The Perfect Social Voting System - <AUTHOR> http://judstephenson.com/2010/05/13/the-perfect-social-voting-system/

<comment><USER3> You're essentially treating each article as if it's an asset. Users are allowed to go long or short on the article, depending on their prediction about its final karma value.

Are people then allowed to exit their positions? Can I place a stop loss? Can I upvote this article, but when it gets 5 down votes decide that I should exit it and go short?

If I can't exit my position, then what is the incentive for me to ever be the first person to vote on an article?

I think it's intuitively obvious to everyone that an article with 20 up votes will not start getting down voted all of a sudden. If I were to guess, I'd say that after 5 or so up votes, you're 90% or more to see a higher close; after 20, it's probably more than 99%. However, at 0 votes, you're probably close to 50/50 (again, just guessing based on experience).

If you can't exit, then your risk of ruin is way too high to make initial voting worth it. If you can exit, then it becomes easy to game the system by switching sides quickly.

Also, what about the ability of people to submit really crappy articles on a dummy account and then down vote them on a main account in order to build karma?

<comment><AUTHOR> I did toy around with weighted entrance rewards, but it makes the model more complicated.

After thinking about reversals a bit more, it would make sense to allow users to "exit" their vote. Bringing the total vote count (positive or negative) closer to zero and allowing more unbiased voting to continue (as people exit their votes, the percentages fall back to 50/50).

</comment></comment><comment><USER4> You might be interested to know that this method has been employed by Cloudmark for many years in their collaborative spam filtering network: <http://portal.acm.org/citation.cfm?id=1105677>

However, it works so well for them because the consensus on what is "ham" and what is "spam" is nearly universal enough that it can be relied upon to be agreed with by the majority of agents (people) the vast majority of the time. For news links, this will unlikely be the case unless you are actively attempting to create a news site where only a very few have power over what is shown and what is not.

Also, the Cloudmark technique chooses very few people to reward and this is on purpose. They are sparing with the reputation points and quick to downgrade on controversy in order to prevent a high-reputation individual gaming the system. Your news reputation system would likely have to incorporate a similar technique in order to be similarly robust. However, in doing so, I would imagine that most people would not see their reputation ever rise and would likely stop using the system. (due to lack of the "incentives" of which you speak) Cloudmark gets around this because people are already marking emails as spam or not in their email clients already, so there's no marginal cost associated with training Cloudmark's network or building their own reputation.

Its an interesting direction you propose, but I believe you'd be exposing your user base to scale-free network effects in which only a small few would gain sufficient reputation to "move the needle" and the rest would wallow in relative obscurity. This would then essentially replicate the Slashdot of 2000 AD but with the marketing message saying that it was "fairer" because of all the "incentives" people have.

You might want to think of how to structure a social news site as a kind of online auction, choosing a structure in which truth-telling is a dominant strategy, instead, such as [http://en.wikipedia.org/wiki/Vickrey%E2%80%93Clarke%E2%80%93...](http://en.wikipedia.org/wiki/Vickrey%E2%80%93Clarke%E2%80%93Groves_auction)

</comment><comment><USER5> It doesn't matter if few people vote, so long as enough votes are registered to rank the comments/articles.

The only thing I can see happening is incentivizing karma whores like me to support popular viewpoints even if I disagree (I don't downvote, but I don't have to upvote). Again, I don't think participation is a problem as long as there is a consistent group of active participants.

Also I don't vote for a warm fuzzy feeling of making the site better. If someone says something I think is right, then I upvote to show my support and hope his viewpoint is propagated enough so that further misunderstandings on the issue is avoided. This way I will decrease the likelihood of some ignorant person making his/her way back to me and forcing me to waste time re-espousing said viewpoint. My motivation for contributing is purely in self-interest.

<comment><AUTHOR> That is a valid point, but I would counter that, while a small group of active participants does allow "the process" to work, more people would express their opinion if voting was incentivized.

Also, the "warm fuzzies" was a simple metaphor for upping the incentives for voting, as "warm fuzzies" could be considered themselves a net marginal gain. If your going to play the karma game (up and down voting) why not reward the users in the same nominal terms used to describe the content they voted on.

<comment><USER5> My commenting, and most peoples' commenting I would assume, is done to get a weight off their chest, not for karma. Unless we can redeem karma for cash, even karma itself has little incentive to be gained by users. I'm not sure how voting making more people vote would make more people comment in this way.

</comment></comment></comment><comment><USER6> Interesting and very insightful points you make in your blog entry. However, I think there is one invalid assumption your social voting is based on - <USER2> fact that the first and last user will vote.

In the point in time at which they vote, the first and last user experience a hope for a future incentive - but no actual incentive. Why should the first user vote on a comment about some piece of content?

This dilemma makes this system the same as the current, pre-dominant social voting system - it provides no initial incentive for someone to create activity, only the hope for a future incentive.

</comment><comment><USER7> There's no need to have absolute karma points or additional incentives.

We just need an intelligent collaborative filter that weighs articles relative to you. That will give users an incentive to vote as they wish (rather than vote for what one thinks _others_ think good).

Pandora News anyone?

<comment><AUTHOR> The point is to give users a reason to vote on stories other than for "that warm feeling of communal good".

If you aren't convicted about the destination of an article, then you won't vote. Karma makes HN game-like.

Its about making content that other people like, not content that a few people have filtered for.

<comment><USER7> This system would only promote the common denominator. For example, divisive (but good) articles would get less voting attention because people would be afraid of voting the wrong way. No?

<comment><AUTHOR> Since we don't know exactly how people would react to given incentive/risk profiles that would undoubtable differ story to story we can assume two scenarios:

\- Stories that have perceived "deadlocks" would be considered volatile. They have a great chance of "breaking out" with large support, so they would be voted on early by supporters to reap the reward.

\- Divisive stories/comments would scare away any voters and eventually only stories that were beneficial to the entire community would be voted on. So in this scenario, this system helps to define the community.

edit: Also, the problem that you describe isn't isolated to my system. In the current HN system, people don't comment on stories because they fear that their comment will be "divisive" and attract negative votes. My system encourages voting, which would reward someone for voting on a "-3" comment (that makes it back to 0 or 1) that is beneficial to the conversation.

<comment><USER7> Pretty interesting. I'd like to see it in practice.

</comment></comment></comment></comment></comment><comment><USER8> Speculative market based on interest, relevance and attention is an interesting idea. Does it need to be tied to a social news website?

</comment><comment><USER9> Articles and comments that are upvoted provide more marginal utility? Or are they simply more pleasing to the reader?

If I tell you that your business model sucks and that you should try selling shoes, you (and others) may be immensely displeased. But then you may try selling shoes and make a fortune.

Nope. Marginal utility and immediate gratification (or ability to predict what a crowd likes) is not the same thing.

<comment><AUTHOR> Sorry Daniel, but this is in no way what I was talking about. I am not saying that marginal utility = what the crowd likes. Neither did I say that HN isn't "working". Only that providing a more quantifiable reward for correctly voting on comments could prove beneficial.

<comment><USER9> My fault for misunderstanding.

So perhaps people could bet parts of the karma that they have already accumulated that the story would get more votes than the running average?</comment></comment></comment>


Perl Branding Proposal – free all the butterflies - <AUTHOR> http://nigelhamilton.com/perl-branding-proposal.html <comment><USER2> So what should the runtime names be then?</comment>


How Developers Stop Learning: Rise of the Expert Beginner - <AUTHOR> https://daedtech.com/how-developers-stop-learning-rise-of-the-expert-beginner <comment><USER2> And now for something else to help make sure we never escape the Imposter Syndrome. "What if my learned skills aren't _really_ down pat? Maybe I am an imposter after all!"

An interesting article for sure; I don't know how to switch between erring on the side of "keep yourself humble, don't fall into the trap of Expert Beginner" as referenced in this article, vs. "don't have yet another existential crisis, you are not an imposter and can do your job".

</comment><comment><USER3> My frustration is so what if they're not an expert. You wouldn't hire a car engineer if you just need someone to drive the car.

Don't get me wrong if you need your building the next google or something sure go hire for it.

But, if your build a Saas or your core business isn't software, why?

What's the fascination with 10x developers since they probably need to switch jobs constantly to get that 10x perspective.

Also, did you really need that bleeding edge tech when it fizzled out a year later anyway.</comment>


Ask HN: Why don't companies open-source the source code of their old products? - <AUTHOR> I'm not talking about products like the first iPhone, I'm talking about products (like gameboys) that are still cool and interesting, but completely irrelevant for the company that invented them.<p>Why don't these companies open-source their old products? <comment><USER2> It may sound trite, but the real reason is -- why _would_ they?

The engineers are all busy working on new things. What product manager is going to say, hey, Fred, take off two weeks and take this random product from 1997 and see if it still builds at all, find the old dependencies, clean it up, talk to legal to see if we still own the rights to (x, y, z), and throw it up on GitHub -- just to expose some of our shoddy programming, last-minute hacks, vulgar comments cursing out other programmers, and maybe even some proprietary company information that we had no idea was in that code base.

There's no upside, but possibly plenty of unknown downside.

<comment><USER3> A potentially big upside is the preservation of our culture for future generations.

<comment><USER4> Companies mostly care about making money, not being beneficial to human race. (not passing judgement, just observing)

<comment><USER5> It's funny you say this...

Back when the idea of a corporation was first formed (I do not remember the time frame) one of the requirements to complete the process of incorporation was to prove what you were going to do for the community around you.

I wonder how this idea got lost in the process...

<comment><USER6> Companies _are_ usually improving the community in some way (that's why they make money in the first place). Grocers sell food to the community, hardware stores sell tools and supplies for making things, even the dreaded oil companies have sold the primary source of fuel for a century (and made money hand-over-fist for it). Random acts of kindness (e.g. open sourcing projects for no reason other than "We could"), while cool, are tangential to the purpose and specialty of the company.

<comment><USER4> This is how it should be - sadly both ends (doing good and making money) are not always aligned with each other. From my personal observation I would say that they are less and less aligned the bigger the company is.

</comment></comment></comment></comment></comment></comment><comment><USER7> A number of reasons come to mind:

1\. They might not have the source any more. There's a depressingly large amount of software that was created, that no-one has the source code to. It might have been lost in a server crash, it might have been stored on a medium which is now unreadable, or people might have just not cared about it after the product was shipped and who knows where it is now?

2\. There might be legal reasons preventing them from releasing it. For example, be a software patent covering part of the code which they licensed for their commercial use, but which prevents them from releasing it as open- source. An example here would be Doom 3's shadow volume code - the open-source release didn't actually include the code that shipped with the game, instead it included a slower (yet not patent-encumbered) algorithm. Unless you built absolutely everything in-house and licensed nothing from anyone else, it can be tricky to work out whether you're actually allowed to release the source to your product.

3\. It might reveal other things that should be private to the company. Often source code has overly-tight integration with things like your in-house version control, or your build system, or other things of that nature. Perhaps your debug build automatically uploads crash logs to your bug tracker, and includes credentials for doing that which were stripped out of the release build? In order to do an open-source release, you need to look through your entire code to figure out if there is anything sensitive there, and remove it (in a way that doesn't stop the product working).

And finally...

4\. What benefit does it get them? Gathering up, scrubbing, testing, and releasing an open-source product takes a substantial amount of effort, and hence a substantial amount of money. And you'd be hard-pressed to see a return on that investment in anything except vague, largely-meaningless "community good will".

<comment><USER8> I would be seriously shocked if #1 was a valid reason. Products for which the source is completely lost after they are shipped? Can it happen _before_ the release? Why there were no backups?

<comment><USER9> This has happened to a product I worked on. There were 2 companies working on it, and when we were done there were 2 backups that I made after we'd finished it.

Backup #1 (USB HD, kept by development company A) was lost in a flood. Of course, this sort of thing is why you have 2+ backups...

Backup #2 (USB HD, kept by development company B, the one I worked for) was lent to the client after they wanted to take a copy of it themselves. Then fast forward 6 months, and:

        US: Please would you return our backup drive of product XYZ?
        THEM: [paraphrased] Who are you?

This product was a one-off, and not key to company B, so nobody chased this up (not that they could do much anyway because the backup drive was presumed lost forever). We only found out about the loss of backup #1 when company A asked us for our backup, because they needed the code for a project they were thinking of doing...

</comment></comment></comment><comment><USER10> At On2, we open-sourced Theora (initally called VP3) partly because I (the CTO at the time) worried that if the company failed, all our IP would be locked up forever due to complex legal obligations to investors and customers.

The other reason we did it -- the reason that convinced the CEO and board -- was that we figured as we developed better products (VP4, VP6 etc) it would be preferable for us business-wise if the N-1 product was free to everyone. Otherwise, inferior competitors would continue to profit by undercutting us on price. It's impossible to undercut free.

I guess I answered the opposite question -- why do companies EVER open source their old products? The culture of VC-backed and public companies is not especially conducive to making the decision to do so, even with old products.

One argument you will hear against doing so is simple: old, free products might compete with new, profitable ones. There is no real business incentive to take that risk.

</comment><comment><USER11> To OP:

How long have you been in development, specifically corporate development?

Imagine code with no modern tools or development process and a limited number of people that might understand how and why it was written. Code written under pressure or by overly clever geniuses. Code not under source control with no or little documentation. Code written for companies that don't exist or have changed hands numerous times. Archived to media that no one has computers or drives or OSes for...

<comment><USER12> Imagine, all of this is standard.

</comment></comment><comment><USER13> I don't work for a big company, so this is purely speculation, but there could be many reasons why it's not done.

* Documentation Time

If you've got a big project, it could take weeks, even months to properly document some software to a position where it could be used by someone outside of the company. Sure you have your internal documentation but it can often be incomplete, or make assumptions that the person reading it knows about other bits of the company.

* Deployment

Big projects will often use very specialized hardware, software and environments, to the point where it could be nearly impossible to deploy outside of the company. It could depend on internal services that can't be open sourced because there still used, or are an important part of the business. Take Google Reader, yes it would be nice if it was open sourced, but internally it probably uses services, databases, APIs specialized just for Google, it's probably been optimized to work on Google's hardware, with their webserver, with their OS build etc.

Reddit is another example of this, Reddit's code is open source, and while it can be deployed, it's not easy. This seems mostly because it's been built to work on a very specialized set of software versions, and in a very specific environment. Larger open source projects tend to be tested on a multitude of environments, with applications only deployed or built internally, there's no point because you can very accurately control your environment.

* Some of the code is still used

Some, or even big chunks of the code could still be being used in current software. If you've got a library that's particularly useful, you might keep using it. If it works there's no point re-writing it just for a new project.

* The code is very bad

We all know it happens, a project contains terrible code, bad bugs and maybe even security issues, they never bothered getting fixed because they were never noticed. Given the opportunity to look through the code people might pick up on these issues and it would look bad on the company.

* Open source is complicated

Open source seems to come along with a whole host of fun things to deal with, GitHub issues, ranty blog posts, forks, copyright, licenses can all get a bit complicated. Even if it's old software that isn't used anymore you probably need to do some degree of management before things get too out of hand. Even a single tweet can have a big impact on a company, or a products reputation, so particularly at larger companies they'd probably want it managed in some way.

Anyone else got anything to add?

<comment><USER14> Dependencies on commercial software (e.g., that package for the sound system, purchased as source and modified, without which the product won't even compile).

Dependencies on specialized build tools; porting to something free would not be easy.

Exposure of security holes in existing deployments by revealing bad security practices.

</comment></comment><comment><USER15> If you're talking about games then the answer is licensing. There are a zillion licenses around the audio stack, the video stack, perhaps the game art or the game characters etc etc. None of that licensing allows you to release the source code (and thus the source material) to the public.

For non-games it can also be about licensing (or as others have mentioned providing evidence that you used code in an unlicensed way) or about support (nobody wants to answer questions about the code).

</comment><comment><USER16> -legal problems (licensing, liability)

-proprietary technology (ie Google Reader hooks into Google backend extensively)

\- Cost of getting it ready for open source (usually a large sunk cost already)

\- They may still make money out of it in the future (ie selling old games with emulation)

<comment><USER16> Also, for individuals there is a lot of positives in that prospective employers can see their work. From a company there may be way less incentives.

</comment></comment><comment><USER17> Software products usually have some 3rd party components in there, and they can't release the code for them because they don't own the copyright. This is the #1 reason why OS/2 can't be open-sourced.

</comment><comment><USER18> Probably because projects which were not designed to be open source rely on too many internal systems to be worth open sourcing.

The google feedback tool springs to mind, the google engineer that made it is working towards open sourcing it but because it want created with that in mind it is taking ages to remove its dependency on loads of internal Google stuff.

<comment><USER19> Exactly this. I haven't looked at the Reader architecture myself, but take a hypothetical "Hey, let's open-source Reader" project at Google:

Reader probably uses the Googlebot crawl infrastructure to retrieve feeds. We're not going to open-source the crawler, so now we need to rip that out and replace it.

Let's say Reader used Megastore to store feed data (the Megastore paper says "hundreds of applications" use it, so this is not an unreasonable idea). Megastore is a nice chunk of intellectual property in and of itself, plus it's built on top of Bigtable.

Throw in Chubby for locking/coordination and some MapReduce jobs for bulk processing, and you're basically down to either rewriting the entire core of Reader or open-sourcing the "crown jewels" of Google's infrastructure. Not to mention any number of underlying libraries (e.g. core C++ libraries) that have hundreds of engineer-hours of investment.

</comment></comment><comment><USER20> Because it is not how open source movement works.

The big idea about open source is that if you're making something useful for many other people and if it is sane, readable, manageable, then you will get lots of feedback, testing and even patches with bug fixes and improvements.

This is the story of nginx - when it was open sourced, people found it useful for themselves, and then they start using it, which leads to the extensive testing, fixes, patches, etc. Now it has several forks, including tengine.

The other story is the story of RedHat at times of RHEL4. They decided that they will maintain their own set of patches for kernel and glibc. Eventually kernel's src.rpm contained a hundred of patches. This was a mistake, because they should send those patches into main tree instead, and, if patches proven to be correct and useful, they would get feedback and testing and code reviews for free. As far as I remember, they did so with RHEL5.

There are another important stories about how community ceased to improve open source projects after they being acquired by big companies - no one wants to improve other people's property. MySQL and Xen were the most well-known examples.

So, there is no use to open source anything which no one need, except, may be some hobbyists and marginals.

</comment><comment><USER21> These are all very good reasons posted below, but I believe that the most important reason is corporate mindset . The powers that be - mostly old-hands- view software as physical "property" and unwilling to let go. Sharing it is seen as sacrilege! Also is seen as providing competitors a peek under the kimono and giving them an advantage.

It is the same reason that many pharmas don't release the data of their failed trials. How much better the world would have been had we had a commons of the failed drug trials. _sigh_

</comment><comment><USER22> Software is written scratch, while the products like the GameBoy are made from dozens of closed source components. Sharp owns the IP on the CPU. What could they open source in a GameBoy?

</comment><comment><USER23> Why would they? There's plenty of downside and not much upside?

</comment><comment><USER24> In the case of something like the Gameboy, Nintendo still profits from selling old software for that platform, emulated on their newer consoles.

The more interesting question is in the cases of businesses that fail. Though I can't imagine this happening, it would be wonderful if the law specified that if a bankrupt company is liquidating its assets and cannot find a buyer for its source code, that it be open sourced.

</comment><comment><USER25> I hope I dont sound like a goofy idealist but... All of these issues (rightly) point out that the major barrier to open-sourcing is cost. Doesn't this seem like a very effective use of kickstarter? However, I can see just negotiating with a vendor of legacy software could be a lot of work and require a good bit of technical know-how for a volunteer on kickstarter.

</comment><comment><USER26> I agree with this. I think that even products that aren't core to a business could be open-sourced. Twitter is a great example of open-sourcing code that is not critical to their core business. I think it's a great way to give back as well as helping your company get notoriety.

</comment><comment><USER27> There is only one success story I can think of where open source revived a faltering product: Eclipse.

I suppose the conclusions from that can be quite open:

a) It doesn't happen often enough to know how effective it would be

b) The product has to be useful enough to attract a community to maintain it, which might be a rare condition

</comment><comment><USER28> There are quite a lot of reasons, but these come to mind first:

There's a shockingly large number of projects out there that use "borrowed" code. This is in the sense that they may use code from open source projects (and didn't distribute the code back as stipulated in the license), code that they've inherited from other companies that may or may not have been part of a legal acquirement or through the much heard "Corporate Espionage", which sounds sexier than it really is.

Usually, it's just an intern or someone else who finds out the default password to source control and/or CVS server and sends out a few feelers to someone interested. Next thing you know, he plugs in a thumb drive and now he's a free agent with a plane ticket and fancier watch.

Early games especially were like this since being _first_ often meant being successful at courting investors (this was before the video game crash of '83).

Source: I once did a freelance job ages ago where the dev team manager, who used to work at a gaming company, freely admitted that it happened quite a lot in the industry. Maybe it's still happening.

Then there are cases where the source is outright appalling in the number of hacks, re-hacks, back-hacks and any number of ducktape and hope holding libraries together. No one of sound mind would ever let anyone else see that mess. Let alone give the impression that some of that code survives in some form in modern software.

Can you imagine how many vulnerabilities exist? For all we know, it may be possible to do a lot more than install Linux on a Gamecube. [http://www.gc- linux.org/wiki/Main_Page](http://www.gc-linux.org/wiki/Main_Page)

Of course there are also the times where "works of art", as it were, are lost to history. As jbri said, there are times where large projects often are destroyed for silly reasons like crashes or even recycling.

I've bought several used hard SCSI drives back in the day on eBay that may have belonged to one such company (SCSI was expensive, yo!) I have no idea what the project was or what I may have in my hands, but it looked like a whole lot of assembly, a bunch of esoteric C (which might as well be assembly) and some proprietary language code, that resembles a cross between Pascal and Python to my untrained eye, and I don't think anyone outside knew how or where to compile.

Now did they copy this stuff before selling it off? Who knows. This was after the dot com crash, so I have no idea if even the original owners were involved in the sale since many of those companies' assets were liquidated in a very short period of time. And we know how delicate they can be when money is at stake.

Then there are issues with licensing (kinda related to the first point) and already mentioned by people here. Open source, as samarudge said, is complicated. If your legalese isn't kosher, you can expect to lose a buttload of cash in a lawsuit(s) even if you win. Especially with the threat of patent trolls around, you can bet fewer companies are willing to risk OS-ing their code.

</comment><comment><USER29> Hardware too! We should have the original hardware for our childhood game consoles running in FPGAs! One FPGA with NES, SNES, Master System, Sega Genesis, Atari...

</comment><comment><USER30> Because someone else could update that old product and start competing with the newer version.

</comment><comment><USER31> Google Reader may come to mind..

</comment><comment><USER32> Why don't you start a web-service to help companies opensource products?

<comment><USER33> because it doesn't solve any of the problems mentioned in this thread? The essential parts are a stable community and 'buildability', none of which are solved by a webservice. Unless you have a great idea for this, than let's talk ;)

<comment><USER32> I think I have some ideas ;) What's your mail?

</comment></comment></comment><comment><USER34> Embarrassment

</comment><comment><USER35> They're morons not to.

Word of mouth in appreciation of a good deed or good product is the most compelling sales pitch you'll ever hear.</comment>


Important Notice Regarding Public Availability of Stable Patches - <AUTHOR> https://grsecurity.net/announce.php <comment><USER3> Looks like the product in question is Wind River Linux, a product of a subsidiary of Intel.

Here's the forum post on backporting an EFI fix:

[https://forums.grsecurity.net/viewtopic.php?f=3&t=3713](https://forums.grsecurity.net/viewtopic.php?f=3&t=3713)

And products with Wind River Linux prominently mentions GRSecurity advertisements:

[https://www.google.com/search?q=wind+river+linux+grsecurity](https://www.google.com/search?q=wind+river+linux+grsecurity)

Edit: It looks like I wasn't the only one to find this. I'll keep this post at the top for other people to reply to.

<comment><USER4> That's infuriating.

</comment></comment><comment><USER5> As a general rule, smaller companies that release their code under the GPL have almost no recourse against huge companies violating their copyrights. One of the big flash drive makers released their own portable browser based on PortableApps.com's Firefox Portable a few years back and distributed it on millions of drives with my name and all copyrights stripped off of it. This happened after I'd been in negotiations with them about using our software platform and fully informed their subsidiary in charge of their resulting software platform of the legal obligations of the GPL including a direct call with the subsidiary's CEO. The most I could do was send them a C&D.

To add insult to injury, the subsidiary released a hardware product years later and another company released a similar but different product in the same segment. The subsidiary sued the other company and had this PR story published about how the CEO was so offended by the "theft" and had to sue them to be able to look his kids in the face.

<comment><USER6> This is not at all true. They are liable for significant monetary damages for violating copyright, and you can find a lawyer to take up the case if you own the copyright. There are a couple well known organizations who have gotten paid more than their expenses from lawsuits against gpl violating companies: sfconservancy.org, sflc.org., fsf.org.

<comment><USER7> In principle, yes. In practice, large companies have extensive legal resources and can afford to drag out a lawsuit far beyond the resources of a team volunteer/hobbyist developers.

It's great that groups like the FSF and Software Freedom Conservancy are using their funds to support legal action when necessary, but they can't be everywhere and enforce everything.

<comment><USER6> In practice, yes. First of all, all those organizations have enforced the gpl on behalf of "a team volunteer/hobbyist developers" from large companies. In fact, it's the primary kind of enforcement they do. Second of all, individuals who have zero resources win lawsuits against large companies EVERY SINGLE DAY. Lawyers work on contingency and pro bono. Stop this hand waving crap saying the gpl can't "really" be enforced for volunteer efforts.

<comment><USER5> Yeah, again, no it doesn't work that way. Again, the folks you mentioned generally only work for non-profits and individual hobbyist devs. They don't work with for-profit companies (even if the company isn't making a profit at present).

And the whole contingency thing... a lot less common than you think. Speaking as someone that's had his copyright ripped off multiple times and been injured due to negligence by the city of New York and/or Amtrak and looked into it with multiple attorneys in each case.

For the most part, the legal system serves those with means and those with means alone.

<comment><USER8> The problem is the same for photographers as for coders. The law that prevent advertisement companies from lifting a image from flikr is the same that prevent companies from lifting some code and removing the license.

Every time and again I read news about some photographer than sued some company and got a million or so for the efforts. Its not easy, quite expensive and I guess many author do give up rather than push forward, but there is recourse against huge companies that violate copyright. The good thing about such lawsuits is that the burden of proof for having a license sits on the infringer, which means a judge don't actually need to understand that fine details of software licenses in order to find someone guilty of infringement.

<comment><USER9> All that notwithstanding, it appears that _pursuing_ one of these cases is terribly expensive. Does the avenue exist? Yes. Is it _actually_ available to those who don't have a bunch of cash to burn? No.

As JohnTHaller said: "For the most part, the legal system serves those with means and those with means alone."

As you said: "Its not easy, quite expensive..."

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Sounds like Verifone is one of the GPL violators. They are known for being "open" except when you want to innovate without permission.

[http://global.verifone.com/products/software/v-os/](http://global.verifone.com/products/software/v-os/) \- Says its Linux Based.

[http://www.verifone.com/products/hardware/multimedia/](http://www.verifone.com/products/hardware/multimedia/) \- Have an MX 900 series of products.

[http://www.verifone.com/products/hardware/petro-pos- systems/](http://www.verifone.com/products/hardware/petro-pos-systems/) \- Have a Petro series of Products

NYSE:PAY - are a multi-billion dollar company.

Employee asking for help: [https://forums.grsecurity.net/viewtopic.php?f=3&t=3938&p=139...](https://forums.grsecurity.net/viewtopic.php?f=3&t=3938&p=13940#p13940)

GRsec saying its verifone: [https://twitter.com/grsecurity/status/450995354972864513](https://twitter.com/grsecurity/status/450995354972864513)

Thread indicating they are using an old unmaintained kernel: [https://twitter.com/grsecurity/status/424914478912651264](https://twitter.com/grsecurity/status/424914478912651264)

Industry called out specifically: "Not only has the entire embedded industry as a whole not contributed a single dime toward our continued development and maintenance (despite our work being critical to the security of the millions of devices using our code: streaming media players, credit card processing systems, etc), the companies we've identified have actively violated the GPL and even our trademark. These transgressions have continued despite their awareness and our legal action."

</comment><comment><USER11> "Since our lawyer has advised us not to mention the companies by name"

Yeah, uh, they're lawyers, they always say that, it's not a signal with any information in it.

As you said, this company can outspend you, and it's not worth it for you to try litigating. Public shaming is all you have! And, since the primary issue was them claiming their kernel has "grsecurity", public shaming is actually a great solution: try to make the technical community aware that this company's security hardening doesn't deserve the "grsecurity" description. You may even get more business from competitors who want to be able to say they worked with you on their grsecurity integration.

<comment><USER12> The lawyers say that because they're advising their clients not to set themselves up for a libel suit, not because they're buzzkills. In other news, doctors recommend you eat healthy, but don't they _always_ say that?

<comment><USER11> ya know... my mother is a doctor, a Family Practitioner (FP). She's the type who's probably more frank with her patients than most. But she still would give slightly different advice to family than to patients. This is to manage risk of lawsuits, unreasonably angry patients, etc. It has to do with the balance of risk and blame. You can imagine the typical stuff - <USER2> tests, end-of-life decisions...

</comment></comment></comment><comment><USER13> This is such a bummer! I just recently switched over to grsec (on Arch) and I could not be happier with the results; seriously, it has made such a huge increse in security so simple to navigate. The Grsec team does incredible work; that no lawyer is willing to pursue this case saddens me, but that's a secondary issue. The core problem here is the corporations with money have functionally unlimited legal authority. It is so far beyond me that society has allowed this to come to be and continues to do nothing to stop it.

To Brad and the PaX team directly (if you read this): You do incredible work and I sincerely hope this move leads to an inundation of sponsorship so that even more people can benefit from your hard work and innovation. Till then, know that there are those of us that stand behind you 100 percent!

</comment><comment><USER14> This angers me. I mean, they're doing the right thing, but it should never have come to this.

volunteers shouldn't be shelling out thousands in copyright and licensing violations- even if they won in court, the amount awarded back would probably be a pittance compared to what these manufacturers make by using their code/trademarks.

I love what the pax guys do, almost every major exploit in the last year is mitigated in some form by grsec.. I wonder what becoming a sponsor entails.. I mean, I wish I could support all the FOSS I use, but I'd go broke pretty quick. :(

<comment><USER15> > I mean, I wish I could support all the FOSS I use, but I'd go broke pretty > quick. :(

Yeah I seem to have that a lot as well.

What I figured a while ago, in summary, is this: we will always use more than we can contribute back. As a silly example, I am grateful for the invention of the wheel but in no way could I pay someone back (living or dead) for every single thing like that. The important thing is that we do _something_. Contribute either with time and skill or with money to a few projects you care about and which you feel can actually use your help. That's still tricky, though, I wouldn't know which of the 2100 installed apt-get packages need my support the most, but realizing this (rather than feeling indebted) gives me some peace of mind.

(If anyone cares, I actually blogged about this: [http://lucb1e.com/?p=post&id=121](http://lucb1e.com/?p=post&id=121) )

</comment></comment><comment> bmir-alum-007 Most, but not all, companies generally don't donate any money to server OSes and open source they deploy by the hundreds of thousands. It sucks but it's the current state of affairs. (I think more FOSS should be be less free and monetized more in the context of large-scale enterprise purposes, in order to keep developers' bills paid and support quality up. The honor system doesn't work because most corporate choose to "cheat" where possible.)

If a project releases open source totally for free, it cannot realistically expect sponsorship to magically appear.

If a project _needs_ sponsorship to _keep the lights on_ , the _we 're closing up shop, unless ..._ routine works.

If a project prefers to become a commercial product with a freemium option, they should do such.

Otherwise, don't slave away on a project and resent what you cannot afford to give away. Just _don 't_ do it, if you can't live with it being exploited by companies for free.

Punishing everyone for the sin of a few rogue companies is the kindergarteners routine and childish. It doesn't work and it just angers people without solving the licensing issue at a core level.

PS: Perhaps grsecurity may want to instead consider a sensible noncommercial license similar to somewhere between AGPL and something like what good ol' evil Oracle would license their DBMS, i.e., companies over X employees or Y revenue need a license; hobbyists, academics and individual developers exempted. Drama resolved.

<comment><USER16> > PS: Perhaps grsecurity may want to instead consider a sensible noncommercial > license similar to somewhere between AGPL and something like what good ol' > evil Oracle would license their DBMS, i.e., companies over X employees or Y > revenue need a license; hobbyists, academics and individual developers > exempted. Drama resolved.

Being a set of Linux patches, it would be hard for them not to make their code available under GPLv2.

They can do the Red Hat thing of making code available only to paying customers, and terminating their customers' accounts if they redistribute things publicly. They mention that in the post.

</comment></comment><comment><USER17> Ah Spender. Always the drama queen.

The real problem here is not companies abusing the GPL (good luck with that), but grsecurity not being integrated with mainline after more than a decade.

You see, if Spender really cared about security he would work with the kernel developers in order to get grsecurity into the kernel but of course being such a famewhore, he never did that. Everything is fine as long as he is the center of attention, actual security be damned.

Spender: I among many have little sympathy for you, you've long exhausted our patience with your antics. Grsecurity is a niche project with minimal actual security impact in the "real world", all because of the deranged way you choose to manage it. Your primary concern, your _ONLY_ concern should be getting grsecurity into the kernel, not companies ripping you off, not companies abusing your trademark, not companies "not playing nice". In the grand scheme of things, these are irrelevant.

<comment><USER18> Do you mean Spengler, perhaps?

<comment><USER19> I think "spendy" is his irc nick. And "spender" is his grsec machine nick [https://www.grsecurity.net/~spender/](https://www.grsecurity.net/~spender/)

</comment></comment></comment><comment><USER20>
      The test series, unfit in our view for production use, will however continue to
      be available to the public

Doesn't sound like that will stop companies from picking it up and using it unfortunately.

This is such a shit situation to be in. Hopefully this publicity gains them some traction with the companies and communities who do care about it.

</comment><comment><USER21> I'm obviously misunderstanding something about this.

Since grsecurity is GPL'd (being modifications to the GPL'd kernel), anyone that is "a customer of any product that uses grsecurity in binary form, [is] entitled to the complete corresponding source code." Which means their stable patches will get requested and released by someone anyway.

Help me understand how this will have any effect on the actual availability of their stable series?

<comment><USER22> It basically just adds a level of indirection. Rather than going straight to the grsecurity folks, you now have to go to whichever downstream is disseminating the kernel based on that patch. Bummer.

Really, it's just weakening the brand they've created for themselves. It always sounds really great in theory, but it's almost never worth it. It's the GPL, they've literally signed up for this type of code (ab)use. I'm not sure why people have trouble understanding this concept.

(Though if they wanted to be really snarky, they'd relicense their code GPLv3 and watch these companies go into complete hysterics.)

<comment><USER23> But wouldn't they need to follow the Linux license, which is GPL2only?

<comment><USER24> Code will be available to sponsors and sponsors would be entitled to release it to the public, but presumably they will threaten to cut you from future updates if they did that, otherwise these is no point in raising the paywall. Unless you are willing to burn dozens of shell companies for each update there is no way of stopping them.

<comment><USER7> Is that actually allowed by the GPL? The text says:

> Each time you redistribute the Program (or any work based on the Program), > the recipient automatically receives a license from the original licensor to > copy, distribute or modify the Program subject to these terms and > conditions. _You may not impose any further restrictions on the recipients ' > exercise of the rights granted herein._

(emphasis mine) Is it legal to penalize someone for exercising their redistribution rights, or would that count as a _de facto_ restriction?

<comment><USER24> > you may not impose any further restrictions on the recipients' exercise of > the rights granted herein.

Further restrictions probably aren't introduced if they packaged this the right way i.e. not bind the GPL license with whatever agreement they will come up with. Sponsors will still have the same rights they are now used to, but GPL never speaks obligations on the distributor having to provide updated versions.

</comment></comment></comment></comment></comment></comment><comment><USER24> > We decided that it is unfair to _our sponsors_ that the above mentioned > unlawful players can get away with their activity.

How is that unfair to them specifically? The purpose of this is to protect them by raising a paywall for anyone that isn't their 'sponsor'? (tangentially, that's why I prefer BSD/MIT, because people aren't as obsessed with other people doing dirty, nasty things with their free code.)

It's bad enough that these patches aren't integrated into the kernel like they ought to be or that they aren't included into mainline distros and are only ever present on custom built machines, now they are behind paywall as well. Damit, I don't want to move to OpenBSD.

<comment><USER25> > Damit, I don't want to move to OpenBSD.

Why not? OpenBSD's awesome.

<comment><USER4> Maybe for servers. It's completely unusable due to performance problems on my i7-powered thinkpad.

<comment><USER25> Really? I run it on a PowerBook G4, and while it's sluggish, it's not entirely "unsuable". If a 10-year-old single-core machine can handle OpenBSD, I'd be amazed by even the slightest performance issue on a quad-core, hyperthreaded, modern PC. What's additionally surprising is that this is the case on a Thinkpad, of all things; IIRC, the OpenBSD devs dogfood OpenBSD pretty heavily on Thinkpads due to their FOSS-friendliness.

Does your laptop have an Nvidia GPU, by chance? In my experience, those do tend to have very bad performance on OpenBSD. Intel and AMD/ATI GPUs should work better.

Also, it's worth mentioning that OpenBSD's kernel has a whole slew of debugging and error checking features compiled in by default; compiling a custom kernel without such features can be done, but the docs don't really recommend it, since it becomes excruciatingly difficult to troubleshoot any problems with it.

<comment><USER4> My laptop has an Intel card, and everything is nominally supported.

You are free to be surprised all you wish: I went back to linux because I was sick of dealing with the system locking up for 5-10 seconds every time I opened, closed, or switched to a new browser tab. Couple that with 1-2 fewer hours' worth of battery life and I found myself very quickly asking what the point of "code correctness" was if the system just doesn't work.

A thoroughly frustrating experience from top to bottom.

<comment><USER25> Just saying. If you haven't already, I'd definitely send them a bug report and dmesg; that all seems _very_ abnormal.

</comment></comment></comment></comment></comment></comment><comment><USER26> OK, figure out who the involved is. It shouldn't be too hard if you're active in that area.

<comment><USER27> I'm going to guess it's the top result from the Google search of the forums for EFI and grsecurity? That or the wind is blowing me the wrong way down the river.

<comment><USER28> This would be really surprising and disappointing. Wind River used to be a/the major FreeBSD sponsor and is now owned by Intel. Intel of course is heavily invested in the Linux and FOSS community.

<comment><USER29> Intel's commitment is to specific products and technologies that it has determined are either in great market demand or are checkbox items in support of its other products. The company has no affinity whatsoever to Free Software or Open Source ideals, and most of its products are closed-source and protected with extremely restrictive licenses. This is especially true in the space at issue here; Intel does not make its firmware available under anything resembling Open Source terms. The same applies to its CPU microcode, most of its specifications, and the large body of tooling used by OEMs and embedded developers (much of which is not only closed but Windows-only). Intel is committed to supporting GNU/Linux distributions offered by its partners or as demanded by the market at large, but in general it remains an extremely closed, secretive vendor.

<comment><USER28> They run the open source technology center ([http://01.org](http://01.org)). Even if their actual goal is exploitation, why would they even blink at 5 figures a year to sponsor this group vs. giving their lawyers something to do and risking exposure like this?

</comment></comment></comment></comment></comment><comment><USER30> It's not clear to me that he has any case at all with the trademark. You don't get to dictate how everyone uses your trademark. Some uses are acceptable without permission:

"Usually it is permissible to use another person's or company's trademark or service mark when referring to a product or service of that person or company, provided it is clear that the mark is being used truthfully to refer to that specific product or service. It may not be used in a way that might mislead others as to that person's or company's affiliation with, sponsorship of or endorsement of your company or its products or services—for example, using a logo instead of simply the word form of the mark, or using the mark more prominently or frequently than necessary." [1]

This appears to be how Wind River is using it.

[1] [http://www.inta.org/TrademarkBasics/FactSheets/Pages/Tradema...](http://www.inta.org/TrademarkBasics/FactSheets/Pages/TrademarkUseFactSheet.aspx)

<comment><USER6> Agreed. I could see this being possible with a pre-existing trademark policy, and an explicitly different trademark for "test quality" code, and being very careful about it all, but otherwise I just don't see it. Trademark is to correctly identify the source of a good, and the source here is identified correctly. If it was creative commons licensed, they would be required to do what they have done.

Not only all that, it seems like this is a bit strange that their complaint is that they called it grsecurity without using a blessed version, so their response is to stop giving out blessed versions publicly. Won't that just encourage more companies to do exactly what they are complaining about?

<comment><USER31> > Won't that just encourage more companies to do exactly what they are > complaining about?

It will become much harder for any company to argue the they are using grsecurity if they are not a sponsor since it is not public disseminated any more.

This should give their lawyers considerable more leverage and the offending company's lawyers are more likely to warn discourage stone walling the grsecurity team since the company will be in a weaker position.

<comment><USER6> I see. This plus an official trademark policy might help.

</comment></comment></comment></comment><comment><USER32> [https://www.google.com/search?q=grsecurity+forum+patch+porte...](https://www.google.com/search?q=grsecurity+forum+patch+ported)

</comment><comment><USER23> That's a shame. :(

Also a shame that it's probably going to be way too expensive to lawyer up something like the Firefox an RedHat style of trademark protection (where forks (or even re-compiles) must use off-label branding). :(

Also a shame that the companies in question can't even be named (and shamed)...

<comment><USER33> Veriphone [https://forums.grsecurity.net/viewtopic.php?f=3&t=3938&p=139...](https://forums.grsecurity.net/viewtopic.php?f=3&t=3938&p=13940#p13940)

There, shamed. Easy.

</comment></comment><comment><USER34> There are a lot of people complaining about a future w/o grsecurity and I share your feelings. However I was surprised to see that nobody has mentioned that you and I can also donate to the project.

Yes, it sucks that MegaCorp and InnoTrode are not compensating Grsecurity for the work. Its probably just as shitty that I have used grsecurity for as long as I have and just got around to donating to the project. If you use grsecurity and don't want to see it disappear go donate. Grsecurity accepts paypal/bitcoin/dwolla:

[https://grsecurity.net/contribute.php](https://grsecurity.net/contribute.php)

</comment><comment><USER35> Naive question: can't EFF help?

<comment><USER24> Linus should've helped. But they don't want to merge patches to the kernel. Use OpenBSD.

<comment><USER33> To be frank, the grsecurity folks and Brad in particular aren't exactly nice to others or trying the get stuff merged in the right way, so they don't get a lot of support from the kernel folks.

Most of the time Brad is shaming kernel devs and saying they're all idiots.

<comment><USER36> > To be frank, the grsecurity folks and Brad in particular aren't exactly nice > to others or trying the get stuff merged in the right way, so they don't get > a lot of support from the kernel folks.

Linus "I am not a nice person, deal with it" Torvalds is upset because someone else is a ranty meany about him? Heaven forbid!

<comment><USER37> Brad doesn't throw personal attacks and insults around like Linus anyway. Plain spoken criticism of actions and ideas is not a personal attack. He tends to strongly disagree with the upstream kernel developers on issues related to security and what pisses them off is that his criticism is fair and accurate. They should be embarrassed about the state of security (and stability...) in vanilla, and they get offended when it's pointed out.

<comment><USER38> _Brad doesn 't throw personal attacks and insults around like Linus anyway. Plain spoken criticism of actions and ideas is not a personal attack._

Quoted below: Plainly spoken criticism of action and ideas

        The real question the news articles should be asking is why the embedded
        industry as a whole is scum and why everyone has problems w/ them

[https://twitter.com/grsecurity/status/636873270285967361](https://twitter.com/grsecurity/status/636873270285967361)

</comment></comment></comment></comment></comment></comment><comment><USER39> I want to add something. I am sure that it will get obliterated by other people. I am not with anyone that uses grsecurity.

On the one hand I can imagine nothing more bitter than other people making money on your hard work.

However, isnt this how the whole thing goes? I mean there wouldn't be a linux kernel without the work of a whole bunch of companies. Did they get sponsorship money from you? grsecurity wouldn't exist without the work of a bunch of other people. Did grsecurity pass on money to other vendors that they rely on? What about people that wrote the drivers that grsecurity use when they did development.

Open source only works because people contribute to a shared base. In return for their contributions they get to use what others already contributed.

<comment><USER13> It seems like you've missed the point. The problem isn't that companies are using the work without paying. The problem is that the unnamed companies are essentially lying in their marketing and violating the grsec trademark in the process.

This is not how FLOSS is supposed to go.

<comment><USER39> Why do you think they are lying? Did the companies use not apply the grsecurity patches but claim they did?

If they did apply the patches AND used the grsecurity trademark in their brochures what is the problem? They arent misrepresenting grsecurity. They arent being derogatory in any way. Why can't you say that you have the kernel and you applied grsecurity patches?

It seems so funny when people are all about GPL code and "freedom" and yet act so precious about a "trademark" just like proprietary enterprises.

<comment><USER7> The whole point of trademark law is that the owner of the trademark gets to control how it's used in commerce. If the mark is being used to advertise a company's product, grsecurity has the right to prohibit it; the company doesn't get to make the call.

This isn't a free-speech issue -- it's just a simple acknowledgement of the fact that consumers treat names, logos, branding etc. as indicators of a product's origin, and that there's a public interest in making those indicators accurate. You can refer to the trademark as long as you don't do so in a way that misrepresents your product. In this case, unless there are specific disclaimers to the contrary, a reasonable person would think "grsecurity" means "code released and approved by the grsecurity team", instead of a version that a third party has modified.

</comment></comment></comment></comment><comment><USER40> Can we as a society stop ripping off open source developers?

Companies that do are essentially stealing from artisans to build infrastructure to defraud the poor so they can horde wealth.

<comment><USER41> Actual GPL violations are bad. If actual trademark infringement happened (the blog post presents the company's counterarguement as to whether or not that happened, and I neither know enough about the law to assess the competing claims or know enough about the situation to know whether or not the blogpost fairly represented the counterarguement), that's bad.

But "[not] bother[ing] to hire us to perform the port properly for them or to actively maintain the security of the kernel they're providing to their paid customers" isn't ripping off the developers or stealing from artisans. Nor is "not contribut[ing] a single dime toward our continued development and maintenance." None of those things are required by the GPL. If you want to sell software, and if you want to get pissed when people use your software without paying you for it, choose a license that requires people to pay you for your software.

(And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? The unmitigated gall factor here is stronger than most of these kinds of rants that I've seen, because they're not even the upstream.)

<comment><USER36> > And exactly how much money has GRsecurity paid to the developers of the > kernel they're patching?

They've donated a lot more mockery than money, I would think.

It's a good point.

<comment><USER37> The Linux kernel wouldn't have features like ASLR, protected_{hardlinks,symlinks}, dmesg_restrict, kptr_restrict, ptrace_scope and lots more if not for PaX/grsecurity.

The fact that pipacs and spender no longer spend their time pushing stuff upstream doesn't mean that upstream doesn't benefit in a huge way from grsecurity via others like Kees Cook who are willing to deal with the politics.

grsecurity doesn't violate the Linux trademark or licensing. It's not a good point at all. You wonder why they don't contribute upstream directly? It has a lot to do with this entitled attitude.</comment></comment></comment></comment>


Ask HN: Where do you put your blogs? - <AUTHOR> I'm thinking of doing some blogging on a pretty casual basis and it's got me wondering where people post their blogs.
For me, I don't think I'd be blogging frequently enough or with enough of a common theme to warrant setting up my own site. Instead, something like Medium springs to mind as an option - although I'm aware they've had some bad press recently.
So bloggers of HN, where do you put your blogs? <comment><USER2> I put my blog on my own site. I think it's worth doing that even if you don't update your blog frequently. For such a blog, you can get commercial hosting for about $5/mo that includes a WordPress installation.

Whatever you do, though, please don't use Medium!

<comment><USER3> Why no for Medium?

<comment><USER4> Not GP but I have some opinions as well. I would've been a Medium advocate several years ago. But all the things they've done in the past few years have been hostile to writers.

1\. Got rid of custom domains, so you have to use a medium.com one. So if you're hoping to start a blog using Medium as a platform/engine but with your own domain, this is a dealbreaker.

2\. Even if you have hundreds of followers, publishing an article on Medium does nothing about surfacing it to any of these followers. Your best bet to distribute the article is still posting on HN and Reddit or Twitter/FB.

3\. On a related note, if you're hoping Medium would bring you traffic, it's 100% up to their editorial if they would feature your post on their homepage, email, etc. Probably best not to bet on it.

4\. Various UI and UX issues pile up over the years. When you open a Medium article on a mobile on a fresh browser nowadays, you're likely faced with enough popups that cover more than half the screen. It's just not nice.

5\. Most people hate their paywall. I don't have a strong opinion here myself.

TBH, most of the draw near the beginning of Medium was how easy it was to start an account and just write stuff, and the writing interface is nice. There has been a number of open source JS projects since then to emulate the Medium editor. IMO there really isn't any reason for anyone new to start on Medium anymore.

</comment></comment></comment><comment><USER5> Digital Ocean and Hugo. The blog content is on GitHub, and I can pull/push from my local machine or my DO instance.

</comment><comment><USER6> Over the past couple of years, I've found it useful to shell out the ~$10/month for a Squarespace site and host my content there.

Wordpress is great too, though isn't as plug-and-play as you might expect.

I would avoid the temptation to build & host your own site, as your goal is to _blog_, not code.

Also, consider capturing email addresses and sending all of your new posts to your subscribers.

It's very motivating to see a small, but growing list of people who want you send them everything you write.

Here's the simple design I use if you want to replicate it: [https://stewfortier.com/subscribe](https://stewfortier.com/subscribe) (it gets about a 30% conversion rate)

Happy writing!

</comment><comment><USER7> Personal blog or business blog?

If personal, any self-hosted platform will work (WordPress, blogger.com, or Webflow).

If business, you can post articles on your site. Some well-known marketers only post once a month. But they do a ton of promotion + optimize to rank in search. From what I've observed, it's not necessary to keep a consistent posting schedule, but it helps in other ways like building up the habit. More in-depth content tends to increase search traffic. That's why you'll see bigger brands like Shopify write a ton of articles daily.

The advantage of using another platform is it gives you the possibility you'll get some of their traffic if you understand their system.

</comment><comment><USER8> I started one of my blogs on Blogger.com, but now I self host them with WordPress on my own server.

In my opinion, don't worry about your platform. Use something that works. The bigger issue is how to get your blog found. And whatever platforms you use, your URL structure should be maintained so that links don't rot and readers can still find you. I made the mistake of going from blogger.com to self- hosted WordPress. I should have just started with WordPress.

<comment><AUTHOR> Thanks for the advice about blogger vs WordPress, I was considering blogger for a while but guess I'll pass over that one

</comment></comment><comment><USER9> Just recently started hosting a static VuePress site out of AWS S3.

I wrote a post about it here: [https://www.ethanaa.com/blog/conversion-to- static-site-with-...](https://www.ethanaa.com/blog/conversion-to-static-site- with-vuepress-and-aws-s3)

</comment><comment><USER10> I can create a blog to anyone who wants one for their own using gatsby, netlify cms and github pages. It will be free to use and host. People can access your blog via your-blog-name.github.io. I won't charge for it for the first 10 people who reach out.

<comment><USER11> I don't think you're targeting the right people here, everything you listed is free, and the majority of the readers on this site can get that set up on their own.

<comment><USER12> The Dropbox comment all over again

</comment></comment></comment><comment><USER13> I use Hugo and Netlify to host my "blog" of sorts.

[https://thechipcollective.com/](https://thechipcollective.com/)

</comment><comment><USER14> Self hosted Wordpress on a DigitalOcean VPS for $5/Month. I even have a single file bash script that I run to install everything in 5 mins on a barebone VPS.

</comment><comment><USER15> Pelican (Bootstrap3), cheap 512MB VPS, GoatAccess for analytical , and Github for update:uploading. Total cost 39.00/year.

</comment><comment><USER16> Netlify and a static site generator

</comment><comment><USER17> [https://epiphany.pub](https://epiphany.pub)

</comment><comment><USER18> Medium is the easiest to get going

</comment><comment><USER19> Hugo and S3 with CloudFront

</comment><comment><USER20> medium and journal</comment>


NSA Technology Transfer Program – 2014 Technology Catalog [pdf] - <AUTHOR> https://www.nsa.gov/research/_files/tech_transfers/nsa_technology_transfer_program.pdf <comment><USER2> I reject the idea that one should have to pay to license technology developed by a (taxpayer funded) federal agency. If tax dollars funded it, it belongs to all of us anyway.

I believe I'm going to write my Congressional reps later today and suggest pushing for the elimination of licensing fees for tech from NSA, NASA, DOD, etc. I'm sure it won't go anywhere, but what can ya do?

<comment><USER3> Indeed, the entire mechanism should be available to the general public for use, or in other words - entirely radical thinking - why don't we defeat the NSA by demanding it open-source itself, 100%? After all, it might make all the difference in the world if maximum intelligence was suddenly and irrevocably available to every single living human on the planet .. its actually within our grasp, as a species, to share such a moment. Gimme root, NSA.

<comment><USER4> Giving your enemies all your tech is not wise. Thankfully hipster dufuses have no real power.

<comment><USER3> Too bad the makers of enemies seem to think they're the only ones who can be trusted with power.

<comment><USER5> Show me a powerful nation without enemies.

<comment><USER3> Maybe we wouldn't have so many enemies if we didn't keep so many secrets.

</comment></comment></comment></comment></comment></comment><comment><USER6> Some of the nuggets:

"Digital Transcription System" (that can handle foreign languages). This would be awesome to release OSS. Finally the tech giants wouldn't have a monopoly on good voice recognition.

"All Fiber Optically-Controlled Optical Switch" So they have all they need to make optical processors/routers. If this is the declassified tech, it's time to start paying attention to [http://pqcrypto.org/](http://pqcrypto.org/)

"Port Protector Assembly for D-Sub Connectors" I haven't heard of much spying happening by someone hooking something up to an unused DVI port. Good to know.

</comment><comment><USER7> One of their offering under technology is converting computer programs with loops to ones without loops. Can anyone help me understand what the point of that is?

<comment><USER8> To make it easier to reason about whether the program will terminate. This is an important part of writing high-assurance software.

From the actual patent text ([https://www.google.com/patents/US7788659](https://www.google.com/patents/US7788659)): "Because of the possibility of looping and branching within loops, a brute force attempt to enumerate the paths through a computer program will most likely fail. Therefore, there is a need for a method of converting a computer program that contains loops to one that does not."

More info: [https://en.wikipedia.org/wiki/Termination_analysis](https://en.wikipedia.org/wiki/Termination_analysis)

</comment></comment><comment><USER9> Another interesting one, I won't post any more. Can anyone think of a current consumer use of a technique like this? Those Garmin GPS/Radios that track each other is the closest I can think of:

DETERMINE RANGE AND VELOCITY OF AN OBJECT PATENT NOS.: 7,755,536 AND 7,545,325

This method provides the ability to determine the position and velocity of a transmitter over a wide range of bandwidths. The second invention models the Doppler process as a time shift and change of scale of the original signal. In this process, the received signal is delayed in time and dilated. In this invention, the method of performing the resampling function is to apply a forward Fourier transform of one length to the zero-padded signal and apply an inverse Fourier transform of a different length to the results of the first transform. This pair of operations results in a resampling of the signal at a rational multiple of the original sample rate. The scale correlation is then computed as the normal correlation of the transmitted signal and the resampled signal.

VALUE Accurate model of Doppler process Rational signal resampling

</comment><comment><USER10> COLLISION FREE HASHING FOR NEAR MATCH INPUTS on page 14 looks interesting. [http://www.google.com/patents/US8355501](http://www.google.com/patents/US8355501)

This could help improve performance for data stores in general.

</comment><comment><USER9> Interesting, didn't know they were into manufacturing techniques, maybe they license to their own exclusive fab contracts:

FABRICATING AND INTEGRATING DECOUPLING CAPACITORS PATENT NO.: 7,297,613 This technology provides a method of fabrication and integration for high quality decoupling capacitors with high capacitance values, low parasitic losses, good yield, and long-term reliability. This method enables high-yielding capacitors and other passive elements to be placed very close to the processor or other integrated circuit design and provides improved signal integrity. VALUE

[Value:] Reduced signal loss and footprint Reduced cost and increased yields for RF systems

<comment><USER11> The NSA has its own small fab, and they are definitely into manufacturing techniques, because they build their own architectures :)

</comment></comment><comment><USER12> Patent 7,945,947

lol, they patented a privilege escalation rootkit

<comment><USER12> Technology Transfer Program S ecurity | Page 63 P ROVIDING A C OMPUTER U SER WITH H IGH -L EVEL P RIVILEDGES P ATENT N O .: 7,945,947 This invention monitors all terminal sessions i n an operating system, su ch as Microsoft' s Windows ® , for a special key sequence and if found, launches a command shell running with high privileges for use by the logged-on user, regardless of which user it was and without requiring subsequent authenticati on. The advantage of this method is that it allows any user to launch a command shell with high privileges even though the user may only have few privileges, and does not require a login with a username and password to be entered each time. VALUE Allows user to launch privileged command shells Simple command for authentication reduces user input

<comment><USER9> I was confused about this one. It appears that it may be for systems only where an authorized server with admin rights is running. I'll have to read more to be sure.

Edit: Upon more reading from ([https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&...](https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&sa=X&ei=u6olVL_ZM4-GyASdzYKgAQ&ved=0CB8Q6AEwAA))

It appears to be non-specific, but an admin computer is needed.

[A] user-definable process is associated to the terminal services session. The user-definable process is selected so that the process can interact with the user connected to that terminal services session and can identify all the desktops registered in the terminal services session that the user-definable process is running in.

[...]

Again, by example, once a process has registered a low-level keyboard hook on a desktop, it is notified of all keystrokes that occur when the input for the keyboard would go to that desktop. Each Vista system prompt service process examines the keystrokes and if the user-definable key sequence (such as CTRL-F10) was pressed, the system performs the action of creating a command shell running as the LocalSystem account.

</comment></comment></comment><comment><USER13> If your government isn't going to engage in commercial espionage on your business or employers behalf (as does China) then it darn well better do technology transfer. If you can't explain your mission value to the American public - whom you happen to be spying on - you could at least articulate this kind of value that can impact citizens in a positive way. IMHO they should double down on this and allocate funds for start-ups ala inQtel.

<comment><USER14> I'm confused, either you are claiming France and China don't conduct commercial espionage or that the US doesn't, in either case I disagree. All three conduct commercial espionage for the "right" corporate clients.

</comment></comment><comment><USER15> Also [http://www.dailydot.com/politics/nsa-technology-transfer- pro...](http://www.dailydot.com/politics/nsa-technology-transfer-program- national-security-agency-ttp/), via [https://news.ycombinator.com/item?id=8373728](https://news.ycombinator.com/item?id=8373728).

</comment><comment><USER16> These all have patents issued, so this is good idea of the state of the art at NSA _4 to 6 years ago_.

</comment><comment><USER17> Reminds me of the Made In India site that was posted the other day. Except the output of NSA is more.

</comment><comment><USER18> ScribeZone is a rip off of Pied Piper!</comment>


Protothreads – Lightweight, Stackless Threads in C - e-sushi http://dunkels.com/adam/pt/ <comment><AUTHOR> It's an application of Duff's Device co-routines. This is handy for event driven parsers.</comment>


Here's How Americans Spend Their Time, Sorted by Income - <AUTHOR> http://www.visualcapitalist.com/americans-spend-time-income/ <comment><USER2> I really wanted this to include time spent working.</comment>


Websocket gets an update - the details. - <AUTHOR> http://axod.blogspot.com/2010/06/websocket-gets-update-and-it-breaks.html

<comment><USER2> It's as I feared: What was previously a nearly-compatible-with-HTTP, dead- simple protocol, looks to have become confusingly, unnecessarily complex. Like XMPP.

It will catch on because _it's all we've got_ , but we're going to shove yet another mediocre protocol onto the stack of protocols servers need to speak in addition to HTTP.

The people working on this have spent time understanding the problem domain better than I have. But I really hope they've thought this protocol through. Because we'll be stuck with it for a _long time_.

<comment><USER3> A lot of bad protocols exist because people didn't think it through enough and a lot of bad protocols exist because people thought it through too much.

The protocol is a bit more readable here: [http://tools.ietf.org/html/draft- hixie-thewebsocketprotocol-...](http://tools.ietf.org/html/draft-hixie- thewebsocketprotocol-76)

The security protocol does seem a little strange: putting numbers into the fields interspersed with random characters and spaces, taking the numbers and dividing them by the number of space characters, and using _2_ fields to make harder. There's a lot of dancing here to ensure that the protocol is implemented correctly.

</comment></comment><comment><USER4> What was wrong with requiring a "101 Switching Protocols" response to an "Upgrade" request? Forcing the server to run four full rounds of MD5 just to demonstrate that it actually implements a protocol is absurd. And reordering fields to prove the server is indifferent to ordering belongs in an integration test for the server, not a real client.

When the Internet works, it's thanks to Postel's Law, which is the polar opposite of designing a protocol to maximize the likelihood of failure.

<comment><USER5> Postel's Law works when everyone follows it, but it's unstable. At some point somebody will be liberal in what he sends and conservative in what he accepts and everyone else will end up working around his bugs forever. This can even lead to a ratcheting effect over time as people use less and less of the protocol to avoid previous bugs.

This leads us to Ruby's Corollary[1]: Be exact in what you send and liberal in what you accept. Since programmers will neither read the spec nor run the test suite, you should build real implementations that exercise every facet of the spec (e.g. randomize anything that doesn't matter). The only way to interoperate with such implementations is to do things more or less correctly.

[1] After Sam Ruby, who inserts test cases into his blog to encourage browsers and feed readers to work better.

<comment><USER4> His end users deserve better. He's wilfully confronting them with interop failures they aren't in a position to understand, much less do anything about. Testing is a burden which should be borne by developers.

<comment><USER5> This kind of interop error should be seen and fixed in the earliest development and should never reach users; that's the point of deliberately triggering it.

</comment></comment></comment></comment><comment><USER6> Seems a little harsh, - it's written somewhat badly, but the comments about endianness are important - sure, a randomly generated 64-bit integer encoded as big-endian is, entropically speaking, no more useful than it's little- endian brother. It's also useless all by itself. As part of a system though, like a challenge/response system, it's important both ends of the system know how to interpret the data they are dealing with - so this is important.

At that point, defining the fact that you are sending a big-endian 64-bit integer It might seem trivial now that we write everything in Java, but endianness caused _all kinds_ of portability problems in the early internet days when we started making different systems talk to each other, and made simple porting jobs difficult. It's how we ended up with network-byte-order instead of just using long ints and stuff like that - it's very easy to overlook.

In short, being specific about data formats matters.

And yeah, it would suck if they over-complicate things - let's not let that happen - we need simple protocols, but not too simple. It's okay if you can slightly abuse them if it means fast adoption (One can coax HTTP servers to sign into IRC and spam channels - but it's not a big enough problem to warrant redesigning the whole thing, right?)

<comment><AUTHOR> > " it's important both ends of the system know how to interpret the data they > are dealing with - so this is important."

As I say, it's treated, by both sides, as 8 bytes of random data. Never as integers. The endianness here is irrelevant. The spec is going into _way_ more detail than it needs.

</comment></comment><comment><USER7> When it goes over the network it has to be big-endian so both sides agree on the value. That's why we call it "network order".

If the value is random and you send the low byte first and then treat that as the high byte it would work. I can't imagine that ever being useful, but it works as long as both sides agree that that [FE, ED, FA, CE] is 0xFEEDFACE.

If your RNG gives you 0xFEEDFACE you better not send it out as [CE, FA, ED, FE] or you're going to make a mess of things. Host byte order is completely irrelevant.

<comment><AUTHOR> The endianness here is irrelevant. It's 8 bytes of random data.

My point was, that generating a random 64bit integer and storing it as little endian, would infact work fine. Because the 8 bytes of random data is only used in the context of "8 bytes of random data", and never as "an integer" by both sides.

The spec is just ridiculously _overly_ specific. It's telling us how you can generate 8 bytes of random data. Any programmer implementing it should have a vague idea how to do that.

<comment><USER7> I completely understand your frustration with the over-specification. Why would they send it over the wire if it was never meant to be used though? Surely the other side is interpreting these bytes somehow and excepts them in a certain order.

[ a bit later ... ]

I decided to check the spec and see for myself what's going on. The part you're talking about, key3, is in fact used later. The bytes may be random but both sides need to know which of the 8 bytes comes first and which comes last.

        Let /challenge/ be the concatenation of /number_1/, expressed as
        a big-endian 32 bit integer, /number_2/, expressed as a big-
        endian 32 bit integer, and the eight bytes of /key_3/ in the
        order they were sent on the wire.

If the other side doesn't agree on the order of the bytes in key3 then things are not going to work. Your other complaints may be valid but sometimes this sort of over-specification helps implementers.

</comment></comment></comment><comment> mike-cardwell I'm not sure if it matters that the protocol is complex. A few people will write libraries which expose a simple interface, so the vast majority of people developing with WebSockets wont have to worry about this stuff.

What _really_ matters, is that the protocol is secure, efficient and extensible. If it needs to be more complex in order to meet those criteria, then fine...

</comment><comment><USER8> I actually spent some time reading that spec yesterday while hunting a bug. I was trying to figure out if maybe we were violating the protocol in some way.

I'm not enough of an expert to weigh in, but the spec did make me chuckle. Super verbose with a dash of paranoia.

This is pretty funny (although gregw has written many longer and more detailed essays about websockets as well):

<https://bugs.eclipse.org/bugs/show_bug.cgi?id=294563>

In the end, we located the bug within our code connecting jetty's websocket support to our message passing system. You can bet that was an adventure to sort out. =)

</comment><comment><USER9> _Why couldn't the spec just include the 'meat'. It's a simple protocol which can be summed up in a page or two. The current spec runs to 55 pages!_

Be glad you don't study law! It's practically written in a different language to everyday, pragmatic English. Specs and math papers can descend to similar levels of readability, though RFCs, on the whole, tend to (in comparison) be quite readable IMHO.

</comment><comment><USER7> After browsing through the spec a little I can't take axod's claims seriously. He's way off the mark saying that endianness of values sent over the network doesn't matter. The fact that they are random bytes is irrelevant, they have meaning even if they are generated randomly.

If you don't understand the point of sending values over the wire in a known order then I'm sorry but I don't trust your ability to properly evaluate the rest of the spec either.

axod: I don't mean this as a personal attack but considering your strong opinions on this I'd expect you to have thought about it more diligently.</comment>


How can a senior engineer maximize compensation without becoming "management"? - <AUTHOR> Good friend of mine is on the job hunt, but has come to the realization that he doesn't want to be a VP/engineering manager, he just wants to code. His concern is getting stuck at lower salary ceilings. Any advice I can share back? <comment><USER2> How low is he worried about?

$200k+ (total comp) for an IC isn't rare. Google, Facebook, Netflix, etc. will all get an experienced senior engineer well into that range.

<comment><USER3> I manage a small team, with people in the valley. Every year I talk to people I know at places like Netflix, Google, etc, to make sure I'm compensating my people well.

Last year the .01% of engineers, the best of the best, people that Apple, Google, Facebook, Netflix seek out and recruit, topped out at $325K for their total comp (salary, health plan, 401K match, bonuses, everything).

Bear in mind that these are the best people, people that can code, can communicate, can ship. Most people don't make this because they are not this good, which is fine. I'm just letting you know how high you can go if you are very, very good at engineering. It's kinda cool, when I was an IC, there was a pretty hard ceiling at about $150K, if you wanted more than that you had to manage.

Also bear in mind that I'm a single source and may have gotten the wrong info (though if that's the case I'd love to be corrected, I use this info for how I comp my people).

<comment><USER4> What's that 325k in take home base pay?

<comment><USER2> One data point (not me): Netflix @ $290k salary.

</comment></comment></comment></comment><comment><USER5> As a full-time employee in the purely technical track, greater responsibility and pay would come through architectural and design roles.

If he really just wants to code, the best way to maximize income would just be develop a career as a consultant rather than a staff engineer. The biggest opportunities for writing code for a ton of money are in a few intense roles, usually associated with R&D on a core product. It's not easy to stumble into those opportunities, and if your friend had the skills to go down that path, he'd already know.

</comment><comment><USER6> One of the best pieces of advice I ever got was from the Dilbert cartoonist. His advice that you can either be in the top 5% at one thing or the top 25% at two things.

Most engineers I mentor make the "mistake" of only focusing on being good at "programming". There is nothing wrong with it, but I'd argue that there is a much lower ceiling than if you were an expert at both programming in general and some niche topic.

In my case I'd say math is the other leg I specialize in, with market micro structure being a close third.

In the general case it could be something like SEO, visual design, or a particular industry like logistics.

The other way to make more is to be closer to the money. If you are developing a product then you are considered a cost center, ie a negative on cash flow not a positive. Sales on the other hand is often the canonical example of a boundless upper limit on compensation as they can directly draw a line from incoming revenue to themselves.

Don't be a programmer, be an engineer who can solve real world business problems. Even better be able to draw a straight line from your work to incoming revenue!

</comment><comment><USER7> It depends how good he is... At a top company, a top "coding" engineer can make a lot of money. But, many people who are not even close to "top" think they are in fact, "top".

<comment><USER8> Perhaps it's the Dunning-Kruger effect?

[http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect](http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect)

</comment></comment><comment><USER9> There's room between "he just wants to code" and management. Primary skills I'd focus on are learning strong communication skills and understanding the business, and dev-ops.

<comment><USER10> This. Some actual things we all do to improve our value but not become people persons:

Mentoring and training employees with less technical skill. Reviewing workflow and looking for ways to "work smarter not harder". Developing tools which help us internally. Prototyping ideas which could become customer-facing value- adds. Finding ways separate parts of the business can help each other. One group will do something another group doesn't, how could having that insight help the second group and vice versa?

</comment></comment><comment><USER11> It can be done but you still have to work hard to achieve this. For example you will have to make a name for yourself outside of your regular work. For example become a Microsoft MVP or similar. Contribute or create projects that are recognised by people in your industry.

Effectively you have to become like a well known actor. So that when someone is starting a project ('movie') they want to hire you for it no matter the cost.

<comment><USER11> [http://www.kalzumeus.com/2015/05/01/talking-about- money/](http://www.kalzumeus.com/2015/05/01/talking-about-money/)

Reading this might also be useful.

</comment></comment><comment><USER12> In 99% of software engineering positions, the ability to code, above a certain threshold, matters less than your ability to communicate, your domain knowledge, your professionalism, and your ability to ship.

If he "just wants to code," he's going to get stuck. If he wants to be a software professional, the sky is the limit for skilled individuals.</comment>