California sues Uber, Lyft over misclassifying drivers as contractors - <AUTHOR> https://uk.reuters.com/article/us-uber-lawsuit-california/california-sues-uber-lyft-over-misclassifying-drivers-as-contractors-idUKKBN22H2KA <comment><USER2> The meat of the article is in the second of last paragraph:

> Becerra also referred to Uber's and Lyft's push to include its drivers in a > federal coronavirus relief bill for unemployment benefits. Those benefits > are generally reserved for workers whose employers pay into the unemployment > insurance system, which Uber and Lyft do not.

Instacart should be watching this closely as there's going to be a lot of idle shoppers who haven't paid unemployment insurance as the economy opens up and the populace goes back to in person shopping.

</comment><comment><USER3> [https://news.ycombinator.com/item?id=23082901](https://news.ycombinator.com/item?id=23082901)

<comment><AUTHOR> Thanks Dang, my search did not yield this submission!

</comment></comment><comment><USER4> And the flagellation of Uber, Lyft continues I wonder if this is the straw that will eventually break the proverbial camels back and lead to the demise of ride share apps in the short term</comment>


Tech Prediction for 2013: It's All About Mobile - <AUTHOR> http://bits.blogs.nytimes.com/2013/02/18/tech-predictions-for-2013-its-all-about-mobile/

<comment><USER2> Was it just me or did they forget in this story to make a single prediction?

So tired of headlines crafted to get viewers that bear little or no relation to what is actually contained in the story. I call it the HuffPo effect.</comment>


Ask HN: My asshole tech lead steals my ideas - <AUTHOR> It usually goes like this:
1. I have an improvement idea (architecture, code organization, dependency handling, code checkers, etc.).
2. I propose it to the tech lead (he's not actually a lead, but works at the company the longest and is most knowledgeable and has most influence on decision making).
3. He doesn't accept it. I ran-out-of-arguments/cannot convince him.
4. A few weeks, even months, pass.
5. He proposes the idea as his own.
6. The manager accepts it.
I kinda furious at the moment because it happened again today. I think it's just weird to go to my manager and say it was my idea in the first place. Why he should believe me?
Any ideas how to handle it? <comment><USER2> 1) Propose your ideas in an email, preferable with someone else cc'd on it.

2) Propose your ideas to several people on your team at once.

3) Find someone more trustworthy if you need a sounding board.

4) Talk to your manager.

5) If you don't have good relationship with your manager AND your tech lead, it's pretty clearly time to find a new job.

</comment><comment><USER3> I can tell you from experience that this actually can be 100% unintentional.

I had a friend and he was the king of telling you a problem and knowing that you would have a solution that he wanted fix his way, but make you think it was your own.

Then I noticed people would just not accept something as a solution but it turns into their own idea after a while. It's their subconscious working things out.

I just did a quick google fu and yup it is actually a thing.

[https://www.psychologytoday.com/us/blog/give-and- take/201412...](https://www.psychologytoday.com/us/blog/give-and- take/201412/the-biggest-reason-we-steal-other-people-s-ideas)

<comment><AUTHOR> Well this is really interesting. I wasn't expecting this. Are you suggesting it takes my lead time to digest the problem and the proposed solutions (maybe subconsciously)?

I don't think that I'm making him believe it's his solution tough. Quite the opposite.

<comment><USER4> I use this analogy, you plant seeds in people's minds with your ideas, the ideas grow into their heads and then they realize that it's a good idea. This happens to me a lot with people that doesn't have full expertise in the problem you are trying to solve.

As a suggestion try to be accountable for your ideas in an email or something like that, and when your lead revives the idea refloat your past email.

</comment></comment></comment><comment><USER5> Talk with your manager. Explain him the problem, give him examples, tell him that it frustrates you that your work is not rewarded. Also that it's difficult to work in these conditions since you feel that you can't trust this guy.

If you don't have regular 1:1s with your manager, tell him you would like to speak about something that bothers you. He's your manager, it's his job. If your manager doesn't do anything or refuses to meet you, you should start looking for another job.

</comment><comment><USER6> > Any ideas how to handle it?

Umm... the obvious one: have you talked to the tech lead? _" Hey, I suggested this idea to you months ago!"_ There is a good chance he is not even aware of that he got this idea from you.

<comment><USER7> Normally that is great advice. But the title of the post is "My _asshole_ tech lead ..." so it probably isn't applicable to the situation. :) At least for me, avoidance is the only strategy that works for assholes.

</comment></comment><comment><USER8> Is the tech lead actually proposing it as his idea? As in "Last night I had this idea x, we should do that". Or is he saying to the manager "We should implement x now because..." but leaving out who had the idea?

If it's the latter, he may be doing it unintentionally. I've known devs that don't have the best social skills, and they maybe don't realise that people would like to have credit for their ideas. It may just be that they mulled it over for some time and came to the conclusion it was a good idea. They may have even forgot who gave them the original idea. It may then be a good idea to talk with them and ask why they didn't give you credit.

Moving forward, my suggestion would be to have an email with others copied in. At most places I've worked we've had a developers@ / team.xy@ email. Maybe an email to that address with the idea, and asking for everyones feedback?

</comment><comment><USER9> I've seen this happen before. It's a sign of a toxic work environment. I would either let it go and just make fewer suggestions, or find a better place to work.

</comment><comment><USER10> Have you tried talking to the tech lead and asking him what gives? There is a very high chance that he doesn't even realize what he's doing. Be charitable - give him the benefit of the doubt and be non confrontational.

</comment><comment><USER11> _Why he should believe me?_

Because you documented the idea and either copied the manager on the initial proposal to your lead, or you mailed it to yourself so that you could pull up the email and show it to him in a situation like this.

<comment><USER9> Yes, copying the manager seems to be a means to keep people honest in the workplace, although I find that it breeds passive aggressiveness.

<comment><USER12> If you're using tasking/ project management system just create the task with your ideas moving forward, keep track of your task numbers. Whenever the a-hole try's to steal it, and he makes a task, make sure to update his task as a duplicate of your task.

My other suggestion is keep things close to your vest. If you have the power to implement changes just start doing it. If you don't, start making branches and developing proof of concepts. Start showing your manager before including the a-hole in the ideas. So that if he try's to steal it, then your manager has already seen it from you.

Also if he's doing it to you, your not alone he's doing it to others too.

Whatever you decide to do, if you can get a trusted coworker to also do it. Then there is a pattern of behavior that can't be ignored.

My other suggestion is, get your resume in order, start interviewing. Forget the a-holes name the instance you walk out the door.

</comment></comment></comment><comment><USER13> _Any ideas how to handle it?_

Quit, find a job working with people who aren't assholes.

</comment><comment><USER14> Honestly, this seems pretty typical to me. If you want the idea implemented, you might have to accept the situation. Alternatively, you could make your proposals directly to the manager, or just sit on them.

Obligatory quote: "Don't worry about someone stealing your ideas. If your ideas are any good, you'll have to shove them down people's throats."

<comment><AUTHOR> Yeah... but I still don't like that he takes credit for them and is seen as the guy who improves the code base/organisation the most.</comment></comment>


Delusions Aside, the Net's Potential Is Real - <AUTHOR> http://www.theatlantic.com/technology/archive/2011/01/delusions-aside-the-nets-potential-is-real/69370/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+AlexisMadrigalTheAtlantic+%28Alexis+Madrigal+%3A+The+Atlantic%29 <comment><USER2> This is a really good review. and the book itself is a must read for any citizen that uses internet and cares about freedom.</comment>


The Apple Boycott: People Are Spouting Nonsense about Chinese Manufacturing - <AUTHOR> http://www.forbes.com/sites/timworstall/2012/01/29/the-apple-boycott-people-are-spouting-nonsense-about-chinese-manufacturing/ <comment><USER2> The wikipedia article on sweatshops does a good job of covering both sides of this.

<http://en.wikipedia.org/wiki/Sweatshop>

The pro-sweatshop argument is encapsulized in this example:

In an article about a Nike sweatshop in Vietnam, Johan Norberg wrote, "But when I talk to a young Vietnamese woman, Tsi-Chi, at the factory, it is not the wages she is most happy about. Sure, she makes five times more than she did, she earns more than her husband, and she can now afford to build an extension to her house. But the most important thing, she says, is that she doesn't have to work outdoors on a farm any more... Farming means 10 to 14 hours a day in the burning sun or the intensive rain... The most persistent demand Nike hears from the workers is for an expansion of the factories so that their relatives can be offered a job as well."

The contra argument seems dominated by appeals to emotion ala Mike Daisey:

"_____ can't even afford to buy the ipad he makes",

"_____ only makes X dollars an hour/day/week/month/year."

"X workers were injured/killed in this accident"

"workers often have to work overtime"

"workers have to stand"

I think Mike Daisey should spend some time in rural China with the relatives of Foxconn employees who do backbreaking farm work. But who would go to see that show without "Steve Jobs" in the title?

<comment><USER3> That's creating a false dichotomy, though. Just because a sweatshop may be better than backbreaking farm work, doesn't mean we can't care about what is happening in sweatshops.

Also, it's "Daisey".

<comment><USER4> Ultimately the main problem with sweatshops is something to the effect that "the best kind of job these people can get is at a sweatshop". The real solution probably isn't shutting down sweatshops, but getting these people better opportunities. (Then the sweatshop problem goes away, since people can simply walk away to better jobs.)

Local effort will need to be involved. Some efforts to help organize workers into unions may exist, and will be of some benefit, but without good alternatives to sweatshop employment the picture is incomplete. Places with top-down command economies may also be ill-positioned to create additional opportunity...

<comment><USER5> It is important to understand that sweatshops exist because they offer BETTER working conditions than those locally available.

They look atrocious to us in the rich western world, because they are far worse than our worst jobs, and with that context mismatch, we react strongly.

It's important to remember that we had sweatshops too. Working conditions during the industrial revolution were horrible compared to conditions now, but that period was a necessary step on the path from the agricultural society to todays society.

The way forward is to incrementally make sweatshops better, until the local conditions approve so much that they're the worst alternative, and then they will disappear. But that change can't happen overnight, and it won't happen if you ban sweatshops. It tooks us hundreds of years in the west, it's going to take decades in the third world.

<comment><USER6> Ok. We had horrible conditions during the industrial revolution.

Why does that mean that everyone going through similar economic transformation has to go through the same living and working conditions?

China knows what is possible. I don't think it will take decades for a society that can build a fully functioning, very modern, highly automated factory in 6 weeks /decades/ to get their working conditions in order.

<comment><USER5> There's also the sad fact that there are other countries than China. If China would improve worker conditions in a short timeframe, the cost of employing chinese workers would increase a lot, and that in turn would cause a lot of foregin companies to go elsewhere for their cheap labour.

The whole _reason_ for globalization is that we in the western world improved our own working conditions so much that the cost of labour in our own countries increased to such levels that it became profitable for corporations to outsource. But we're still competitive because we moved up the value chain.

So you need to move everyone up the value chain, and that means you need a way to still perform that labour that needs to be performed, and to do that you need to automate more, add more industrial robots, but there's a limit to what robots can do, and there's a limit to how many robots you can produce in a year.

But we'll get there. Cheap labour will be eliminated, the living standard and working conditions of the entire world will rise, and I think it's better to cheer the fact that it's happening _at all_ , and _faster_ than it did in the western world, than to lament the fact that it's not going as fast as you would _like_.

</comment></comment></comment></comment></comment></comment><comment><USER7> >"If not to buy Apple, what's the substitute – Samsung? Don't you know that Samsung's products are from its OEM factory in Tianjin? Samsung workers' income and benefits are even worse than those at Foxconn. If not to buy iPad – (do you think) I will buy Android Pad? Have you ever been to the OEM factories for Lenovo and ASUS? Quanta, Compaq … factories of other companies are all worse than those for Apple. Not to buy iPod – (do you think) I will buy Aigo, Meizu? Do you know that Aigo's Shenzhen factory will not pay their workers until the 19th of the second month? If you were to quit, fine, I'm sorry, your salary will be withdrawn. Foxconn never dares to do such things. First, their profit margin is higher than peers as they manufacture for Apple. Second, at least those foreign devils will regularly audit factories. Domestic brands will never care if workers live or die. I am not speaking for Foxconn. I am just speaking as an insider of this industry, and telling you some disturbing truth."

This doesn't excuse Apple or any of the other companies working with Foxconn, but it suggests that there are many sides of this issue, and many voices yet to be heard on it: [http://www.theatlanticwire.com/technology/2012/01/many- chine...](http://www.theatlanticwire.com/technology/2012/01/many-chinese- workers-want-those-jobs-foxconn/48101/)

</comment><comment><USER8> Isn't it an Xbox Boycott? A Dell Boycott? An HP Boycott?

It's annoying when journalists (NY Times in this case) hang their story on the Foxconn client doing the most to keep track of working conditions, just because Apple is a name that gets readers.

More to the point, as the article recounts, it's not clear Foxconn is China's worst problem. It seems it's even safer to work there than in America.

"Read" this infographic: <http://media.tumblr.com/tumblr_lym1w8YedI1qbv2gy.png>

<comment><USER9> I think it's even more odd that Apple somehow has become the medias corporate prodigal son that can do nothing wrong.

People need to realize that Apple is no longer the upshot company trying to survive under the boot heel of Microsoft, but actually a vastly profitable company utilizing all the methods expected from a global industrial giant.

Stop treating Apple as if they are some form of 'do good' company!

<comment><USER10> This article is a reaction to a media feeding frenzy around Apple's supposed abuses of Chinese workers. Your view that the media treats Apple with kid gloves is out of date.

</comment></comment></comment><comment><USER11> The problem that Apple is experiencing is the exposure of the tension between its marketing and its image, and reality.

The author of the article says, "That's what being poor means, having to work extremely hard to make very little. Yes, that is a harsh thing to say but then reality can indeed be harsh."

No one would deny that reality can be harsh. At the same time, you can't deny that Apple - and, of course, the other electronics companies - does not truthfully convey that reality to its customers. Doing so would not be in Apple's best interest. However, if this boycott succeeds, it would demonstrate that having this tension between reality and image is also not in Apple's best interest.

The article also makes the standard corporatist argument that the behaviour of corporations is outside of their control, because they are subject to market forces.

This tact ignores the human factor. Apple is made up of humans. It is not humanly impossible to demand that a supplier adhere to higher standards than are prevalent in the rest of China.

Setting that aside, let's examine the issue purely from the standpoint of the marketplace, but rather than looking at the Chinese labour marketplace, let's look at the American consumer goods marketplace.

Humans respond to a variety of different factors when making purchasing decisions. It is not just about price and quality, but can also be about morality and emotion. In this instance, Apple's customers may be persuaded to boycott Apple because of these subjective factors.

That may seem unfair to some, but isn't that just a risk of globalization? After all, a global company must deal with market forces everywhere it operates: both market forces affecting who makes its products, and market forces affecting who purchases them.

Apple will be forced to balance these market forces, and when it does so, it may result in lower profit margins but better working conditions at its suppliers' factories.

<comment><USER12> "The problem that Apple is experiencing is the exposure of the tension between its marketing and its image, and reality."

It's funny how relevant the Eloi and the Morlocks still are today, more than 100 years after being put down in ink.

<http://en.wikipedia.org/wiki/Eloi>

<http://en.wikipedia.org/wiki/Morlock>

</comment></comment><comment><USER13> I am sick and tired of hearing how the suicides are no big deal because they are less than the national average.

1) You don't know the non-jumping suicide rate. There could be plenty of workers who take their lives privately in their dormitories.

2) Jumping off a roof of your workplace is a VERY different type of suicide then swallowing a bunch of pills. It's making a statement about who the employer is and what they have driven the employee to do. There would be a national alarm if we had 18 blue-collar workers jump off the roofs of a GM plant.

<comment><USER14> > There would be a national alarm if we had 18 blue-collar workers jump off > the roofs of a GM plant.

I don't necessarily disagree with you, but I did want to point out the faulty logic at play here. It would be a _national_ alarm because this number is very high _for our nation_. Any time you're dealing with foreign cultures it's easy to forget about all of the things that are only true for your culture.

Eighteen suicides sounds awfully high, but if it's lower than the average it's actually progress. I'm sure we'd all be much happier if the number was zero, but I'll take progress toward an ideal over ineffectually trying to force it to happen immediately.

 _note: I have no idea what the average suicide rate is in China, "as a public statement" or otherwise. The article quotes 22/100,000/year and extrapolates from that to say that Foxconn is "doing well." My point is that judging foreign cultures by your own standards is a dicey game, and sometimes you just have to be content with improvement instead of trying to mandate equality._

<comment><USER13> _It would be a national alarm because this number is very high for our nation_

Eighteen was just using the number in the article. A national alarm would be sounded if 3 workers jumped to their death at a GM plant last year. GM executives would be tripping over themselves to show remorse, there would be a 60 Minutes specials on the reason GM drove the employees to their deaths, psychologists would be called in to help workers, etc., etc., etc.

The point is that people would be alarmed, as they should be. People wouldn't be making excuses that suicide happens, deal with it.

 _Eighteen suicides sounds awfully high, but if it's lower than the average it's actually progress._

Again, we don't know the suicide rate of employees Foxconn. We know the number of people who have jumped to their death. You can't extrapolate a subset of the suicides and compare that to the national average for all suicides.

<comment><USER15> People probably would be irrationally alarmed. People are also irrationally alarmed when one pretty blond girl vanishes, or when a moron tries to set his underwear on fire on a plane. 60 minutes does devote undue attention to such things, and Obama would probably say "something must be done".

People are more irrational about some topics than others. So what?

<comment><USER13> _People probably would be irrationally alarmed._

It's irrational to be alarmed about a company driving workers to commit suicide? Are you seriously making that argument?

<comment><USER15> Yes, it is irrational to worry about a suicides rate of a subset of people which is not statistically different than the suicide rate of the nation as a whole. You'll note that I'm not applying any double standard to China - I made the exact same argument two years ago about France Telecom: <http://news.ycombinator.com/item?id=872813>

<comment><USER16> You did not respond to his point that the suicide rate of people who jumped to their deaths is unlikely to represent the entire number of suicides. I tend to agree with him.

Given that someone is posting an infographic here that appears to tacitly claim that the few workers who jumped represent the _entire_ list of suicides at Foxconn, you'll forgive me if I want to examine the data sources and know exactly how the reporting mechanisms work.

Because when I see how anomalously low it is compared to the suicide rate pretty much everywhere else, exactly one thing springs to mind: under- reporting.

<comment><USER15> I was merely responding to his point about 3 hypothetical suicides at GM, not defending Foxconn against all charges. If you have better data on the suicide rate at Foxconn, go ahead and post it.

<comment><USER16> Fair enough, but I sincerely doubt that anyone has accurate information on the suicide rate at Foxconn. I just can't believe in anomalously low statistics compared to everywhere else given with no data on how the information was collected.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> China is undergoing the biggest urbanization in history. More and more people are moving from the country side to the city to find work, make more money and improve their standard of living. As already mentioned in this thread, the jobs available at the likes of Foxconn are better paid, and probably safer than other alternatives available to a semi / unskilled worker.

Let me put it another way - a child of a worker employed at Foxconn now will have better opportunities in the future (with access to better schooling, more money) than the child of a poor farmer in the country side. I believe a similar sort of change happened in most industrialized countries during periods of rapid industrialization. Perhaps some of the people considering a boycott of Apple's products have a great grandparent who moved to the city and worked long hours for "low pay" about a hundred years ago!

</comment><comment><USER18> > _"That's what being poor means, having to work extremely hard to make very > little."_

"Being poor" means not having very much money.

Working extremely hard to make very little, when one does not care for the work and has little practical alternative is being exploited.

This is or is not to say that Apple or Foxconn is exploiting the workers.

The argument attributed to Krugman is essentially the same argument that was advanced in opposition to divestiture in apartheid South Africa in the 1980's - that economic exploitation is better than change.

<comment><USER15> Krugman's argument does not apply to apartheid.

I'll make an analogy. If you are punching someone, I might punch you back. In the short run, this action harms both your face and my hand, and I might accidentally step on your victim in the process. Counterproductive, right? But in the long run, it provides you an incentive to stop punching the victim, and they wind up better off. Similarly, economic sanctions against South Africa would harm everyone in South Africa (including the victims), but might cause the ruling elite to change their behavior.

In contrast, if you are sick, punching you won't help. You are now more motivated to get beterbut so what? There is no simple action you can take to become better. Sanctions against China or Foxconn are closer to this situation - there is no simple action they can take to stop being poor.

Interestingly, I've been told by a couple of black South African that life was indeed better in many ways under apartheid. As it was described to me, "at least under apartheid, if your sister gets gang raped, the cops will beat down the N __* who did it." (Very rough quote, I'm remembering a conversation from 2004.)

(Side note: isn't it surprising to read old Krugman? These days it's easy to forget that he was once an economist.)

<comment><USER18> Yes, yes, Krugman's argument does not apply to apartheid.

It is the logical form of his argument which parallels the form of arguments made against divestiture in the apartheid regime. The logical form of the argument may be summed up as "the possibility of distant perverse effects outweighs the value of more immediate virtuous effects."

A analogy would be, we have a contract which requires me to pay you in cash. When you come to receive payment, I refuse to pay cash on the grounds that you might become infected by a virus on one of the bills.

</comment></comment></comment><comment><USER19> Well Apple and Foxconn are swiftly constructing a vast manufacturing installation in Brazil right now. Several actually. So now maybe everyone will stop complaining about working conditions. But I doubt it.

Of course...maybe they will just start complaining about the D@#N Brazilians stealing our jobs. Somehow I think complaining is just part of what people in the developed world do.

<comment><USER20> That and exploiting third world workers.

</comment></comment><comment><USER21> Call me heartless... a job needs doing. Someone is doing it.

If Apple ran these factories then yes, boycott them. However they don't. They hire Chinese companies to put their products together.

This is a China problem not an Apple problem. China can introduce work standards, maximum working hours, minimum pay etc. Contracts can then be renegotiated or whatever.

As things stand though the factories are supplying jobs to those who need jobs. If the jobs weren't required the people wouldn't be doing them.

Is the situation good? No. However, this is an issue for the Chinese Government. You introduce law's, factories follow laws, working conditions improve.

It would be bad business for Apple to narrow its margins in such a competitive market to provide better working conditions than the majority of other shithole factories in China.

</comment><comment><USER22> The issue is not about economics, it's about morality. His economic arguments are sound, this is indeed how capitalism works. Apple (and many others) have made a decision to introduce a level of indirection - the Foxconn people are legally not Apple employees, but for all practical intents and purposes, they are.

Just like pollution, gross worker exploitation has been largely eliminated in the first world* and has just been relocated to the third world.

The question is whether Apple and the consumers who support them should morally continue on their path.

* "largely eliminated" does not mean that there is not significant abuse, just that as a percentage of the employed population, it's historically very small

<comment><USER23> I don't understand the argument here. If the issue is morality, then an effective boycott of Apple products harms Chinese workers, because nobody is working at Foxconn instead of some better latent opportunity in the Chinese economy.

If Apple paid workers the prevailing wage for US skilled labor, Apple would not be paying workers in China at all, because the discount on labor is the primary reason it outsources to China.

One looks at the spread between Apple's COGS and Apple's list prices and wonders how it can be reasonable that Apple captures that whole spread. But that's why we have markets: over time, wage pressure erodes Apple's margins; Foxconn (or comparable companies) obtain better clients, or are simply forced to increase their cost because of competition from other firms.

When Apple responds to that pressure by finding another third world country to buy from, it's simply repeating the same process in that country: unless they source forced labor from Myanmar or North Korea, the only way they can get labor is by _improving_ the wages that were already available in that country.

Part of the issue here seems to be the (unreasonable) expectation that _one company_ can fix third-world rural poverty _instantly_. Improving the lives of millions of people in Asia is a process that will involve many, many countries and take many decades.

<comment><USER24> > _Part of the issue here seems to be the (unreasonable) expectation that_ one > company _can fix third-world rural poverty_ instantly.

I think you've hit the nail on the head here. It's easy to hate big corporations, but even if you make the argument that they are exploiting workers, what are the alternatives?

If Americans truly have a moral responsibility to improve Chinese lives, then actually what is necessary is a foreign policy that directly aims to level the playing field between the countries. It might be something effectively akin to an international progressive tax, I don't know what form it would take, but the point is that Americans would never stand for this. People are already complaining daily about losing their jobs to overseas workers, and the entire culture—both cultures I believe—are based on competition. Corporations are just a handy scapegoat to assuage our liberal guilt.

</comment></comment></comment><comment><USER25> LOL

As if Apple is the root of all problems. As if Foxconn only manufacture products from Apple. As if people are FORCED to work in those conditions. As if they DONT have a choice of not working there.

And i am sorry peeps, what happen if Apple suddenly decide to double pay Foxconn? What happens if EVERYONE double pay them? Would those people get double their salary?

And it is great that Foxconn are now considering using Advance robotics instead, more people Jobless, more people suffer.

Oh, and i forgot, American has once been through this stage as well, and looking from the web it is obvious they dont teach history there.

</comment><comment><USER26> We should just have tariffs on imports that don't meet our labor and environmental standards.

<comment><USER27> That would never pass, but assuming that it did, it would cause a consumer revolt when people saw the higher prices on their toys (even if it only applied to luxury goods).

<comment><USER28> That's a rather defeatist attitude. People would be all for tariffs if they were told that it makes American workers' labor more competitive.

</comment></comment></comment><comment><USER29> There's an Apple boycott? First I have heard of it.

</comment><comment><USER9> I don't get it. How is it NOT a valid point of concern that Apple has 70% margins on some products that are produced by extreme low income workers under bad conditions?

<comment><USER30> But it's obvious, isn't it? The workers choose to work there, for that income and under those conditions. This means that all alternative options available to them are worse (like working for even lower income and in worse conditions, or even not working at all). So, clearly, Apple has improved their conditions. Plus, Apple is doing it at profit -- which means that that improvement is sustainable. Isn't it marvelous? I mean, I don't like Apple products, but I have to give it to them: they change lives of thousands of workers for the better.

<comment><USER3> _The workers choose to work there, for that income and under those conditions_

Considering how many workers who choose to work there are underage, you can't exactly say that they are giving meaningful consent to work there.

<comment><USER30> But I believe I can. These kids often choose between living in hopeless poverty and earning a reasonable living. It's pretty plain and simple. You don't have to be 21 to make a rational decision in a situation like this.

<comment><USER3> I was thinking more along the lines of 13-year olds, as Daisey encountered in his travels. There's a reason why developed nations don't let children enter into contracts.

<comment><USER31> Yeah, the reason is they can afford it. Because developed nations have a safety net that puts food on the table while those kids are at school instead of work.

The whole equation is different for developing countries.

</comment></comment></comment></comment></comment></comment><comment><USER32> This is a load of crap. I think this attitude of justifying someone's wrong doing by pointing out that everyone else is doing it, is just hypocrisy. On the other hand I cant agree with people lashing out on apple because of this practice, although i do disagree with the practice in the first place. I will tell you why this seemingly contradictory stand isn't contradictory at all.

The practice of exploiting someone else's weaknesses for one's own advantage is widely spread and even sanctioned by some societies in general (implicitly and sometimes less so), the bottom of the problem is not tech companies abusing poor workforce, it is the general lack of consensus as to what is fair and what is not. Singling out a single actor from the flock is also unfair (such as is the case today with Apple - and just because they are so successful-). Not is it only unfair, it is counter productive because it will hurt apple and in no way do any good to the chinese workers.

Now, we want to fix the problem? Then we need to first figure out what the fuss is all about, and i say that is easy!

This entire argument, it looks to me, boils down to fairness. The question of What is Fair, and what is not (or evil if you will). It is not a new argument, for ages people have tried to settle on a general agreement on what it is to be leading the good life. Religions were built around this and constitutions were designed for that as well; the social contract that defines who we are as Americans, Chinese, Arabs, French, Christians, Muslims etc.... It has however been very difficult to bring all these people to agree together to one single approach to life, and so over eons people have "siloed" each with their own "moral code".

And i say companies (including apple) have all abided by these contracts and are not abusing any of their compatriots. So in essence they are not in violation of anything. Why? simply because the "abused" -by western standards- people you are concerned about are not being abused in America, but in China, and what's more? Their treatment is not considered to be abuse in China, it is legal THERE.

This is horrifying, because it is cool to indirectly abuse someone overseas as long as you treat your compatriots fairly? I say not, but in order to make it un-cool we need to agree to a new universal bill of ethics where things are more defined and definitive like What is a minimum fair working condition universally.

What now?

I think it is time for tech companies that have made billions (including apple) to take a step back and ponder their moto "we do stuff that changes the world", add to it " ... to be a better place for all" and apply it on all the aspects of their business. This new bill of ethics once finalsed can be "ratified" by these monster companies and others will follow. The reason i am specifically speaking of tech companies it because i know tech and the hacker spirit and i can assert that there is a general good will and faith to make the world a better place, and since the world has given us, and still is, great things and lots of appreciation, the industry and community is mature enough ,now, to start giving back and leading by example.

</comment><comment><USER33> _At best, forcing developing countries to adhere to our labor standards would create a privileged labor aristocracy, leaving the poor majority no better off._

I'm tired of this apologist bullshit. It's been showing up in HN articles for weeks now.

Yes, I understand the concept that the standard and cost of living are lower in China. I understand that it may be better to have children working than starving on the streets. I understand that rural farm life in China is terrible.

That is absolutely _no excuse_ for keeping people in near-slave conditions. That is no excuse for allowing people to be maimed (by machinery _and_ by non- stop repetitive, back-to-back 12 - 16 hour shifts) with no compensation. That is no excuse for allowing people to be blacklisted if they make any complaint about working conditions.

Apple is now sitting on $100 _billion_ and still telling us that their products could never be manufactured in the US. Hilariously, one reason they cite is that you can't find a fab plant right next to a glass plant. Guess what? Build them both in the US, pay reasonable US wages, and provide reasonable US working conditions.

If Apple's success _requires_ that 8,000 people be put instantly onto production lines for insanely long shifts, day after day until their bodies fall apart, _then their products should not exist_.

<comment><USER34> It's all so emotional isn't it?

If you rage harder maybe our Chinese people's life would magically become better.

Or in fact you do not care as long as your shinny new toys are isolated from the poverty and suffering of the rest of the world and manufactured in your sunshine and rainbow and god's chosen America.

Apple's success enabled Foxconn and other suppliers to employ literally millions of Chinese people, millions of otherwise poorer people to each send home $3000+ dollers per year.

It's ugly, it could be better, some aspects of the factory life need immediate improvement even by Chinese standard, on humanitarian reasons alone.

It has nothing to do with Apple's 100B reserve. It's not that Apple can not afford it. It's my country, China, with its vast under educated labor surplus can not afford the US dream, can not abandon low value add manufacturing industry.

<comment><USER33> _Or in fact you do not care as long as your shinny new toys are isolated from the poverty and suffering of the rest of the world and manufactured in your sunshine and rainbow and god's chosen America._

Instead of being a dick, why don't you read what I've written more closely?

Manufacturing in the US is just _one option_ , which I suggest because they insist that they can't possibly do anything to improve labor conditions at the Chinese factories.

 _China, with its vast under educated labor surplus can not afford the US dream, can not abandon low value add manufacturing industry._

Nobody is saying China should abandon its manufacturing industry. People are saying that _labor conditions_ should be better. This can be done without destroying China's manufacturing sector.

<comment><USER34> I'm an asshole, not a dick. Mind you.

Apple can and is trying to improve the labor conditions at its supply chain. That's the whole point of its annul report. Foxconn is trying too. Those companies' primary goal is money, suicide workers cost a lot of money. Bad PR cost a lot of money.

What's impossible is suddenly western standard living, what's impossible is immediate strict labor law enforcement, what's impossible is working condition the same level as in the US.

<comment><USER33> _What's impossible is suddenly western standard living_

Why do you, and others, keep bringing this up as if anyone asked for that?

<comment><USER34> Because in almost every article about Chinese Labor practice it was filled with details describing how horrible those dormitory livings were, using colorful words like slave-labor, soul-crushing etc.

But to a lot of Chinese people, living in the complex certainly is not nice, but not unimaginably horrid either. I spent half of my college years with 7 other dudes in a room about 130 sqft, for example.

<comment><USER33> I think you need to read more about the conditions at Foxconn.

In college, you weren't doing mind-numbing 12 - 16 hour shifts, the same actions day after day after day until your body failed. You weren't blacklisted for complaining to whoever ran the facility. You weren't maimed by machinery and subsequently completely ignored.

There is a _lot_ to be done that has absolutely nothing to do with a "western standard of living".

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> <http://www.apple.com/supplierresponsibility/>

[http://www.apple.com/supplierresponsibility/code-of- conduct/...](http://www.apple.com/supplierresponsibility/code-of- conduct/labor-and-human-rights.html)

[http://www.apple.com/supplierresponsibility/code-of- conduct/...](http://www.apple.com/supplierresponsibility/code-of- conduct/health-and-safety.html)

[http://www.apple.com/supplierresponsibility/code-of- conduct/...](http://www.apple.com/supplierresponsibility/code-of- conduct/environmental-impact.html)

<http://www.apple.com/supplierresponsibility/auditing.html>

</comment><comment><AUTHOR> From the article:

 _> Boycotting Apple for better Foxconn wages and conditions is like having sex for virginity. Entirely counter-productive and exactly the wrong thing to be doing._

<comment><USER9> I think it's pretty much proven without a doubt that public opinion can sway corporations and politics. I really don't understand this form of 'Corporate protectionism'.

</comment></comment><comment><USER36> Oh thank God we as a consumer society are trying to sweep this issue under the rug. It's starting to ruin the enjoyment of my Apple products.

Those so called hard working conditions where poor Chinese people work 16 hour days 7 days a week in unsafe conditions until they're literally crippled... they should be grateful they even have a job.

What are these workers expecting? Compassion? Sorry. They were born in the wrong country. God bless America!

The sooner we can rationalize this issue away, the better. I don't need the guilt trip, and I sure as hell don't need the inconvenience.

<comment><USER37> Masterful satire.

</comment></comment><comment><USER38> i wouldn't expect less from an economist. just hear his paradoxes:

1st he quotes: "First of all, even if we could assure the workers in Third World export industries of higher wages and better working conditions, this would do nothing for the peasants, day laborers, scavengers, and so on who make up the bulk of these countries' populations. "

tl;dr: even if you raise those workers pay, it will do nothing for the other workers in the country

2nd he concludes: "Wages paid to manufacturing workers in China are not determined by the productivity of those specific workers. They are not determined by US wages, by the profits that Apple makes nor even by the good intentions of the creative types that purchase Apple products. They are determined by the wages paid by other jobs in China and that is itself determined by the average level of productivity across the Chinese economy."

tl;dl: the workers are paid poorly because everyone in the coutry is badly paid.

see what he did there?

he just used the cause of the problem as a consequence and dismissed it!

boycott apple (and others!) so that those specific workers wage will rise to please public opinion, and with that, the wage of everyone else will also rise!

<comment><USER39> And where is the money for "everyone else" going to come from?

<comment><USER40> Africa. Somebody has to pull the short straw, I guess - your objection indicates that you would agree that somebody will have to be exploited

<comment><USER39> No, it indicates that a complex economy takes time to develop because so many structures therein rely on each other.

Are you suggesting that if a billion Chinese were to be transplanted to the USA tomorrow they would all find good paying jobs? Where would the infrastructure to support all this come from? Now add to this the fact China doesn't even have the economic infrastructure that the USA does.

I don't see any exploitation here only gradual growth and development.

By your logic I assume you believe Africa needs to be exploited for the benefit of the Chinese?</comment></comment></comment></comment>


America's Worst Charities - <AUTHOR> http://www.tampabay.com/americas-worst-charities/ <comment><USER2> What matters is how much money is eventually spent for the cause. See [http://www.ted.com/talks/dan_pallotta_the_way_we_think_about...](http://www.ted.com/talks/dan_pallotta_the_way_we_think_about_charity_is_dead_wrong.html)</comment>


Ask HN: Captcha Alternatives? - <AUTHOR> TLDR: I help with a gaming community-related site that is being targetted by a script kiddie, they are registering hundreds of thousands of accounts on our forums to 'protest' a cheating (aimbot) ban. They then post large ASCII art spam, giant shock images (the first one started after we blocked new accounts from posting [img]), the usual.
Currently we use a simple question/answer addon at registration time - it works against all untargeted bots and is just a little "what is 4 plus six" or "what is the abbreviation for this website" type of question. It's worked fine for years and we don't really get general untargeted spam.
I am somewhat ethically disinclined to use reCAPTCHA, and there are some older members that can't reasonably solve hcaptcha easily. Same for using heavy fingerprinting or other privacy invading methods. It's also donation-run, so enterprise services that would block something like this (such as Distil) are both out of budget and out of ethics.
Is there a way I can possibly solve this? Negotiation is not really an option on the table, the last time one of the other volunteers responded at all we got a ~150Gbps volumetric attack.
I've tried some basic things, like requiring cookie and JS support via middleware; they moved from a Java HTTP-library script to some kind of Selenium equivalent afterward. They also use a massive amount of proxies, largely compromised machines being sold for abuse. <comment><USER2> * Allow new accounts, but hide messages from them until their posts are verified manually and the accounts are either approved or shadow-banned.

* Don't delete ban accounts, don't notify them in any way, but tag their IPs and cookies to auto shadow-ban any sock puppets, so that these don't even make into an approval queue.

* Use heuristics to automate the approval process, e.g. if they looked around prior to registering, or if they took time to fill in the form, etc.

* Add a content filter for messages, including heuristics for an ASCII art as a first post, for example, and shadow-ban based on that.

* Hook it up to StopForumSpam to auto shadow-ban known spammers by email address / IP.

* Optionally, check for people coming from Tor and VPN IP, and act on that.

Basically, make it so that if they spam once, they will need both to change the IP _and_ to clear the cookies to NOT be auto shadow-banned. You'd be surprised how effective this trivial tactic is.

All in all, the point is not to block trolls and tell them about it, but to block them quietly - to discourage and to frustrate.

<comment><AUTHOR> We already tag/drop all Tor and VPN traffic. Cookies don't make much sense because this looks like browser automation, not someone just swapping VPNs by hand repeatedly.

For IP bans, they are now using illegitimately acquired or fraudulent IP space (the guy is not intelligent enough for this, he's almost certainly just buying proxies with in-game gold or some BS - but there is a criminal element here), including what might involve significant hijacking of AT&T, CenturyLink, Level3, and Windstream network resources.

(if you work at one of those places and are clueful, I would be very interested in asking about this)

<comment><USER3> By the way how do you detect VPN traffic? For tor we just pick up the list of exit nodes but we've had trouble identifying VPN without using a 3rd party API.

<comment><USER4> I know a site just banning a IP opening 443/tcp. It bans web server and possibly ssl-vpn server, but causes false positives.

<comment><USER5> we are a stealth startup founded by former Paypal and Coinbase engineers. We have a device intelligence product that can detect accesses from proxies/VPNs without using any IP list. We can also detect the True OS that someone is using - useful to detect emulators and script kiddies. Happy to chat if of interest: info AT sardine.ai

</comment></comment></comment></comment></comment><comment><USER6> Other posters have given good advice on technical aspects. I'd like to add my experience from moderating a large subreddit.

Focus on making it not fun to troll. Never acknowledge the disruption. Make all your countermeasures as silent as possible. Never address the script kiddy directly. Don't accidentally make a "leader board" or similar by counting number of bans/deleted posts etc.

Eventually it just becomes a waste of time to scream into nothingness and they will go elsewhere.

</comment><comment><USER7> A method used by a german community once was the troll throttle. The basic idea being that troll and spam content compressed better than average content.

So you point various compression algorithms against your community content to form an average/median/other statistical points. Try both compressing each post individually and compressing it as one giant text corpus and counting the size growth a post generates by being added. These are your measurement points.

An incoming post must solve a captcha to be able to post, however, the likelihood of solving it is tied to the compressability of your post.

A compressable post is likely to be spam or ascii art. The captcha fails even if the data was entered correctly. IIRC I used a relationship of 'min(1, sqrt(1/compress_factor)-1.05)'.

A non-compressable post is not only likely to succeed a captcha, they might succeed even if they actually failed it.

The entire point is that it shifts balances. Trolls will have to submit their posts a few times and resolve captchas, which slows them down. Making content that does not compress well across a variety of compression algorithms, especially if you also account for existing text corpus, is a very hard problem to solve. They'd have to start to add crap to the post to bloat it up, at which point you can counter with the next weapon.

Repeat all of the above, except instead of compression, you estimate entropy. High entropy blocking means you can block messages containing compression decoys.

<comment> 0-_-0 The best part about this is it's difficult to figure out how the detection mechanism works to counter it, and I really like the idea, but isn't it easy to just add random noise to the a post to give it the right amount of entropy?

<comment><USER7> It would be quite an art to generate a legible post that contains both ASCII art and a consistent amount of entropy without containing too much entropy or being too compressible.

And since posting it adds it to the compression dictionary, it's likely to only going to work some time before it gets compressed better.

You'd be fighting yourself more than the captcha. Plus an attacker would now have to, in order to figure out if a post will work or not, attempt to compress the post over X number of compression algorithms (plus of course the unknown text corpus of the long-term compressor) as well as estimate entropy via Y algorithms. You'll be wasting a lot of CPU on these tasks.

Meanwhile, humans have no issue because while english does compress somewhat, when we express unique ideas it's less compressible then when we do not.

<comment> zupa-hu > it's likely to only going to work some time before it gets compressed better

Unlikely, random noise does not compress. It's practically always unique.

<comment><USER7> But that triggers the entropy detector.

</comment></comment></comment></comment></comment><comment><USER8> We're a UK company, and we had an incredibly persistent spammer. He'd also send us threatening emails. His persistence and nastiness was draining and quite frankly impressive how much time he was putting into it all.

I don't know if it was coincidence, but after some sleuthing found his real name and did the online FBI tip-off form about his emails to us. He had a bad history and may of been on bail.

Stopped pretty promptly after that - guessing he got a phone call.

</comment><comment><USER9> You didn't mention email confirmation in the first place but figure I'd mention this for others. I recently ran into a similar situation and had the idea of registrants emailing ME a secret code I give them instead of confirming they receive it. Still technically automatable but would definitely throw a curveball to the bots. I confirmed with an Ask HN that this is a secure method: [https://news.ycombinator.com/item?id=24116530](https://news.ycombinator.com/item?id=24116530)

</comment><comment><USER10> Not the answer you're looking for, but reCaptcha is probably your best option.

I attempted half a dozen mitigation strategies to prevent spam on one forum I ran. I tried honeypots, questionnaires, other captchas, and proxying services to block bots. They slowed the bots at best, but when there's a torrent of bad actors it really doesn't matter if you slow them down 50%.

I finally installed reCaptcha and it solved the problem instantly. Not a single bot has signed up in 6 months. I started getting suspicious that signups were just broken, but I tested it and it was fine.

After that experience, I'm very much on team reCaptcha. I tried hCaptcha as well (on a different project), but found it was much harder to solve.

<comment><USER3> Also, after you hit a certain number of users the "bad actors" sometimes have people behind them manually adjusting their bots' algorithms to match your tricks.

</comment></comment><comment><USER11> HCaptcha founder here. I am sorry you had trouble solving captchas. Perhaps your older members might have luck with [https://www.hcaptcha.com/accessibility](https://www.hcaptcha.com/accessibility).

<comment><USER12> Gosh, your captcha are really hard to solve, and I'm not even 25 year olds yet. Sometime I can't understand the question and what I should select because the images are showing only small part of the objects, and it's keep going and keep going, I must solve 5 - 7 questions before I can access to the target website.

<comment><USER7> For me it's the opposite. hcaptcha questions are usually atleast solvable, even if you get some parts wrong. Google usually wants me to solve 4-5 of the image questions, sometimes I just get fully blocked without explanation and can't solve further captchas.

And that is on top of not having to give more data to google.

</comment></comment></comment><comment><USER13> client side, GPU bound challenge (the user doesn't do anything but wait for a spinner to load, the javascript has to solve a np hard problem).

won't block all spammers, but will increase the server cost (even for selenium) to the point where they'll have to get GPU instances which will be too expensive for a script kiddie.

this is what cloudflare is sorta doing when they say "verifying your browser"

<comment><USER14> How will this stop a bot that has embedded browser in it? For the bot is just a thread that will wait on "cloudflare verification" to happen. Not that hard to bypass

<comment><USER15> It will cost server resources for the attacker. It's not just waiting, it needs to actually solve the problem.

<comment><USER16> Unless you make it very expensive (which would turn legitimate users away, because they don't want to wait for a minute to sign up), that won't help, I think. You tie up a core for 5 seconds, but the server has 12 of those, so they can create 12 accounts every 5 seconds => still too much to handle in moderation.

<comment><USER7> It's 12 accounts per second instead of 600 per second if it only takes 1 second. Or 1200 if it takes half a second. That is still an improvement.

</comment></comment></comment></comment></comment><comment><USER17> Hey, my game will be in a similar situation. I'm looking into building a CAPTCHA that works by taking submissions from r/notinteresting, r/mildlyinteresting, and r/interestingasfuck, and asking the user to take an image and classify the image into not interesting, mildly interesting, and very interesting. We can distort, crop, and recolor the image to defeat reverse image search. That should be enough of a stopgap to stop them. Contact me via email (in my profile page) if you want to work together on that project.

<comment><USER18> So my script has a 1 in 3 chance of getting the CAPTCHA correct each time, with just a random guess?

A regular 6 character alphanumeric CAPTCHA has a 1 in 56,800,235,584 chance as a comparison…

<comment><USER19> reCAPTCHA works in a similar way, they just ask you to determine which photos in a set of 9-12 contain a particular object (2^12 at best). If you just asked people to do the Reddit classification 7 or 8 times you'd get the same chance of random guesses passing. The trick is to rate limit attempts.

Personally my problem with this is that even with the basic categories reCAPTCHA asks for I find it difficult to figure out whether certain edge cases should count. I feel it could be more frustrating to have to guess whether someone on Reddit found a particular image interesting or not.

</comment></comment></comment><comment><USER20> Some CDN services provide Bot detection. (as well as other DDoS mitigation options).

[https://www.cloudflare.com/products/bot- management/](https://www.cloudflare.com/products/bot-management/)

[https://www.akamai.com/us/en/products/security/bot- manager.j...](https://www.akamai.com/us/en/products/security/bot-manager.jsp)

Edit: I didn't see your comment about budget. I expect Akamai may be out of reach, not sure about Cloudflare's options. Most bot detection is going to need to finger print behavior of the interaction to the site (Captcha as well). If that data is handled correctly, (not being sold/made available to a third party/destroyed after use), I believe it can be done ethically. Obviously my ethics are not yours.

<comment><AUTHOR> "Bot Management" is enterprise only on CF, and Akamai is out of reach.

<comment><USER21> hey there, i work for ipinfo.io and we have a privacy detection API ([https://ipinfo.io/developers/privacy](https://ipinfo.io/developers/privacy)) that includes vpn/proxy/tor/hosting(bot, scrapes,etc) flagging which may help your predicament? You can test out how accurate we are by appending any nefarious IPs to our URL and see if we flag it correctly. e.g. [https://ipinfo.io/188.8.131.52](https://ipinfo.io/18.104.22.168).

Not sure if that will be your magic bullet but will be happy to have a chat and riff on this. I've talked to customers that are using our privacy detection API and I do remember a good subset using it for your sort of use case. At the very least, I can pass on some learning, strategies, etc to combat it.

Available anytime at ken@the-ipinfo-domain.

<comment><USER22> $50/mo for geolocation + ASN lookup?

<comment><USER21> that's our paid plan but we do have a free tier! if you have something in mind and an interesting use case, hit me up and I can organise access for you.

</comment></comment></comment></comment></comment><comment><USER23> A more extreme approach that may or may not work for you is to make the community invite-only.

Track the network of invites and shadow-ban linked accounts when you detect the spammer popping up. The spammer will eventually run out of invitees.

You can combine this with "no invitation required" short periods, where you make changes to the signup flow, spam detection, etc. and make the window short enough for the spammer to not have the time to adjust their bots.

</comment><comment><USER24> Maybe try stealing Wikipedia's ip ban list - wikipedia gets a massive amount of spam which makes it an easy resourse for getting a list of evil ip addresseses.

Their list is a combo of [https://en.wikipedia.org/wiki/Special:GlobalBlockList](https://en.wikipedia.org/wiki/Special:GlobalBlockList) and [https://en.wikipedia.org/wiki/Special:BlockList?wpTarget=&wp...](https://en.wikipedia.org/wiki/Special:BlockList?wpTarget=&wpOptions%5B%5D=userblocks&blockType=sitewide&limit=50&wpFormIdentifier=blocklist) and TOR (which is handled automatically) [there is also an api version in json format]

</comment><comment><USER25> If you can detect them as spammers, instead of banning them, shadow ban them, making their posts invisible to others, and slow down the servers response for them.

There is also alternatives to recaptcha, that might be more ethical, for example [https://www.phpcaptcha.org/](https://www.phpcaptcha.org/) \- there are some image matching ones too, but I don't know any specific ones.

<comment><USER22> Perhaps embed some recursive/infinite XSL in an iframe or data src attribute. There are also ways to create memory intensive HTML documents. This will cripple their Selenium or other headless browser instance.

</comment></comment><comment><USER3> Not sure why it's not mentioned but, in addition to technical mitigation, if you know the attacker's general info, then maybe you can also try other avenues such as law enforcement or legal claims.

More work as well but when you whois some of the attacking machines you can find out what the abuse@ email is for them and contact them. That can put the provider on notice if you later also go with some legal action.

</comment><comment><USER26> Is there a reason to not use hcaptcha for signup only? Older members are already members, so all you are doing is applying it to the new people.

Or add 2FA with a text message for sign up. That is a lot harder to automate and unless he is willing to spend a ton of money on extra phone numbers, he should run out of them quickly.

</comment><comment><USER27> the only wining move against spam is to make it easier to clean up than it is to spam.

captcha only benefit google and the like, who couldn't care less for the community or content. Captcha makes honest content (and spam cleanup) more expensive than the spam! it's a losing proposition that only looks good when you look at it without considering all the situations.

make honest content (and spam) easy, but cleaning up easier. Things like every user can flag something, after a certain number of flags, also remove other content from the same IP (or same bundle of users with a close registration time window) automatically. And of course a feature for admins to automatically ban and erase content from users wrongly flagging honest content.

It's harder than captcha, but it is an actual solution. Captcha is lazy and ableist.

<comment><AUTHOR> This is exactly why I do not want to do captcha. I don't want more third party analytics, tracking, or making our players solve endless captchas.

We are a gaming community that also has some older folk that we'd like to be accomodating for. Most of the cheapo PHP captcha libraries don't support any form of accessibility, or if they do it's a vulnerability that allow instant solving.

Part of the problem is that we can moderate just fine, but we can't moderate or look through hundreds of thousands of new registrations - just need something to somehow get rid of 99% of the garbage automatically.

<comment><USER11> Hi, hCaptcha founder. For anyone who has trouble with captchas I'd recommend checking out [https://www.hcaptcha.com/accessibility](https://www.hcaptcha.com/accessibility) . For the privacy obsessed (like me) our privacy pass option is pretty great as well [https://www.hcaptcha.com/privacy- pass](https://www.hcaptcha.com/privacy-pass).

</comment></comment></comment><comment><USER28> How many people are you registering a day normally? I'm wondering if you shut off signups for a while + handle the inevitable attack & they can't get back in they might move on. How much money and time do you think they (or you) are willing to commit though, what a crappy tale :-(

</comment><comment><USER29> I'm working on [https://spamscanner.net](https://spamscanner.net), which will be useful very soon for this with a public and free API (which will store zero logs and adhere to same privacy as [https://forwardemail.net](https://forwardemail.net)).

</comment><comment><USER30> In my experience JavaScript filters work very well against spambots. For example, you could have 2 honeypot fields, 1 with a certain value, 1 empty. In JavaScript you switch their values, and on the server side it should validate this way. Most spambots don't run JavaScript (yet). Another one could be a simple timeout, again 2 fields with a certain value. You count 1 down, the other up. On server validation there should be a difference of more than 1.

For an example, check a WordPress plugin I made 2 years ago: [https://wordpress.org/plugins/la-sentinelle- antispam/](https://wordpress.org/plugins/la-sentinelle-antispam/)

There is also the slider thing on Ali Express, that you could check out. I haven't looked into it, not sure how it exactly works.

<comment><AUTHOR> This is targetted spambots, so they will run through it once by hand and check the request.

Aliexpress uses heavy, extreme amounts of fingerprinting, including port scanning your device and your internal network via  tags and Websockets. The slide part is the least of it.

<comment><USER31> Yeah, this is the trouble with client-side solutions. If it's worth their time (for example, if there's a credit card field or something), the bad actor will first take a look at the request as it's sent to the server and then they will make requests that look similar. You can do some aggressive stuff with fingerprinting like this example but honestly at a certain point captchas are just going to save you a ton of hassle and the alternatives start to become increasingly invasive too. And I say this as a person who strongly dislikes captchas from both a privacy perspective and an end-user perspective.

</comment></comment></comment><comment><USER32> Try requiring new accounts' first few posts to be manually approved. Then he'll have to make enough quality posts to build up credibility first. This is very difficult, especially for a script kiddie.

Alternatively, you can take away the instant gratification by adding a cooldown of, say, three days for each created account. Then he'll have to register them in bulk and hope the humans don't spot the patterns.

You could also try using Bayesian filtering, but you'd have to block the ASCII art first.

</comment><comment><USER33> How about a simple out-of-band confirmation requirement for every account signup?

"Thank you for registering. Please send an SMS to number XXX with code YYY to activate your account."

Kind of like a reverse 2FA.

<comment><USER34> I think that would kill signup rates, mostly because it's so different from other solutions, but damn is it an interesting approach.

You may need to add something that prevents the same phone number from being used for multiple signups.

</comment></comment><comment><USER35> You could also try detecting Selenium, but that could be cat and mouse as well:

[https://stackoverflow.com/questions/33225947/can-a- website-d...](https://stackoverflow.com/questions/33225947/can-a-website- detect-when-you-are-using-selenium-with-chromedriver#41220267)

Remember, the goal is to flag accounts for cheap bulk rejection, without telegraphing to the attacker.

<comment><USER35> > without telegraphing to the attacker.

To extend this thought: I recommend that you don't roll out single mitigations at once anymore. Debugging is always confounded by having multiple simultaneous errors causing the same problem. Doing one at a time just lets him ladder up with you. Knock out some rungs.

Always do pairs or triplets from now on if you can.

</comment></comment><comment><USER36> We at NetToolKit have been working on related problems for years and might have two products that directly address what you are looking for.

We launched Shibboleth (a CAPTCHA service) about a year ago, and you can select from a variety of different CAPTCHA types (including some non- traditional types; different types have different strengths and fun factors): [https://www.nettoolkit.com/shibboleth/demo](https://www.nettoolkit.com/shibboleth/demo) There are a variety of options that you can set, and you can also review user attempts to solve CAPTCHAs to see if you want to make the settings more or less difficult.

Recently, we launched Gatekeeper ( [https://www.nettoolkit.com/gatekeeper/about](https://www.nettoolkit.com/gatekeeper/about) ) which competes against Distil and others, but without fingerprinting. Instead, site operators can configure custom rules and draw on IP intelligence (e.g. this visit is coming from Amazon AWS or this IP address has ignored ten CAPTCHAs in two minutes), and Gatekeeper will indicate to your website how it should respond to a request based on your rules. There's also other functionality built in, such as server-side analytics. Some light technical integration is required, but we're happy to help with that if need be.

As with all NetToolKit services, we have priced both of these services very economically ($10 for 100,000 credits, each visit or CAPTCHA display using one credit).

We would very much appreciate a conversation, even if it is only for you to tell us why you think our solutions don't fit what you are looking for. I would be happy to talk to you over the phone if you send me your phone number via our contact form: [https://www.nettoolkit.com/contact](https://www.nettoolkit.com/contact)

<comment><AUTHOR> Yep, unfortunately usage based billing is not possible for us. We can't use any usage based cloud services at all due to abuse and attacks - can't even host a simple avatar or button images on S3 without someone trying to infinite loop curl them to blow through budget abusively. On top of that, if you're going to reverse proxy the site, your service will probably be hit repeatedly with 300G+ attacks.

Do you have an email (ideally one that doesn't pipe into a ticket system)? Maybe I can share some possible/creative attacks we've seen that you can improve your service with, even if it's out of budget for us.

As a comparison note, Stackpath does 1mil requests for $10/m.

<comment><USER36> Our contact form does not pipe into a ticketing system (it goes into support@[our domain, available via our profile link], which is just a G Suite email account that you can use to contact us directly).

I'd very much appreciate hearing your thoughts about attacks and understanding what an effective solution would be. Thanks also for your note about Stackpath -- we aren't a CDN, but Gatekeeper could help reduce bandwidth usage by denying requests.

<comment><AUTHOR> I mean that is the price for Stackpath WAF (captcha, rate limiting, etc) :)

</comment></comment></comment></comment><comment><USER37> This may run afoul of your "no privacy invading methods", but are you able to implement email verification before new users can post? Then once they get bored of trying to attack the site you can go and purge all accounts created in the last n days that haven't been verified yet.

I run a gaming community with several thousand members and we regularly have to fend off attacks on both the community (spam bots in Discord) and the game servers themselves (targeted DDOS attacks usually in the 200-300Gbps range.)

From my experience, they tend to get bored and move on rather quickly so often times whatever we have to implement is more temporary in nature and doesn't really affect the existing community much if at all.

<comment><AUTHOR> Email verification is already required and always has been.

He's cycling through handfuls of oddball throwaway/disposable providers, some catchalls. We block all known temporary email providers, but there are a few that are obscure/blackhat/let you point a MX record from any free dynamic dns provider to enable abuse.

Another interesting thing is that after we blocked all known VPN provider space, he switched to more "darknet" proxy providers that pretend to be legitimate by having random eastern european dirty IP blocks announced on Comcast/Verizon AS.

A human eyeball can detect them, they're all pretty obviously following a pattern like NameNameName or random letters, but unsure how I'd want to write something to catch this in an automated fashion.

Oddly, this actually started over ~2 month ago, and it just started again this week after a few weeks of no activity or attempts at all. Our complete VPN block resulted in no successful activity for 9 days.

He also periodically tries to re-register from the same home IP once a month claiming to be a new account and why is he getting banned? and etc.

<comment><USER32> You could whitelist the email providers, and require "strange" email providers to be approved by mods. The workflow would look like this:

1\. Sign up with Gmail 2\. Verify email 3\. Account is instantly approved

1\. Sign up with sharklasers 2\. Verify email 3\. "You're using a weird email provider. Mods will look at your account and see if it looks OK. If so, we'll approve it"

<comment><USER35> Don't telegraph that information, I think. Better perhaps for the automatic approval to look like a fast human and the manual approval to look like a slower one. A process doesn't have to be manual to look manual. The goal here is to reduce the cost per request.

</comment></comment></comment></comment><comment><USER38> Sorry to hear you're dealing with this. I'm not in the field, but this is a case where I would abstractly be tempted to use javascript blockchain mining or similarly require some amount of useless computation by the browser during signup.

</comment><comment> Pick-A-Hill2019 Some good answers in the stuff others have posted (Especially the accessibility one).

You don't provide many details of what you do and do not have at your disposal in terms of skills, tech stack, access to log files etc so this is a non- expert cut and paste from SO [1]. Yeah I know (StackOverflow) and it doesn't even relate directly to your problem ....But if you read the long bit below it might give you a bit of blue-sky thinking.

>> The next is determining what behavior constitutes a possible bot. For your stackoverflow example, it would be perhaps a _certain number of page loads in a given small time frame from a single user (not just IP based, but perhaps user agent, source port, etc.)_

Next, you build the engine that contains these rules, collects tracking data, monitors each request to analyze against the criteria, and flags clients as bots. I would think you would want this engine to run against the web logs and not against live requests for performance reasons, but you could load test this.

I would imagine the system would work like this (using your stackoverflow example): The engine reads a log entry of a web hit, then adds it to its database of webhits, aggregating that hit with all other hits by that unique user on that unique page, and record the timestamp, so that two timestamps get recorded, that of the first hit in the series, and that of the most recent, and the total hit count in the series is incremented.

Then query that list by subtracting the time of the first hit from the time of the last for all series that have a hit count over your threshold. Unique users which fail the check are flagged. Then on the front-end you simply check all hits against that list of flagged users, and act accordingly. Granted, my algorithm is flawed as I just thought it up on the spot.

If you google around, you will find that there is lots of free code in different languages that has this functionality. The trick is thinking up the right rules to flag bot behavior. <<

[1] [https://stackoverflow.com/questions/6979285/protecting- from-...](https://stackoverflow.com/questions/6979285/protecting-from- registration-bots)

</comment><comment><USER39> I've had a lot of luck with variants of a honeypot. Add a visually hidden field and any time it is submitted with content, block the post. Super simple and with some creativity, it's hard for the bots to keep up.

<comment><USER40> Even better. Take a current field and hide it and put a replacement for it. (Ie hide FirstName and add a FName field) More likely for it to be triggered.

</comment></comment><comment><USER41> You have received some great suggestions so far.

One of the forums that I frequent has a "newbie" section, which is not visible to full members or guests (who are not logged in). Whoever registers to the website needs to get a predefined set of "Likes" on their posts. Not every post gets a "like" \- only those that contribute to the discussion do (not everyone needs to agree, debates are welcome as long as they are civil).

This helps maintain the quality of the forum to an outside viewer and cuts out a large amount of spam.

<comment><USER41> Couldn't edit, so replying to my comment:

The newbie section comes with a limited number of posts per day - so for example, I sign up today, I can post a maximum of 5 posts per day, and this limit goes up as I accumulate "likes".

I'm not sure if this will help if there are no community moderators trying to share a bit of the workload though.

</comment></comment><comment><USER42> Be sure you do email verification before users are able to post. Block domains of temporary email services (there are lists floating around GitHub, Google is your friend). Only allow one account per address. Figure out what domains the spammer is using to make email accounts. If you can, block them entirely, if not, require manual approval just for those domains. Use the other suggested technoques, like shadowbanning etc. Consider requiring or allowing social log in or phone number verification.

<comment><USER43> If you need a reliable & good API to do email verification, check out [https://removebounce.com/](https://removebounce.com/)

</comment></comment><comment> Seb-C It happened to me a long time ago. He was not only spamming and using SQL injections to destroy my community, but also advertising his own concurrent website.

When I also started to build scripts and destroyed his own website, he basically realized the harm he was doing, apologized and stopped.

Reminds me of the old good times when you could trap script-kiddies on msn.

"I think you are lying and not capable of hacking my computer. I'm waiting for you, my IP is 127.42.196.8"

</comment><comment><USER44> Cloudflare perhaps with a firewall rule that blocks bots over a certain threshold? It may fall under fingerprinting if you need to know that.

</comment><comment><USER45> I mentioned quite a few alternatives to ReCAPTCHA that often work in situations like yours here: [https://nearcyan.com/you-probably-dont-need- recaptcha/](https://nearcyan.com/you-probably-dont-need-recaptcha/)

Some of the best solutions include very minimal/quick captchas, or simple checks for things like javascript

<comment><AUTHOR> Thanks for the article! In this case, this is custom spam from someone that has spent a few hours looking at the network tab in devtools. The bad actor is running headless browsers after we started doing basic cookie and JS checks; we added some additional JS checks for basic things like whether it's a 800x600 window or similar - this stopped the spam for a few days until he figured it out.

<comment><USER45> That's good, at least if they're not too skilled sometimes the ratio of time spent playing cat vs. mouse with them isn't too bad, since it takes them a long time to bypass measures.

You could also look into things on other layers rather than the application level, for example, maybe the IPs they're using all come from similar VPN providers or services?

</comment></comment></comment><comment><USER46> Loosely related discussions, for reference: [https://news.ycombinator.com/item?id=23089599](https://news.ycombinator.com/item?id=23089599) [https://news.ycombinator.com/item?id=20058697](https://news.ycombinator.com/item?id=20058697)

</comment><comment><USER47> I think we might need more creative solutions to the problem of spam <everything> including online reviews, posts, phone calls. Some kind of PKI id verification system that every user should sign up with. Sure that will be turn off a lot of users, but the trade off is only the true enthusiasts will be participants.

</comment><comment><USER48> Can you enable hcaptcha with a whitelist for known-good accounts? Not ideal but might annoy them enough to give up.

<comment><AUTHOR> Unfortunately, all (ok, the only) the hcaptcha plugins available basically just let you enter a sitekey and nothing else/no other configuration possible.

<comment><USER49> Simply don't add hcaptcha to the page for approved accounts or ignore absence of a solved captcha on the server in submitted data. If you can't whitelist approved accounts, then you have a problem.

</comment></comment></comment><comment><USER50> > Negotiation is not really an option on the table, the last time one of the > other volunteers responded at all we got a ~150Gbps volumetric attack

that's hilarious, have you tried trolling them back like just enjoying their company? start saying pool's closed and things like that

</comment><comment><USER51> Could new accounts not have an approved Post and instead, all new accounts must get manually approved ? Or is that not feasible due to the volume you have ? I would make sure that first few posts by a new account is now automatically approved/shown to anyone.

</comment><comment><USER52> Temporarily charge a dollar to create a new account?

Also, do you have cloudflare in front of you?

</comment><comment><USER53> Do you know if they are using headless browsers? If so, we can block them without fingerprinting and without captchas. [https://methodmi.com](https://methodmi.com)

<comment><USER54> > MMI's primary implementation is through the use of a JavaScript tag which > interrogates the device to which the ad was delivered for the presence of a > graphical processing unit (GPU). The JavaScript creates a Canvas Element in > HTML5, which allows access to WebGL (Web Graphics Library), a JavaScript API > for rendering interactive graphics within any compatible web browser without > the use of plug-ins. An IVT classification decision is made based on the > results of the rendering capability of the device.

How this can't be emulated by a headless browser?

</comment></comment><comment><USER55> Try using a proof-of-work system. It won't differentiate between humans and bots but it'll significantly slow down the pace they can register accounts, and it is completely transparent to legitimate users.

</comment><comment><USER56> Are you sure they're not posting directly to the registration endpoint and bypassing the signup form? We just had this problem with spammers in China and QQ emails. Adding a nonce helped dramatically.

<comment><AUTHOR> We have a number of required fields that are generated in client-side JS and not present in the underlying HTML. Our best guess based on logs is someone walking through signup with devtools open, and then trying to replicate the requests. A day or two of reprieve whenever some funky change is made, like making the form element default to action="/a/url/that/bans/the/person" and then when JS loads and it detects more than 1000 pixels worth of mousemoves, replace the form action with the real signup endpoint.

It's a standard forum software with some plugins, all <form> elements are CSRF protected with a random value, etc.

<comment><USER35> I wonder if you could rotate mitigations to keep him off balance. Using different ones for different IP ranges may complicate his ability to analyze the code.

</comment></comment></comment><comment><USER57> A JS tarpit (not sure this is the right name) might help

You add a JS snippet that does some work, but if you detect a bot you make it do increasingly more work. Think bitcoin mining but not actually that

</comment><comment><USER58> Do you have any problems with hCaptcha other than its accessibility? It sounds like that is a much easier problem to solve than everything else people are suggesting in this thread.

</comment><comment><USER59> naive Q: how damaging would it be for you to stop accepting new accounts temporarily? or put differently, how many legitimate accounts are created on a daily basis? (single digits?)

</comment><comment><USER60> you could try google recaptcha v3 which does not require any user input and runs in background. not 100% sure however if it helps in your case but i think it should definitely help

<comment><USER38> This falls under fingerprinting and privacy-invasive methods.

</comment></comment><comment><USER61> Recaptcha it and wait them out. He can't do it forever. Then unrecaptcha. Just do a month. You'll lose some sign-ups and then you can go back to the old thing.

<comment><USER62> Aren't there captcha services that are less creepy than Googles?

<comment><USER63> hCaptcha[1] springs to mind, not that I know if they're more or less creepy than Google.

[1] [https://www.hcaptcha.com/](https://www.hcaptcha.com/)

</comment></comment></comment><comment><USER64> Add e-mail verification and a introduce a random 30-60 min delay before sending the verification e-mails. Then you can cut on disposable e-mail domains and so on.

</comment><comment><USER65> Might be slightly unorthodox, but email the first post to a Gmail account from a random address and see if it is marked as spam, only display the post if not.

<comment><USER66> Sorry, but that will backfire badly. The source IP / email / donation will be blacklisted in general very quickly. Also lots of targeted forum spam would not count as "random email" spam

</comment></comment><comment><USER49> Can't he just do that 150Gbps thing to make you do anything? Also can't you allow aimbots? You can keep them in a separate space and put them in a separate leaderboard.

</comment><comment><USER67> [https://xkcd.com/810/](https://xkcd.com/810/)</comment>


Joey Hess Uses This - <AUTHOR> https://usesthis.com/interviews/joey.hess/ <comment><AUTHOR> Nice one from the interview:

"I don't habitually use any cell phones or tablets. If it doesn't have a keyboard, I feel that my thoughts are being forced out through a straw."

:)</comment>


How to opt-out of the new GitHub UI? - <AUTHOR> https://github.community/t/how-to-opt-out-of-the-new-ui/119416 <comment><USER2> It's terrible, like why is the repo title all the way on the left and not centered?

I guess UI designers need to justify their job somehow. Just like the Reddit redesign, it's damn awful :(.</comment>


Lyft Mono – Hands Free Ride Hailing - <AUTHOR> http://take.lyft.com/mono/ <comment><USER2> You know there are 2 more days in March, right?</comment>


Why are so many HN Members so quick to thumbs down? - <AUTHOR> Isn't the goal of a site driven by the growth of diversity and thought to be more open-minded or at the very least constructive when disagreeing? What's happened on this website is that there has developed an oligarchy that sets the tone on almost every topic on this website and will downvote you into oblivion if they disagree even if you have a valid point which stifles conversation.
Now don't get me wrong I think this place is fantastic for learning new things, but shouldn't that be the point? To share and explore with one another, not to see who can out neg the next person. Frankly, thumbs down should be eliminated because to set the limit at 500 makes new users feel like they are constantly ganged up upon and who wants to say around a place like that. I've recommended this site to many friends only the hear the same feedback that people act far too arrogant sometimes. We need to remember that our shared passions for technology trump petty forum disagreements.
Enlighten rather than hate your neighbor.
Example: Why did this deserve 2 downvotes:
"I failed my first 2 tech interviews and Google and Snapchat leaving me feeling cheated by the dumbass whiteboard. Whiteboard tests are tailor-made for the inside the book thinkers. The ones that stop learning when the chapter ends and soon forget when the next subject begins. Computers are the thing that gets you to the thing. You want people who can see that the software they are working has a broader impact beyond 1s and 0s." <comment><USER2> All well and good, but have you seen the amount of plain old SPAM that gets here, as well as just weak submissions? Some filtering, even if a little harsh, adds value.

And I speak as someone whose submissions rarely gain traction, especially my own pages!

I see no cabal or conspiracy. I see a somewhat self-selecting and "focussed" group of people with a tight-ish intersection of overlapping interests.

</comment><comment><USER3> While it's possible some votes aren't well justified, keep in mind that the voting buttons themselves are really close together (especially on mobile) and can be hard to hit properly. When I see a "why would this be downvoted?" case, I sort of assume it was meant to be an upvote.

Recently HN implemented an "undown" link so if anyone thinks they made this mistake, look for that link after voting.

</comment><comment><USER4> Why not give an example?

<comment><AUTHOR> Example: Why did this deserve 2 downvotes:

"I failed my first 2 tech interviews and Google and Snapchat leaving me feeling cheated by the dumbass whiteboard. Whiteboard tests are tailor-made for the inside the book thinkers. The ones that stop learning when the chapter ends and soon forget when the next subject begins. Computers are the thing that gets you to the thing. You want people who can see that the software they are working has a broader impact beyond 1s and 0s."

<comment><USER5> Some theories:

negative emotional language ("dumbass") doesn't fare well.

People who have no difficulties with whiteboard tests easily could treat it as an insult.

Your PS on that comment might come across as petty bragging.

Generally I'd say unless you regularly get downvoted or it's a lot of downvotes don't worry too much, while it is a signal it certainly has noise.

<comment><USER6> Another theory:

Your comments are filled with opinionated arrogance.

That aren't backed up with any facts. Basically, the unwritten rules is the more opinionated your comment(especially if it isn't in the norm) the more you need to back it up with facts or even links to sources.

Also, I've gotten my share of down votes. But, usually it gets re-upvoted once enough people see it down voted. if it's not a "worthless comment" or extreme opinion without some kind of argument to back it up.

<comment><USER6> Ask yourself this->Is my comment actually useful to other people? or just me spouting off my greatness...

Most of my down-votes are from the later. or my dark sense of sarcasm, but that's a personal issue of mine.

<comment><AUTHOR> For people who failed their first interviews, it gives them hope they can be a CTO in 5 years. Hows that for being helpful? Again, it seems like you are just projecting insecurities at me and what I have accomplished by calling me arrogant instead of successful.

<comment><AUTHOR> My god how do you go outside with a sensitivity level that high?

<comment><USER2> Is there any need to go on being this rude? It simply does not help.

I spent a LONG time working with "Big Swinging Dicks" (the wrong sort of BSD for HN maybe?) in finance in London (and New York and Tokyo), and the loudest rudest ones were not the ones best at their jobs. When even the IT guy can tell that you are about to do several megabucks of screwup, bad-mouthing other people is just digging the hole deeper, for example.</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: How do you deal with production issue PTSD? - <AUTHOR> I work in a small team, in a large company, with big responsibilities. Downtime can be fatal for our company.
I've had a few experiences waking up at 5 AM (in our time it's when the US has peak traffic and most issues arise) checking alarms and having to fix large systems on my own. This has left some non-negligible PTSD. I often wake up in semi-panic in the wee hours and check my phone for system status. It gets quite exhausting.
How do you deal with this? <comment><USER2> There's an old saying: You can't care about the problem more than the customer.

In this case, since you are an employee, the customer is your company. You are providing a service for them.

If downtime can be fatal, and your company is large, they should actually hire some people to cover that time. You've taken too much responsibility upon yourself. You're caring about it more than they are.

You need to put your health before the health of your company. What do you think will happen to this company if you are unable to continue at work? They'll have to find someone else. Tell your boss that your boss needs to mitigate this risk by hiring additional staff to share the load or cover nights. You will help train.

If you don't think you can have this conversation, it's time to find a different job.

<comment><USER3> I see many of my friends falling is this trap, that they care way more about the company cares about them. They seem to believe that if they dedicate their lives to a company that will be rewarded. It might be, but they might as well be made redundant.

They keep giving but the company rarely gives back and this hurts their mental health.

So care just the right amount. And put yourself above your job. If you can't do that you need to find another job or rethink how you are doing your current job.

</comment></comment><comment><USER4> Afghan veteran here.. The only thing that's worked for me for dealing with PTSD was talking about it with people who share similar experiences.

So this post is a great first step to fix it for you.

</comment><comment><USER5> This isn't advice you can take now while you still have this job, but may help you in the future.

I was an early employee in one of the companies in the late 00s/early 10s that became a unicorn. Early on there were frequently times that required one of us (early engineers) to wake up in the wee hours to deal with problems. After this period of time I developed symptoms where I subconsciously always expect phone alerts to ring or things to happen in the middle of the night and have trouble going back to sleep if I wake up (which I do a lot even before; am a bad sleeper).

After I no longer had that job the way I slowly recovered from that is to sleep with my phone completely turned off or outside of the room -- letting my mind rest at ease that I'm not going to be waken up by a call or alert. I had to do this for a long time for that sleep paranoia to go away for the most part. I've also held less stressful jobs for a long time for my mind to recover gradually.

</comment><comment><USER6> Seek out Cognitive Behavioral Therapy (CBT). It is very effective for treatment of PTSD.

<comment><USER7> I have developed anxiety which I believe is work based, seeing a psychologist for CBT next week. If anyone is interested in how it goes my first name at my username dot com

</comment></comment><comment><USER8> Stop caring about the company and find a new job.</comment>


Vimeo banned from India, can not access! - <AUTHOR> http://vimeo.com/

<comment><AUTHOR> Edit: Edited the title, seems there is a block only in India. Is there a ban anywhere else?</comment>


Ask HN: What can we do about customer service - <AUTHOR>

I come from India and here most companies suck at customer service. It's even hard to find relevant email ids or phone numbers, let alone getting the problems resolved. I am guessing that this is a universal problem.
I would love to do something about this. I have a few ideas and I am interested in knowing how others think this can be solved. To start off, I am thinking of a platform that provides info on customer service numbers, email ids, twitter and facebook urls etc of widely used services. Also, people should be able to write what worked for them and what did not. This information would be presented in a well organized and an easily searchable fashion.
Will this help? What else do you think can be done? Can there be a service around customer service? <comment><USER2> There can absolutely be a service around customer service. I'm a little wary about whether there can be a _business_ around customer service or not. Note <http://gethuman.com>. It doesn't incorporate the Twitter / Facebook component of what you're talking about, but it does show how to get ahold of a company by phone. I'm not sure what, if any, business model they have in place. On the other hand, <http://getsatisfaction.com> is focused on customer service, and I believe they have a business model in place.

I think your best bet would be to do some early-stage customer development / validation (which it looks like you're doing?) on it, and see if you can develop a minimum viable product that people would pay for.</comment>