midnightmonster

I've used Freshbooks for invoicing for years, and I've switched between their time tracker and other services/apps repeatedly.

Switched to timely first of August, and I'm still happily using it even though it increases my pain significantly a couple times a month when I have to invoice things--timely is just that much better for scheduling and tracking that it's easily worth it for me.

While I'm here, I would love if the web app had a multi-week view so I could plan a month more easily and drag tasks between days over larger spans.

This was a great story to read, and the ending hit me like a surprise twist, so much the better for being a real event. Thanks for sharing it.

I am not anything close to a lawyer, but years ago as a web designer I had a startup client who got in trouble for soliciting the general public for investment. Your bit about looking for funding is more vague than theirs was, and I think investment laws have even changed a bit since then, but might be something to ask a lawyer about.

Kristi, what are you actually saving to the vault when I use PayPal? I know you present the merchant with a token, but how is it accomplished? Has PayPal had a charge-whenever token capability before that was not widely understood, or are you actually saving the customer's paypal email and password so you can charge arbitrary transactions in the future?

I skimmed 96 comments looking for anyone to say, "You know, this is pretty offensive and/or wrong." I found only two posts comprising one sarcastic attempt at pointing that direction.

No one's making the argument that porn's good, but a lot of people either genuinely assume so or want to signal that they're really pragmatic and modern and liberal. (If you think everyone's just bracketing the moral questions and that it's appropriate to do so, ask yourself how well a post on successfully marketing on white supremacist websites would fare.)

I'm not going to make an actual case that porn is evil either: it's clear we'd have to do a lot of work on finding common philosophical ground first, and I don't have the time. But in the face of apparently-overwhelming social acceptance of evil, it's better if someone says, "Hey, everybody, this is wrong," even if they can't convince people of it at the moment. Since I can't find much to upvote here, I'll be that guy:

Pornography is evil in concept and in practice. Building your business through it is considerably worse than, e.g., using huge email spam networks. It beggars belief that--in a community that can at least entertain the idea that it might be wrong to create a business by exploiting people's lizard brains with notifications, gamification, and misleading social ads--ninety-eight percent of comments on using porn to promote your business either avoid considering morality at all or go out of the way to indicate that everything's a-ok here.

I would be curious if the event or the organizer had any connection to the venue. It wouldn't keep me from going, and it might make me notice it more just for the unexpected juxtaposition.

I upvoted at first because Kris is a friend and it looked good. Then I watched the video and:

1) This looks great

2) It's a fantastic demo video

Is the automatic local connection app thing going to work if I'm behind a NAT? Any plans to make the desktop app work on Windows or Linux?

Furthermore, I've been trying to get them to sell me a commercial license for months. Someone sometimes emails me back, but they have yet to give me a way to give them money.

I used a lot of systems. AFAIK, they all give some way for you to set your own transaction ID, and they all provide you with a gateway transaction ID, too. A good system will have a backend process to reconcile records based on one of these and would of course flag anything where the dollars don't match. This is the (inadequately explained) basis of my contention that the price editing is not a big deal. Of course, it could be a big deal if they botched a lot of other things, but by itself it doesn't mean there's an actual serious problem.

Actual approaches I've seen:

* Trust the submitted data. Sadly, very popular. Of things I've seen lately, Authorize.Net's new Direct Post Method does this, as does the Prolific gateway.

* Have the merchant optionally crypto-sign all the interesting-to-manipulate parts and submit the signature along with. Braintree's old API worked this way, not sure about the current. USAePay does this, but they don't let you sign all the important fields.

* Stripe has your form submit to you, but they use JavaScript to submit the card details to them first and replace them in your form with a customer ID which you charge as you like.

* PayPal Express Checkout (but not any of their other checkout methods) uses the method you suggest. Although of course with them you leave the merchant's site to complete your payment. I suspect the reason it's not used more is that it requires the gateway to maintain some state that they wouldn't otherwise have to, and it involves an extra server round trip versus signing the submission.

I meant not so big a deal as transmitting the card data in the clear, and not that hard to fix, and possibly not even indicative of developer incompetence if they knew about this issue (which may be a limitation of the gateway the merchant insisted they use) and apprised their client.

Yes, it's bad for people to be able to change the prices on what they're buying, and potentially it's a very big deal if there's no reasonably attentive humans involved anywhere else in your process. (If I got a $10,000 order, I'd double check that everything was golden in my gateway before I popped the cork on my champagne.)

The worst case for this is someone with a stolen credit card purchasing big ticket items for a small enough amount that it doesn't trip any alarms. You'd be a fool to do this with your own card.

Ahhhhhh... Someone is wrong on the Internet!

The card thing is really No Big Deal. It's actually a pretty smart integration with one shortcoming.

Whatever gateway they're using has some support for you maintaining control of the checkout experience while not actually receiving or transmitting card data--a great thing for PCI compliance. So the form is on an HTTPS page on the merchant's site, but instead of posting to the merchant's app, it posts directly to the gateway. The gateway communicates status with the merchant via a synchronous HTTP request or signed data in a redirect URL, and the merchant's software processes the transaction without ever seeing card data.

As the OP says, "they're using HTTPS"--yes, this makes all the difference. The only reason the info appears to be clear text to him is that he's using Tamper Data, a browser extension that lets you play with your own POST data before you send it over HTTP(S).

This is the Right Way to do it for a site that doesn't get some compelling advantage out of building the infrastructure necessary to be PCI compliant. Done this way, PCI compliance requires just the trivial SAQ A. The only problem with this is that either the gateway does not support (sadly, the most common case) or the developer did not implement signing the transaction details on the merchant side.

HTTP header is code for "POST data".

The way I figure it is, if it consistently clears $100/month more than the value of the time you put into it each month, hey, you've got a new macbook every year.

I've been looking for a good reason to use twilio for years now. Will the latest developer contest with this new API http://www.twilio.com/contests/2011/07/new-developer-contest... be enough to get me to look harder? I think it may.

I'm an independent web software developer. I work for various clients on an hourly or per-project basis. The highest rate I charge is 50% higher than the lowest rate I charge. If I had an agent that could keep me busy with the higher rate jobs--increasing my average hourly rate and giving me more hours to work because I'd spend less time chasing down gigs--I'd be more than happy to pay him/her 10%.

That's a technique that Braintree has popularized if not pioneered, but it's a neat trick that most people agree is PCI compliant (I also hope and believe this), not a change in the security standards.

Among others, USAePay has also made this possible for some years (not as well as braintree does), and the payment startup stripe http://stripe.com/ achieves the same result in a more JavaScript-y way.

It is getting more popular, though, I suppose.

Perhaps even more important, they have a list of hundreds (thousands?) of pages I thought were interesting enough to read later. Seems like a fine base from which to build or enhance profiles of thousands of citizens.

Really excited about Dungeon Adventure. Going to have to sort out how to make it run well with multiple children controlling the heroes. Mostly, how not to be biased in dealing out monster attacks to the heroes. Possible monster 'strategy': attack whoever just attacked you. If you weren't attacked, attack whoever dealt the most damage to your monster buddies in the last roll. For when the monsters have initiative, make the order of the heroes walking through the dungeon significant--whoever's in the lead gets attacked first, giving them the opportunity to collectively decide to put the healthiest guy in the front, or let one person keep the protection ring in exchange for always taking the lead, or put the weakest in front to watch him die (or trade him out for a new hero) or whatever.

Nginx can have workers, but the default number is one. nginx doesn't need a separate worker per time to handle each request. Anything that happens on a given connection is an event (connected, received some data, finished receiving data, got a response from the backend, closed the connection), and nginx just responds to events in the order received across all connections. It doesn't have to hang out and wait for the client to finish sending it's request, doesn't have to wait for PHP to process the request, just goes about handling the next event until those time-consuming things finish.

If you've looked at using PHP with nginx, you might be thinking of the fastcgi workers. Rather than including PHP in the web server process, fastcgi keeps a pool of PHP processes around, and whenever you get a PHP request, nginx passes it off to the fastcgi backend (then goes about other business until the backend responds). I don't know of any reason that PHP run this way should be faster than as an apache module, but the whole system ends up faster because the web server part is using a lot less memory and CPU. And depending on your site, there are some really low hanging optimizations you can do with nginx. E.g., just need a couple of configuration lines to cache all PHP GET requests for 5 min (unless you have cookie X, if you want). Since nginx seriously will not bat an eye over serving a redditing worth of static files, that means even your unoptimized word press site can stand up to the front page no problem. (Not verified from actually attempting it. But I did setup a simple PHP site on a 512 Linode that served 250k page views per day without excessive disk activity or the CPU usage crossing 10%.)

I'm seeing anti-euthanasia in the article for sure, and certainly some anti-abortion arguments spring to my mind when reading, but I don't see the article actually making any of them. It's discussing only post-birth ethics.

  > with Prefork and mod_php, every time someone was 
  > connecting I was spinning up a new Apache thread and a 
  > new PHP VM every single time (please correct this if 
  > wrong... this is how I understood it).

Since no one has yet... no, this isn't quite right. Apache in prefork mode maintains a pool of workers, each of which does contain essentially the full webserver and PHP system. These listen for requests and respond to 1 request per process per time. Once a process finishes responding to a request, it starts listening for a new one again. Apache tries to keep at least a few idle processes on hand all the time, so clients don't have to wait, and it will fork new processes to handle more simultaneous connections up to a configured limit. If you get a sudden spike in traffic which then dies down, Apache will start killing excess processes. Processes live until killed as unnecessary, or after serving N requests as configured.

That all sounds pretty reasonable, until you realize that every request, even for styleseets, scripts, images, favicon.ico or robots.txt, is served by one of those fat apache+php processes, which can easily reach 10MB of memory usage each (or a lot more sometimes, depending on your modules). And if Keep-Alive is enabled, or a client is a bit slow, or some part of the Internet gets dodgy, a process can get tied up for a long time, requiring Apache to start more, increasing your memory usage and leading to thrashing and/or hitting the max child processes limit.

Default max is 256 child processes, so easily enough to cause disk thrashing on a 1GB machine, and not enough to fully utilize a much larger machine.

We had cobra through my wife's former job. As others have noted, you can get cobra even if quit on your own.

Thankfully, the old job was in Maryland, where state law requires insurance companies to offer a continuation policy after cobra expires. It continues as long as you want it and make your payments, and they have offer you a similar policy in the state you move to if you leave Maryland.

We pay almost $1000/month for my wife and the kids to be covered. I have no health insurance at all. Because the policy is in my wife's name, it doesn't qualify as a sole proprietor business expense. (If it were in my name, it would count as a business expense as of 2010, even though it's not bought through the business.)

Because of preexisting conditions, we can only get private insurance that excludes most of the things likely to go wrong with my wife and kids. We're now in Florida where the state offers an HMO for children in low income families, but you can buy into it at full price if you don't qualify income-wise. Since the pricing is per-child not per-family, and our fourth is due in June, and we don't qualify for the discounts, the HMO isn't a useful option for us right now. (The 'and children' part of our current insurance is a comparatively small expense.)

For whimsy that doesn't waste my time, my favorite recent example is when I ordered a giant gummy bear on a stick for my brother for Christmas (we have a candy gag gift tradition).

It was shipped in a box in a box, of course, and the outer box was padded with packing peanuts. When I opened the outer box, at the very top in the middle was one of those rubber monster finger tip puppets with the wiggly arms--chewing on a packing peanut. Made my day. If they were really smart, he'd have been chewing on something wit the company name on it, which I think would increase the chance that I would remember it now.

Maybe it was just the class I took, but I took macro and wished from the first day and ever after that I had taken micro. I felt like one class of micro might have gotten me some information I could actually use in business, whereas one class of macro was far from enough to get a handle on current events or monetary policy.

I agree, and yet I hesitate. People who have taken one or two philosophy classes are often insufferable and not least to themselves (or so I suspect). E.g., there's no broadly accepted 'answer' in epistemology (can we know things? What does it mean to say we know something?), and in an intro class you're only likely to be introduced to the problem and a few of the historically popular responses. These may lead you to conclude that philosophy is a lot of sound and bespectacled fury, signifying nothing or else that your newfound cynicism about knowledge constitutes an important superiority over naive mortals.

Epistemology is just one example. Whatever tickles your brain in an introduction to philosophy--whether arousing your curiosity, 'clicking' with something long felt, or leading you almost to despair--you should treat as a diagnosis. Valuable information, no doubt, but almost worthless to you unless you go on to seek treatment, that is, to study it further.

Writing! Programmers need to be able to make themselves understood by other humans. You need grammar, style, structure, and lots and lots of practice. If you confess to your advisor or an English faculty member that you're not terribly interested in literature, but you want to do what it takes to become an effective non-fiction writer and communicator, they can probably point you in the right direction.

(And if your school should happen to offer a rhetoric class, take it/them.)

Bought for kindle. Resonates so far, but doesn't seem to have any intention of telling me how to apply it's wisdom to my actual problems.

I've gone without shampoo for many months now, maybe a year. I keep my hair very short anyway, so it doesn't matter very much. It hadn't even occurred to me to try going without soap. I could probably see it working fine now that I think about it.

Atwood recommends only browsing 'anonymously' when on public, unencrypted networks, but that's a lot harder than it sounds. A facebook 'like' widget (even if you don't click it) on the news site you're using anonymously can be enough to get your Facebook info sent over the network.