Meet the Company Hijacking New York Times Ad Revenue - <AUTHOR> http://www.theatlanticwire.com/technology/2012/10/meet-company-hijacking-new-york-times-ad-revenue/58147/

<comment><USER2> Obviously the NY Times is not happy with its ads being replaced by someone.

However, in my opinion this would be acceptable if it were the intention of the user. I hold the point of view that it is entirely my decision how to display websites on my devices. For example, it is up to me whether I display ads, run Javascript, or Flash. Similarly it would be okay if I decided to install a program that replaced ads on popular websites by different ones.

But it seems obvious to me that the users installing this software have no clue what they are doing, and are in fact essentially installing hidden malware. And _this_ should be the way this problem is attacked and dealt with. Not via some perceived moral rights by websites to not have their ads replaced, but simply by the fact that this company is essentially installing malware without consent. This is what should be criminally prosecuted in my opinion.

<comment><USER3> >This is what should be criminally prosecuted in my opinion.

It seems to me all the talk of laws is rather pointless. If the NY Times can detect that this is happening then they can refuse to serve pages to clients that do it, and instead give them instructions on how to remove the malware. That solves the problem for everybody. The user takes a minute to follow the instructions to clean their machine of malware, then continues on to read the article.

Why does everything need a legal solution?

(And yes, Malware Corp. can try to sue you for telling people to remove their crapware, but anybody can sue anybody for anything. Doesn't mean they'll win.)

<comment><USER4> Why should the NYTimes have to spend their resources and lose their revenue to educate and support people removing that software? That's an expensive cat and mouse game that they shouldn't be forced to play.

<comment><USER3> Better that they should have to spend the same money in additional taxes to support government investigations and prosecutions, only to have the bad guys move offshore and keep at it?

I think you're perhaps overestimating the cost of banning such things too. For one thing, there is no reason to go it alone. Major ad networks should be providing websites with tools to identify and disinfect affected clients. Then the cost to the NY Times et al would be little more than installing the supplied tools on their servers.

In addition, there is a certain amount of "starve them and they die" that needs to happen here. If something is illegal but still profitable, it continues to happen. On the other hand, if it becomes unprofitable because no websites will service infected clients then it disappears even if it's still legal.

<comment><USER4> The cost isn't in implementing the detection or writing a nice notice, it's in _supporting_ the people it's for. Removal can be hard, look at Sony's bs with rootkits the other year.

Aside from that websites are a terrible way to fix a problem, there's probably still a massive amount of the internet 'best viewed in X' even though standards and non-IE browsers have been popularized for _years_. It's taken like a decade of campaigning, education and updates to reduce IE6 to insignificance.

Browser / operating system vendors are in a good position to tackle it and there's precedence for that too, but a single website even as big as the NYTimes is in a weak position to do anything except sue.

<comment><USER3> You don't literally have to have every website on board. You just need a critical mass such that any given malware-infected user will encounter a website that they consider important but that they can't access, and therefore have an incentive to take steps to remove the malware. That goes a long way to deprive the malware authors of infected users, even if there continue to be some websites that don't block the malware.

And as for browser and OS vendors, it seems like there is a clear way for the Times to push that along: If this problem is nontrivially impacting ad revenue then Google has a clear incentive to work with them on Chrome and Android, and with that as leverage, they can go to other browser and OS vendors and say "take the same measures to keep your users from coming to our website infected with this crap or we'll be recommending that they use Google's products instead."

</comment></comment></comment></comment></comment></comment><comment><USER5> I remember the day I figured out a Chrome plugin I regularly used was doing this. It was a Gmail notifier that had been widely used when I started using it. And after a while, I was getting the most annoying ads on YouTube without realizing that Google hadn't changed anything.

Rather, the plugin changed and added the ads to YouTube. It was so under-the- radar that I wouldn't have noticed unless I had decided one day to look up why YouTube was allowing allowing ads with sound to play over videos.

I'm a savvy user, but that was literally slipped under my nose. I think a lot of users that wouldn't have been nailed by such plugins in the past are starting to find them to be a huge problem.

<comment><USER6> Well, the official YouTube ads are rather invasive and awful as well...

</comment></comment><comment><USER7> The New York Times could probably commission a Sambreel detector for less money than it's losing to these scumbags. You have a right to the screen real estate in your own browser, of course, but the NYT has the right not to serve you content if you're not going to abide by its terms.

Whatever you think about the ethics of ad blocking (not a quagmire I want to wade into), NYT ads fund one of the best regarded operations in all of journalism, while Sambreel ads fund... what, exactly? Let's not lose sight of what a scam this is.

<comment><USER8> If a user knowingly choses to install a plugin that includes Sambreel, it's not a scam. It's their browser to do with what they will. Having said that, I'm guessing that there are a lot of scummy plugins/extensions that don't alert the user to Sambreel being installed. _That's_ what's the scam here.

Also, the target of the funding shouldn't enter into a discussion about legality/ethics of the method.

<comment><USER7> The NYT is entitled to set terms that forbid the viewing of their site with Sambreel installed.

</comment></comment></comment><comment><USER9> This sort of ad replacement is one of the ways Kim Dotcom intends to keep himself in his mansion: <http://news.ycombinator.com/item?id=4576834>

</comment><comment><USER10> A social media professional (relatively computer savvy) I know came to me recently thinking the Facebook page she managed had banner ads on it. I quickly found she had a browser extension adding it (don't remember if it's one this company created).

This company is parasitic, not adding value for anyone, the publisher or user. Despite the complaints about the Chrome store becoming more of a walled garden, perhaps it would help situations like this.

<comment><USER11> You hit the nail on the head, the walled garden isn't about malware, it's about killing ad replacement and the adwords revenue it kills.

</comment></comment><comment><USER12> I'm surprised we haven't seen more of this. I fully expect companies like refer.ly and skimlinks.com to implement this model with a twist: share the revenue with customers.

Customers could install the extension/plugin and browse sites as normal. However the ads they see would be earning them cash.

<comment><USER13> Yeah that was tried over 10 years ago with AllAdvantage.

<http://en.wikipedia.org/wiki/AllAdvantage>

</comment></comment><comment><USER14> I own my browser. I may choose to replace all ads on content I consume with poetry, or white space.

We need to be careful here. Simply because an ad-centric revenue model grew up around web content doesn't mean it is written in stone.

<comment><USER15> I'm not sure if I can agree with this. While I do understand where you're coming from I'm hesitant to say its okay to willfully replace ads on web pages. That's a point I don't have very strong opinions on but I do strongly believe that plugins like the one in question are unquestionably unethical and not okay.

You do own your browser but you don't own the sites you visit or their content. To me when someone argues for being able to replace ads on a website that's almost the equivalent of saying "I am entitled to take ownership of and alter anything I lay my eyes on". Some people counter by arguing that if it's not alright to replace ads then it's not okay to use custom CSS rules or plugins or apps designed to enhance readability. The fundamental difference between those things is that site owners want you to read their content and almost universally happily accept people using custom CSS and readability type plugins but replacing ads is different in that you are making a choice to put someone else's content on their site to the site owmer's detriment. If I were running a site that relied on ad revenue I'd almost prefer plugins that stripped out the ads altogether to one's that replace ads with one's that someone else will profit from. In the case of the former you could reasonably assume the visitor wouldn't be clicking any ads anyway but in the case of the latter that user may still click and youd get nothing.

Imagine there was an eyeglass company that sold glasses that would replace certain things you saw with other things that they decided on. I know this is far out but just follow me here. Now imagine owners of these glasses walk into a mall and the glasses replaced window signage and ads with ones from the eyeglass maker's preferred partners. The shop owners in the mall would be upset but the maker of the eyeglasses would claim they're just giving their customers the deals they want. And then a certain portion of the people who wear these glasses say "I own my eyes. I may choose to replace anything I see with whatever I want".

In 1996 I was 10 years old and grew up from that point on with the web. Ads were annoying for a time but the people posting and creating them learned really fast that their strategy wasn't working and from then on ads have been pretty polite. They mostly just sit in their grid positions. Sometimes they're animated and sometimes they have sound but it's off by default. I don't get why people hate online ads so much. They're easy to ignore and rarely if ever become intrusive these days. But that's a whole 'neither topic. My main point is that suppressing ads is one thing but to replace ads with others that deprive a site from the CPC revenue is unequivocally wrong. It may be legal but it's wrong.

<comment><USER6> The site is welcome to have a login system with a terms of use agreement, or to use quizzes to verify ad exposures, etc, if they so chose.

<comment><USER15> But this isn't about exposure or impressions. This is outright stealing. There's a certain portion of users who will never click an ad and blocking them out completely is really no loss. But what's happening here is that ads are still displayed and in the event a person clicks the ad the revenue goes to someone else. The visitor didn't come for the ads, they came for the content. So the plugin maker is basically a leech. Replacing another site's ads with your own and taking the revenue is theft and if it happened to you I'm not sure you'd feel the same way. You know damn well your suggestion is totally unrealistic but it totally misses the point anyway.

</comment></comment></comment></comment><comment><USER16> I have to say I have more of a problem with the advertising exchange that is allowing this to happen than the "adware" company itself. Rubicon has to not only represent the campaign buyers interests but also maintain publisher brand safety to sustain a business model. It's just a matter of time before real publishers will inevitably leave Rubicon if they continue to disregard this fact.

</comment><comment><USER17> What a coincidence... I removed this junk yesterday from my fathers computer. In this case, it inserts ads on top of Google search results and shows options to search using yahoo search among the other junk. Very annoying.

</comment><comment><USER18> > _At first glance, it seems unlikely that Sambreel is pervasive enough to > affect the ad industry. After all, how many people are going to download > junky browser plug-ins? On the other hand, Sambreel's reported use of > underhanded tactics could mean it is indeed widespread._

The pervasiveness of hijacking plug-ins is depressing. I lent my roommate my top-of-the-line MBP from 2008 and within a couple of months it was filled with bizarre homepage hijacking plugins. A few days ago I got a hijacked DM-tweet from a top investigative journalist. I wonder if general computer literacy and best practices will ever outpace spammers' ability to infect computers?

<comment><USER19> Why is it even possible to install these plugins in the first place? Shouldn't they be blacklisted?

<comment><USER20> Some folks are using general purpose computing devices to access the web.

<comment><USER19> I'm aware of that. I meant that Chrome should be blacklisting these plugins so that they cannot be installed, even manually.

<comment><USER21> Blacklists are a constant game of whack-a-mole. Anything you add to the blacklist will be replaced by 10 more variants.

Whitelisting would be a more reliable solution. It has snuck into consumer computing under a different name: app stores.

<comment><USER22> Interestingly, this is what Crome has done. The app store used to be a distribution point, but as of recent versions of Chrome it's become an exclusive source of extensions for exactly this reason. (There are fortunately ways around it, but it does minimize the threat of malware).

</comment></comment></comment></comment></comment></comment><comment><USER23> What's amusing to me is that you can build something like this with 100 lines of JavaScript and a bit of Rails scaffolding (I know because I've done it).

</comment><comment><USER24> Is this new? Advice : Read all user reviews when downloading addons / plugins or any software.

<comment><USER25> astroturfing & paid reviews.

</comment></comment><comment><USER26> Curious. Doesn't bode well for the Kim Dotcom's MEGA project.</comment>


Why I study computer science - <AUTHOR> http://lindseykuper.livejournal.com/397458.html

<comment><USER2> What an insightful post.

Here is my own list. (May be subject to editing.)

Why I do Software Development:

* The problems are challenging and are interesting (fun)

* I have the ability to make real difference</comment>


"Steve Jobs wouldn't have done that." - <AUTHOR> http://svbtle.paulmckellar.com/steve-jobs-wouldnt-have-done-that

<comment><USER2> I'm not worried yet. But when people start saying, "What would Steve do?", then I'll be worried.</comment>


Be More Arrogant. - <AUTHOR> http://posts.richoakley.com/post/be-more-arrogant.

<comment><USER2> I think I disagree strongly with the posit here. If you can make a world- changing innovation on the scale of the aeroplane, great, more power to you; there's no need to be a dickwad about it, blundering around with a "fuck you" attitude.

Also, is twitter really a world-changing innovation?

<comment><USER3> No. It's a forum with a gimmick that happens to work well on mobile (short posts).

And I agree with you... if you make a world-changing innovation, you won't need arrogance. Arrogance is just an insistence that the world is too stupid to recognize your genius, when the work can't speak for itself.

</comment></comment><comment><USER4> I think the word he's looking for is "confidence"

But I do agree Twitter is world changing. Anything that a substantial subset of the population actively engages with can't help but change the world.</comment>


Instant Websites for Nonprofits | Bellstrike - <AUTHOR> http://bellstrike.com/ <comment><USER2> According to the main page, Bellstrike will receive 9.5% of the total amount that people donate through the site. The TOS does, however, list a different commission; "As the sole consideration for Zekten's provision of the Service, each Client Nonprofit agrees to pay Zekten a transaction fee of 6% for each donation made to the Client Nonprofit using the Service, with a minimum transaction fee of $1.50."

Which one is it?

<comment><USER3> Hi, I'm the founder of Bellstrike. The actual fee is 9.5% with no minimum transaction. We include the credit card transaction fees (WePay charges 3.5%) in the 9.5% fee. We originally were going to separate the two fees out but decided to include everything in one fee. Thanks for pointing out the type - we thought that had been corrected. We'll make the change.

</comment></comment><comment><USER4> Beautiful design.

What was the thought process behind choosing a commission-based business model over a flat monthly subscription?

Are you sure that business model is going to be profitable, and (perhaps more importantly) not negatively affect your clients' conversion rate? I know if I was going to make a sizeable donation and saw that 10% of it was being eaten up in fees I'd be calling around see if I could mail in a check.

Edit: Also, have you looked into getting a referral fee when people sign up for an account with wepay?

<comment><USER3> Well, to be honest, no we don't know if it'll be profitable yet. Mostly because we just launched and don't have enough data. We very well may introduce a monthly fee that allows nonprofits to only pay the percentag (3.5%) transaction costs that WePay charges. We're certainly not into taking advantage of nonprofits. Most nonprofits have under $25,000/year in revenue. If you make $12,000/year in revenue, it's hard to even justify paying $15 or $30 per month for something that you don't know if it works. We think with this model it will hopefully reduce the barriers to entry for small nonprofits so that they can get online quickly and easily and actually accept online donations. The majority of nonprofit websites don't even have an online giving option.

Also, if we do get a sizable number of nonprofits on the system, there are other services that we'd like to offer to them down the road for an affordable price (like $5 - $15/month). That may be a donor management database that's easy to use and stripped down for small nonprofits, a stripped down email marketing service, etc.

We looked into referral fees from WePay but they don't offer that for apps that use their API. That's really fine for us though. We kind of like the fact that we aren't telling nonprofits to use WePay with an ulterior motive of us making a little extra money. We use WePay because it is bar none the best marketplace payment processor that we know of... and that's with them having just released their marketplace API about a month ago.

</comment></comment><comment><USER5> I ran into this on HN randomly the other day when I looked up the wrong user and saw this in a user's profile. The whole site, introductory video, tours, etc. are so tight! Amazing job, guys. Best of luck!

</comment><comment><USER6> What features or services differentiate Bellstrike (9.5%) from WePay Giving (3.5%) or First Giving (7.5%)?

<comment><USER3> We actually provide a full, branded website for nonprofits. Most everything is baked in for them - blog, automatic receipts for donations, etc. WePay is a great service but they don't provide websites - they handle transactions. We use do use WePay's API to handle the transactions on the nonprofits' websites.

First Giving is a great service as well but if I understand their model correctly, it is more of a fundraising page for an individual to raise money for a nonprofit.

</comment></comment><comment><USER7> Congrats to the Bellstrike team. Looks great, feels great, never lets you down.

</comment><comment><USER8> This looks really great!

A couple questions:

\- What language/framework do you guys use?

\- How secure are the transactions?

\- What do you guys use for transactional emails (welcome, password recovery, donation receipts, etc)

I'm the Product Manager of PostageApp (<http://postageapp.com>) and I'd love to give you a hand with transactional emails, if you are so inclined! Let me know, keep up the awesome work!

<comment><USER3> Thanks! To answer your questions:

1) Rails 2) WePay handles our transactions so they're secure - we use their new API. We highly recommend them. You can learn more about their security here: <https://www.wepay.com/about/security> 3) We actually already use Postmark. That being said, we'll check out PostageApp too :)

<comment><USER8> Neat! Thanks for answering. Definitely something I'm going to pass along to a few friends who are in this space or are constantly starting something. :)

As for the mail, no worries! Let me know if you have any questions about us, or if you just want a bit of feedback regarding your transactional designs and copy.

Cheers!

</comment></comment></comment><comment><USER9> The most effective charities spend around 10% of donations on all administrative costs and another 10% on fundraising. The current 9.5% fee for this "service" seems excessive.

</comment><comment><USER10> This is really a fresh breath of air. The current state of art in this industry is <http://www.convio.com/>

Good Luck Guys!

<comment><USER3> Thanks so much.

</comment></comment><comment><USER11> Answer "Sure" to "Can I use my own web address?" is a bit misleading. The correct answer would be "No you can't."

<comment><USER3> Maybe we should reword that.

The thinking behind that is that the really small nonprofits that we work with are generally relieved to find out that they can still use their domain name on their business cards and brochures and email and just forward the domain to their Bellstrike subdomain.

As a general rule most small nonprofits aren't techies, don't know the difference between hosting and a domain name and don't know what a 301 redirect is or that it's even possible. That being said, we'll certainly talk about rewording that so that it's clearer for the tech oriented audience and doesn't seem misleading. That's a pretty easy change :)

We do plan on offering a domain masking service like Flavors.me, Carbonmade, etc. where they won't have the need to do a 301 redirect.

Thanks for the feedback. We just launched today so we're glad to hear your thoughts so we can make corrections.

<comment><USER11> Plus the search engines won't index their domain, and if in some case they had to move away from your service (I don't say they should, as the service seems to be rather cool) then they would loose their presence in search engines. This is a kind of tradeoff they should be aware of in the first step.

Ability to have custom domain name will solve this problem.

</comment></comment></comment><comment><USER12> an audible bell strike when I pull the bell would be cool :)

<comment><USER3> We've thought about that. Didn't know if it'd be annoying.

<comment><USER12> 1\. you wouldn't want it too loud. just a hint is fine

2\. it only sounds when the user pulls the rope, so it's fully within the user's control</comment></comment></comment>


Slack just wiped out our data overnight - <AUTHOR> https://medium.com/@mohsen/slack-just-wiped-out-our-data-3aef1f6b978d <comment><USER2> > If Slack has to comply with the export control law, they also need to comply > with GDPR.

Slack is an American company, GDPR is a EU law and OP is Iranian. That's not how this works... Sure companies that operate within the EU have created tools to export your data automatically (they still have contact points to request the same data if you don't have an account or were banned so can't use the automated tools) so they opened those tools up to everyone not just those within the EU. But that doesn't mean you are covered by the EU law and can demand your data. Only thing I would suggest is to lookup the GDPR email for slack and manually request the data. Though I wouldn't expect anything.

US companies are forbidden from doing business with Iran, US company discovered it was, closed down the account and refuses to continue that business relationship by handing over data.

So sounds like standard policy to me. It would be like me getting banned off a game because I broke TOS (because OP did break TOS, it's pretty much boilerplate and they have experienced this before so it's not like they were not aware) and getting pissed off that I can not access my chat history any longer.

OP was on borrowed time from the beginning.

Does it suck? Sure it does. But what else you going to expect? For them to explicitly break the law after they discovered they were already in violation and took the steps needed to come under compliance because you didn't read ToS, or (with them admitting this isn't the first time they have got dinged by this law, probably the more likely) wilfully choose to ignore them.

<comment><USER3> > Slack is an American company, GDPR is a EU law and OP is Iranian. That's not > how this works... Sure companies that operate within the EU have created > tools to export your data automatically (they still have contact points to > request the same data if you don't have an account or were banned so can't > use the automated tools) so they opened those tools up to everyone not just > those within the EU. But that doesn't mean you are covered by the EU law and > can demand your data. Only thing I would suggest is to lookup the GDPR email > for slack and manually request the data. Though I wouldn't expect anything.

Slightly unrelated but note that many "American companies" are explicitly headquartered in the EU for tax reasons, and by structuring themselves in this way they are explicitly putting themselves under EU jurisdiction. Examples include Apple and Google (headquartered in Ireland) and Amazon (headquartered in Luxembourg).

A quick search found that Slack is actually headquartered in America. But if they are dealing with the EU market then they very likely need to have an EU subsidiary (and looking again they have a Dublin office and so are likely incorporated in Ireland). However, GDPR only applies to EU/EEA residents -- so you can't just send a GDPR request if you are not resident within EU/EEA.

<comment><AUTHOR> My point is not a legal one, it's a moral point. If they've complied with the GDPR it means they even have processes and systems to give users their data but didn't have the decency to respect their customer and at least close their account in a much better way. The export law says you are banned to serve Iranian companies (!), Fine, but it definitely doesn't force you to f* your users in Iran!

</comment></comment></comment><comment><USER4> Lots of people shaming companies this week, but all of them including this one just don't sound justified at all.

I mean an Iranian company using American products and expecting EU protection?! None of it makes any sense.

<comment><USER3> > I mean an Iranian company using American products and expecting EU > protection?! None of it makes any sense.

It should be noted that Slack has an office in Dublin so it very likely has an Irish subsidiary (just like Apple, Google, and half of the tech industry so they can avoid taxes) and thus is subject to EU requirements. The GDPR applies to them, and since they have an EU company they (I believe) need to obey GDPR requests from any source. [EDIT: This is incorrect.]

But I can understand why Slack would cancel their account, since violating export sanctions is a really easy way to end up in gaol.

<comment><USER2> Nope.

It covers data for EU/EEA citizens and residents data held by companies "doing business" with people in such areas. An off the top of my head example. An Australian citizen who has never been to the EU can not use the GRPR against Microsoft just because MS have a office in the EU.

Edit: My bad, I think the Australian would be under the Dublin office in the slack case. But the GDPR rules are focused on data of EEA/EU residents/citizens and not (always) data of people outside of the EEA/EU collected by companies within the EEA/EU.

<comment><AUTHOR> My point is not a legal one, it's a moral point. If they've complied with the GDPR it means they even have processes and systems to give users their data but didn't have the decency to respect their customer and at least close their account in a much better way. The export law says you are banned to serve Iranian companies (!), Fine, but it definitely doesn't force you to f* your users in Iran!

</comment></comment></comment></comment><comment><AUTHOR> Slack just gave us back our access. I've updated the post on the medium. Thanks to you Slack!

</comment><comment><USER5> I don't care whether the story is a wind-up or legit, there's a bigger principle.

Want to maintain professionalism and integrity? Due process is important. You can't just slam the door closed in peoples' faces arbitrarily and go radio silent or word's going to get out that you're untrustworthy. Do right by people; don't be a dick. Otherwise: problems.

<comment><USER6> Professionalism? Iran sends money to suicide bombers and you're complaining that our side lacks professionalism? UH, OK. How about not breaking the law? Does that mean anything to you?

<comment><AUTHOR> This is not about governments. It's just a simple customer care matter. Different laws come and go, but a good company can always treat its customers better.

<comment><USER6> Iran executes homosexuals. What part of 'sanctions' do you not understand??? This is not a debate. It is U.S. law. Deal with it.</comment></comment></comment></comment>


Sergey Brin's iPhone Adventure in Davos - <AUTHOR> http://bits.blogs.nytimes.com/2008/01/31/sergey-brins-iphone-adventure-in-davos/index.html?ref=technology <comment><USER2> Maybe the reason Google is getting the most mobile traffic from the iPhone is b/c gmail for mobile is still not as good as the built-in Blackberry email client!</comment>


How to attract a top hacker... (NOT) - <AUTHOR> http://www.djangohire.com/a/jbb/job-details/570785

<comment><USER2> Reminds me of the quote The Joker had in The Dark Knight:

"If you're good at something, never do it for free."

I love programming. I do it during the day, at night, on the weekends, all the time. I do some things for money, some things for free, and some things that no one will ever see just because it's fun.

I realize that this job is actually paid, but I don't like the thought that people who require payment for programming someone else's idea are just "doing it for the money".

</comment><comment><USER3> On the contrary, anyone who still believes in a bs that staying wake an insane amount of time is a way of getting things done, should educate himself on how his body & brain actually works, or at least go through "Hammock-Driven Development".

<comment><USER4> > still believes in a bs that staying wake an insane amount of time is a way > of getting things done. You missed the part where he says getting things > done at high quality. I agree with you, but think things can be get done in > a half-assed way, by staying awake. But ultimately will need to be reworked > multiple times the hours you stayed up.

</comment></comment><comment><USER5> I'd love to see the caliber of people joining this. I'm sure some people have applied. Some with some deception in their heart. None the less, interesting.

I have my own 112,347 projects to finish.

I would have hoped he would have been clear about the idea/business/challenge/work and more transparent about the ownership/revenue/raised funds.

And coders that accept no salary for coding, except for close friends or family seem dubious.

</comment><comment><USER6> You will less likely get someone who cares your dream as much as you do.

What I realized/found these days is that the most passionate people that love to work on startup ideas tend to have their own strong opinions on how things should be done.

This creates a little bit of a management issue. Discussions tend to be filled with using esoteric technology or the "would it be cool if" or the "that's sucks, I could do better in 1 day" as opposed to focus on delivering the stable, high quality, 85% UI polished, version 1.0 of the product.

<comment><USER7> 85% UI polished?!?

It's a miracle if some people can get it to look 50% complete. For some reason, and by magic, the UI incrementally degrades given the number of days in the hands of certain engineers. I'm not saying that everyone is like that, but I'm pretty certain that if some engineers approached following driving directions the same way they follow the UI, they'd be permanently lost with no hope of return. 85%. Sheesh.

<comment><USER6> Hey, calm down :P. I just grab that number out of nowhere.

Anyhow, theoretically, version 1.0 should be simple isn't it? So would it be far-stretch to ask for 85% polished UI? (might be some bugs in the UI interaction code, but the look should not be superbad. At least not an eyesore :).

But that's in theory...

<comment><USER7> It's a fair assessment. In my view version 1.0 should be a MVP that addresses the basic needs of the user as they pertain to the underlying system. Decoupling the UI and applying it to the system via API is the ideal solution, but rarely do I see that happen in a 1.0 product when the product itself is in constant flux throughout development.

But I would still like to see how the magic degradation happens from when an engineer receives the static UI and absolutely f*cks it up so that their version of "good enough" barely resembles the end product.

</comment></comment></comment></comment><comment><USER8> By filtering out the people who 'only do it for money', he has also inadvertently filtered out all the people who know that the way business show they value their employees is to pay them appropriately.

</comment><comment><USER9> >I'm not a engineer, I'm an entrepreneur.

This is what turned me off the most, actually.

</comment><comment><USER10> We are looking for a slave. Please apply.

<comment><USER11> They are looking for someone who reads the whole job description and not just the headline.

<comment><USER12> The job description is just as bad as the headline deception. "Eating and breathing code" and "forgetting to pay taxes" for _their_ project isn't my idea of a good time.

Here's my response to the posting: "Give me 50% of the company based on your complete, non-NDA bound idea breakdown _with_ promise of both salary and full bennies and I'll pretend to be just as insane a lunatic as you claim to be about taking on Google and Facebook with your likely dumb as dirt, drunken post-frat party backnapkin half-idea."

</comment></comment></comment><comment><USER13> I honestly think he screwed up by hedging his play in the end. If he decides to go down that path he should say something like "dont worry, you'll get paid" on a first contact email or even during an interview only. He started with something that could have been bold but in the end looked like windows 8: look we have this super cool new interface totally redogned from ground up (but dont worry we still have all the bloatware somewhere in there)

</comment><comment><USER14> The intersection of stimulating-to-develop-projects with those that people will pay money for is quite large. However, the intersection of liberating- and-enjoyable-life-opportunities with i-don't-have-any-money are not that large.

</comment><comment><USER15> I wonder if this "entrepreneur" also isn't getting paid. This is the classic bad business proposition - i.e. I won't pay you now but I might at some unspecified point in future.

<comment><USER16> Last line says:

      p.s. You will get paid. I just needed to filter out people who only do this for money.

</comment></comment><comment><USER17> Hope his product is actually worth so much pathos

</comment><comment><USER18> It sounds so very desperate and sad...

</comment><comment><USER7> > Me? I've got that illness. I'm not a engineer, I'm an entrepreneur.

There are plenty of business opportunities that require little if any code to be written that could be addressed by anyone who has the entrepreneur bug. It's hard work, rarely generating sexy IPO-level returns or media exposure, dealing with cutthroat competitors, regulators, clients and employees and an apathetic market. But like I said, it's hard work.

Why someone would still believe today that they can magically make a business succeed in a space where they ignore even the most fundamental concepts is beyond me. More often than not these projects tend to be very simplistic and rely not on the technology but on the social dynamic of the concept (see: Kickstarter) and if the hiring non-technical founder is unable to hire from within their social circle then it's quite possible that either any developer they know would pass on this or they don't actually know any developers.

And why is this person choosing development languages/stacks, or did they cross post to every language job site?</comment>


Researcher shows that black holes do not exist - <AUTHOR> http://phys.org/news/2014-09-black-holes.html

<comment><USER2> Alternative theories are fine but this doesn't explain any of the observations that have led us to believe black holes exist in the first place. If black holes don't exist, what exactly is Saggitarius A* then? The stars at the center of our galaxy are orbiting something invisible and truly massive (about 4 million solar masses.)</comment>


Tell HN: Request for Hardware Company - <AUTHOR> High-fidelity sound is a terribly fractured, commodified, and unmonopolized market.
If you want something that is the best -- simply the best -- do you purchase a 90s-era value like Sony, Pioneer, or Panasonic?
Do you purchase an arthouse German brand like Klipsch or Bang & Olufsen?
What about an audiophile's recommendation of an Audiolab or a pragmatist's recommendation of an Audioengine?
You already know that companies like Beats, Bose, and Sennheiser are far more markup than they deserve.
And isn't Sonos basically a new-age version of Bose?
...
Is this scenario similar to the PC market before Apple? Fractured and undifferentiated?
Why do the back of these hifi units still resemble the pre-GUI gibberish of DOS 3.1?
Why do the remotes look like they would be good for fast-forwarding VCR tapes?
Where are the sophisticated app-enabled controls?
What are the speakers that will encourage more recordings in binaural audio?
Where is there no single strong voice of audio quality in the industry?
Why should I have to tell my speakers what kind of music I'm listening to?
Where is a more advanced audio hi-fi software? Shouldn't I enjoy pristine audio as my given right?
Can there be a personal audio company with the futuristic elan of Tesla and the holy lust for minimalism of Apple? <comment><USER2> There are already many companies (including all the ones you listed) that would love nothing more to monopolize / take over the industry. There really are not that many companies that can match the cult like following that Apple or Tesla do.

Also hey honestly it sounds like the company you're looking for IS apple. I feel like their home pod thing fills most of your requests.

<comment><USER3> I second this advice: I've bought many pieces of high end gear over the decades, and have a decent set up currently, but it doesn't really matter. I'd enjoy my music just as much with a homepod (or two, for stereo) at home, and good headphones at work.</comment></comment>


Khronos unveils Vulkan: OpenGL built for modern systems - <AUTHOR> http://arstechnica.com/gadgets/2015/03/khronos-unveils-vulkan-opengl-built-for-modern-systems/

<comment><USER2> Organization that is named after Klingon homeworld announces product that is named after Vulcan homeworld.</comment>


Trump Supporters Aren't Stupid - <AUTHOR> https://medium.com/@emmalindsay/trump-supporters-aren-t-stupid-3d38f70f2a2f#.fstio2x4s <comment><USER2> In addition to these ideas on racism, a lot of people are missing that Trump is very skillfully using _phatic expression_ to establish his position of authority, which cannot be countered with _reason_ or _logic_.

Trump may be using English words, but he isn't really expressing _information_ to the people that are voting for him. Instead, this kind of phatic language is about posturing and dominance.

I highly recommend reading this[1] blog post that explains how this difference is a _language barrier_. While it was written about the "intelligent design" drama, the basic ideas it presents apply broadly. Similar to how belief in "intelligent design" is more than just resistance to science, support for Trump is more than just latent racism.

Incidentally, this is why John Oliver's "Drumph" name calling can work. It's not about what it sounds like, or even that it involves Trump's old family name. It works because it is speaking the same type of language (phatic expression) in a way that makes Trump look weak. It knocks Trump down a step in the social hierarchy.

[1] [http://scienceblogs.com/clock/2007/05/31/more-than-just- resi...](http://scienceblogs.com/clock/2007/05/31/more-than-just-resistance- of-s/)

</comment><comment><USER3> This piece contains same great thoughts. As a Bernie supporter, I want to "win", which to me means achieving a society where democracy is valued, everyone has a voice, and everyone has an equal opportunity to succeed. No matter how provoked I feel by some of the things Trump says or does, I know that any negative action I take or words I say against his supporters will only push them farther away, and me farther from my goal.

The antidote to Trump is empathy.

Here's a great video of Bernie talking about this idea: [https://www.facebook.com/actdottv/videos/422038514653387/?th...](https://www.facebook.com/actdottv/videos/422038514653387/?theater)</comment>


Confessions of a San Francisco Millennial Startup CEO - <AUTHOR> https://hackernoon.com/confessions-of-a-san-francisco-millennial-startup-ceo-7ae7b47a8698 <comment><USER2> _" Our country is now a surveillance police state, and our civil liberties have been traded for a false sense of security. Meanwhile, everyone I know and love is a slave to a casino financial system that has robbed my entire generation of our youth, health, ability to own a home, and start families of our own. To make matters worse, everyone is trapped in echo chambers, and divided by the mainstream media and social media due to identity politics because the technology that was supposed to set us free has instead been weaponized against all of us."_

</comment><comment><USER3> This guy thinks he's got it all figured out but in the end all he's doing is whining about the reality. Classic.

This has nothing to do with "the time" and the situation. Every generation had complaints about what their previous generation has done, the only difference is some people decided they will persist and end up succeeding, and some people like this guy just gives up thinking he's "learned" how the world works finally and "the world is rigged".

Of course the world is rigged. But that's not the point because a lot of successful people succeed despite the rigged system. If you can't figure that out, you're probably better off not being an entrepreneur.

Before you downvote me for being critical, just go read what this guy says in the post, the whole post is just a whining from a bitter guy who failed his startup. If you can't get an investor, it's your fault, not the world's.</comment>


EU Court of Justice: Censorship in Name of Copyright Violates Fundamental Rights - <AUTHOR> http://www.laquadrature.net/en/eu-court-of-justice-censorship-in-name-of-copyright-violates-fundamental-rights

<comment><USER2> This is, for once, an amazingly common sense decision, striking a good balance between IP protection, sensible business environment for the ISP, and personal freedom.

From the official press release[1]:

 _"The Court finds that, in adopting the injunction requiring Scarlet to install such a filtering system, the national court would not be respecting the requirement that a fair balance be struck between the right to intellectual property, on the one hand, and the freedom to conduct business, the right to protection of personal data and the right to receive or impart information, on the other."_

I understand this isn't exactly revolutionary but amidst ACTA, SOPA, bailouts, and similar lunacy, this is a breath of fresh air and a glimmer of hope.

[1]: [http://curia.europa.eu/jcms/upload/docs/application/pdf/2011...](http://curia.europa.eu/jcms/upload/docs/application/pdf/2011-11/cp110126en.pdf)

EDIT: Formatting.

<comment><USER3> I totally disagree with you.

This is an unelected body making sweeping decisions without any accountability on a set of laws no-one voted for and a 'nation' that no-one voted for.

It may be positive for us, but in terms of democracy it highlights how ridiculous the EU and its unaccountable mechanisms have become.

I also believe my country, the UK, is trying to wriggle itself out of the human rights laws of the EU as they're too strong and (apparently) being abused, so expect other countries to follow suit and this judgement to be worthless in the long run.

After all this is in direct contradiction with explicitly passed laws in this country. Seriously worrying that an EU judge thinks he should start making these claims in direct contradiction to an elected body passing laws.

<comment><USER4> > the UK, is trying to wriggle itself out of the human rights laws of the EU > as they're too strong and (apparently) being abused

It's worth pointing out again that the European Convention on and European Court of Human Rights are entirely and completely distinct from the EU and any federalisation coming from Brussels.

Not that this decision from the European Court of Justice (which _is_ an EU institution) has anything to do with Human Rights anyway (other than perhaps insofar as the ECHR already stipulates the right of privacy).

<comment><USER3> As far as I understand it it's far more complicated than you make out:

[http://en.wikipedia.org/wiki/Charter_of_Fundamental_Rights_o...](http://en.wikipedia.org/wiki/Charter_of_Fundamental_Rights_of_the_European_Union)

Also they _did_ rule that this was incompatible with the fundamental right to privacy (final sentence, rest preserved for context):

 _the Court finds that the injunction in question would require Scarlet to actively monitor all the data relating to each of its customers in order to prevent any infringement of intellectual-property rights. It follows that the injunction would impose general monitoring, something which is incompatible with the E-Commerce Directive. Moreover, such an injunction would not respect the applicable fundamental rights._

</comment></comment></comment></comment><comment><USER5> >the war on culture sharing

What a powerful concept as an anti-dote to 'war on file-sharing'.

</comment><comment><USER6> How will if effect decisions like this:

<http://www.bbc.co.uk/news/technology-15459005>

...where BT (big British isp) was told to block sites?

<comment><USER2> Judging by the Court press release[1], it would seem that the unreasonable cost of filtering _all_ P2P traffic for copyrighted material (yes, they actually asked for that) weighed heavily in the Belgian case. This would likely not be much of a factor when it comes to filtering a single domain, as mentioned in the UK case you linked to.

Still, the injunction by the EU court could well shift the balance even in cases where blocking is more technically feasible. Fingers crossed.

[1]: [http://curia.europa.eu/jcms/upload/docs/application/pdf/2011...](http://curia.europa.eu/jcms/upload/docs/application/pdf/2011-11/cp110126en.pdf)

</comment></comment><comment><USER7> I wonder what consequences this will have on three strike laws.

<comment><USER8> This is unrelated to 3-strike. This is more about DPI filtering.

<comment><USER9> Well, the French 3-strikes law mandates that to ensure you won't be attacked in court for downloading, you have to install a monitoring software on your computer. So I think in this case, it could apply.

Of course, in such a case, the devil is in the details so maybe it does not apply because it's not asked to the ISPs to do that.

<comment><USER8> The French 3-strikes law does not mandate anything like that. It only says that you should make sure your access is not used for downloading illegaly, but does not specify how. (And no decree was published, afaik).

<comment><USER10> Your analysis is right, but unfortunately the decree has been published last year. The first few third-strokes were struck in the past few months.

(FR) [http://www.legifrance.gouv.fr/affichCodeArticle.do;?cidTexte...](http://www.legifrance.gouv.fr/affichCodeArticle.do;?cidTexte=LEGITEXT000006069414&idArticle=LEGIARTI000022402015&dateTexte=vig)

<comment><USER8> There are still no formal definition of what securing your access means ("moyen de sécurisation").

<comment><USER10> Ah, yeah, true. And fortunately, they are not that dumb as to hurry up and make things worse than they already are... or are they?

Orange (major French ISP) tried to monetize a securization solution based on a 2€/month contract that would block P2P traffic from unauthorized WLAN clients directly on the box. The solution was hacked within days (hours? not sure), simply by grabbing plain-text IP adresses of all the users with a simple /status http query to the webserver of the service provider, and injecting them on random P2P networks using IPFuck (sic), de facto forcing all customers to break the law.

Orange retired their solution from the market and decided to never again try to take on that subject.

Right now the only official stance from HADOPI (3-strikes organization) is a recommandation to use WPA2 instead of WEP. Still no means of securization, so if you get caught, you're to blame for not doing something nobody knows how to do.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The cynic in me tells me that this is more about providing a huge competitive advantage over countries with SOPA like laws than it is about protecting human rights.

But as they say, one should not look a gift horse in the mouth.

What happens with a decision like this is that countries with SOPA like laws will be where you want to be as part of the publishing industry whereas the EU now is the place where you want to be (or at least where you want your hardware to be) if you are a content hoster like youtube.

That's fine.

Of course this might end up with content only being available in countries with SOPA like laws, but looking at what is available for purchase here in Switzerland, I'd say that this is already the case.

As such, I'm really happy about this decision and I have in fact printed it out with the intention to hang it on the office wall.

<comment><USER12> > _but looking at what is available for purchase here in Switzerland_

can you explain what you mean by that for those not familiar with switzerland?

<comment><USER9> I'm not in Switzerland but I'm a Frenchman in the Netherlands, and I believe the situation is the same.

Basically, there is plenty of content with geographic limitations. Something that might be less visible from the US but that can be pretty annoying once outside.

And that's without counting missing services such as Hulu or Netflix, for the same reasons.

<comment><USER13> Yeah, I've got the same experiences in both Netherlands and the UK (I'm an Englishman living in the Netherlands, and working for a French multinational - just up the road in Ede).

Sure, we can use VPNs to access Hulu or BBC iPlayer, but that's an extra expense and adds an extra layer of complexity to it.

Take, for example, my BoxeeBox: it works great for local files, but it misses all of the cool streaming features that American users can enjoy.</comment></comment></comment></comment>


Severe Security Advisory on AMD Processors - <AUTHOR> https://amdflaws.com/ <comment><USER2> Very heavy on fear and branding, light on technical detail...

Its very interesting to contrast this to the way Spectre and Meltdown were 'marketed'. They had fancy websites too, but not quite as blandly corporate sanitized as this one, and both actually focused quite a lot on the names of the security researchers who had found it, and went into details.

Whereas this is just trying to get the public to put pressure on AMD and to get corporate purses to commission CTS-Labs reports.

Will be interesting when the details become public.

</comment><comment><USER3> "The Promontory chipset is powered by an internal microcontroller that manages the chip's various hardware peripherals. Its built-in USB controller is primarily based on ASMedia ASM1142, which in turn is based on the company's older ASM1042. In our assessment, these controllers, which are commonly found on motherboards made by Taiwanese OEMs, have sub-standard security and no mitigations against exploitation. They are plagued with security vulnerabilities in both firmware and hardware, allowing attackers to run arbitrary code inside the chip, or to re-flash the chip with persistent malware. This, in turn, could allow for firmware-based malware that has full control over the system, yet is notoriously difficult to detect or remove. Such malware could manipulate the operating system through Direct Memory Access (DMA), while remaining resilient against most endpoint security products."

So because a design was based of a design based of a design it may be vulnerable to all kinds of attacks.

Am i following these assumptions correctly?

Promontory -> ASMedia ASM1142 -> ASM1042 -> these are wrong

</comment><comment><USER4> Not sure whether this is being hyped extra due to Intel's desire to tar and feather AMD. Certainly, the FUD around where AMD's chips are made is other- than-honest, and many parts of the paper are blatantly speculative.

One part of the paper claims that AMD's use of East Asian IP is inherently inferior and established IP-based backdoors in Ryzens. With such a bold claim, put up or shut up, please.

Nonetheless, the vulns appear real, but without PoC, all CTS has here is vapor, and they don't even have PoCs internally for all of the exploits which they claim to be documenting.

</comment><comment><USER5> Anything that describes itself as a "severe security advisory", but doesn't come with a CVE entry up front is really shady.

There's no disclosure timeline. Was AMD ever informed of the "vulnerabilities" and if so, when, and what their responses were? Nothing suggests as such.

There's no concise explanation of the risk. What exactly is the danger here? The website only shouts in my face that everything is wrong but not how.

The name "Ryzenfall" really sounds like they came up with the name first and looked for a vulnerability second.

The phrasing of "Severe Security Advisory" is deceptive. Sounds like it's coming from AMD, it's not.

Lots of smoke, a tonne of it actually. But I don't see anything else to suggest there's actually a fire.

</comment><comment><USER6> This site seems really scammy. Another attempt to deflate stock?

[https://www.thestreet.com/video/14469681/jim-cramer-on- amd-t...](https://www.thestreet.com/video/14469681/jim-cramer-on-amd-there-s- a-concerted-effort-to-keep-the-stock-lower.html)

<comment><USER2> Well CTS-Labs seems to be an Israeli "cyber-security" consultancy, and I can't find more back-history than that. They do seem to have got the story into businessinsider and cnet etc already in the past hour - these are the only CTS-Labs hits I find on google.

<comment><USER7> the whois on their domain is bit weird:

Registrant Organization: Domains By Proxy, LLC

<comment><USER8> It's GoDaddy's domain privacy.

</comment></comment></comment></comment><comment><USER9> So, the access required seems to be: 1) MASTERKEY: Reflash UEFI BIOS (local access, or defeat the specific BIOS, such as from AMI) 2) RYZENFALL: defeats a bunch of TPM and other secure boot/etc. stuff. Even in 2018 a lot of this is unused, and should never be your only security 3) FALLOUT: allows defeating some bootloader security, but isn't a big deal except on some locked down endpoints. 4) CHIMERA: some kind of chipset backdoor requiring local root. Unclear how big a deal this is due to access required.

Overall, even if these are real, they're not showstoppers. If your security depends on TPM/etc., you're screwed anyway. They do allow local malware to do worse things, and might require some mitigations in shared environments, but it's mostly stuff you should already have protected in those settings anyway.

<comment><USER10> If your security depends on a TPM you should be using a proper hardware TPM and not the fTPM running on the PSP, even my gaming-oriented Crosshair VI Hero motherboard has headers for a hardware TPM.

</comment></comment><comment><USER9> This is the slickest/weirdest branding for a security vulnerability that I've ever seen. There's basically zero information on the site itself except something like: "if you use AMD devices, don't use them, and AMD is incompetent", although the whitepaper has more content (which I'm now reading).

On its face I'd generally accept that the security features on AMD are bypassable, but I don't think any of the current x86 platforms are really suitable for anything except dedicated system for a given customer or security level ("system-high").

Multi-tenant/cloud are nice, convenient, and less expensive, but I'd want to depend on as few of the security features as possible.

</comment><comment><USER11> I'm not trying to dismiss this outright, but what is this? Is this a hoax or real? Because from the name of the site to the whitepaper, it all smells rather fishy. I also read on Reddit that they only told AMD 24h before disclosure, even though all of these vulnerabilities are supposed to be "public knowledge" anyway?

> It summarizes security vulnerabilities, but purposefully does not provide a > complete description of such vulnerabilities to protect users, such that a > person with malicious intent could not actually exploit the vulnerabilities > and try to cause harm to any user of the products described herein. Do not > attempt to exploit or otherwise take advantage of the security > vulnerabilities described in the White Paper.

> The report and all statements contained herein are opinions of CTS and are > not statements of fact. To the best of our ability and belief, all > information contained herein is accurate and reliable, and has been obtained > from public sources we believe to be accurate and reliable. Our opinions are > held in good faith, and we have based them upon publicly available facts and > evidence collected and analyzed, which we set out in our research report to > support our opinions. We conducted research and analysis based on public > information in a manner that any person could have done if they had been > interested in doing so

<comment><USER12> Someone shorting AMD?

<comment><USER13> Looks like it!

"Advanced Micro Devices (NASDAQ: AMD) shares are active as Viceroy Research has come out negative on the stock, saying it could become worthless.

Viceroy made the comments after analyzing CTS Labs' report exposing fatal security vulnerabilities across AMD products.

"Viceroy, in consultation with experts, have evaluated CTS's report. We believe the issues identified by CTS are fatal to AMD on a commercial level, and outright dangerous at an international level," the report said.

It was added, "We believe AMD is worth $0.00 and will have no choice but to file for Chapter 11 (Bankruptcy) in order to effectively deal with the repercussions of recent discoveries."

Viceroy will discuss the short call on CNBC's Halftime Report at noon."

[https://www.streetinsider.com/Analyst+Comments/Viceroy+Resea...](https://www.streetinsider.com/Analyst+Comments/Viceroy+Research+Negative+on+Advanced+Micro+Devices+%28AMD%29/13937313.html)

<comment><USER14> Is CTS connected to Viceroy?

</comment></comment></comment></comment><comment><USER15> Looks like some teenagers [1] and a PR company [2] are doing some marketing or market manipulation stunt...

Note that the site of that "Cyber Security Consultancy Firm" does not even support HTTPS. :))

[1] [http://cts-labs.com/management-team](http://cts-labs.com/management-team) [2] [http://www.bevelpr.com](http://www.bevelpr.com)

</comment><comment><USER16> Screams "scareware" and "financed by Intel"...

</comment><comment><USER17> These are interesting "security flaws," given the level of access an attacker needs to exploit these.

I wonder what (other) security professionals have to say about this white paper.

<comment><USER18> Also curious that "safefirmware.com" — where the whitepaper is hosted — doesn't seem to have any history whatsoever.

<comment><USER8> CTS will be launching a firmware security analysis service/tool for the enterprise market in the coming months this is likely a PR domain for that, and also likely the reason behind this whole "campaign".

It's similar to what Peach (Fuzzer) did after they've (co)"discovered" Heartbleed however that was handled much better.

</comment></comment></comment><comment><USER19> This is such a weird site.

> amdflaws.com

> This site is maintained by CTS-Labs. By accessing the contents of this > website, you confirm that you have read our full disclaimer.

The white paper seems non standard too, where's the disclosure timeline, etc?

</comment><comment><USER20> "Exploitation requires that an attacker be able to run a program with local- machine elevated administrator privileges." [https://safefirmware.com/amdflaws_whitepaper.pdf](https://safefirmware.com/amdflaws_whitepaper.pdf)

I wish Intel would invest in fixing their CPUs instead of doing this.

<comment><USER8> The PSP MIMO registers and the driver are exposed in VMs at least on the Pro/Epyc platform because the PSP is needed for SEV-KM which is used to manage the keys for memory encryption if these are sufficient this will be a big problem for cloud/vm deployments.

</comment></comment><comment><USER3> AMD's response ([http://ir.amd.com/news-releases/news-release-details/view- ou...](http://ir.amd.com/news-releases/news-release-details/view-our-corner- street-0) / [http://ir.amd.com/ir-blog](http://ir.amd.com/ir-blog)) :

"We have just received a report from a company called CTS Labs claiming there are potential security vulnerabilities related to certain of our processors. We are actively investigating and analyzing its findings. This company was previously unknown to AMD and we find it unusual for a security firm to publish its research to the press without providing a reasonable amount of time for the company to investigate and address its findings. At AMD, security is a top priority and we are continually working to ensure the safety of our users as potential new risks arise. We will update this blog as news develops."

Dan Guido ([https://twitter.com/dguido/status/973628933034991616](https://twitter.com/dguido/status/973628933034991616)) claims:

"Regardless of the hype around the release, the bugs are real, accurately described in their technical report (which is not public afaik), and their exploit code works."

</comment><comment><USER21> >Media Inquiries - Jessica Schaefer, BevelPR: email@example.com

I think this is self explanatory

</comment><comment><USER22> Were they given a heads-up of 7 months ?

</comment><comment><USER23> The vulnerabilities all sound like

> we have another instance of MS07-052: Code execution results in code > execution.

</comment><comment><USER24> "fakenews.com"

<comment><USER24> It looks like they are trying to drum up business

</comment></comment><comment><USER25> -_-

At one point they straight up assert that Taiwanese IP is inferior.

Edit: I own amd stock, make of that what you will

</comment><comment><USER26> This seems to be targeted at AMD's reputation primarily. Security seems to be a secondary concern.

</comment><comment><USER27> Tweet [0] Says only 24Hrs notice given? can anyone confirm this?

[0] [https://twitter.com/MalwareJake/status/973567705142853632](https://twitter.com/MalwareJake/status/973567705142853632)

<comment><USER28> He appears to be trying to justify it, badly, by insinuating AMD did the same by breaking the meldown/spectre embargo. [https://twitter.com/MalwareJake/status/973569779419160576](https://twitter.com/MalwareJake/status/973569779419160576)

<comment><USER29> These tweets to give the impression the team behind "AMDFlaws.com" are either

A) incompetent,

B) jerks or

C) all of the above

Post Scriptum: I've archived both tweets here; [https://archive.is/bqQRT](https://archive.is/bqQRT) [https://archive.is/z1wgy](https://archive.is/z1wgy)

Just in case.

</comment></comment></comment><comment><USER14> At least one group looks to be an attack against AMD's equivalent of Intel AMT.

<comment><USER10> The AMD PSP is akin to the Intel ME, AMT is a set of remote management tools that happens to run _on_ the ME on supported systems - so not quite.

</comment></comment><comment><USER30> From discussion I'm seeing elsewebs, this is _extremely_ suspicious.

</comment><comment><USER31> Whois protection. Very trustworthy source... not.</comment>


Securing AWS Credentials on Engineer's Machines - <AUTHOR> https://99designs.com/tech-blog/blog/2015/10/26/aws-vault/ <comment><USER2> I recall seeing a post about a month ago directly to the GitHub repo for this tool. Since then, I have started working on a similar effort to address the issue of API credentials on developer machines. I looked into using STS too, but the issue I kept coming back to was that if a malicious third party (MTP) obtains the developer's machine and it is turned on and logged in (ie, ignore HDD encryption and assume they got the credential somehow), then the MTP can use the same workflow as the engineer to obtain access to the production system, right?

I suppose we need to clearly define the attack vector that we are trying to prevent. If we define the attack vector to be a MTP using developer credentials to obtain access to the production environment for any amount of time, then does aws-vault address that use-case?

If the long lived credentials on the developer box only have permission to request short lived creds from STS which have greater permissions, then I understand how that is certainly better than the MTP having long lived creds with greater permissions. But, how much better is it really? If the creds have IAM permissions, then the MTP could use the temporary creds to lock everyone else out except the root account.

I suppose the article is trying to make the point that the short lived credentials need to have appropriate permissions for the task which the developer needs to complete on a regular basis? Even so, someone somewhere needs to have creds which can modify IAM so that we can manage users, right?

I feel like I am talking myself into a rabbit hole here. Can anyone pull me out? I think/hope that I am missing something obvious and I'm hoping that the answer is "we're not solving everything, but we are reducing the attack surface".

Thoughts?

<comment><AUTHOR> Author of post and aws-vault tool here. There is absolutely a short window of time when it's possible to steal an unlocked machine and have full access to the unlocked keychain. The same issue exists for Keychain itself and things like ssh-agent. The idea is to reduce the attack surface, as you said, and to practice principle of lease privilege. Create roles for specific use cases with just the required permissions, and assume them as needed, based on credentials stored encrypted at rest. It's doesn't solve everything, but it's considerably better than the alternatives

AWS offers the concept of Power Users, which have access to everything except IAM. We use them for most things, which mitigates the risk of an attacker escalating temporary access into long term access. They can still cause a lot of damage, but it's time limited.

</comment></comment><comment><USER3> Great work on this, it really is a weak spot for a lot of aws developers, myself included.

I would love to see more work on the AWS side to address this with integration to keychain, 1password and the like.</comment>


When is the best time to clone your dog? - <AUTHOR> https://www.washingtonpost.com/lifestyle/style/when-is-the-best-time-to-clone-your-dog/2019/07/09/5a8e8ca2-a269-11e9-bd56-eac6bb02d01d_story.html <comment><USER2> If you have money you're allowed to spend it on whatever you want, but if you love animals know that in the US we euthanize 1.5 million often perfectly healthy pets a year.

Donating $50k to transport pets from areas where they kill to areas where there's a shortage of adoptable pets would make a big difference. By my estimate, you could save about, say, twenty semi truckloads of animals.</comment>


A pigeon beats South Africa's slow internet - <AUTHOR> http://www.globalpost.com/dispatch/south-africa/100406/pigeon-beats-south-africas-slow-internet

<comment><USER2> Didn't they do this some point last year?

<comment><USER2> Yup [http://www.mg.co.za/article/2009-09-10-winston-the-homing- pi...](http://www.mg.co.za/article/2009-09-10-winston-the-homing-pigeon-draws- tweets-of-support)</comment></comment>


Accelerated "Ray Tracing in One Weekend" in CUDA - <AUTHOR> https://devblogs.nvidia.com/accelerated-ray-tracing-cuda/ <comment><AUTHOR> "Ray Tracing in One Weekend" is the first in a very popular 3-part series of short, introductory-level books on ray tracing.

"Ray Tracing in One Weekend/The Next Week/The Rest of Your Life" have recently switched to DRM-free, "Pay What You Want" pricing [http://in1weekend.blogspot.com/2016/01/ray-tracing-in-one- we...](http://in1weekend.blogspot.com/2016/01/ray-tracing-in-one-weekend.html)

<comment><USER2> From the post: "Ray tracing was invented by Turner Whitted around 1980."

I believe that Turner probably did some great things, but somehow I don't think I believe he invented ray tracing. Ray tracing has been around for so long in physics...

<comment><USER3> Whitted published the first paper applying recursive ray tracing to the problem of rendering an image. Quibbling over this is like saying no one invented compute graphics because Renaissance artists knew how projection worked.

<comment><USER2> I am sorry you feel that way =/; I understand it was a picky comment, but quibbling over it is far from the gross overstatement you mentioned.

</comment></comment></comment></comment><comment><USER4> I checked this out because I expected to learn about the brand new RT Core accelerated ray tracing. Turns out this tutorial does not touch that topic. It's awesome either way, but [https://devblogs.nvidia.com/nvidia-optix-ray- tracing-powered...](https://devblogs.nvidia.com/nvidia-optix-ray-tracing- powered-rtx/) might be more relevant for people like me.

</comment><comment><USER5> I'd also recommend this interesting blog series from Unity graphics engineer arasp, covering many languages and platforms and incremental perf improvements: [https://aras-p.info/blog/2018/03/28/Daily-Pathtracer- Part-0-...](https://aras-p.info/blog/2018/03/28/Daily-Pathtracer- Part-0-Intro/)

</comment><comment><USER6> Can someone explain Ray Tracing to me like i'm five? Assume that this 5 year old loves playing a lot of different varieties of games and would be glad if his favorite developers end up making better experiences for him using ray tracing.

<comment><USER7> Ray tracing is relatively easy to understand, it's not ray tracing that is actually complicated. Ray tracing is simply sending out rays from the virtual camera, seeing what they hit along the way, and calculating the lighting effects of the materials and light sources when you hit those things. In the end you've simulated a sample of light that hit the camera. Repeat a couple million times and you've got an accurate picture of what the virtual scene looks like.

"Normal" computer graphics is comprised of doing every dirty shortcut trick you can imagine to avoid tracing hundreds of millions of rays per second while still having some semblance of lighting effects in the virtual scene.

<comment><USER8> some good eli5s here, just adding for the grandparent post to remember that light bounces so the calculations get rather iterative and expensive.

<comment><USER9> also, don't forget that the nature of material also influences how light behaves e.g. scattering, reflection, refraction etc. etc. and depending on the scene, computations can be quite expensive...

</comment></comment></comment></comment><comment><USER10> What's wrong with the code? I have CUDA 10 installed and all Nvidia's shipped samples work fine, while this doesn't. I'm new and totally lost, how can this be debug?

[weeb@neet ~/repo/raytracinginoneweekendincuda (ch01_output_cuda)]

$ ./cudart

Rendering a 1200x600 image in 8x8 blocks. CUDA error = 48 at main.cu:48 'cudaGetLastError()'

<comment><USER11> cuda error 48 is apparently "No Kernel Image available for execution on this device"

Make sure that you're building for the appropriate device architecture.

[http://arnon.dk/matching-sm-architectures-arch-and- gencode-f...](http://arnon.dk/matching-sm-architectures-arch-and-gencode-for- various-nvidia-cards/)

<comment><USER10> thanks! that did it, works now. Makefile had "sm_60" arch flag while my card is sm_50.

<comment><USER3> "I'm new and totally lost"

Then I'll give you some unsolicited advice:

1\. Don't assume it's someone else's fault - "What's wrong with the code" is the wrong first question.

2\. Read the original article, in its entirety. Fortunately people are still nice enough to help you, but the combo of "how is this screwed up" and "I didn't thoroughly read the article" is off-putting to people who would otherwise love to assist you.

The relevant section:

> If you start with my Makefile, note that I build for a GTX 1070 card using > specific -gencode flags for that card (-gencode arch=compute_60,code=sm_60). > You will want to adjust the architecture and feature settings for the GPU or > GPUs you will be running on.

</comment></comment></comment></comment><comment><USER12> I made a similar thing a couple of years ago: [http://powerstones.ivank.net/](http://powerstones.ivank.net/)

Instead of producing an image, it is an actual game :D And instead of running just on nVidia, it runs everywhere (in a browser, even on phones etc).

</comment><comment><USER13> Just a random thought: would it make sense for Rust to target GPUs?

<comment><USER14> The programming model for GPUs is pretty different from CPUs. (Branching is discouraged on GPUs, simpler hardware, highly parallel, etc.). I think the right approach is to have separate languages for the two.

<comment><USER3> The original post is about how to make a C++ program run on a GPU via relatively minor annotations.

<comment><USER14> Yes, and the question was whether it makes sense for Rust to target the GPU, not whether it's possible. I think most people would agree that in an ideal world you would have a different programming language for the GPU than you have for the CPU because the hardware is so different. CUDA uses C++ (and C and Fortran) because there is already lots of code written in these languages and it makes it easy to port code to run on the GPU.

</comment></comment></comment></comment><comment><USER15> In the newest Chrome I'm getting

        NET::ERR_CERT_SYMANTEC_LEGACY
        Subject: devblogs.nvidia.com
        Issuer: RapidSSL SHA256 CA

<comment><USER16> It's their fault, but to temporarily override it so you can read the page simply type "thisisunsafe" (without quotes) on the error page

<comment><USER17> Whose fault? Chrome? I'm also facing the same problem. Same version of Chrome, but on Windows, it loads properly, but not on Mac.</comment></comment></comment>


Export your Hacker News saved links to CSV using only Chrome console - <AUTHOR> https://github.com/thomaskcr/hn-saved-export <comment><USER2> Anyone find a way to do this in Firefox as well? It seems to work; except, it won't save the data in CSV. I'll try to get the raw JSON data...

<comment><USER2> got it working with the following:

window.location=window.URL.createObjectURL(new Blob([localStorage.getItem('hn_saved')],{type:'x-whatever/x-backup'}));

file name is weird (I'm a JS newb!)

<comment><AUTHOR> Thanks for sharing, I figured there would be some type of issue with the download portion in other browsers. I'll see if that works in Chrome too and then maybe edit so more people can use it out of the box.

</comment></comment></comment><comment><USER3> Good work OP! I have been meaning to write a python script to do this for a while now. However, entering the code for each page may soon get tedious. (I have 88 pages of saved links.) I'll probably get down to writing that script anyway and share here when I'm done with it. :)

<comment><AUTHOR> Thanks, there are obviously much better ways to do this (even something like GreaseMonkey over using the console), I was going more for an optimization of total time invested. It takes less than 5 seconds per page, so you could probably still swing doing 88 in less than 10 mins pretty easily.

</comment></comment><comment><USER4> FWIW, I had to do something similar and used [http://inorganik.github.io/debugout.js/](http://inorganik.github.io/debugout.js/) It worked really well and using jQuery (inject it) make the code really simple to write.

</comment><comment><USER5> What puts a link on your saved links page? I'd never noticed that page before.

<comment><USER6> Up voting it.

<comment><USER7> I really wish there was a way to save a link for later reading without up voting.

Sometimes I'm on my phone, see an interesting title I can't read right at the moment, but feel weird about upvoting it without actually reading it first.

I've tried using read-it-later apps, but that works mostly for the articles and not the comments on HN which I find just as important.

<comment><USER8> What's wrong with voting?

</comment></comment></comment></comment><comment><USER9> I don't have a save button

<comment><USER3> Upvoting a story adds it to your saved links. You can access your saved links here: [https://news.ycombinator.com/saved?id=<username>](https://news.ycombinator.com/saved?id=<username>)

</comment></comment><comment><USER10> Thanks, always was curious how to save localStorage into a CSV.

</comment><comment><USER11> [https://github.com/HackerNews/API](https://github.com/HackerNews/API)

<comment><USER12> That doesn't give you access to saved stories. Saved stories are stories that you voted on and are "private" to the user.</comment></comment>


Tell HN: MIT Team that won the Red Balloon Contest on Colbert Report Tonight - <AUTHOR>

Physicist Riley Crane, leader of the MIT team that won the DARPA contest will be on the Colbert Report tonight.<p>In other news, Boston is freezing cold and I can't wait to get back to SanFran tomorrow. <comment><USER2> Finally... we can find Bin Ladin AND kidnapped children</comment>


Dejavu: Audio fingerprinting and recognition in Python - <AUTHOR> https://github.com/worldveil/dejavu <comment><USER3> Hey! Creator here. Awesome to see this get posted and people excited about the project.

I made a cool writeup about it here: [http://willdrevo.com/fingerprinting-and- audio-recognition-wi...](http://willdrevo.com/fingerprinting-and-audio- recognition-with-python.html)

It's a great little library for doing audio recognition, stream radio advertisement verification, and all sorts of interesting people email about all the time that I never would have thought of.

It's certainly not as speedy as Echoprint, which is both written in C++ and doesn't use an FFT for the locality sensitive hashing, but is quite user friendly. The benefit of doing constellation or time delta based LSH methods like in Dejavu is that you can actually recover the time at which you matched.

If you love it, feel free to dig in and contribute!

<comment><USER4> Great work! Thanks for open sourcing this - its very educational.

At the moment I'm using it to process a few hundred gigs of song files that I've collected as a big furry hairball of a mess over the years - <USER2> about having multiple iPods and MP3 players over the years, and not really doing very good house-keeping in the move from one to the other (and avoiding things like iTunes where possible) has meant that I have a lot of files that may have duplicate songs in them - but the filenames and organization doesn't necessarily reflect that fact.

So I'm using dejavu right now to clean this up .. I'm assuming you'd be happy to have a "find_duplicates.py" script added - if so, I'll let you know as soon as I have one working .. ;)

Thanks again!

<comment><USER3> Glad to see it's working well for you!

I'd be curious as well to see how the performance holds up getting into the terabytes as I haven't tested that. Remember too that there are a lot of parameters for the matching algorithm here ([https://github.com/worldveil/dejavu/blob/master/dejavu/finge...](https://github.com/worldveil/dejavu/blob/master/dejavu/fingerprint.py)) which allow you to trade off accuracy, speed, and storage in different ways. I've tried to document it throughly.

Finding duplicates is a great one! Actually generating a checksum for each audio file (minus the header and ID3 tags) and adding this as a column in the songs table for all the different filetypes Dejavu supports (mp3, wav, etc) would probably be the best way to do this.

I say this because so many songs today are built on sampling. Mashups and EDM music often samples from other work, and as such, the fingerprints _and_ their alignment can be shared across different songs. Something more clever like seeing the percentage of hashes by song that are the same and comparing to a threshold might do the trick, though.

Happy hacking, and feel free to send in a PR! :)

</comment></comment></comment><comment><USER5> I worked on this too a few years ago. There is a massive patent minefield out there, including this algorithm.

We were doing recognition of TV shows where you are holding a cell phone in your hand some distance from the TV. A prototype with this algorithm was okay, but very easily confused especially as the number of items in the database increases. You also end up with a lot less amplitude at that distance from the TV which makes the source messier. In theory phase shouldn't have had an effect, but in practise it did so things had to be run multiple times at different offsets to improve matching.

Our final algorithm was way better. It was based on what audio codecs do. It even worked reliably with a 60db signal while there was a 70db interferer signal!

</comment><comment><USER6> Surprised nobody has mentioned MusicBrainz, it's the free and open source music fingerprinting database which powers the Picard, Jaikoz, Beets, etc taggers. They have been doing audio fingerprinting for years, you can download the DB or access it via a web API. The author's solution may work quite well with small number of entries to match against, but I suspect the match rate goes down significantly when lookup is against hundreds of thousands or millions of other fingerprints.

[https://wiki.musicbrainz.org/Fingerprinting](https://wiki.musicbrainz.org/Fingerprinting)

<comment><USER7> Audio fingerprinting as used by MusicBrainz is a little different concept. Because it doesn't have the need to match short phone-recorded samples, we can use more efficient algorithms for both the fingerprinting and their matching. It's usually not the match rate that goes down when dealing with a large database, but the false match rate that goes up. And of course performance. Those were my two main things to worry about when I was working on AcoustID (the current fingerprinting technology used by MusicBrainz).

</comment></comment><comment><USER8> Fingerprinting is fine; but the actual value would come from a large database of all sorts of fingerprints, so it could be used to identify songs, snippets, movies, etc.

<comment><USER3> That's certainly useful, and what Echoprint and MusicBrainz have tried to do.

Unfortunately, many fingerprinting use cases require hashing at different granularities (ie, FFT windows), or need different collision guarantees to trade off space vs. accuracy and so on and so forth.

A perfect example is throwing away part of the SHA-1 hash of a fingerprint. You lose some entropy, but you become more space efficient.

Thus in many cases, while the core algorithm might be the same, the parameters and constraints of the individual use case often mean that the fingerprints themselves aren't universal in size or format.

</comment></comment><comment><USER9> This is amazing! truly great explanation in the related blog post here [http://willdrevo.com/fingerprinting-and-audio-recognition- wi...](http://willdrevo.com/fingerprinting-and-audio-recognition-with- python.html) Does anyone know of a good explanation of locality sensitive hashing? I know there are other applications.

<comment><USER10> Shameless self-promotion: in my Stack Overflow answer [1], I reference good introductory LSH papers [2-5].

In short, LSH is an algorithm that hashes points that are _nearby_ in a feature space into the same bin with high probability. Contrast that with cryptographically secure hashes where the tiniest change in the input is designed to yield a completely different hash. The point is that, in domains like multimedia, you want to tolerate some distortions to your signal, e.g. microphone noise, blur, etc. These minor distortions shouldn't affect your characterization of the data, e.g. "is this a guitar", "is this a cat", etc.

The advantages are that it's simple to implement, and it has mathematically provable probability bounds and query complexity.

[1] [http://stackoverflow.com/questions/5751114/nearest- neighbors...](http://stackoverflow.com/questions/5751114/nearest-neighbors-in- high-dimensional-data/5773066#5773066)

[2] [http://www.cs.princeton.edu/courses/archive/spr05/cos598E/bi...](http://www.cs.princeton.edu/courses/archive/spr05/cos598E/bib/p253-datar.pdf)

[3] [http://www.vldb.org/conf/1998/p194.pdf](http://www.vldb.org/conf/1998/p194.pdf)

[4] [http://www.vldb.org/conf/1999/P49.pdf](http://www.vldb.org/conf/1999/P49.pdf)

[5] [http://web.iitd.ac.in/~sumeet/Slaney2008-LSHTutorial.pdf](http://web.iitd.ac.in/~sumeet/Slaney2008-LSHTutorial.pdf)

</comment></comment><comment><USER11> I worked for a company working on audio fingerprinting before (as well as image/video). I have to say it's great that we have a song (audio) recognition system that works pretty well, but the business never takes off. May be it's just my previous company as I'm not sure how Shazam is doing, but I haven't heard of them for a while

<comment><USER12> Actually Google is now competing with them: [https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.ears&hl=en)

</comment></comment><comment><USER13> I've putzed around on something very similar to this for performing analytics on terrestrial radio stations and the commercials. Great work, and I love that you've open sourced it...I didn't use python for mine (C++), but, python allows for a much easier barrier to entry versus my spaghetti code :)

</comment><comment><USER14> I've written similar code, but using image processing algorithms. You can find it here:

[https://github.com/jminardi/audio_fingerprinting](https://github.com/jminardi/audio_fingerprinting)

</comment><comment><USER15> How well would this work for spoken word instead of music?

<comment><USER16> Probably not particularly well. It's based on the variations in pitch over time and unfortunately the human voice fills a very narrow frequency band. Maybe you could limit it to focus on that area of the frequency spectrum to get better results but I suspect it would require more dramatic changes to get good results.

</comment></comment><comment><USER17> this is great! i was just starting out on a project in which one component was to recognize gunshot sounds from varying distances.

<comment><USER3> Not sure if you've seen this, but relevant:

[http://www.shotspotter.com/](http://www.shotspotter.com/)

</comment></comment><comment><USER18> Rather then just fingerprinting recorded audio can this thing fingerprint words and passphrases that the user just says outloud?

<comment><USER5> Not even close. This technique only works when the relative energy of different frequency buckets remains the same, and the same time periods apart (in milliseconds). You are very unlikely to have the same fingerprints when repeating the same words/phrases.

Try using an app that shows the FFT and see if you can get it to show the same thing twice when speaking. For example on Android this works [https://play.google.com/store/apps/details?id=org.hermit.aud...](https://play.google.com/store/apps/details?id=org.hermit.audalyzer)</comment></comment>


Career Builder's CEO: Young people are 'ghosting' employers - <AUTHOR> https://www.yahoo.com/money/career-builders-ceo-gen-z-workforce-181045113.html <comment><USER2> It's not ghosting, it's called quitting.

When you work for a soulless corporate machine, it makes no difference whether you tell your manager. They would take the same actions whether you gave notice or not. Giving them the satisfaction of hearing out your reasoning is kind of like putting in unpaid work.

I fully realize that this is highly cynical, but, on the other hand, not everyone works for a soulless machine. I suspect that those who "ghost" are largely working for the soulless companies who have not even enough common decency to qualify for an explanation.

When a company terminates employment, do they have to provide explanation or notice? Nope! But they sure don't get accused of "ghosting" in stupid ass PR articles.

<comment><USER3> It's not called "quitting", it's called "having a weak ethical compass and low personal standard for behavior". And I disagree with the rest of your ideas, too.

<comment><USER4> I think under reasonable circumstances, it's probably a dick move to bail on a company with no notice that actually treated you well. It seems to me however a perfectly ethical action to not place your mental health or well-being at the behest of what the parent here so accurately described as a soulless corporate machine that treated you like garbage. If you want or need to get out, then get out.

</comment></comment></comment><comment><USER5> I once worked at a place where everyone who did the job I did understood it was shitty, and our superiors understood it was shitty. On a fairly regular basis, a new hire would go out to lunch during their first week and never come back. No one batted an eye.

If you are shocked at a new hire ghosting you, it might be because:

A) You didn't realize their job was shitty

B) You didn't realize your workplace is shitty

C) You knew that their job and/or workplace was shitty but didn't think anyone would have the courage to just fucking leave

D) You knew that their job and/or workplace was shitty but you thought someone you hired into that role/environment anyway owed you the courtesy of giving you a heads up before they just fucking left

</comment><comment><USER6> On the flip side, not so long ago I gave the asked-for two weeks' notice at a corporate job, and they set an end date at one week. No comp for the second.

Obviously, I'll think long and hard about giving any notice in the future, even at a FAANG-level job.

<comment><USER4> Set the place on fire and never look back. In retrospect, I totally agree.

</comment></comment><comment><USER7> If you can't be bothered to treat me like a human being, why should I not treat you the same?

</comment><comment><USER8> I wish this data was sliced down better into full time and part time work and/or hourly and exempt jobs. I feel there are more 'bad part time' jobs now than in years past that don't allow someone to give appropriate notice without reprisal.

</comment><comment><USER9> When the friction/anxiety cost of explaining your exit is higher than the cost of ghosting, you get ghosts.

It seems the pressures that used to deter this behavior have fallen away, and ghosting is effectively free at the individual level (I'd guess that it's expensive at the societal level).

Labor and dating markets have bottomed out the cost to try new engagements, and since everyone recognizes this, they invest less in each one.

Feels like a chicken an egg problem. It doesn't make sense to train employees that will ghost you after they're certified, but it doesn't make sense to dedicatee yourself to an employer that treats you like a flight risk. Nobody tries hard because nobody else is trying hard.

</comment><comment><USER10> Hey there, Ms Career Builder CEO! Want to hear a funny story?

I found an interesting job on your site, so I followed the links and applied directly with the target company.

They finally got back to me: _62 days later_.

Cry me a fucking river about ghosting. Clean your own house first.

</comment><comment><USER11> Any company that's highly upset about "ghosters" (and has had it happen multiple times) should consider how it treats applicants. Does it respond to every single application that's submitted?

</comment><comment><USER12> Companies could add anti-ghosting clauses, like an employee needs to give at least 1 day written notice even for the trial period. In that case if he starts working at another company on the same day when he was expected, he can be sued for damages.

<comment><USER13> I support this, because it's a good indicator of what jobs not to take.

In our non-post-scarcity society, the vast majority of people don't leave jobs simply because they are bad, they leave them _because they expect to find something better_. So the problem is that better employers exist and you're not one of them.

(Also, give your one-day notice and then take a sick day.)

<comment><USER12> Ghosting means that the employee goes to another job, because he prefers that, but doesn't tell the first one about it, in case he changes his mind. It's about not making a decision even after signing the contract.

I'm not an employer, but in my dating life I had a girlfriend who was 20 minutes late on her first date. After we got together, a few weeks later she told me that actually she was late because she put another date with another guy at exactly the same time as with me, just she didn't like him in real life.

I had much worse ghosting situations as well, when a girl didn't show up, and didn't even answer my texts/calls.

Be happy if you don't know the meaning of the word.

I'd be interested to know how you would handle a baby sitter (who was very nice before) not showing up and not returning your texts/calls when you have a child and you need to go to a business meeting or to theatre for example.

<comment><USER13> > _I 'd be interested to know how you would handle a baby sitter (who was very > nice before) not showing up and not returning your texts/calls when you have > a child and you need to go to a business meeting or to theatre for example._

Presumably the same way I'd handle a babysitter who called me ten minutes before they're supposed to show up saying they got in a car accident.

Actually, probably differently - I can't meaningfully control car accidents but I can pay my babysitter more / figure out what they need to be happier.</comment></comment></comment></comment>