The mean age of high-tech founders is 43, economists say - <AUTHOR> https://blogs.wsj.com/cio/2018/08/31/silicon-valley-myths-aside-time-is-on-the-side-of-aging-entrepreneurs/ <comment><USER2> Great data, but I'm pretty disappointed with many of the other conclusions.

In the opening line the article states that the 5 largest tech companies were founded by those age 30 and lower. Why? The article isn't very helpful here. It seems to say that they are anomalies, which is a little unsatisfying.

> "one may reconcile the existence of great young entrepreneurs with the > advantages of middle age by noting that extremely talented people are also > extremely talented when they are young."

So they destroy the myth of the young founder, by perpetuating the myth that these founders were superhuman (extremely talented is the word they used). As evidenced by valuations of their companies continuing to rise as they got older.

I find Malcom Gladwell's conclusion more satisfying: When the internet was born, these people were closest to it in - in part because they were young.

I'd extend Gladwell to argue: In once in a lifetime technology revolutions, the young may be advantaged in creating a handful of super valuable companies. And those companies are so central and their small head start is so so powerful, that those companies succeed, at times in spite of their founders.

My conclusion: If you happen to be in college during a technological revolution, you won the lottery and should start a company. Otherwise, you are better off learning, accumulate resources, and founding late in your career.

<comment><USER3> > My conclusion: If you happen to be in college during a technological > revolution, you won the lottery and should start a company. Otherwise, you > are better off learning, accumulate resources, and founding late in your > career.

This seems to be major selectivity bias. Let's call the development of the internet a major technological revolution. How many successful startups have emerged over the time since that revolution began? AOL was started in what, the early 90's? Yahoo was started in the mid-90's. Google was started in the late-90's. Facebook was started in 2004. Twitter, 2007? AirBnB, 2009? Stitch Fix, 2015 or so?

The idea that there's a small window to create a valuable startup right after a tech revolution has begun seems to make sense at first glance, but after more thorough investigation pretty much falls apart. There's never an easy time to create a company like that. It requires intelligence, connections, luck, execution, persistence, and a million other factors.

Put another way, if anyone could go back to 1995 knowing what they know now, I would bet that almost nobody could recreate Google or Facebook because of all the hidden difficulties of launching them that is glossed over now that we are 15+ years out from their launches.

Meanwhile, a guy like Bill Gates would probably have enormous success in pretty much any line of business (albeit not at the scale that Microsoft has had), but far greater than the average founder.

<comment><USER4> Yes, as long as we don't mythologize Bill as having something innate _only_ going for him. He _has_ that but he also had Old Money and Family. Not trying to rain on anyone, just putting things in perspective. Bill's a super talented dude.

<comment><USER5> Bill Gates is indeed talented and hard working -- and generous in some ways. He also dumpster-dived to learn how to write good software from looking at other people's code without their explicit permission: [https://patch.com/california/losaltos/microsoft-co- founder-p...](https://patch.com/california/losaltos/microsoft-co-founder-paul- allen-recounts-his-days-of-7a8784789a) "That phase of Allen's life involved taking the bus–sports coat, tie, leather briefcase and all—down to the offices of local computer gurus. "I would boost Bill into dumpsters and we'd get these coffee-stained texts (of computer code)" from behind the offices, grinned Allen.""

And MS-DOS is based in part on CP/M's design: "MS-DOS paternity suit settled: Computer pioneer Kildall vindicated, from beyond the grave" [http://www.theregister.co.uk/2007/07/30/msdos_paternity_suit...](http://www.theregister.co.uk/2007/07/30/msdos_paternity_suit_resolved/) "Last week, a Judge dismissed a defamation law suit brought by Tim Paterson, who sold a computer operating system to Microsoft in 1980, against journalist and author Sir Harold Evans and his publisher Little Brown. The software became the basis of Microsoft's MS-DOS monopoly, and the basis of its dominance of the PC industry. But history has overlooked the contribution of Kildall, who Evans justifiably described as "the true founder of the personal computer revolution and the father of PC software" in a book published three years ago. In a chapter devoted to Kildall in Evans' They Made America: From the Steam Engine to the Search Engine: Two Centuries of Innovators, Evans related how Paterson "[took] 'a ride on' Kildall's operating system, appropriated the 'look and feel' of [Kildall's] CP/M operating system, and copied much of his operating system interface from CP/M.""

If you want to get away with such things, it helps to start rich, of course: [http://philip.greenspun.com/bg/](http://philip.greenspun.com/bg/) "William Henry Gates III made his best decision on October 28, 1955, the night he was born. He chose J.W. Maxwell as his great-grandfather. Maxwell founded Seattle's National City Bank in 1906. His son, James Willard Maxwell was also a banker and established a million-dollar trust fund for William (Bill) Henry Gates III. In some of the later lessons, you will be encouraged to take entrepreneurial risks. You may find it comforting to remember that at any time you can fall back on a trust fund worth many millions of 1998 dollars."

And to have free legal advice from his father (a lawyer).

Contrast all that with the hypocritical letter Bill Gates wrote: [https://en.wikipedia.org/wiki/Open_Letter_to_Hobbyists](https://en.wikipedia.org/wiki/Open_Letter_to_Hobbyists) "As the majority of hobbyists must be aware, most of you steal your software. Hardware must be paid for, but software is something to share. Who cares if the people who worked on it get paid Is this fair? One thing you don't do by stealing software is get back at MITS for some problem you may have had. MITS doesn't make money selling software. The royalty paid to us, the manual, the tape and the overhead make it a break-even operation. One thing you do do is prevent good software from being written. Who can afford to do professional work for nothing? What hobbyist can put 3-man years into programming, finding all bugs, documenting his product and distribute for free?"

So wrote the millionaire dumpster diver who could afford to write free software his whole life -- but chose instead to resell an OS that ripped-off someone else's hard work (one reason IBM may have wanted to keep an arms- length distance from MS-DOS instead of buying it outright). Those are hypocritical words to anyone who knows more of the story, but brilliant marketing -- including the rhetorical deception about how much time free software developers might have (such as ones at universities or government labs or students like, then, Linus Torvalds).

[Stuff I previously mentioned here: [https://news.ycombinator.com/item?id=15772233](https://news.ycombinator.com/item?id=15772233) ]

To be clear: just because Bill Gates did stuff like that in his teens and 20s does not mean he would do stuff like that now. He many have grown as a person in many ways over the past few decades (e.g. the Gates Foundation).

<comment><USER3> The comments from that post about his best decision being born to a wealthy family are so moronic.

Sure, the connections probably helped him stay out of trouble, go to better schools, etc. But to say that he owes his success to his wealth is absurd. I would argue that extreme wealth for most people would inhibit ambitions, not enhance them.

I would also argue that today most entrepreneurs wouldn't peruse publicly available Github repos to learn how to code, let alone dumpster dive for printouts of code to study. Some might view that as playing dirty, I would say it shows an incredible amount of ambition and drive. After all, he could have been getting drunk at Harvard and studying pre-law like everyone else was there in the 70's.

</comment></comment></comment></comment></comment><comment><USER6> My guess is that a lot of successful founders are people with experience in a given domain who founded a company to fill an unfilled need within that domain, and that most of these founders are on the older end. For example, I recently interacted with the founder of a $200 million company that sells infrastructure materials (e.g. fiber optic wire) to large telecommunications companies. To found a company like this, you need to know that the need exists in the first place and you are are at a huge advantage if you already have contacts in the industry.

There are tons and tons of companies like this that you have never heard of because $200 million companies don't make the news. But they do make their owners very wealthy even if they aren't billionaires.

Lacking domain experience and/or industry connections, many young people will often found consumer facing companies. These companies are often winner-takes- all and a tiny fraction of them will make their founders super wealthy. Plus, consumer companies by nature tend to be more well known because they advertise their brand and cater to consumers so they appear on the news more often. For example, AbbVie and Medtronic both have larger market caps than McDonalds, but they (intentionally) don't seek publicity, so you don't hear about them (and therefore their founders) much.

<comment><USER7> Many times, these $200 million companies make their owners far wealthier than even unicorn founders. Because not only are they sometimes fully owned by the founders, but they are making cash flow from day one (gasp!) and paying out healthy distributions from the beginning.

<comment><USER8> Agreed. There are many business opportunities in "niches" . I met a founder who became a VC after she exited her company that did interior design for office buildings. I think I offended her when I called her 8-9 figure business a niche but I had never even imagined that that need could have possibly existed until she told me.

<comment><USER6> To be fair, that's a pretty big niche. There are hundreds of thousands if not millions of office buildings out there and they all need _someone_ to design the interiors.

But one thing that's kind of cool about it is that it doesn't scale beyond a certain point. Because it requires legs on the ground, this is the sort of business that isn't winner takes all. Sure you can get large, but there's always going to be room for boutique design firms.

</comment></comment></comment></comment><comment><USER9> > _" "Young people are just smarter," Zuckerberg told the audience of a 2007 > VC conference, adding that successful startups should only employ young > people with technical expertise."_

> _" "People under 35 are the people who make change happen," said VC Vinod > Khosla at a 2011 conference. "People over 45 basically die in terms of new > ideas" because they "keep falling back on old habits." Entrepreneur and VC > Paul Graham said in a 2013 interview that investors tend to be biased > against older founders. "The cutoff in investors' heads is 32… after 32, > they start to be a little skeptical.""_

I don't buy this, even as someone under 27. I could see an argument that younger people have more time to think creatively and catch on to new trends in technology since they likely have more time to do so than older people with families or greater responsibilities. However, I don't believe successful change is only limited to younger people. Heck, I have friends who are 25 that haven't even figured their own life out and don't know how to keep an apartment clean. Yet, they still must know better than a 35 year old with 10 years of industry experience?

To be honest, I've had more enjoyment working for startups with founders over 30 than under 25 - partly because those over 30 have less time for bullshit. They treat it like work (which is it). It was also helpful to learn from older people who could pass on both technical and life advice to me as a younger person from a "things I wish I knew at your age" perspective.

Younger founders could still be successful, but, in truth, working with a bunch of other young people my age could feel more like "hanging out" than getting work done. Sometimes young people don't actually know what to do in certain circumstances and have no one to ask, which can be good and bad depending on how you look at it.

<comment><USER10> If you want a business that is effectively a VC lottery ticket, ie flame out or go big in 18 months, you want folks under 30. They're stupid enough to believe the VC's and sign up, energetic enough to do something, and silly enough to keep up with the lifestyle fads that might produce something that goes exponential.

If you want a business that produces _money_ , you want founders who know an industry, understand the holes and deficiencies, have a solid nose to avoid the bullshit and the swamps, keep tight control over their cashflow and realize that this will probably take about 5 years--that's someone 35+ and more probably 45+.

However, 5 years is _WAY_ outside the return window for the modern lottery ticket VC. Consequently, they are going to give you every excuse in the book to avoid investing in a company other than "I'm buying a lottery ticket, not a business."

<comment><USER11> Very good post. Not so many people understand this.

</comment></comment></comment><comment><USER12> > the mean age of high-tech founders is 43.2, economists say

I could see this. From the perspective of an Engineer I'm 36 and I have never been more qualified to start a company than today. People I work with in their 40s are great I've had the opportunity to learn from some excellent people in my career

<comment><USER13> This has been my experience as well.

After seeing startup CEOs be swept aside for growth or scaling CEOs by their VC's, I decided I wanted to build lasting and transferable skills alongside the problem solving.

In hindsight there was little harm spending my twenties gathering 20 years of experience in 10 years. This is less about age, than how one levels up.

Putting in time helped understand problems at a greater breadth, depth and uncover inter-disciplinary connections, instead of the spitball ideation process.

After 10 years (around age), having 20 years of experience on average puts you ahead of many of your contemporaries, leaving you in a better position to recognize opportunities, and areas needing improvement. If this is you, let's chat :)

<comment><USER14> I appreciate what you're trying to say, but you can't just claim to have 20 years of industry experience after starting in that industry 10 years ago, right? Do you put 20 years of experience on your resume?

<comment><USER13> It's similar to how Paul Graham compares like working really hard for a few years in a startup vs working slower at a traditional job. How hard one works in a compressed amount of time, and the results one achieve in the same amount of time can equate to something.

I never would put 20 years of experience on my resume. Can't fake it till you make it in tech. :) Years of experience, again aren't the metric alone, its the quality of those years does matter.

If someone has 10 years of experience, and their achievements and skillset are mature and are on par with someone at the top of the pile with 20 years of experience, that might be one way. Does that help clarify?

Either way, I'm not sure where this new literal HN is coming from, and maybe I haven't done a very good job of explaining much.

<comment><USER14> Thanks for the clarification. I get what you're trying saying. The point of confusion for me was how literally you used "20 years of experience" in your career. As you said, it's hard to pass that off literally, but I totally understand having compressed learning. I, myself, have been in the industry for 12 years now and I feel that number is fair, but I feel like almost all of my usable experience came in the last 6 years. So in a way I feel like I got 12 years of experience in 6 years.

<comment><USER13> Cool. Now having 20 actual years of experience, I think I was describing it in hindsight, vs looking to my future.

I agree with your 12 yeaer experience. When I hire or am being hired we look for recent, relevant and hopefully experience that shows a higher level of mastery relative to other candidates.

Still this is a nice reminder of how good HN has been at attracting new entrepreneurs/technologists, and the lowering the average age/experience level on HN. I see it as a positive.

</comment></comment></comment></comment></comment></comment><comment><USER15> _On the other hand, many resources accumulate with age, including access to human, social and financial capital. Older entrepreneurs are likely to have more experience in managing development, finance marketing, sales, HR and other operations._

I wonder why they didn't look at prior startup experience. Could it be that those 44 yrs old had 2-3 other startups before that just didn't work and so they knew how to do things?

<comment><USER16> Even just regular work experience will help a lot. Some of the successful founders I know had a few failed startups under their belt. But you can learn a lot from just working with other people. I've learnt a lot about all sorts of things just by taking an interest in how my colleagues do their work, and most of it was stuff I'd have struggled to figure out by my self.

</comment></comment><comment><USER17> Selection bias, if you're starting a company at age 43, you are risking your career and monetary stability. The type of person who can afford this is probably already part of an elite financially secure class. How misleading is this article? They are comparing apples to oranges, people starting companies in their 20s are not the same as people starting companies in their 40s. Take the set of people in their 20s who would be capable of starting a company in their 40s (meaning they have career success, a cushion of money, etc) and compare them to the entrepreneurs in their 40s, then you have a statistic. This is false otherwise.

<comment><USER18> you are risking your career and monetary stability, at your 20s too, if you start a company and fail, you risk going homeless and having a huge gap on your cv.

<comment><USER19> I would like to see a citation for this assertion that, if your company fails, you are at high risk (or higher than normal risk) of homelessness. This doesn't fit with what I know for what puts a person at risk of homelessness.

And there's no gap on your CV. You put down "Worked on launching x startup from X date to Y date. It sold, folded, whatever and I'm looking for a job now."

Thank you in advance if you can come up with a cite.

<comment><USER2> My understanding is that failing is more of an issue outside the US. In the US, which is where the data is from, I tend to agree with DoreenMichele: Startup failure is fairly easy to recover from. You mostly risk opportunity cost (lost wages, lost promotion periods).

<comment><USER20> Actually cost of failure is much lower in Europe due to welfare state and generally lower cost of living.

</comment></comment></comment></comment></comment><comment><USER21> For my startup, age is crucial: There's no way I could have done this work before I was 40, and similarly for would be competitors.

I had to learn about:

mainline business

entrepreneurship

startups

venture capital, what it is good for and what isn't

about people, especially in business -- vendors, employees, customers, investors, lawyers, management, organizational behavior, etc.

quite a lot of pure math

quite a lot of applied math and associated computing

my original applied math

The pure and applied math is Ph.D. stuff, and I do have that Ph.D. But some serious business experience is crucial. Just those two prerequisites rule out nearly anyone under 30.

But, but, but, people over 40 are out of new ideas? Not in my startup!!! The user interface, user experience, some of the computing, and especially the crucial core enabling applied math are far out, wildly new, "radical, provocative" stuff.

If I gave a lecture on the custom, internal ad targeting applied math, then nearly everyone in Silicon Valley, entrepreneurs and VCs, would soil the furniture and then, on the way to the restrooms, the carpet. Later they'd meet at a local bar, try to wash away the shock, and try just to f'get about that experience. Why? As I learned as a first year pure math grad student, there is little so intimidating, frustrating, confusing, and discouraging as a very nicely done, precise, fully correct, advanced, strikingly original, calm, lecture on pure math where understand only a key word now and then!!!!!

I do owe a thanks to the author, Irving W-B: At one time he invited me to give, and I gave, a very simplified version of just such a lecture on some of my research to some of his people!!!! What I gave then a colleague had pronounced "radical, provocative". After my lecture, some of Irving's people and I had lunch, and on one small point agreed that I'd reinvented k-D trees, IIRC in Sedgwick.

Think people over 40 can't be original? Ever hear Wagner's <i>Tristan und Isolde</i>?

<comment><USER22> In my early 30's now and I often muse on how poorly prepared I actually was, coming right out of school.

Basically, society molds the young to fit an image. Then those young people all compete over that image, hopefully start to realize this is a terrible idea and there are better things, and start looking for a niche to exit to. And then perhaps 20 years later they've learned enough to successfully hit that niche!

<comment><USER11> Your second para here is quite a profound statement!

</comment></comment></comment><comment><USER23> I think the the younger folks are more likely to spot an outsize opportunity where no one was looking at all, whereas an older person might be more aware of an incremental change in an existing business model that presents a new opportunity.

<comment><USER24> _I think the the younger folks are more likely to spot an outsize opportunity where no one was looking at all,_

I hear variations of this refrain a lot. But I wonder, is there any particular evidence to support this, or even a reasonable sounding theory to explain why it is likely to be so?

<comment><USER23> A lot of the more "visible" larger outcomes seem to be based on how people socially interact moreso than technical innovation. Older people generally aren't first wavers in new means of sharing their lives, e.g. facebook, twitter, snapchat etc were all just new ways of talking. I know thats ridiculously reductive in scope, but it just seems older folk are more dispositioned to attack problems that provide a clearer path to renumeration, while younger folks seem more focused on doing something cool that technology enables.

I have 0 data to back up that armchair analysis.

</comment></comment></comment><comment><USER25> The numbers are far more favorable for older founders than I expected. But that's also completely in line with my life experience. As you work, you learn how to manage yourself and others, and a lifetime learner accumulates knowledge of much greater depth and breadth than someone younger. This accumulated knowledge and management skill should provide advantages in startups.

</comment><comment><USER26> I think an important aspect not mentioned in this article is the environment in which the computer and internet wunderkind founders got their starts.

You had a perfect storm of brand new, super powerful tools (the internet providing dirt-cheap distribution, cheap computation, beginner friendly programming languages -- php for facebook, java and python for google, etc.). There was so much low-hanging fruit with relatively little competition.

A very similar thing happened in physics in the early 20th century, and led to the same notion that genius is a fleeting trait concentrated in the young. To quote this BBC article: [https://www.bbc.com/news/science- environment-37578899](https://www.bbc.com/news/science-environment-37578899)

 _It was like discovering a new toolkit which could quickly yield discoveries. Or, less charitably, as one scientist said: "mediocre physicists could discover great physics"._

</comment><comment><USER27> Good, there's still hope for me... lol (38/dev/entrepreneur).

</comment><comment><USER28> Sure, I can see how this is a myth about founders... but what about employees? We can't all run startups. There's a lot of age bias in hiring.

<comment><USER29> There's definitely a lot of age bias in the employment, particularly after ~40. The key is to move up the difficulty ladder. Your age-resistant employment prospects skyrocket if you move away from lower value skills - think PHP - and move up to (just for example) Java or Go et al.

Or move away from low value front-end junk that turns over every three years (the latest JavaScript framework of the month), and to higher value serious programming. That's where long-term job security comes from. The difficulty acts as a barrier to entry against a flood of low skill labor that will constantly undercut you (both in regards to age and income). Master a high value, higher barrier to entry language or two and you can write a six figure ticket for the rest of your adult life. And as certain languages begin to themselves age off, the demand often only goes up for the dwindling supply of engineers that still know it well.

<comment><USER30> Any examples of those languages?

<comment><USER31> I almost agree with the poster above, but I think it's less about the languages than high-value skills or specializations. As long as you're defining yourself by a language, you're more limited than someone who's known for expertise in some specialty.

Examples include distributed systems, realtime software, embedded programming, network programming, etc.

</comment></comment></comment></comment><comment><USER32> The most successful founders now would be in their early 30s, as that's the range that captures die hards that started just early enough to have the most thorough perspective while still being younger. On the other hand, any successes can only really come from "the chosen" (ie, whoever VCs decided to fund).

</comment><comment><USER33> [http://archive.is/6aBOh](http://archive.is/6aBOh)

</comment><comment><USER34> My take on it:

"The youth have all the energy and time to spend, no obligations and no financial worries. But they have very little life experience and exposure to these hidden problems. So what they end up solving are the kind of problems primarily young people have. This certainly makes for some very amazing products, but I can't help feeling a little disillusioned. The amount of time and energy that goes into fun, but ultimately useless ideas, rather than fixing some of these hidden problems is mind-numbing.

On the other hand, the older generations are exposed (aware or unaware) to a lot of these hidden problems. They have experience on how to solve them because they understand them. Yet by that time, most of them have to provide for a family, pay of their mortgage, tuition fees, healthcare, yearly vacations and the 3 cars. They also often lack the imagination on how to solve things in a new technological paradigm."

</comment><comment><USER35> I think one big advantage of older founders is the wisdom not to be fooled by the first VC to come along dangling cash with major strings attached.

<comment><USER11> Good point. VCs are looking for outsize returns. Older founders, who can't spread their risk like a VC, are pursuing more predictable businesses but which are therefore probably lower profile and lower return.

</comment></comment><comment><USER36> Figure 3A is really interesting - post 40 founders are more successful.

</comment><comment><USER37> I can't get past the paywall, but the info looks a lot like the survey that circulated this summer. In that study, the researchers went through tax data and used tech companies that hired at least one employee as their proxy for a "startup."

This seems wildly flawed. It's the same methodological quirk that makes Kauffman data not so helpful.

I'd like to do a study that looks at some of the more common metrics of success in the startup community.

\+ Top 100 companies tracked by Gartner

\+ Top 100 Apps on Apple Store

\+ Top 100 Websites measured by Quantcast

I've looked at sample that's pretty close to that and the average age is much closer to 30, and even artificially inflated by serial entrepreneurs who are on their third companies.

<comment><USER38> [http://archive.is/6aBOh](http://archive.is/6aBOh)</comment></comment>


Stonehenge: Neolithic monument found near sacred site - <AUTHOR> https://www.bbc.com/news/uk-england-wiltshire-53132567 <comment><USER2> There's a lot of speculation here about cultural amnesia, but I think that's partly missing the point - which is the sheer scale of the project.

These structures are absolutely massive. I used to live in the area and it took me a long time to see Durrington Walls, partly because it's hard to imagine an earthwork on that scale. I literally did a double take when I realised that some earth banks were part of this huge construction.

The Walls are a small enclosure inside this much bigger complex, and they still cover an area bigger than Wembley stadium, which can seat up to 90,000 people.

This new ring of shafts - presumably with objects inside them - is slightly smaller than the entire town of Salisbury a few miles to the south. It makes the Old Sarum earthwork, which used to _be_ Salisbury in medieval times, look like a footnote.

For a neolithic culture, it must have taken an absolutely insane amount of planning and physical effort - and this at a time when the total population of the British Isles was less than 200,000 people.

</comment><comment><USER3> the report doesn't mention Prof. Wolfgang Neubauer's team from vienna who developed the technology: [https://archpro.lbg.ac.at/press- releases/stonehenge_durringt...](https://archpro.lbg.ac.at/press- releases/stonehenge_durrington_pits)

</comment><comment><USER4> I'm of the firm belief at this point that we are a species with severe amnesia.

I find it significantly more plausible that cataclysmic events we no longer remember occured in our past and wiped away a rich history in which we may have feasibly been far more advanced technologically than we currently are.

<comment><USER5> This is a pretty old idea that was recently rebranded as the "Silurian Hypothesis". If you put in a bit of thought, it'll be obvious that it essentially boils down to one of two things:

Either every paleoanthropologist, archaeologist, and geologist out there is in a massive conspiracy to hide the truth, or all of the people in those disciplines are complete idiots. An event like that would leave strong genetic, palynological, and archaeological evidence, yet nothing of that sort exists. Any explanation purporting to wipe out the evidence and replace it with the consensus story we do would be better called magic than science.

<comment><USER6> You could be right. It is certainly a compelling argument; "either scientists are in a conspiracy or complete idiots" (paraphrased). The answer is however unequivocally: we don't know. And it behooves to be a bit more humble when it comes to these things, and investigate each claim individually instead of making blanket statements about everything such.

There are several aspects one can take into account that can inspire a more nuanced approach: one is that these kind of theories is an "entry-drug" for interest in archaeology and related sciences. To get on a high horse and nip such interest in its bud is counterproductive from a scientific perspective and is reminiscent of the defensive position that many professions are taking in the open data age that has opened for masses of amateur researchers doing much better work than a tiny cadre of elite professionals could do on their own.

Another aspect of this dismissive attitude is that the notion a petrified and fact-resistant "establishment" is opening the field for all sorts of nut case Youtube channels that exploit this types of interests instead. Including the age-old nazis with their Atlantis and similar theories.

So no, let's assume that we don't know, that anything is possible. But let's also inspect the evidence for each fantastical claim with best of our knowledge.

<comment><USER7> _So no, let 's assume that we don't know, that anything is possible. But let's also inspect the evidence for each fantastical claim with best of our knowledge._

Well, first of all, you don't know that anything is possible. To assert something is possible without actually showing it is possible is meaningless. That doesn't mean we can conclude it _isn 't_ possible, just that we don't know if it's possible.

Second, while 'we don't know' is a perfectly acceptable position, it does not lead to,'therefore my pet idea is worthy'.

You are, of course, entirely within your right to explore any idea you'd like, but to claim the scientific community is unfair or defensive to dismiss your idea because it either has no evidence to back it up, or frequently because it has been proposed over and over and has already been picked to death, is intellectually lazy. If you want people to take it seriously, you need to provide evidence. There's too much to study to be able to take every currently baseless idea and run with it.

<comment><USER6> > _Well, first of all, you don 't know that anything is possible_

I said "let's _assume_ (...) that anything is possible", a completely different thing, so your argument that " we don't know if it's possible" is moot, and a classic case of a straw man argument.

> _" while 'we don't know' is a perfectly acceptable position, it does not > lead to,'therefore my pet idea is worthy'"_

Again, you are mostly having an argument with yourself, as this is somewhat a misrepresentation of what I'm saying. My main point is that it behooves to be a bit humble when it comes to dismissing ideas that are possible albeit without firm evidence and that offhanded dismissal should be discouraged, unless one can actually disprove the claim. It is after all the stuff from which new knowledge is made. That doesn't mean that every scientist must engage and clamor to inspect the evidence for each fantastical claim (but I do believe that an active interest from the scientific community would help cleanse the scene of some of the more outrageous theories).

> _" If you want people to take it seriously, you need to provide evidence."_

Really? so all scientific endeavors must produce evidence before they are allowed to posit something? I think you will agree that this is an untenable position hold as a general principle, and you probably mean that any layman should not be allowed to posit anything without having the proper education and academic standing. Be that as it may, such ivory towers of academic snobbishness will fall, eventually.

</comment></comment></comment></comment></comment><comment><USER8> It'll be a shame when the Government starts building the road tunnels underneath Stonehenge to allegedly ease traffic. Sacred doesn't seem to be in their vocabulary.

<comment><USER9> Sacred = supersedes my authority = destroy</comment></comment>


Buffett:  Free news unsustainable - <AUTHOR> http://www.bloomberg.com/news/2012-05-24/buffett-says-free-news-unsustainable-may-add-more-papers.html

<comment><USER2> Paid news is unsustainable.

News has always been free. The newspaper was a package deal, largely paid for by advertising, and consumers only forked over a little bit of money for the convenience.

And now that raw news has been disintermediated, there's even less reason to pay for "news".

Newspapers have already lost other things of value in their "package deal" (personal ads etcetera) because they couldn't be bothered to really go online. And most of them have completely sacrificed their credibility as watchdogs for political and commercial gain.

News has zero market value. News _happens_.

Newspapers are an outdated concept, and it's valuable parts have already been monetized by others.

<comment><USER3> Well, that's what most of us here believe obviously. But are you betting against the Oracle of Omaha?

<comment><USER4> The Oracle of Omaha doesn't bet on tech because he knows he doesn't understand it. His money has been made by only investing in businesses he fully understands.

I think he would think of "free news" differently if he had a better understanding of technology.

<comment><USER5> News is only free because the newspapers got into a war for eyeballs on the Internet. It is only now after they've had their businesses decimated that they realize that free content wasn't such a wise move on their part. There certainly isn't anything about free news that makes it a competitive advantage. If anything, it actually hurts them economically because they're giving away their product for nothing. No one sane runs a business on driving an increase in traffic.

<comment><USER6> People haven't paid for the content of newspapers since newspapers moved to an ad-supported business model a century ago. The newsstand and subscription costs were for printing and distribution, not for content.

On the internet, the cost of printing and distribution have collapsed, so it makes sense that readers should be able to access it for free. The problem is that advertising revenues have also fallen dramatically, which means newspapers are feeling pressure to start charging readers to produce the content.

The idea of charging for content is actually a throwback to the early days of newspapers, which were similar to websites and blogs in that they were extremely diverse in quality and viewpoint and publications wore their agendas and ideologies on their sleeves.

The professionalization of the news media followed the transition from subscription-supported content to ad-supported content, in large part because advertisers want content that is balanced and innocuous enough not to alienate large swaths of potential customers.

I don't know how the business of the news is going to shake out, but my hunch is that the people who figure out how to make money from online media won't be the people who figured out how to make money from print media.

Just as the proliferation of movable type destroyed some professions (scribes) and invented other professions (writers, publishers), the proliferation of the internet is also going to destroy some professions and create others.

One thing, though: I wouldn't bet against good writing over the long term.

</comment></comment></comment></comment></comment><comment><USER7> News is ripe for disruption. News was a better business when it was harder to find out what was happening in the world because of difficulty in transporting information and media. That's all gone now.

Has Buffet heard of Twitter?

News aggregators like Huffington Post?

The only thing I think news papers have over citizen journalists is credibility, editorial and writing quality. Decent news analysis can be derived from prominent bloggers.

I wouldn't want to be in the business of any kind of content creation in the long term. Copyright as a concept is going to be fundamentally challenged in the next few generations.

Newspapers are just whistling past the graveyard right now.

<comment><USER8> This is an interesting perspective. The logical conclusion of this perspective is that the people who currently are paid to be reporters, editors, writers, photographers, etc. add little to no value to the world. Similarly, that news can exist without primary sources to exchange on Twitter of for bloggers to write about.

As a counterpoint, I'd suggest that:

1) Most people are not able to obsessively follow everyone on Twitter, and filter through the tweets for the most relevant news. For the first job of a news organ is to filter out the noise.

2) News aggregators must aggregate something. Take the homepage of HuffPo, for instance. Most of the articles posted there are written by people on the HuffPo payroll. Most of the others link to sites where someone was paid to write the article, like the Washington Post. None are direct links to a tweet.

3) Credibility is not an afterthought for most people. We expect our news outlets to at least make an attempt to be credible and/or publicize their biases.

4) Prominent bloggers don't typically interview local officials. Local officials matter, but they are not sexy and often must be visited in person for interviews. The general point here is that very few people will cover some important parts of the news for free, because doing it sucks.

<comment><USER9> To the typical reader or viewer, credibility is equivalent to agreeing with ones own biases while claiming to be unbiased. Hence the state of journalism.

<comment><USER10> Exactly - Republicans watch Fox, Democrats watch MSNBC & everyone is happy hearing what they already believe.

</comment></comment></comment></comment><comment><USER11> A quick question to everyone who is asserting that aggregation, social media, and citizen journalism makes traditional, for-pay news outmoded:

What if Watergate happened today? Who would break that story? Who would follow the leads? Who would protect the informants?

Before you answer "Wikileaks", keep in mind that one of their top informants is currently being held in military prison under borderline inhumane conditions, and their leader is currently being extradited to face trumped up charges of sexual assault. Meanwhile Bob Woodward has a book deal and is spending his retirement on the sunday morning talk circuit...

<comment><USER12> I hate to be so cynical on Hacker News, but I think it has some bearing on the business opportunities, so here goes.

If Watergate happened today, (1) the New York Times would assign a reporter like Judith Miller to present the administration's viewpoint almost verbatim, (2) the Economist would rehash conventional DC wisdom from across the Atlantic while largely misunderstanding the context, (3) Stratfor would hyperventilate and try to panic us into buying expensive whitepapers full of worst-case geopolitical scenarios, (4) Mother Jones would write an amazingly depressing exposé that nobody can bear to read, (5) the Christian Science Monitor would try to do the right thing, but find itself hamstrung by limited personnel, and (6) two thousand local papers would plagiarize the same wildly inaccurate article off the AP wire. Oh, and for every reporter who tried to discover the truth, 10 would take a statement from each side and imply that the truth must be somewhere in the middle.

Seriously, I would pay real money for accurate news and competent analysis. I've tried, I really have. But the available options are just awful. Editors want to move product, reporters want to finish 500 words by 5pm, and readers want to confirm their worldviews.

<comment><USER13> > the Christian Science Monitor would try to do the right thing

As a non-American, I was a bit taken aback to see the Christian Science Monitor mentioned. Are they a news source? Do they have a history of "trying to do the right thing", as you put it?

<comment><USER14> The Christian Science Monitor is a pretty high quality and reasonably unbiased newspaper greatly held back by a rather unfortunate name and association. Certainly on topics of US Politics they are the among most most unbiased, and have a stated policy of never endorsing any candidate or party.

While being owned by the Christian Science church they do a good job of being independent and avoiding any mention of doctrine. I truly believe that if the same newspaper was published without any connections to any church it would rank much higher in world opinion, but most people tend to dismiss it due to the name.

(full disclosure: Grew up christian scientist, long since lapsed, but still have friends who believe, and I hold no animosity towards the church).

</comment></comment></comment></comment><comment><USER15> From here, I wonder how many people will realise that they can do without a great deal of what's considered typical news? I was a voracious newspaper reader as a child and watched the nightly news without fail. At present, however, I don't watch TV news, I haven't bought a newspaper in many years and I have deleted bookmarks to every local/general/large news source and try to avoid them beyond that also because they peddle trash day after day chasing mindless pageviews.

"Find out what Miranda Kerr called her new baby! Related news: Gallery of 43 photos we've stolen off the net that we know you can't resist looking through."

Put a paywall in front of all content, and people may start to realise and make a choice.

Is the next generation growing up buying newspapers?

</comment><comment><USER3> Here's Buffett's actual letter - [http://dataomaha.com/documents/warren- buffetts-letter-to-pub...](http://dataomaha.com/documents/warren-buffetts- letter-to-publishers-and-editors)

</comment><comment><USER16> There has never been much money in selling news, the value is in controlling public perception, which is unbelievably valuable, and which is why the owners of the largest newspapers and news agencies don't care if they run at razor thin margins or (as is often the case) losses, it is all about controlling the information channel.

This is somewhat less obvious today with the competition from many other open channels of information, but newspapers used to be absolute kingmakers. In the time around World War I they were even used by arms manufacturers in collusion with finance and state actors to drive the arms race in the run-up to the war.

</comment><comment><USER17> I'm not the type to cling to dying business models, but I actually would consider paying a little money to get in-depth quality analysis of current events or topics I find interesting, just like I'd be willing to spend money on a good book. It's not a necessity and I would treat it as a luxury, but I do believe there is a niche market demand for that kind of content. The current advertising based model of distribution seems like a race for the most eyeballs and consequently a race to the bottom.

</comment><comment><USER6> > Press+, a startup that sells online subscription technology, is used by more > than 300 publications

Incidentally, Press+ is _trivially easy_ to disable. It's a third-party client script that counts how many times you've visited the site in the past month and prompts you to pay once you've reached the limit.

</comment><comment><USER18> "A newspaper typically generates 70–80% of its revenue from advertising." <http://en.wikipedia.org/wiki/Newspaper#Advertising>.

The real problem is maintaining the advertising client income when going from paper to electronic print.

</comment><comment><USER19> One of Buffett's mantras is stick to what you know.

He stated that he won't invest in tech companies as he doesn't know them.

I'm sure there was a man that knew horse and carriages, and didn't know anything about cars.

</comment><comment><USER20> Free news is unsustainable just like free software is unsustainable.

<comment><USER21> No. He's not saying that there can't be news out there that's free, he's saying that newspapers releasing free content is unsustainable. I, and many others I believe, agree with him.

I think that "free news" (whatever that ends up being) will win in the end; newspapers giving away the keys to the castle won't make them win (not that I think anything will).

</comment></comment><comment><USER22> Correction: free news as a business model is unsustainable - assuming the internet stays the way it is (relatively uncensored).

</comment><comment><USER23> That is funny, I was thinking today that one way the newpapers might survive was by going free (we just started getting for free a couple local newspapers)

</comment><comment><USER24> <http://news.ycombinator.com/item?id=4022316>

</comment><comment><USER25> Well at least he isn't joking about being greedy when others are scared.

</comment><comment><USER26> Dude has a horse in this race.

EDIT: I should say, he has an interest in moving the market, especially at a time when FB is dominating the online newscycle. I don't think he lacks credibility, I think he lacks a goal here. He's trolling.

<comment><USER27> He has a horse in the race because he thinks he is right, not the other way around. He doesn't have to have a horse in the race.

</comment></comment><comment><USER28> Of course he would say that after buying all those newspapers. He actually wants to make money from them, and for that he needs people to believe they need to pay for news.

</comment><comment><USER29> What about ad-supported news, is that sustainable?

<comment><USER30> According to half the past week's analysis of Facebook, ad-supported _anything_ isn't sustainable.

<comment><USER31> > ad-supported anything isn't sustainable

Google is 90%+ ad-supported.

The analysis was more about Facebook's valuation rather than its sustainability.</comment></comment></comment>


Ask HN: What do you think about "dim-lighting" low score comments? - <AUTHOR> Long long time ago HN comments had visible scores. Then it was changed[1]. That was also a long time ago.
These days, all comments with positive scores display the same. Comments with negative scores, however, are "dim-lighted" with lighter (and lighter) gray font.
While In theory "dim-lighting" should make the comment less visible, it practice it attracts attention to the down voted comments.
What do you think? How is this effecting discussion? Any better UI ideas?
[1] https://news.ycombinator.com/item?id=2595605 <comment><USER2> > Any better UI ideas?

Reddit has pre-collapsed comments, which seem reasonable. But that will collapse the whole thread, which is undesirable.

> it practice it attracts attention to the down voted comments.

I'm more interested in the premise of this question.

(a) Is really this true, and backed up by HN-scraping of some sort?

(b) Do we want it to attract less attention? Sometimes they attract insightful replies explaining a common misconception.

In short: what problem are we trying to fix? Has this really reduced the quality of threads by much? By what metric and by how much?

<comment><USER3> Agree. Would not be in favor of Reddit-like collapse. Overall I am happy with current system.

Slightly OT: On mobile the up- and downvote arrows are too close together. For every vote I have to zoom in to accurately click the right one. I suggested to HN Support to place the downvote arrow to the right of the comment header, or have a separator/spacing between the 2 arrows.

</comment></comment><comment><USER4> I personally use custom CSS to make the dimmed comments black when I hover them, so I can more easily read them if I so choose.

I don't really have an issue with comment dimming. It shows that a significant number of users find the comment to be more noise than signal, so that those who wish to avoid such can do so easily.

I _think_ I've seen some pre-collapsed threads here as well... specifically ones where an HN administrator has taken some sort of action and commented on that.

<comment><USER3> > I personally use custom CSS to make the dimmed comments black when I hover > them, so I can more easily read them if I so choose.

That is a nice solution, but does not work on mobile. Could be part of standard HN though (maybe configurable). I usually select the text, so it becomes readable.</comment></comment>


TSMC Ramps 5nm, 3nm to Pack Over a Quarter-Billion Transistors Per sq mm - <AUTHOR> https://fuse.wikichip.org/news/3453/tsmc-ramps-5nm-discloses-3nm-to-pack-over-a-quarter-billion-transistors-per-square-millimeter/ <comment><USER2> >Results were mixed from TSMC first quarter 2020 financial results. Amid pandemic, the company saw net revenue of $10.31 billion

Mixed? I am not sure how this is mixed considering we knew Consumer Electronics and Smartphone sales dropped by ~30%. That is the largest market in terms of unit volume. And yet HPC managed to pick up all of that. I think this could be a mixed of Amazon Graviton 2 and AMD's EPYC, along with other GPGPU usage.

7nm is ramping extremely well in all of its variants. 5nm is on schedule, and despite the constant absurd rumours about TSMC's 3nm is behind schedule, TSMC remain optimistic they will deliver on time in 2H21, that is basically when Apple ships iPhone 13.

And there is nothing new, TSMC has stated N3 wont be using GAA for nearly 2 quarters now, and the news and press still refuse to read any investor notes and comment. Which is annoying as I am not sure what intentions they have when publishing false claim. ( Not WikiChip they are doing a brilliant job in most parts)

To me this quarter was much better than expected. And HPC remains an exciting opportunities. I only wish TSMC will also put more effort into its other non leading edge node like 28nm . Which seems to be getting competition from everywhere like SMIC, GF and UMC.

</comment><comment><USER3> When I try to wrap my brain around this idea, I get a headache.

<comment><USER4> There is a _lot_ of "stuff" in relatively small areas. For example a cubic mm (aka μl or microliter) of water has 10^20 atoms:

[https://www.wolframalpha.com/input/?i=1+cubic+mm+of+water+in...](https://www.wolframalpha.com/input/?i=1+cubic+mm+of+water+in+atoms)

As another example, the well studied bacteria E. coli is approximately 2 μm^2 [0]. So in the same 1 mm^2 used by TSMC, 500,000 entire living organisms could be fit.

[0] [http://book.bionumbers.org/how-big-is-an-e-coli-cell-and- wha...](http://book.bionumbers.org/how-big-is-an-e-coli-cell-and-what-is-its- mass/)

<comment><USER3> Now it's a migraine. :)

</comment></comment></comment><comment><USER5> Wow.. If we ever perfect 3D fabrication..</comment>


Why are the username and password on two different pages? - <AUTHOR> https://www.twilio.com/blog/why-username-and-password-on-two-different-pages <comment><USER2> This just prevents me from being able to quickly hit tab to get to the password field. It also makes it so that my password manager can't auto fill everything in one go.

<comment><USER3> Define "one go".

Keepassxc auto-type allows you to add a delay between writing the username and writing the password.

Works just fine for me in these "two step" login scenarios.

Edit to clarify:

This is what I am talking about:

[https://github.com/keepassxreboot/keepassxc/wiki/Autotype- Cu...](https://github.com/keepassxreboot/keepassxc/wiki/Autotype-Custom- Sequence#delay-n)

<comment><USER2> That's added friction. Every standard username/password form takes me only one click to enter into my password manager. Your timing based approach also adds uncertainty. What if the second form is different now? What if the first request doesn't finish in the specified delay time? When dealing with credentials, I don't want to think about any of those things.

<comment><USER4> What if the one-page login has a change that requires two tabs to get to the password field, instead of one? This has happened to me on multiple sites.

What if the one-page login is changed to require additional information? At least one airline loyalty program I belong to now requires User Id, Last Name, and Password to be filled in.

Credential-collecting workflows have myriad ways to break the "standard" of _USERNAME <tab>PASSWORD<return>_ that are present regardless of how many pages the workflow spans.

<comment><USER5> > At least one airline loyalty program I belong to now requires User Id, Last > Name, and Password to be filled in.

Ha! Yes AA's login field requiring both your name and id is annoying but United takes the cake for asking you "secret questions" on every login and you have to pick the answers from a 10-choice drop down.

<comment><USER4> I didn't remember that it was AA. And ultimately, that's my point in all responses to this article.

I don't know the login process for specific services I use. I don't know what they require or how many pages they are. It takes me less than a minute to configure a login sequence. And it works.

So, to me, none of these login workflows are broken. And the games of "yes, but" that others (not you) are playing is silly, because people are trying to tell me I'll be frustrated doing a thing that has decreased frustration for me for years.

</comment></comment></comment></comment></comment></comment><comment><USER6> I completely support the two-page mechanism, for several reasons.

I very much dislike the model where, after entering an email address, the page contents change to redirect you to a different login. For one thing, that's a separate call out to the server, which takes longer than you expect on slow or lossy networks.

Also, I wonder how that UI change appears to someone using a screen reader. I think that, given a choice between this method and a two pages, the two pages is friendlier to the visually-impaired. But I would love corrections on that!

Having an API to match username to login method also means you have more code to maintain, and you have a potential source of information leakage to protect. With separate pages, you can use more-generic technologies, which react upon seeing a weird access pattern (like CloudFlare's DDoS protection interstitial).

I dislike the optional password method for two reasons. First, infrequent users may not remember that they use SSO. They enter a password. If the site takes them to SSO, then it just reinforces the wrong notion that a password _is_ required.

It can also make things confusing if a person uses a site twice, once for work (which uses SSO) and once for home (which uses a password). In this situation, having a username and optional password on one page may interact weirdly with a password manager.

Those were just the first things I thought of. I expect there are more, but then I'd start rambling!

<comment><USER7> The part I dislike about the two page logins is they often don't repeat the login name on the second page.

For Google's logins for instance, there are times when my password manager doesn't get what user I am supposed to log as, and I might also not remember what I chose on the first page (just showing me the account's name doesn't help when I use several accounts with all my real name)

And the opposite issue with realizing on the second page that I am not on the right user or want to change. Depending on the context (e.g. a browser pane popped up by an app) going back is cryptic or just not well supported.

In that sense it's less confusing in some way, more in others. I don't see it as a very good alternative or something that should win the world.

</comment></comment><comment><USER8> I hope someone from Twilio engineering or product management reads the complaints here and actually redesigns their login flow. Multi-step login flows are trash.

<comment><USER9> Especially on iOs, where I have a password manager that won't fill in the email/username step, so I have to manually either find that or type it.

If it's one screen I can just prefill both at once.

<comment><USER10> PayPal handles this pretty nicely, in a way that iOS seems to be happy with.

They have both fields in the HTML, but the password is hidden until the email is submitted. My 1Password iOS integration handles that fine - when I go to the second step, password is there.

<comment><USER11> Initially I was worried about this two-step process in relation to password managers, but I can't think of any examples that trip 1Password up.

</comment></comment></comment></comment><comment><USER12> I love how this article cites Brad Frost's "Don't Get Clever with Login Forms"[1], yet at the same time advocates specifically for doing one of the "don'ts" listed in that cited article ("don't split login across multiple pages").

Reading through Twilio's article, I still don't see a satisfactory explanation why they did it this way instead of just presenting both fields plus a list of buttons for other authentication methods (like what they even acknowledged to be the norm, citing examples like Pinterest and Twitch). If you're trying to dynamically choose the authentication method by looking up some preference associated with the user's email address, then you are exhibiting the textbook definition of overthinking the problem.

If users want to login with Google/Facebook/Twitter/Microsoft/etc. credentials, provide a button for it and call it a day. Those login methods will automatically (in all likelihood) provide an email address for your app to tie to its internal "user" representation (though you might have to explicitly request that particular permission in the OAuth or SAML or whatever flow).

[1]: [http://bradfrost.com/blog/post/dont-get-clever-with-login- fo...](http://bradfrost.com/blog/post/dont-get-clever-with-login-forms/)

</comment><comment><USER13> ...because apparently implementation details have trumped usability.

Regardless of if you use a password manager, or enter the credentials manually, it's adding another step in the flow of an already irritating system.

<comment><USER14> I don't understand this. It's not an "implementation detail", it's a business requirement. That is, the business requirement is that some email addresses have different authentication requirements (i.e. with password or without). There are certainly different ways to handle this, as the article goes over in detail, but they all have different usability tradeoffs, and frankly I think the multi-step is less confusing than some of the other options.

It frustrates me when people, especially engineers, gloss over trade-offs that had to be made because their _particular_ use case isn't as well supported without considering how all users are affected.

<comment><USER15> Choose your authentication method before entering the login details then. What are they going to do if they need to add support for electronic id cards? Add a 3rd page into the login step?

<comment><USER14> So instead of letting the system, which can easily determine which auth system to use based on the email, you're putting the responsibility on the user to remember what they used when they have potentially tens/hundreds of web accounts? Yet somehow putting the password on the next page is worse??

<comment><USER15> If they're going to use a password manager then the password manager will tell them. Your system can't determine if the user signed up with Google or is using an electronic id card either.

<comment><USER16> Yes, it can. How do you think Auth works? You know what auth methods the user has. Otherwise you can't really validate their auth.

<comment><USER15> If you're using an electronic id card then you don't have the same username and password values that your website uses. You likely won't even use the same fields. Authenticating through that usually just involves a separate button.

<comment><USER16> Auth systems don't key off of usernames... When we added FIDO support there's still a backing user store that records user x has FIDO y, with a recording of the public key. That's how the pairing works. You can see it today on login.live.com

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> If you're going to have a 2-page login worflow, just make sure that you aren't making network calls client-side to check if the email is registered on the site.

This is a super easy way for attackers to enumerate valid email addresses to then come back and stuff credentials.

</comment><comment><USER18> Currently working on an authentication server that will have local users, and integrate SSO and 2FA options...

The break in flow is kind of required... I _COULD_ display a disabled password field for the purpose of showing it... I instead opted for having a hidden password field (by size/opacity) so that password managers and auto-fill can populate it... when the user clicks next, the password field will be filled and continue. I _could_ just try logging in with the entered password, if populated then display the password field without error, but this would/should probably count against the bad password attempts.

There's no perfect way here... dealing with the blur event for the text field for similar behavior will also cause alien events and mess with accessibility. Having a clear "Next" is at least a consistent in terms of a11y.

</comment><comment><USER19> I designed and implemented a new login flow for the app I work on. We went from the username and password on separate pages to all fields on a single page and increased our retention significantly within the login/sign-up flow. Turns out the more steps you add to your sign-ups process, the less people want to sign-up at all.

We measured a 20% loss in users per click for the previous sign-up flow. That was quite a shock to see.

</comment><comment><USER20> Google login does this but a password manager autocomplete seems to complete the whole process in a single stage. Dunno if it's cause of a hidden password field or something

</comment><comment><USER4> I see multiple complaints about breaking password manager workflows, but Keepass has allowed me for years to use any simulated input sequence for credentials.

I have many passwords configured with:

        1. Type username
        2. Type <ret>
        3. Pause 750ms
        4. Type password
        5. Type <ret>

Some need an extra tab in there to give the password field focus for input. I have a short template for this, so I can just copy-paste the input sequence into any new password.

<comment><USER21> Except an error will lead to your password being typed in plaintext potentially if the timeout expires and the focus goes back to the login field or another field or url bar

<comment><USER4> What is the threat model here? How am I compromised if part of my password gets typed somewhere else?

It's already plaintext when it's typed. If there's a keylogger on my machine, they're getting the password.

If it's typed into another field, I'm really not concerned. I'm not logged in yet. So if it gets typed somewhere and submitted through a form, it may end up in a log somewhere un-associated with my username.

If the concern is that it's seen in public, this is valid, I guess, but not a concern for me. I access private services in private. Probably 90% of my computing is done in my home.

<comment><USER22> Your browser could crash during step 3, moving focus to the next open window. This window could be a chat window. It's an unlikely situation, but it's not inconceivable.

<comment><USER4> This is not a concern in my threat model.

</comment></comment></comment></comment></comment><comment><USER23> I'd like to know HN opinion on using the first form to pull in and display a pre-selected identification image or statement. Basically to show the user something associated with their account that a phishing site would not have access to, before they've typed in their password. I've seen banks do this and am starting to see it in healthcare.

<comment><USER24> They're awful. If you go to a phishing site and _don 't_ see the image, and you're in the 99% of users, you're not going to say, "oh no, this must be a phishing site!" If you notice at all, you're going to think "they finally got ride of that stupid penguin picture".

Did you ride the bus today? Did you notice whether they removed one of the ads you saw yesterday? Yeah, neither did I.

<comment><USER25> Exactly. This is why EV certificates are a waste of time, too. People notice the _presence_ of things, but they don't notice their _absence_.

</comment></comment></comment><comment><USER26> On mobile GMail sign-in (Firefox on Android), there's a form with an email address and a 'Next' button.

Type into the form and press return and... it clicks the 'forgotten password' link. I'd love to know the UX behind such a significant change to normal behaviour.

</comment><comment><USER27> Why do you need to have a single login page? Why can't you have different login pages for SSO (really, corporate) and non-SSO (really, personal)?

If you have a B2B product where your customer provides an IdP for their users, then provide them with a login link that is tuned for corporate users - e.g. example.com/login/sso. On this page you have a single input box for an email address. Most corporate users will simply bookmark this page and never know that another login page exists.

If you have individual users, then have another login page - say, example.com/login, with a prompt like "<Button for FB login> <Button for Google login> <Button for Apple login> <Button for Corporate login> Or, enter a username and password below: <username field> <password field>". If the user clicks <Button for Corporate login> then it takes them to example.com/login/sso. If the user has a corporate SSO but tries to fill in the password field anyway, process the login request according to the corporate IdP while throwing out whatever was in the password field.

<comment><USER28> I think having two different login pages for the same thing (the service) is worse than having two-step logins. It's just more confusing and requires you to think about it before logging in, which should be super easy and quick.

</comment></comment><comment><USER29> So what would be a good solution when you offer both email/password as well as multi tenant SSO as login methods? I want to cause as little friction, so that would exclude a separate page/url for SSO logins. I could off course remember the user's email the first time, and offer SSO subsequent logins if cookies persisted. However, what to do about the first login? Most of the users will continue to use email/password, and I wouldn't want to show the password field to users that will be going to use SSO. So the password fields need to be conditional on the email (domain). I don't want to hardcode the SSO domains in the login form, so some roundtrip to the backend would be required. I see little option except for separating into two steps. A hidden password field would accommodate password managers and a cookie could remember which login flow was used previously and conditionally show the password field. What are your thoughts?

<comment><USER30> Create a bloom filter of your SSO domains. As the email field is populated check the domain against the bloom filter. If it matches disable the password field and display a message about that domain using sso and the user being redirected. In all other cases use normal password authentication.

In the background use an ajax call to your server to validate the bloom filter. If you got a false positive then revert the UI to the password enabled version, but this will be extremely uncommon with the right size of bloom filter.

<comment><USER16> Are you suggesting that the bloom filter be pushed with the login page? That's like 10 MB of data on every login request. It's almost certainly faster to just do the Ajax call. (Assuming you have around 2 million domains supported - even at 200k that's over a megabyte).

<comment><USER31> That doesn't sound right. At 1MB for 200k domains is 5 characters per domain - the efficiency of that bloom filter is "almost" like sending the domains themselves. An online calculator suggested 230KB for a bloom filter of 200k items (1% error rate).

<comment><USER16> Yeah, 1 percent is way too high is the concern. That will generate support calls and customer complaints. (plus, the same domains will always hit the problem, meaning those domains will specifically ask us to fix it - so... We send an extra list of known domains?)

</comment></comment></comment></comment></comment><comment><USER32> As long as it still works with a password manager, the two-step process doesn't really annoy me. What does is when these break the password manager flow for some reason - I think that should be added to UAT for these sorts of deployments now (especially considering browsers are coming built in with these tools now too).

</comment><comment><USER33> IIRC, O'Reilly's Safari Online did a good enough implementation that handled external authentication (using SAML with an IdP) and on-platform authentication (using email address and password). The login form had both the email and password fields, but once you typed your email address and tabbed to the password field, it would've detected at that time whether you're an SSO user who needs to be redirected to elsewhere for authentication, and if so, it would hide the password field and redirect you when you hit Enter or clicked the Submit button. This requires JavaScript to work, but seemed like a good enough compromise to support both modes.

P.S.: It's been a long time since I used Safari Online. Hence the past tense in the description above. It probably still has the same behavior.

</comment><comment><USER34> I really hope this trend reverses soon.

</comment><comment><USER35> Google's login is especially annoying if you're used to typing username-tab- enter-password-tab-enter. It takes you to the "Forgot Password?" page and next thing you know, you've entered your password in plain text in the e-mail field.

</comment><comment><USER36> I hate this trend. It breaks password managers. Calendly is another service that does this.

<comment><USER36> A solution maybe is to have a second page for password managers. Maybe there should be a standard meta tag with a link to password manager friendly login page.

</comment></comment><comment><USER37> The article itself points to the relevant HN discussion: [https://news.ycombinator.com/item?id=19172225](https://news.ycombinator.com/item?id=19172225)

</comment><comment><USER38> The questions to ask in these situations and about security policy:

1) Are you increasing user friction?

2) Have you significantly reduced the workload of the attacker?

If 1) is yes, then it should be a no-go. A certain baseline amount of user friction is necessary for security. However, any additional friction is going to result in overall worse security for the site. You _want_ your users to be using properly implemented password vaults. Don't get in their way.

If 2) is no, or "only in obscure circumstances," then it's a no-go. Cost- benefit doesn't work out. See 1)

</comment><comment><USER39> It would be great if article would mention a potential security issue with this approach: two-page login forms, which have any conditional logic based on the provided username, may leak the information about existence of that username. This opens possibilities for social engineering attacks ("pay $100500 or we'll tell your wife that you are registered on the dating website").

EDIT: updated my comment to reflect that conditional logic may expose existence of account, but does not necessarily do it.

<comment><USER40> You can't avoid it, username existence is easy to check by trying to register an account. The only solution against the problem you described is to use usernames, which are freely chosen by the user or generated by the website automatically, not email addresses, so that people can create accounts not tied to their identity.

Also, two-step form doesn't mean that you have to check username existence after the first step. But, again, this is useless as mentioned above.

<comment><USER39> It's not always like that. For non-digital businesses account registration flow can be significantly different and not accessible for random visitors. E.g. healthcare provider may provide online access to patient file only after the first appointment.

</comment></comment></comment><comment><USER41> Twilio's login form commits this sin, but goes further and tosses in a baffling "Enable 2FA" checkbox for good measure.

<comment><USER42> This checkbox is extra confusing because it enables 2FA for all users. I'm not sure how everyone else gets credentials when you do that, so I unchecked it after I figured out what I had done. Luckily, I kept the credentials in my 2FA app because someone else later re-checked it.

</comment></comment><comment><USER29> TL;DR: To support SSO (SAML) that doesn't require a password. Good login forms don't necessarily confuse password managers.

<comment><USER43> It can be made to work with password managers by using a hidden password field, they just.. didn't.

<comment><USER44> Or an SSO button, or a different login page (that's very common), or ...

</comment></comment></comment><comment><USER45> Backblaze does this too. I hate it.

</comment><comment><USER46> To break password managers :-( I hate 2 step forms. They make the internet less secure.

</comment><comment><USER47> I was ranting about this the other day. The whole point of programming is to have as few steps as possible.

While we're at it, can we also say forcing 2nd party apps to use Oauth is nonsense that doesn't help anyone do anything.

<comment><USER10> The linked article explains _why_ the second step is necessary.

<comment><USER47> It also gives examples of much better ways to solve the same problem.

<comment><USER10> It specifically calls the other options out as less suitable for SAML users or having other downsides.

Option two: "This option prioritizes handling username/password login, and may work better with password managers, but requires some Javascript handling that could be fickle."

Option three: "It simplifies the page, doesn't require a lookup of the domain, but could be clunky for the platform's SAML users."

Twilio is clearly _aware_ of the other ways of handling this.

</comment></comment></comment></comment><comment><USER48> Login pages nowadays are like a US airport.

</comment><comment><USER49> Whatever reason, this practice needs to die in a fire.

</comment><comment><USER50> To confuse password managers, obviously. :).

</comment><comment><USER51> I hate that shit.</comment>


Joyent raises $15M - <AUTHOR> http://www.businesswire.com/news/home/20100914005707/en

<comment><USER2> This was actually independently discoverable previously, thanks to a story posted by organicgrant a week ago: <http://news.ycombinator.com/item?id=1663993></comment>


Coworkers Make You More Productive - <AUTHOR> http://hicks-wright.net/blog/coworkers-make-you-more-productive

<comment><USER2> She finds a cheaper and more attentive rubber duck to replace the need for a live human being to discuss code with. How cost effective!

<comment><USER3> Glancing over at his office and observing his day-old beard, I'm going to go way out on a limb here and suggest that Tyler is, in fact, male.</comment></comment>


The Subatomic Discovery That Physicists Considered Keeping Secret - <AUTHOR> https://www.livescience.com/60847-charm-quark-fusion-subatomic-hydrogen-bomb.html <comment><USER2> The article hardy makes any sense. You can't make a fusion of bottom quarks because they don't stick together. Reading the abstract of the paper, [http://www.nature.com/nature/journal/v551/n7678/full/nature2...](http://www.nature.com/nature/journal/v551/n7678/full/nature24289.html) the reaction is

Lambda_b + Lambda_b -> Xi_bb + n

(up+down+bottom) + (up+down+bottom) -> (up+bottom+bottom) + (up+down+down)

This makes sense because each quark is inside a baryon with three quarks.

They say this is equivalent to the fusion of

D + T -> He + n

[proton+neutron] + [proton+neutron+neutron] -> [proton+proton+neutron+neutron] + neutron

[(up+up+down)+(up+down+down)] + [(up+up+down)+(up+down+down)+(up+down+down)] -> [(up+up+down)+(up+up+down)+(up+down+down)+(up+down+down)] + (up+down+down)

The analogy is very very very week. They are very different reactions.

The worse part is the total linkbait title. If you somehow magically can create a lot of Lambdas_b, in a very small time all of them will get transformed into protons, electrons and a lot of gamma rays. If you have enough you will have a nice explosion.

But if in the middle of the transformation they collide and produce some Xi_bb, the Xi_bb's will decay soon into protons, electrons and a lot of gamma rays. You don't get more energy because some of the Lambda_b get temporaly transformed into Xi_bb, the final energy is the same, so the risk is obviously zero.

For comparison, Deuterium is stable and Tritium is almost stable, so you can produce and accumulate them conveniently. And a bunch of Deuterium and Tritium will not cause spontaneously a nuclear explosion. But if you convince them to undergo fusion, you get a nice explosion. The final products are stable Helium and almost stable neutrons, so this reaction is enabled because Helium exist, so D+T->He+n is interesting.

</comment><comment><USER3> I think we are nearing click bait here, which is becoming a more and more common on HN

<comment><USER4> How so? It's the original title, and it aptly described the article.

We are probably just becoming more sensitive and resistant to having our feelings manipulated constantly. Which I think is a good thing.

Edit:On second thought, I got further in the article and it's clear that the whole "we almost kept it secret" angle is a total stretch created by the author to make for a more exciting read. Yeah, this is click bait. Although, it's cool to know that you can theoretically smash two quarks together and get a boom.

<comment><USER5> Just because it's the same as the original title doesn't mean it's not click bait. It just means the original title is click bait too.

A non clickbait-y title would explain what the article was about instead of creating mystery so you would follow through.

</comment></comment></comment><comment><USER6> 1 picosecond is about the time it takes light to travel half the length of a single grain of salt. What a Joycean level of measurement.

</comment><comment><USER7> The article talks about fusion chain reactions in hydrogen bombs, but the fusion in hydrogen bombs isn't an exponential sequence of chain reactions, it's due to very high temperatures caused by _fission_ chain reactions in the primary. Hence the term "thermonuclear".

</comment><comment><USER8> Despite the fact that a bottom quark fusion event emits 18 times the energy of traditional fusion (deuterium nuclei), the discoverers note that it's not possible to create a chain reaction of bottom quark fusions. So there are no military applications (or energy applications for that matter).

<comment><USER9> > a bottom quark fusion event emits 18 times the energy of traditional fusion

Small correction. The article says the MeV is 8x not 18x

<comment><USER8> Ah, I stand corrected.</comment></comment></comment>


Freedom to protest in the US is under systematic attack - <AUTHOR> http://www.theguardian.com/commentisfree/2014/feb/13/cecily-mcmillan-occupy-trial-civil-liberties

<comment><USER2> Actually the situation and the violence against demonstrators in the 1930's was far worse, very often fatally worse. Commies and labor unions, you know. Little sympathy from anyone. Police riots were the norm back then and prosecution for their murders was unheard of.

That's not to excuse what's happening, just offering a bit of perspective.</comment>


Perfect Tic Tac Toe AI - <AUTHOR> http://tic.cwoebker.com

<comment><USER2> The AI might be perfect, but the controls are not. I clicked near the bottom right corner, and it didn't register a move for me, but the AI went again. That being said, Tic Tac Toe is not difficult to solve. The connect four game definitely seems more fun.

<http://i.imgur.com/imchk.png>

<comment><AUTHOR> Thanks, I fixed the bug.

</comment></comment><comment><USER3> I really like the minimalist design of the site. The other game I found is more challenging:

<http://connect4.cwoebker.com/>

</comment><comment><USER4> The connect 4 ai was not perfect at all. I beat it 3/3 times.

</comment><comment><USER5> Source?</comment>


The Ug99 fungus could wipe out 80% of the world's wheat crops - <AUTHOR> http://articles.latimes.com/2009/jun/14/science/sci-wheat-rust14

<comment><USER2> While I want to be concerned if this is a very _real_ threat, I have a hard time getting worked up due largely to the many _scares_ that we have nowadays like 'Swine Flu' and 'Avian Flu' or even the 'Banana Fungus'. (Wikipedia is your friend)

I realize that these things can be very real threats, but the media leeching off of the mass fear surrounding possibilities with such far-reaching consequences really desensitizes people. Such reporting makes it hard to sort out which are real threats and which are not. Not only that, it makes it hard to figure out what the _real_ consequences are if these threats are realized.

Questions like, "How does this affect wheat-related grains such as spelt?" are not presented to the reader. So what happens if wheat production takes a major hit? Will we be able to deal with it? Will other crops pick up the slack? Will grains such as oats, kamut, spelt be unaffected? Are there practical considerations related to growing such alternative grains in different localities (the article _does_ mention that there are many varieties of wheat bred to local conditions)?</comment>


How to fire a programmer - <AUTHOR>

Ignoring the issues surrounding the decision to let a programmer go. What should the team/management do when firing a programmer?<p>* What do you tell the rest of the team? * How do you actually go about firing someone? * What do you do if they have copies of code/data on their laptops? * How does the team move forward after this decision? <comment><USER2> You should make it as quick and painless as possible, first thing in the morning and on a Friday. (so that they have the weekend to think about what happened and so that they dont show up on say tuesday if you fired them on monday...awkward)

Get everyone who sits around them first to be occupied in a meeting somewhere else.

5-10 min later...

Then arrive at the employee's desk and tell them that you would like to speak with them for a moment outside. just make a remark as they get up to get any personal belongings.

walk them out the door and let them know that you appreciate their efforts but seem to come to a conclusion that they will not be needed anymore and that HR will have anything they really need from their personal work desk at the end of the day.

First thing Monday let everyone know in a one on one meeting that the employee has been discharged in a serious way.

No one should be making a big deal out of this.

the end...

</comment><comment><USER3> Regarding "how" - do it fast and quick. We recently had some drawn out reorg at my company and it was really stressful knowing something might happen to you. When a firing does it happen, it should be as quick and painless as possible. To move forward, do just that. Give the team a quick explanation of what happened, and then move on with life and start searching for a replacement.

PS - I am not a manager. This is just from observation.

</comment><comment><USER4> If they signed a Non-Disclosure Act then you are covered legally to sue the living crap out of them should they use or distribute the code.

If they have code on their laptops make sure they delete it obviously and get with your attorney.

Just let them go, and let the team know along with the programmer in question as to why you let them go.

<comment><USER5> There really is no practical way to "make sure" they delete anything. They could have seen the writing on the wall weeks ago and smuggled code out.

If I was bringing my own laptop into a job, and they fired me and wanted to see what was on my laptop, the response I'd give them is "show me a court order."

This is one of the reasons why it is a good idea to provide your employees with the equipment they need to do the job.

If it is their laptop, then you do not have the right to go snooping around in it, you pretty much (absent prior written agreement) have to take their word that they have or will delete anything proprietary.

<comment><USER6> Nonetheless, many people steal data from their former employer: [http://www.cio.com/article/481883/More_Than_Half_of_Fired_Em...](http://www.cio.com/article/481883/More_Than_Half_of_Fired_Employees_Steal_Data)

 _[...] employees on the day they were laid off all tried to grab corporate information about high-worth individuals thinking it could help them in the future._

Maybe this should be taken in consideration for your firing process.

</comment></comment></comment><comment><USER5> Firing someone is one of the situations where you can get into legal trouble. So the best advice I can give is to not be heavy handed, and be respectful of the subjects rights and feelings.

The best opportunity to do it would be if they stay later than the rest of the team, or come in earlier, to do it away from the rest of the team. It is humiliating to fire someone and then parade them in front of the team. Asking them to stay late (Eg: 5:30 if the team goes home at 5) on a friday night might be a good way to do it.

You inform them that they have signed a confidentiality agreement and need to delete any copies of proprietary code or data they may have.

Be sure to give them some severance, unless they committed a heinous crime. Some companies make you sign an agreement not to sue as part of severance. Have all this work out after you fire them, rather than on the spot. (You don't want to force them to give up rights in an emotional situation, where they are ambushed by the firing and thus, by definition, have not had an opportunity to consult with a lawyer.)

Whatever they have done, realize this is a failure on your part. Treat them respectfully, and do not fall into the trap of attempting to rationalize or justify it. IF you can give them an honest answer as to why (assuming this is not for cause) then do so. Otherwise they may well assume it is for age, religion, skin color, etc.

Having a letter of recommendation written "To whom it may concern" beforehand and signed by signficiant people in the company (if this is a startup, that means the CEO) would be a classy thing to do. (again assuming it is not for cause.)

If it is for cause then you have to tell them the cause. If they dispute it, then say that decision to fire is made and if they wish to they can of course consult a lawyer.

The team will move forward even if you do everything wrong. But how you treat the employee, no matter what they did, will affect how the team sees you. So, treat them as you would want to be treated.</comment>