Ask HN: Have you ever tried to live without a phone? - <AUTHOR> I am considering ditching my smartphone and either going back to an old-school phone or not owning one at all. What are your thoughts? Any experience? <comment><USER2> Many of us were old enough to have lived during a time where smartphones did not exist. My thoughts are... it is nice to have access to a great pocket- sized camera and communication device, though it is also nice to turn it off once in a while.

<comment><USER3> Exactly so. Though life was more annoying without a mobile phone for example (failed rendezvouz?) it happened. It's not helpful to demonise the tech rather than managing it and yourself candidly IMHO.

<comment><USER4> > Though life was more annoying without a mobile phone

I disagree. My feeling is that life was much better, more "human" without mobile phones. I hate how everyone walks around staring down at their phones instead of looking at the world. It's like an addiction. It reminds me of the ST:TNG episode "The Game". People don't even acknowledge each other's existence anymore.

Face-to-face interactions (pre-pandemic) ceased to exist, attention spans dropped precipitously, laziness increased (I can't be bothered to go out anywhere when I can have it delivered to my door by a "gig worker".) It's truly become a dystopia. If you weren't alive or an adult in the years before smartphones, you may not realize what a dystopia this is in comparison. I'm not even idolizing the past — there were certainly plenty of problems in the past — but this is even worse, and none of the past problems were solved either.

One of the unacknowledged advantages of desktops computers is that you _can 't_ take them everywhere. You have to leave desktop computers on the desktop. You eventually have to get up, get away from the computer, and interact with other humans in person. I also feel that mobile phones decrease personal independence. The smartphone becomes a "crutch" that you don't know how to live without. You can't even function adequately without a smartphone in your hand or pocket.

<comment><USER5> When you read and reply to people's comments on the internet, aren't you acknowledging their existence? When you browse the work that they created aren't you looking at the world?

<comment><USER4> I'm afraid you're missing the point. When I say people don't acknowledge each other's existence, I mean people literally within a few feet/meters of each other, who could easily see and/or speak with each other if they made even the bare minimum of effort.

When another person is in your physical presence, it's almost like you're deliberately ignoring them when your eyes are glued down on the smartphone. It's personal rudeness, a diss. "You're not even worth raising my head and saying hi."

<comment><USER5> The people on the phone are effectively only a few centimetres away, nevermind feet. So shouldn't it be even more rude to ignore internet messages?

The internet isn't some kind of fake virtual reality... it is just a communication tool. The draw to use it is created by real people sharing real ideas. I think this idea that people who are physically closer to you deserve more of your attention is misguided.

<comment><USER4> > shouldn't it be even more rude to ignore internet messages?

Who says you have to ignore internet messages? It took you a half hour to reply to my comment, and that's fine. That leaves plenty of time to acknowledge a person IRL.

The internet will still be there when we get home from being outside. That's one of the advantages of the internet.

<comment><USER5> Unfortunately no notifications on here, and also I had to think about what I was going to say :)

> The internet will still be there when we get home from being outside

And won't the physical space outside still be there after you decide you're done talking on the internet?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Never had one, never will. My wife has, my kids too, I don't. Clients get hold of me via e-mail or IM, family through landline. If I am unavailable immediately then tough luck, I love not be at anybody's finger tips if I go for a stroll in a park, for example.

<comment><USER7> Its not like you are obligatory to answer.

<comment><USER6> Problem is if you have one then at least one person becomes important enough to "make you", the boss / a family member / a friend you feel you're in debt etc. I see that plenty around me. Pretty sure if I'd have one that person would become my wife for me. Don't get me wrong, I love my wife but I also love the freedom of not being at her disposal 24/7.

</comment></comment></comment><comment><USER8> I don't own a smartphone, and the main reason is that I don't want to spend all my day staring at screens. Thus, I have resisted the idea of buying one for more than a decade now. The thing is that I don't _really_ need it. If it comes to maps, my car has an excellent GPS system. Music I don't need to listen to outdoors. E-mails and such well I have my PC and if I'm not at work what's the point of being bothered, it's not like I'm a medical doctor or anything remotely essential.

I own a Kindle for books, which helped a lot with my Internet addiction and the lack of focus, and for communication I have a dumb mobile phone with a battery that lasts for weeks.

Realistically speaking the only reason I'd buy a smartphone these days is for photos. Anything else is just fucking useless. I can't do work on a smartphone, and I don't even want to. I enjoy having time off of any electronic device because it helps my brain unwind and adds quality to my life.

<comment><AUTHOR> Inspiring set up. This is basically what I am gravitating towards.

</comment></comment><comment> Funes- >I am considering ditching my smartphone

Do it. Your health will thank you almost immediately for that.

>going back to an old-school phone or not owning one at all.

Personally, although I love the idea of going landline-only, I think a "dumb" phone can serve one well in a certain number of circumstances, so that's what I've been using for four years now. I use a Nokia 6250 at the present moment, but I keep switching between old phones I like and have lying around--some of them are brand new, never been out of the box.

I don't even text. I only make phone calls, and if someone doesn't pick up, I leave a voicemail telling them when they can preferrably return the call. That's it. I only use e-mail for more formal exchanges, but never to have anything that resembles an informal conversation.

Mind you, if you are still relatively young, doing away with IM, texting, and social media can be fairly alienating, as you will no doubt realize how utterly addicted everyone else is to their smartphone, and how a great deal of social activities and interactions that used to happen not that long ago don't come about that often anymore. Many opportunities to think deeply, to reflect, to have a conversation, to laugh, to question something, to go through your own personal memories, to find new things to do, to _live_ , in sum, are now wasted on a regular basis.

Good luck with it, and don't be afraid to be an outlier.

<comment><AUTHOR> Thanks! I am 23 and live abroad so I always told myself I owned a smartphone to stay connected to family at home. But I just started to realize that it owns me. Plus during COVID I don't go out anyway. So why not try...

<comment> Funes- By all means, stay connected to your family--just try and do it through other platforms. In similar circumstances to yours, I stayed in contact with my family through Ring, Tox (toxic), and XMPP. I always preferred audio and video calls over texting them, which I almost never did. Stay connected to those that care about you the most, through healthy means. No need to own a smartphone, you are right about that one, but do know that there are meaningful connections worth maintaining.

</comment></comment></comment><comment><USER9> Since the raise of smartphones I have not turned on or not taking with me my phone for days or weeks at a time. Especially during traveling I find it a nicer experience to have to interact more with locals, stroll around and getting lost at times, instead of just ubering from one tripadviser location to the next.

On a day to day what I think helped me most is:

\- Do not disturb mode on all the time.

\- Keep apps to a minimum that is actually useful. I think I never had more than like 5 installed.

\- Turn off most if not all notifications.

\- If its a personal phone, do not set up all the work related stuff (email, slack, calendar, etc.) on it, or make sure notifications are turned off.

\- And maybe most importantly, "train" your social or work circles, that not immediately responding does not mean you are dead or hold a grudge on them and if they want something from you they might have to think ahead.

With this I'm happy with having a device in the pocket or bag that does come in handy often enough, but does not need to be the most recent expensive flagship and is not a tamagotchi needing constant attention.

</comment><comment><USER10> I'm doing this currently. I had a job that had zero respect for my personal time and any notification from my phone would chip away at my mood to some degree. It got to the point that my phone made me miserable and I stopped answering calls / texts even from the people I would otherwise want to hear from. I've been separated from that job for years but the resentment of people I don't know being able to 'sound an alarm' on my end (hyperbolic, I know) lingered. Early this year, I canceled my phone contract and transferred my existing number to Google Voice when my physical phone died. Using this for a few days and borrowing my SO's phone to control media to the TV and I quite liked being reachable on my terms. I have since gotten a WiFi only tablet that I use for messaging / calls on the go and to deal with the TV. This works well for me as I can easily contact people when needed with minimal prior planning. I've even road tripped helping a friend move with maps.me downloading my route to my device, stopping at a McDs parking lot for wifi to place a call letting my ride know I needed pickup in ~ 20 mins, etc. It is very doable with the availability of WiFi these days (at least in my area and even along my route in rural US) and I have no plans of getting another phone any time soon. I feel like its like when I was only accessible by land line. If I'm not home or my voice app is closed, sorry -- I'll get back to you when I can.

</comment><comment><USER11> Not sure if you will still check this thread but in case you do:

I only have a voip.ms account at this point (I use linphone, that I'm not entirely happy with but seems better than the alternatives I've been able to find and is cross platform). I only connect to it when I need to make a call and get voice messages sent to my email. While it might be different depending on where you live (I'm in a large city in the US), there are a number of places that expect you to have a phone and it will be more effort to be completely without one, so I'd recommend some VOIP account if you are going for the least annoyance non-smartphone option. Some companies require the ability to send you a text message, including Google (I think, unless there is some way to get around it) and Paypal. I was able to get SMS from Google on voip.ms but not from Paypal (they say SMS from short codes usually doesn't work and it they have no idea when they might be able to make it work). Paypal still lets me use the account (and stopped the annoying messages on login after I enabled TOTP) but I can't add any new info (update cards or bank info) so it may eventually stop working. My bank also seems to require that I have a phone but I can get the text via voice (but not just a message, you need to type a number before it gives you the code), text, or authy. I should try to see if they would give me a TOTP key if I contact them. You will need some phone number to enter into a form much more often but for me I think those are the only ones where I have actually needed to use the phone.

At least in the US, old cell phones can be used for emergency calls as long as they can connect (even if they do not have active service).

</comment><comment><USER12> Yes, by living in the 80s and 90s (and even in the 2000s where the phones were "not smart")

It sucked.

Not being communicable where you were and having to depend on fixed places for communication (phone booths, etc) sucked.

Not being able to access some information quickly (maps, etc) sucked. Ok maybe sometimes it was fun, but it overall sucked.

So thanks but no thanks

You can always set your phone to "Do Not Disturb" or "Airplane Mode" if needed. Or, you know, not look at it immediately after getting a notification

<comment><USER7> Totally this.

You are now given more options regarding daily activity + safety which aren't obligatory.

I was recently thinking what was in my parents heads when I was lost in the mountain storm during regular ski period in 90s.

</comment></comment><comment><USER13> I went back to a dumb phone and a WiFi only iPad.

I downloaded maps for offline use but I hated it and really missed having decent navigation at the push of a small button in my hand.

For music I used a 2008 iPod video. I actually still prefer it when riding my motorcycle.

I was shocked at how much I still needed the iPad for MFA via google authenticator / Microsoft auth / Authy because the Yubikey I bought didn't work with most sites. This was a couple years ago. YMMV.

I wish I'd blogged about it. I ended up going back to a cheap Android after a couple months of missing a decent camera then go frustrated with the speed of the phone and went to a pixel and then back to iPhone.

When I have been without a phone it's demonstrated how much I really need one for the simplest things like a calendar, a timer, a flashlight, a camera. A lot of that a dumb phone can do. But navigation is the deal breaker.

That said I think $1000 phones is stupid. I am very happy with the new iPhone SE

</comment><comment><USER14> I can't, because I really need these apps:

\- Electric scooter unlocking (you scan a QR code on the scooter)

\- Car rental and unlocking

\- Maps and navigation

\- Grocery list (I uncheck items when I notice that I'm running out, so the list is always up to date when I go to the mall)

\- Language learning app

\- Music streaming

\- Podcasts (includes news)

As for my experience, I tried a week without a phone and a year without social media and my conclusion was that I absolutely need a smartphone and like Twitter (after some cleanup and muting some topics). I also tried a Jelly Phone (very tiny Android phone) for a while, which was fun, but a regular sized smartphone just works best for me.

Ultimately, it's up to you, to pick the technology that best fits your life. If you can live with an old-school phone or none at all, why not? The nice thing of the "not owning one at all" option is that you can just try it immediately.

</comment><comment><USER15> I have a high spec phone running Sailfish OS, and I think I have the best of both worlds. With all notifications and push updates turned off it's a useful tool but no longer intrudes. I've set up periods of the day when even phone calls don't trigger audible alerts, so I can work without interruption. But when I need access to information, Slack conversations, files from our NAS or even SSH access to servers themselves, I have that anywhere in the world.

A lot of the time it stays in my bag, and gets to the end of the day with 75% charge left despite reading books on it over lunch, often watching an hour's video on it in the evening, and listening to music via bluetooth at work if I need to shut out distractions.

It's now a tool and no longer an intrusion.

</comment><comment><USER16> I grew up without one, but came in fully to the working world of 'always on'.

It took me 6 months of 'non corporate work' to get used to the idea of not receiving emails all the time.

It becomes part of your identity and you feel lost without it.

But then you regain something lost - peace of mind.

I can't even imagine what it means to grow up 'fully connected' \- sometimes I think that young people must be excessively neurotic, and would be afraid of 'quiet' and think that what was normal for all of human history is now, in one generation - 'bizarre'.

I recommend getting an Android and not using apps. Don't have notifications, but if you want to check something you can.

And it will take 6 months to get used to, but afterwards, you might not be able to fathom going back to the noise.

<comment><USER17> Not using apps is way more radical than blocking almost all notifications.

<comment><USER16> I see what you are saying, but the notification is actually a big deal. The notification is the 'trigger' to set us off to 'read the thing' which gives us our little dopamine hit. It's hard to resist, and it takes up a lot of mental noise.

Even the _possibility_ of getting notifications is stressfull.

The difference between having a phone on, where people can contact you - vs - phone dead or 'no phone' is definitely noticeable. 'Knowing you don't have to check' is an extra level of peace.

<comment><USER18> notifications reallly piss me off.

it seems that if i shut my mouth its all fine but as soon as its time for a conversation there is constant disruption and derailment from the continuity of a conversation, effect is a shallow conversation or series of mini conversations made of half phra [BRRING!! BRINNG!!] hey someone just liked a post from yesterday, what was that we were talking about.

</comment></comment></comment></comment><comment><USER19> I lived without a cell phone until I was in my late 30s (2016). It made going out, meeting friends, navigation, taking photos, and dating much more difficult. Other people will expect you to have one and not having one makes you harder to communicate with; think about how many people you regularly text instead of call. My current relationship relies heavily on a cellphone; we use our phones to identify restaurants, get directions, and have brief text conversations. There are many things I dislike about cellphones but I would never go back.

</comment><comment><USER20> My life improved measurably once I got a phone. Many events happen more or less spontaneously and people will message me in the moment if I want to join something. Since joining facebook and whatsapp I have become a much more social person (in real life).

I don't use facebook for posting, just for messaging. I don't install works apps (teams) on my phone, so if I get a notification, it's usually positive/meaningful one. I mute all group chats.

This is how I keep my phone a positive object in my life.

</comment><comment><USER21> I can relate to not wanting to be on a leash.

What I did is disable all notifications and ringtones. Calls go to voicemail and if people leave a message I'll call back on my own time, otherwise I won't. Only my SO has audible ringtones and notifications so I know that if the phone rings it's worth answering.

I don't install apps if I can help it, I havE gotten rid of Facebook twitter etc a long time ago and will use the browser for the rest. If they go out of their way to make the browser experience shitty on mobile (Reddit, linked in), well, more power to them I'll only use my computer with ad blocking instead.

And of course I'll never install my works chat app on my phone, nor will they ever get my phone number.

But I do find having a smartphone is convenient. Maps at the tips of your fingers when you're lost, calling places when you're on the go and need to ask or change something, gps for the bicycle, transit pass for public transportation and trains, music on the go... it feels like by disabling all notifications, no social networks presence, and no native apps if I can help it, then I have the best of both worlds. Oh and nextdns.io for ad blocking on the iPhone, it works everywhere except in the YouTube app and for websites that inject google ads after the page has loaded (only a couple of websites as far as I'm concerned)

<comment><AUTHOR> Maybe the rule should be: no phone while at home? Lock it on arrival or something. All the practical/non-attention-sucking benefits of phones happen outdoors I reckon

</comment></comment><comment><USER22> I've gone back and forth between smartphones and dumbphones a few times now. Each model and OS have a big impact on how dumb or smart a phone can be.

Smartphone Pluses: It's nice to have a camera and a flashlight in my pocket all the time. Having the internet nearby is also nice for when I need to look things up. GPS is really nice.

Smartphone Minuses: It's distracting, but you can and should customize your app preferences, notifications, etc. to your liking. The battery sucks.

Dumbphone Pluses: Not very distracting. Forces you to be thoughtful in text messages, as they are laborious to write on a numpad. Good battery life and they are mostly replaceable. Though you should buy a few replacements and store them in your fridge as battery models are dropped from manufacture.

Dumphone Minuses: Generally, not a good camera or screen to read/view from. Same with flashlight, but you can get a small one for your keychain anyways. Lack of apps and internet. Sometimes you really do want to have a stargazing app or know that one recipe. You can call 411 and ask them those questions as well, but it does cost money. No GPS. No real social media support, though you can send out updates to most social media sites, but getting back info is done through text message and that can be a hassle. Overall, you can do work- arounds, but they take time, knowhow, money, and are overall less optimal.

Overall, I have a pretty locked down smartphone right now and it works ok. I'd like to have a better battery though. I don't think I'll be going back to a dumbphone as the 'social inertia' of smartphone usage is pretty high.

</comment><comment><USER23> Yes, of course, I only got one of the things when I got a girlfriend - who is now my wife - in another country. Before that time I was employed as a service developer and -architect at a big telco while at the same time (well, at night mostly) working on a number of free software projects. I did standby duty during the Y2K moment supreme (nothing happened and I could party along at the hostel close to the office). When I needed to be reachable I had a pager on me, otherwise I was either close to something with a network connection or in disconnected bliss out in the woods.

The same works just as well now with the exception of the pager which needs to be replaced with a phone. Wear it when you need to be reachable, otherwise leave it at home. I still do this with my phones in a way in that I don't use data and leave my main device at home when I'm out in the woods. The secondary phones - I have a number of them - are all older Android devices which I use as audio players and cameras which happen to make it possible for people to reach me.

Just get a cheap phone or leave your current one at home for a while to see how it goes.

</comment><comment><USER24> My phone melted down last week and spent a long weekend without it. It was very refreshing, and tempted to stay phone-less, so kind of regret that I used the warranty and received a new one. What a coincidence that I just wrote about the brief experience a few hours ago: [https://ivanluque.com/unphoned/](https://ivanluque.com/unphoned/)

</comment><comment><USER25> I've considered doing the same. Also, before I ran my own company, I used to never take a phone or laptop with me on vacation.

Here are some things I've done as a half measure to make phones more tolerable:

\- Turn off notifications for almost everything. I don't let any of the current crop of messengers send audible (or vibration) notifications. I only see them if I look at my phone. I don't allow notifications from any social app, or really anything else.

\- Set up "favorites" on Android, and leave my phone to only allow those through a large chunk of the time. This means the only people that I'll hear ring if they call are basically: my wife, kid's daycare and server downtime notifications.

For me that gets it into the range of tollerability most of the time. It helps that I've always been more of a laptop / desktop person than phone user for browsing. I don't tend to pick up my phone super often. Friends do complain that I'm hard to reach though.

</comment><comment><USER26> I did live without a smartphone for 20 days during my military service. I had no other choice as only "dumb" phones were allowed.

I would suggest it as a one-month experiment to anyone reading this. I had so much time to think, reflect and... get bored. It was a sort of detox. It was great to __not __know where you are on the map. It was great to __not __have something to listen to. It was great to __not __catch-up.

Since I was off the hook of my smartphone, I tended not to bail out on conversations with others and go back to my digital reality. I talked to people (maybe other people not having smartphones also helped with this).

I kept my "dumb" phone for a couple of months after that but I don't think I can manage to live without a smartphone full time. However, it's a great exercise to reduce addiction. I definitely started use my smart phone less.

</comment><comment><USER27> If your goal is to take back your attention and stop being a slave to messages and notifications, you can always turn them off and uninstall just those apps. I've been running in 24/7 "do not disturb" mode for the last few years, and it's been a game changer. I use my device on _my_ terms when _I_ want to, not when other people or apps want my attention. All notifications are silent and do not light up my lock screen. All calls go directly to voicemail with no ring. My ring tone and message tones are set to silent audio files, in case I missed something. Any app that I find myself compulsively going into gets uninstalled.

Also, leaving Facebook about ten years ago and never picking up any of the alternatives was a critical step toward taking back my attention.

</comment><comment><USER28> On and off, over the years, due to remote locations. So, not exactly what you are asking for.

Longest period was about 3 months, during which time I was able to voice chat via sat a few times a week. On many other occasions I've been off the phone grid for a few days to a couple weeks.

Message apps are a big one for me because I am rarely near people with whom I have close relationships. Months without that were quite lonely.

On the other hand, I (almost) never use maps, never use social media, and do not use my phone for watching videos. All of that by early choice. I survive fine that way.

Ive found that without my phone the first couple days have lots of frustrated moments of "oh...I cannot look up the thing I do not know," but after that I adapt.

</comment><comment><USER29> I find that if I didn't have a phone, my time would probably just be spent staring at a computer instead. Before smart phones I would sit for hours browsing the internet on my computer.

Now I still spend hours browsing the internet each day, but usually I'm also out and about because I'm doing it on my phone.

However, I'm thinking of getting a smart watch and completely leaving my phone at home. If I really need to communicate someone I find an Apple Watch is good enough, and it eliminates the other distracting apps that eat up my time. Probably the way to go tbh, and if I had kids it'd probably be the first communication device I give them instead of a phone.

</comment><comment><USER30> I want to try this once. But I'm so much into WhatsApp, Instagram. It will be kind of digital detox. I had deleted twitter and Facebook 6yrs back that was once of the best decision I had made. Now I'm kind of addicted to that Insta feed and Youtube feed. I will be deleting Insta account. But hope will come over the need of WhatsApp and other cool apps and ditch phone completely.

But if you suddenly need a document and you have been out for some work, and you don't have mobile to receive it ? This is the only thing I'm not able to cover it up. Rest if I ditch I can come over it.

<comment><USER21> > But if you suddenly need a document and you have been out for some work, and > you don't have mobile to receive it ?

That's an easy one: my personal phone = no work use whatsoever. And if they offer to pay for it (they won't), then I'll decline so it stays my phone rather than my work's whistle.

</comment></comment><comment><USER31> I just gave in and made the switch to a smartphone. It's getting tough to find dumbphones that aren't limited to 3g, which Verizon (my carrier) is turning off that _also_ have a QWERTY keyboard. If you can live with T9, you have a lot more options.

Last time I got a new phone (2015 or 2016), most of the QWERTY phones were just crappy or outdated smartphones. I found a slider with QWERTY that is apparently 3g only. Everybody hated the voice quality.

This time around, I gave in and got an iPhone SE. I hate the distraction, but I wasn't willing to live with T9 for texting.

Good luck!

</comment><comment><USER32> I have black out periods. A few hours a day that I'm not accessible. Turn phone off, disable all messages in laptop , etc.

It's really helped with mental health to the point where I take a few days off a month and completely disconnect from "networked" tech. No phones or internet. I walk, I write, I watch movies I took the time to buy instead of taking what Netflix pushes on me.

I can't say how I'd be without it but I do think it's improved my life by making me appreciate slowing down more and deeper involvement in anything I'm currently doing.

</comment><comment><USER33> It's almost a requirement of modern city living To have one.

Paying parking meters, not having to deal with rolls of quarters.

Also 2 factor logins at work from home require a smart phone.

Filling out forms for pandemic related info to get into Work requires a app. (For those that work in labs and not from Home)

I don't love being plugged in all the time, but having lived my life without one (cell phones weren't around in early 90s College) I'm not going back. Dumb phones were a pain to type on.

Apart from being always connected there is anxiety about my phone breaking which is another downside.

</comment><comment><USER34> I did it for about a month a few years ago and it was really refreshing. I've been trending back in that direction. I got an iPhone SE and uninstalled most apps.

I still really enjoy having a few things: maps, camera, and messaging. I don't do much of the social thing so that's not a problem.

I've been checking out the Lightphone II. It's definitely intriguing with the support for a hotspot and podcasts, music, and eventually maps. But I also don't know that I want to spend that much.

</comment><comment><USER35> My work requires a smartphone for multi-factor authentication and to unlock the office door (if we ever go back to the office)

<comment><USER36> For multi-factor, could you use an Android emulator running on your PC?

Obviously, that does not work for the doorlock.

<comment><USER37> Running it on the same machine would defeat much of the purpose.

A better idea is to just turn it on for 2FA, then turn it off again.

<comment><USER36> That was my point. Using a mobile phone as a second factor seems more like an inconvenience.

Other sibling mentioned IMEI pinning, but I assume the emulator can spoof IMEI.

I am all for a separate physical device, just not a phone.

<comment><USER37> A phone is just a computer, just like any other device. What do you have specifically against it? You can just keep it turned off except when you need to use it for 2FA.

</comment></comment></comment></comment></comment><comment><USER38> I am about to do exactly the same after I move: get a landline and ditch my smartphone. I think of what it costs in time, money, resources, and freedom, and I've come to the conclusion that I'd be a more satisfied human being without a smartphone. I'm not interested in buying what it's selling.

</comment><comment><USER39> I did this intentionally for a few years about five years ago and thoroughly enjoyed the experience. The only reason i ended up getting a phone afterwards was to develop mobile software.

As i notice myself get too attached to my device i miss those peaceful years. At the very least leave it behind when you go on holiday if possible.

</comment><comment><USER40> I've been thinking about doing a multiple-profile setup on Android. One with just the SMS / Phone / Camera apps, and the other with email or slack for when I'm on call. Anyone have experience with the profile system on Android?

</comment><comment><USER41> Smartphones are not a status symbol anymore so it's now much easier to have a lower-end device that meets basic needs (phone, email, messaging) while limiting how distracting it can get (games, AR/VR)

</comment><comment><USER36> I let my phone's battery 'die' and may not recharge for several hours to a day.

I have thought about porting my number to Twilio or similar, and having a stationary phonebooth that can send and receive mms messages, as well.

<comment><USER5> It's very bad for the lifetime of a lithium battery to let it drop all the way to 0% charge

<comment><USER42> Do most devices wait until 0% to turn off?

<comment><USER5> No, but the higher the depth of discharge, the worse the degradation will be.

See: [https://batteryuniversity.com/index.php/learn/article/how_to...](https://batteryuniversity.com/index.php/learn/article/how_to_prolong_lithium_based_batteries)

</comment></comment></comment></comment><comment><USER43> Or just turn it onto airplane mode for most of the time. You get the benefit of having something with you to take notes, photos, videos, etc but none of the constant connection and availability anxiety.

</comment><comment><USER44> I had thoughts about this but eventually decided to just turn off the color on my smartphone. Now I just use it when it's absolutely necessary because it looks so drab.

</comment><comment><USER45> Depends on your lifecycle. I honestly couldn't imagine living in a big city without map/taxi/metro apps. I love getting lost, but not on a daily basis.

</comment><comment><USER46> It's not possible to use internet banking here without being able to receive SMS, so that would be tough. Dumb phone is enough for that, though.

</comment><comment><USER47> Don't have one, don't feel the need for one.

</comment><comment><USER48> Never had one, never really caused a problem. Mutli-auth with a yubikey, land- line if I need to make a call, old ipod for music ... do it.

</comment><comment><USER49> I don't have a phone, not even landline. It's fine. People adjust to the fact that I'll reply to emails when I have time.

</comment><comment><USER50> When I have broked my last hpone, I spend several days without anything. It was hard but in some case greate. I had digital detox)

</comment><comment><USER51> Is this bout "distractions are the devil"? My life in plain text kinda thing?

</comment><comment><USER17> We had a landline even when I was a kid... on vacations ?

</comment><comment><USER52> The all first part of my life :)

</comment><comment><USER53> Why should I do that? I remember the time w/o cell phones and it was horrible. I never want to go back.

<comment><USER54> And now there aren't hardly any payphones.

<comment><USER55> How come they don't sell batteries on the train no more? I guess it's cause the iPod came out.

<comment><USER53> They sold batteries on trains? I remember there used to be a pay phones on some German trains but they were using the analogue C network, which shut down in 2000.

<comment><USER54> People sold them on the NY subway at least.

</comment></comment></comment></comment></comment><comment><USER56> I have for 4 years.

Not going back.

</comment><comment><USER57> never say never</comment>


Reviewing the SEAL: A new form of bootstrapper funding - <AUTHOR> https://medium.com/swlh/the-cost-of-raising-earnest-a-review-of-earnest-capitals-shared-earnings-agreement-seal-2cf68c099ddc <comment><USER2> >> To summarize: in a traditional seed investment, the founder is giving up that which is not scarce, and which has a nominal value (stock) for that which is scarce and has immediate value as legal tender (cash). The consequence of this transaction is that he must also accept sharing some percentage of the cash that will come later if he or she is successful. However, at that later point, cash is much less scarce and has less value to the entrepreneur and the business than it had previously.

>> With a SEAL, things are quite different. The investor is providing the founder with cash when it is scarce, but their own access to cash (through payback) comes to this side of the non-linear payout of an acquisition or exit. This means that cash is still a scarce resource. While it is true that the founders themselves are also partaking in cash in the short term, it is because they are actively working on the business and creating more value than they are taking out in the form of cash.

This is just plain wrong. By binding the payback to profit (not revenue) and giving the entrepreneur a lot of flexibility in defining when to allow the (successful) business to become profitable, the investor will only have access to cash when it isn't scarce.

The author seems like a really competent person so, unless they have a bone to pick with the Earnest Capital team, I can't understand how/why they got this so wrong.

<comment><AUTHOR> Thanks for the nod to competence.

Re: "By binding the payback to profit" \-- but it isn't bound to profit. Re- read the terms. It's Founder Earnings, which is profit PLUS any founder salary above a 'low but fair' threshold. You can be breakeven or below zero and still have shareable earnings with a SEAL if you are making a market rate ( _not_ low but still fair).

I spent days thinking this through and would be happy to explore your objections in a higher-fidelity forum or longer-form format than HN comments.

For now, suffice to say I have no incentive to mislead founders.

</comment></comment><comment><USER3> Very interesting analysis. As a bootstrapping founder, I am thinking about possibly raising funding at some point. So it's good to see new options coming out and some way of comparing them with existing options.

To the author - I wonder if you could use the data from the Open startups (sharing their numbers on Baremetrics) and see how different funding options, including Earnest capital's SEAL, would work out for them.

<comment><AUTHOR> Yes, absolutely. The key question in my mind still (after finishing the article) is what startups actually WOULD be smart to take money on these terms (what kind of business model, unit economics, and growth trajectory would they have to have for it to make sense).

My guess is it's a narrower slice of the startup population than Earnest intends. And my prediction is they will update their terms to broaden the slice.

</comment></comment><comment><USER4> The section on "Cost of SEAL Capital, in Equity" is mathematically correct, but omits a few key points that make the example unreflective of what would happen in reality. The whole point of the Equity Conversion terms is to keep open the option to raise VC if the founder wants to do so.

If after a SEAL, the business decides to raise a priced round at a valuation higher than the Valuation Cap, then the investor has the option to convert to [any unpaid amount of the Return Cap] / [Valuation Cap].

If at the time we are negotiating a SEAL this simple math shows the investor would own a giant % that would make a VC round impossible, then it closes down that option and defeats the entire purpose. It's very easy to plug in numbers that generate a result that is extremely founder-friendly ($100k, 3x, $5m cap = 6%) or ridiculous ($250k, 5x, $2.5m cap = 50%).

As part of the upfront negotiations, any honest investor would make sure the founders understood how these numbers play out in a variety of scenarios and agree on terms that are fair to both parties.

The example in the post is $250k, 4x, $3.5m and with the implied 28.3% the conclusion is "the terms will work out so poorly for you and your new investors that the most likely outcome is new investment never happens" \- But by changing the cap to $5m, it becomes 20% (not an unreasonable ownership stake for a very early seed/pre-seed investment). If the return multiple is 3x, we get to 15% which can be further reduced by any payments that might have been made prior to the fundraising round.

There are plenty of fair ways to structure these terms. Though I would agree that for founders that are dead set on raising a round of VC in the near future, they should use traditional products like a SAFE or convertible note, which are built for this purpose.

</comment><comment><USER4> Hi all, I'm the GP of Earnest Capital and I'll add here the comments I gave to Matt privately before this post. The terms we use for our Shared Earnings Agreement are the result of a transparent and honest discussion with the community via this post ([https://earnestcapital.com/funding-for- bootstrappers/](https://earnestcapital.com/funding-for-bootstrappers/)). I received 100s of comments about our investments structure from founders and investors, 99% of which were along the lines of "how will you build a successful fund with such founder-friendly terms."

I would encourage folks who are interested to read the very good discussion: Here on HN: [https://news.ycombinator.com/item?id=18338665](https://news.ycombinator.com/item?id=18338665) On Indiehackers: [https://www.indiehackers.com/forum/help-us-design-funding- fo...](https://www.indiehackers.com/forum/help-us-design-funding-for- bootstrappers-and-indie-hackers-eb92f5e179) And directly in the term sheet draft that we posted with comments open on Google Docs: [https://docs.google.com/document/d/1HoZ94eWTctYQM5O5RXDeQQ_h...](https://docs.google.com/document/d/1HoZ94eWTctYQM5O5RXDeQQ_hU36Pk- UM8_pO8--_-MQ/edit)

A Shared Earnings Agreement is not debt and comparisons based on interest rates are academically interesting, but misleading because you cannot go to any debt lender with a side project with $2k MRR and get a loan to take a year and grow it. A SEAL has no fixed repayment schedule, no personal guarantee, no mechanism to foreclose on the business if it fails, and critically and unlike any form of debt __the investor only gets paid when the business is doing well __(repayment is a % of the economic benefit the founders choose to pay themselves: Founder Earnings).

We designed it to be a substitute for equity (where seed VC is really the only real alternative most founders at our stage would have) but equity that doesn't force the company to continually raise capital or sell the business. A SEAL can still have a successful risk-adjusted outcome for the investor even if you build a nice profitable business (literally the "nice Italian restaurant" example quoted from DHH in the post).

You may as well also include the effective interest rate on every VC investment that returns 50x or 100x their investment and say "Woah what a high interest rate. Should have used a credit card." Like equity, the implied "interest rate" on a SEAL looks higher in scenarios where the business & founders are more successful (thus paying back more Founder Earnings faster) and is a nice, low 0% APR if the business fails

That said, if anyone has constructive feedback to share I would love to hear it: [https://earnestcapital.com/contact/](https://earnestcapital.com/contact/)

<comment><USER2> > You may as well also include the effective interest rate on every VC > investment that returns 50x or 100x their investment and say "Woah what a > high interest rate. Should have used a credit card." Yeah,

This. The author seems to completely miscomprehend/discount the risk involved for both parties in his calculations.

It's important to remember that the payback is based on profit, not revenue. The author does note this, but a lot of his reasoning around the founders' hypothetical motivations only make sense if you assume the reverse is true.

For example:

> While much shorter than a mortgage, eight years can feel like a long time to > owe money, especially in startup land, where 1 year can feel like a decade.

This misses the point because you _don 't_ really owe money like a mortgage. With a mortgage if you don't pay it off today, lose your job and can't make future repayments, you could lose your house.

With this SEAL, if you don't pay back the investors today and suddenly can't afford to pay anything next month, there are no negative consequences. You won't be fired, lose your house/additional equity or end up paying back more (eg due to interest).</comment></comment>


Subways and Urban Air Pollution [pdf] - <AUTHOR> https://www.nicolasgendroncarrier.com/_pdf/Gendron-Carrier_etal_WP_2018.pdf <comment><AUTHOR> Abstract:

> We investigate the relationship between the opening of a city's subway > network and its air quality. We find that particulate concentrations drop by > 4% in a 10km radius disk surrounding a city center following a subway system > opening. The effect is larger near the city center and persists over the > longest time horizon that we can measure with our data, about eight years. > We estimate that a new subway system provides an external mortality benefit > of about $594m per year. Although available subway capital cost estimates > are crude, the estimated external mortality effects represent a significant > fraction of construction costs.</comment>


Modern B-Tree Techniques (2011) - <AUTHOR> http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.219.7269&rep=rep1&type=pdf <comment><USER2> For those who don't know, Goetz Graefe is sort of the patron saint of btrees. He recently won the Sigmod Codd innovations award for his contributions:

[https://sigmod.org/sigmod-awards/people/goetz- graefe-2017-si...](https://sigmod.org/sigmod-awards/people/goetz- graefe-2017-sigmod-edgar-f-codd-innovations-award/)

He also has a lot to say about locking in B-trees:

[http://15721.courses.cs.cmu.edu/spring2016/papers/a16-graefe...](http://15721.courses.cs.cmu.edu/spring2016/papers/a16-graefe.pdf)

</comment><comment><USER3> > Probably the strongest arguments for B-trees over hash indexes pertain to > multi-field indexes and to nonuniform distributions of key values. A hash > index on multiple fields requires search keys for all those fields such that > a hash value can be calculated. A B-tree index, on the other hand, can > efficiently support exact-match queries for a prefix of the index key, i.e., > any number of leading index fields

Yes, well, if none of the columns/fields in the index are sufficiently selective, then the ability to search a B-tree by prefix may not do you much good. Don't get me wrong though: I fully agree with all of the given reasons for B-tree superiority to hash tables.

Although the newest storage technologies (particularly very fast byte- addressable NVMs) -- too new for TFA -- might well change things. When you have fast byte-addressable storage it will pay to not read pages, and hash tables may yet involve fewer accesses than B-trees in that case, though I suspect B-trees will successfully adapt anyways.

<comment><USER2> One thing that doesn't make the two interchangeable is total ordering and range queries, which are only supported by B-trees and not by hash indexes. So the question is whether you're willing to trade that away for faster insertion and lookup.

> When you have fast byte-addressable storage it will pay to not read pages

It always pays to not read pages :-) An alternative way to look at it is that faster storage is more forgiving of more accesses, meaning the benefits of hash indexes might be less prominent.

<comment><USER4> _So the question is whether you 're willing to trade that away for faster insertion and lookup._

I wouldn't characterize the decision as a trade off. They're different tools for different situations.

</comment></comment></comment><comment><USER5> Well, it's an interesting survey. I'm surprised at how much space it devoted to illustrating B-trees in the context of RDBMSs as a lot of the concepts there really had no specific connection to B-trees.

So much space devoted to logging, locking and latches. All heavily used in the industry up till the last decade. All obsolete now. Not a single mention of immutable/persistent B-trees. Were there really no academic papers on the topic written in a time covered by this survey?

</comment><comment><USER6> This is from 2011, in case you missed that. I was confused by sentences like:

>Flash memory, flash devices, and other solid state storage technology are about to change the memory hierarchy in computer systems in general and in data management in particular.

until I looked up at the publication date.

<comment><USER7> Thanks, we've updated the title!

</comment></comment><comment><USER8> Really good read ! Must read for people who like algorithms and competitive programming !</comment>


Looking for a Junior Developer in Munich - <AUTHOR> Job offer in Munich, remote work possible <comment><AUTHOR> Title: Junior Developer (M/F) Firm: Hillert und Co. Interactive und Mobile Marketing GmbH Location: Munich, Germany Start date: ASAP

Who you are: You are a problem solver, a creator, a do-er with a user centered focus and passion for developing captivating, seamless projects for digital products and services of all kinds, sizes, shapes and contexts. You like to get your hands dirty and can always see the bigger picture.

Who we are and why us: We are Hillert und Co. Interactive and Mobile Marketing, a digital advertising agency located in Munich, Germany. At Hillert Interactive, we work in a collaborative environment in integrated multi- disciplinary teams of developers, project managers and other designers with an all hands-on deck stance. As a Junior Developer with us, you will play an integral role and are incorporated fully in our creative process, from strategy to conception to design to development. We don't just believe in creativity, we live for it. And we will let your creativity run wild with the opportunity to work with firms ranging from fortune 500 such as BMW, Rolls Royce, Mini and OSRAM to innovative Startup's.

With all the electric buzz of a Startup; we have an entrepreneurial spirit and work hard, play hard attitude. Whether it's a game on the fussball table, team volleyball game or designing a new digital campaign, we work hard because we love what we do.

What you're bringing to the table: • 4-5 years development experience • Full stack developer, but at least front-End • Languages: Html5, CSS3, JS • Responsive web design • Application performance oriented • Cross Browser Development • Content Management Systems Typo3, Drupal • You're working with frameworks including node.js, jQuery, react, react native, angular js… • Git & Version control • Building and Automation tools • Experience with RESTful Services and API's • CMS liferay and First spirit • A huge plus would be app development • German as a language • Willingness to relocate to Munich, Germany or work remotely from within Germany

What you'll be doing: -Technical concepts for websites, campaigns, web apps. -Development of front end, backend for systems/webapps -Development of Drupal websites/new features -Development of Typo3 websites/new features

A typical day could include development in multiple projects, System updates for existing clients, integrated concept discussions with PM and UX, and Kickern

Apply now to firstname.lastname@example.com with your CV and portfolio to join our growing international team and unleash your creativity. #CreateDigitalProductsPeopleLove

Find out more about us:

[http://www.hillertundco.de/home/](http://www.hillertundco.de/home/) [https://www.linkedin.com/company- beta/1661720/](https://www.linkedin.com/company-beta/1661720/) [https://www.facebook.com/hillertundco/](https://www.facebook.com/hillertundco/)</comment>


Notes to Myself on Software Engineering: A laundry list of personal reminders - <AUTHOR> https://medium.com/s/story/notes-to-myself-on-software-engineering-c890f16f4e4d <comment><AUTHOR> Technology is never neutral. If your work has any impact on the world, then this impact has a moral direction. The seemingly innocuous technical choices we make in software products modulate the terms of access to technology, its usage incentives, who will benefit, and who will suffer. Technical choices are also ethical choices. Thus, always be deliberate and explicit about the values you want your choices to support. Design for ethics. Bake your values into your creations. Never think, I'm just building the capability; that in itself is neutral. It is not because the way you build it determines how it will get used.</comment>


Ask HN: AWS Uses Angular.js with React - <AUTHOR> It seems the AWS API Gateway console is built using Angular.js + React. Why would anyone do this?<p>https://twitter.com/tuhinkarmakartk/status/1128724672634187776?s=09 <comment><USER2> In 2015 my team had Backbone, Angular, and React in a single app for a period of time. We merged two separate applications (Backbone and React) from two separate teams into a single application. We gradually moved the application over to entirely React over the course of about 7 months. not that uncommon.

<comment><USER3> > not that uncommon.

That is my understanding as well, it is especially common to see this when a product is migrating from one framework to another. A quick google search turned up plenty of examples: [http://tiny.cc/jmur6y](http://tiny.cc/jmur6y), including Microsoft's tool specifically for this purpose: [https://github.com/microsoft/angular- react](https://github.com/microsoft/angular-react).

</comment></comment><comment><USER4> Angular 1.x has this dreadful thing called digest cycle. Long and short of it, the rendering performance degrades proportionally with the number of things Angular has to watch for changes.

Some people retrofitted busier parts of their apps with react views to work around that. There are even a frw angular directives for that out there.

</comment><comment><USER5> At my previous job we started out with Angular in 2017. After some time passed benefits of using React was clear to everyone in the team. We wrote new features in React. The old Angular code worked as expected. It made little sense to spend time porting that to React.</comment>


Show HN: Poli – An easy-to-use SQL reporting application built for SQL lovers - <AUTHOR> https://github.com/shzlw/poli <comment><USER3> Looks great!!! I see you're using react for the frontend. Is the option bar for the reporting objects (on the left - e.g. for charts) dynamic or static? I'm currently creating something similar and planned to use something like JSON form ([https://github.com/jsonform/jsonform](https://github.com/jsonform/jsonform)) in order to create a dynamic option bar.

<comment><AUTHOR> Thanks. If you are talking about those three Slicers (User, Product, Year) in the Slicer & Charts screenshot, they are dynamic in a way that the values displayed are queried from the database but I don't think they do the same thing as jsonform.

<comment><USER3> Maybe I misunderstand your left side panel. I thought it's related to the object (e.g. a specific chart) that is selected but looking at it again it seems to be related to the entire dashboard.

I was not referring to the form values but to the structure of the form - <USER2> just thought the different object types (chart, table) don't have static forms behind but dynamic ones. In your case, as far as I can tell, dynamic forms wouldn't make much sense as your form objects are only textboxes, checkboxes and selection boxes - also you don't have too many different objects to configure. Doesn't matter - was just wondering.

But really a great application! I'm working on a similar platform but not open source and with focus on data generation/collection instead of reporting.

</comment></comment></comment><comment><USER4> Looking great!</comment>


Ask HN: What's your preferred way of ensuring complex database integrity? - <AUTHOR> What I mean really is: when working with relational databases, and you have complex constraints to ensure (not trivial things like notnull but something like: "two tables away" uniqueness, etc..), do you like filling it with tricks using PKs/FKs/UNIQUEs to ensure integrity or do you prefer writing some code that will get executed as you application boots up, that ensures that all the more complex requirements are met? <comment><USER2> Isn't that the primary purpose of transactions?

I mean, every time you write to the database, you open a transaction, do you stuff and close it. It either works or it doesn't. If it doesn't, then it rolls back. Isn't that enough?

I guess I am saying that for complex integrity checks, it should be the responsibility of the application's data layer.

On the other hand what is meant by "complex"? Is it "complex" because of numerous, ever-changing applications that touch the database or is it just one application and a database with a lot of tables?

In the case of wild, numerous applications, I suppose that database-side integrity controls are needed. If you really have ONE application touching the database, it might be better to have the application police integrity. Perhaps there's more than one answer?

<comment><USER3> Here's an example of a "complex" constraint. You have a restaurant reservation system, and reservations are stored as time intervals. Each restaurant has a capacity, and you need to ensure that a booking does not make it so that the restaurant exceeds capacity at any point of time.

One way to resolve it with triggers is to have a stored procedure fetch all the records that intersect the new booking's interval, and procedurally count the number of concurrent bookings at each record's start and end times; the constraint would be violated if and only if the count at any point plus the pax of the new booking exceeds capacity.

<comment><USER4> Imho that's the only way. Anything else can end up in invalid state.

</comment></comment></comment><comment><USER5> > do you like filling it with tricks using PKs/FKs/UNIQUEs

I am not sure that I would call these "tricks"

</comment><comment><USER3> As mentioned by the other comment, it's standard to use database triggers to ensure consistency.

There are two major problems with dealing with them in the application side

1\. You can no longer guarantee consistency.

2\. In the case where you need to do some things procedurally so that your application can no longer make a yes/no query to determine if a constraint is violated but need to make use of intermediate results, then this means that you will need to transfer intermediate results over the wire, which is a performance penalty over just doing it in the database server.

edit: of course, when you need to ensure consistency with some data source outside the database, there's no choice but to do it application-side.

<comment><USER6> >As mentioned by the other comment, it's standard to use database triggers to ensure consistency.

 _shudder_

Triggers are almost always the wrong level to handle consistency. It flies in the face of 'fail fast' if you need to actually handle problems of consistency and if you need 'last line' protection, why not bake it into the structure instead?

<comment><USER7> Foregoing triggers in favor of validating data in the application layer can be dangerous. The problem is that you need to re-implement data validation on every path to the database. If you've got a single application server, and it's the only client that ever writes to the database, this might work. But as soon as you add another service with write capability, you need to re- implement the validation logic. What if you forget?

If you put the validation in the database, any application can leverage it. If you want to fail fast, you can still do validation in the application layer while relying on the DB layer as the ultimate validator.

<comment><USER8> _But as soon as you add another service with write capability, you need to re- implement the validation logic._

Then Don't Do That (tm)

It's hardly ever a good idea to have multiple apps writing to the same set of tables directly.

<comment><USER7> Why not? How is it any different than two web requests causing a multi- threaded application server to send two simultaneous writes to the database?

If you use triggers for validation, you can rely on your database's MVCC to resolve any conflicts between triggers. Note that this is significantly more performant and robust than the application trying to resolve, or even notice, those conflicts.

<comment><USER8> Don't do that, was in response to:

 _But as soon as you add another service with write capability, you need to re-implement the validation logic. What if you forget?_

In context of application validation logic, the logic is only living in one place.

Triggers are basically "spooky action at a distance".

It's also much easier to promote, version, upgrade, and rollback application changes.

<comment><USER3> There are consistency guarantees that it's possible that you can't ensure with just application logic.

Suppose you are running a booking system for ridesharing. When you want to lock-in a passenger's seat, it's possible that consistency can be violated when you do it at the application level: both A and B request a seat after a query returns that there is a seat available, then simultaneously lock-in their reservation after seeing stale data.

It's also naive to think that validation in the application is sufficient. For, say, a webapp, there should be three places where that occurs: at the client where you can provide the most meaningful feedback, at the service to catch most consistency errors and guard against malicious actors while you can provide meaningful feedback, and at the database level for the most perennial and slow-moving constraints so that concurrency and your own bugs don't fuck up your source-of-truth.

edit: come to think if it, it's possible to do it without triggers as long as you can still express the constraint as a query: append a boolean field to each table with a TRUE check constraint, and use a table query mirroring the constraint to populate that field on every mutation.

<comment><USER8> _Suppose you are running a booking system for ridesharing. When you want to lock-in a passenger 's seat, it's possible that consistency can be violated when you do it at the application level: both A and B request a seat after a query returns that there is a seat available, then simultaneously lock-in their reservation after seeing stale data._

This is a solved problem.

      function reserveSeat (customerid, seatid)
      {
       lock
      {
          updatedRows  = update seats set customerid = {customerid} where id= {seatid} and customerid is null

          return updatedRows == 1
       }
      }

Yes pretend scarfaceScript takes care of sql injection vulnerabilities and "lock" makes sure that only one thread can enter the block at any given time.

<comment><USER3> This is only possible when you have a row for each available seat, though. Consider the case where you don't want to represent each seat in your application.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Generally my rule of thumb is to keep the integrity checking as close to the data as possible. Usually that means integrating it into the schema/database (optionally with triggers), as long as that has proper tooling (versioning specifically).

With more complex checks it might be necessary to build a periodically runnable check mechanism. At startup might be a good way to do it, or some sort of cronjob. I can imagine that in larger systems there might even be separate services to check data integrity across other services.

<comment><USER8> I've never heard someone say as the database grows in complexity - "I'm so glad we decided to use triggers everywhere".

<comment><USER9> I haven't actually used triggers myself, and I do feel like they're too far away from the data to be visible/easy to understand.

</comment></comment></comment><comment><USER10> I try to encode all constraints in the database using constraints and triggers. This way your data is always consistent regardless of which app/language is interacting with it.

Sometimes I add the same or similar constraints in the application layer because it leads to better error/validation messages.

IMO having data integrity enforced in the database instead of application code is similar to having a type system enforcing code integrity at compile time instead of at runtime. It's about catching errors as early and as close to the root as possible.

</comment><comment><USER11> If you're using SQL Server, you can use indexed (materialized) views to enforce uniqueness across multiple tables.

There's also a neat little trick with indexed views and cross join[1] that you can use for more complex constraints. I've never used it for anything more than reference tables, so I can't comment on its ability to scale.

[1] [https://spaghettidba.com/2011/08/03/enforcing-complex- constr...](https://spaghettidba.com/2011/08/03/enforcing-complex-constraints- with-indexed-views/)

</comment><comment><USER6> If data needs to agree PKs and FKs are a way to go. I avoid UNIQUES unless absolutely necessary since they are not structural.

Reference tables for things that don't change or change very seldom are a valuable tool if data across other tables must agree. Check constraints otherwise.

But that's just the bones -- the last line of defense. Having a framework that can push such constraints through the application is very helpful so you are not waiting for SQL errors to enforce integrity.

It is easy to go overboard, though, and it is worth thinking about how important data integrity and agreement actually is before writing it in stone, so to speak.

<comment><USER12> can you say more about "reference tables" ?

<comment><USER6> Sure.

I've also heard them called 'Verification Tables'. They are basically check constraints but stored in a table for reference. If you are using a check constraint in more than one place and it goes beyond a simple 'Y', 'N' it's probably worth thinking about using a reference table instead.

These tables will generally not be changed very often and can be considered 'read only' for the most part. At their most pure, an application can count on certain values to exist in a reference table and might even verify this at startup or populate them with application properties. They could be application level properties if not for the referential integrity needs.

It is often useful, however, to have some reference tables that are only 'mostly read only'. Changeable but largely static.

As a trivial example, a table like state_abbreviations. It is a finite list of data that is unlikely to change.

Data that comes from the government is a pretty good candidate for this kind of thing. It changes, but not often, and you don't want to give users the option to put whatever they want. e.g. Federal School Codes.

Other good candidates are structural aspects of your application. Say, a list of modules that users can navigate to to perform a certain job function. Perhaps you want to give them the ability to compose security roles around those and then apply those roles to users. Also, say, you want to use the same names for menus or reference them elsewhere in a consistent way, a reference table might be the way to go.

</comment></comment></comment><comment><USER13> I much prefer when the database enforces integrity by limiting access and preventing corruption from occurring.

In Microsoft SQL Server, you can often achieve the desired result with check constraints, primary and foreign keys, indexed views, and unique indexes. When more logic is required, I usually restrict write access from the application at the table or column level and force modifications to occur through a stored procedure that enforces integrity.

</comment><comment><USER14> It is a correctness vs performance trade-off. I typically use foreign keys and the type system as much as possible and back-off when needed for performance or certain cases of flexibility.

Unfortunately unlike compiled typed languages the database foreign keys are just straight up runtime overhead.

Using types correctly such as storing numbers and dates and UUID's in the actual database type rather than strings is an obvious one that typically improves space and performance, there is normally not much trade off here. Varchar with specific length I go back and forth on, it has saved me off on and catching something not validated for length properly in the app, but does get in the way when needed to expand length which happens quite often.

For coded values I like a code table per code type with foreign keys rather than say EAV, this has saved me many times in data quality and allows extra attributes to be added to specific types. It matches more closely to the type system in the client too which will have a specific type for a specific coded value. It also allows reflection like qualities where you can query the schema and follow the types. The downside is in a large app you can have many hundreds or more of code tables and its more work to cross cut features, but the benefits outweigh the downsides for me. this also goes for more full blown "entities" which are more obvious.

I don't normally use more complicated constraint or triggers, the tend to get in the way things like ETL loads and many complex rules end up working out much better in the app code. I am torn about it, but the procedural languages in the DB is usually less expressive with less reuse and can't do the other things needed such as alerting messaging etc.

Bottom line though don't be dogmatic, use the database as you can, test performance make the trade-offs. Sometimes constraints and triggers are better due to their locality to the data, sometimes leaving off foreign keys is better due to the overhead. Sometimes EAV is better for flexibility (or JSON).

In an ideal world we would run the same code in any tier(client, app server, database) for this stuff choosing the best location to run it based on the needs (or run it in multiple tiers, client for user experience, database for transactional correctness). You can almost get there with javascript an PL/V8 now days, and sort of with .Net and Sql Server, but its really not there yet.

</comment><comment><USER15> I'm moving more and more stuff into the database. Let me clarify my job:

\- I use Postgres. This is important. Postgres has long been one of the most stable databases. It has multiversion concurrency control and even lets you make changes to tables within transactions, which makes such changes easier. It has many features, like check constraints, triggers, procedural languages, and JSON, which makes it easy to put move more stuff to your database.

\- I have shell access to Linux virtual machines. I don't have layers of frameworks. I use the psql command-line tool and can log in as the superuser, postgres, when I need to. So my use of the database is not inhibited in any way.

\- I write internal business apps. They can have complex business rules, but it is not web scale --- though I would be comfortable serving hundreds of requests per second for tens of thousands of users with my set-up, which is just a single virtual machine. I'm being conservative, and it could probably handle 100 times that.

I began 14 years ago as most web programmers do, keeping their database as a dumb data store and writing everything in their middle layer. But I have found maintenance easier, and the overall codebase much, much smaller, by keeping my database in the know as much as possible.

\- Are the values in a column supposed to be from a limited set of choices? Tell it! Put those choices in a table, and link the column to that table with a foreign key.

\- Is a number supposed to be within a certain range? Is the date in a column supposed to be after a date in another column? Tell it, such as with Check constraints.

\- Is the data supposed to be sorted or summed or transformed before printed on the page? Tell it! Put the gob of SQL into a view, so that all your middle layer does is "select * from view".

</comment><comment><USER16> I generally keep the more complex stuff in the application layer, where it's often easier to capture and change. If all the logic goes into the DB, it can be a real pain to update and maintain (especially if you're running a cluster of sharded databases, say).

Some might suggest that you take a performance hit by not using stored procs etc, but in reality it's never been a problem for my apps (the largest one has over 150k active users - [https://usebx.com](https://usebx.com)).

</comment><comment><USER17> Trying to think through the alternative presented:

If the application is the only way to access the data, it would appear consistent until it wasn't. Assuming two application processes, process one would not immediately see the mistake it made, but process two would see it on startup. So, an audit table might be a good idea to see which process (or user) made which change, including the original erroneous entry, and any change needed to remedy the failed constraint. If the first process is still active, the second process could warn the first process, but that leaves a lot to chance. In comparison, once in place, relational database constraints are always "on" and enforced globally. Enforcement on a per transaction basis might provide a consistent slowdown, but still be preferable to a long startup time for checking the integrity of a large dataset with potentially many errors. In order to handle increasing startup times given boot time integrity checking, you may have to partition the data into more recently and less recently accessed data. In that case, you may find inconsistencies in reporting where the application only touched an earlier set of data once, and didn't enforce integrity checking. On the other hand, you could be presented with an opportunity to remedy the data before you can receive the report. If the entries that are permitted change over time, you would need some kind of date ranges on those values, so that the person receiving the report doesn't enter historically inaccurate data while fixing their own report.

</comment><comment><USER18> I've got some somewhat delicate relationships in the database (Postgres) for an application that I am working on.

I've opted to build an "API" within the database consisting of views for read- access and stored procedures that can validate relationships upon insert/update. It's pretty clean so far as it allows the data needed for integrity checks to remain in the database.

This hasn't made it to production yet, so take it with a grain of salt :)

</comment><comment><USER19> It mostly depends on what type of table it is, I am a Db2 DBA z/OS. From experience, PK is must for every table either composite or single column. FK not recommended for 24/7 high volume or transaction table, recommended to handle it via code for ease of maintenance.

Column should be NOT NULL WITH DEFAULT, nulls introduces unnecessary additional where clause checks.

</comment><comment><USER20> Make your complex database error resistant. Write documents for what it means when references are missing. Do Garbage Collection rather than ON_DELETE triggers. Do everything that SQL doesn't want you to do.

SQL requires defining integrity in advance, and if your database gets corrupted, there is little hope of recover. Cleaning up your data is nearly impossible because your schemas and logic are tightly coupled.

Writing garbage collection scripts is easy if you make a practice of it, and makes you think about your schema in the ways that are important and that the ease of triggers hides from you. You can monitor and metricize it in ways that you can't with triggers.

</comment><comment><USER21> I've yet to encounter DB level integrity problems that aren't solved by a well designed, normalized schema combined with proper use of transactions, PKs, FKs, unique and not null constraints, etc.

These problems probably exist, but they're very rare. Much more rare than people THINKING they have a problem like this, hacking around it with poorly implemented application code, and ending up with data that has integrity issues, when it could have been solved well using the DB properly.

<comment><USER22> We ran a large e-commerce company main site solely on a single (with HA) SQL Server database. (We've since added other DBs, and always had other reporting and analysis systems, but we were doing over $1BB/yr on a single transactional server.)

There's no "room" there for foreign key constraints nor pervasive use of transactions. We used limited transactions in payments area only (and eventually even retired the last of those) and no foreign keys.

Reasonably careful coding, doing a lot of work in stored procedures, and "fix it if it breaks" was the order of the day. I won't claim it was academically pure, but it sure did work based on the scoreboard (cash register).

<comment><USER21> Curious to know what you mean by "no room." As in the performance impact of FKs and extensive use of transactions was too high? In my experience (not insane scale, but around 1 million daily active users hitting DBs with TBs of data), the performance overhead of FKs and transactions is fairly minimal. Ad- hoc attempts to bring the same functionality almost always end up in a loss of referential integrity, corrupt/wrong data, lots of bug squashing, etc. Why waste all that dev time and introduce all those bugs when you can use battle tested approaches like FKs and transactions that can guarantee correctness, at only a small performance hit?

</comment></comment></comment><comment><USER23> I handle those at both DB and application layer. Integrity is ensured by the database, proper error messages and logging is handled at the application layer.

</comment><comment><USER24> Database triggers is a common tool to use in such cases

<comment><USER25> Provided your database system has triggers. Cloud Spanner, for example, does not.

</comment></comment><comment><USER26> If I'm in an environment where I'm using an RDBMS, then yeah, I mostly try to rely on the built in support for referential integrity that is supplied by the database. If there's a rule that's too complex to express that way, I would probably just write code (in Java, Groovy, Python, whatever I'm working with) to verify things.

</comment><comment><USER27> It's hard to answer without having enough context. Indexes, Transactions, and Triggers are three common choices, respectively. But don't forget complex data integrity requirements are also often a sign for bad design.

</comment><comment><USER28> You use functions and stored procedures to provide a controlled API over the table. All actions will go through those and that will have your logic to enforce the constraints.

<comment><USER12> right - except you can do this _outside_ the database also, in code. But there is something about the rigor/pain-level of writing the in-DB functions that tends to make them change less. It is equally possible with external code, but the mental modal has to create expectations for your environment.

</comment></comment><comment><USER29> I try to keep code out of my data where possible. No triggers, no constraints (excepting maybe PRIMARY KEY and NOT NULL). Despite otherwise being a nutter for type safety, I'll even favour TEXT over enums.

The main reason is change. As I evolve the code base, I might want to do something today which is principled, but seemed unprincipled yesterday. Database constraints have tended to hit me the hardest at the worst times too, e.g. being unable to make an emergency fix in prod. Or prod can't come up because the flyway script (which succeeded in test/stage) got snagged on a constraint when it ran on prod data.

<comment> le-mark _No triggers, no constraints (excepting maybe PRIMARY KEY and NOT NULL)_

Could you not then simply use a nosql solution?

<comment><USER30> Or you can have that logic at a back-end application level (assuming all clients are going through this one back-end to interact with the database).

</comment></comment></comment><comment><USER8> I keep as much logic out of the database as possible besides PKs/FKs etc.

I keep all of my logic in the application and only one "service" can write to related tables.

I also think that you should always write software as domain specific "microservices". Not necessarily out of process, separately released microservices, but the Domain Driven Design concept of "services" that can just as easily be part of a monolithic project with different modules or if necessary shared between teams via versioned modules.

It is so much easier to deploy, rollback, and version code than databases.

</comment><comment> rooam-dev Integrity checks during startup will slow down in time. Also, does it mean you have to restart the app often? Sounds bad to me.

Complex constraints sounds like an app/domain responsibility, much easier to test, version, troubleshoot, evolve.

When a solution cannot quickly and easily be tested, it impacts overall agility (small iterations become small waterfalls). Having complex constraints in database, could mean slower release cycles, processes (schema changes reviews, etc), more migrations.

</comment><comment><USER31> It's called database normalization.

</comment><comment><USER32> triggers.</comment>


Like a Dog - <AUTHOR> https://thenewinquiry.com/like-a-dog/ <comment><USER2> On the scale of dog people vs. cat people, I'm squarely in the cat camp. I don't mind dogs, but I see the "heroism" in this article as a form of codependence. Dogs are pretty much wired to be human companions; they thrive on human attention and will do almost anything to secure it. Accordingly -- unless you broadcast "I'm a horrid person" vibes in some wavelength they can detect -- a dog will love you almost by default; their love is what you'd expect nearly any dog will do to fulfill its needs.

Cats, by contrast, naturally can take or leave humans. They get some material benefit (ready access to warm dry shelter and effectively endless food) from living with humans, but can fend for themselves pretty well on their own without ever interacting with a human. So when a cat loves you, it _means something_. It means you've really put work into that relationship and seen it through to the end, and the cat has come to value you as more than a food and shelter provider but a source of emotional stability and comfort. One sign this has happened is when you find yourself unable to walk without nearly tripping over your feline pal, who inserts themself into your path lest you pass without petting or cuddling them.

I've noticed other cat people have similar views.

<comment><USER3> > It means you've really put work into that relationship and seen it through > to the end

Note: if you don't do this for your dog, you will have a terrible dog.

*I was 100% a cat person until I got dogs. Now the relationship I have with my dogs is 5x the relationship I've ever had with one of my cats. They require so much more trust, and return it in turn.

</comment></comment><comment><USER4> _[Considering dogs generally, Ackerley] "saw how amiable and well-mannered they were, in a way how sad, above all how nervous with their air of surreptitious guilt, and meeting the mild, worried brown eyes that often studied me and my friendly hand with doubt, I realized clearly, perhaps for the first time, what strained and anxious lives dogs must lead, so emotionally involved in the world of men, whose affections they strive endlessly to secure, whose authority they are expected unquestioningly to obey, and whose mind they can never do more than imperfectly reach and comprehend. Stupidly loved, stupidly hated, acquired without thought, reared and ruled without understanding, passed on or "put to sleep" without care, did they, I wondered, these descendants of creatures who, thousands of years ago in the primeval forests, laid siege to the heart of man, took him under their protection, tried to tame him, and failed—did they suffer from headaches?_"

This really touched my heart. Disclaimer: dog owner.</comment>


An overview of the top web hacking techniques of 2017 - <AUTHOR> https://portswigger.net/blog/top-10-web-hacking-techniques-of-2017 <comment><AUTHOR> I know this is a teensy bit on the late side - this is our first year after taking it over from WhiteHat. Anyway hopefully it's a valuable introduction to some new threats that everyone doing stuff related to websites should be aware of.

<comment><USER2> Some of these are vulnerabilities, some of these are techniques, some of these are general security topics.

The list doesn't really match up with the title.

The content, however, is worth sharing.

<comment><AUTHOR> Good to hear you like the content. Regarding the title, yeah it's a tricky one to name. Ultimately the top few are new techniques illustrated using vulnerabilities, and all the entries are evaluated through the lens of whether the underlying technique can be adapted and applied to other systems.

Admittedly, Cloudbleed is a bit of a weird one. But I like it for that.

</comment></comment></comment><comment><USER3> The blog version of regilero's HTTP smuggling is a really good read.

[http://regilero.github.io/security/english/2015/10/04/http_s...](http://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/)

</comment><comment><USER4> I've read the first of the list (#10), and I'm skeptical this "top web technique" has ever been used in the wild.

The blog post starts with a few obvious errors. OPcache is parts of PHP since [PHP 5.5]([http://php.net/manual/en/opcache.installation.php](http://php.net/manual/en/opcache.installation.php)), not PHP7. And "PHP7 by Rasmus Lerdof" is almost a joke: he was certainly not a top contributor to this iteration. These errors are not important _per se_, but they point to an overall lack of quality, and suggest no one reviewed before publication.

The article is not very clear about the vectors one needs to attack. Here is the list:

1\. A non-standard configuration that enables file cache in OPcache. Very improbable.

2\. An access to the result of phpinfo() which gives many sensible details about the PHP instance.

3\. A security breach allowing the attacker to upload files into the cache path without restriction on the file name.

4\. The URL to a PHP file that received no HTTP query since the PHP server started. The alternative is a configuration that disables in-memory caching in OPcache, but that would be far too contrived.

When the server has all these vulnerabilities but uses write-protected PHP files, then you can hack OPcache for remote code execution.

<comment><AUTHOR> If you want to write off the entire post by looking at a single entry, I can see why you'd pick #10 which is the lowest ranked one.

It's clearly not as widespread as Tickettrick or as proven as Advanced Flash Vulnerabilities, which is why it's ranked lower. But it's a neat trick which I suspect is likely to be applicable to similar technologies in the future.

</comment></comment><comment><USER5> Much of the scariest XSS (aka, most difficult to prevent) comes from the DOM these days.

Edge, FF and Chrome don't follow the spec as well as they should, and the result is a lot of minor browser incompatibilities that are very hard to detect and fix.

Each browser is making modifications to the DOM spec, many of whom make introducing XSS and XSRF into a web app very easy.

Deep DOM and JS knowledge is a must have for pen testers these days.

<comment><USER6> What's an example of a modification to DOM spec that introduces vulnerabilities? I'm not sure I'm familiar with any.

<comment><USER5> in MS Edge

document.cookie = 'secret=123'; const parser = new DOMParser(); const html = parser.parseFromString('', 'text/html'); console.log(html.cookie);

prints secret=123 because of an improperly implemented inheritance model. other browsers do NOT inherit cookies from main document as a result of following the spec closer</comment></comment></comment>


Ask HN: Small teams, how do work from home? - <AUTHOR> I would like to know how start-up and small teams suddenly moved to work-from-home model. Did you completely change anything on your stack, or started using an entirely different stack? How efficiently are you working, and what problems are you facing with the change?
For me it had always been:
1. Mail-in-a-box for internal & customer support email. 2. Gogs fot git. 3. RocketChat for team communication. 4. NextCloud for files sharing. 5. LastPass for password management. 6. DigitalOcean for DNS and hosting needs.
When we started working from home, we introduced Taiga for project management, BookStack for internal documentation, and Collabora app on NextCloud for document editing.
Things haven't changed much, but it feels like there's a lot to manage, including the servers, authentication, onboarding, offboarding, etc.
I prefer to self-host everything I can, partly because of the horrible things that happened to startup founders who suddenly lost their accounts on Google, GitHub and alike. <comment><USER2> I think it helps to schedule meetings to socialize. There's a lot of informal bonding that happens in an office that gets lost when being home.

</comment><comment><USER3> We ramped up remote work before the pandemic to expose inefficiencies in communication and improve the lives of our colleagues who commute through an unreliable public transportation system. We figured we'd have to do it, so we might as well make learn how to.

Our hypotheses was that cumulative fatigue with respect to days of the week was non-linear, and removing a couple of days to work remotely would _reset_ us and improve recovery. We experimented with the first day of the week remotely. We thought it would be a nice transition, as people would spend the week-end, work remotely the first day of the week, then work at the office the following days.

We noticed improvements in morale and energy levels. We also experimented with working remotely the whole week to learn what the bottlenecks were.

This lead us to improve our technical writing and information dissemination: use helpful templatse to write clear issues that allow everyone to understand and be on the same page asynchronously, and everyone had access to these issues and knew where we were at.

We haven't changed our stack: we use GitLab for repository management and issue tracking, Slack for messaging.

One addition is Jitsi for video calls, but we're not using it more than before the pandemic. I'll die on that hill. There's work to be done, and nobody messes with the flow of people. We aggressively keep that under control not to disturb colleagues. We amortize that by taking notes and dispatching them, and by recording the videos for others to view ad libitum. Ideally, I want to have colleagues request a Jitsi session just to chat a bit and have a friendly conversation.

The feedback is that colleagues say they now have long stretches of time to focus. They say that they miss the interactions. I'd rather have people say they miss the interactions on a call (i.e: demand), than having to take a low entropy call.

One thing we've been doing from the beginning, before the pandemic, is get our colleagues' feedback: how are you feeling? How is working the first day remotely going for you? What do you like, what don't you like? How was working for one week remotely for you?

After the pandemic: How are you today? Are you okay? What do you have trouble with? How can we help?

These questions were important to correct course. Everyone has a different situations. Some people have less space than others, some don't have a dedicated space for work, some struggle with interruptions, and others find it hard to focus. It was important to talk these things through, encourage people, make it clear that it is an adaptation period and that everyone will find their rythm.

It was also necessary to set expectations: I returned from Paris in late January and it was clear that it was only a matter of days before cases would pop up. We made the decision to start working remotely when the case count was 17. These cases were concentrated in a city where two colleagues lived, and they took the train to come in. It was an unacceptable risk and we made the decision to eliminate that risk until we knew more about the virus.

Personally, I set my timeline in February that this whole thing would last at the very least one year. Having a "one year" timeline helps completely ignore press releases and government agencies roller-coaster expectation management, and helps setting colleagues expectation: we're in this for the long run, make your arrangements. This allows them, for example, to relocate to some other place and be with their family, which they cannot do if they don't know if they're going to be called in a week later. This also helps with finances so they can make the decision not to renew a lease, for example.

We also make a clear committment that the safety of our colleagues is very important, and as long as this is not sorted out, we'll continue to work as we are. Some colleagues were worried as their friends who worked at other companies were called back after the government started pushing for "reopening", and the point that this wasn't going to happen was important to make.

I recently switched to OBS Studio for screen-recording. I used Kazam before to record screens for presentations, but its audio stopped working on Ubuntu 20.04. I applied a patch I found on their bug tracker (replace time.clock() with time.perf_counter()) and it got the sound to work, but it has an issue when the sink is a Bluetooth headset.

Happy to answer more questions, as it is working for us very well and we're actually working better now.</comment>