How to Resign Gracefully - <AUTHOR> http://www.cforcoding.com/2010/04/how-to-resign-gracefully.html <comment><USER3> _You Will Get Yelled At

A lot of comments on TechCrunch revolved around being treated badly. If you're lucky you have a boss that's passionate about what they're doing. If so, such bosses will get heated and yell because they care._

Yeah, right.

I don't work well while being yelled at. I don't want to deal with that. And so I refuse to work in environments where I get yelled at. Seriously, if you're my boss and you yell at me, my resume is being updated that night and I'm going to shop it around. If you're my co-worker then I'll wait until you calm down some, and raise the issue. If I don't get an apology then I'm going to either my or your boss about it depending on the political dynamics of the company. If the company doesn't agree that you were out of line, I'm going to find another job and go.

And yes, there are people I've worked with that have broken this rule which I choose not to work with ever again.

Now I understand that some people, cultures, etc differ. In some yelling is OK. That is fine. I choose not to be in those ones. And I'm far from the only person who feels this way.

So if you're a boss and you yell, take a moment to consider this. No matter what excuses you give yourself for your crappy behavior, are you losing really good employees because they don't agree with you on this issue? After you've thought about it for a while, perhaps you'll find better ways to handle stress than yelling at people below you in the hierarchy.

<comment><AUTHOR> Expecting to be in a job where there's never any conflict is a lot like expecting to be in a relationship without ever fighting.

<comment><USER4> He didn't say that.

<comment><AUTHOR> Actually that's exactly what he said:

> Seriously, if you're my boss and you yell at me, my resume is being updated > that night and I'm going to shop it around.

Yell at him _once_ and he's gone. Note: I didn't say you will get yelled at a lot or even often but it _will_ happen.

If you pack your bags the first time you get yelled at well that's a pretty good argument that you should be yelled at sooner rather than later to see what you're made of.

Consider it a filter.

<comment><USER5> He's not talking about conflict. He's talking about yelling, which is a monkey dominance game for someone who has lost interest in finding the right answer. It's just a hair below shoving on the "cannot control himself, belongs in a cage" scale of warning signs.

What am I made of? I'm a human being, not a slave, so I demand zero tolerance for this in any workplace.

<comment><AUTHOR> And the relationship analogy still applies: sure most (hopefully) conflict isn't settled more amicably but tempers do blow up and things get said in the heat of the moment. Expecting that to _never_ happen makes you look thin- skinned, naive or both.

<comment><USER4> I think it can be expected in a professional setting in the US. Given your line of thinking, almost any behavior can be excused.

I'll also add that it depends on the expectation of the job when you applied. Normal white collar work in the US usually doesn't entail being yelled at. Being a football player does. So does signing up to be a Marine.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> After reading tons of comments from people with varying viewpoints, I still can't comprehend how someone could say this to their employee:

"... Good luck being employee 4,367 at a dying company....Horribly disappointed in you."

I don't care if the employee only sent out an email without a face-to-face conversation or resigned in person and then sent an email for documentation purposes. I don't care if the employee was horrible, mean-tempered, or terrible at programming. I don't care if he was core to the entire startup, without whom the company is bound to fail. None of it matters. His email was very polite and I can absolutely see myself in his shoes. Sure he called his next opportunity "amazing" but so what? In next paragraph he commends his ex- coworkers/teams and thanks everyone. What else could he have said in a resignation email?

I just can't believe someone in CEO-level position replied to a resignation email like this. Not every email should be treated the same. "Hey I'm sick today, can't make it to work" or "Sorry! I haven't fixed the bug yet" are very different from "This isn't an easy email to write..." As a manager, you do not treat those emails lightly or brush them off as good riddance.

<comment><AUTHOR> Fact is, Yahoo is a directionless arguably dying company and very much a large company rather than a startup with all that entails, probably meaning many meetings before you can ever change anything and so on.

And Jason said something in the heat of the moment? So what? They just promoted the guy and he can't even sit down and have a conversation? I'd be horribly disappointed too.

Remember "disappointed" means you actually care and had high hopes/expectations for that person. That's WAY better than no expectations whatsoever.

<comment><USER6> > Fact is, Yahoo is a directionless arguably dying company and very much a > large company rather than a startup with all that entails, probably meaning > many meetings before you can ever change anything and so on.

Does not matter. The boss has absolutely no right to judge the next company. Everyone moves around in the tech world. MS employees joined Google, then Facebook, then Amazon, and so on. Bosses are supposed to wish employees good luck in the future or at the very least be polite and respectful.

> And Jason said something in the heat of the moment? So what?

So TechCrunch. So permanent record & documentation. So bad PR. People in the IT/startup world should know the internet never forgets. Also there is no heat of the moment when you reply to an email titled "Resignation." I can believe heat of the moment if an employee walks into your office and says "Screw you! I quit." But you can't play the "heat of the moment" card if it's an email. Take some time to cool off before you reply.

> They just promoted the guy and he can't even sit down and have a > conversation?

Irrelevant to the discussion. He could have been made CTO and still wanted to resign. It was a very polite email and it is a free country/world. As a boss, you need to be a good leader and say positive things even when someone wants to quit.

> I'd be horribly disappointed too. Remember "disappointed" means you actually > care and had high hopes/expectations for that person. That's WAY better than > no expectations whatsoever.

I'd be horribly disappointed too myself. But saying "horribly disappointed" is not constructive criticism or even a poor choice of words. It is outright insulting. Instead of going back and forth over these words, let me just write out what an appropriate reply should be, so you can decide yourself how far this is from what really happened:

        Hi Evan,

        I accept your resignation and have notified Elliot to take care of the paperwork tomorrow. You can take the next two weeks off and have someone pick up your personal belongings or let Elliot know where to ship them.

        I had high hopes for you and am disappointed to see you leave. Good luck with your future ventures.

There. Said nearly the same things without sounding rude or insulting. Senior employees resigning can't possibly be such a common occurrence that a CEO can't even take 2mins to think the reply through. Could it?

<comment><AUTHOR> > > They just promoted the guy and he can't even sit down and have a > conversation?

> Irrelevant to the discussion.

It's entirely relevant. If you accept a promotion, you are making some kind of commitment. To turn around and quit 2 weeks later just goes to show your actions were, at best, disingenuous.

> As a boss, you need to be a good leader and say positive things even when > someone wants to quit.

The chance to do that went out the window once this private email was made public. That's kinda the point of this whole thing.

<comment><USER7> If it didn't involve some sort of rearrangement or big announcement, I would say that the promotion acceptance being a commitment argument is weak. It's not that big of an investment by the promoter.

WRT the second, as a boss, you should not be petulant. If you're not someone who your subordinates can look up to and admire, morale suffers badly. He doesn't deserve a chance to issue an email redaction any more than I deserve the chance to redact insults I make to someone at a bar. Sure, it would be nice to be able to apologize before it has any negative impact, but it is by no means one's right.

</comment></comment></comment></comment></comment><comment><USER8> Early on in my career, I learned a lesson from a retiring colleague -- a former Army Colonel, "never be loyal to a company because the company won't be loyal to you." You can be loyal to individuals, and people can be loyal to you. But the company? Nah. Lots of people get burnt really early in their careers thinking that showing intense loyalty to an organization will be rewarded when no such thing happens -- an "organization" doesn't care. At best, your boss might give you a bump if you are loyal to him/her, and that kind of thing pays off in the long run, in terms of keeping well built bridges (it's amazing how often you meet the same people in a given industry no matter how big).

The reason I'm commenting about this?

> They're not in the office? You wait a few days until they are. They new job > can't way? Bullshit. Or, if true, it's a good sign that it's an organization > you don't want to work for because they don't care about you.

This is the kind of idealistic naiveté, that while nice in principle, doesn't really matter in reality. Show up, do a good job, when the time is right, move on. If you boss isn't there, call them. If they aren't making themselves available to the employees, then I suppose they fall into the category of "places that don't care about you" anyways.

Organizations, by definition never care about you and you shouldn't care about them. Care about your work and doing a good job -- that builds self-respect and your reputation. Ask for what you want when you want it and be patient until you get it, don't be a baby or an asshole, be flexible when better ideas than yours come along, that builds respect. Business isn't about feelings, it's about _production_ and making more money than you lay out. If you want feelings, wait 'till quitting time and the after-work meetup at the local happy hour where everybody can commiserate all they want over $3 beers.

Think your company cares about you because of the free t-shirts, catered food and free drinks? Are you kidding me? They just know they can squeeze and extra 2-3 hours a day out of your sorry ass at pretty much no extra pay and about $10-15/day.

Other than that, the post is pretty spot on.

<comment><USER7> Your post is probably accurate for most megacorps, but I should hope that employees at a startup or company of less than 10 people don't feel this way about the company. At that level, it's very much a personal relationship rather than a company-employee relationship where loyalty only goes one way. Not all companies are about the creation of profit at any cost... some actually like creating an environment that is pleasant to work in, with free food, etc. for no reason other than making life a bit more enjoyable.

<comment><USER9> It's a personal relationship with the people, not with the company. You feel a personal connection with the founders, with the other early employees. You're passionate about the product. You want to build something amazing, and make more money out of it than you put in, and maybe change the world doing so.

Your CEO probably cares about you. It probably kills him when the company is running out of money and he has to let you go. But the company doesn't "care." It shows no loyalty to you, and you should feel no loyalty to it. That doesn't mean you can't work for a company and love the work, but it does mean you shouldn't get wrapped up in it to the point where you lose sight of your own interests.

<comment><USER7> My point was that when the company is the founders, it's not really possible to separate loyalty to the founders and loyalty to the company. At that point, it's very possible that the founders/company will act out of loyalty to you rather than purely out of self-interest, at least until their ability to do so runs out.

And I disagree vehemently that one should feel no loyalty to their startup. I know of at least one startup that has run out of money without sacking their employees, and the employees agreed to waive their pay until the startup was able to get its cashflow going again. Had they all immediately bailed as you seem to imply they should have, that startup would be dead now. Instead, I believe its current valuation is around a billion.

I would hope my employees would do the same for me.

</comment></comment></comment></comment><comment><USER10> Jason needs to chill. It is not clear to me if Evan has damaged his brand as an individual. But it is clear that Jason has damaged Mahalo as a brand. As the CEO, Jason has responsibility to his shareholders. If you promote someone and still he leaves, you need to find out why and you need to ensure that the team left behind is still motivated. A good CEO does that by inviting the departing employee to a face-to-face in order to provide a reasonable explanation to the rest of the company. It is all optics, but it is important optics. How Jason feels emotionally is not important. What he does to maintain shareholder values is.

<comment><AUTHOR> Mahalo is no better or worse off for this incident.

The people who hate Jason and/or Mahalo still hate them. The people who like Mahalo, well, I can't imagine they quite match up with the profile of the average YC reader...

<comment><USER11> Mahalo are worse off. There are plenty of people out there - me included - <USER2> neither knew much nor cared much about Mahalo but may have considered working there had an opportunity arisen. I wouldn't work there now though. That might not give Jason any sleepless nights, but I bet many better developers than I have watched this play out with great distaste and resolved never to put themselves in the way of the people involved.

<comment><USER10> That's exactly the point. If Mahalo was a restaurant and I am a dish washer, I probably won't think too much about who I work for and who I work with. But if I am a technologist then I would have to choose to work for a startup. Life is too damn short to be working for a dick.

</comment></comment></comment></comment><comment><USER12> Let's play word-replace...

 _A lot of comments on SocialCrunch revolved around being treated badly. If you're lucky you have a husband that's passionate about you. If so, such husbands will get heated and yell because they care._

Yeah, sounds just as lame.

<comment><USER13> This is one of my favorite techniques in showing why some arguments are asinine; well played.

</comment></comment><comment><USER14> This article condemns the employee for doing something well within his rights in a polite manner because that's not the Right Way To Do Things. It then goes on to say "An employer is well within their rights to bar you from the premises."

I mean, really? This is a two-way street here.

</comment><comment><USER15> > Had it remained private, which it should've, Jason may have calmed down and > mellowed about the situation over time.

Honestly, I find that highly unlikely.

Why shouldn't the guy post it online, really? I believe he was "verbally" abused on twitter and "yelled at" rudely in an email. It's important to know these things about an employer.

> you that if there was anything urgent there (eg prescription medication) > that he would've gotten that ASAP

Yeh, he lost me there. It's a huge assumption that may or may not have held out - you can't make a point off the back of it.

<comment><AUTHOR> > Why shouldn't the guy post it online, really?

Because now on the first page when you google his name you'll find a post about him leaving a company after 12 months and posting a private exchange with his (former) boss on his blog.

</comment></comment><comment><USER16> +1. I haven't seen another article or comment pointing out that resigning over email is a terrible idea.

I said recently that egregiously bad behavior should be publicized (<http://news.ycombinator.com/item?id=1274033>). This is _not_ an example of such behavior. You resigned over email and received a harsh response? Airing it in public will only cause you harm.

(None of this is a defense of don't-hire-job-hoppers. See <http://news.ycombinator.com/item?id=1287253>)

</comment><comment><USER17> Statiscally speaking, it is a sad episode for both Jason and Evan: the former will be condemned by several people for handling the matter not in the best possible way, and the later for making its employer's inadequate response public. Which is relevant, as Jason, being more well known, is more likely to actually suffer a bigger impact from this bad press than the engineer. Not a win-win situation by far.

<comment><USER18> i'm pretty happy jason's character is being exposed. hopefully every future potential hire will see this.

</comment></comment><comment><USER19> hmm... I wonder if Jason would/has ever fired someone in as 'shitty' a way as this kid quit? If his business was in trouble and he had to do it, I guarantee he would; notice would be minimal; and the process would be formal (otherwise he's not doing his fiduciary duty to his investors).

Having fired > 100 people, I think 'at will' is in force in startups just as it is in the real world, and it cuts both ways. If someone was willing to email 2 week notice, they probably didn't drink the kool-aid, or felt like they weren't appreciated. Or maybe they're just an unsocialized 20-something who didn't want to deal with the drama. Either way, the pay-it-forward karma would be to take him into the office and say "hey, next time keep in mind the company is comprised of people who give a shit; man up and quit in person, with reasons". That should have been the end of it.

</comment><comment><USER18> it's ironic, given the tweet from calacanis, how it's the employers demonstrating the sense of entitlement in reacting to all of this.

 _"So ignore any comments about the at-will issue. It's irrelevant."_

no, my legal rights are never irrelevant. go screw yourself.

</comment><comment><USER20> _This is the tragedy of the modern education system in that it rewards participation not winning._

Winning is entirely beside the point. Sure, merely showing up should not be enough (never mind what Woody Allen said). But education should be about bettering yourself, not defeating others. Oh, and learning how to learn. Not just memorizing facts to pass tests.

Eighty percent of success is showing up. -Woody Allen</comment>


Ad expert: Google's Super Bowl spot was a live traffic test - <AUTHOR> http://venturebeat.com/2010/02/08/google-super-bowl-ad/

<comment><USER2> Don't they have something close to this data already, by virtue of controlling the most popular search engine? They can already observe the search-traffic spikes for various brands and products from Super Bowl ads that they _didn't_ pay for.

It's possible they got some new data out of it, but my guess is that it really was just an ad purchased for the reason ads usually are purchased, in this case partly to counter Bing's ad campaign.

</comment><comment><USER3> This is an interesting approach: _. "What better way to learn the true potential of the world's most expensive slot than to buy it."_</comment>


A Collaborative Browser Based Raytracer - <AUTHOR> http://peterbraden.co.uk/projects/badoomph/demo

<comment><USER2> This fails for the same reason the JavaScript entries failed to make a dent in the Engine Yard contest: When JavaScript is roughly 1000x slower than GPUs, even borrowing other people's browsers isn't enough to make up the difference. Also, real ray tracing generally involves huge source data that would have to be downloaded to each client.

<comment><AUTHOR> But that's the whole point. Sure javascript is slooow and with the small number of browsers visiting the demo, this isn't even comparable to the performance of a GPU.

It's the potential. You have literally millions of computers on the internet right now, capable of running this code.

Also, raytracing is only an example. But what large data set do you need for raytracing? I guess if you had a massive mesh then that might add up/

<comment><USER3> This seems like the beginning of another argument in favor of an idea I've been kicking around for a little while now: combine http with bittorrent in some seamless fashion to really make more of the web better distributed.

<comment><USER4> Can you elaborate? I've been thinking about how to do that for a few years.

<comment><USER3> You've been thinking about it longer and probably more in-depth than I have. There was a project awhile back called localhost that made me think about it. It wasn't as transparent as what I would like to see, though. 4chan also made me think about it. The content there has a very high turnover, and many of the users painstakingly mirror the parts of the site that they care about. It would be nice if they had a tool they could use from their browser to share out their mirrors so that those pages never 404. The next step would be to implement the way localhost intentionally allows poisoning (or as I call it, "controversy") or versioning, and a trust network would round out the implementation to deliver the most-probably-preferred version upon the first visit, with the option to choose. I don't know if this would be a browser extension or a new RFC surrounding HTTP and bittorrent, but it's what I think WebDAV should be.

<comment><USER4> That's awesome. Yeah, I've been thinking along pretty similar lines.

4chan is basically a "paging channel" or "advertisement channel": anybody can post, which means it can't provide reliable delivery (any message can be swamped by spam) or archival, but that's the only way to establish communication between people who don't have a pre-existing relationship (either directly or through their social network).

Poisoning/controversy is inherent in human-readable, non-centrally allocated, shared namespaces. (See Zooko's triangle.) It's not always a problem — Google shows that your suggested approach of using a trust network to choose among the candidate versions can work pretty well — but in the cases where it _is_ a problem, you can reduce the magnitude of the problem by using self-certifying names (like SHA1 sums), unshared namespaces (like petnames), or centrally- allocated names (like DNS). Nick Szabo's "Secure Property Titles" proposal is the only plausible alternative I've seen. (I don't know enough about social dynamics to predict whether it would work as he predicts.)

One of the advantages of hash-addressed data (data named with a self- certifying name that consists of a secure hash of its contents) is that it can be replicated to many peers without any particular concern for integrity or timeliness. (And in Freenet and BitTorrent, it is.) So it might be good to use hash-addressed data for as much of the system as possible. Localhost only stores _filenames_ in directory nodes, then uses Kademlia to look up the .torrent infohashes associated with various versions of the filename; it would be good to often provide durable links consisting of the infohash itself.

The other thing I think is needed is a way to publish a mutable resource that only you can update. Such a resource can have a self-certifying (but non- human-readable) name consisting of the hash of your public key, possibly an ID number, and a timestamp.

Localhost, for those who are wondering what we're talking about: <http://p2p.cs.mu.oz.au/software/Localhost/thesis.pdf>

</comment></comment></comment></comment></comment></comment><comment><USER5> This is going to totally re^H^Hinvent social raytracing.

<comment><USER6> Just out of curiosity, what does ^H^H mean?

<comment><USER7> From <http://en.wikipedia.org/wiki/Backspace>:

 _Pressing the backspace key on a computer terminal would generate the ASCII code 08, BS or Backspace, which would delete the preceding character. That control code could also be accessed by pressing Control-H, as H is the eighth letter of the Latin alphabet. Terminals which did not have the backspace code mapped to the function of moving the cursor backwards and deleting the preceding character would display the symbols ^H (caret, H — see Caret notation) when the backspace key was pressed. This sequence is still used humorously for epanorthosis by computer literates, denoting the deletion of a pretended blunder, much like overstriking.

Example:_ My slave-dri^H^H^H^H^H^H^H^H^Hboss decided to stall the project.

<comment><USER6> Thanks!

</comment></comment></comment></comment><comment><USER3> Does it detect poisoning? If not, only good will prevents somebody from goatse-ing the image.

<comment><USER8> I'm not sure that would work -- since each person gets the next line in the batch (seems like anyway), the best you can do is poison a few random lines. making a cohesive image out of that would mean you'd have to poison the source data.

</comment></comment><comment><USER9> Great work. This is definitely an exciting step in a new direction of rendering.

</comment><comment><USER10> Very cool! it's like the browser version of Autodesk's Backburner network ;)

</comment><comment><USER11> Awesome work!</comment>


Rule 9: At no time and in no event can you do anything to critique us or our app - <AUTHOR> https://www.easyar.com/freeServices.html <comment><USER2> > 9\. At no time and in no event can you do anything, including without > limitation an action that involves a remark, piece of writing, picture or > video, that may have adverse effect on VisionStar or EasyAR Open Platform. > \--- just charming!</comment>


Interactive Images - <AUTHOR> http://www.weberleifels.com/?cat=6

<comment><AUTHOR> I´d like to highlight that this is not intended as a nude-pic discussion ;)</comment>


Why does the Zune HD have the message "For our Princess" inside of the case? - <AUTHOR> https://blogs.msdn.microsoft.com/oldnewthing/20180914-00/?p=99735 <comment><USER3> I went with the Zune / have avoided apple products for years because I find their advertising smarmy. So, I went with Zune and received ENDLESS RIDICULE.

BUT! Zune was great. I had the zune app with spotify-style music subscription before spotify was a thing.

The Zune software was really pretty and nice, and you could plug your zune into your computer and it would act as an external hard drive without fighting with it.

<comment><USER4> I never understood the love for the iPod, it was pretty mediocre. It did have iTunes integration which had the ability to purchase music and sync, but it had and still has a shitty interface.

Edit: I get that we have to worship Steve jobs, but the iPod wasn't revolutionary. Others before and after did it better.

<comment><USER5> Not sure I understand the disagreement here; I think you're right on. I had an mp3 player before the iPod came out; it's not like iPod was the first mp3 player. The iPod had a nice external "look" and great marketing, but functionally it was much more difficult to use than other mp3 players that were available at that time. I was told iTunes worked better on the mac, but my experience using it on the PC was nothing short of painful. Other mp3 players had the capability of of using simple drag-and-drop functionality to move your mp3's over to the player, without the need to learn a new program and without forcing a different idea of music library management on the user.

<comment><USER6> The only thing I can remember it having was the smart playlist feature, where you could construct playlists using criteria like "Has at least 3 stars" and "Not played in five days" etc.

Though that was more of an iTunes feature, that I wouldn't mind seeing in Spotify!

It let you make auto-updating lists to keep your library fresh, and not rely on the shuffle feature.

</comment></comment></comment></comment><comment><USER7> The Zune HD was really a great device. Hadn't heard about this dedication, but it's incredibly touching.

</comment><comment><USER8> zune was the most underestimated mp3 player ever. it just never got the fame it deserved.

<comment><USER9> Agreed. I still use my original Zune every day. It's off the grid now, the Zune software still works but can't connect to any MS servers, has an FM radio. They can be picked up very cheap.

I have a Zune 120 and Zune HD as well but I don't find them either as good, especially on FM radio.

<comment><USER10> Which model do you have? I think I'm going to grab one.

<comment><USER9> I have each generation they made. I personally like the 1st gen Zune 30 since I listen to a lot of KEXP and it has the best performing radio, but I'd suggest looking at the models and figuring out what you need. None of them are bad in my opinion.

<comment><USER10> Do you have a recommendation if I just want to play MP3s through my car aux? Don't really care about size as long as it's at least 2 GB.

Every time I look for something, it seems like there's only $20 junk and $100+ players to choose from. I've gone through 3 Sansa Clips that just keep dying. I bought a Fiio x1 and had the wheel die on me in the first year, and using the warranty was way too much hassle.

<comment><USER11> Not a Zune, but consider a Blackberry 9900 - there are some on eBay for around $40 [1], they take micro SD expandable storage, appear as USB drives so they don't need sync software, have a standard headphone socket, have wifi and bluetooth and touchscreen as well as physical keyboard, and the hardware and build quality is "high end business device from ~2011".

Software is nothing special, but shuffle play artist/album/song/playlist it can do.

[1] e.g. [https://www.ebay.com/itm/Mint-Used-BlackBerry- Bold-9900-Unlo...](https://www.ebay.com/itm/Mint-Used-BlackBerry- Bold-9900-Unlocked-T-Mobile-4G-Smartphone-8GB-GSM- Qwerty/292657895786?hash=item4423c5196a)

<comment><USER12> Agreed, this was my phone for years and the speed of opening the music app and typing to filter down to what you want is fantastic. Easily swappable battery too.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> This is really sweet. I wonder what the cost was to do this for every unit, and at what point in the production lifecycle her death occured?

<comment><USER14> From the pictures a few links through, it was silkscreened on along with some other information that was going to be there anyway. I imagine if it was before that silkscreen was made, it didn't cost anything extra.

<comment><USER15> Further on this point: It's common for PCBs (Printed Circuit Boards) to have Easter eggs in either the copper or silkscreen layers. They're also often in the photolithography masks used for making silicon chips: [http://micro.magnet.fsu.edu/creatures/index.html](http://micro.magnet.fsu.edu/creatures/index.html)

</comment></comment></comment><comment><USER16> Was just talking about the Zune the other day. I really with Microsoft would release a new one or a phone or something. I'd love to just have a dedicated music player when traveling so I don't use up my phones battery.

<comment><USER17> Music playback from local storage uses a minuscule amount of battery - if you listen all day, you're going to lose only an hour or so of standby on a modern phone.

You'd be better off spending the same money to buy a battery pack to recharge your phone when it runs low.

<comment><USER18> Uses, or should use? On an Android device (S5) I've found the battery usage from music playing not-insignificant - perhaps it prevents the phone from fully entering standby, or something? At a very rough estimate, I'd say it uses 20% as much power to play music as active usage requires, though this is very much anecdata.

Either way, I'll second the recommendation to get an external battery pack - <USER2> high-quality one will give more audio playback time than a media player, with much more utility and convenience.

<comment><USER19> Most modern phones (not sure for S5 which is pretty old these days, but Nexus 5 was the first to introduce it) have a separate DSP for music playback.

The app must use Androids playback API though.

</comment></comment></comment></comment><comment><USER20> I wonder how many electronics ship with this type of thing. The Macintosh is fairly famous[1], and the Amiga had signatures and a dog print[2].

1) [http://www.folklore.org/StoryView.py?project=Macintosh&story...](http://www.folklore.org/StoryView.py?project=Macintosh&story=Signing_Party.txt&topic=Apple%20Spirit&sortOrder=Sort%20by%20Date&detail=medium)

2) [https://en.wikipedia.org/wiki/Amiga_1000](https://en.wikipedia.org/wiki/Amiga_1000)

</comment><comment><USER21> The Nintendo Switch Pro Controller also includes a small hidden message just above the right analog stick, "THX 2 ALL GAME FANS". [0]

[0] [http://www.nintendolife.com/news/2017/03/have_you_seen_the_h...](http://www.nintendolife.com/news/2017/03/have_you_seen_the_hidden_message_inside_your_switch_pro_controller)</comment>


Apple's design process - BusinessWeek - <AUTHOR> http://www.businessweek.com/the_thread/techbeat/archives/2008/03/apples_design_p.html <comment><USER2> Apparently the www.randsinrepose.com guy is also "Michael Lopp, senior engineering manager at Apple", according to that BusinessWeek "Tech Beat" article. Assuming that's accurate, it alone is an interesting bit of news (to me at least) - even if it does date back to March 2008. That may shed as much light on how innovation happens at Apple as the article itself does. The "wide-open" initial stage followed by gradual honing by reality checks doesn't feel very different than creativity-processes used in most organizations that value innovation. The article might also be a helpful reminder that it isn't only from the brain of Steve Jobs that Apple mines for ideas.

</comment><comment><USER3> Isn't Michael Lopp the guy who writes Randsonrands? Is it the same person?

</comment><comment><USER4> That was an interesting article, tho a little old. Things may change now when Jobs is gone...

<comment><USER3> Tim Cook, Phil Schiller, Jonathan Ive, Eddy Cue. Four people who are each reputed to be just as strict and important to Apple culture as Jobs. Cook in particular is said to be far more intense than Jobs when it comes to operating and getting things produced.

</comment></comment><comment><USER5> way old! But a great article.</comment>


ProtonCalendar Security Model - <AUTHOR> https://protonmail.com/blog/protoncalendar-security-model/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=21913392](https://news.ycombinator.com/item?id=21913392).</comment>


Why Speakers Earn 30k An Hour - <AUTHOR> http://oreilly.com/social-media/excerpts/9780596802004/why-speakers-earn-30k-an-hour.html

<comment><USER2> One thing sort of hinted at but not explicitly mentioned is that the field you speak in makes a significant difference, especially at the lower end (really famous people will make out well in any case). If you can get onto the corporate speaking circuit, doing tutorials and lectures at corporate retreats, for example, there is a _lot_ of that work, and it pays fairly well. This usually requires a sort of "pop" or "business" angle on your speaking. Even a very engaging lecture about advanced mathematics is not going to get you invited to most corporate retreats, but a lightly mathematically tinged anecdote, or a more business-focused lecture about using statistics to analyze markets, might do so.

I've noticed in game-design, for example, that over the past 1-2 years by far the best way to go if you want to make money speaking is to get into "gamification", talking about how companies can use game mechanics and badges for engagement and that kind of thing. Even if you're a better speaker when talking about actual game-design, the markets are just very differently sized, so it's more lucrative to give an "ok" talk about gamification (lots of clients) than a great talk about game-design (many fewer clients, unless you're Will Wright level).

<comment><USER3> _This usually requires a sort of "pop" or "business" angle on your speaking._

An anecdote: I got an email after my Old Spice speech from somebody who charges $30k a speech. He said "That was good, topical, and funny. If you want to do more like that, get an agent. You will get gigs."

<comment><USER4> Link for the curious:

<http://akshat.posterous.com/patio11-says-hello-ladies>

<comment><USER5> What software is used to include the slides and the talk video in the same frame?

<comment><USER3> A professional editor using the Adobe toolchain, as far as I know.

</comment></comment></comment></comment></comment><comment><USER6> >To put the numbers so far in this chapter in perspective, the average adult on planet Earth earns $8,200 a year (U.S. dollars). The average American makes about $45,000. Since you see your paycheck, you know exactly where you stand.

Bit of a tangential nitpick: I don't like that he used the _averages_ here--I think he should have used the medians. Which, for Earth, is about $850 [0] and, for U.S.A., is about $30k-50k [0,1]. Even so, a single number doesn't give you a very good picture of the actual wealth distribution, but the median is better than the _average_ (for chrissake!) in this case.

[0]: [http://www.wisegeek.com/what-is-the-median-income- worldwide....](http://www.wisegeek.com/what-is-the-median-income- worldwide.htm) (I tried for a couple minutes to find a better source--sorry.)

[1]: <http://en.wikipedia.org/wiki/Median_household_income>

Edit: And, overall, I found the excerpt to be rather fluffy, feel-goody, and sparse on content. Maybe I'm cheating here, but it seems like the kind of text that would make a fine talk, but a vacuous essay.

<comment><USER7> For those wondering, here are the individual income medians from the 2010 census (all numbers are pre-tax gross income):

individual median income: $26,680/yr, single: $18,881/yr, married: $32,033/yr, divorced: $28,668/yr, widowed: $18,485/yr,

This is a more accurate picture for which to start making comparisons regarding your individual income status (in the united states).

</comment></comment><comment><USER8> The discussion on the last time this was submitted : <https://news.ycombinator.com/item?id=927757>

<comment><USER9> I wonder if there is any value in the comments from the second time around or if rereading the first set of comments is sufficient? Maybe a double blind study is neccessary.

</comment></comment><comment><USER10> Well he also seems to forget the amount of effort but in by the speaker. Of course a more famous one will be paid more, (s)he has spent thousands of hours doing appearances, books, etc all to gain some notoriety, all without the assurance it will pay off or come back to them some day. 30k an hour just isn't accurate if you see all the effort over the years to pull it off and the pre and post work needed to be done per speaking engagement.

</comment><comment><USER11> Does anyone have an opinion on the ethics of paying for speakers, in the context of a public conference?

I am fine with covering basic expenses, travel. What about significant speaker fees?

<comment><USER12> er, I don't see what is ethically wrong with it if the organizers are charging people to attend - like Scott says, the organizers can make $250k from tickets to see him speak.

What is ethically 'troublesome' is when conference organizers like O'Reilly (but others do it, they just happen to be hosting the post) take pay-for-play speakers at their conferences but don't disclose.

In other words, the speakers pay the conference organizers AND the attendees are paying too. I have no problem with speakers being paid, in fact it increases the chances of high-value speakers attending.

</comment></comment><comment><USER13> This only adds up if you think it makes sense for some many individuals to be allocated 10000x more resources for their leisure while the majority scrape to get by.

Its a very primitive belief system that actually predates social Darwinism and served as the inspiration for it.

In order to have an actual civilization, we will need to start to realize the differences between humans and common animals.

<comment><USER9> What do we have now if not an actual civilization?

<comment><USER13> If you come up with a substantive response to any other part of my comment then I will answer your question.</comment></comment></comment>


New visa will boost UK high-tech sector - <AUTHOR> http://uk.reuters.com/article/idUKTRE6A30WA20101104

<comment><USER2> This might at least light a fire under the US government to do the same.

<comment><USER3> I hope that happens, but I haven't noticed the US government being quick to imitate good ideas from other countries.

<comment><USER2> I agree they rarely imitate good ideas, but they respond to competition. So if we could point to startups that happened in other countries as a result of US visa policies, that would apply pressure.

</comment></comment></comment><comment><USER4> _The proposed new "entrepreneur visa" would allow people with great business ideas and the backing of serious investors to set up shop more easily in Britain._

The most important part. How much of funding to make it a serious investor?

<comment><USER5> Current requirements for entrepreneur visa:

      • You have access to not less than £200,000
      • The money is held in one or more regulated financial institutions
      • The money is disposable in the United Kingdom
      • You personally have at least £3000 to support yourself
      • You can pass an english language fluency test

For more details: [http://www.ukvisas.gov.uk/en/howtoapply/infs/inf24pbsentrepr...](http://www.ukvisas.gov.uk/en/howtoapply/infs/inf24pbsentrepreneur)

</comment></comment><comment><USER6> Even w/ this visa London will be no more attractive as a startup hub than New York, both of which are dominated by over-paid financiers who have driven up the cost of living to unaffordable levels for normal folks, let alone boot- strapping entrepreneurs. And then there's the weather...

<comment><USER7> If you're from the US, maybe. But if you're from Bangladesh and looking for a place to do a startup, you may decide to go to London for the visa.

</comment></comment><comment><USER8> Unless they also do something about the weather, I'd still pick California.

<comment><USER9> I thought you were going to China: <http://maxkle.in/giving-up-on-europe/>

BTW, I don't mean this as a snarky retort. I'm seriously curious whether that plan has panned out for you.

<comment><USER8> I did go.

<comment><USER10> And..?

</comment></comment></comment></comment><comment><USER11> More detail on this over at TechCrunch Europe: [http://eu.techcrunch.com/2010/11/04/uk-government-plans- east...](http://eu.techcrunch.com/2010/11/04/uk-government-plans-east-london- tech-cluster-startup-visa-review-of-ip-law-200-million-in-finance-what/)

Thread here: <http://news.ycombinator.com/item?id=1867017>

</comment><comment><USER12> A definite plus move and the canny thing is locating it near the existing "Tech Triangle" - Shoreditch and moving Eastwards towards Stratford.

That part of London is cheap, well connected and has a large immigrant population. It will be interesting to see how this pans out in reality , but all the good signs are there.

<comment><USER13> Shoreditch is anything but cheap. It'll fall off pretty quick by the time you get to Stratford though.

I lived in Tower Hamlets (ie, the area in question) for 10 years and loved it. A lot of native Londoners look down on it as it has a reputation and is kinda rough around the edges. I understand a lot has changed in the last few years with the financial collapse and them dumping money in to the area in the build up to the Olympics.

</comment></comment><comment><USER14> you should add "UK" in the title.

</comment><comment><USER15> There's been a visa like this for some years already in the UK. I guess he is just changing it, and taking credit.

Basically if you have a whole bunch of money available you can set up a business in the uk. You must hire a certain amount of people over a certain amount of years.

<comment><USER16> The same visa also exists in the US. Have $500k-1 million? Then you can get in the short line to get a greencard.

</comment></comment><comment><USER17> Can someone explain the what Cameron means by altering the intellectual property laws?

<comment><USER18> I thought it might be software patents from the Reuters article but Techcrunch suggests its more about a DMCA-like system

</comment></comment><comment><USER19> Surprise the UK made the move before US given all the hype about #startupvisa a few months ago.

<comment><USER14> UK make the move, US make the "words"

</comment></comment><comment><USER20> agriculture: 1.2% industry: 23.8% services: 75% (2009 est.)

Isn't services sector saturated?

<comment><USER10> No, this is symptomatic of a modern economy. Any advanced economy will have a similar focus.

If you think about it on a higher level, it makes a lot of sense. At first, the great bottleneck was having enough food, so all economies began with an almost-100% focus on agriculture. But then, as that became less and less of a problem, the next bottleneck was having enough stuff - whether machinery to make agriculture more efficient, or other items to make your life better.

As "stuff" gets less and less scarce, and cheaper and cheaper to acquire, what are we left with? The final bottleneck, which isn't going away any time soon, is that we all only have 24 hours in a day. "Services" is a euphemism for "ways to buy other people's time so you can have more than 24 hours of 'good time' (and higher 'good time' than you'd be able to achieve by yourself) per day". Whether that's bank services to speed up your money handling, or cleaning services, or web design services, or any other number of services which basically amount to helping someone, somewhere to make more efficient use of their time.

This is the final bottleneck until we figure out how to speed up our thoughts, and so all activity ends up piling into there.

<comment><USER21> Another thing I wonder about is this:

Company X makes white computers. It has all sorts of employees: hardware designers, software developers, industrial engineers, factory workers, janitors, even gym instructors and aroma therapists. Over time the company evolves or is replaced. The new company mostly manufactures. A lot of the engineering is done by other companies. The hire janitorial service companies and employees can get their own damn aroma therapists.

The second situation is contributing percentage points to the "service," but fundamentally nothing has really changed. Same people doing the same jobs for the same purpose, just structured differently.</comment></comment></comment>


Ask HN: How do you manage your resumes? - <AUTHOR> While different companies would have different skill sets that they look for, one may have to tailor multiple resumes. What is your way of do this? Any tools you use?<p>I currently use multiple folders of latex source files. <comment><USER2> I write them in restructuredText, then I run them through pandoc and can take several routes from there to PDF.

My standard resume gets me calls, but if I feel the need to personalize it, I will probably do it with Sphinx.

</comment><comment><USER3> I have just one template and I fill it from a list of all things I did professionally (projects, tasks, achievements, important events).</comment>


America's yield curve is no longer inverted - <AUTHOR> https://www.economist.com/united-states/2019/11/14/americas-yield-curve-is-no-longer-inverted <comment><USER2> > Perhaps more important, each of the past three pre-recession inversions > reversed themselves before the ensuing downturn began.</comment>


Google Reader Adds Magic to Your Feeds - <AUTHOR> http://mashable.com/2009/10/22/google-reader-personalization/ <comment><AUTHOR> I tried the "magic" and at least I feel that it is more fun to read. News are not sorted by date any more, which it gives me some "feeling" of randomness reading that I like. The new sorted news "seems" to be ranked according to my previous history of reading. Not sure if it is better but so far I like it a lot.</comment>


Mozilla Announces $225,000 for Art and Advocacy Exploring A.I. - <AUTHOR> https://blog.mozilla.org/blog/2018/06/04/mozilla-announces-225000-for-art-and-advocacy-exploring-artificial-intelligence/ <comment><USER2> This is an unpopular opinion here, but the facts stand.

Mozilla makes money disappear. Their 2016 revenues were in excess of $520M, and their claimed output was the Quantum browser.

The two largest R&D verticals seem to be their browser and the codecs group. That still doesn't account for expenses of $520M in 2016, and much much more in 2017.

Where is all the money going, Mozilla?

<comment><USER3> Browser engineers aren't exactly cheap. 250k for a good C++ Dev is reasonable. Assuming 100 engineers (a very conservative estimate), that's 25 million in just pay alone. 50 million including codec. Now add in the costs of infrastructure, community engagement, DevOps, Marketing etc. and the costs will quickly balloon. Browsers are critical infrastructure like operating systems. Their complexity is on the same level as OSes, perhaps even more. It's exposed to hostile code everyday, you don't want people who don't know what they are doing to work on it. This isn't some sort of dating app where the only vulnerability you have to worry about is a code injection in the birthday form field.

<comment><USER2> So the true benefit (to the community) is about $50M +- 10%. Heck, let's double it and call it $100M.

The remaining expenses are fluff. In a corporation, one wouldn't be allowed to have non-essential expenses far exceed essential ones. In a non-profit, this philosophy needs doubling down on.

I might be completely wrong, but Mozilla seems to be subsidizing the whims of a corrupt few at the top.

<comment><USER4> """So the true benefit (to the community) is about $50M +- 10%. Heck, let's double it and call it $100M."""

Your napkin "calculations" make zero sense. Go read the financial report.

"""Mozilla seems to be subsidizing the whims of a corrupt few at the top"""

Ah it is clear what your real intent is.

<comment><USER2> "Ah it is clear what your real intent is."

And what might that intent be? Are you suggesting Mozilla's top brass are bonafide angels doing God's work, above public scrutiny? They seem to position themselves as champions of the people and freedom, much like politicians

</comment></comment></comment></comment></comment><comment> s-shellfish While I believe there are real dangers AI can cause, I don't know how you'd go about proving such a thing without recreating the problem in a different constructed variant.

Psychology and sociology are 'soft' sciences because you can't test people psychologically and sociologically in 'hard' ways without seriously crossing some serious ethical boundaries.

It could be argued that a lot of the decisions being made that back the design in contemporary infrastructures already are engaged in this sort of testing and behavioral modification, in ways that seem innocent from the onset, but yet still propagate across social systems in ways that are far too chaotic and complex to forecast.

<comment><USER5> Proving to a high standard of proof would indeed be very hard.

But a lot of useful Science can be done by observing, documenting, cataloging and explaining the effects of AI being already inflicted on us.

<comment> s-shellfish I don't know if I would use the word 'inflict' when one is inferring intents.

I think if there were more transparency concerning these systems and their affiliated organizations, that would obviate the need to add another layer of reasoning, which would reduce the number of unknowns, rather than increase.

Of course, that requires cooperation and trust. Which brings one back to the question of intents. Which can conflate intents meant to 'inflict' (harm?) or intents meant to grow, develop, inspire, progress.

</comment></comment></comment><comment><USER6> If anyone is interested I would recommend Alexandra Meliou. She does research at UMass and her work explores making data and large data manipulation more transparent, and also therefore does some amount in quantifying bias and diversity. I attended a talk by her and it was very enlightening.

[http://people.cs.umass.edu/~ameli/](http://people.cs.umass.edu/~ameli/)

</comment><comment><USER7> How does a project like this relate to Mozilla's core mission?

I understand that it may be useful but this is far outside of what I would expect Mozilla to spend its funds on.

<comment><USER8> [https://www.mozilla.org/en-US/mission/](https://www.mozilla.org/en- US/mission/)

>Our mission is to ensure the Internet is a global public resource, open and accessible to all. An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent.

<comment><USER9> From Mozilla's blog post describing the project:

> We're awarding $225,000 to technologists and media makers who help the > public understand how threats to a healthy internet affect their everyday > lives.

> In a world where biased algorithms, skewed data sets, and broken > recommendation engines can radicalize YouTube users, promote racism, and > spread fake news, it's more important than ever to support artwork and > advocacy work that educates and engages internet users.

I guess that's somewhat related to their mission. Although they seem to be taking on more of an activism / PR role with this project.

My guess is that it's largely people within Mozilla responding to the popular outrage against Russian 'bots', fake news, and the alt-right.

</comment></comment></comment><comment><USER10> Why is Mozilla investing in this study? It's a good cause but should Mozilla be the one doing this? I feel bad when they are doing this but I still can't use Firefox on macOS because they won't implement support for keychain and then they go ahead and stretch themselves thin on these things.

I mean it's all good and fine but please also focus on the one thing you are supposed to be doing primarily.

Disclaimer: I donate to Firefox.

<comment><USER11> This is a rounding error in their budget. They have $500 million in revenues.

[https://www.mozilla.org/en- US/foundation/annualreport/2016/](https://www.mozilla.org/en- US/foundation/annualreport/2016/)

<comment><USER10> What would be the excuse to flat out ignore all those desperate user requests then?

Issue list: [https://github.com/jfitzell/mozilla- keychain/issues/88#issue...](https://github.com/jfitzell/mozilla- keychain/issues/88#issuecomment-332331685)

<comment><USER12> "Why is an organization spending their money on things that I personally don't care about? Large groups of people can only do ever one thing at a time and problems can always be solved faster by throwing money at them."

<comment><USER10> Are you making this statement after looking at the issues I linked?

</comment></comment></comment></comment></comment><comment><USER13> "... to help art and advocacy projects ..."

Why not (serious) social science projects? Don't have today's sociologists have anything to say about this or do they need a few more decades for warm up.

<comment><USER14> I would argue that we are at a point where it's more important to raise awareness of the dangers of algorithmic bias and other AI issues because the public is not aware of them. Art is provocative and fits this role nicely.

To answer your question directly though, there is "serious" work like that from people like Veale and Skirpan; also orgs like AI Now are very serious about this area.

</comment></comment><comment><USER15> This would roughly fund 1-2 technical staff to work on one project for one year. Probably just 1 staff if the project involves statistical methodology work, data collection, and modeling to empirically assess society impacts rather than writing yet another safe AI / AGI risk essay.

Not a normative judgment, just thinking about what people think this labor costs vs. what it actually costs.

<comment><USER16> Right, but the open-source community might be involved as well - maybe the money is more about promoting e.g. a platform than paying individual staff

<comment><USER15> Yes, that is a good counterpoint.

</comment></comment></comment><comment><USER17> Mozilla can't afford to throw its money away on projects like this if it wants to stay relevant. This is two/three engineers salary for a year.

<comment><USER14> This is little more than 1 engineer's salary and benefits for a year.

Can you explain how this is Mozilla "throw[ing] its money away"?

<comment><USER18> If for that money one can get only one manyear in the bay area due to the cost of living, wouldn't it make much more sense to hire 4 people for a year elsewhere?

<comment><USER19> It seems obviously more complicated than that, otherwise the bay area wouldn't be what it is.

<comment><USER18> For companies that are physically there, but afaik Mozilla is quite spread out and people work remotely most of the time.

<comment><USER20> Mozilla has both multiple offices and remote employees.

So do various other companies with significant physical presences in the Bay Area (Google and Facebook come to mind).

</comment></comment></comment></comment></comment></comment><comment><USER21> Someone needs to do it... thanks Mozilla

</comment><comment><USER22> AI can't create Art.

</comment><comment><USER8> Better link: [https://blog.mozilla.org/blog/2018/06/04/mozilla- announces-2...](https://blog.mozilla.org/blog/2018/06/04/mozilla- announces-225000-for-art-and-advocacy-exploring-artificial-intelligence/)

<comment><USER23> Thanks! We've updated the submission from [https://www.neowin.net/news/mozilla-announces-225000-for- pro...](https://www.neowin.net/news/mozilla-announces-225000-for-projects- examining-ais-effects-on-society).

</comment></comment><comment><USER24> This is a really important study that should be conducted by an organization with a strong engineering culture and as little bias as possible. Who would be better then Mozilla to do this? I really don't trust academia to do this with all of its misplaced incentives.

<comment><USER25> > I really don't trust academia to do this with all of its misplaced > incentives.

We've really learned to repeat the anti-'academia' meme. There is no "academia"; Mozilla is an organization; "academia" is millions of people around the world in every place and environment imaginable. It's absurd to assume all these people are the same or coordinated somehow.

Given the absurdity, one might ask: Who would be interested in discrediting everything produced by every college and university?</comment></comment>


Ask HN: Where do you get your reading material from? - <AUTHOR> Where do you get your technical reading material from ?
Engineering Blogs/ Books / Guides / Tutorials ?
From technical learning for new topics, I am using safaribooksonline.com on a trial basis and so far I have liked the experience of being able to read from whatever material I want.
Are there any similar services out there which are more affordable?
For the ones who have used it, how do you rate safaribooksonline ? Is it worth paying the hefty subscription fees? <comment><USER2> I am primarily using Safari. I was not able to find any alternative services that offers such a wide variety of books. I got it at 50% off couple months ago... I am not sure I'd pay the full price for it. I like the selection and the idea of being able to browse any book in the library... Some books work better than others, as some are HTML. Sometimes formatting is off, and if the book is image heavy it might be completely unreadable... one example is Value Proposition Design.

I don't quite like their Queues idea. I tend to read books, not arbitrary chapters from books... Maybe I just didn't give it enough time. I wish they didn't make it the primary feature... it kind of gets on the way of someone like me who is trying to read a book as a whole.

Safari still offers an alternative option which is a bit more affordable. See if it works for you [https://ssl.safaribooksonline.com/subscribe](https://ssl.safaribooksonline.com/subscribe)</comment>


Bret Victor, Inventing on Principle (2012) [video] - <AUTHOR> https://www.youtube.com/watch?v=PUv66718DII <comment><USER2> So, where are all the companies that are building next-generation developer tools and direct manipulation document and simulation tools? It has been a while since this video got released.

<comment><USER3> His demos only work with small amounts of code, scale up to the size of a real codebase and they all become infeasible, as well as not really that useful.

<comment><USER4> You mean like the code at Xerox PARC and ETHZ?

Many of his ideas were already possible on the workstation OSes created there.

<comment><USER5> Agreed. But possible and popularized are two different things.

<comment><USER4> Since I started delving into computer archeology I wonder how the computing world have looked like if AT&T had been allocated to sell UNIX instead of having given it for free.

</comment></comment></comment></comment></comment><comment><USER6> Here is a transcript of the talk: [https://github.com/ezyang/cusec2012-victor/blob/master/trans...](https://github.com/ezyang/cusec2012-victor/blob/master/transcript.md)

</comment><comment><USER7> Are there any efforts do implement his "immediate feedback" ideas in the context of data science/scientific computing?

I could see some amazing iPython/jupyter demos, where the user can import some data, filter/rearrange data, and create a few plots-- but then adjust and see the plots change dynamically by adjusting values throughout the notebook.

<comment><USER8> I've seen a few, such as [https://atom.io/packages/hydrogen](https://atom.io/packages/hydrogen) \- running code inline in atom with Jupyter.

</comment></comment><comment><USER9> I like to think we are: [http://framerjs.com](http://framerjs.com).

</comment><comment><USER10> (2012)

<comment><USER11> Yup. Added.</comment></comment>


I'm Joining Report URI - <AUTHOR> https://www.troyhunt.com/im-joining-report-uri/ <comment><USER2> I don't get it. What does Report URI do? Their landing page doesn't say. And Troy Hunt's blog post tells me this:

        * Set up CSP headers
        * Somehow, magically, Report URI will tell you things

Wait what? How does that work? I feel like I'm missing a step. Unfortunately [https://report-uri.com/](https://report-uri.com/) doesn't really explain either, or have integration docs of any kind.

I'm not trying to be snarky, I'm considering to become a customer.

<comment><USER3> To get this reporting to work, you need an HTTP header in place. Historically (fairly short term history) this was "report-uri"; hence the name of their product... however this has since been replaced by "report-to". More information on these headers can be found here: [https://developer.mozilla.org/en- US/docs/Glossary/Reporting_...](https://developer.mozilla.org/en- US/docs/Glossary/Reporting_directive) (at time of writing the `report-to` documentation is pending)...

Steps:

      - User's browser loads your page
      - User's browser detects something which would be a violation of your CSP policies
      - User's browser blocks that content...
      - ...and also checks for a Report-To, Report-URI, or CSP-Report header in the HTTP Headers.
      - If any of those headers exist, the user's browser makes an http post to the stated URL,
        passing information about the problem.
      - If the URL stated in those headers was the Report-URI.com service's URL (i.e. the service which
        Troy Hunt's writing about) then their company receives this data, and can use the information
        in that to determine that this report relates to your website (i.e. from the info in the
        `document-uri` field), and store this information in the metrics they provide for your site.

<comment><USER3> ps. You could implement your own functionality to collect these reports. The Report-URI product (as opposed to header) is just a pre-written service to save you rolling your own. You just need to build something to receive the HTTP POST statements and do something with the data. Or you look on GitHub and find someone's done that for you: [https://github.com/seek-oss/csp- server](https://github.com/seek-oss/csp-server) (and more: [https://github.com/search?utf8=%E2%9C%93&q=csp+report- to](https://github.com/search?utf8=%E2%9C%93&q=csp+report-to)).

Specifics and examples of what `report-to` looks like here: [https://wicg.github.io/reporting/#examples](https://wicg.github.io/reporting/#examples)

There's also a nice blog about implementing the old `report-uri` header here: [https://gdstechnology.blog.gov.uk/2015/02/12/experimenting-w...](https://gdstechnology.blog.gov.uk/2015/02/12/experimenting- with-content-security-policy-on-gov-uk/)

<comment><USER3> Here's a nice example of what the report packet looks like:

      {
        "@timestamp": "2016-07-07T12:01:03.044Z",
        "csp-report": {
          "document-uri": "http://example.com/signup.html",
          "referrer": "",
          "blocked-uri": "http://example.com/css/style.css",
          "violated-directive": "style-src cdn.example.com",
          "original-policy": "default-src \u0027none\u0027; style-src cdn.example.com; report-uri /_/csp-reports"
        }
      }

Ref: [https://github.com/seek-oss/csp- server/blob/master/example/c...](https://github.com/seek-oss/csp- server/blob/master/example/csp-report-example.json)

I don't know what's in place (if anything) to prevent sending fake reports... i.e. presumably a hacker could read these headers from a site, then send HTTP POST messages reporting all kinds of errors from various IPs (e.g. if they have access to compromised machines), flooding your useful metrics with false data, thus hiding any useful information in there...

Better than the current protocol, you'd have your site generate an ID for every legitimate request so that any reports could be tied back to that... but even then any hacker would just need to call your site once per false report to get that ID, so this only offers a small amount of additional protection (though in doing so increases the probability of the site being targeted by a flooding / DoS attack).

<comment><USER4> I haven't opened the ReportURI webpage, but I would assume their value added compared to DIY is exactly in spam-filtering and solving (or mitigating) all the security issues that report-uri (the header) inserts itself.

Call me cynical, but I believe reporting causes more harm than good, by exposing new attack surface.

Why not just deploy a crawler that detects CSP errors and reports them in a static report for the site owner?

<comment><USER5> CSP violations (such as XSS vulnerabilities) can manifest themselves on non- public pages, where they'd be difficult to detect with a crawler.

In addition, the Web Reporting API covers more than just CSP. It can also report various types of certificate errors, such as those triggered by violations of the Expect-CT and Expect-Staple headers (such violations might occur if your users are under attack by a MITM).

<comment><USER4> I imagine you realize that a user under MITM would have the report POST request tampered? It's false security.

On the other hand, you are right that the crawler wouldn't catch everything.

<comment><USER6> I'm not certain what the implementation status is in various browsers, but the relevant RFCs (e.g. for HPKP) typically recommend that user agents retry the submission of reports. The report URIs themselves may also use HPKP to prevent them from being intercepted (as opposed to just DoSing the submission). There are certainly scenarios where an attacker can only temporarily MitM the victim and the reporting mechanism would still be of use eventually. The reporting itself is not the enforcing mechanism, so timely submission is not the most important thing in the event of an attack.

That said, it's true that the biggest practical use people get out of report- uri is to test the roll-out of these headers and to detect issues they might cause.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> If you don't know who is Troy Hunt, then one thing to do right now is to signup for his great service: [https://haveibeenpwned.com/](https://haveibeenpwned.com/)

in essence, everytime(+) some massive break occurs, and your e-mail (and probably password) is among them after reaching "darknet" (meaning black market), you will get from haveibeenpwned an e-mail, urging you to some action (password change, account closure/change etc).

(+) Troy amassed over the years huge db of past breakins (so you can check your email presence also in past events) and with current respect/reputation he gots access to new ones pretty fast, informing you instantly in most cases.

Highly recommended.

<comment><USER8> > after reaching "darknet" (meaning black market)

> with current respect/reputation he gets access to new ones pretty fast, > informing you instantly in most cases

So he has the respect of (street cred with?) the dark net/black market folks and that's how he gets them instantly? Or I suspect you meant to say something slightly different?

<comment><USER9> These lists get 'traded' amongst security professionals a lot. Quite a few of them will send Troy a copy to load in to HIBP.

</comment></comment></comment><comment><USER10> Report URI appears to depend on CSPs being submitted. There was recently a discussion about uBlock Origin blocking CSPs on privacy grounds. [0]

So this will only work for sites that use CSP _and_ users who don't have uBlock Origin installed, unless uBlock Origin changes their default policy on CSPs.

ninja edit: I see uBlock Origin has changed their defaults to permit CSP submission [1]

[0] [https://www.theregister.co.uk/2017/10/17/ublock_origin_csp_r...](https://www.theregister.co.uk/2017/10/17/ublock_origin_csp_reports/)

[1] [https://github.com/gorhill/uBlock/issues/3140](https://github.com/gorhill/uBlock/issues/3140)

<comment><USER11> Troy very publicly carrying water for Scott Helme/Report URI looks quite a bit different in hindsight, as the number of Report URI marketers doubles to 2.

· [https://twitter.com/troyhunt/status/920590590223331329](https://twitter.com/troyhunt/status/920590590223331329)

· [https://twitter.com/troyhunt/status/920222303849390081](https://twitter.com/troyhunt/status/920222303849390081)

· [https://twitter.com/troyhunt/status/920173854835720193](https://twitter.com/troyhunt/status/920173854835720193)

The uBlock Origin dev compromised with an opt-out for CSP reports, even though they can be used for things like IP address leaks to 3rd party servers (similar to the as-seen-in-court Tor-busting captcha mess). Personally I would prefer only same-origin reports.

\--

My biggest problem in all of this is that Scott was not careful to always document his not-quite-obvious conflict of interest, and even worse: Troy's association is only now being revealed weeks later. I do appreciate the work being done to improve the effectiveness of CSP reports in default configurations of open source tools, but can't help wondering about the motivation. Disclaimers go a long way toward keeping unsuspecting maintainers informed of both sides of an issue.

· [https://github.com/issues?utf8=%E2%9C%93&q=is%3Aissue+author...](https://github.com/issues?utf8=%E2%9C%93&q=is%3Aissue+author%3Ascotthelme+CSP)

· [https://twitter.com/Danbo/status/920325189954654208](https://twitter.com/Danbo/status/920325189954654208)

Scott was also blamed here on HN last week for his part in promoting the death of HKHP (public key pinning) apparently due to ease of misconfiguration.

· [https://news.ycombinator.com/item?id=15573076](https://news.ycombinator.com/item?id=15573076)

Looking back now I'm left wondering how HKHP affected Report URI and Scott's other project, Security Headers. I will disclose my bias as I watch highly effective marketing of convenience (top of HN!) triumph over my personal flavor of slightly paranoid privacy yet again.

<comment><USER6> I don't understand the argument that it's bad because it leaks the IP address to a third party. So would embedding any other resource hosted on a different domain - from JavaScript CDNs to images. No one is suggesting these should be blocked, right?

I have no problem with uBlock blocking requests to the CSP report-uri if the domain in question is on the user's filter list (I'd probably consider it a bug if it didn't do that), but that's not what is happening here (before this was fixed, that is).

The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, so I don't see how it's similar.

<comment><USER11> It is 100% clear to me that differences of opinion will result in drawing the line on an ad blocker's default configuration in different places.

Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I personally was unaware [edit]this could happen to me in Chrome with uBlock Origin installed[/edit] until this issue came up, and a free pass through ad blockers to a 3rd party seems like an advertising/tracking company's dream come true.

> JavaScript CDNs to images. No one is suggesting these should be blocked, > right?

Many of these [edit](specifically: tracking pixels and just straight up ad images)[/edit] are blocked by ad blockers in the default configuration.

> The Tor-captcha-thing was about leaking the origin IP of the Hidden Service, > so I don't see how it's similar.

Thank you for the correction. I apparently imagined this referenced when partial VPN or Tor is insecurely used only to access specific domains, or DNS is not also routed through.

[edit] updated with a bit more detail

<comment><USER6> > Would you mind sharing how long your browser was sending CSP reports to 3rd > parties before you knew about it?

I'm not sure what you're asking - when did I become aware of this possibility? I guess when I learned about CSP?

> I personally was unaware this was possible until this issue came up, and a > free pass through ad blockers to a 3rd party seems like an > advertising/tracking company's dream come true.

Adblockers block requests to things like Google Analytics by matching the domain (and other patterns). Why is this not an acceptable solution for CSP? If tracking tools start using CSP for this, they'll be added to the filter lists, just like any other tracking script. We're not asking uBlock to block _all_ third-party requests on the off-chance it might be an ad or tracking service, so why would we do that for CSP?

> Many of these are blocked by ad blockers in the default configuration.

Do you have a source for this? This would break a large number of sites. uBlock seems to have an experimental feature that mirrors certain popular CDN URLs locally, but it doesn't seem to be enabled by default and the Wiki page hasn't been updated in over two years. AIUI, even with this feature enabled, requests to non-popular (non-local) assets would still go through.

<comment><USER11> > Why is this not an acceptable solution for CSP? If tracking tools start > using CSP for this, they'll be added to the filter lists, just like any > other tracking script. We're not asking uBlock to block all third-party > requests on the off-chance it might be an ad or tracking service

This is a good question! When a new technology arrives that allows tracking, I prefer uBlock default to blocking it. Advertising/tracking companies pursue the bleeding edge in their cat & mouse game; this way the barn door is closed before the horse leaves (two too many animal analogies?). I do understand that others will pursue a different choice, and encourage disclosure by those doing so because money is on the line.

The discussion regarding CSP has resulted in a change in uBlock's default behavior which I will take into consideration the next time I re-evaluate which ad blocker to use.

PS. In case it's not clear, I originally commented: >Personally I would prefer only same-origin reports.

PPS. This is a much jucier target assuming it works when JavaScript is disabled.

</comment></comment></comment></comment></comment></comment><comment><USER12> Ok... So... i just signed up, and it walked me though some steps. Verify Email: Done, Customize (change reporting URL): Done... Configure: (change some domain filters)... Done... 2FA: Done... but how do i actually set this up?! like, what do i need to put on my site to enable this?! WTF?! is this done at a page level? (HTML inserted into the page) is it at a server level (Nginx, Apache?) Or is it done somewhere else?! where do i set this up?! more digging required, but it would have been handy to have a guide for what i need to install...

<comment><USER5> [https://report-uri.com/account/setup/](https://report-uri.com/account/setup/)

But yeah, it seems like they could really use some instructions on how to set this up for people unfamiliar with how the Web Reporting API works. The documentation you're looking for is here: [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Co...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri)

<comment><USER13> > Deprecated

> This feature has been removed from the Web standards. Though some browsers > may still support it, it is in the process of being dropped.

Ok..

<comment><USER5> Keep reading:

> Though the report-to directive is intended to replace the deprecated report- > uri directive, report-to isn't supported in most browsers yet.

So it's deprecated, but until it's replaced by report-to (which works in a very similar way) report-uri is still the proper way to make this feature work.

I would have linked to report-to instead, but MDN doesn't have good documentation on that yet.

</comment></comment></comment></comment><comment><USER14> > ...embeds an XSS attack in the TXT record of a DNS entry which then renders > into the output of a WHOIS service

I'm not even mad, that's amazing.

<comment><USER15> There was a particular domain that, when queried at most whois services, would play the harlem shake in your browser. It worked nearly everywhere that did such lookups.

<comment><USER16> It was linked in the next sentence of TFA: [https://www.youtube.com/watch?v=1anIUDvdCjY](https://www.youtube.com/watch?v=1anIUDvdCjY)

The domain was forfun.net

</comment></comment></comment><comment><USER17> Isn't it pretty easy to exhaust anyone's quota -- for the write key is visible in html source code?

However it is not specific to this service but I have always wondered why this design(write key public and quota system) works, while it shouldn't.

<comment><USER18> There's nothing to gain from exhausting someone else's quota. People will go to great lengths to exploit anything for profit, but just messing with other people without anything to gain personally -- that's not a good motivation.

<comment><USER5> DDOS attacks are a well-known attack that falls under the same category. I wouldn't be so quick to dismiss this as a valid concern.

</comment></comment></comment><comment><USER19> For CSP also check this great Firefox add-on by Mozilla [https://addons.mozilla.org/en-US/firefox/addon/laboratory- by...](https://addons.mozilla.org/en-US/firefox/addon/laboratory-by-mozilla/) . It generates and allow you to test the CSP header.

</comment><comment><USER20> Is it really a failure if X-Frame-Options header is missing on a blog? If it is a failure then why not just make it not possible to use iframes at the browser level.

Without context, this service misrepresents the real security of any given site.

<comment><USER21> To be fair, the challenge of nearly all security assessment tools, including Security Headers, is they don't understand the context of what they are assessing. X-Frame-Options on a blog isn't a big deal. X-Frame-Options on a SaaS app can be. That's why blindly scanning something and then saying "look at all these vulnerabilities" is a pretty poor way to assess the security of a service.

</comment></comment><comment><USER22> Is the HPKP he mentions as a security measure the same public key pinning chrome did just announce the deprecation date, because it is too risky to do; or are these different concepts?

<comment><USER23> It's the same thing. There are some differences of opinion on the matter.

<comment><USER24> Actually Scott Helme (mentioned in the article) also came to the conclusion that HPKP does more harm than good: [https://scotthelme.co.uk/the-death-knell- for-hpkp/](https://scotthelme.co.uk/the-death-knell-for-hpkp/)

</comment></comment></comment><comment><USER25> Sentry can also handle CSP reports effortlessly, and it's all open source. I had a quite good experience with their ease to use UI.

</comment><comment><USER26> I really hope that this somehow will improve the adoption of CSP.

Getting CSP right is quite hard and I have seen many big sites just using it in report only mode ( forever).

</comment><comment><USER27> what about, who cares?

<comment><USER28> Could you please stop commenting like this?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER29> What a great "I'm joining" post! Congrats Troy and Report URI</comment>


Paulson's Swindle Revealed - <AUTHOR> http://www.thenation.com/doc/20081110/greider2 <comment><USER2> The US government shouldn't be able to get as good terms as Buffett. He is a marquee investor whose investment improves Goldman's image, whereas taking money from the government makes it seem like the company is in trouble. He also invested earlier, when they may have been in more of a pinch.</comment>


.net Awards 2011: the top 10 young developers of the year - <AUTHOR> http://www.netmagazine.com/features/net-awards-2011-top-10-young-developers-year <comment><USER2> Why is it the top 10? Their profiles seem really standard for developers aged 19. Who didn't start playing around with PHP and JavaScript at age 14?

<comment><USER3> Anyone over 30 :)

</comment></comment><comment><USER4> Are those being able to create websites and use fancy web frameworks nowadays considered top developers?

</comment><comment><USER5> Isn't it interesting there's only one mention to C#, one to Java and one to Windows?

<comment><USER3> And basically all of them listed PHP.

I guess you need to be a little older to truly form a deep hatred for PHP.

<comment><USER6> Because PHP and the whole LAMP stack is like air. Everyone knows it because all you have to do to use it is just breathe. Anyone can just pick it up and immediately make an awesome website. It's a simple easy-to-learn language with dozens of easy all-in-one installers. No command line haxoring needed. Unlike ASP.NET, the tools are free. Unlike Rails or Django, hosting is cheap and easy to find.

With all the hate on PHP, I feel like it's the childhood friend from elementary and middle school that you out-grew because you became "too cool" for them in high school.

<comment><USER5> > hosting is cheap and easy to find.

It's not like you can get a private VPS for next to nothing and, with things like Google App Engine (which supports Python and Java) going for almost nothing, there is little reason to go with PHP unless you have most of your code already written in it.

</comment></comment></comment></comment><comment><USER7> It's interesting to see the kind of heroes these guys have. Wonder if that is general for their generation.

<comment><AUTHOR> General as in "shared by everyone" or as in "shared among geeks/nerds/people that are into development"?

Also interesting is their education, it's making it obvious that we are moving away from universities (although the sample isn't in any way big enough we can get the hint, I guess)

</comment></comment><comment><USER8> 6 UK, 3 US and 1 DE. I wonder what was the sample size like?

I also like the mag that's from 1994 with a 'beta' on its logo.

</comment><comment><USER9> Why only web developers?

<comment><USER10> .net is a magazine focused on web development.

According to the site, it's "The world's best-selling magazine for web designers and developers since 1994"

<comment><USER9> Oh, I thought the .Net had something to do with Microsoft's framework with the same name

<comment><USER5> It's weird Microsoft seems OK with the brand overlap...

<comment><USER11> .net magazine first launched in 1994 - well before Microsoft even dreamed up the .NET framework, hence nothing Microsoft can do anyway

<comment><USER7> And it's actually a pretty decent magazine. Much better than your average internet focused magazines out there.

<comment><USER5> And the title has always put me off...</comment></comment></comment></comment></comment></comment></comment>


Show HN: PatchBin.com - Pastebin for patches + comments + code review. - <AUTHOR> http://patchbin.com/haLJ28

<comment><USER2> XSS open. <http://github.com/ninjagod/patchbin/issues#issue/1>

<comment><AUTHOR> I disabled escaping because it had trouble rendering XML code. I thought it was safe but I was wrong.

Fixing now. Thanks! [edit] fixed

<comment><USER2> I played a bit with code and I think you could benefit from reading:

<http://www.python.org/dev/peps/pep-0008/>

<http://docs.djangoproject.com/en/dev/topics/forms/>

[http://docs.djangoproject.com/en/dev/topics/db/models/#many-...](http://docs.djangoproject.com/en/dev/topics/db/models/#many- to-one-relationships)

</comment></comment></comment><comment><USER3> I know horizontal space is tight, but it'd be nice if you could have 2 at- least-80-character-wide views (rather than hard-wrapping them at whatever they are now) when you have a wider screen. Looks good though.

<comment><AUTHOR> Thanks!

I'm having a tough time with CSS right now. I hope to add a client-side way to detect when the screen is large enough and show 80 character wide views.

<comment><USER4> $(window).width() will display the viewable width of the client in jQuery. and onResize will fire on <body> when the window is resized. (food for thought)

I think this is a pretty neat idea. Often a coworker is working remotely and our boss has been begging for some code review. This could have some use.

</comment></comment></comment><comment><USER5> I really like this implementation. Very clean, effective, and simple. I hope you continue to make progress on it ^_^.

</comment><comment><AUTHOR> To the folks who tried out the commenting:

A lot of comments are blank. If you entered valid text and that didn't get written to the database, and is a bug. Can you please describe any bad experience you had with the commenting system.

Thanks!

<comment><USER6> You might want to put a "cancel" button on the comment form. The blank comments might be people who are trying to get rid of the comment form after accidentally double-clicking.

<comment><AUTHOR> Done! Thanks!

</comment></comment></comment><comment><USER7> Nice. One minor nitpick, your django instance is running in DEBUG mode.</comment>