Germans are so scared of surveillance they microwave their ID cards - <AUTHOR> https://www.washingtonpost.com/news/worldviews/wp/2015/08/14/germans-are-so-scared-of-surveillance-they-microwave-their-id-cards/ <comment><USER2> To be precise it's not only our ID cards that we like to microwave but above all our passports.

The reason is that 2005 a new generation of passports was introduced, which contain RFID chips that can be read out wirelessly over a distance of a few centimeter (or in some cases even a few meters). In the beginning, these chips only contained a digital version of the information on the passport, i.e. the name, passport ID and photo. However, since 2007 the chips also contain the digitized fingerprints of the passport holder. Various organizations such as the Chaos Computer Club showed how easy it was to access that information and demonstrated that such access could even be done unknowingly to the passport owner, e.g. when walking by a (hidden) reading device with your passport in your pocket. So, quite a nightmare from a privacy perspective.

Back to the microwaving: While it is required to have a valid traveling passport if you wanna go abroad (i.e. outside the EU), it is NOT (yet) required to have a passport with a working RFID chip. Simply putting your passport into your microwave oven for a few seconds will irreversibly destroy the RFID chip while leaving the passport intact => Privacy problem solved :)

So the next time someone tells you that Germans are not very pragmatic or too obedient just tell them that we are microwaving our passports ;)

(I edited the first line to reflect the fact that they primarily talk about ID cards in the article, thanks to _more_original for pointing this out)

<comment><USER3> What is the effectiveness of RFID shields? Tampering with the passport is really a nono.

<comment> maze-le Very good. I made some tests, back when I was at the university. We had a Hardware Lab with Radio-Test Equipment and RFID Readers/Writers.

I have this one:

[https://shop.digitalcourage.de/thema/stoprfid/rfid-nfc- myfar...](https://shop.digitalcourage.de/thema/stoprfid/rfid-nfc-myfare- schutzhuelle-aus-metall-folienausfuehrung-leder-einfach.html)

It just works. The Signal/Noise-Ratio and amplitude of the RFID-Signal (in the casing) is just too small, to trigger a rfid response.

<comment><USER4> What material is actually used in your linked shield for "Schnüffel-Chips" [fantastic word!] ? Is it just foil lined or is there a mesh, what material is the mesh and what pitch?

I'd imagine you could have an active mask too [eg just a RFID with false data] that would return some signal just not the one being sought.

<comment> maze-le I don't know what material it is exactly but it is a mesh, and suprisingly thin and flexible.

Your idea of an active fake-chip is really nice, it could actually work (on non-encrypted content).

</comment></comment></comment></comment></comment><comment> dao- "On Tuesday, a 29-year old man was arrested at Frankfurt Airport after authorities noticed that he had microwaved his German identification card"

No he wasn't. The source ([http://www.faz.net/aktuell/rhein-main/mann-erhitzt- personala...](http://www.faz.net/aktuell/rhein-main/mann-erhitzt- personalausweis-in-mikrowelle-13747024.html)) linked to from the article says police confiscated the damaged ID card and gave the man a temporary replacement, and he could continue his travel.

Yet another glitch in this rather poor article. (Others have already pointed out other flaws that I won't repeat.)

</comment><comment><USER5> The casual xenophobia in this headline and article are crazy. Really, "Germans are so scared...", "Germans can't take a joke."?? We must have a little more nuanced view of the situation than that - just because there is a group of people doing something in a certain country doesn't mean that we should push the message that it is representative of the whole population. Wow.

<comment> maze-le Yep, thats about it, besides some hackers and hipsters, I don't know people over here who would even consider this. FYI, I didn't do it, I have a metal casing, that works as a faradays cage, to counter unwanted RFID emissions.

</comment></comment><comment><USER6> Well, and they've got every reason to be. The NSA and American airport security theatre made the world a place where microwaving your ID card actually makes a lot of sense.

> sales of old-school typewriters were reported to have skyrocketed

That's awful journalism and hearsay at best. Typewriter sales didn't skyrocket. Some authorities, notably services related to government and parliament bought some typewriters after the NSA breach and the most recent parliament security breach because they just couldn't trust their digital equipment anymore.

<comment><USER7> _Typewriter sales didn 't skyrocket._

If you dig back through the sources to the original quote you'll also find this further quote from the same salesperson of a typewriter company talking about their sales number:

"We've seen an increase because Brother left the market"

So he only said their sales went up, not the total demand for typewriters, and while he had seen some increased orders from various defense and security services, he attributed it largely to one of their biggest competitor leaving the market.

I also wonder how much the hipster movement has contributed to the increased sales in typewriters?

</comment></comment><comment><USER8> Deutschland: Das Land der Dichter, Denker und Paranoiden.

The article is a bit overblown, we are not really that scared. Actually most people don't care or even understand the implications. But privacy is a very big and deep-rooted thing.

These German microwave shenanigans are around for quite some time, but i haven't met one single person that microwaved ids or passports.

<comment><USER9> Since you're referring to the Dichter & Denker trope: that was originally about Germany having no copyright in the 18th century, so access to the works of the poets and philosophs was affordable and widespread.

So it doesn't refer to lots of poets and philosophs (Germany was probably below average) but to the wide distribution of their writing.

(my favorite anecdote from that time: Goethe, at some point, cited his own works. Since he didn't lug all that stuff around he worked from a copy he bought. Unfortunately it was an unauthorized copy containing modifications, which he didn't notice - and copied into his citation)

</comment></comment><comment><USER10> More like incredibly pissed and disillusioned than scared (in the US-meaning, not UK-meaning of 'pissed'). The article reads like us Germans are a bunch of tin-hat weirdos, and indeed, pre-Snowden I would have agreed and laughed at these silly people who think they're watched at every step, it's all just conspiracy theories right, it's all over since 1990, the secret service has no longer power over people etc etc etc?

Post-Snowden is an entirely different world, and I feel like the last 25 years were for nothing. The worst and silliest conspiracy theories turned out to be indeed true. The 'Free West' which was such a powerful and wonderful vision for the East German youth turned out to be just another variation of a surveillance state, just with a prettier paint-job.

So yeah, I'm incredibly pissed at the German and US governments and the secret services. The sad thing is that nothing at all would change with a different government.

[edit: typos]

</comment><comment><USER11> One can learn a lot from people that had suffered nazis and stasi not so long ago.

</comment><comment><USER12> _In 2010, a governmental survey came to the conclusion that it would "take ten years for the document to establish itself."_

This is because they have a validity of 10 years, nothing security related.

</comment><comment><USER13> In the future, I think it's far more likely that the US or UK will have a really horrible government, than Germany. Because the US and UK governments have been pretty good for such a long time, most people in those countries are not aware of the importance of privacy. And when the horrible government comes along, there will already be plenty of surveillance in place that it can use to tyrannize people.

</comment><comment><USER14> > "online formulas"

I'm guessing this was translated from German or something; isn't form "Formular" in German?

<comment><USER15> It is.

</comment></comment><comment><USER16> It's unclear to me why there needs to be any biometric information at all, on an ID card for use in a modern country like Germany. A chip-and-pin card with a ID number on it and your name (the latter simply so that you don't mix up your card with that from someone else). All the rest goes in a database.

The police can look up your "Virtual ID card" based on your ID number or from other information (a fingerprint, retina scan, name, etc.). Non-security institutions (other government agencies, a bank, whoever) do so only with your permission... you put your card into a smart reader, confirm with your pin, and your "virtual ID card" is shown to the person confirming your identity.

All access to the system is logged (including the police) so that the user can see who's pulled up his info.

</comment><comment><USER17> Yeah, and Americans are fat gun-wielding christians.

<comment> saiya-jin well, many of them are, just not all :) not that there is anything wrong with gun wielding, or being christian (nobody is perfect after all), that fat aspect not so much

</comment></comment><comment><USER18> How did difficult to assail ideas like Freedom of Speech come about?

I mean, speech can obviously be dangerous, lead to actions, incite, etc. But, unlikeable speech will garner some support when repressed because freedom of speech must be preserved.

When it comes to surveillance and a lot of other liberty relevant stuff, we don't seem to be able to draw lines. Regulations, promises and policies seem to be enough "as long is it doesn't get into the wrong hands."

What we end up with is a predictable immediate slide. Surveillance laws enacted to allow authorities to pursue terrorists are used in general policing. Financial restrictions enacted to fight organized crime, and "money laundering" end up restricting financial freedoms of anyone getting caught up in the "risk review" dragnet and being denied basic financial services.

Anyway, Germany and their living memory of the Stazi is a potential flag bearer for the freedoms that we are losing quickly.

</comment><comment><USER19> Let me fix that headline: "a few hundred Germans are so scared of surveillance they microwave their passports".

<comment><USER20> And if millions know that microwaving destroy the chip but the passport is still usable... did you still think it will be only "a few hundred" ?

<comment><USER19> Yes. Well, maybe a few thousand.

</comment></comment></comment><comment><USER21> Why not put it into a Faraday cage?

<comment><USER9> Like everything sold on [https://shop.digitalcourage.de/thema/stoprfid/](https://shop.digitalcourage.de/thema/stoprfid/) (the 'support shop' of an organization doing privacy advocacy)

</comment></comment><comment><USER22> "scared of" is not an acceptable synonym of "opposed to".

</comment><comment><USER23> I mean those silly Germans - they just can't take a joke about their own government as well as their partner, the U.S., spying on them and then using that information for their own economic interests or other more malicious reasons.

Lighten up!</comment>


Facebook is doomed - <AUTHOR> http://www.linkedin.com/today/post/article/20130917125221-8451-facebook-is-doomed?trk=tod-home-art-large_0&utm_source=buffer&utm_campaign=Buffer&utm_content=buffer07c5f&utm_medium=twitter

<comment><USER2> If I had a dollar for every doom and gloom X is Y post, I could finally buy that beach side villa in Danang and sip ca phe sua da's until I get diabetes.

What I find particularly curious about this post is how much this particular author wants to climb back into his mother's womb. I'm not being flippant or glib, re-read the post if you didn't catch it the first time around. He wants technology to think for him, he wants technology to coddle and embrace him so he doesn't have to think for himself. Google will drive him places, google will read his emails and predict his wants and cater his technology consumption to his whims, google will blast his retinas with all the contextual information he'll ever need without having to retain it or know it for himself. He's hoping for the technical equivalent of an antimitotic sac with Google branding all over it, washing him with vital information nutrients.

He also doesn't seem to get Facebook from a socioeconomic standpoint. Facebook doesn't need to do all of these things that Google _might_ do. Facebook just needs to let you feel not lonely when you are feeling lonely. Facebook just needs to connect you with those you aren't necessarily really connected with. Facebook, like it or not, is a new form of communication the same as the phone was, email is, SMS is, etc. The market will decide the value of that.

<comment><USER3> You're conflating facebook with social networking.

We've had social networking since before the internet was created, and one of the first things to have been done on the internet was social networking (message boards, email, instant messaging, etc).

Facebook is simply one implementation of social networking. There were others, and are still others. For example, email, instant messaging, forums, still exist, as well as new stuff like Pinterest, tumblr, twitter.

Facebook's size is due to network effects, not necessarily because a company like Google is incapable of technically matching facebook's product, or because facebook is dominating with its product. For example, Google was able to grab over 50% of the smartphone market share when it focused its efforts on Android. But, it basically has an insignificant share of the social networking market with Google Plus. Why? It's probably because social networking is more winner-take-all. But this doesn't mean Facebook has won, as the barriers to entry for creating the technical product of a social network is simple. This means facebook has limited control of its users. We grant facebook the monopoly, and it really has limited opportunity to screw us or extract money from us, for once they go over the line, we'll all spill over like water to something else like Google Plus.

</comment></comment><comment><USER4> Good old jingoism ... and nepotism towards his friends, Kurzweil. People like Gruber and Wadhwa should not hold so much sway with normal masses. Just read these two sentences.

"Google already reads my emails before I do, and, by analyzing what I search for on the Internet and which Web sites I visit, knows what I am thinking. It "knows" what other people think about me. If my friend and noted futurist Ray Kurzweil succeeds in his mission at Google, it will understand my wants and needs too. It will predict what I want to search for, where I want to go to, and what I want to eat. It will understand how my brain thinks and become my personal assistant."

"Contrast this with what we can expect from Facebook: more ads, more annoying sponsored posts, more intrusions of privacy. "

<comment><USER5> Those two sentences make perfect sense. People go to Facebook to socialize, to Google to search. This naturally leads to the conclusion of Facebook going with very constricted models of monetization like having intrusive ads, selling your private information, showing sponsored posts. Google is in a more natural position to advertise, it doesn't have as much to gain by showing you annoying ads as Facebook. In addition to all of this, Google does not seem afraid to venture out into completely new areas. I'm not saying Google is an innocent saint that'll never do any wrong, but it's pretty clear Google's future is markedly brighter than Facebook's. It'll be interesting to see how Google+ shapes in the coming years. One interesting possibility is Google+ having no ads at all (it currently does not have any) for all of its life, _because Google can afford to do that_ and everyone will like that.

<comment><USER6> Google's future is markedly better than Facebook's ? No way.

Facebook has stickiness and the network effects to keep people on it. Google has none of that. If a better search engine appeared overnight everyone would switch to it and that would be the end of Google. If a better social network appeared very few people would switch. In fact I would postulate that if Microsoft managed to convince Mozilla and Apple to change the default search engines to Bing that it could be almost enough to send Google into a death spiral.

<comment><USER7> How many people do you know who use gmail? Every time they go on the webmail client they are pretty much back on Google's homepage.

Between all the people who use Android, Chrome, gmail etc, Google would be just fine if Apple and Mozilla changed default search engines.

At the moment, Facebook are a one trick pony that many people can easily live without.

<comment><USER8> Literally one-hundred percent of the people I know who are really serious about email are moving away from Gmail. It was only in mid-2012 that they passed Hotmail for being the biggest email service in the world. Gmail is very popular among certain types of (mostly technical) people.

In fact, it's probably Android that has put them over the edge. Gmail still has a fragile position. At least as far as my browsing habits are concerned, using Gmail didn't lead me back to google search or any of their other services.

Could you imagine what the world would look like if somehow in 4 or 5 years Firefox OS ended up eating Android's lunch?

Search is a major component of their advertising business, which these days is their core business. If people switched they'd definitely be in a major pinch.

<comment><USER7> Most people I know use gmail, and not a single one of them is thinking of changing due to privacy concerns (as far as I know). What better option is there for a non-technical person anyway?

80%+ of people who own smartphones use android, and they have phones for most niches - big, small, cheap, stylus, unlockable, replaceable battery etc. They have several manufacturers making phones with it. Their position there is not fragile either.

I'd love to see Firefox take off, but there is no way it is going to be bigger than Android.

Sure, there is a very small chance that everyone will stop using Google's products, but the chances of people moving off Facebook is much greater.

<comment><USER8> People said the same things about iPhones, Blackberries before that and Palm before them.

There is always some company that's going to eat the dominant company's lunch.

To think otherwise is to ignore history.

<comment><USER7> You are missing my point. It is not that it is impossible for people to move away from Google, just that it is far more likely that they will move away from Facebook.

And I don't remember anyone saying that people wouldn't eventually move away from iPhones, blackberries and Palm pilots. People might move away from Android, but it would take many years, and it probably won't be en masse to FFOS.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> In the past three days, I've read that the following companies are doomed: Facebook, Microsoft, Apple, LinkedIn, and Samsung.

Good thing I have so many blog posts to tell me about it! Otherwise, I don't think I would have noticed. After all, it's pretty hard to tell that Facebook is doomed, what with all the numbers.

</comment><comment><USER10> This was a bizarre read. Here's my favorite line:

 _" I expect that a successor to Google Glass will replace my laptop, iPad, and TV; incorporate voice recognition and gestures; and provide me with an immersive 3D-viewing experience."_

If you aren't convinced that Google is doing amazing things, then just look at this feature list I made up in my head for the next version of a product that hasn't even shipped!

Stand clear when those expectations collide with reality.

</comment><comment><USER11> Last time facebook was doomed they managed to set an all time stock price high by getting their shit together.

Google has been public for 9 years now, facebook is just over a year. To call them doomed because they seem intently focused on controlling their rollercoaster stock price seems a little short sighted. At least give them the chance to get their house in order before lambasting them for not spending enough money on trying to make people live forever.

<comment><USER4> Every tech company is doomed, except Google.

</comment></comment><comment><USER12> Not a very good article. The author implies that there will be a mass migration of users to another service if Facebook remains stagnant in terms of carrying out acquisitions. But Facebook continues to improve and update the user experience, so there is little incentive for users to move to a would-be competitor. Not when they already have connections with family members, close friends, and many others. Facebook has very much become a part of many users daily lives like using the Internet, and users have already invested a lot into Facebook; it's like a sunk cost. FB may remain static (in the same niche market) if they don't carry out more acquisitions, but that's (may be) fine. They can't be "doomed" just because other companies are carrying out more acquisitions.

</comment><comment><USER13> This article is quite sensationalist and doesn't seem to consider the fact that every company today is in a different stage of its life cycle.

FB was founded in 2004, while Google was founded in 1998, so it's appropriate to compare today's Facebook with 2007's Google, pre-android and all.

Box was founded in 2005, salesforce: 1999, linkedin: 2001, jawbone: 1999, workday: 2005, amazon: 1994.

Note that the two oldest companies in this list are Amazon and Google, so it's no wonder that they are the ones who have expanded the most beyond their initial markets.

It's always taken a while to build a great company that competes in 2+ markets, and that hasn't changed.

</comment><comment><USER8> This guy seriously thinks that people don't hate Google?

Has he not been paying attention to all of the hate been directed at them at this year alone? After Reader? After the NSA leaks?

<comment><USER14> The number of people who've actually stopped using Google is probably _tiny_.

People have been complaining about FB for years, and yet they're still huge.

<comment><USER8> The number of people who've stopped using Facebook is pretty tiny when you consider their usercount as well.

</comment></comment></comment><comment><USER15> _Google's Wi-Fi balloons, called Google Loon, could provide me with connectivity when I go hiking in the mountains_

Don't people want to disconnect anymore or is just me?

<comment><USER16> And possibly miss reading about what one of my friends ate for breakfast? Are you _mad_?

</comment></comment><comment><USER17> I mean, points on Google being a broader, more innovative company with a larger vision are well taken. And Facebook is still the college dorm room social network. But it's hard to see how a site with 1.1 billion global users will shrink to irrelevance any time soon. Even if it loses 600 million of those users, 500 million people are still using it. Facebook is not doomed by any stretch of the imagination, unless I'm not seeing your definition of 'doom.'

</comment><comment><USER18> They may be doomed but they are giving their stock holders a nice return. (disclaimer I hold FB stock, not a lot but whatever).

The weird thing here is that Google wouldn't be so damned focused on ruining their primary product (search) if Facebook wasn't doing as well as it is. So I measure Facebook's success by that, how much Google is willing to damage their bread and butter properties to compete. By that measure they are doing just fine.

</comment><comment><USER19> if facebook is able to continue on their mission of "connecting" people and using the registered folks to figure out ways to make it useful, i am sure they will be around for a while.

maybe if it became less "buzz worthy" (ie, teen-focused) and more boring/pragmatic, it could find even more uses for the network and ways to be ubiquitous for a long time. seems like they could displace a lot of firms out there - linkedin being an obvious example. (i know everyone has linked in in a different mental box than facebook, but that could change.)

of course - no company lasts forever. very few companies sustain for 30-40+ years. it's not necessarily a reflection on "the company" that this happens, virtually every company is flawed in some way and time exposes the cracks and can break it apart.

</comment><comment><USER20> Why stop with Facebook? Any company, that does not have self driving cars and Internet balloons is doomed.

</comment><comment><USER21> This is actually just straight up stupid. In so many ways, that I don't care to do a useful deconstruction of the post.

I think we should expect a "Facebook is doomed" article at least once a month and just ignore them because they're usually baseless.

</comment><comment><USER22> Can the writer of this article read what he's saying? "Fb is lame because they're just using my data to sell me annoying ads...Google on the other hand is learning about me with my data!" (Which they will use to sell you ads)

</comment><comment><USER23> #1 [http://pandawhale.com/post/6939/reading-hacker-news-as-a- non...](http://pandawhale.com/post/6939/reading-hacker-news-as-a-non-cs- liberal-arts-major-bay-area-quarter-life)

</comment><comment><USER24> This author likes to make wordy predictions and kick up a buzz. That allows him to maintain his 'opinion leader' status. He doesn't have much of real substance to say..

</comment><comment><USER25> _> It will, for sure, buy or copy more hot products such as Instagram, Pinterest, and Foursquare._

I'm pretty sure one of those happened already ...

</comment><comment><USER26> Well, before Facebook or MS or Google is doommed, I am sure BlackBerry is doomed first.

<comment><USER4> hahahahahaha. Its true, but the Waterloo giant going down still saddens me. Well, it had its glory days.

<comment><USER26> The thing is no single company can survive forever. Soon or later big companies have to be broken up to survive. I'd imagine in the future Google and Apple will face the same problem that MS and Blackberry are facing. Their products are now commonly seen and used don't really mean their business can go well forever. Without attractions (from both users and news reporters), new competitors can sell similar products in more compelling ways and then steal the market.

<comment><USER21> Now explain IBM.</comment></comment></comment></comment>


Rewriting Playdar: C++ to Erlang, with code statistics - <AUTHOR> http://www.metabrew.com/article/rewriting-playdar-c-to-erlang-massive-savings/

<comment><USER2> The stats are misleading, as it's not a comparable rewrite. The new code is refactored and much cleaner. For example, for "LAN Resolver 105 vs 427" a 75% saving. I looked at the actual code (thanks for posting it.) The C++ code contains a lot of cruft like explicit handling of ping/pong/pang and a http handler with some html snippets, which the new code doesn't have. I removed the cruft and result sloc is 105 vs 302 (still include all the boilerplate stuff: includes/namespace, the quite verbose asio server setup that can be refactored, and the line wasteful brace usage.)

The erlang code is also much denser. I gziped the code to compare a fairer symbol count: it's 1535b vs 2916b, a 47% saving, not bad but not that impressive either, considering the refactoring in the new code.

From user's point of view, the new distribution is 4x larger (10MB vs 2.5MB) and uses much more memory, which is a bad deal. It's OK for a developer to scratch his itch but dramatizing the benefit of such scratch doesn't help anybody.

<comment><USER3> When the developer claims that Erlang only uses "slightly" more memory and is currently not optimized for efficient memory use how exactly do you get to "uses much more memory"? The difference between 10M and 2.5M for the distro size is so slight given current average broadband speeds as to not even be worth mentioning.

</comment></comment><comment><USER4> By the way, you really should try out Playdar - it lets you stream your music on any of your computers from any of your computers. It also lets you stream from your friends, and there is a darknet plugin too. Even neater is how it interfaces with the web - you run a greasemonkey script for each website you want to use (say, Last.fm) which inserts a play link next to each track. The browser then talks to playdar which goes off, finds the song and streams it to you. It's really neat.

</comment><comment><USER5> This is interesting and valid, but to be fair it looks like playdar operates entirely where C++ has no advantages: io bound. It's surprising he didn't figure it a bad choice the first time around. Comparing Erlang to a Perl or Python version would be more interesting.

<comment><USER6> Ten months ago RJ wanted to write Playdar in Erlang but was worried about the portability of packaging and distributing the Erlang VM. As it stands this is still an untested area for desktop software… but ten months gives you a long time to think about things, and it's going to work, so yay.

<comment><USER5> Distributing Erlang applications may be untested, but there have been good canned cross platform packagers for Perl for some time now. I'm sure the situation is the same for Python et al.

<comment><USER7> While what you say is true, I'm not entirely certain what your point is. If distributing Erlang applications is/was untested, and (assuming I understand the article correctly) this is a data point regarding distributing Erlang applications, what do cross-platform packagers for Perl have to do with it?

<comment><USER5> There was no reason to write it in C++ or worry about the difficulties of distributing an interpreter in the first place. There were good tools already. Stepping out on a limb and doing it with Erlang was unnecessary. I thought the thread was fairly obvious.

<comment><USER7> I'm unclear about what you mean by "unnecessary". In the strict sense, rewriting the software at all was unnecessary; in the very strict sense, writing it in the first place was unnecessary.

My best guess at what you mean is that they incurred unnecessary risk by rewriting it in Erlang as opposed to some more mature language, but even then I'm not certain what would be meant by "risk", given that it's an open-source project that is distributed for free. In that context, it wouldn't be a business risk in any sense (particularly given that one could just decide to scrap the rewrite if it was turning out poorly).

Might it have been easier in Python or Perl? I have no idea, but it seemed to work out well enough in Erlang, so Erlang would appear to qualify as a "good tool" in this case, at least.</comment></comment></comment></comment></comment></comment>


Ask HN: Would you book an appointment with your doctor on Facebook? - <AUTHOR> If your doctor had a Facebook page, would you feel comfortable booking an appointment through a widget on their FB page? How about if they were using Messenger and you could chat with them to book an appointment? Does the convenience out weigh any concerns you may have over privacy issue? Lets assume that you would only be booking an appointment and not providing anything more than your name and contact info.<p>Background: I am one of the founder at Luma Health. We are trying to make it easier for patients to see their doctor. <comment><USER2> I'd do neither. It's not necessarily a privacy thing because my health info isn't very sensitive and FB already knows absolutely everything about me.

It's more that Facebook is a place where I socialize, read news, and find local events. Booking a doctor's appt is a totally different use of the service and feels as weird as, for example, doing video calls through YouTube.

I also think people have been burned by the "I think I'm doing something private on FB, but it somehow got published" experience in the past, and this would make them super nervous.

And, finally, I'd imagine this would violate HIPAA laws because Facebook's DB would be holding sensitive health data about your users, so I'm not even sure this is legal without a partnership with Facebook and their own HIPAA compliance.

Edit: HN is also a bad place to ask about this because a lot of people here are privacy wonks and won't even use Gmail or Facebook. Researching products for general consumers is fairly uninformative here.

Edit 2: Actually, I'm sort of horrified if you don't already know the HIPAA implications. Doesn't your company deal with those every day?

</comment><comment><USER3> How in the world would this comply with HIPAA? Facebook makes no bones about the fact that they have no interest in handling regulated medical data...

And if you don't think the fact that I booked an appointment with a specialist is HIPAA protected, I suggest you dig into the regulations that control your market a bit more.

</comment><comment><USER4> I'd never do it either, not because of privacy concerns but ethical reasons against Facebook benefitting from whatever they gather about such transactions.

To the other commenters, I'm sure the poster is aware of HIPAA. Luma Health works with Aptible, an "HIPAA Security and Compliance Platform". (Source: [https://www.lumahealth.io/about-us/](https://www.lumahealth.io/about-us/) near the bottom, and [https://www.aptible.com/](https://www.aptible.com/))

</comment><comment><AUTHOR> Thanks for your comments.

This was informative. My question was not so much whether this is HIPAA compliant. There are obvious problems. My question was whether people have the appetite for even wanting to book an appointment on FB. Smt88's comment on YouTube and video call says it all. My sentiments were the same.

</comment><comment><USER5> never. HIPPA violation</comment>


Python Interview Questions. Part II. Middle - <AUTHOR> https://luminousmen.com/post/7 <comment><USER2> Some of these questions cannot correctly be answered by someone with only "Middle" experience in Python.

"Let A and B be objects of class Foo. What functions and in what order is called when print(A + B) is executed?" That's pretty complicated. Does Foo implement __add__ or __radd__? Are either of them descriptors? Does Foo implement a metaclass? Do I assume that the addition will return a Foo?

The "Is there an assignment operation in python?" depends on if PEP 572 is considered a definition of what's in Python. Issue35224 is currently in patch review, so perhaps soon it will be in master.

The "How are Dict and Set implemented internally?" depends on the implementation. Are we talking pre- or post- 3.6? I only know the pre-3.6 implementation, and even then only vaguely.

"How memory is managed in Python?" is a very complicated question. There's reference counting and cyclic garbage collection and free lists. And special memory management during program exit. Likely more.

"You have a function that takes other functions as an argument. How to validate the value of an argument?" I have no idea what this means. I think it wants the magic word "callable", but callable() only checks to see if something _appears callable_. The documentation says 'If this returns true, it is still possible that a call fails'.

"You need to implement a function that should use a static variable (for example, a call counter). You cannot write any code outside the function and you do not have information about external variables (outside your function). How to do it?" What does this mean? Python doesn't have static variables. Is this asking for something like:

      def spam(i):
        spam.call_counter = getattr(spam, "call_counter", 0) + 1

or def spam(i): x = globals() key = "++tDHYHd9udBFG5LT" x[key] = x.get(key, 0) + 1

I would reject either one in code review.

With the "Q: Add some code to make it work". It doesn't make sense. What's it supposed to do? And why "I" and "i"? I think this is supposed to give the right answer:

      Repeater = iter
      repeater = Repeater('Hello')
      for i in repeater:
          print (i)  # hello

The example with "print x," switched to Python 2.

The list() in the following is needless obfuscation:

      x = [[0], [1]]
      print(len(' '.join(list(map(str, x)))))</comment>


A first-principles implementation of arithemetic in Python - <AUTHOR> https://github.com/bjackman/pynum/blob/master/number.py

<comment><AUTHOR> I was thinking about the nature of numbers after reading this[1]. It occured to me that you could implement them in software. I couldn't get the idea out of my head so to calm myself down I just decided to get it done.

It lacks elegance in certain places (it uses loops, there is definitely a nicer way out there of defining zero-ness, and the Number.one etc variables are a bit ugly), so feel free to fork it and beautify it (or add features).

[1] [http://betterexplained.com/articles/a-visual-intuitive- guide...](http://betterexplained.com/articles/a-visual-intuitive-guide-to- imaginary-numbers/)</comment>


MiniZinc: free and open-source constraint modeling language - <AUTHOR> http://www.minizinc.org/ <comment><USER2> Every time some OR or constraint programming language comes up, Håkan Kjellerstrand is an obligatory mention. He has a whole page dedicated to problems and examples for those, including MiniZinc: [http://www.hakank.org/minizinc/index.html](http://www.hakank.org/minizinc/index.html)

<comment><USER3> Yes, an impressive set of problems solved with an impressive set of solvers. Quite a bit of experience stored on that site.

One thing I'm interested to know (as someone with less experience in constraint programming), is when does one employ constraint programming engines like Choco, Gecode, MiniZinc etc, vs. when metaheuristics (such as simulated annealing, genetic algorithms, etc.) are a more practical solution. Is there a rule of thumb regarding the size search space, type of problem etc. ?

<comment><USER4> Constraint satisfaction is NP-complete and for optimization it's NP-hard. In theory that means it's going to be equally hard to determine how many steps solving the problem takes as it is to simply solve the problem.

Local search is always going to outperform global search but there's no guarantee of a solution or an optimal one. So it really depends on your needs and how long you're prepared to wait. Modern CSP solvers can handle impressively large problems with multiple thousands of clauses (1m+ for SAT), but it really depends on what your constraints look like.

</comment></comment></comment><comment><USER5> A constraint solver typically works by:

1\. Having a finite set of variables with a finite set of possible values

2\. Having a finite set of propagators which are monotonic on variables (that is, it either reduces the amount of possible values for a variable or does not (it never adds).

3\. A space describing a full set of variables and propagators

4\. A way of reducing the amount of values when all propagators have hit a fixpoint for some space.

5\. A way of rewinding state when some variable runs out of possible values

And then it basically (BASICALLY) runs this loop:

while(!solved(space)) {

if(failed(space)) {

    		rewind(space);

    	}

    	while(!fixpoint(space)) {

    		for(p in propagators(space))

    		{ p(space);

    		}

    	}

    	make_choice(space);

}

It's mainly used for solving NP-hard problems by being smart when attacking the full search tree.

<comment><USER6> So what differentiates the solvers then? Is it in how they apply the propagators? I'm interested because I naively wrote the exact loop you just posted, trying to solve a very hard problem. I spent ages trying different heuristics, but I knew I was floundering. Then I discovered Z3, which solves the problem in a tiny fraction of the time. It seems like pure magic, and I'm keen to understand how it works.

<comment><USER7> I haven't used all the different solver engines, and I haven't kept up with the field, but many years ago I had a license to IBM ILOG CPLEX, and it was interesting how much faster it was than some others. Gurobi is also very fast (I think they were started by the people who sold ILOG CPLEX to IBM), but haven't benchmarked it vs CPLEX.

<comment><USER6> So I haven't looked deeply into the capabilities of Gurobi and CPLEX, but I was under the impression that they focus on integer linear programming. How do they do with problems for which finding a feasible solution is very difficult?

</comment></comment></comment></comment><comment><USER8> There's a good MOOC on Coursera on applied discrete optimization that uses MiniZinc: [https://www.coursera.org/learn/basic- modeling](https://www.coursera.org/learn/basic-modeling)

</comment><comment><USER9> Fun fact: We're using MiniZinc and Gecode in production code to solve volume/product puzzles on oil tankers.

</comment><comment><USER10> Tried to use MiniZinc to write a model checker [1] for c programs a while back [2]. Essentially checking the equivalence of c functions that use only bit operations. It basically translates the programs into minizinc, then attempts to derive a case where the same input results in differing output. Was a fun way to experiment using the constraint solver for a practical application, though unfortunately didn't work as well on larger more complicated functions.

1) [https://en.wikipedia.org/wiki/Model_checking](https://en.wikipedia.org/wiki/Model_checking)

2) [https://github.com/dbunker/ArchStatMzn](https://github.com/dbunker/ArchStatMzn)

<comment><USER11> I'd expect a SMT (Satisfiability modulo theory) solver like z3 to work better for this use case, might be worth giving it a try. E.g.

      x = z3.BitVec('x', 32)
      y = z3.BitVec('y', 32)
      i1 = x | y
      i2 = ~(~x | ~y)
      s = z3.Solver()
      s.add(i1 != i2)
      if s.check() == z3.sat:
          print "found counterexample"
          print s.model()
      else:
          print "always equal"

</comment></comment><comment><USER12> People need to specify what type of constraint their solver handles. It's a rather large space, and to not even mention what type of constraints on the page is a major oversight.

<comment><USER13> Hear, hear. Is this good for optimization problems over the reals, or only finite-domain problems? If the former, can it solve nonlinear problems?

<comment><USER14> Some of the FlatZinc solvers can handle (nonlinear) finite-domain problems, and some just linear MIP problems with floats.

Some solvers, e.g. Gecode and JaCoP, can handle nonlinear problems with floats as well as finite-domain problems.

<comment><USER15> _the_ hakank?

<comment><USER14> :-) Yes.

</comment></comment></comment></comment></comment><comment><USER16> Whenever I come across a post about constraint solvers, I refer back to this article for a great introduction to the domain - complete with examples and different progressive approaches - [http://www.jasq.org/just-another-scala- quant/new-agey-interv...](http://www.jasq.org/just-another-scala-quant/new- agey-interviews-at-the-grocery-startup)

</comment><comment><USER17> I've never heard of constraint programming languages before, and I kind of wish I had, because I recently had a problem where I needed to sequence a bunch of elements based on a lot of arbitrary rules. Sequencing based on one rule was easy, but applying all simultaneously was a huge PITA, and resulted in much headaches; this tool looks like it could have solved the problem quickly. Definitely putting this in my bookmark tool-set for future use.

</comment><comment><USER18> I would love to hear other applications of optimization techniques to HN readers.

(I used constrained quadratic optimization to fit transition matrices to population data for my dissertation, and for some other demographic estimation projects.)

</comment><comment><USER19> What is a constraint modeling language exactly? I briefly looked at the first example in the documentation, and it looks like you specify a problem and some type of solver solves the problem automatically? What algorithm is it running exactly?

<comment><USER4> "Constraint Programming" refers, for the most part, to the solving of finite- domain problems via backtracking and constraint propagation and is typically concerned with performing a complete, global search of the solution space.

[https://en.m.wikipedia.org/wiki/Constraint_satisfaction](https://en.m.wikipedia.org/wiki/Constraint_satisfaction)

<comment><USER19> I like this answer. However, by solution space do you mean domain space?

<comment><USER4> Yes, sorry, the search space.</comment></comment></comment></comment>


Generate and host static sites out of your WordPress CMS - <AUTHOR> https://www.wphyperfast.com/ <comment><USER2> It would be cool if it was a downloadable tool.</comment>


Scrum is the new waterfall - <AUTHOR> http://www.adambourg.com/2015/11/10/scrum-is-the-new-waterfall/ <comment><USER2> I've been at a few studios, all expounding how they're "Agile! Scrum! Fast- Moving!" And I've seen true "agile" horror shows.

Stand-ups consisting of everyone either A) trying to prove they actually did work yesterday in as many words as possible or B) taking this as a chance to have a nice chat with everyone. Hour-long daily stand-ups are not agile.

The worst though was the planning meeting for next sprint, where no one had a #$%^ing clue what they needed to do, what the priority was, where the dependencies lay. A day every two weeks you dread.

I think the big take-away is not to do Agile for Agile's sake. Do it to solve a problem- if developers don't know what each-other is doing, there's solutions. Working on a product with changing requirements? Work in sprints to be able to respond to that. But don't do it because it's what all the cool kids are doing.

EDIT: The inverse is also true, people. It's not supposed to be a religion, you can pick and choose practices and processes to fit your requirements. Do what you need to do to achieve the goals you want to achieve.

<comment><USER3> At the university where I am, we were discussing today in one compsci class how agile is something that only works if you don't care about consistent quality and only care about always having the newest, shiniest, greatest.

And how, if you are working on software for ESA, or working for one of the largest internet retailers, or if you're writing a control software for railway switches, waterfall is the only possible option.

Even if the target is moving, agile is never able to provide quality.

Some of my professors were hired before by large internet retailers to spend weeks trying to understand even their business processes, as the retailer had built their infrastructure without oversight and every employee was working on whatever they wanted.

Just this "trying to understand what even is going on" helped them improve their processes and greatly increase their profit margin, as they were able to make many things more efficient with rethinking and rewriting.

 _EDIT: I'll add my definition of quality here: Your software is able to interact with third parties without them ever having to rewrite their software, your software can run for decades without or with little maintenance, and your software is well documented. In my opinion, Agile is very ill suited for these requirements. One example is the Internet of Things, where you can be sure no one is ever going to update their smart washing machine_

<comment><USER4> That's not true. Quality and agile process are almost orthogonal. It is entirely possible to develop extremely high quality software within an agile environment and very possible to develop extremely poor software using waterfall.

Agile doesn't mean "every engineer working on whatever they wanted."

Ultimately quality software results when developers place a priority on writing correct software and when management is truly committed to creating high quality software and all of the expense that includes.

<comment><USER3> > Working software over comprehensive documentation

> Responding to change over following a plan

These statements from the agile manifesto are directly opposite to any kind of quality software. Documentation and Code Quality are some of the most important features. Your software is not working if it doesn't exactly match its documentation.

You can live with that in web software, but you'd end in jail if you tried to write security critical systems like that.

<comment><USER5> Whenever the manifesto says "X over Y," it does not suggest this is a strict dichotomy. I have worked in an agile manner on software that had extremely well-documented behaviour and all sorts of documented, objective requirements.

The expression "Working software over comprehensive documentation" simply emphasizes what matters at the end of the day: Working software. If you need a certain amount of comprehensive documentation to prove that the software works, you incorporate that documentation into your process.

It's the same as emphasizing collaboration over contracts. I worked for a decade in consulting, I assure you there are contracts with clients even when you use Scrum. You don't refuse to have any hard, contracted, binding commitments. It's just that you prioritize collaborating with people over setting up solitudes that communicate by throwing contracts over a wall.

As for responding to change over following a plan, if you can set up an environment where there are no changes allowed to interfere with the plan, by all means ignore change and follow the plan.

But if you actually have changes that matter, you need to deal with them too. But that doesn't mean don't plan, or never follow any plan. It just means, respond to changes that matter.

For example... What if you discover that the security for a piece of software need to be updated. You'd respond to that, wouldn't you? You wouldn't push on to finish what was originally planned with your fingers in your ears?

These are guidelines. They're motivating forces. You are supposed to do it in harmony with the hard requirements of your business and domain.

<comment><USER3> Documentation can also be useful without working software.

For example, when you have to interface with others. They can work on the software that depends on yours before you have even written a single line of code, and it will work.

Software without documentation also can lead to serious issues – as in the "does the train continue running when the signal is broken" question I mentioned a dozen times now.

In actual critical projects, Documentation over software. The best software is nothing without documentation.

That's the first point where I have to disagree with it.

In many other points, agile leads to teams just carrying the technical debt with them.

<comment><USER5> > The best software is nothing without documentation

You know, it's not enough to restate your own points, you have to read and absorb the things other people are saying.

Once again, "Working software over documentation" does not mean "Working software instead of documentation."

It means that working software is more important than documentation, but both can be important. And it can be that documentation exists to make the software work.

If I said "Working software over software patterns," that wouldn't mean "Never, ever, ever use the Command Pattern, or Adaptors, or a Facade." It just means that you use those things to make the software work. And if they are essential to making the software work, they are essential.

So you tell me that software is nothing without documentation, and I happen to agree. But software is also nothing without binaries. But that doesn't mean "binaries over working software." It just means, "build binaries as part of working software."

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> The best project manager I ever worked with just wrote everyone's names on the board, asked what they were working on today, writing it on the board next to their name. You can imagine how the next day went; "So Andrew, how did X go yesterday, any blockers? Is it done? What are the issues, can we break this down further?"

It's all you need.

</comment><comment><USER7> I don't really agree with this - Scrum isn't really easy to do but in many situations it is the simplest approach to take.

If you need to monitor your progress in 'real' terms (i.e., whats actually completed) Scrum is pretty much the minimum ceremony you can get away with in my experience.

If you don't need to do that, say if you don't have a deadline that you need to know you wont hit ASAP, then Scrum is likely not a good fit.

> It's boring, its old, it leads to pointless meetings run by people who don't > write software, who don't understand the technical process behind writing > software and don't always care

I dont think these people are meant to be running scrums.

> Adhere to the sprint commitment, even if you have to work over time.

Yeah, and you will be if you dont adjust your commitments as soon as you realise youre not going to meet them.

> Agile is about moving fast, building working software today and delivering > with changing requirements

Yes it is. And scrum adds time tracking on top of that.

It sounds like you dont really know what the purpose of scrum is. And this is fair enough, because I dont think they had a very good explanatory service - it was pushed as the 'next big thing' like XML and SOAP was in the 90s.

<comment><USER8> _It sounds like you dont really know what the purpose of scrum is._

Unfortunately, every response to "we tried process/technique X and it failed" in this space is ultimately "you didn't understand it" or "you did it wrong".

So no _true_ scrum would have...

No _true_ Agile shop would have...

And where does that get us? It appears that the success rate of people understanding and implementing these things is very close to 0%. Maybe the problem is with the processes/techniques after all.

<comment><USER9> _It appears that the success rate of people understanding and implementing these things is very close to 0%_

I don't think this is the case. You're likely only hearing about the failures.

Here's a counterpoint – we implemented Scrum. It didn't cause any real issues, increased the speed with which we delivered features to customers, and increased the visibility of everything that was happening both within the development team and within the wider business.

Part of that was having a dedicated individual responsible for managing and implementing that process who made sure that it was actually achieving things we wanted to, rather than being a tick-box exercise, and who isn't afraid to make modifications such that the process better reflects the needs of the team.

In fact, I'd argue that the problem is completely the opposite to what you imply – it's not that people don't implement 'true' agile or 'true' scrum, but that they try to do so, rather than using these systems as a basis for building a development process that works for their team. No _true_ agile team is slavishly adherent to rules that don't work.

</comment></comment></comment><comment><USER10> As I experienced Scrum in practice, it is said that people should be "empowered". In reality, something totally different is happening: People are not empowered, but the management just delegates the responsibilities for the project to the developers and lays back, assured that they just have to wait for the "agile fruits" to be reaped. They have done everything, they could do, now the "empowered" employees have to see ...

Those poor employees might feel "empowered", but in reality, they are "impoverished". They are now responsible for the project, but often without amble resources needed. For example, when they need additional hardware or rooms or .... they are not empowered to get it. They are still beggars. Instead, they are empowered to work longer hours to reach the project goals they have set themselves. Why did they such a stupid thing? Because they wanted to look bright or because of group pressure or because they want a raise ...

And after they set their goals themselves, they are on their own.

This is not "empowerment", it is not about people -- it is just a good excuse for the management to get rid of the responsibilities and to "motivate" people to work longer hours. It is the newest "silver bullet" process of a project management that already lost control.

<comment><USER11> This. 1000x. This is definitely one of the pitfalls of poorly implemented scrum. For bigger companies, scrum tends to be a decision by the higher ups and implemented by the lower ranks keeping middle management is disarray over their role in the change. Moreover as the author mentions agile is about people first, but followed by processes. If scrum teams don't have the power, or empowerment, to change the processes, to become more agile, to remove blockers/impediments, the team burns out / self destructs for the precise reason you mention about spending longer hours achieve the committed (not to mention the committed is affected by the deadlines which are manipulated by management/or worse, external stakeholders) in order to uphold their word/project. To me there is a flaw here.

I do believe scrum can be an effective tool for a few use cases, but people often underestimate the warning signs. "Scrum is easy to learn, but difficult to master." \- [https://www.scrumalliance.org/community/articles/2011/may/sc...](https://www.scrumalliance.org/community/articles/2011/may/scrum- from-student-to-master)

<comment><AUTHOR> This is really the heart of it, I've really only worked in environments that have been top down as their implementation of scrum. When the engineer team got to decide, we picked Kanban. The lightest process for us.

Scrum top down. I buy that. Bottom up? I'd give it a try, but the team needs the ability to say "no".

</comment></comment></comment><comment><USER12> Scrum works fine when it's just programmers. Scrum and Agile become shackles when management gets involved and sees it as a status-checkup for their top- down view. The latter scenario seems to be 90% of situations, unfortunately.

</comment><comment><USER13> The fatal flaw of any process - scrum, kanban, waterfall, etc, is when engineering teams try to use them as a replacement for communication rather than as a communication aide.

<comment><USER14> Yep. Process is compensation for lack of talent, which may sound cruel or arrogant but it's not. If you're great, you can self direct, design, and implement what needs to happen in your project with no help or management at all.

It's totally okay not to be great, but when you're not great you need help, and help comes in the form of management, and management needs a way to set and manage expectations. Agile is one way, waterfall is another.

</comment></comment><comment><USER15> I don't understand why this is on the top of Hacker News. It seems to be one person's opinions and experiences about complex issues that face hundreds of thousands of engineers in thousands of companies across the world.

Nothing in the article makes me trust this persons perspective over any other. It's not thoroughly investigated with metrics over many case studies. There's no empirical evidence to back up his assertions. He doesn't have a reputation for other work that would make me trust his informed opinion over any others.

There seems to be hundreds of articles touting every possible side of this issue, why did this one strike a chord?

<comment><AUTHOR> Your right, I presented no evidence. Honestly it was a rhetorical post that I did not expect to strike the cord that it did.

</comment></comment><comment><USER16> Whats wrong with waterfall? Surely mis-using waterfall was the culprit. I'm guessing same goes for Scrum. I've never followed true scrum so my opinion might be jaded however the devil generally lies in the implementation of the process.

You cannot fit the same tire on a truck and a kid's tricycle, same way you cannot fit the same process for all development cycle. If you team needs clear direction and everything well defined (written in stone), follow waterfall. If your team needs formal process but can do some things on their own (say a team filled with new hires and one lone experienced dev), scrum might not be so bad. Kanbaan is good when everyone knows what they're doing and you really just want to know which stages do you need to focus more on.

You're best bet is probably to try all three and whatever else exists, mix and match until you can successfully deliver your products without a whole lotta overhead and then keep tweaking the process when conditions change (new hires, folks leaving, change in goals/features).

<comment><USER17> Waterfall is literally a strawman methodology made up to illustrate the worst possible way to build software (short of having a million monkeys trying random programs), in order to serve as contrast to a way that actually works.

<comment><USER16> I wasn't really going towards defending waterfall[1] but lemme give it a try.

Waterfall might be not bad when you cannot have feedback mechanisms, you cannot roll out changes in phases, where requirements/scopes are fixed, tech stack is well defined and products have matured enough.

[1] : wanted to more say, use the right tool for the right thing in the right way. I don't think its easy but its doable.

</comment></comment></comment><comment><USER18> It's amazing to me the lengths organizations will go to avoid the one thing that actually works: hiring a small team of really good developers, paying them a lot of money and giving them hard ship date.

<comment><USER19> That seems like laissez-faire waterfall to me. The problem with the "hard ship date" is that it usually comes with a set of expectations for what is ready on that date: If you need software X on July 1, what happens when software Y becomes more necessary on April 15?

<comment><USER18> A hard ship date and flexible requirements is the way to do it: you force the issue and require your (great) developers to immanentize the software. It clarifies the mind and, assuming you didn't start off with absurd goals anyway, you get most of what you want.

Most importantly, it gets you to ship.

</comment></comment></comment><comment><USER20> But then you're working in a bigger business where you do actually need to interact with managers and internal/external stakeholders. And they're all asking you: «When can you deliver?».

Yes, estimating is hard. It's impossible really, but everyone knows this and accept the consequences of delayed deliveries and blocking events. But they want status updates and delivery schedules all the same.

Pointless exercise maybe? But in real life and in business actually having someone thinking longer than three days ahead is usually a necessity, in my experience.

I agree though that you should minimize the amount of pointless meetings and solve blocking issues as they come - this is more a sign of a good tech lead and healthy work environment rather than weaknesses in the Scrum methodology.

</comment><comment><USER21> Scrum at its core is about setting your team up to LEARN and improve by introducing feedback cycles.

That's it.

If your team learns after one cycle that they are more effective without one of the common ceremonies, then your team should drop it.

The problem that Adam is observing is not with Scrum itself - it's that too many miseducated managers lose sight of the point and are obsessing over the wrong details.

Source: I have been on extremely successful Scrum teams, I have seen Scrum done properly dramatically transform "stale" teams, and I have trained with Jeff Sutherland, one of Scrum's founders.

</comment><comment><USER22> Any system implemented without an understanding of how systems work, and how humans interact with them, will be painful.

We need systems thinking, not any one prescribed process.

<comment><USER23> > We need systems thinking, not any one prescribed process.

Problem is, its hard to get people doing systems thinking, _especially_ about systems they are part of.

<comment><USER22> It's hard, but it's the only problem remaining.

</comment></comment></comment><comment><USER24> Straying away from any consideration of "how well agile was implemented", I've never been at a shop that seemed to get any real advantage by saying they are "agile". Although my experience is only 4 shops on that matter.

I would argue that since the method is deliberately left unclear, in reality it mostly profits to whoever wants to game it to his/her advantage. And if everybody wants the project to succeed as their respective primary goal, then you do not need such methodology anyway.

Do whatever seems to work best for the team, and don't name it. Don't waste time writing blog posts about how you found a new groundbreaking way to work, as these matters are subjective.

For example, now I work by asking whatever needs most attention right now, getting it done, and then asking again. No backlog, no notes anywhere, nothing. If we forget about something and it is important, it will come back up. It has no name and it works perfectly for us!

</comment><comment><USER25> Similar to choosing a web framework, most often the issue is with the people, not the methodology/framework.

</comment><comment><USER26> I'm at a small BigCo. We have a few pilot agile projects. Based on what I see them doing, and what I read in the article, it looks like scrums are two week death marches.

</comment><comment><USER27> This is so negative.

Look... the process can't be, "Hey you get all the time in the world to build undefined requirements with out providing any sort of insight." The reason you let people who don't code in to the meetings is because they pay your salary -- right? So translate. Give them something that makes them feel you are spending their money correctly.

It's not all that hard to just define requirements, put a line in the sand for what you think you can get done in a two week block, and show your progress on a board -- is it? This article seems to take the stance, "Devs are the only ones who matter and everyone else is someone who is going to make me sit in a meeting I don't want to be in." It's really immature to think this way, and short sighted.

You need some sort of process, some sort of roadmap, so your sales and marketing team can drum up interest for the product and the team can be successful growing the business. This isn't an academic exercise, it's a job, and you work on a team that requires communication to operate.

<comment><USER28> If the primary way information flows between teams in your organisation is by throwing everyone in a room on a bi-weekly basis, you don't have much of an organisation. That's not professionalism, it's bad management under the heading, 'better than nothing.'

</comment></comment><comment><USER29> If you got a bad development process it doesn't matter how you label it SCRUM, Waterfall or Kanban.

The main is issue is to implement SCRUM properly. If I have seen it both ways. The difference is like night and day.

</comment><comment><USER30> The problem is that Scrum is rather lukewarm agile. It's mostly about toe- dipping, not making big changes in how you think about how you work. It _can_ lead to this, but it just really often doesn't.

Firstly, Scrum too often becomes the waterSCRUMfall - you don't deal with the problem end-to-end, you insert a version of Scrum in the middle of a broken organizational context.

Secondly, Scrum also mostly has a lot to say about team organizational structure, reporting, and process (which managers like) but not so much about software development practices (which help you do your job). This can lead to busy work and misinterpretation from those who "manage" software rather than those who "do" software.

Thirdly, I have a theory that a lot of the fallout from Scrum and agile not working is due to people trying to find something easier to digest than Extreme Programming, which includes nearly all the development practices that scrum teams pick and choose. Once you look for something easier to adapt to, meaning you don't have to change everything, it becomes easier for agile consultants to keep modifying the already lukewarm process to be a 10% improvement of the mess you already have rather than a leapfrog replacement.

And the few times a leapfrog is OK, it requires a lot of organizational air cover and buy-in, top to bottom, because you can't "force" people to work in a very different way without it being rejected.

My view is - if your approach to building software is broken, and you want to do something different, you have two choices:

a) build a process organically from the top down and bottom up simultaneously - perhaps a mix of Kanban for change management, and individual development practices that the software teams & senior developers want to do.

b) if you have the willpower and lack the knowledge or patience, adopt a "more extreme" agile method like Extreme Programming, and complement it with organizational change management techniques like Kanban. And ensure you have people or partners that can really help you with it (at all levels - not just as "coaches").

Finally, Kanban is not a software development process. It's a change management process. You an evolve a software development process out of Kanban and picking/choosing from other ideas from XP or others. Kanban is good in that it allows you to tailor an approach that deals with "big picture" organizational change issues first -- trying to do too much and piling up requirements inventory or work-in-progress. But it doesn't say anything about how to build software.

</comment><comment><USER31> Where do I send my money! Scrum is the worst! Kill Scrum

<comment><AUTHOR> This made me laugh. Send money to adam dot bourg at gmail</comment></comment>


Web Performance in a Nutshell: HTTP/2, CDNs and Browser Caching - <AUTHOR> https://medium.com/baqend-blog/hosting-lessons-learned-6010992eb257 <comment><USER2> Somehow I knew before opening this article it would be from Baqend</comment>


The chip card transition in the US has been a disaster - <AUTHOR> http://qz.com/717876/the-chip-card-transition-in-the-us-has-been-a-disaster/ <comment><USER2> Much longer than swiping ? Is this for real ? I've been using a chip for almost a year, and it's not long at all. Hardly more than a few seconds.

<comment><USER3> in my experience, yes, it's for real. Swiping takes less than a second. The card takes 20-30 seconds easily.

Apple Pay is lightning fast, but a lot of point of sale units have NFC disabled, which is just silly. Then there are others that actually take Apple Pay and don't even know it. Whataburger is a good example.</comment></comment>


Achieving a Perfect SSL Labs Score with Go - <AUTHOR> https://blog.bracelab.com/achieving-perfect-ssl-labs-score-with-go <comment><USER2> > No HTTP/2 for you! - HTTP/2 was enabled by default in go 1.6, however HTTP/2 > mandates the support of the cipher suite > TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. As this is a 128bit cipher, it needs > to be removed. The only way to achieve a perfect score now is to disable > HTTP/2.

Why does it have to be this way?

<comment><USER3> I think something to understand here is that SSL Labs wants you to aim for A+, not for 100%. The numeric score is probably just to visualize what areas need improvement, and obviously 256 scores more than 128, but that's not an indictment of 128.

This article in a nice exercise, but not a guide you should follow in production. The HTTP/2 ciphersuites recommendations are great, and there's no security reason to disregard them.

<comment><USER4> Author here. This is exactly right.

I even go as far to say:

> You should probably stop here. Continuing to attempt to achieve a perfect > score will result in reduced client compatibility. This means that many > users will not be able to access your site.

I should probably have also said that it is unlikely to be their intentions. An A+ is more than good enough.

This was just an exercise to better understand how to influence the score with a Go server as I've read a few in the past for NGINX, Apache etc.

Aiming for 100% in all ares was just a fun, but mostly pointless metric. It did, however uncover a couple of interesting things along the way.

</comment></comment></comment><comment><USER5> This is an interesting example of how to get a perfect score on the ssl test.. but it's a terrible config for a production web server.

It only works with the following clients without an error.. since this is when these browsers added TLS 1.2 support (and this config requires tls 1.2):

      Android 5+
      Firefox 27+
      IE 11, Edge
      Opera 17+
      Safari 7+

It might work on some versions of Chrome after v30 (when tls 1.2 was added) but before they added the obsolete crypto warning (that this config triggers).

It pointlessly excludes clients since TLS 1.0, 1.1 and AES 128 are still considered secure.

<comment><USER6> >It pointlessly excludes clients since TLS 1.0, 1.1 and AES >128 are still considered secure.

Wrong. All AES-based ciphers in TLS 1.0/1.1 are vulnerable to the Lucky Thirteen attack. This can be avoided by careful implementation, however as far as I know the go developers don't even try to do that and say if you want something secure use gcm.

<comment><USER5> Wrong.

1\. TLS 1.2 is also vulnerable to the lucky thirteen attack.

2\. The lucky thirteen attack requires CBC-mode.. which is also what generates the obsolete crypto warning in chrome.

The solution here is clearly to disable CBC-mode.

[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf](http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)

</comment></comment></comment><comment><USER7> > This means I need to take the default CipherSuites and simply remove any > that use a cipher smaller than 256bit.

Arguably using a higher bit cipher suite should be considered worse, since it reduces accessibility. 128 bit crypto (specifically the GCM suites) are ridiculously faster, to the point where it is practically free to enable it for all websites. Treating 256bit crypto as better feels like it is missing a key point of security: availability.

<comment><USER8> It is not at all obvious which of AES-128 and AES-256 is more secure.

See for example this 2009 paper: [https://www.schneier.com/blog/archives/2009/07/another_new_a...](https://www.schneier.com/blog/archives/2009/07/another_new_aes.html)

</comment></comment><comment><USER9> Go encryption support looks really elegant.

Ironically just before reading this article I was reviewing a Java code change to force TLS 1.1+. The logic to set security protocols and ciphers correctly is quite tangled in part because it's not consistent across different libraries e.g., for JMX and SSL sockets. I still can't tell if the code I was reviewing will work in production.

Has anyone posted a general comparison of Java vs. Go on security? This deserves a closer look.

<comment><USER10> Go's TLS and crypto is across the board better than Java's. I wouldn't choose a language based on its TLS stack, but if you were in a weird position where you had to do that, you'd pick Go.

It's not a fair comparison: Go has a TLS stack that is shepherded by Adam Langley, who is one of the Internet's foremost experts on TLS.

<comment><USER9> Perhaps not but it is astonishing to me that many (most?) of the comparisons between Go and Java omit security. In particular, it's hard see how you can assert Go (or any language for that matter) is well-suited for distributed computing without considering issues like authentication and encryption.

Here are a couple of examples of what I mean. [2] cites use of Go in financial apps without a single mention of security.

[1] [http://thenewstack.io/a-closer-look-at-golang-from-an- archit...](http://thenewstack.io/a-closer-look-at-golang-from-an-architects- perspective/)

[2] [http://www.techworld.com/apps/why-googles-go-programming- lan...](http://www.techworld.com/apps/why-googles-go-programming-language- could-rival-java-in-enterprise-3626140/)

<comment><USER10> I don't understand this argument. I'm a security practitioner and, in particular, a software security expert. I don't think either language is intrinsically more or less secure. But Go does have a better TLS stack.

<comment><USER9> Building secure systems in Java requires a lot of arcane knowledge due to the complexity of the libraries. For instance, you can't just throw a switch and convert all socket-based communication to TLS. I'm not arguing that Go is necessarily better but it's a useful consideration in language evaluation.

But maybe I'm missing your point.

</comment></comment></comment></comment></comment><comment><USER11> The driven-by-score configuration keeps a AES256-CBC-SHA cipher but discards a AES128-GCM-SHA2 cipher which is more robust.

<comment><USER5> In fact, using AES256-CBC-SHA will cause Chrome to mark the https with a red strikeout (in the location bar).. because its 'outdated' cryptogrpahy. See: [https://certsimple.com/blog/chrome-outdated- cryptography](https://certsimple.com/blog/chrome-outdated-cryptography)

<comment><USER10> You should lose the scare quotes, as SHA1 is approximately as secure relative to hash functions as RSA-1024 is to public key algorithms: that is, not very.

<comment><USER5> fair... but it's actually the CBC suite that generates the warning.

<comment><USER10> All the CBC suites in TLS are vulnerable to Lucky 13.

<comment><USER5> Exactly. So why not call it insecure.. Instead it's just "outdated". Hence the quotes

</comment></comment></comment></comment></comment></comment><comment><USER12> It's really easy to get an A+ on SSL labs as long as you follow standard modern recommended settings for your certificates and web server (nginx generally being the easiest to set correctly), having said that I see my own crappy blog has dropped from an A+ to an A in the last couple of weeks: [https://www.ssllabs.com/ssltest/analyze.html?d=smcleod.net&s...](https://www.ssllabs.com/ssltest/analyze.html?d=smcleod.net&s=18.104.22.168&latest)

I highly recommend regularly reading Mozilla's various posts on recommended security settings, especially the TLS best practises for web servers and OpenSSH.

\- [https://wiki.mozilla.org/Security/Server_Side_TLS](https://wiki.mozilla.org/Security/Server_Side_TLS)

\- [https://mozilla.github.io/server-side-tls/ssl-config- generat...](https://mozilla.github.io/server-side-tls/ssl-config-generator/)

\- [https://wiki.mozilla.org/Security/Guidelines/OpenSSH](https://wiki.mozilla.org/Security/Guidelines/OpenSSH)

<comment><USER13> The article goes beyond an A+ and also goes for 100% in all the ratings. The guides which you linked don't do that

<comment><USER14> Neither should they. Both guides haves different goals.

SSLLabs evaluates the highest possible security, while Mozilla's levels compromise to implement the best possible TLS for a given population of users. "best" isn't always determined by security: speed and compatibility are taken into account as well.

That said, Mozilla's modern level ranks A+ in SSLLabs: [https://www.ssllabs.com/ssltest/analyze.html?d=jve.linuxwall...](https://www.ssllabs.com/ssltest/analyze.html?d=jve.linuxwall.info)

</comment></comment></comment><comment><USER15> I'm not a golang developer --- is it common in Go deployments to run your service without a reverse proxy in front of it? Do people implement rate- limiting on their own?

<comment><USER16> The bigger problem is that in go you can not do privilege revocation. And although unprivileged binding <=1023 has been a solved problem for well over a decade, most people still consider it a dark art.

So they go for a reverse proxy, more often than not, just to get the 80/443 binding.

<comment><USER17> Is setcap(8) the informed thing to be using on Linux?

<comment><USER16> Yes, and it works good with Go since you have static executables so you do not have to set the capability on an interpreter. But you have to reapply it after every upgrade, which is easy enough to automate. That said, I mostly use mac_portacl on FreeBSD.

</comment></comment></comment></comment><comment><USER18> Given all the comments indicate that AES 128 is considered secure, do SSL Labs need to change their scoring algo for the cipher suite?

<comment><USER14> We also recommend AES-256 being preferred to AES-128 in Mozilla's modern configuration. From the rationale section:

        AES256-GCM is prioritized above its 128 bits variant,
        and ChaCha20 because we assume that most modern devices
        support AESNI instructions and thus benefit from fast
        and constant time AES.

[https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_com...](https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility)

</comment></comment><comment><USER19> to extrapolate: if you disable webserver nobody can access it and hence no security risk at all _wohooo_

obviously refering to the point that all this tight security will result in lot of issues for most users</comment>


[JavaScript] to promise or to callback? This is the problem - <AUTHOR> http://loige.co/to-promise-or-to-callback-this-is-the-problem/ <comment><USER2> Hmm. If every library author took the second approach there would be tons of wasted code. This may not be a bad thing but it bothers my OCD.

It would be nice if you could write callback-only or promise-only code and have a post-processor produce two .JS files. One with callbacks and one with promises. Then somehow, just as magically, you could require either one. This would save memory and my OCD.</comment>


Show HN: MuseTree – Human-AI interaction for music composition - <AUTHOR> https://github.com/stevenwaterman/musetree <comment><USER2> If I get the intended usage correctly : - First you pick the composer and instruments (They can't be changed even though the UI seems to indicate they would). -Then you click (Load More) with 4 selected. It will generate 4 possible continuations from the current tree.

-As a human, you listen to the 4 and pick the one you think is helping the music get in the right direction. If the music isn't getting anywhere, you backtrack and click Add More.

-Use Right click if you want to delete some nodes and all theirs descendants. If you use right click on the nodes of the good path you wanted to keep. Poof! They are gone! All your hard selection work is gone :(

This is an interesting idea to help explore the music space, but as a human, you are contributing to the composition at a rhythm of two bits every 2.5s (and it took you 10s to listen and pick). That is not much input. Maybe you can close the loop with reading bio-metric cues as you watch your listener listen so that you can discover its preferences.

Edit:

Sorry if it feels harsh but to me the whole point of Human-AI interaction is to make the human work less, and the whole point of human composition is to allow the human to express more. It's a miss here on both for me.

Here it doesn't feel like we are in these "20 questions" style scenario where we can make bits count, but rather trying to put the cat in the box by hitting the walls. In typical Human-AI interaction in reinforcement learning there are some promising research paths where you help the AI pick the right reward function. You make the human listen to two generated music extract and you try to predict the shape of the reward function, i.e. which one will the human like better. This way you can effectively make the bits count.

<comment><AUTHOR> First, thanks for the feedback - I really appreciate it!

You're pretty much right with the intended usage - with a couple of minor notes.

\- You can control-click on a node to quickly load more

\- The genre and instruments can be changed whenever you like, but MuseNet will try to transition sensibly, so it might not be immediately obvious

Accidental deletion is a major problem right now, and is high on the to-fix list. Personally, I manage just using the save/load functionality, but it's not a great replacement.

I had hoped to get this more polished before sharing it, but other things came up and it got put to one side for now. Definitely open to pull requests if anyone wants to fix something, there's a long list of issues on the repo!

You're definitely right that it's not a very efficient use of the human. Another planned feature is the ability to directly edit or write the MIDI, allowing the user to say "I liked this option, but this one note was bad".

When writing MuseTree, I was imagining a user who enjoyed music, and wanted to try creating some music of their own, but couldn't just write something outright. With MuseTree, the only skill needed to write good music is the ability to recognize good music.</comment></comment>


2012 Voting Machines Altering Votes - <AUTHOR> https://www.youtube.com/watch?v=QdpGd74DrBM

<comment><USER2> The major discussion ended up here: <http://news.ycombinator.com/item?id=4749574>

Confirmed by NBC: <http://news.ycombinator.com/item?id=4750364>

Other submissions:

<http://news.ycombinator.com/item?id=4748783>

<http://news.ycombinator.com/item?id=4748903>

<http://news.ycombinator.com/item?id=4748736></comment>


LastPass Raises Prices Again - <AUTHOR> https://blog.lastpass.com/2019/02/change-lastpass-premium.html/ <comment><USER2> Perfect timing for me, as I just switched from LastPass to 1Password and couldn't be happier.

LastPass has seemingly taken a bit of a fall lately, both user experience wise (this sure doesn't help) as well as the article earlier this week [0] explaining some blunders in the API calls which can lead to secret keys being accessible by bad actors (in certain circumstances)

[0][https://news.ycombinator.com/item?id=19579454](https://news.ycombinator.com/item?id=19579454)</comment>


Screenshots of microPledge ("helps software get made and developers get paid") - <AUTHOR> http://micropledge.com/shots <comment><USER2> Very nice. I'm excited about this because I've sponsored some open source development and never had an easy way to do it.

Here what I've done: I use a piece of open source software. I want the developers to implement a feature that will be very useful to me. I offer to pay a considerable amount of money. They agree. I send them half. They complete it. I send them the other half.

A system that would let me share the financial burden and handle the whole process would be very useful. I said before that I think you should expect to see much bigger pledges than you're thinking right now. As a business, pledging $10k for a feature that saves me having to buy an extra $50k in servers is a no-brainer.

If you're going to be actually holding the money you will need to be extremely credible and your reputation spotless. A picture of who you are, your office (if you have one), street address, phone number, and that kind of stuff goes a long way. I want to make sure the authorities can find you if you do anything evil.

<comment><AUTHOR> Sweet. microPledge solves two problems of these problems:

1) The pay-half-now-half-later thing is solved by our staged releases. The developer can say "I'm 50% done, can I please have half my pledge money?" And he'll get half his money if the pledgers are okay with his progress (if they're not, he might only get a portion of his money till they are happy).

2) The share-the-burden thing -- especially if you're talking big pledges. You could have your $10,000 split across 5 people/companies (or more, of course).

The Credibility Thing is a good point, and something we're very conscious of. We're going to be very open about who we are and where we live. And (very soon) we're also going to look into getting our money flow audited annually by a company like Grant Thornton.

P.S. Just wondering if you have a contact email/website somewhere? Didn't see one on your profile page.

<comment><USER2> I think it's a good idea for the developer to get some money upfront. A developer might take time off their day job to complete the project. They're more likely to do that with some cash in hand. Perhaps that's solvable by them saying "I'm 1% done, please send half the pledge".

I'm just a developer/sysadmin guy who frequently has the task of spending money on behalf of the companies I work for, usually on contract. Occasionally the best available option is to sponsor development. In my case I've basically dealt with the open source developer as a private sub-contractor.

Which actually brings up an interesting point. For various reasons some companies won't want others to know they're sponsoring outside development. You should consider giving sponsors the option of having their pledge remain non-public. Maybe even anonymous to the developer, which is an interesting thought.

</comment></comment></comment><comment><USER3> The site looks great, and I think the idea is a good one. Just a thought though - I noticed SourceForge is testing a new marketplace ("SourceForge.net is introducing a new feature that will let you buy or sell services for Open Source projects right from the site.") So you might have a bit of competition if they are doing something similar to what you are.

Good luck with the business, I can't wait to see it when it launches.

</comment><comment><USER4> The UI is very nice, well done. I'm not sure how big a market there is for pledges to build software, though. How about expanding the scope? Say I want to organize an event for Facebook Apps developers, but I need help with the expenses. I put up a pledge for, say, $200, and link to it from my blog. If enough people pledge and the cost is covered, then I'll setup the event. Otherwise, I'll know that there is not enough interest. And, of course, software can still be a category for those who need software built.

<comment><AUTHOR> Well, in fact our system allows for non-software projects quite nicely. But we decided our first focus would be software, mainly because we didn't want to spread ourselves too thin too quickly.

Anyway, your FaceApps Developer Expo sounds like a sweet microPledge use case. Users can withdraw their pledges if a project doesn't finish on time (e.g., you don't get enough money for the event and decide to call it off).</comment></comment>