed of placing an order is important but the information about other related prices and indices is also very relevant. Getting this information 60ms before other market participants would give you a huge advantage.

<comment><USER9> 60ms would make no difference to how fast a human can make a decision. This is for automated trading.

So can't they put a computer near each market that would get the relevant information quickly and place the order quickly as well?

<comment><USER21> the computer would need data from the other exchange(s) as well, not just the one its nearest to

<comment><USER9> I didn't think of that, thanks.

Although aren't the exchanges open at different times? I guess there is some overlap.

<comment><USER20> If you look at the bottom of the 24 hour graph here (<http://www.kitco.com/charts/livesilver.html>) you can see the opening hours for different exchanges around the world. You can see that for a few hours London, New York, and Hong Kong or New York, Hong Kong and Sydney are open. It's quite interesting and of course a bit of a headache if you have to work in a multi-timezone system.

</comment></comment></comment></comment></comment></comment><comment> T-Winsnes Does anyone know if this would affect latency from Australia to the UK?

<comment><USER22> Unlikely that a route over the north pole would help. Only if the traditional one were truly horrible.

<comment><USER23> The only Australian links with any affordable capacity go through to the US, which is how UK traffic is routed :/

</comment></comment></comment><comment><USER24> There is all kinds of activity happening because of the opening of the north west passage including billion dollar bets like this one. But the global warming deniers keep denying. It's baffling.

<comment><USER25> Some would argue it's a natural cycle and not especially caused by humans. Other comments in this thread allude to something similar happening in medieval times

<comment><USER24> Some would be making stuff up and ignoring what scientists have been telling us.

<comment><USER26> You mean, like that CO2 lags not leads temperature change?

<comment><USER27> Not at all. It is true that CO2 has never led temperature change before; that's because the massive anthropogenic CO2 spike in the data is completely unprecedented, so we don't know what happens when CO2 increases massively "on its own".

Climate scientists try to figure out whether this could affect global climate, and many say it can and probably is. This latter thing is what is being ignored.

</comment></comment></comment></comment></comment><comment><USER28> It would be good news for esports. Currently due to latency game companies opt to split the world into regions and sell regionally linked copies of the game.

<comment><USER29> I don't believe that's the reason. It's a relatively new phenomenon.

If you region-lock your games, then people in Europe/Asia can't buy the cheaper North American version and play it locally.

<comment><USER28> I didn't mean to imply it's on the list of reasons. Just a side effect.

</comment></comment></comment><comment><USER30> Can headlines be edited? Tokyo is misspelled...

</comment><comment><USER31> Now I have new answer for when people ask what value HFT adds.

<comment><USER29> Isn't "large amounts of liquidity" enough?

<comment><USER32> This may be a myth. Nanex (<http://www.nanex.net/>) does a lot of detailed analysis of the HFT. Their view, and it is supported by a lot of data and many very detailed, if not intuitive graphs, is that HTF does not help liquidity.

<comment><USER29> I've read some of their analyses before. Most people automatically associate HFT with the Flash Crash and claim it's bad for the market. The HFT algorithms pulling out of the market exacerbated the Flash Crash by drastically reducing liquidity, so there's some anecdotal evidence at any rate.

<comment><USER33> The bigger claim that it's bad for the market is because it's parasitic front running.

<comment><USER29> Frontrunning is definitely shady, but (from what I've read) only a small subset of HFT firms actually have the setup to do it. Those firms have custom FPGAs implementing the minimum amount of the Infiniband spec because anything else is too slow. They also pay a boatload to colocate their servers physically _right_ next to the exchange backbones.

Most HFT is not frontrunning.

<comment><USER34> ...but there apparently is enough of it where a 60 mSec advantage is worth the $1,500,000,000 investment.

<comment><USER29> Frontrunning isn't measured in milliseconds. It's microseconds (and soon nanoseconds).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> Now I don't feel so bad about spending a month of my time to make our search results page 40ms faster at Indeed.com

</comment><comment><USER4> No on mentions one of the real behind-the-scenes motives for these new lines: Tokyo and London are major hubs for the financial services industry and reducing even 60ms in transmit time means big bucks for High Frequency Trading in these two stock markets: <http://en.wikipedia.org/wiki/High- frequency_trading>

<comment><USER36> Uhm, did you read the post? That is exactly what they say the reason was.</comment></comment>


Advice to a Young Mathematician [pdf] - <AUTHOR> http://press.princeton.edu/chapters/gowers/gowers_VIII_6.pdf

<comment><USER2> If you like this stuff, recommend you read Hamming's "You and Your Research" (<http://www.cs.virginia.edu/~robins/YouAndYourResearch.html>), which is thought-provoking and approachable.

Ha, Sir Michael Atiyah's advice to a young mathematician includes a great anecdote: ""J. E. Littlewood is reported to have set each of his research students to work on a disguised version of the Riemann hypothesis, letting them know what he had done only after six months. He argued that the student would not have the confidence to attack such a famous problem directly, but might make progress if not told of the fame of his opponent! The policy may not have led to a proof of the Riemann hypothesis, but it certainly led to resilient and battle-hardened students"".

What a great story — sounds like it just leapt off the pages of the McSweeny's list "Zen Parable or Just Someone Being Cruel?".

<comment><USER3> Sounds a little like the Dantzig story: <http://www.snopes.com/college/homework/unsolvable.asp>

</comment></comment><comment><USER4> love it... probably not intended but i found it fascinating how the description of finding new ideas and approaches in mathematics (or any field for that matter) is similar to that in startups. this part in particular resonated

"If you keep asking yourself such questions when reading a paper or listening to a lecture, then sooner or later a glimmer of an answer will emerge—some possible route to investigate. When this happens to me I always take time out to pursue the idea to see where it leads or whether it will stand up to scrutiny. Nine times out of ten it turns out to be a blind alley, but occasionally one strikes gold. The difficulty is in knowing when an idea that is initially promising is in fact going nowhere. At this stage one has to cut one's losses and return to the main road. Often the decision is not clear-cut, and in fact I frequently return to a previously discarded idea and give it another try"

</comment><comment><USER5> I would like to archive this so that I can go back to it later, however I can't seem to find the original work and scribd is holding it hostage asking for a signup as ransom. Can anybody point me out to the source?

<comment><AUTHOR> _I would like to archive this so that I can go back to it later, however I can't seem to find the original work and scribd is holding it hostage asking for a signup as ransom._

The original source (Princeton University Press) URL

<http://press.princeton.edu/chapters/gowers/gowers_VIII_6.pdf>

appears if you mouse over the submission title here. I never read on scribd, which always annoys me with usability issues like that. But, alas, any user of HN who submits a .PDF link will find it automatically styled to also link to scribd.

<comment><USER6> Is there a userscript or anything for getting rid of the scribd links? I tried to adblock but the markup is too simple to let it identify them.

<comment><USER7> Why? They're not that large, just click the original title instead. I would understand if you asked for a Google Cache replacement, though (I use a bookmarklet for that).

</comment></comment></comment></comment><comment><USER8> In the risk of being downvoted to death, I think reposting these articles is necessary:

'Don't become a scientist!': <http://wuphys.wustl.edu/~katz/scientist.html> 'Women in science': <http://philip.greenspun.com/careers/women-in-science>

The career for pure mathematicians(which is more like the humanities, and specific knowledge quite untransferrable) in academia, being better or worse, is open for discussion.

<comment><USER9> Quite questionable examples. Most girls I know become teachers/nurses/psychology/doctors and a few engineers. Zero in CS usually. It's only about the money in the US because your diploma costs too much money and you need to pay down your debt. His webpage only applies to the US, I'm sure other countries like Russia have babes in Computer Science (See Golden Eye).

</comment></comment><comment><USER10> There is so much good advice in here directly applicable to entrepreneurship!</comment>


Streeme - a private, HTML5 based music server (alpha release) - <AUTHOR> http://code.google.com/p/streeme/

<comment><USER3> This looks awesome. This may seem shallow, though, but when I got to the setup page, I was a little disappointed with the complexity of the setup required.

\- Why are you using MySQL instead of SQLite or something even simpler? Surely my personal music streamer doesn't need serious scalability.

\- Why does the setup require futzing with my Apache configs to use mod_rewrite? For just streaming music, I'm willing to put up with ugly ("something.php/directory") URLs. This would also make it easier to get up and running with non-Apache web servers (lighttpd, for instance).

\- Do I really need to use a non-default PHP configuration? And increasing the interpreter's memory limit seems a little ominous.

This is all to say that perhaps the right way to deploy something like this would be as a single program you can run that has its own built-in Web server. As it is, the configuration is daunting for a home computer (although completely reasonable for a real server setting).

<comment><AUTHOR> 1\. You can use SQLite or postgres if you'd like :) they all work in my tests. Just replace the database connection string with the sqllite or postgres one. My docs are just for a common lamp configuration. MySQL is a bit more performant thanks to the query caching part.

2\. the mod rewrite is part of the framework I'm using (Symfony 1.4). just makes things a little easier to secure and the code a bit more maintainable. Luckily you only have to do it once. There is a VM version that uses vmware and it works fairly well if you don't feel like doing a bunch of setup - <USER2> iTunes won't play nice with the VM edition because of static paths :/

3\. the problem I found is that if you have a large library, the itunes xml can take a lot of ram to parse. If you're not using itunes, the RAM demands might be a bit lower.

I do hear you on the setup complexity. I think when I get closer to a perfectly stable program with developers familiar with buidling system specific installers, I'd like to build a slick installer that installs and spins up a server for you. For now there's the VMware image.

</comment></comment><comment><USER4> This is pretty awesome, but doesn't PHP have some framework or library for running webapps with their own web servers? I really dislike trying to get PHP working and then have to get nginx or Apache working.

At the risk of sounding too stuck up, Ruby and Python have many frameworks for running themselves as web servers.

<comment><AUTHOR> I hear you.. I'm using a PHP framework to be sure, but it doesn't come with a web server yet. I have a kind of love hate thing with PHP myself - distributing it isn't all that easy. That said, I made a debian linux image all set up if you'd like to just try it for a while before taking the plunge into a custom install. [http://code.google.com/p/streeme/wiki/InstallingStreemeHomeS...](http://code.google.com/p/streeme/wiki/InstallingStreemeHomeServer)

</comment></comment><comment><USER5> Awesome, thanks. This might be an alternative to Rdio for some people.

</comment><comment><USER6> I created the exact same thing using Kohana but has a community aspect. My friends love it, I think this would be great if it offered community features.

</comment><comment><USER7> Looks great. Like subsonic except w/ a nice UI.

<comment><AUTHOR> Thanks! I didn't find out about Subsonic until just recently, but it looks like it needs native apps on mobile. I was trying to go as close to a pure web browser based application as I could. Scratching an itch, I guess :)

</comment></comment><comment><USER8> I wonder how much memory this lamp setup ends up using compared to the jvm (for subsonic).

<comment><AUTHOR> Runs about 30MB idle streaming a song with PHP and 97MB peak scanning 8500 songs using iTunes.xml. FFMpeg uses a bit of ram, but I think song scanning is the most intensive because of the stupid plist parsing task not streaming its results to PHP nicely. It's on the todo list for cleaning up.

</comment></comment><comment><USER9> Very nice, I'll be setting this up on my server later tonight.

</comment><comment><USER10> How come this thing wants my AWS credentials?

<comment><AUTHOR> That's just the boilerplate config for cloudfusion (a PHP based Amazon API library that streeme uses). Just fill in the bare minimum to get streeme to fetch art. - In my experience, it's AWS_KEY, AWS_SECRET_KEY, AWS_ASSOC_ID & AWS_DEFAULT_LOCALE

</comment></comment><comment><USER11> I'd like to store my music in S3 and have this running on my personal webserver to point to my files in S3. Is something like this possible? I suppose I could mount my S3 storage on my webserver.

<comment><AUTHOR> Yep.. just run it as a mounted drive and point your watched folders config to it.</comment></comment>


Is Google Chrome the New IE6? - <AUTHOR> http://www.pcmag.com/article2/0,2817,2397158,00.asp

<comment><USER2> The difference that Michael Muchmore and PCMag are (deliberately) failing to understand is that while these new features are currently only implemented by chrome, this is only because other vendors have not yet implemented them, whereas with IE6 MS prevented other people from implementing them. This is what "lock-in" means.

There is absolutely nothing stopping MS from copy and pasting huge chunks of chromium into IE tomorrow. That was not the case with activex.

Like others have said, this article is trolling us.

<comment><AUTHOR> Yes, it is kind of amazing. I almost submitted it with the title "Does PCMag Know What Open Means?" but I decided that there was enough linkbait/troll in the material already. If nothing else, it does highlight that the concept of "open" is still poorly grasped even within technical circles.

</comment></comment><comment><USER3> Go ahead and ignore the elephant in the room: Chrome is open source, IE6 is proprietary software. IE was a means to an end for Microsoft, and that end was extinguishing the uprising that is the internet. They almost succeeded, but ultimately failed.

Chrome may have feature and marketshare parallels to IE6, but it will never be IE6. IE6 was weilded in anger. Chrome is open source, which significantly limits Google's ability to use it in a similar fashion. Not to mention, Google isn't out to kill the web in the way that Microsoft was.

</comment><comment><USER4> I think we're being trolled.

"Great stuff, faster Web interactions, but let's not forget that that universal access using any software is why the Web took off in the first place." Has he any had experiences where a site served only SPDY clients?

</comment><comment><USER5> There is nothing stopping other browsers from implementing the same features, most of them are probably fully documented standards anyway, even if there was no documentation people could just look at Chromium's source code, which was certainly not the case with IE.

This article is immensely ignorant, it basically states that no browser should have capabilities that other browsers lack, if that would be the case than we would end up in a deadlock, because everyone would wait for everyone.

Emerging standards need to be tried in the open, Google is doing the right thing, they are trying SPDY with real world web apps and real world customers so that it will mature by the time other browsers implement it and we won't be stuck with implementations that suck.

</comment><comment><USER6> Not even close. What an incredibly sensationalist title from PC Mag.

</comment><comment><USER7> The iPad IS the new IE6 <http://blog.millermedeiros.com/2011/01/ipad-is-the- new-ie6/>

</comment><comment><USER8> Re: that angry birds thing, it sounds to me like Google was marketing the levels as "Chrome exclusive", but not that it specifically took advantage of functionality that was only available on Chrome. I'm thinking something like user-agent detection...? I'm info-poor, here, I admit.

</comment><comment><USER9> I didn't read the article because it's crap. Did they mention that it auto- updates? That alone makes the whole argument invalid because as long as there is auto-update there is no lingering in the past.

</comment><comment><USER10> In addition to what other commenters have said, IE6 got huge market share then stagnated. Even worse, when IE7 came out, people didn't upgrade. Chrome continues to improve and auto-update.

</comment><comment><USER11> So, IE6 owns "Embrace, extend and extinguish"?

</comment><comment><USER12> No.</comment>


Google has removed the link to the "best" version of Google Scholar - <AUTHOR> http://scholar.google.ca/advanced_scholar_search?hl=en&sciui=2&as_sdt=0,5 I have used Google Scholar for the past 3 years to do free and quick legal research.  My school gives us access to very expensive alternatives like WestLaw and Lexis Nexis but that doesn't help much except people who then go on to work at firms that can afford unlimited subscriptions to these services.
In that same period, I have watched Google Scholar actually regress in it's usefulness.  I understand that it is not called Google Legal Research but the updates to the search format since I started using it have actually made it harder to do the type of research I need as I have learned to get better.  The only "improvement" I've seen is to literally remove old improvements.
Up until at least last week, they allowed you to revert back to the old look with a link on the main Scholar page.  That link now appears to be gone and I hope that they will not remove the feature completely since the old link location itself still works.
Google needs to, at a minimum, put the option of using the "old" version and, optimally, should reinstate the "old" version as the "new new" version plus some actual improvements. <comment><AUTHOR> I have used Google Scholar for the past 3 years to do free and quick legal research. My school gives us access to very expensive alternatives like WestLaw and Lexis Nexis but that doesn't help much except people who then go on to work at firms that can afford unlimited subscriptions to these services.

In that same period, I have watched Google Scholar actually regress in it's usefulness. I understand that it is not called Google Legal Research but the updates to the search format since I started using it have actually made it harder to do the type of research I need as I have learned to get better. The only "improvement" I've seen is to literally remove old improvements.

Up until at least last week, they allowed you to revert back to the old look with a link on the main Scholar page. That link now appears to be gone and I hope that they will not remove the feature completely since the old link location itself still works.

Google needs to, at a minimum, put the option of using the "old" version and, optimally, should reinstate the "old" version as the "new new" version plus some actual improvements.</comment>


NY bill would provide tax credit for open source contributors - <AUTHOR> https://opensource.com/government/16/3/ny-bill-tax-credit-open-source-contributors <comment><USER2> It's only up to $200 but still that's an extra $200 break if you're doing a lot of open source work. I contribute to other projects when I find an issue but I mostly work on my own project (msngr) and it would be pretty awesome to write off some of the time and money I spend on it.

Hell if it expands beyond $200 I could see myself contributing to more open source. Though this could be easily be abused as well.

Maybe I shouldn't be excited. Maybe I should be complaining and wanting a more simple tax code. But it's cool when anyone in the government recognizes open source.

</comment><comment><USER3> Awesome. Now I just have to convince them that all my home HW is for open- source and my time is very valuable.</comment>


Glympse grabs $12M to take real-time location sharing tech to the next level - <AUTHOR> http://venturebeat.com/2014/06/13/glympse-grabs-12m-to-take-real-time-location-sharing-tech-to-the-next-level/

<comment><USER2> Congratulations. Looks like a promising application although I imagine they are a bit in danger of Apple themselves building this technology.</comment>


FDA to Ban Juul, Flavored E-Cigarettes If Industry Doesn't Change - <AUTHOR> https://www.bloomberg.com/news/articles/2018-09-12/fda-threatens-to-pull-e-cigarettes-to-fight-rise-of-youth-vaping <comment><USER2> It's still amusing to me that Juul markets itself, raises money, and structures its ranks like a technology startup, but they're really a tobacco company. Every trope about "growth hacking" from a traditional startup apply here, except that "growth hacking" is most impactful with getting kids to smoke, which I at least assumed was a non-starter for forward-thinking people in the 21st century. Yet, here we are, with a tech startup that likely _needs_ kids to smoke in order to turn their company's financials right-side-up for a successful exit.

<comment><USER3> I don't know how anyone who works for JUUL Labs can sleep at night.

<comment><USER4> It's likely that on balance they have saved many lives.

<comment><USER5> I've heard that a fair few times before about vapes. That they are 'cleaner' than cigs, and therefore better. But I've not yet seen a peer-reviewed study on them that proves they are less bad than cigs. Is there one? I mean, nicotine is itself not a good thing to be exposed to [0].

[0] [https://en.wikipedia.org/wiki/Nicotine#Adverse_effects](https://en.wikipedia.org/wiki/Nicotine#Adverse_effects)

<comment><USER6> [https://www.gov.uk/government/news/phe-publishes- independent...](https://www.gov.uk/government/news/phe-publishes-independent- expert-e-cigarettes-evidence-review)

<comment><USER7> Thank you (and favorited for later reference).

Here's a question that I don't see answered in this page though: I'm a non- smoker and asthma patient (was diagnosed at age 7, the cause is most likely second-hand smoke from my father), so I always stay clear of smokers and don't let anyone smoke indoors while I'm around. What is a reasonable policy to assume wrt vaping? Do we have any evidence regarding second-hand vaping? I'm not particularly worried about getting addicted that way, but about whether the smoke from an e-cigarette can be harmful to me as an asthma patient (or to others).

(And while we're at it: What about Marlboro's Iqos? I stood next to someone using one of these a few weeks ago and the reduction in second-hand smoke and stench is remarkable.)

</comment></comment></comment></comment></comment></comment><comment><USER8> I have friends and family that either quit using vapes or substituted then permanently. As a former half a pack smoker myself, on occasion I would smoke a cigarette at a bar because it's such a nice feeling, then feel guilty the next day. Juul is the only e-cig that I really like, and since I bought one I've yet to smoke a cigarette when drinking. Banning them because "think of the children!" is extraordinarily short sighted. Why not ban fruity alcoholic drinks too? Kids prefer those to beer.

<comment><USER9> >Why not ban fruity alcoholic drinks too? Kids prefer those to beer.

Because alcohol use is much more socially accepted than nicotine use.

<comment><USER10> the alcohol and tobacco lobbies are also way more powerful

<comment><USER11> Juul is the first mass-market e-cigarette product I'm aware of that _isn 't_ directly or indirectly owned by a company that was already in the traditional tobacco market.

</comment></comment></comment></comment><comment><USER6> I highly suspect these young vapers would have picked up smoking instead if products like this didn't exist.

I don't know what more the industry can realistically do. The sales of their products is already limited to adults, and I don't know why advertising flavorings is supposed to be about targeting children (why would adults not like strawberry flavoring?) so unless there is an epidemic of B&M or online stores that keep selling to minors, they're already doing what they can.

Maybe I'm missing something, but as an outsider, the FDA seems dead set on killing your vaping industry by all means necessary.

<comment><USER12> >I highly suspect these young vapers would have picked up smoking instead if products like this didn't exist.

personal observation, not data, but I don't think this is so. I work on a university campus, and the proportion of people on campus that smoke has cratered this decade. The only reliable smoking populations are foreign students, and they seem to taper off over their undergrad years, which I can ascribe only to peer pressure against smelling horrible -- and maybe easy access to "study aids" like adderall.

edit: i should add that juul use has jumped just this year alone, and with less focused of a user group.

<comment><USER13> But doesn't that line up with the popularization of nicotine vaping?

I tend to think indoor smoking bans had something to do with the decline, but I don't know the timeline for anywhere except my state.

<comment><USER12> it does, loosely. However, box mods are still quite rare, so it's not super clear that the narrative of "people stopped smoking and started vaping" really holds -- or held until Juul took over, which is quite recent.

It's fairer to say that an age cohort basically just stopped consuming nicotine at all, and that a new, younger generation has picked up again but switched delivery methods.

</comment></comment></comment></comment><comment><USER14> I'm astonished that there are folks in this thread who believe vaping to be as harmful as smoking cigarettes. Are there any peer reviewed papers supporting this assertion? I've kept an eye on literature as it's been released and everything indicates orders of magnitude less cell death and disruption from nicotine and flavor carrying PG/VG vape juice than cigarette smoke. Linked a DOI supporting this understanding elsewhere, but wondering if folks have papers supporting the opposite?

<comment><USER6> The amount of misinformation in this thread is worrying. Seems like your American pharmaceutical lobbies, or whoever gains in destroying the vaping industry, have succeeded in spreading the idea that vaping is somehow more damaging than smoking. Now that the science showed pretty clearly it's at least way less dangerous than cigarettes in short-to-mid term, they switched the narrative to "for the kids".

</comment></comment><comment><USER15> As a former smoker who was only able to quit using Juul, this is disappointing to me. As a father of a one year old, I understand the reasoning behind this.

I think perhaps the answer is to make the Juul and similar products less appealing to youth. How? Of course this is a complex topic but less flashy hardware and marketing could be a small start.

<comment><USER16> I'm afraid you haven't actually quit, merely swapped one delivery mechanism and associated set of toxic compounds for another.

<comment><USER15> I was able to quit using Juul. That is to say, I no longer smoke cigarettes or Juul.

<comment><USER17> But this is somewhat an admission of using it as medication, which is far from what Juul is being marketed as. It should be next to the nicotine patches at the pharmacy. Can you even buy nicotine patches in bulk? Substances that can be abused for something other than their primary use as medication are heavily regulated by the FDA (think meth ingredients).

</comment></comment></comment></comment><comment><USER18> Last I checked, nicotine isn't carcinogenic. It's the tobacco that kills you. Or, at least, there isn't enough research yet to say that nicotine alone is harmful enough.

So I may be playing devil's advocate here, but isn't this a net improvement over the last few decades? Kids getting hooked on something that's significantly less deadly? It's not ideal, sure, but it's better than a slew of cancer epidemics.

What is the FDA trying to achieve?

<comment><USER19> > Kids getting hooked on something that's significantly less deadly? It's not > ideal, sure, but it's better than a slew of cancer epidemics.

The whole point is that these are kids who wouldn't be using nicotine products _at all_. Smoking rates have declined in the US over the last 40 years, and yet there's been an uptick in youth nicotine usage since the introduction of e-cigarettes.

So when talking about youth usage, no, this is clearly not an improvement, by any measure.

<comment><USER20> If we don't block the consumption of caffeine in youths, why should we block the consumption of nicotine - a compound with similar effects?

i.e. Why is nicotine so much worse than THC, alcohol, caffeine, guarana, or any number of other stimulants/depressants?

<comment><USER19> > If we don't block the consumption of caffeine in youths, why should we block > the consumption of nicotine - a compound with similar effects? i.e. Why is > nicotine so much worse than THC, alcohol, caffeine, guarana, or any number > of other stimulants/depressants?

Alcohol and THC are both already restricted to adults. Caffeine is restricted as well, in that many places won't sell caffeine pills to people under 18.

Nobody is talking about preventing kids from buying tomatoes. But when we're talking about concentrated and extracted forms of a stimulant... those are already heavily restricted.

<comment><USER21> Caffeine in Coca-cola or other energy drinks is not a restricted substance/ quantity based on age.

</comment></comment></comment></comment></comment><comment><USER22> Straight from the CDC:

> Nearly 8 of every 100 high school students (7.6%) reported in 2017 that they > smoked cigarettes in the past 30 days—a decrease from 15.8% in 2011.

>Nearly 12 of every 100 high school students (11.7%) reported in 2016 that they used electronic cigarettes in the past 30 days—an increase from 1.5% in 2011.

While of course e-cigs aren't harmless, there's a pretty clear replacement effect between them and cigarettes. Kids are going to do stupid things anyways, taking away the more enjoyable of the two isn't going to stop that.

[1] [https://www.cdc.gov/tobacco/data_statistics/fact_sheets/yout...](https://www.cdc.gov/tobacco/data_statistics/fact_sheets/youth_data/tobacco_use/index.htm)

<comment><USER23> It seems like it might not just be a replacement effect, though. Adding those numbers together, and pretending that 2016 == 2017, you get an increase from 17.3% of kids using either in 2011, to 19.3% in 2016/2017.

Perhaps you can make an argument that, lacking tar and being (purportedly?) less addictive, e-cigs are enough less bad that a net increase in the number of kids consuming nicotine is an acceptable price for halving the number of kids who are smoking cigarettes. That's a more arguable argument, though.

</comment></comment><comment><USER12> I have long been confused how Juul manages to avoid getting taxed into oblivion.

A cart has ~2x packs of cigarettes worth of nicotine, yet is regularly sold for ~$15 in my state, which is a 50% or greater savings over traditional cigarettes. I don't entirely understand how this is legal.

The FDA is in an interesting regulatory bind here, too -- I think nicotine is unique in their regulatory scope in that the FDA is concerned with efficacy and safety and tobacco products are known to be unsafe and ineffective therapeutic agents.

<comment><USER24> Not arguing your main point at all, but I wanted to correct your last statement. While not considered safe, cigarettes have proven to be remarkably protective against the development of Parkinson's disease in a slew of studies spanning decades of research. This is relatively little-known outside of the field. I did my PhD in Parkinson's drug discovery, and it was one of those findings that is frustrating due to the lack of other effective therapies for PD prevention and the obvious deleterious effects of smoking on heart disease, lung cancer, etc. Here's a relatively recent review paper on the topic: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5494127/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5494127/).

Relevant excerpt: "Population-based studies have shown that smoking was associated with approximately 40–50% reduced risk of developing PD. [10, 11] This inverse relationship between smoking and PD was dose-dependent: age- adjusted relative risks (RRs) of PD were 0.8, 0.6, 0.5, and 0.4, for 1-9, 10-24, 25-44, and 45+ pack-years, relative to never-smokers, as shown in a large prospective cohort study [9]. There is also a temporal relationship between cigarette smoking and PD risk [9, 17]. Individuals with more years of smoking, older age at quitting smoking, and fewer years since quitting smoking had lower PD risk. Researchers prospectively observed a significantly lower risk of PD for smoking as early as 15 to 24 years before symptom onset, but not for smoking 25+ years before onset (n = 143,325) [17]."

<comment><USER25> Interesting. I wonder if vaping would have the same effect, or if it's some other ingredient?

</comment></comment></comment><comment><USER26> This is just stupid. Until the government wants to ban crap like watermelon vodka, this is just a win for traditional tobacco companies. Should we be encouraging anyone to smoke or Vape? No. But that doesn't mean shitty retailers breaking the law aren't the bigger problem. Do parents have no responsibility here anymore?

</comment><comment><USER27> Time to pivot to caffeine vaporizers. Or one of the many other stimulants that are found in energy drinks and are legal to sell to children.

</comment><comment><USER28> If they are to be consistent they should also ban Facebook and video games like league of legends.

</comment><comment><USER15> In what I'm sure is unrelated news /s, Altria Group stock has spiked to a 5-month high today [1]. Although there are legitimate reasons to consider banning E-Cigarettes, we should also be cognizant that Big Tobacco sees this as a benefit to their business. That alone makes me very suspicious of the potential benefits of this considered ban.

[1] [https://www.nasdaq.com/article/altria-group-inc-mo-has- spike...](https://www.nasdaq.com/article/altria-group-inc-mo-has-spiked-to- nearly-a-5month-high-20180912-00717)

</comment><comment><USER29> My daughter says that half the kids in her high school have one of these.

<comment><USER11> Sounds like a lot of nice fines or jail terms to be handed out to whoever sold/gave them to the kids. What kind of investigation is being conducted to find out who's responsible?

<comment><USER30> Most people get stuff like that through friends and family members. Aggressive enforcement of minor laws like that tends to be harmful to society in the long term.

<comment><USER11> If there was an epidemic of binge drinking in a school, I'm pretty sure the local police would start running sting operations to figure out who's supplying the alcohol.

If there's an epidemic of e-cigarettes, why aren't they doing the same? And I guess I may be ignorant of how the market for these works, but I've never actually seen them in regular shops. Where would I go to buy a Juul? I know there are dedicated vape shops, and also tobacco shops that sell e-cigarettes. Could you run stings there the way many US states run them at stores that sell alcohol?

<comment><USER31> They've advertised Juul and similar pretty heavily in convenience stores like Circle K.

</comment></comment></comment></comment></comment><comment><USER32> Is there anyway to reverse course in the USA and remove power from these alphabet agencies that claim they know what's best for us? What happened to being a free people who could make their own decisions?

<comment><USER33> > What happened to being a free people who could make their own decisions?

I'm glad you have the time, knowledge, expertise, and experience to thoroughly investigate the safety and long term affects of every product you use on yourself, second hand effects on others, and the environment. Not everyone is so lucky to be blessed with so much time, energy, and knowledge that they themselves can do what thousands of people so full time.

<comment><USER34> The point is the government is not consistent about what is permitted and what is banned.

If you are banning vices that cause societal harm, alcohol is far ahead of anything else. DUI victims, destroyed families, physical abuse, homelessness...alcohol is reliably correlated to all of these but since it brings in lots of tax $$$ and educated voters enjoy their Pinot, we look the other way.

<comment><USER33> Where did I claim it was a perfect system? My point was that it's a better system than the alternative of everyone fending for themselves.

Also, alcohol sales and marketing are heavily regulated, along with tobacco.

<comment><USER6> Then regulate the vaping industry as well. Outright banning it because of current issues is damn short-sighted.

<comment><USER33> > The Food and Drug Administration is threatening to pull flavored electronic > cigarettes like Juul off the market if the tobacco industry doesn't do more > to combat growing use of the products by children and teens.

They're not "Outright banning", they're threatening to if the industry is unable to stop advertising to or otherwise making it appeal children. This is par-for-course for how regulation works: you don't comply and refuse to become compliant, you can't do business.

They're not just destroying an entire industry without working with said industry to mutually reach their goals.

</comment></comment></comment></comment></comment></comment><comment><USER35> "Your usage has been flagged as a violation of our terms of service".

Sweet can't browse bloomberg with links. Nice.

</comment><comment><USER36> Pathetic. But not surprising; the moral panic around kids vaping has been building for a while now.

<comment><USER16> It's not moral panic. Vaping is just as harmful as smoking. Combustion is still the main chemical reaction, and the resultant compounds are just as toxic. They only smell nicer.

<comment><USER37> There's no evidence of this. Everything I've read indicates that vaping is likely (and dramatically) less harmful. The levels of toxins are orders of magnitude lower or nonexistent in vapor.

Also, there's no combustion when liquid-based nicotine solution is atomized.

<comment><USER16> I grant that vaporization occurs at a lower temperature than combustion, but it is still a chemical reaction that relies on a heating element. Proponents of e-cigs have always argued that this makes e-cigs safer, and it does not produce the same compounds that yobacco burning does. What is not clear is whether the compounds produced are safer.

<comment><USER14> Vaporization (boiling) is not a chemical reaction.

</comment></comment></comment></comment></comment><comment><USER16> Long overdue. Vaping should be regulated much like smoking. It has the same deleterious side effects for individuals as smoking, and much the same negative impact on society (through second hand smoke).

<comment><USER15> The Royal College of Physicians strongly disagrees with you. This is the same group that sounded the alarm on cigarettes in 1962 with their groundbreaking report "Smoking and health" [1]. Their 2016 report, "Nicotine without smoke: Tobacco harm reduction" [2] stands in staunch disagreement with your statement.

[1] [https://www.rcplondon.ac.uk/projects/outputs/smoking-and- hea...](https://www.rcplondon.ac.uk/projects/outputs/smoking-and-health-1962)

[2] [https://www.rcplondon.ac.uk/projects/outputs/nicotine- withou...](https://www.rcplondon.ac.uk/projects/outputs/nicotine-without- smoke-tobacco-harm-reduction-0)

<comment><USER16> Thanks for the article, will read at home. The conclusion isn't unanimous however.

</comment></comment></comment><comment><USER38> Why is it the company's responsibility to stop kids from using their product? This seems like something that _parents_ should be responsible for.

And what is the company to do in the first place? As long as something is available for adults, and teenagers want it, teenagers will find a way to get it.

<comment><USER39> We live in a civil society which means we figure out together what our mutual obligations are. Did you not get the memo?</comment></comment>


Ask HN: New Years Resolutions? - <AUTHOR> Got a resolution you want to share? <comment><USER2> Finish a project. It's easy to start a hundred projects, but hard to finish one.

</comment><comment><USER3> Spend more of my time and money on others who need it more. This past year has been an eye-opener for me when it comes to realizing how much people are struggling around the globe. Too much of our time now is spent on things we can't take with us to the grave while those around us continue to suffer.

</comment><comment><USER4> _or you can allow the goal to inject your present reality with new hope, enthusiasm, and motivation. Even though it seems like you're setting goals for the future, you're really setting goals for the present. The better you understand this, the more easily and enjoyably you'll achieve your goals._ \- [http://www.stevepavlina.com/blog/2006/08/how-to-set-goals- yo...](http://www.stevepavlina.com/blog/2006/08/how-to-set-goals-you-will- actually-achieve/)

Alternatively, any of you setting 30 day trials for January 09? - [http://www.stevepavlina.com/blog/2007/12/start-the-new- year-...](http://www.stevepavlina.com/blog/2007/12/start-the-new-year- with-a-30-day-trial/)

</comment><comment><USER5> Yes, a meta-resolution. When I want to get something done, I will break up the project into specific tasks that can be done in less than one day, and then make a written commitment about when I will finish that task.

If it's a big project, I can start by breaking off the early steps without figuring out all the steps at once.

The idea is to make myself take actual actions, no matter how paltry, rather than staying stuck in daydream mode.

My first actual resolution: create a text file on my desktop to store this list of to-dos, until I decide on a better approach. Due: 2008-12-31 13:15. Done!

</comment><comment><USER6> Not really New Year's resolutions, but I am committed to 100 pressups by end of March and a Marathon in May. Both of these will take me at 33 to fitter than I was when I was an 18-year-old lifeguard.

<comment><USER7> The best thing about that resolution is that you have a way out. If you don't manage it, you could always just do a pressup a day to reach your goal of 100 ;-)

</comment></comment><comment><AUTHOR> My resolutions:

Start an OSS project. Learn and use a new programming language in a project. Keep up my current pace at the gym. Write more.

No specific metrics and nothing too ambitious, I guess. :)

</comment><comment><USER8> take one week off work every 3 months. I've taken a total of 13 days off in the last 3 years working 40 hours/week as a consultant and 15/week on my own stuff. I'm burnt out and my productivity has gone straight down the crapper

</comment><comment><USER9> Never made resolutions. If I want to do something I just do it. If it don't I don't. If I want to improve myself I just tell people what I am trying to do and ask them to ensure I don't stray. Otherwise I always felt it is deceiving myself that I will miraculously change myself somehow.

</comment><comment><USER10> Def working more on my own or oss projects... but gotta shamelessly plug our startup - <http://www.ichange.com> to help you change yourself with reminders and accountability from the community.</comment>


Ask HN: Can we build synthetic neurons? - <AUTHOR> I just finished https://arxiv.org/abs/1705.06963 and was pleasantly surprised at state of neurotrophic computing. Specifically, the use of organic materials to build robust, low power networks that get past the von Neumann bottleneck and allow us to incorporate new levels of sensing into our environment and lives seems extraordinary. TPUs and chips are obviously interesting for orgs like google, but what about synthetic clusters of neurons integrated into our environment? How significant could that be? <comment><USER2> Are you asking about something like the spinnaker supercomputer or do you mean artificial but non-virtual man-made neurons?

<comment><AUTHOR> The latter, spinnaker is cool, but I'm thinking about building low power sensory networks into appliances, the environment, etc</comment></comment>


Improving browser security - <AUTHOR> http://marc.info/?l=openbsd-misc&m=142523501726732&w=2

<comment><USER2> I wonder if he's aware of this NDSS 2015 paper: [http://www.internetsociety.org/doc/exploiting-and- protecting...](http://www.internetsociety.org/doc/exploiting-and-protecting- dynamic-code-generation)

TL;DR version: the JIT becomes a separate process that maps the code cache as RW, while the browser itself only sees a RX mapping. They also discuss why flipping between RW and RX in the same process is insecure (basically, TOCTTOU attacks from different threads).

</comment><comment><USER3> So, this note says that browser JITs are the main thing that typically needs writable and executable memory right now, and the author (Ted Unangst) is going to try to fix that.

It seems natural to think that JITs would want that feature (so they can compile things into native code and then jump into it). Can someone who has worked with DOM rendering or Javscript interpreters opine on whether it's plausible to get rid of the use of write+execute memory segments without sacrificing a lot of performance?

<comment><USER4> On Firefox and WebKit (but not Chrome) you can already do that, by disabling the JIT and thereby only running in the interpreter.

You do lose a large amount of speed on sites that have JS doing heavy things. However, on a lot of the web, you don't need heavy JS, so you might not notice it on a news site or your email site. Try to play a game, though, and it'll be obvious.

<comment><USER5> No the idea is you set memory to write permission only, write out the jitted code, and switch the memory to execute, no write before you execute it. It simply means more calls to change memory protection, which is on page size granularity so may mean using a whole page for each jitted fragment.

<comment><USER6> How do you support self-modifying code like ICs then?

<comment><USER7> When patching IC, first set code page to W. Patch. Then set code page to X.

It sounds expensive, and it is. ~3% regression on SunSpider is reported. Mozilla is probably not okay with that, but OpenBSD probably is.

</comment></comment></comment></comment></comment><comment><USER8> Nearly every browser engine has or had patches at one time to accomplish this. Its a call to mprotect/VirtualProtect after writing native code to memory. Theres a performance hit to JIT engines that update emitted code often due to dynamic JS typing. You could always just turn off the JIT engine and execute the slower bytecode. But thanks for coming down from the mountain to enlighten us, again.

<comment><USER8> Heres Chris Leary's patch for Firefox. A bit dated at this point though [https://bugzilla.mozilla.org/show_bug.cgi?id=677272](https://bugzilla.mozilla.org/show_bug.cgi?id=677272)

</comment></comment><comment><USER9> Not just browsers. Some other common packages that also use JIT include:

Java Python (PyPy) Qemu Valgrind PCSX Yabause Mupen64plus

</comment><comment><USER10> Fixing open source JITs to support Windows x64 SEH properly is on my wishlist for MS Open Tech.

</comment><comment><USER11> > The policy has remained advisory because many JIT engines use such memory > and enforcing mandatory W^X would mean such programs no longer run on > OpenBSD

It really annoys me to see something like this. "Oh, well we didn't upgrade our OS to that much more secure feature because it would've meant breaking compatibility with a few popular apps... _2 decades ago_ ".

My point is whether it breaks compatibility or not is irrelevant. The solution is simple: set a _reasonable_ but very clear deadline for when you'll adopt that feature and those apps will stop working unless they adapt. You could make it 1 year, 2 years or even 5 years, depending on how big of a change you're requiring of those developers.

But not doing it _at all_ because it would break compatibility with some apps is just inexcusable to me. I'm also quite disappointed Microsoft hasn't implemented all the EMET features into Windows 10 and may not even consider doing it until Windows 12.

<comment><USER12> Mozilla doesn't care if Firefox works on OpenBSD or not.</comment></comment>


Ask HN: What is your opinion on the Bitcoin debate? - <AUTHOR> There is currently a large debate going on in the bitcoin world. The main development team of bitcoin wants to keep the current block size limit and wants to enable off-chain scaling (via "segwit"). Other developers are pushing for bigger blocks ("bitcoin unlimited", BU) to allow on-chain scaling.<p>I'm currently favoring BU, but I would be okay with segwit if that would not mean that there will be no further block size increase. Would like to hear your thoughts on the topic. <comment><USER2> SegWit does in fact represent a block size increase. Here are some of my thoughts on the matter: [https://news.ycombinator.com/item?id=14075274](https://news.ycombinator.com/item?id=14075274)

<comment><AUTHOR> Well, okay, it "represents" a block size increase, so that you can put ~70% more transactions into a block. In reality, it is not a block size increase as the block size will stay at 1MB.

But I don't think that this is enough long term. I would much prefer an increase to 4MB or even 8MB.

<comment><USER3> Long term 4MB or 8MB (or even 32GB) won't be enough. SegWit enables more sophisticated scaling solutions necessary if Bitcoin wants to become anything more than money for a selected few enthusiast.</comment></comment></comment>


Preventing weak passwords by reading your mind - <AUTHOR> https://telepathwords.research.microsoft.com/

<comment><USER2> =Previous discussion=

Telepathwords: A New Password Strength Estimator (schneier.com) - Dec 6, 2013 - 81 points - 64 comments

[https://news.ycombinator.com/item?id=6860987](https://news.ycombinator.com/item?id=6860987)

</comment><comment><USER3> should I type my passwords in there? ._.,

<comment><USER4> Only if it's "password", "secret", "god", "scotu" or "12345"

<comment><USER5> What's scotu?

</comment></comment></comment><comment><USER6> the problem is not coming up with hard passwords. the problem is trying to remember all of them across the litany of places that require them (many with varying policies for creating "safe" passwords). if we can solve the "remembering" part, users wouldn't even need to be asked to create a pw (it would simply be assigned)

<comment><USER7> I find it hard to believe that it's suggested people remember passwords. I would suspect that anyone who knows anything about security would be using something like LastPass to generate and store passwords.</comment></comment>


The inescapable weight of my $100,000 student debt - <AUTHOR> https://www.theguardian.com/news/2018/aug/21/the-inescapable-weight-of-my-100000-student-debt?CMP= <comment><USER2> "My debt was the result, in equal measure, of a chain of rotten luck and a system that is an abject failure by design."

Personal choice played no part in being $100,000 in student debt?</comment>


NetBSD 9.0 - <AUTHOR> https://netbsd.org/releases/formal-9/NetBSD-9.0.html <comment><USER2> "Updated ZFS. This is the first release with ZFS usable for daily use, but there is no support for booting from ZFS nor using ZFS as root filesystem yet"

Grateful for this

<comment> corona-chan OpenBSD next, please!

<comment> yjftsjthsd-h OpenBSD will probably never use ZFS; they like clean code that they can understand and control as completely as possible, and ZFS is a monster of a codebase that replaces whole chunks of the system with its own.

</comment></comment></comment><comment><USER3> NetBSD is probably my favorite BSD. I like its focus on simplicity and portability. I also like pkgsrc a lot more than ports. I appreciate that pkgsrc is portable beyond BSD, too - Minix uses it. Nice work, folks :)

<comment><USER4> MINIX 3.x :)

I remember hacking on MINIX _2_ (which is an entirely different (and tiny) codebase) in the university's Intro to OSes course to speed up the keyboard repeat rate on the physical MINIX PCs in the computer lab. Interestingly, the course now uses FreeBSD.

I hope MINIX 4 or a similar project would:

\- use seL4 as the kernel

\- also be a Type-1 hypervisor (like Xen or ESXi)

\- BSD-derived userland (as MINIX 3)

\- port FreeBSD's Linux binary compatibility

<comment><USER5> Ever heard of [https://genode.org/](https://genode.org/) ?

</comment></comment></comment><comment><USER6> Force10 network switches (owned by Dell now) use NetBSD for their FTOS and have for quite some time. Just thought I'd throw that out there.

<comment><USER7> Their compellent storage arrays did as well at one point. Not sure if they still do.

<comment><USER6> Wow, really? I built an Oracle cluster on Compellent spindles and was pretty impressed with its tiering. Had no idea NetBSD was involved, very cool. I was actually using Force10 switches in the storage fabric IIRC.

</comment></comment></comment><comment><USER8> I am a Linux user. What would be a good reason for me to try out NetBSD? Honest question.

<comment><USER9> Without going too far in to the politics of GNU/Linux, it's a bit messy. All the distros are different from each other, plus they're changing so rapidly that a book about one version is much less useful for managing another (think Ubuntu 14 -> 16, or Ubuntu 16 -> 18).

Also, while GNU/Linux is generally portable, many of the things you learn about Ubuntu will be different on what you'd run on a Raspberry Pi, or an UltraSPARC, or on a PowerPC.

NetBSD is the same OS on all the hardware it supports, so the system consistently does what it does regardless of where it's run. If you want to develop on a desktop and deploy on a Pi, for example, you'll have a much easier time with NetBSD :)

<comment><USER10> Especially now that NetBSD can run on an RPi3. It was a bit embarassing that it could not.

<comment><USER11> RPi3 support was present in NetBSD 7.1 and 8.0. NetBSD 9.0 is the first release where you can run it in 64-bit mode.

</comment></comment></comment></comment><comment><USER12> Don't see anyone mention these rather notable features of NetBSD 9.0:

* NVMM — hypervisor compatible with QEMU. [https://news.ycombinator.com/item?id=19622590](https://news.ycombinator.com/item?id=19622590). [http://blog.netbsd.org/tnf/entry/from_zero_to_nvmm](http://blog.netbsd.org/tnf/entry/from_zero_to_nvmm).

* KASLR — kernel address-space layout randomisation. [https://news.ycombinator.com/item?id=15769457](https://news.ycombinator.com/item?id=15769457). [http://blog.netbsd.org/tnf/entry/the_strongest_kaslr_ever](http://blog.netbsd.org/tnf/entry/the_strongest_kaslr_ever).

Both were done by the same person, BTW, who also found a serious bug in OpenBSD's VMM hypervisor earlier today, too — [https://news.ycombinator.com/item?id=22336962](https://news.ycombinator.com/item?id=22336962).

</comment><comment><USER13> Wow, this looks like huge news for NetBSD. Not too in tune with the BSD ecosystem, but this sounds great for ARM servers.

</comment><comment><USER14> NetBSD impresses by it's broad platform support and low memory usage. You can boot a whole os with less ram usage than some programs.

</comment><comment><USER15> I am waiting for NetBSD to be available in SourceHut CI[1]. We already use it for FreeBSD and OpenBSD jobs, missing only one major OS - NetBSD.

[1] [https://man.sr.ht/builds.sr.ht/compatibility.md](https://man.sr.ht/builds.sr.ht/compatibility.md)

<comment><USER3> Please help! The image is _almost_ complete:

[https://git.sr.ht/~sircmpwn/builds.sr.ht/tree/master/images/...](https://git.sr.ht/~sircmpwn/builds.sr.ht/tree/master/images/netbsd)

But I need a NetBSD expert to come in and put on the finishing touch: making the filesystem resize to fill the available space on the qcow2. Without this, the image cannot build a new version of itself which isn't smaller than the host image, leading to image shrinkage over time and eventual breakitude.

<comment><USER12> It should be doable with the following rc.d configuration:

      resize_disklabel=YES
      resize_root=YES

The second script is available by default, but the first one is somehow hidden from general availability:

* [http://bxr.su/n/distrib/utils/embedded/files/resize_disklabe...](http://bxr.su/n/distrib/utils/embedded/files/resize_disklabel)

* [http://bxr.su/n/etc/rc.d/resize_root](http://bxr.su/n/etc/rc.d/resize_root)

You can fetch it raw, it seems to work great:

      cd /etc/rc.d/
      ftp http://bxr.su/raw/NetBSD/distrib/utils/embedded/files/resize_disklabel
      chmod +x resize_disklabel

The `resize_disklabel` script does handle `fdisk`, too. If it doesn't work for your usecase, might want to provide the output of running `/etc/rc.d/resize_disklabel` manually, together with `fdisk` and `disklabel` outputs, too.

P.S. BTW, you probably don't want to run `resize_root onestart` once the system is running multiuser — it passes `-y` to `resize_ffs`, which causes temporary filesystem corruption if the filesystem is running in `rw` mode.

<comment><USER3> Aye, but that doesn't seem to work. Check out the genimg script - it's already trying to set up resize_root. I've also tried resize_disklabel without success. What this needs isn't another well-meaning HN comment trying to debug by proxy - I need someone who knows how NetBSD works to get their hands dirty and get it done.

<comment><USER12> The resize_root script wouldn't do anything if the fdisk and disklabel aren't adjusted (provided it's not a raw filesystem file that's being resized as in [http://wiki.netbsd.org/amazon_ec2/build_your_own_ami/](http://wiki.netbsd.org/amazon_ec2/build_your_own_ami/) page), so it's kind of expected that it doesn't work all by itself, and that [https://git.sr.ht/~sircmpwn/builds.sr.ht/tree/master/images/...](https://git.sr.ht/~sircmpwn/builds.sr.ht/tree/master/images/netbsd/genimg) is wrong.

</comment></comment></comment></comment></comment><comment><USER16> > Reworked SATA subsystem, now supporting multiple commands in transit (NCQ),

Well, that's more than a decade overdue. It looks like they added a NVMe driver in 8.0 that's not shockingly primitive, so I wonder why SATA was lagging so far behind.

<comment><USER17> At least it is now available.

</comment></comment><comment><USER18> Out of the 3 major BSD, FreeBSD targets for high number of software supports, OpenBSD targets for security which both seems to have a reason to adopt, but NetBSD targets for wide hardware support but is there other reason people have to adopt NetBSD these days?

Never tried NetBSD ever since I tried FreeBSD nearly 20 years back and OpenBSD several times since then.

</comment><comment><USER19> There was an Article "Are the BSDs dying" ([https://www.csoonline.com/article/3250653/is-the-bsd-os- dyin...](https://www.csoonline.com/article/3250653/is-the-bsd-os-dying-some- security-researchers-think-so.html)) where it us said, that NetBSD has the lowest code quality of all BSD variants. It also finishes last when it comes to security updates.

To this day NetBSD doesn't deliver binary security updates in a timely manner. Not in the base system and not for packages. Even OpenBSD manages to do this nowadays. If there is even a patch at all, it is delivered in source form only. Users are supposed to build the binaries for themselves. That's anachronistic in the year 2020.

Building from source consumes not only time but also energy. When everyone talks about saving energy and reducing carbon footprint, source based systems where every user is supposed to build binaries from sources are a not only a waste of time but are also contributing to the climate crisis.

<comment><USER20> Contributing to the climate crisis seems like a stretch. Bitcoin obviously uses a lot of power and contributes to the climate crisis. Building OSes from source is just a hobby for most people, and probably doesn't register as a particularly environmentally intensive one compared to even reading paperback books.

<comment><USER21> I have a huge soft spot for NetBSD because it was my first BSD and first foray into kernel work. The more alarming issue affecting Open and Net is that commodity computer architecture has wildly changed in the past 10 years. A late 1980s style locks and CVs approach to SMP is only good for a handful of cores. Consequently, if you run one of these on what are becoming standard desktop class systems like Ryzen, you are throwing away a great deal of performance (and therefore energy efficiency). Basically modern computers look a lot like an HP SuperDome or whatever from 2000 which is wild and inconvenient for programmers, but reality. FreeBSD (HEAD) is now generally competent on something like an Epyc or multi-socket intel box, and there isn't much left to eek out on an 16-thread laptop.

I funded and helped stabilize a technology called Epoch Reclamation into FreeBSD that can be thought of like a cleaner version of Linux' RCU at least for tracking object liveness. One of the most interesting things I've seen go into FreeBSD recently is a further improvement on that, a novel form of safe memory reclamation directly in UMA: [https://reviews.freebsd.org/D22586](https://reviews.freebsd.org/D22586). This is really exciting because for instance RCU suffers from time of use to time to free issues in Linux, and this new holistic approach really does not for fast turnover workloads.

NetBSD does have a form of SMR called pserialize(9), but ignoring some of the algorithmic weaknesses it also has a lot of global or oversized locks in critical subsystems like the VFS and network stack that turn it into a fairly non-SMP friendly system let alone consideration for different memory latencies like NUMA.

A lot of these ideas from FreeBSD can be copied into Net and Open but the code bases have diverged greatly where it's not some simple forklift (for instance Net and Open use a similar kernel memory allocation that is totally different than Free).</comment></comment></comment>


Apple ships fix for file URL crash bug - <AUTHOR> http://support.apple.com/kb/DL1640

<comment><USER2> I noticed that in the release notes.

Ever since Safari 6 came out, I've been having a problem with display errors. I have a late 2010 MBP, and it only occurs on that computer and when on the Intel graphics. On sites would manipulate the DOM in certain ways (expanding/hiding comments in Reddit, new fields appearing when you fill out existing fields in some sites) you could see things transition but at the end of the update/animation a rectangle of old content would still display.

It was some sort of rendering GPU bug, and it was horribly obnoxious. Reddit was where I noticed it most. Once it happened, re-opening/closing the comment wouldn't do anything because OS X/Safari seemed to cache the result. The only fix was to either switch to the nVidia GPU or to zoom the page in a little bit (to force a re-render) then back out.

But I installed the update a short while ago and I haven't seen it yet. I hope it's fixed, I was starting to consider switching browsers.

Too bad Safari's inspector is still the same terrible one they introduced in 6 and not the good was that was in 5 (and is still in Chrome). I don't know why they decided to change it but it's terrible.

<comment><USER3> > But I installed the update a short while ago and I haven't seen it yet

I have the same issue, also only on Intel graphics, but it would only manifest itself after a sleep/wake cycle. So try that. I'll try installing this update too, I hope it fixes it.

<comment><USER2> Maybe that's why I haven't seen it yet. My laptop usually has uptimes measured in weeks, but gets suspended multiple times a day.

</comment></comment></comment><comment><USER4> Bootcamp support for Windows 8! Finally!

</comment><comment><USER5> Incidentally they also fixed the retina fan issue today:

<http://support.apple.com/kb/DL1559>

</comment><comment><USER6> My favorite part of this update: "Fix for an issue in Messages that may cause messages to appear out of order after waking from sleep"

<comment><USER7> At least one of the million things wrong with Messages has been fixed. That app is awful.

</comment></comment><comment><USER8> Great update. I'm happy that they have addressed some Safari issues.</comment>


Ask HN: $10k in legal fees for a seed round – is that a joke? - <AUTHOR>

I'm reading http://venturehacks.com/articles/debt-benefits (cost section) and http://www.startupcompanylawyer.com/2007/05/13/who-pays-legal-fees-in-a-convertible-note-bridge-financing-and-how-much-does-it-cost/.  What I'm getting is that you'd be lucky if you paid under $10k in legal fees for your seed deal.  Is that a joke?!!!!!
I'm a student at Pitt, and am starting a website (http://www.collegeanswerz.com/) to make better college reviews.  I'm looking to raise about $60,000 in the next few weeks so I could pay people to answer questions.  It seems ridiculous for me to pay 1/6 of what I'm raising in legal fees.
Am I missing something?  Are these sorts of fees typical?  If so, how does that make sense? <comment><USER2> They used to be, and still can be -- if you have a bad investor who wants to play hardball (hint: don't play that game). It doesn't take much to run up $10k in legal fees if you have a problematic negotiation.

That said, there are a lot of resources out there now (convertible note generators, "standardized" series AA paperwork, etc.) that can lower this cost substantially if you try. Wilson Sonsini has a note term sheet generator [1], and there are probably others.

Also, keep in mind that many reputable, startup-savvy lawyers will work on a deferred fee for this kind of thing. You can also negotiate prices for simple contract reviews.

[1] [http://www.wsgr.com/WSGR/Display.aspx?SectionName=practice/t...](http://www.wsgr.com/WSGR/Display.aspx?SectionName=practice/termsheet- convertible.htm)

<comment><AUTHOR> What is the least amount of money that you could get away with? Do you even need a lawyer for a seed round if you're not doing anything fancy?

<comment><USER3> You don't technically _need_ a lawyer, but I would advise you to retain one.

Even if raising money with a convertible note, and using the community documents, you'll still need someone to file your Form D, prepare your board consent, and ensure all i's are dotted and t's crossed. You don't want to run afoul of the SEC.

Is your corporation established? Are you authorized to sell shares?

If you bring your own paperwork, you should be able to get away with <= $5k via a negotiated fixed price or cap on the legal work.

Some firms are also willing to defer payment up to a certain amount and/or until you raise additional funds down the line.

<comment><AUTHOR> So do most people invest a couple thousand dollars in legal fees? What about kids for whom that would be over half of the money they have to their name?

<comment><USER2> This is not uncommon. Incorporation alone will cost you around $1-2k, after all filing fees, services, etc. are included in the cost, and you need to do that before anything else.

I recommend using something like clerky.com for incorporation and post- incorporation setup. They might also be able to help you with the later parts of the process.

As far as the cost goes...you gotta spend money to make money. Don't do any of this until you're absolutely sure that you have committed investors, and you'll minimize your risk.

</comment></comment></comment></comment></comment><comment><USER4> There are several alternatives to paying expensive lawyers for what should be a very simple deal. The best two in my (non-lawyer) opinion:

* Techstars has free documents to use - [http://www.techstars.com/docs/](http://www.techstars.com/docs/)

* Fenwick and West (Prominent SV law firm) have posted their version of startup docs on GitHub - [http://venturebeat.com/2013/03/06/fenwick-west-github/](http://venturebeat.com/2013/03/06/fenwick-west-github/)

Just get your investors to agree to a standard, simple deal and everyone will be better off.

</comment><comment><USER5> We used Clerky for something recently. They took a process that would have been complicated, costly, and fraught with anxiety in the past and made it near-effortless for a ridiculously low price—really a commoditized price. I can't imagine what challenges they must face figuring out how to scale that in the market, but the benefit to customers is so huge that if they pull it off it will be the rare thing that deserves the term "disruptive". You might want to check whether they offer what you need.

</comment><comment><USER6> You should be using Clerky for a convertible note financing. It should cost you just a few hundred dollars total and won't require lawyers.

<comment><AUTHOR> I see that their convertible note financing is in beta. Could I still use it? And I think I'd still need to do some incorporation paper work, but it seems like with Clerky, this all could be done for under $1,000. True?

<comment><USER7> One of the cofounders here - feel free to shoot us an email and we'll see if we can help you out! The company formation stuff (which should be done before you issue any notes) will be a little under $700 including third-party fees.

<comment><AUTHOR> I plan on doing so when I get closer to raising money, which will be in a few weeks. I was just doing some preliminary research today and got scared when I thought I'd have to dump all my savings into this, but it's reassuring to know that you guys are around!

</comment></comment></comment></comment><comment> super-serial My startup is at the same stage as yours... I need seed capital to take it to the next step. (I'm building an HTML5 competitor to GoAnimate.com/PowToons and need to pay for artwork)

My plan is to do contract work to pay for artists. Since you don't live in the Valley and you don't have a team of ex-Googlers working with you... you either need to show off paying customers, or get ridiculous amounts of traction to have any chance of getting funding. Otherwise people might not take you seriously.

But maybe that's just my opinion, and other people have different experiences.

<comment><AUTHOR> Good luck with your startup! I like the need you're meeting. Videos are important, and they're not easy to make. It's something I've thought about before, but I don't have the technical skills to implement it.

I actually think I'll be fine getting funding. 1) I'm confident that I have something people want (better college reviews). 2) I plan on offering $100 to the best answerer, and $20 to the 5 next best answerers, and doing this for every school (I've exhausted the methods of getting kids to do it for free, and it's not working). I'm pretty sure kids will be willing to answer questions with this incentive. I'm gonna use my own money though to test it at 5 schools to prove that this method works. 3) 2) shows that they could fill out my website's content by giving me a $60,000 investment. If investors believe in 1), then success should be pretty simple.

</comment></comment><comment><USER8> I know that some larger law firms have processes to give you "free" legal representation. I have worked with a large law firm before that was willing to take on promising start ups in exchange for a note (converted during the next round). The additional benefit of this type of arrangement is that their Rolodex is usually pretty deep, and they have business analyst that will match you up with investors that "fit" your startup best. If you want more info about what the details of my arrangement where email me.

<comment><USER9> FYI - you do not have e-mail visible in your profile. You need to put it in the About textarea.

</comment></comment><comment><USER10> I'm pretty sure the juvenile spelling of "answerz" will end up costing you more than $10k.</comment>


Don't Be Afraid of the Clowns - <AUTHOR> http://www.buzzfeed.com/voraciousbrain/a-journey-into-a-clown-conventions-novelty-sized-heart-of-da

<comment><USER2> I must say the writing in this is pretty great. The moment when he described viscerally a perhaps mundane action - laughing - I paused and realized that I had never read such a description of laughter ever. It was as if he was dying, I was genuinely afraid for him and confused what was happening.

Great read on an interesting topic, phenomenal writing.

(I know I'm going a little overboard with my praise but I was always a sucker for words)

</comment><comment><USER3> Still afraid. Very afraid.</comment>


In Which I Savagely Impugn the Honor of IPMI and its Friends - <AUTHOR> http://fish2.com/ipmi/ <comment><USER2> Pfft, this guy only mentioned the obvious horrible security implications. Aside from that glaring flaw, there is also the small matter that IPMI software is all implemented by raging idiots who got fired from BIOS vendors, and then got fired again from the people who write mobile radio firmware, and then got fired again from the company that writes the software in your electric toothbrush. They never work in actual outages, cause more host outages than they solve, and are in no way a substitute for having humans on site. I had a rack full of garbage from Penguin Computing that would hang on reboot with the message that the BMC was not responding. Thanks, that's helpful. And dozens of horror stories from every vendor ranging from SuperMicro to HP and IBM.

I encourage you to guess whether Facebook, Google, and Amazon use IMPI to manage anything. Have a look at the OpenCompute designs for a hint.

<comment><USER3> [http://opencompute.org/wp/wp- content/uploads/2012/05/OpenCom...](http://opencompute.org/wp/wp- content/uploads/2012/05/OpenComputeProjectOpenHardwareMachinesManagement.pdf)

These designs?

<comment><USER2> Doh. Just goes to show, you can open up your process, but you can't make people have judgement and taste.

<comment><AUTHOR> And/or that you should look before you speak.

</comment></comment></comment></comment><comment><USER4> Late last year I was building infrastructure with some higher security requirements and was quite shocked at the IPMI situation - concerned enough to email Redhat (who obviously support lots and lots of clients on hardware from lots and lots of vendors) via a personal contact in a global security team there, with my concerns and some evidence related to our particular hardware vendor.

After some time to ponder, they got back to me with "your concerns look legitimate". Discussions followed, but I am not aware of any specific advisories resulting from this.

I also understand that recently there was an IPMI-related presentation at Ruxcon Breakpoint in Melbourne, Australia: <http://www.ruxconbreakpoint.com/speakers/#Igor%20Skochinsky> ... no idea of the content, though.

Honestly, I think the first thing is for vendors to be a lot more honest: if someone has root on your host, they can most likely trivially obtain root on and backdoor the IPMI controller. Once they get root on the IPMI controller, they can do anything they want on the IPMI LAN. This reality differs greatly from the 'dedicated' and 'separate' words used in vendor marketing literature and documentation, and is no doubt a _direct contributor_ to insufficiently paranoid systems architecture, resulting in real world vulnerabilities in some pretty important systems.

Why do I say pretty important? Well, outside of remote KVM, IPMI is frequently used for node fencing in high availability (HA) cluster scenarios, which means that this technology is likely to co-occur with some fairly paranoid / 24x7x365 systems (air traffic control, stock markets, etc.). Attackers with a foot-hold can thus use IPMI-based vulnerabilities to (permanently) compromise such higher-end systems.

What are we as implementers supposed to do? Here are some ideas. (1) Run a relatively paranoid, receive-only, anomaly-based NIDS on your IPMI segment to encourage 'after the fact' detection of bad behaviour. (2) Run IPMI on a dedicated VLAN. (3) Run your IPMI VLAN on dedicated hardware (4) Program your network infrastructure to ensure that regular IPMI nodes on your average server cannot communicate with any other peers on the link layer (ie. other servers) _except_ for the expected source of management operations (5) Make sure the expected source of management operations isn't running an IPMI controller (or at least, one from the same vendor on the same subnet) (6) Don't use IPMI at all

Honestly, IPMI can be very useful in some cases, though it's probably a massively unspoken vulnerability in some high end systems. As always, don't trust any single component... security only comes in partly-effective layers ...

</comment><comment><USER5> Are these IPMI things ever installed on desktops and laptops, or are they strictly for server hardware?

<comment><USER6> You may be able to find it on high-end workstations sold by server companies (read, a 4U server turned on its side, with added feet), but by and large it's a server-only thing. The reason being it's only really necessary to have the level of remote access offered by these systems if it's difficult to access the hardware, or you have a very large amount of the hardware (in most cases where it's used, both of these are true).

<comment><USER7> You can also buy discrete bmc pci cards from a few different vendors. I believe super micro sells them, but I've always loathed any environment that uses super micro servers as they tend to be low to mediocre quality compared to the "big 3" tier 1 server vendors.

</comment></comment></comment><comment><USER8> Anecdotal, but the IPMI software I have to use regularly for access to a specific server is, without doubt, the worst server utility I've ever used.

I love having the BMC there, but you are really at the mercy of vendors to update their IPMI/BMC firmware. Guess how often that happens.

</comment><comment><USER9> IPMI is so bad, I don't even use it for my servers when it is available! Better to just wait and call someone at the datacenter who will take care of reboots properly.</comment>